Summary
Recommended security update for all users. This release tightens how feeds that redirect to another address are followed, extends the list of addresses a feed may not be read from, and makes campaigns with several feeds on the same site do less work on every run.
Security
- A feed that answers with a redirect is now followed only when the new address is one a feed may live on, applying the same rule as the address stored in the campaign. Feeds that move to another address, to
https://or to a syndication service keep working exactly as before, and the campaign log names the address where the redirect was stopped. - The addresses a feed may not be read from now also cover the ranges reserved for documentation, benchmarking and network transition, and the IPv6 forms that stand for an IPv4 address.
Improved
- Sites that read feeds from their own network can keep doing so with “Allow feeds on private and local addresses” under WPeMatico > Tools > Danger Zone, or one feed at a time with the
wpematico_allow_internal_feedsfilter. - Feeds published by the same site continue to be fetched without any configuration, on every address the site answers on.
- The post type a campaign publishes to is now stored in the exact spelling WordPress registers it under, so the post status, the post author and the markup an imported post keeps are always checked against that type and the permissions of the user saving the campaign. Bulk editing campaigns follows the same rule as editing one. Campaigns edited by administrators and editors keep working exactly as before.
- Feed addresses are now resolved once per host and per run, so a campaign with several feeds on the same site, and a multipage feed, do less work than before.
Recommendation
Recommended for all users — update as soon as possible. This release is especially relevant for sites with feeds that redirect to other addresses, feeds read from private or local networks, or campaigns edited by multiple users.