WordPress.org
Get WordPress

Plugin Directory

Changeset 3670364


Ignore:
Timestamp:
08/28/2026 12:46:46 PM (2 months ago)
Author:
sanchshevchuk
Message:

Version 1.1.9: Added row reordering UI and clarified URL mapping instructions

Location:
sanch-multidomain-ldap-auth/trunk
Files:
2 edited

Legend:

Unmodified
Added
Removed

  • sanch-multidomain-ldap-auth/trunk/readme.txt

    r3667184 r3670364  
    55Tested up to: 7.1
    66Requires PHP: 7.4
    7 Stable tag: 1.1.8
     7Stable tag: 1.1.9
    88License: GPLv2 or later
    99License URI: https://www.gnu.org/licenses/gpl-2.0.html
    … …  
    2525== Frequently Asked Questions ==
    2626
     27= Does this plugin require the PHP LDAP extension? =
     28Yes, your web server must have the `php-ldap` PHP module enabled to initiate connections with your Active Directory Domain Controllers.
     29
    2730= How does the Intranet Blacklist mode work? =
    2831First, all guests must log in. By default, all pages, categories, and posts are accessible to logged-in users. When you add a URL path or category to the plugin settings and map it to an AD Group, that path becomes restricted. Only users belonging to the mapped AD group will be able to view or edit it. If a category is restricted, all posts inside it inherit this restriction automatically.
    … …  
    3033== Changelog ==
    3134
     35= 1.1.9 =
     36* Feature: Added visual Drag/Move (Up/Down) buttons to the mapping table to easily prioritize roles (Top-to-Bottom processing).
     37* UI/UX: Clarified the instructions for URL Protection, explaining that empty URL fields are valid for Role-only assignment.
     38
    3239= 1.1.8 =
    33 * Feature: Implemented Strict Cascading ACL logic. Restricting access to a Category URL now automatically denies access to all posts belonging to that category across the frontend, REST API, and admin list tables, regardless of the post's individual permalink structure.
    34 * Performance: Optimized cascading checks by executing a direct bulk SQL query against `$wpdb->term_relationships` during transient generation, bypassing slow sequential `get_the_terms` lookups.
     40* Feature: Implemented Strict Cascading ACL logic. Restricting access to a Category URL now automatically denies access to all posts belonging to that category across the frontend, REST API, and admin list tables.
     41* Performance: Optimized cascading checks by executing a direct bulk SQL query against `$wpdb->term_relationships` during transient generation.
    3542
    3643= 1.1.7 =
    3744* Critical Bugfix: Resolved an infinite recursion loop (PHP Fatal Error: Allowed memory size exhausted) triggered by `get_terms` executing within its own cache generation filter. Added strict DB cycle guards to prevent infinite loops in malformed page trees.
    3845* Critical Bugfix: Prevented a fatal crash during AD user login by migrating from class-dependent `WP_Application_Passwords::delete_all_application_passwords()` to safe, direct core meta deletion `delete_user_meta()`.
    39 * Feature: Overhauled the UI settings to use multi-line Textareas for URL mapping inputs, allowing administrators to visually list and manage restricted routes column by column.
     46* Feature: Overhauled the UI settings to use multi-line Textareas for URL mapping inputs.
    4047
    4148= 1.1.4 =

  • sanch-multidomain-ldap-auth/trunk/sanch-multidomain-ldap-auth.php

    r3667184 r3670364  
    33 * Plugin Name:       Sanch MultiDomain LDAP Auth for Active Directory
    44 * Description:       Enterprise AD Integration: Mandatory Intranet Login, Blacklist ACL, Smart Tree Routing, and LDAP Guard.
    5  * Version:           1.1.8
     5 * Version:           1.1.9
    66 * Author:            sanchshevchuk
    77 * License:           GPL v2 or later
    … …  
    468468}
    469469
    470 // FIX 1.1.8: Strict Cascading Helper. Забороняє пост, якщо заборонена будь-яка з його категорій/міток
    471470function ad_auth_user_can_access_post($post_id) {
    472471    static $cache = [];
    … …  
    486485                $t_link = get_term_link($term);
    487486                if (!is_wp_error($t_link) && !ad_auth_user_can_access_url($t_link)) {
    488                     return ($cache[$post_id] = false); // Якщо категорія заборонена -> пост заборонено!
     487                    return ($cache[$post_id] = false);
    489488                }
    490489            }
    … …  
    547546    if (isset($post->post_author) && $post->post_author == get_current_user_id()) return $response;
    548547
    549     // FIX 1.1.8: Use the new strict cascade helper for REST API responses
    550548    if (!ad_auth_user_can_access_post($post->ID)) {
    551549        return new WP_Error('rest_forbidden_acl', __('403 Forbidden: Content restricted.', 'sanch-multidomain-ldap-auth'), ['status' => 403]);
    … …  
    572570            if ($post->post_author == $user_id) return $caps;
    573571
    574             // FIX 1.1.8: User cannot edit a post if its category is restricted
    575572            if (!ad_auth_user_can_access_post($post->ID)) {
    576573                $caps[] = 'do_not_allow';
    … …  
    630627
    631628    foreach ($pages as $page) {
    632         // FIX 1.1.8: Check page cascade too
    633629        if (ad_auth_user_can_access_post($page->ID)) {
    634630            $allowed_page_ids[$page->ID] = true;
    … …  
    785781            ));
    786782
    787             // FIX 1.1.8: Швидка перевірка заборонених категорій через SQL
    788783            $restricted_term_ids = [];
    789784            remove_filter('get_terms', 'ad_auth_filter_terms', 10);
    … …  
    804799            if (!empty($restricted_term_ids)) {
    805800                $term_ids_sql = implode(',', array_map('intval', $restricted_term_ids));
    806                 // Дістаємо всі пости, що належать до заборонених категорій
    807801                $restricted_posts_from_terms = $wpdb->get_col("
    808802                    SELECT tr.object_id
    … …  
    824818                if (empty($p->post_name) && !in_array($p->post_status, ['publish', 'private'])) continue;
    825819
    826                 // Забороняємо, якщо URL поста заборонений АБО якщо пост лежить у забороненій категорії
    827820                if (in_array($p->ID, $restricted_posts_from_terms) || !ad_auth_user_can_access_url(get_permalink($p->ID))) {
    828821                    $strict_deny[] = $p->ID;
    … …  
    915908                    } else {
    916909                        alert(strWarn);
     910                    }
     911                }
     912                if (e.target && e.target.classList.contains('move-up')) {
     913                    var row = e.target.closest('tr');
     914                    if (row.previousElementSibling) {
     915                        row.parentNode.insertBefore(row, row.previousElementSibling);
     916                    }
     917                }
     918                if (e.target && e.target.classList.contains('move-down')) {
     919                    var row = e.target.closest('tr');
     920                    if (row.nextElementSibling) {
     921                        row.parentNode.insertBefore(row.nextElementSibling, row);
    917922                    }
    918923                }
    … …  
    12081213                </div>
    12091214                <div class="inside">
    1210                     <p style="margin-top: 0; font-size: 14px;">
    1211                         <?php esc_html_e('MANDATORY LOGIN: All users must log in to access the site. Once logged in, all unmapped URLs are accessible. Map specific URLs to AD groups to RESTRICT those paths only to members of those groups.', 'sanch-multidomain-ldap-auth'); ?>
    1212                     </p>
    12131215                   
     1216                    <!-- FIX 1.1.9: Оновлений блок підказки з чітким описом роботи правил -->
    12141217                    <div class="ad-tip-box">
    1215                         <strong>💡 <?php esc_html_e('Tip - Role vs Base:', 'sanch-multidomain-ldap-auth'); ?></strong><br>
    1216                         <b><?php esc_html_e('WP Role Code', 'sanch-multidomain-ldap-auth'); ?></b> <?php esc_html_e('is the unique ID for your group (e.g., department_reader, branch_editor) used to separate access.', 'sanch-multidomain-ldap-auth'); ?><br>
    1217                         <b><?php esc_html_e('Base Role', 'sanch-multidomain-ldap-auth'); ?></b> <?php esc_html_e('grants the actual physical permissions in WordPress (e.g., selecting Editor allows them to write posts).', 'sanch-multidomain-ldap-auth'); ?>
     1218                        <strong>💡 <?php esc_html_e('How Mapping Works:', 'sanch-multidomain-ldap-auth'); ?></strong><br>
     1219                        <b>1. <?php esc_html_e('Role Priority (Top to Bottom):', 'sanch-multidomain-ldap-auth'); ?></b> <?php esc_html_e('A user gets the WP Role from the FIRST group they match from top to bottom. Use ↑/↓ buttons to prioritize Admins over Subscribers.', 'sanch-multidomain-ldap-auth'); ?><br>
     1220                        <b>2. <?php esc_html_e('URL Protection (Blacklist):', 'sanch-multidomain-ldap-auth'); ?></b> <?php esc_html_e('If you enter paths (like /?cat=6), they become LOCKED and visible ONLY to this AD Group. If left empty, this rule just assigns a role.', 'sanch-multidomain-ldap-auth'); ?>
    12181221                    </div>
    12191222
    … …  
    12241227                                <th style="width: 20%;"><?php esc_html_e('WP Role Code (ID / Slug)', 'sanch-multidomain-ldap-auth'); ?></th>
    12251228                                <th style="width: 15%;"><?php esc_html_e('Capabilities (Base)', 'sanch-multidomain-ldap-auth'); ?></th>
    1226                                 <th style="width: 35%;"><?php esc_html_e('Restricted URL Paths (One per line)', 'sanch-multidomain-ldap-auth'); ?></th>
     1229                                <!-- FIX 1.1.9: Нова назва колонки для кращого розуміння -->
     1230                                <th style="width: 35%;"><?php esc_html_e('🔒 Protect URLs (Only this group can access)', 'sanch-multidomain-ldap-auth'); ?> <br><small style="font-weight:normal; color:#666;">(One per line. Leave empty for role-only mapping)</small></th>
    12271231                                <th style="width: 10%; text-align: center;"><?php esc_html_e('Action', 'sanch-multidomain-ldap-auth'); ?></th>
    12281232                            </tr>
    … …  
    12671271                                    </select>
    12681272                                </td>
    1269                                 <td style="text-align: center;"><button type="button" class="button remove-row"><?php esc_html_e('Remove', 'sanch-multidomain-ldap-auth'); ?></button></td>
     1273                                <!-- FIX 1.1.9: Додано кнопки сортування ↑ ↓ -->
     1274                                <td style="text-align: center; vertical-align: middle;">
     1275                                    <div style="display: flex; gap: 4px; justify-content: center; margin-bottom: 4px;">
     1276                                        <button type="button" class="button move-up" title="Move Up">↑</button>
     1277                                        <button type="button" class="button move-down" title="Move Down">↓</button>
     1278                                    </div>
     1279                                    <button type="button" class="button remove-row" style="width: 100%; text-align: center;"><?php esc_html_e('Remove', 'sanch-multidomain-ldap-auth'); ?></button>
     1280                                </td>
    12701281                            </tr>
    12711282                            <?php endforeach; ?>
Note: See TracChangeset for help on using the changeset viewer.