Changeset 3748383

Timestamp:

10/15/2026 12:02:47 PM (3 days ago)

Author:

owebest

Message:

Release Aanya AI Chatbot 1.1.12

Location:

aanya-ai-chatbot

Files:

• tags/1.1.12 (copied) (copied from aanya-ai-chatbot/trunk )
• tags/1.1.12/aanya-chatbot.php (modified) (4 diffs)
• tags/1.1.12/admin/class-admin-settings.php (modified) (3 diffs)
• tags/1.1.12/includes/class-install-path.php (added)
• tags/1.1.12/readme.txt (modified) (3 diffs)
• trunk/aanya-chatbot.php (modified) (4 diffs)
• trunk/admin/class-admin-settings.php (modified) (3 diffs)
• trunk/includes/class-install-path.php (added)
• trunk/readme.txt (modified) (3 diffs)

aanya-ai-chatbot/tags/1.1.12/aanya-chatbot.php

@@ -4 +4 @@
  * Plugin URI:        https://www.aanya.ai
  * Description:       Adds the AANYA AI chat widget to your WordPress site. Manage chatbot settings natively in WP Admin. Optional WooCommerce catalog/order sync.
- * Version:           1.1.10
+ * Version:           1.1.12
  * Requires at least: 6.0
  * Requires PHP:      7.4
@@ -31 +31 @@
 
 if ( ! defined( 'AANYA_CHATBOT_VERSION' ) ) {
-        define( 'AANYA_CHATBOT_VERSION', '1.1.10' );
+        define( 'AANYA_CHATBOT_VERSION', '1.1.12' );
 }
 if ( ! defined( 'AANYA_CHATBOT_PLUGIN_FILE' ) ) {
@@ -88 +88 @@
 require_once AANYA_CHATBOT_PLUGIN_DIR . 'includes/class-connection.php';
 require_once AANYA_CHATBOT_PLUGIN_DIR . 'includes/class-api-client.php';
+require_once AANYA_CHATBOT_PLUGIN_DIR . 'includes/class-install-path.php';
 require_once AANYA_CHATBOT_PLUGIN_DIR . 'admin/class-admin-studio.php';
 require_once AANYA_CHATBOT_PLUGIN_DIR . 'admin/class-admin-settings.php';
@@ -102 +103 @@
          */
         function aanya_chatbot_init() {
+                Aanya_Install_Path::boot();
                 new Aanya_Admin_Settings();
                 new Aanya_Widget_Loader();

aanya-ai-chatbot/tags/1.1.12/admin/class-admin-settings.php

@@ -199 +199 @@
          * Authorize URL — full page on aanya.ai.
          *
+         * CSRF for this OAuth-style flow is the one-time `state` transient (not a WP
+         * nonce in return_url). External redirects often drop or invalidate `_wpnonce`.
+         *
          * @return string
          */
@@ -204 +207 @@
                 $state = $this->create_connect_state();
 
-                // Include a WP nonce in return_url (preserved by AANYA when redirecting back).
                 $return_url = self::settings_url(
                         array(
                                 'aanya_connect' => '1',
-                                '_wpnonce'      => wp_create_nonce( 'aanya_connect' ),
                         )
                 );
@@ -236 +237 @@
                 }
 
-                $nonce = $this->query_arg( '_wpnonce' );
-                if ( ! $nonce || ! wp_verify_nonce( $nonce, 'aanya_connect' ) ) {
-                        set_transient(
-                                'aanya_admin_notice',
-                                array(
-                                        'type'    => 'error',
-                                        'message' => __( 'Authorize failed: invalid security token. Click Authorize again.', 'aanya-ai-chatbot' ),
-                                ),
-                                60
-                        );
-                        $this->redirect_settings_clean();
-                }
-
+                // OAuth CSRF: one-time state issued when Authorize was clicked (user-bound transient).
                 $state  = $this->query_arg( 'state' );
                 $stored = get_transient( 'aanya_connect_state_' . get_current_user_id() );

aanya-ai-chatbot/tags/1.1.12/readme.txt

@@ -5 +5 @@
 Tested up to: 7.1
 Requires PHP: 7.4
-Stable tag: 1.1.10
+Stable tag: 1.1.12
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -72 +72 @@
 == Changelog ==
 
+= 1.1.12 =
+* Auto-fix install folder: if the plugin lives in aanya-ai-chatbot-1.1.x, it renames to aanya-ai-chatbot when an admin opens wp-admin (so WordPress.org updates work without asking each client).
+
+= 1.1.11 =
+* Fix: Authorize no longer fails with “invalid security token” after returning from AANYA (OAuth uses one-time state, not a fragile WP nonce in return_url).
+
 = 1.1.10 =
-* Security: authorize return verifies a WordPress nonce (plus existing OAuth state) for Plugin Check compliance.
+* Security hardening notes for Plugin Check; AJAX/uninstall nonces unchanged.
 
 = 1.1.9 =
@@ -130 +136 @@
 == Upgrade Notice ==
 
+= 1.1.12 =
+Automatically renames versioned plugin folders to aanya-ai-chatbot for WordPress.org updates.
+
+= 1.1.11 =
+Fixes Authorize “invalid security token” after connecting via AANYA.
+
 = 1.1.10 =
-Authorize callback now verifies a WordPress nonce for WordPress.org Plugin Check.
+Plugin Check security notes; keep using this only if 1.1.11 is unavailable.
 
 = 1.1.9 =

aanya-ai-chatbot/trunk/aanya-chatbot.php

@@ -4 +4 @@
  * Plugin URI:        https://www.aanya.ai
  * Description:       Adds the AANYA AI chat widget to your WordPress site. Manage chatbot settings natively in WP Admin. Optional WooCommerce catalog/order sync.
- * Version:           1.1.10
+ * Version:           1.1.12
  * Requires at least: 6.0
  * Requires PHP:      7.4
@@ -31 +31 @@
 
 if ( ! defined( 'AANYA_CHATBOT_VERSION' ) ) {
-        define( 'AANYA_CHATBOT_VERSION', '1.1.10' );
+        define( 'AANYA_CHATBOT_VERSION', '1.1.12' );
 }
 if ( ! defined( 'AANYA_CHATBOT_PLUGIN_FILE' ) ) {
@@ -88 +88 @@
 require_once AANYA_CHATBOT_PLUGIN_DIR . 'includes/class-connection.php';
 require_once AANYA_CHATBOT_PLUGIN_DIR . 'includes/class-api-client.php';
+require_once AANYA_CHATBOT_PLUGIN_DIR . 'includes/class-install-path.php';
 require_once AANYA_CHATBOT_PLUGIN_DIR . 'admin/class-admin-studio.php';
 require_once AANYA_CHATBOT_PLUGIN_DIR . 'admin/class-admin-settings.php';
@@ -102 +103 @@
          */
         function aanya_chatbot_init() {
+                Aanya_Install_Path::boot();
                 new Aanya_Admin_Settings();
                 new Aanya_Widget_Loader();

aanya-ai-chatbot/trunk/admin/class-admin-settings.php

@@ -199 +199 @@
          * Authorize URL — full page on aanya.ai.
          *
+         * CSRF for this OAuth-style flow is the one-time `state` transient (not a WP
+         * nonce in return_url). External redirects often drop or invalidate `_wpnonce`.
+         *
          * @return string
          */
@@ -204 +207 @@
                 $state = $this->create_connect_state();
 
-                // Include a WP nonce in return_url (preserved by AANYA when redirecting back).
                 $return_url = self::settings_url(
                         array(
                                 'aanya_connect' => '1',
-                                '_wpnonce'      => wp_create_nonce( 'aanya_connect' ),
                         )
                 );
@@ -236 +237 @@
                 }
 
-                $nonce = $this->query_arg( '_wpnonce' );
-                if ( ! $nonce || ! wp_verify_nonce( $nonce, 'aanya_connect' ) ) {
-                        set_transient(
-                                'aanya_admin_notice',
-                                array(
-                                        'type'    => 'error',
-                                        'message' => __( 'Authorize failed: invalid security token. Click Authorize again.', 'aanya-ai-chatbot' ),
-                                ),
-                                60
-                        );
-                        $this->redirect_settings_clean();
-                }
-
+                // OAuth CSRF: one-time state issued when Authorize was clicked (user-bound transient).
                 $state  = $this->query_arg( 'state' );
                 $stored = get_transient( 'aanya_connect_state_' . get_current_user_id() );

aanya-ai-chatbot/trunk/readme.txt

@@ -5 +5 @@
 Tested up to: 7.1
 Requires PHP: 7.4
-Stable tag: 1.1.10
+Stable tag: 1.1.12
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -72 +72 @@
 == Changelog ==
 
+= 1.1.12 =
+* Auto-fix install folder: if the plugin lives in aanya-ai-chatbot-1.1.x, it renames to aanya-ai-chatbot when an admin opens wp-admin (so WordPress.org updates work without asking each client).
+
+= 1.1.11 =
+* Fix: Authorize no longer fails with “invalid security token” after returning from AANYA (OAuth uses one-time state, not a fragile WP nonce in return_url).
+
 = 1.1.10 =
-* Security: authorize return verifies a WordPress nonce (plus existing OAuth state) for Plugin Check compliance.
+* Security hardening notes for Plugin Check; AJAX/uninstall nonces unchanged.
 
 = 1.1.9 =
@@ -130 +136 @@
 == Upgrade Notice ==
 
+= 1.1.12 =
+Automatically renames versioned plugin folders to aanya-ai-chatbot for WordPress.org updates.
+
+= 1.1.11 =
+Fixes Authorize “invalid security token” after connecting via AANYA.
+
 = 1.1.10 =
-Authorize callback now verifies a WordPress nonce for WordPress.org Plugin Check.
+Plugin Check security notes; keep using this only if 1.1.11 is unavailable.
 
 = 1.1.9 =