Upvimeo — Direct Uploads for Vimeo

Changelog

1.6.32

• Update: Changed Text Domain to upvimeo-direct-uploads for WP.org compliance.

1.6.31

• Refactor: Removed local asset overrides to natively rely on the Freemius API for product branding.

1.6.29

• Fix: Hardened native WordPress update logo injection to guarantee trailing slashes via plugin_dir_url().

1.6.28

• Enhancement: Bypassed API cache to enforce local logo rendering for native WordPress update screens.

1.6.27

• Enhancement: Bypassed API cache to enforce local logo rendering for Freemius pricing page and WordPress sidebar.

1.6.26

• Security: Added strict path traversal validation to chunked video uploads. Fix: Purged unpermitted vendor shell scripts from the distribution archive.

1.6.25

• Fix: Adopted official WP.org recommended display name (‘Upvimeo — Direct Uploads for Vimeo’) and slug structure to comply with directory trademark guidelines, while verifying full compatibility with WordPress 7.0.

1.6.23

• Maintenance: Updated Freemius SDK to version 2.13.4 for improved stability and security.

1.6.22

Fix: Physically extracted the final residual trialware string from the settings helper to ensure 100% compliance with WP.org automated repository scanners.

1.6.21

Fix: Synchronized and updated ‘Tested up to’ (7.0) and ‘Requires PHP’ (7.4) headers across main plugin file and readme for full WP.org directory compliance.

1.6.20

Fix: Finalized strict CSS/DOM namespace isolation and completely extracted residual premium option strings from Free core logic to comply with WP.org automated scanners.

1.6.19

• Maintenance: Normalized file line endings for strict PHPCS compliance and optimized internal file segregation.

1.6.18

• Fix: Migrated all premium integrations to a hard file-segregation architecture to guarantee 100% physical codebase compliance with WP.org guidelines.

1.6.17

• Fix: Restructured internal Freemius compiler tags to guarantee 100% physical extraction of premium code from the Free distribution.

1.6.16

• Fix: Physically stripped remaining premium-only frontend configuration settings and UI elements from the free distribution to strictly comply with WP.org Trialware guidelines.

1.6.15

• Maintenance: Updated Freemius SDK to version 2.13.3 for improved compatibility and security.

1.6.14

• Fix: Unified AJAX capability routing to resolve Guest/Subscriber permission conflicts and enforced unconditional database cleanup upon uninstallation.

1.6.13

• Fix: Implemented context-aware AJAX capability routing for frontend/backend uploads and finalized trialware data isolation.

1.6.12

• Security hardening of chunk-upload routing endpoints and complete extraction of unused frontend option configurations from the core dashboard.

1.6.11

• Fix: Removed non-functional frontend upload UI settings from the free dashboard to comply with WP.org Trialware guidelines.

1.6.10

• Fix: Excluded development testing scripts (install-wp-tests.sh) from the distribution package to comply with WP.org repository guidelines.

1.6.9

• Security: Added late escaping for view helpers.
• Fix: Enforced strict JavaScript and DOM prefixing for WP.org compliance.
• Fix: Corrected Freemius logic stripping integration.

1.6.8

• Fix: Aligned plugin header names to resolve WP.org Plugin Check (PCP) mismatch warning.

1.6.7

• Security hardening and refactored naming architecture.

1.6.6

• Feature: Added a new setting “Force Vimeo Only” for Tutor LMS. When enabled, it locks the lesson video source to Vimeo and displays a “This platform uploads to Vimeo only” message, streamlining the instructor upload experience.

1.6.5

• Fix: Resolved Composer autoloader fatal error by restoring required production polyfills (symfony/polyfill-mbstring and related packages) that were incorrectly stripped by over-broad .distignore rules.

1.6.4

• Security: Wrapped shortcode output in wp_kses() with explicit iframe allow-list (XSS hardening).
• Security: Updated SweetAlert2 from v11.1.4 to v11.26.25.
• Fix: Changed admin menu position from 5 to 85 to avoid conflicts with core WordPress menu items.
• Refactor: Added upvimeo_video as canonical shortcode tag; old tags (upv_vimeo_video, vimeo_video, UPVIMEO_vimeo_video) kept as deprecated backward-compat aliases.
• Build: Hardened .distignore and .gitattributes to strip all dev-only Composer packages from distribution builds.
• Build: Added upload-modal.source.js documentation to == Source Code == section.

1.6.3

• Compatibility: Tested and verified compatible with WordPress 7.0 “Armstrong”.
• Maintenance: Updated Tested up to header to 7.0 to reflect verified compatibility.

1.6.2

• Build: Hardened .distignore to exclude shell scripts (*.sh) and vendor package test/dev artifacts (tests, .github, docs, phpunit configuration, composer files) from the WordPress.org distribution build. Resolves wp.org rejection caused by .sh fixtures inside third-party Composer dependencies (squizlabs/php_codesniffer, symfony/mime).

1.6.1

• Security: OWASP Top 10 audit — fixed SSRF vulnerability in Vimeo thumbnail fetching by enforcing HTTPS and validating CDN hostnames before any outbound request.
• Security: Patched path traversal risk in chunk-upload file removal; realpath() bounds check now confirms the target file stays inside the tmp directory.
• Security: Fixed authentication-check order in all chunk-upload AJAX handlers — current_user_can() now runs before nonce verification and input parsing.
• Security: Temporary upload directory now creates an index.html guard on first access to prevent directory listing.
• Security: Added esc_url() and absint() escaping to Vimeo link and attachment IDs in the media library helper (XSS hardening).
• Security: Removed <script> tag from wp_kses allowed HTML list in admin class.
• Fix: Removed ob_start() / ob_get_clean() bootstrap wrapper that silently swallowed PHP errors and warnings during plugin load.
• Fix: Implemented full upvimeo_fs_uninstall_cleanup() — plugin now correctly deletes all options, upvimeo-upload posts, and transients on uninstall.
• Fix: UPVIMEO_MIN_PHP_VERSION constant corrected from 7.3.0 to 7.4.0 to match the Requires PHP header declaration.
• Fix: wp_die() message on missing vendor dependencies is now escaped with esc_html__() and translatable.
• Fix: Replaced current_user_can('administrator') (role name) with current_user_can('manage_options') (capability) per WordPress coding standards.
• Fix: Removed double json_encode() wrapping inside wp_send_json_success() in the attachment-delete AJAX handler.
• Fix: Added public visibility modifier to plugin_action_links() method in the admin class.
• Build: Removed Update URI plugin header to eliminate WP.org Plugin Check (PCP) plugin_updater_detected error; Freemius SDK handles Pro updates independently.
• Build: Updated .distignore and .gitattributes with a comprehensive exclusion list to strip all development artifacts from distribution builds.

1.6.0

• Fix: Addressed persistent 403 “Sorry, you are not allowed to access this page” error by restoring native Freemius capability routing.
• Refactor: Replaced destructive menu unsetting techniques with non-intrusive CSS/JS UI manipulation to safely hide duplicate pricing tabs.

1.5.9

• Fix: Resolved fatal error (TypeError: urlencode()) by removing invalid custom redirect logic for the Freemius trial banner.
• Fix: Natively corrected the Freemius trial banner 403 error by enabling proper pricing menu registration in the SDK configuration.

1.5.8

• Fix: Resolved WordPress.org Plugin Check (PCP) deployment failure by excluding hidden files from build.
• Fix: Suppressed broken Freemius trial UI banner preventing 403 errors.

1.5.7

• Security: Comprehensive security audit, fortified AJAX endpoints with strict capability checks and nonces.
• Security: Enhanced SQL injection protection by strictly enforcing $wpdb->prepare for database interactions.
• Security: Implemented strict late-escaping guidelines via wp_kses_post and native HTML esc_ functions for all outputs.
• Enhancement: Optimized deployment configuration by refining .distignore and Freemius Update URI logic for repository compliance.

1.5.6

• Fix: Resolved a fatal Server Error (TypeError: ftp_pwd()) during WP-Cron or CLI headless executions by safely refactoring directory verification logic.

1.5.5

• Fix: Corrected the SDK inclusion path to utilize the updated Composer package instead of a legacy directory.

1.5.3

• Fix: Resolved a minor bug.

1.5.2

• Feature: Added 14-day free trial configuration without upfront payment requirement.

1.5.1

• Enhancement: Minor deployment configuration updates to exclude composer.lock from the final build.

1.5.0

• Security: Added comprehensive CSRF protection with strict Nonce verification across all AJAX and form handlers.
• Security: Fortified data processing with strict unslashing and sanitization for all global inputs ($_POST, $_GET, $_FILES) to prevent Stored XSS vulnerabilities.
• Security: Enhanced output escaping for frontend views, HTML attributes, and Exception messages to prevent Reflected XSS.
• Bug Fix: Resolved an issue where uploaded videos incorrectly defaulted to “Embed Anywhere” instead of accurately inheriting the user’s specific Vimeo privacy presets (e.g., “Specific domains”).
• Refactor: Prefixed global variables (e.g., $upvimeo_option, $upvimeo_content) to prevent namespace collisions with WordPress core and third-party plugins/themes.
• Refactor: Migrated native PHP rename() operations to the standard WP_Filesystem::move() API for improved cross-server compatibility.
• Cleanup: Removed deprecated Freemius Update URI headers to ensure WordPress.org repository compliance.
• Cleanup: Standardized line endings to LF across all files and removed residual debugging code (print_r(), error_log()).

1.4.12

• Fix: Resolved “No PHP code was found” PHPCS warning by adding standard Silence is golden string to empty PHP file.
• Security: Comprehensive security and compliance audit resolving remaining WordPress.org Plugin Check (PCP) violations.
• Security: Fortified file inclusion with ABSPATH checks and replaced native filesystem functions with WP_Filesystem API.
• Security: Enhanced Freemius Pro build separation using explicit premium file exclusion tags.
• Security: Resolved late escaping, CSRF nonce verification, and missing input sanitization warnings across AJAX handlers and integrations.

1.4.11

• Refactor: Eliminated un-prefixed global variables in template partials for compliance with WordPress coding standards.
• Refactor: Refactored data passing to use the load_template() $args parameter natively.
• Refactor: Prefixed all local variables across admin and public partials with $upvimeo_ to prevent namespace conflicts.

1.4.10

• Fix: Repaired the custom Upvimeo promotional banner on the ‘Add Plugins’ screen by correcting the broken image source and updating the “Read Setup Guide” target URL.
• Fix: Fixed broken Upvimeo logo paths on the Settings and Library Upload admin pages by dynamically generating properly escaped URLs.
• Fix: Prevented WP Rocket and other caching plugins from lazy-loading Upvimeo logos on admin pages which caused them to appear broken.

1.4.9

• Enhancement: Upgraded Freemius SDK to version 2.13.1.
• Fix: Addressed an issue where the Upvimeo admin menu icon disappeared by directly embedding a base64 encoded SVG asset.

1.4.8

• Enhancement: Optimized build process for WordPress.org repository compliance.
• Enhancement: Updated Freemius SDK configuration for standard Free/Pro distributions.
• Refactor: Moved SweetAlert2 library to the shared assets directory matching WP best practices.
• Fix: Updated .distignore to properly exclude development artifacts from distribution builds.

1.4.7

• Fix: Resolved undefined method error for is_account_tier_free check.
• Refactor: Updated Vimeo API checks to comply with WP.org guidelines.
• Refactor: Improved prefixing guidelines implementation.
• Fix: Resolved Upload Icon Bug (SyntaxError: Identifier ‘fields’ has already been declared).
• Fix: Fixed HTML Comment Issue behind the “upload new” button.
• Refactor: Enhanced WordPress late-escaping guidelines compliance.
• Refactor: Optimized $_FILES iteration to prevent unintended processing.
• Refactor: Upgraded sanitization and escaping for superglobals ($_SERVER, $_REQUEST, $_POST, $_FILES).
• Fix: Handled Video Upload Errors (403 Forbidden on AJAX request).

1.4.6

• Fix: Addressed an orphaned admin_footer hook causing a fatal error in the admin dashboard.
• Fix: Resolved an issue where the Freemius Account page displayed “Free version” despite having an active Pro plan by dynamically checking the UPVIMEO_IS_PRO constant.

1.4.5

• Fix: Resolved the black screen issue and missing titles in the video editor.
• Fix: Fixed WPCS Regressions resulting in “Visible Code” bugs and missing UI elements.
• Fix: Addressed an “Undefined variable $dir” error in helpers.php.
• Fix: Fixed a fatal error in the pricing page by removing invalid Freemius SDK calls.
• Security: Ensured proper Freemius Pro feature validation and implemented fallback UI for expired licenses.
• Refactor: Global clean-up removing development artifacts and prefixing variables.
• Refactor: Modernized Welcome Screen with a new Hero Banner layout and conditional Free/Pro CTAs.
• Maintenance: Fixed automated plugin scan issues including load_plugin_textdomain and readme metadata.

1.4.4

• Fix: Resolved UI alignment issues and corrected CSS flex layouts for the admin Welcome / Setup instructions card.

1.4.3

• Security: Comprehensive WordPress Coding Standards (WPCS) audit and fixes across the entire codebase.
• Prefixing: Ensured all global variables, functions, and hooks are properly prefixed with upvimeo_.
• I18n: Added missing text domains and translator comments for improved localization.
• System: Replaced native unlink() with WordPress-standard wp_delete_file() for better file system handling.
• Integrations: Hardened security checks (Nonce verification) and data sanitization for ACF, Gravity Forms, WPForms, and Custom Forms.

1.4.2

• Fix: Removed Update URI to comply with WordPress.org guidelines.
• Fix: Resolved Author URI mismatch issue for directory submission.
• Refactor: Separated Pro features (including Freemius SDK) into a dedicated folder strictly for the Premium version.
• Optimization: Cleaned up unnecessary development artifacts from the main plugin distribution.

1.4.1

• Enhancement: Updated Gravity Forms upload field with modern UI (Drag & Drop, Progress Bar).
• Security: Hardened input sanitization for form integrations.

1.4.0

• Security: Comprehensive audit; hardened sanitization and SQL query preparation.
• Performance: Implemented database query caching.

1.3.9

• New: Completely redesigned WPForms upload field with a modern, card-style UI.
• Improvement: Added real-time upload percentage display.
• Improvement: Enhanced progress bar visualization and spacing.
• Fix: Resolved issue with progress bar visibility on some themes.
• Fix: Refined Gravity Forms upload field styling (Modern UI, clean container).
• Fix: Fixed LearnDash upload modal progress bar percentage visibility.

1.3.8

• FIX: Refined Gravity Forms upload field styling (Modern UI, white card, blue button).
• FIX: Refined WPForms upload field styling (Modern UI, white card, blue button).
• FIX: Removed green checkmark circle from success state in both Gravity Forms and WPForms.
• FIX: Improved success UI (progress bar turns green on complete).
• FIX: Fixed LearnDash upload modal progress bar percentage visibility/positioning.

1.3.7

• Fix: LearnDash Integration: Resolved issue where video URL was saved as a player.vimeo.com link instead of the standard vimeo.com format, ensuring correct embed rendering.

1.3.6

• Fix: Elementor Compatibility: Resolved “Infinite Loading” loop in Elementor Editor by implementing comprehensive safety guards across all integrations (TutorLMS, LearnDash, Gravity Forms, WPForms, ACF).
• Fix: Performance: Prevented heavy upload scripts from loading in Elementor Editor to improve performance and stability.

1.3.5

• Enhancement: Gravity Forms UI Modernization: Completely refreshed the upload field with a clean container, smooth gradient progress bar, and animated success checkmark.
• Fix: TUS Upload Reliability: Implemented synchronous upload fallback for Gravity Forms to resolve background process failures on certain hosts (localhost/staging).
• Fix: License Validation: relaxed strict Pro license checks to allow smoother uploads on local development environments.
• Maintenance: Removed legacy debug logging for better performance and security.

1.3.4

• Enhancement: LearnDash Integration: Automatically inserts video URL into “Video URL” field after upload.
• Fix: Privacy Conflict: Resolved issue where “Hide from Vimeo” videos displayed as empty windows by enabling embed permissions.
• Fix: LMS Compatibility: Updated URL format to player.vimeo.com for better LMS preview compatibility.
• Enhancement: UI/UX: Improved Upload Modal responsiveness and styling for a modern look.
• Security: Verified upload handling and privacy permission logic.

1.3.3

• Security: Fixed potential XSS in admin settings by sanitizing output.
• Security: Enhanced input validation and JSON handling in AJAX actions.

1.3.2

• Fix: Resolved “Infinite Loading” loop in Elementor Editor by adding robust safety guards.
• Fix: Resolved “Access Denied” error on Pricing/Account pages for Pro users.
• Fix: Resolved potential PHP fatal error in admin class regarding db_helper.
• Security: Comprehensive OWASP Top 10 security audit and validation.

1.3.0

• New: Brand New Welcome Experience: Completely redesigned Setup Guide with enhanced visuals and clearer instructions.
• Enhancement: Modernized UI: Major design updates to the “Upgrade to Pro” page, giving it a premium look and feel.
• Fix: Upgrade Page Loading: Resolved an issue where pricing tables would sometimes fail to load on the Free version.
• Enhancement: Logo & Branding: Improved Upvimeo logo visibility and positioning across the admin dashboard.
• Enhancement: Button UX: Refined button sizing and hit areas for a better user experience on high-DPI screens.
• Fix: Minor CSS adjustments for better compatibility with third-party admin themes.

1.2.13

• Enhancement: Improved Admin Dashboard stability and menu performance.
• Enhancement: Optimized admin menu structure for a cleaner, more professional workspace.
• Enhancement: Redesigned the Welcome / Setup banner for better responsiveness on smaller screens.
• Fix: Resolved minor UI inconsistencies in the settings area.

1.2.12

• Fix: Resolved CSS loading consistency on the Account page.
• Fix: Improved layout rendering for Account Details header.

1.2.11

• Fix: TutorLMS integration – fixed progress bar visibility issue.

1.2.10

• Fix: TutorLMS integration – automated field visibility interactions.

1.2.9

• Enhancement: Major UI Overhaul: Modernized User Interface with card-based design and improved typography.
• Security: Comprehensive security audit and hardening (OWASP standards).
• Enhancement: Improved handling of Vimeo domain fetching for various plan types.

1.2.8

• Enhancement: Modernized Gutenberg block UI.
• Fix: Improved TUS protocol stability for large files.

1.2.7

• Security: Admin interface hardening and escaping verification.
• Security: Enhanced API error handling.

1.2.6

• Enhancement: Complete Admin Interface refresh.
• Enhancement: Gravity Forms UI improvements.
• Fix: Admin menu positioning fixes.

1.2.4

• Fix: WPForms success message race condition resolved.
• Stability: Process Manager optimization.

1.2.3

• Enhancement: WPForms styling updates.
• Fix: Builder rendering improvements.

1.2.0

• Enhancement: Unified Account management interface.
• Fix: Menu structure optimization.

1.0.0

• Initial Release.