MontraFolio gives every user of the site an image portfolio of their own, and lets staff run shared portfolios \u2014 events, trips, campaigns \u2014 with designated contributors.<\/p>\n\n
Interface in English, Portuguese and Spanish<\/strong>, independently of the WordPress language.<\/p><\/li>\n In any page of the theme.<\/strong> Three blocks, each with a shortcode: a collection with its lightbox, the collections of a portfolio, and the descriptions of either.<\/p><\/li>\n Everything described above is in this version and covered by tests: the portfolio area (sign-in, content terms, portfolios, collections, contributors, uploads, limits), the private storage and the image delivery, the public pages and the three blocks with their shortcodes, the wp-admin management screens (the portfolios list with its filters, creation of assigned portfolios, editing, owner change, rename with redirect, contributors, limits, suspension, deletion, storage report, regeneration of the derived sizes), the permissions by role, the personal data exporter and eraser, the retention rule with its notice, and the accessibility and performance passes.<\/p>\n\n This plugin connects to four video services, and only when somebody uses the video feature. Nothing else on the site ever contacts them, and with every service switched off in Settings \u2192 Videos<\/strong> no request is made at all.<\/p>\n\n When an owner or a contributor adds a video<\/strong> by pasting its address, the site asks that service's public oEmbed endpoint about the address, to learn the title and the address of the thumbnail. What is sent is the address that was pasted and the site's own address, in the request; the thumbnail is then downloaded once and stored on this site. Nothing about the visitor is involved: this happens while somebody is administering a collection.<\/p>\n\n When a visitor presses play<\/strong> on a video, that visitor's browser loads the player from the service, which receives their IP address and whatever their browser sends, and may set cookies. Until play is pressed nothing is requested, unless the site turns Load the video only when the visitor presses play<\/em> off.<\/p>\n\n Linked videos contact nobody.<\/strong> The networks the Link a video<\/em> feature points at \u2014 Instagram, Facebook, LinkedIn, and whichever else a site adds to the list \u2014 are not<\/strong> external services of this plugin: no request is ever made to them, at any moment, by the site or by the pages it serves. The address is stored as text and the picture is one the site uploaded itself. A visitor who presses the link goes there under their own steam, exactly as they would follow any link written in any post.<\/p>\n\n The services, with their terms and their privacy policies:<\/p>\n\n Everything this plugin ships is its source. The JavaScript and the CSS under The translations are not carried in the package: WordPress.org delivers them as language packs, and\na site that wants a language nobody has published yet drops the catalog into\n wp-content\/languages\/plugins.<\/p>\n\n No usage data, no domain, no versions: the plugin never reports anything about your site to anybody, and updates come from WordPress.org through the normal WordPress mechanism. The single exception is videos, and only where somebody uses them: adding a video asks its service for the title and the thumbnail, and playing one loads it from that service. Both are listed under External services below.<\/p><\/dd>\n Yes \u2014 YouTube, Vimeo, Dailymotion or TikTok, by pasting the address of the video. It becomes an item of the collection like an image: same order, same caption, same observation, and it can even be the cover. Nothing of the video is stored on your site except its thumbnail, which counts as one image against the collection's limits. Each service can be switched off in Settings \u2192 Videos<\/strong>, and switching them all off removes the feature from the portfolio area.<\/p><\/dd>\n Those cannot be played inside your pages, and this plugin does not pretend otherwise. Since 2020 Meta answers the Facebook and Instagram oEmbed only to an application registered with Meta, which a plugin installed on sites it knows nothing about cannot be; LinkedIn never published an endpoint at all. So there is no title and no thumbnail to fetch \u2014 and nothing is fetched.<\/p>\n\n Instead there is Link a video<\/strong>: you paste the address and choose a picture of your own for the card. It takes its place in the collection like any other item, and the card opens the address in a new tab. Those networks are never contacted by your site, at any moment, so no script of theirs runs on your pages and no visitor's address reaches them until that visitor chooses to go. The accepted networks are a list you can edit in Settings \u2192 Videos<\/strong>.<\/p><\/dd>\n Not until they choose to be. With Load the video only when the visitor presses play<\/em> on \u2014 which is how it is installed \u2014 a public page showing a video makes no request at all to the video service: the visitor sees the thumbnail stored on your own server, and a notice saying what pressing play will load. Only then is the player loaded \u2014 and it starts playing right away, because pressing play is the gesture browsers ask for before a video may start, so one press is all it takes. YouTube is played from youtube-nocookie.com unless you say otherwise, Vimeo is asked not to keep a session about the viewer, and the text of the notice is yours to write.<\/p><\/dd>\n No. Users sign in with their WordPress accounts on the plugin's own page. A single sign-on plugin (Microsoft Entra ID, LDAP and others) is optional and plugs into the WordPress login pipeline.<\/p><\/dd>\n In No. Owners and contributors work in p-admin, a page of the plugin at the address chosen in Settings ( Yes, with three blocks \u2014 MontraFolio - Collection<\/strong> (the gallery), MontraFolio - Details<\/strong> (the descriptions) and MontraFolio - Portfolio<\/strong> (the list of collections) \u2014 or their shortcodes, The owner name shown on a portfolio and the owner e-mail kept with it, which is never published (copied from the profile, editable by the site staff without changing the account), which account made each contributor designation and each upload, the file name an image had on the device, the content terms accepted (version and date) and the date of the last activity in the portfolio area. Images are stored without camera metadata. Tools \u2192 Export Personal Data<\/strong> includes all of it. Tools \u2192 Erase Personal Data<\/strong> deletes the personal portfolio with its images, releases assigned portfolios without touching their content, removes the account's designations, anonymises the uploader and the device file name of images in other portfolios, and keeps only the acceptance of the content terms, as the proof that what is still published was uploaded under them. Nothing is sent to another server.<\/p><\/dd>\n If the person deleting the account attributes its content to another user, that user receives every portfolio of the deleted one. Otherwise Settings \u2192 Privacy<\/strong> decides for the personal portfolio (delete it with its images, or hand it to a chosen account), and assigned portfolios wait for a new owner. Optionally, a retention period removes the personal portfolios of users with no activity for that long: the portfolio is marked, its owner is written to, the portfolio area offers a button that keeps it, any use of it takes the mark off, and only after the notice period (a year by default) is it deleted.<\/p><\/dd>\n Yes, at four levels. Settings<\/strong> decides what a new portfolio and a new collection start with. A manager holding set the limits of a portfolio<\/em> then gives each portfolio its own storage and image ceilings in wp-admin; the owner sees that ceiling and, in the portfolio area, may narrow any collection and any contributor within it. A level set to 0 has no limit of its own and follows the level above. Changing a limit never deletes anything: it decides what the next upload may add, and the meter each person sees is whichever level runs out first for them.<\/p><\/dd>\n Yes \u2014 see the blocks above. Beyond that, the pages the plugin serves itself (the sign-in, the content terms, the portfolio area, the public gallery) are documents it writes whole, without the theme's header and footer: that is what lets a public image be answered before the theme even loads. A site adds what it needs to them through three actions of the plugin \u2014 No. A photo bigger than one request can carry is sent in parts and put back together on the\nserver, exactly as a backup file is. The only limit that can make a photo smaller is the one in\nSettings \u2192 Uploads<\/strong>, which is yours to choose. Nothing in the plugin asks you to change a PHP\nsetting, and it never lowers quality to fit your host's.<\/p><\/dd>\n They are accepted everywhere, and nothing has to be configured for it. Safari converts them itself; every other browser converts them with libheif, which the plugin loads on the device only when such a photo appears. A server whose Imagick was built with HEIC support converts them too, which is only faster; Tools \u2192 Site Health \u2192 Info \u2192 Media Handling<\/em> says whether yours was.<\/p><\/dd>\n\n<\/dl>\n\n\n The name is written MontraFolio<\/strong>, with a capital F. It reads that way wherever the plugin names itself: the header WordPress shows, the titles of the three blocks in the editor, the menu of wp-admin, the settings screens, the export and the erasure of personal data, and the line above the title of the pages the plugin serves, for sites that did not put a name of their own there.<\/p>\n\n MontraFolio.<\/strong> The plugin carries its name through everything it names: the blocks, the REST addresses, the folder the images live in and the graphics.<\/p>\n\n The REST addresses are Translations now come from WordPress.org instead of travelling inside the plugin.<\/strong> They are delivered as language packs and installed into Nothing a visitor sees was changed by this version, and nothing needs doing on update.<\/p>\n\n First version published on WordPress.org.<\/p>\n\n What it is: portfolios of images for an organisation, one for each person who wants one and as\nmany shared ones as the staff need; collections shown as tiles or as a carousel; images kept in\na private folder the plugin serves itself, never in the Media Library; uploads from a phone's\ncamera, resized on the device before they travel; limits at four levels; videos hosted elsewhere\nadded beside the images without a visitor being handed to anybody until they press play; a portfolio\narea built for a phone, and management screens in wp-admin for whoever runs the site; the personal\ndata export and erasure of WordPress, a retention rule for portfolios nobody uses any more, and no\ntelemetry of any kind.<\/p>\n\n The development that got here \u2014 fifteen versions, from 0.5.0 to 0.9.5 \u2014 is in External services<\/h3>\n\n
\n
https:\/\/www.youtube.com\/oembed<\/code>, player on youtube-nocookie.com<\/code> or youtube.com<\/code>) \u2014 terms https:\/\/www.youtube.com\/t\/terms \u00b7 privacy https:\/\/policies.google.com\/privacy<\/li>\nhttps:\/\/vimeo.com\/api\/oembed.json<\/code>, player on player.vimeo.com<\/code>) \u2014 terms https:\/\/vimeo.com\/terms \u00b7 privacy https:\/\/vimeo.com\/privacy<\/li>\nhttps:\/\/www.dailymotion.com\/services\/oembed<\/code>, player on geo.dailymotion.com<\/code>) \u2014 terms https:\/\/legal.dailymotion.com\/en\/terms-of-use\/ \u00b7 privacy https:\/\/legal.dailymotion.com\/en\/privacy-policy\/<\/li>\nhttps:\/\/www.tiktok.com\/oembed<\/code>, player on tiktok.com<\/code>) \u2014 terms https:\/\/www.tiktok.com\/legal\/terms-of-service \u00b7 privacy https:\/\/www.tiktok.com\/legal\/privacy-policy<\/li>\n<\/ul>\n\nSource code<\/h3>\n\n
assets\/<\/code> are written\nby hand and served exactly as they are written: there is no build step, no bundler and no minifier,\nso what runs in a browser is the file you can open in the plugin's folder. Nothing here is generated\nfrom something kept elsewhere. The only compiled files are the two third-party libraries below, and\neach is named with the address of its own source.<\/p>\n\nThird-party code<\/h3>\n\n
\n
assets\/vendor\/libheif\/libheif.js<\/code> (Emscripten glue, minified) and assets\/vendor\/libheif\/libheif.wasm<\/code> (the compiled library); the sources are at https:\/\/github.com\/strukturag\/libheif and the build that produces these files at https:\/\/github.com\/catdad-experiments\/libheif-js<\/li>\n<\/ul>\n\n\n\n
\/wp-content\/plugins\/<\/code> or install it from the Plugins screen.<\/li>\n\n
Does the plugin send any data anywhere?<\/h3><\/dt>\n
Can I put a YouTube video in a collection?<\/h3><\/dt>\n
What about a video on Instagram, Facebook or LinkedIn?<\/h3><\/dt>\n
Do my visitors get tracked by the video services?<\/h3><\/dt>\n
Do I need another plugin to sign in?<\/h3><\/dt>\n
Where are the images stored?<\/h3><\/dt>\n
wp-content\/uploads\/montrafolio\/<\/code>, a folder protected against direct access on Apache and IIS. On nginx, add the location<\/code> rule described in the manual; the unguessable file names and the delivery through the plugin remain the real defence.<\/p><\/dd>\nDo users need wp-admin?<\/h3><\/dt>\n
\/p-admin\/<\/code> by default). Users with nothing beyond a reading role land there after signing in and never see wp-admin.<\/p><\/dd>\nCan I show a portfolio inside a page of my theme?<\/h3><\/dt>\n
[mtfl_collection portfolio=\"ana\" collection=\"trip\"]<\/code>, [mtfl_details]<\/code> and [mtfl_portfolio]<\/code>. The portfolio is picked on the block itself. The Collection block presents it as tiles, as a carousel or as both, inheriting what the owner proposed when it is not told otherwise; a list of collections can point each line at the same page, so that one page holds the list and the gallery of whichever collection the visitor picks.<\/p><\/dd>\nWhat personal data does the plugin store, and can users export it?<\/h3><\/dt>\n
What happens to a portfolio when its user is deleted?<\/h3><\/dt>\n
Can I limit how much each person uploads?<\/h3><\/dt>\n
Can I put a portfolio inside a page of my theme?<\/h3><\/dt>\n
mtfl_page_head<\/code>, mtfl_page_body_start<\/code> and mtfl_page_footer<\/code> \u2014 each given the context of the page, so a consent banner or an analytics script can be placed where the site means it and kept off the sign-in page. The public pages carry their own Open Graph and Twitter tags, built from the title, the description and the cover.<\/p><\/dd>\nMy host only allows 2 MB uploads. Do I have to change that?<\/h3><\/dt>\n
What about HEIC photos from an iPhone?<\/h3><\/dt>\n
1.1.3<\/h4>\n\n
\n
block.json<\/code>, and the translation catalog did not carry them, so they stayed in English whatever the language of the site. The catalog now holds them, with the title and description written there too, and a language pack translates them along with everything else.<\/li>\n?name={portfolio}<\/code> and ?name={collection}<\/code> \u2014 used angle brackets, which translators and their tools took for HTML and asked to keep untouched. Braces say what they mean: put the name of the parameter here and the address there, in any language.<\/li>\n<\/ul>\n\n1.1.2<\/h4>\n\n
\n
block.json<\/code>, the file the directory reads \u2014 so the Blocks<\/em> section of the plugin page tells what MontraFolio - Details<\/em>, - Portfolio<\/em> and - Collection<\/em> each do, instead of listing only their names. Nothing changes in the editor: the same titles, the same descriptions and the same mark as before.<\/li>\n<\/ul>\n\n1.1.1<\/h4>\n\n
\n
1.1.0<\/h4>\n\n
\n
[mtfl_collection]<\/code>, [mtfl_details]<\/code>, [mtfl_portfolio]<\/code>. A page built with an earlier set shows the blocks as unrecognised, and an earlier shortcode prints nothing, until each is written with these names.<\/li>\nuploads\/montrafolio<\/code><\/strong>, and an earlier one is renamed to it on the first request after the update. Nothing is copied and nothing is rebuilt \u2014 the folder is renamed with everything in it, and the images go on being served from the same addresses. A site that named its own folder is left alone. In the one case where the rename cannot be done, every screen of the plugin says so plainly, names both folders and says that nothing was deleted.<\/li>\nmontrafolio\/v1<\/code>.<\/strong> Only something written against them by hand would notice.<\/p><\/li>\nwp-content\/languages\/plugins<\/code>, the folder WordPress keeps for them \u2014 which means a translation now survives an update of the plugin instead of being replaced by it, and a site can put a language of its own in that same folder for a language nobody has published yet. Settings \u2192 Plugin \u2192 Plugin language<\/em>, which makes the plugin speak a language the rest of the site does not, reads from there too; a language that is not installed reads in English. Until the packs for a language exist, the plugin reads in English unless its file is placed by hand \u2014 the manual says how.<\/p><\/li>\n1.0.1<\/h4>\n\n
\n
1.0.0<\/h4>\n\n
changelog.txt<\/code>.<\/p>","raw_excerpt":"Image portfolios for organisations: every user can have one, staff run shared ones with designated contributors, and images stay in a private folder.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/369007","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=369007"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/luismiggarcia"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=369007"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=369007"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=369007"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=369007"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=369007"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=369007"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}