Manage Software Licenses With AI and Answer Key Tickets Faster
- Security: Vendor profile saving now checks permission on the account being changed, so a logged-in user can no longer change another user’s email address or details.
- Security: Restricted approved vendors from seeing other authors’ private products in store listings or editing product categories and tags.
- Security: Approving downloads from the Downloads list now requires permission to publish each one, so vendors can no longer skip store review or publish other vendors’ pending products, posts, or pages.
- Security: The vendor registration, login, and contact forms now always apply the reCAPTCHA and required fields set in the FES settings.
- Security: Limited taxonomy suggestions on vendor forms to product taxonomies, so approved vendors no longer see unrelated term names.
- Security: Prevented visitors who weren’t logged in from changing vendors’ recorded sales and earnings.
- Security: Removed old FES upgrade routines that visitors who weren’t logged in could run to delete vendor roles and create unapproved vendor records.
- Security: Restricted approved vendors to editing only the products they authored, rather than any post, page, or product.
- Security: Blocked other websites from making a user an approved vendor when a store admin visited them while logged in.
- Security: Blocked other websites from changing a vendor’s status when a store admin visited them while logged in.
- Security: Vendor display names are now made safe on the admin vendor profile, so unsafe content entered at registration no longer runs when a store admin views it.
- Security: Closed a gap on the FES tools and upgrades screens that let a crafted link run unwanted actions as the store admin who opened it.
- Security: Vendor dashboard comment replies are now posted as the replying vendor and only on their own products, and can no longer hide comments from other vendors’ dashboards.
- Security: Product files added through the vendor pricing field must now be the vendor’s own uploads or links to another site, not protected files stored on the site.
- Security: Vendors can now view a receipt only for orders containing their own products, rather than any order’s customer details, license keys, or subscriptions.
- Security: Corrected vendors list searching and sorting, which let store managers, or a crafted link opened by one, read or change data in the store’s database.
- Security: The FES login form now signs a visitor into only the account whose password they entered.
- Security: Vendor file fields now accept only media files the vendor uploaded.
- Admin: Vendor addresses are now edited in a modal.
- Admin: Vendors are now redirected away from admin screens they shouldn’t reach in every case.
- Admin: Saving a vendor profile no longer adds backslashes to names and addresses containing quotes or apostrophes.
- Forms: Fixed taxonomy term suggestions on vendor forms, which failed on PHP 8.
- i18n: Fixed a WordPress 6.7 notice about translations loading too early.
- Tools: Fixed a PHP warning when recounting vendor statistics for vendors with no products.
- Tools: Removed the outdated Pre-FES 2.4 import/export and Reset All Forms tools, and laid out the remaining Frontend Submissions tools as cards.
- Vendors: Fixed an undefined variable notice in the vendor cache.
- Dev: FES forms now refuse to save when the form ID doesn’t match the type of form being saved.
- Dev: Removed the FES 2.2 and 2.3 upgrade routines, which current installs no longer use.
- Dev: Deprecated
fes_tools_page(),fes_get_tools_tabs(), andfes_process_form_tools(); the FES tools now submit through EDD’s admin action router and requiremanage_shop_settings. - Dev: The minimum requirements are now PHP 7.4, WordPress 6.2, and EDD 3.4.0, and the addon tools library has been updated.
