Changeset 3752264

Timestamp:

10/17/2026 06:36:15 PM (3 weeks ago)

Author:

wpsignal

Message:

Release version 0.29.1

Location:

wordsocket

Files:

• tags/0.29.1 (copied) (copied from wordsocket/trunk )
• tags/0.29.1/CHANGELOG.md (modified) (1 diff)
• tags/0.29.1/includes/class-wpsignal-admin-page.php (modified) (1 diff)
• tags/0.29.1/readme.txt (modified) (3 diffs)
• tags/0.29.1/wordsocket.php (modified) (2 diffs)
• trunk/CHANGELOG.md (modified) (1 diff)
• trunk/includes/class-wpsignal-admin-page.php (modified) (1 diff)
• trunk/readme.txt (modified) (3 diffs)
• trunk/wordsocket.php (modified) (2 diffs)

wordsocket/tags/0.29.1/CHANGELOG.md

@@ +1 @@
+**0.29.1** - Fixes the Connect tab's "Connect with WPSignal" button, broken in 0.29.0: it sent the browser to `admin-post.php?action=wpsignal_oauth_start&_wpnonce=...` and WordPress answered "The link you followed has expired." The URL was built with `wp_nonce_url()`, which HTML-escapes its result; `wp_localize_script()` used to decode that again, and 0.29.0 moved the settings config to inline JSON, which does not. The URL is now built raw. Manual connection with an API key was unaffected.
+
 **0.29.0** - The Settings tab shows its real-time collaboration section only while Gutenberg's collaboration experiment is on, and reads that state from the settings page itself. Before, it read it from the frontend client's config, which is not printed on an unconfigured or rejected site, so the tab showed "Loading real-time collaboration settings..." for good. Developer mode: the Triggers and Explorer tabs are listed only when "Show the Triggers and Explorer tabs" (Settings tab, Developer tools) is on, stored as `wpsignal_developer_mode` (default off) and saved through `POST /wpsignal/v1/settings`, whose switches now save independently (`yjs_provider_enabled` and `developer_mode`, either one; neither is 400). A site owner who installed an extension no longer meets hook wiring and an event console with no explanation (tester feedback, 2026-10-15); a developer switches them on once. Every save, connect, disconnect and test publish on the settings page reports through one toast list at the bottom of the screen (core's snackbar, from the `core/notices` store): success, a red error, and a held "pending" toast where a request takes a while. The hook behind it, `useTask( task, { pending, success, error, onSuccess, onError, onSettled } )`, is published to extensions as `window.wordsocket.useTask`, so an extension's tab saves the same way with no notice state of its own.
 

wordsocket/tags/0.29.1/includes/class-wpsignal-admin-page.php

@@ -184 +184 @@
                                 array(
                                         'connectUrl'    => rest_url( 'wpsignal/v1/connect' ),
-                                        'oauthStartUrl' => wp_nonce_url(
-                                                admin_url( 'admin-post.php?action=wpsignal_oauth_start' ),
-                                                'wpsignal_oauth_start'
+                                        'oauthStartUrl' => add_query_arg(
+                                                array(
+                                                        'action'   => 'wpsignal_oauth_start',
+                                                        '_wpnonce' => wp_create_nonce( 'wpsignal_oauth_start' ),
+                                                ),
+                                                admin_url( 'admin-post.php' )
                                         ),
                                         'restUrl'       => rest_url( 'wpsignal/v1/' ),

wordsocket/tags/0.29.1/readme.txt

@@ -4 +4 @@
 Requires at least: 6.7
 Tested up to: 7.1
-Stable tag: 0.29.0
+Stable tag: 0.29.1
 Requires PHP: 8.2
 License: GPL-2.0-or-later
@@ -180 +180 @@
 
 == Changelog ==
+
+= 0.29.1 =
+* Fixed: "Connect with WPSignal" on the Connect tab led to "The link you followed has expired" since 0.29.0, because the authorization link's nonce was HTML-escaped. Manual connection with an API key was unaffected
 
 = 0.29.0 =
@@ -366 +369 @@
 == Upgrade Notice ==
 
+= 0.29.1 =
+Fixes the "Connect with WPSignal" button on the Connect tab, which led to "The link you followed has expired" in 0.29.0. Update if you still need to connect a site; connected sites are unaffected.
+
 = 0.29.0 =
 The Triggers and Explorer tabs are now hidden until "Show the Triggers and Explorer tabs" is switched on under Settings > Developer tools; your triggers keep running. Update WordSocket before ShopSocket 0.6.

wordsocket/tags/0.29.1/wordsocket.php

@@ -4 +4 @@
  * Plugin URI:        https://wpsignal.io/wordsocket
  * Description:       WordSocket is the official WordPress plugin for <a href="https://wpsignal.io">wpsignal.io</a>.
- * Version:           0.29.0
+ * Version:           0.29.1
  * Author:            WPSignal
  * Author URI:        https://wpsignal.io
@@ -37 +37 @@
 
 /** @var string Current plugin version. */
-const VERSION = '0.29.0';
+const VERSION = '0.29.1';
 
 /** @var string Absolute path to the plugin directory (with trailing slash). */

wordsocket/trunk/CHANGELOG.md

@@ +1 @@
+**0.29.1** - Fixes the Connect tab's "Connect with WPSignal" button, broken in 0.29.0: it sent the browser to `admin-post.php?action=wpsignal_oauth_start&_wpnonce=...` and WordPress answered "The link you followed has expired." The URL was built with `wp_nonce_url()`, which HTML-escapes its result; `wp_localize_script()` used to decode that again, and 0.29.0 moved the settings config to inline JSON, which does not. The URL is now built raw. Manual connection with an API key was unaffected.
+
 **0.29.0** - The Settings tab shows its real-time collaboration section only while Gutenberg's collaboration experiment is on, and reads that state from the settings page itself. Before, it read it from the frontend client's config, which is not printed on an unconfigured or rejected site, so the tab showed "Loading real-time collaboration settings..." for good. Developer mode: the Triggers and Explorer tabs are listed only when "Show the Triggers and Explorer tabs" (Settings tab, Developer tools) is on, stored as `wpsignal_developer_mode` (default off) and saved through `POST /wpsignal/v1/settings`, whose switches now save independently (`yjs_provider_enabled` and `developer_mode`, either one; neither is 400). A site owner who installed an extension no longer meets hook wiring and an event console with no explanation (tester feedback, 2026-10-15); a developer switches them on once. Every save, connect, disconnect and test publish on the settings page reports through one toast list at the bottom of the screen (core's snackbar, from the `core/notices` store): success, a red error, and a held "pending" toast where a request takes a while. The hook behind it, `useTask( task, { pending, success, error, onSuccess, onError, onSettled } )`, is published to extensions as `window.wordsocket.useTask`, so an extension's tab saves the same way with no notice state of its own.
 

wordsocket/trunk/includes/class-wpsignal-admin-page.php

@@ -184 +184 @@
                                 array(
                                         'connectUrl'    => rest_url( 'wpsignal/v1/connect' ),
-                                        'oauthStartUrl' => wp_nonce_url(
-                                                admin_url( 'admin-post.php?action=wpsignal_oauth_start' ),
-                                                'wpsignal_oauth_start'
+                                        'oauthStartUrl' => add_query_arg(
+                                                array(
+                                                        'action'   => 'wpsignal_oauth_start',
+                                                        '_wpnonce' => wp_create_nonce( 'wpsignal_oauth_start' ),
+                                                ),
+                                                admin_url( 'admin-post.php' )
                                         ),
                                         'restUrl'       => rest_url( 'wpsignal/v1/' ),

wordsocket/trunk/readme.txt

@@ -4 +4 @@
 Requires at least: 6.7
 Tested up to: 7.1
-Stable tag: 0.29.0
+Stable tag: 0.29.1
 Requires PHP: 8.2
 License: GPL-2.0-or-later
@@ -180 +180 @@
 
 == Changelog ==
+
+= 0.29.1 =
+* Fixed: "Connect with WPSignal" on the Connect tab led to "The link you followed has expired" since 0.29.0, because the authorization link's nonce was HTML-escaped. Manual connection with an API key was unaffected
 
 = 0.29.0 =
@@ -366 +369 @@
 == Upgrade Notice ==
 
+= 0.29.1 =
+Fixes the "Connect with WPSignal" button on the Connect tab, which led to "The link you followed has expired" in 0.29.0. Update if you still need to connect a site; connected sites are unaffected.
+
 = 0.29.0 =
 The Triggers and Explorer tabs are now hidden until "Show the Triggers and Explorer tabs" is switched on under Settings > Developer tools; your triggers keep running. Update WordSocket before ShopSocket 0.6.

wordsocket/trunk/wordsocket.php

@@ -4 +4 @@
  * Plugin URI:        https://wpsignal.io/wordsocket
  * Description:       WordSocket is the official WordPress plugin for <a href="https://wpsignal.io">wpsignal.io</a>.
- * Version:           0.29.0
+ * Version:           0.29.1
  * Author:            WPSignal
  * Author URI:        https://wpsignal.io
@@ -37 +37 @@
 
 /** @var string Current plugin version. */
-const VERSION = '0.29.0';
+const VERSION = '0.29.1';
 
 /** @var string Absolute path to the plugin directory (with trailing slash). */