Summary
Recommended security update for all users. This release strengthens campaign permissions and previews, improves feed validation and support for private or local feed addresses, and makes campaign editing respect the permissions of the user performing the changes.
Security
- Campaign run logs, previews, item previews, and XML node reading now verify that the current user has the appropriate permissions before displaying or processing campaign data.
- Links to campaign logs and previews are now tied to the campaign they belong to, and the “See Log” action is shown only to users who are allowed to open that campaign.
- Campaign and item previews now escape displayed content safely. Unusual markup from a feed is shown as text instead of being executed, while normal feed formatting, images, links, lists, tables, and video embeds continue to render as before. Allowed preview tags can be extended with the new
wpematico_preview_item_allowed_htmlfilter.
Improved
- Feeds published on the public internet continue to work normally. Sites that need to read feeds from private networks, intranets, or localhost can now enable “Allow feeds on private and local addresses” under WPeMatico > Tools > Danger Zone. Feeds hosted on the same site continue to work without additional configuration.
- Feed URLs are now validated before every fetch. Invalid addresses that are not valid
http://orhttps://URLs are reported clearly in the campaign log instead of producing a confusing parser error later. - A new
wpematico_allow_internal_feedsfilter allows a specific feed on a private address without enabling private and local feeds site-wide. - Campaigns now respect the permissions of the user editing them. Users who cannot publish posts save the campaign with “Pending review”, while users who cannot assign posts to other users save it under their own name. Both changes are reported on screen after saving. Administrators and editors continue to work as before.
- The same permission rules now determine how much feed markup is preserved. Administrators and editors can keep unfiltered HTML, including embeds. Campaigns last edited by users without that permission use the same filtering WordPress applies to that user’s posts. Campaigns created before this release keep their existing behavior.
- The WordPress content filter used during post insertion is now restored immediately after each imported post. A manual campaign run no longer leaves a filter active that could affect other content saved during the same request.
- The “Word to Category” field is now properly escaped when a campaign is reopened, so words and regular expressions containing markup are displayed exactly as entered. The stored values and regular expression matching remain unchanged.
Fixed
- Fixed an issue where the WordPress content filter used during an imported post could remain active after the post was inserted, potentially affecting other content saved during the same request.
Recommendation
Recommended for all users — update as soon as possible. This release is especially relevant for sites using multiple authors or editors, private or local feed sources, campaign previews, or custom feed markup.