Thisismyurl Dashboard Notice Control

Changelog

1.6226

• First release published through the WordPress.org plugin directory. Nothing in the plugin changed to make that happen; the code here is the code the Plugin Review Team approved.
• Tested against WordPress 7.1. Every item in the 7.1 field guide was checked against this plugin: the post editor now always running inside an iframe, client-side media processing, the @wordpress/components updates, the persistent toolbar in the post and site editors, the new SVG icon API, the jQuery UI update to 1.14.2, and the Abilities API changes. This plugin registers no editor assets, no scripts of its own, no icons, and no abilities, and it never touches image processing, so none of those changes reach it.
• Verified on 7.1 rather than assumed: suppression, the settings-screen exemption, the per-plugin allowlist, the constant and filter override paths, the administrator bypass, and the WP-CLI status command were each exercised on a 7.1 install with WP_DEBUG on, with no notices, warnings, or deprecations logged. Plugin Check reported no errors at severity 1 with experimental checks included.

1.6206.1519

• When the on/off state is pinned by a PHP constant, the settings screen now states that state in plain text instead of rendering a checkbox that cannot take effect. That removes the last inline JavaScript from the plugin, and closes a case where a visitor with JavaScript disabled could move the checkbox and save the opposite of what the screen displayed.
• The settings screen now reports the state that actually governs the site rather than the stored option value, so it can no longer show “on” while notices are visibly showing. This covers the thisismyurl_dashboard_notice_control_enabled filter as well as the constant, and the screen now names whichever one is overriding it.
• Saving the allowlist while the on/off state is overridden in code no longer rewrites your stored preference to match the override. If you chose “on” and a constant later pinned it off, removing that constant gives you “on” back.
• The allowlist field is now programmatically associated with its instructions, so a screen reader announces them when you tab into the field rather than leaving you to go looking.
• When the state is overridden in code, the screen now names its own subject (“Notice suppression is on…”) instead of opening with a bare “On.”, which did not stand on its own when read aloud.
• The notice-hiding CSS and the optional auto-dismiss script are now registered and enqueued through wp_enqueue_style()/wp_add_inline_style() and wp_enqueue_script()/wp_add_inline_script() instead of being echoed from admin_head and admin_footer. Both are addressable by handle, so another plugin can dequeue them.
• The admin-bar indicator now reflects per-screen exemptions. Without this it would report “Notices: hidden” on a screen where notices were plainly visible.
• This plugin’s own settings screen is now exempt from suppression by default, so saving the allowlist shows its “Settings saved.” confirmation instead of appearing to do nothing.
• Allowlist directory prefixes are resolved once per request rather than once per notice callback per slug.
• Hardened the allowlist against malformed array callbacks, which could emit a PHP warning before reflection caught them.
• Added a per-screen exemption filter (thisismyurl_dashboard_notice_control_suppress_on_screen) so notices can stay visible on chosen screens without disabling the plugin.
• Added a read-only WP-CLI status command reporting suppression state, constants, and the allowlist.
• Notice removal now runs on current_screen rather than admin_init. WordPress fires admin_init before set_current_screen(), so the screen was not yet known; the new timing still runs before any notice renders and catches every callback the old timing caught.
• Fixed the settings page storing the opposite of what it displayed when the enable/disable state is pinned by a PHP constant. A disabled checkbox is not submitted by the browser, so saving the allowlist wrote suppression OFF while the screen showed it ON — surfacing only once the constant was removed.
• Fixed the per-plugin allowlist never matching for plugins installed via symlink or junction (Bedrock, Composer-managed installs, and some development setups). Reflection resolves the real path, so those plugins reported a location outside the plugins directory and were silently never allowlisted.
• The pinned on/off control now stays reachable by keyboard and screen reader, and its explanation is programmatically associated with the checkbox.
• Corrected the settings-page save button label: the form saves the on/off switch as well as the allowlist.
• Added an on/off switch to the settings page. Suppression could previously only be disabled with a PHP constant, which is no help to a site owner who cannot edit wp-config.php. A constant or filter still overrides the setting.
• Fixed the per-plugin allowlist never matching on Windows hosts: reflection returns an OS-native path, so the hard-coded “/plugins/” comparison never matched a backslash path and the allowlist was silently inert. Paths are now normalised, and the match is anchored to the real plugins directory instead of matching anywhere in the path.
• Corrected the plugin description: it said notices are “automatically dismissed”, but JS auto-dismiss is opt-in and off by default. The description now states what the plugin does out of the box.
• Removed the sponsorship link from the plugins-row action links.
• Uninstall now clears options on every site in a multisite network, not only the one that ran the deletion.
• Renamed the plugin to “Thisismyurl Dashboard Notice Control” (slug thisismyurl-dashboard-notice-control) per WordPress.org Plugin Review Team feedback: the previous name led with a generic phrase and was not distinctive enough for the admin-notices category.
• Renamed every public identifier to match the new slug: class, constants, hooks and filters, the allowlist option, the settings-page slug, the bypass query vars, the text domain, and the main plugin filename.
• Plugin URI now points at the plugin’s home page.
• Fixed an activation fatal: the enable/bypass gates ran at plugin-include time (before pluggable functions exist), causing a 500 on activation. The gates now evaluate at hook time.
• Otherwise no functional change: the per-plugin allowlist, network-notice filter, and bypass behave exactly as in 1.6174.1641.

1.6174.1641

• Added Settings > Thisismyurl Dashboard Notice Control settings page (menu slug thisismyurl-dashboard-notice-control-settings).
• Added per-plugin allowlist: enter plugin slugs whose notices should pass through suppression.
• Allowlist stored in option thisismyurl_dashboard_notice_control_allowlist; each slug sanitized via sanitize_key().
• Callback allowlist check uses ReflectionFunction / ReflectionMethod to resolve source file paths.
• Added “Settings” link to plugin action links row.
• Security: replaced esc_html() with a CSS-selector character allowlist regex for inline style output.
• Added autoload => false to register_setting() for the allowlist option (the autoload argument is honoured on WordPress 6.6 and later; on 6.0-6.5 it is ignored and the option autoloads).
• Added uninstall.php to clean up options on plugin deletion.
• Added .distignore to exclude .git/, CHANGELOG.md, README.md from distribution zip.

1.6158

• CSS context: replaced esc_html() with wp_strip_all_tags() for inline style selector output (correct escaping context for a style block).
• Version constant: synchronised VERSION class constant with plugin header on every release.

1.6148

• Security: the administrator bypass URL now requires a valid nonce on every path. The previous nonce-less fallback made the nonce-protected bypass claim decorative.
• Multisite: network-scoped notice suppression (network_admin_notices, user_admin_notices) is now gated behind the thisismyurl_dashboard_notice_control_suppress_network filter (defaults to true) so one site no longer silences the whole network without an opt-out.
• Support: the admin-bar item now shows whether notices are hidden or showing, so administrators can see suppression is active and don’t lose update or security nags silently.

1.6147

• Unified plugin versioning to the x.Yddd calendar-version scheme.
• Confirmed compatibility with WordPress 7.0.

1.6143

• Updated Tested up to to WordPress 7.0.
• Standardized the donation link to GitHub Sponsors.
• Added project governance files (PILLARS, CONTRIBUTING, SECURITY) and README badges.

1.6140

• Updated display name to “Thisismyurl Dashboard Notice Control”.
• Added nonce-protected bypass URLs.
• Added quick bypass shortcuts in plugin action links and admin bar.
• Version moved to calendar format 1.6NNN.

1.0.1

• Added emergency bypass (?thisismyurl_dnc_show_notices=1) for administrators.
• Added constants and filters to enable, bypass, and configure behavior.
• Disabled JS auto-dismiss by default (now opt-in).
• Scoped CSS selectors to notice contexts in #wpbody-content.
• Added accessibility and operational safety guidance to documentation.

1.0.0

• Initial release.
• Added global notice suppression for wp-admin.
• Added CSS fallback hiding for direct-rendered notices.
• Added JavaScript auto-dismiss for dismissible notices.