Changeset 3803670

Timestamp:

11/15/2026 06:04:19 PM (less than one hour ago)

Author:

geminilabs

Message:

Release 8.3.8, see readme.txt for the changelog.

Location:

site-reviews

Files:

• tags/8.3.8 (copied) (copied from site-reviews/trunk )
• tags/8.3.8/changelog.txt (modified) (1 diff)
• tags/8.3.8/languages/site-reviews-en_US.po (modified) (19 diffs)
• tags/8.3.8/languages/site-reviews.pot (modified) (18 diffs)
• tags/8.3.8/plugin/Api.php (modified) (2 diffs)
• tags/8.3.8/plugin/Commands/CreateReview.php (modified) (3 diffs)
• tags/8.3.8/plugin/Commands/FetchPagedReviews.php (modified) (1 diff)
• tags/8.3.8/plugin/Controllers/AdminController.php (modified) (7 diffs)
• tags/8.3.8/plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php (modified) (3 diffs)
• tags/8.3.8/plugin/Controllers/Api/Version1/RestReviewController.php (modified) (1 diff)
• tags/8.3.8/plugin/Controllers/EditorController.php (modified) (1 diff)
• tags/8.3.8/plugin/Controllers/ListTableController.php (modified) (2 diffs)
• tags/8.3.8/plugin/Controllers/MainController.php (modified) (1 diff)
• tags/8.3.8/plugin/Controllers/PrivacyController.php (modified) (1 diff)
• tags/8.3.8/plugin/Controllers/ToolsController.php (modified) (2 diffs)
• tags/8.3.8/plugin/Controllers/VerificationController.php (modified) (2 diffs)
• tags/8.3.8/plugin/Database.php (modified) (3 diffs)
• tags/8.3.8/plugin/Database/OptionManager.php (modified) (3 diffs)
• tags/8.3.8/plugin/Database/Query.php (modified) (3 diffs)
• tags/8.3.8/plugin/Database/RatingManager.php (modified) (1 diff)
• tags/8.3.8/plugin/Database/Sql.php (modified) (7 diffs)
• tags/8.3.8/plugin/Database/Tables.php (modified) (1 diff)
• tags/8.3.8/plugin/Defaults/ApiDefaults.php (modified) (2 diffs)
• tags/8.3.8/plugin/Helpers/Arr.php (modified) (1 diff)
• tags/8.3.8/plugin/Helpers/Text.php (modified) (3 diffs)
• tags/8.3.8/plugin/Integrations/MultilingualPress/Defaults/SyncReviewDefaults.php (modified) (2 diffs)
• tags/8.3.8/plugin/Integrations/MultilingualPress/RelationSaveHelper.php (modified) (3 diffs)
• tags/8.3.8/plugin/Integrations/MultilingualPress/ReviewCopier.php (modified) (2 diffs)
• tags/8.3.8/plugin/Integrations/WPLoyalty/Controller.php (modified) (1 diff)
• tags/8.3.8/plugin/Integrations/WooCommerce/Controllers/RestApi/ProductReviewsController.php (modified) (1 diff)
• tags/8.3.8/plugin/Modules/Html/Form.php (modified) (2 diffs)
• tags/8.3.8/plugin/Modules/Html/ReviewForm.php (modified) (3 diffs)
• tags/8.3.8/plugin/Modules/Html/SettingForm.php (modified) (1 diff)
• tags/8.3.8/plugin/Modules/Paginate.php (modified) (1 diff)
• tags/8.3.8/plugin/Modules/Sanitizers/ArraySanitizer.php (modified) (2 diffs)
• tags/8.3.8/plugin/Modules/Sanitizers/SanitizeEmails.php (modified) (1 diff)
• tags/8.3.8/plugin/Modules/Sanitizers/SanitizePostIds.php (modified) (1 diff)
• tags/8.3.8/plugin/Modules/Sanitizers/SanitizeTermIds.php (modified) (1 diff)
• tags/8.3.8/plugin/Modules/Sanitizers/SanitizeUserIds.php (modified) (1 diff)
• tags/8.3.8/plugin/Modules/Schema.php (modified) (2 diffs)
• tags/8.3.8/plugin/Modules/SystemInfo.php (modified) (1 diff)
• tags/8.3.8/plugin/Modules/Validator.php (modified) (1 diff)
• tags/8.3.8/plugin/Modules/Validator/CaptchaValidatorAbstract.php (modified) (1 diff)
• tags/8.3.8/plugin/Modules/Validator/FriendlycaptchaV2Validator.php (modified) (1 diff)
• tags/8.3.8/plugin/Modules/Validator/ProcaptchaValidator.php (modified) (1 diff)
• tags/8.3.8/plugin/Modules/Validator/SignatureValidator.php (modified) (3 diffs)
• tags/8.3.8/plugin/Modules/Validator/ValidationRules.php (modified) (2 diffs)
• tags/8.3.8/plugin/Notices/GatekeeperNotice.php (modified) (3 diffs)
• tags/8.3.8/readme.txt (modified) (2 diffs)
• tags/8.3.8/site-reviews.php (modified) (1 diff)
• trunk/changelog.txt (modified) (1 diff)
• trunk/languages/site-reviews-en_US.po (modified) (19 diffs)
• trunk/languages/site-reviews.pot (modified) (18 diffs)
• trunk/plugin/Api.php (modified) (2 diffs)
• trunk/plugin/Commands/CreateReview.php (modified) (3 diffs)
• trunk/plugin/Commands/FetchPagedReviews.php (modified) (1 diff)
• trunk/plugin/Controllers/AdminController.php (modified) (7 diffs)
• trunk/plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php (modified) (3 diffs)
• trunk/plugin/Controllers/Api/Version1/RestReviewController.php (modified) (1 diff)
• trunk/plugin/Controllers/EditorController.php (modified) (1 diff)
• trunk/plugin/Controllers/ListTableController.php (modified) (2 diffs)
• trunk/plugin/Controllers/MainController.php (modified) (1 diff)
• trunk/plugin/Controllers/PrivacyController.php (modified) (1 diff)
• trunk/plugin/Controllers/ToolsController.php (modified) (2 diffs)
• trunk/plugin/Controllers/VerificationController.php (modified) (2 diffs)
• trunk/plugin/Database.php (modified) (3 diffs)
• trunk/plugin/Database/OptionManager.php (modified) (3 diffs)
• trunk/plugin/Database/Query.php (modified) (3 diffs)
• trunk/plugin/Database/RatingManager.php (modified) (1 diff)
• trunk/plugin/Database/Sql.php (modified) (7 diffs)
• trunk/plugin/Database/Tables.php (modified) (1 diff)
• trunk/plugin/Defaults/ApiDefaults.php (modified) (2 diffs)
• trunk/plugin/Helpers/Arr.php (modified) (1 diff)
• trunk/plugin/Helpers/Text.php (modified) (3 diffs)
• trunk/plugin/Integrations/MultilingualPress/Defaults/SyncReviewDefaults.php (modified) (2 diffs)
• trunk/plugin/Integrations/MultilingualPress/RelationSaveHelper.php (modified) (3 diffs)
• trunk/plugin/Integrations/MultilingualPress/ReviewCopier.php (modified) (2 diffs)
• trunk/plugin/Integrations/WPLoyalty/Controller.php (modified) (1 diff)
• trunk/plugin/Integrations/WooCommerce/Controllers/RestApi/ProductReviewsController.php (modified) (1 diff)
• trunk/plugin/Modules/Html/Form.php (modified) (2 diffs)
• trunk/plugin/Modules/Html/ReviewForm.php (modified) (3 diffs)
• trunk/plugin/Modules/Html/SettingForm.php (modified) (1 diff)
• trunk/plugin/Modules/Paginate.php (modified) (1 diff)
• trunk/plugin/Modules/Sanitizers/ArraySanitizer.php (modified) (2 diffs)
• trunk/plugin/Modules/Sanitizers/SanitizeEmails.php (modified) (1 diff)
• trunk/plugin/Modules/Sanitizers/SanitizePostIds.php (modified) (1 diff)
• trunk/plugin/Modules/Sanitizers/SanitizeTermIds.php (modified) (1 diff)
• trunk/plugin/Modules/Sanitizers/SanitizeUserIds.php (modified) (1 diff)
• trunk/plugin/Modules/Schema.php (modified) (2 diffs)
• trunk/plugin/Modules/SystemInfo.php (modified) (1 diff)
• trunk/plugin/Modules/Validator.php (modified) (1 diff)
• trunk/plugin/Modules/Validator/CaptchaValidatorAbstract.php (modified) (1 diff)
• trunk/plugin/Modules/Validator/FriendlycaptchaV2Validator.php (modified) (1 diff)
• trunk/plugin/Modules/Validator/ProcaptchaValidator.php (modified) (1 diff)
• trunk/plugin/Modules/Validator/SignatureValidator.php (modified) (3 diffs)
• trunk/plugin/Modules/Validator/ValidationRules.php (modified) (2 diffs)
• trunk/plugin/Notices/GatekeeperNotice.php (modified) (3 diffs)
• trunk/readme.txt (modified) (2 diffs)
• trunk/site-reviews.php (modified) (1 diff)

site-reviews/tags/8.3.8/changelog.txt

@@ -1 +1 @@
 == Changelog ==
+
+= 8.3.8 (2026-11-15) =
+
+- Fixed a security issue in review excerpts
+- Fixed a security issue in the notice shown after restoring a revision
+- Fixed a security issue in the review type filter
+- Fixed a security issue in the schema
+- Fixed captcha checks slowly filling up the database
+- Fixed forms with more than one Assigned Pages, Categories or Users field not submitting
+- Fixed hidden form fields changing after a failed submission
+- Fixed MultilingualPress translations losing their custom field values when the original review is edited
+- Fixed number fields ignoring decimals in their minimum and maximum
+- Fixed reviews not saving with version 3 of the SQLite Database Integration plugin
+- Fixed some assigned pages, categories or users not being saved with a review
+- Fixed the admin search permission check
+- Fixed the Install button in the missing plugin notice
+- Fixed the IP address detection tool permission check
+- Fixed the review approval permission check
+- Fixed the validation of submitted reviews
+- Fixed the verification email permission check
 
 = 8.3.7 (2026-10-31) =

site-reviews/tags/8.3.8/languages/site-reviews-en_US.po

@@ -116 +116 @@
 
 #: plugin/Controllers/Api/Version1/RestRenderController.php:103
-#: plugin/Controllers/VerificationController.php:96
+#: plugin/Controllers/VerificationController.php:105
 msgid "Thank you, your review has been verified."
 msgstr "Thank you, your review has been verified."
 
 #: plugin/Controllers/Api/Version1/RestRenderController.php:104
-#: plugin/Controllers/VerificationController.php:97
+#: plugin/Controllers/VerificationController.php:106
 msgid "Thank you, your review has been verified and is awaiting approval."
 msgstr "Thank you, your review has been verified and is awaiting approval."
@@ -432 +432 @@
 msgstr "Submitting, please wait..."
 
-#: plugin/Modules/Html/ReviewForm.php:14
+#: plugin/Modules/Html/ReviewForm.php:15
 msgid "Submit Review"
 msgstr "Submit Review"
@@ -476 +476 @@
 msgstr "You have already submitted a review."
 
-#: plugin/Modules/Validator/SignatureValidator.php:27
+#: plugin/Modules/Validator/SignatureValidator.php:28
 #: views/pages/documentation/support/common-problems-and-solutions.php:89
 msgid "This review cannot be submitted, please refresh the page and try again."
@@ -2437 +2437 @@
 msgstr "Enabling this option will persist field values entered into the review form until either the review is submitted or the browser tab or window is closed."
 
-#: plugin/Database.php:237
+#: plugin/Database.php:231
 msgctxt "admin-text"
 msgid "(no title)"
@@ -3400 +3400 @@
 
 #: plugin/Commands/SendVerificationEmail.php:71
-#: plugin/Controllers/VerificationController.php:34
+#: plugin/Controllers/VerificationController.php:35
 msgctxt "admin-text"
 msgid "Resend Verification Request"
@@ -3486 +3486 @@
 msgstr "Import"
 
-#: plugin/Controllers/AdminController.php:309
-#: plugin/Controllers/AdminController.php:327
-#: plugin/Controllers/AdminController.php:340
+#: plugin/Controllers/AdminController.php:313
+#: plugin/Controllers/AdminController.php:332
+#: plugin/Controllers/AdminController.php:346
 msgctxt "admin-text"
 msgid "Nothing found."
@@ -3580 +3580 @@
 
 #. translators: %s: the review type
-#: plugin/Controllers/EditorController.php:108
+#: plugin/Controllers/EditorController.php:109
 #, php-format
 msgctxt "admin-text"
@@ -3681 +3681 @@
 msgstr "Respond"
 
-#: plugin/Controllers/ListTableController.php:272
+#: plugin/Controllers/ListTableController.php:270
 msgctxt "admin-text"
 msgid "Sorry, you are not allowed to respond to this review."
 msgstr "Sorry, you are not allowed to respond to this review."
 
-#: plugin/Controllers/ListTableController.php:275
+#: plugin/Controllers/ListTableController.php:273
 msgctxt "admin-text"
 msgid "Someone"
@@ -3692 +3692 @@
 
 #. translators: %s: user's name
-#: plugin/Controllers/ListTableController.php:281
+#: plugin/Controllers/ListTableController.php:279
 #, php-format
 msgctxt "admin-text"
@@ -3821 +3821 @@
 msgstr "You do not have permission to import settings."
 
-#: plugin/Controllers/ToolsController.php:366
+#: plugin/Controllers/ToolsController.php:380
 msgctxt "admin-text"
 msgid "reload the page"
@@ -3827 +3827 @@
 
 #. translators: %s: a link with the text "reload the page"
-#: plugin/Controllers/ToolsController.php:371
+#: plugin/Controllers/ToolsController.php:385
 #, php-format
 msgctxt "admin-text"
@@ -3833 +3833 @@
 msgstr "The permissions have been repaired, please %s for them to take effect."
 
-#: plugin/Controllers/ToolsController.php:446
+#: plugin/Controllers/ToolsController.php:460
 msgctxt "admin-text"
 msgid "You do not have permission to rollback the plugin."
@@ -3921 +3921 @@
 msgstr "Approved on:"
 
-#: plugin/Controllers/VerificationController.php:35
+#: plugin/Controllers/VerificationController.php:36
 msgctxt "admin-text"
 msgid "Send Verification Request"
@@ -4224 +4224 @@
 
 #. translators: %s: the plugin name
-#: plugin/Notices/GatekeeperNotice.php:130
+#: plugin/Notices/GatekeeperNotice.php:133
 #, php-format
 msgctxt "admin-text"
@@ -4231 +4231 @@
 
 #. translators: %s: the plugin name
-#: plugin/Notices/GatekeeperNotice.php:146
+#: plugin/Notices/GatekeeperNotice.php:149
 #, php-format
 msgctxt "admin-text"
@@ -7116 +7116 @@
 msgstr "Limit result set to verified status."
 
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:18
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:19
 msgctxt "admin-text"
 msgid "Cannot create existing review."
 msgstr "Cannot create existing review."
 
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:22
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:23
 msgctxt "admin-text"
 msgid "Sorry, you are not allowed to create reviews as this user."
 msgstr "Sorry, you are not allowed to create reviews as this user."
 
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:26
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:27
 msgctxt "admin-text"
 msgid "Sorry, you are not allowed to create reviews as this review author."
 msgstr "Sorry, you are not allowed to create reviews as this review author."
 
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:30
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:139
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:31
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:146
 msgctxt "admin-text"
 msgid "Sorry, you are not allowed to assign the provided terms."
 msgstr "Sorry, you are not allowed to assign the provided terms."
 
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:45
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:68
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:121
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:46
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:69
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:122
 msgctxt "admin-text"
 msgid "Invalid review ID."
 msgstr "Invalid review ID."
 
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:51
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:52
 msgctxt "admin-text"
 msgid "Sorry, you are not allowed to delete this review."
 msgstr "Sorry, you are not allowed to delete this review."
 
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:74
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:75
 msgctxt "admin-text"
 msgid "Sorry, you are not allowed to view this review."
 msgstr "Sorry, you are not allowed to view this review."
 
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:81
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:127
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:82
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:128
 msgctxt "admin-text"
 msgid "Sorry, you are not allowed to edit this review."
 msgstr "Sorry, you are not allowed to edit this review."
 
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:97
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:98
 msgctxt "admin-text"
 msgid "Sorry, you do not have permission to access reviews."
 msgstr "Sorry, you do not have permission to access reviews."
 
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:104
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:105
 msgctxt "admin-text"
 msgid "Sorry, you are not allowed to edit reviews."
 msgstr "Sorry, you are not allowed to edit reviews."
 
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:133
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:140
 msgctxt "admin-text"
 msgid "Sorry, you are not allowed to update the review as this user."
@@ -7560 +7560 @@
 
 #. translators: %s: plugin name
-#: plugin/Controllers/ToolsController.php:427
+#: plugin/Controllers/ToolsController.php:441
 #, php-format
 msgctxt "Site Reviews (admin-text)"
@@ -9235 +9235 @@
 msgstr ""
 
-#: plugin/Controllers/ToolsController.php:451
+#: plugin/Controllers/ToolsController.php:465
 #: views/pages/tools/general/rollback-plugin.php:21
 msgctxt "admin-text"
@@ -9254 +9254 @@
 msgid "%s was not updated because its folder is a git repository."
 msgstr ""
+
+#: plugin/Controllers/AdminController.php:390
+msgctxt "admin-text"
+msgid "You do not have permission to search."
+msgstr ""
+
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:134
+msgctxt "admin-text"
+msgid "Sorry, you are not allowed to approve this review."
+msgstr ""
+
+#: plugin/Controllers/ToolsController.php:314
+#: plugin/Controllers/ToolsController.php:332
+msgctxt "admin-text"
+msgid "You do not have permission to change the IP address detection."
+msgstr ""
+
+#: plugin/Controllers/VerificationController.php:52
+msgctxt "admin-text"
+msgid "You do not have permission to request verification of this review."
+msgstr ""

site-reviews/tags/8.3.8/languages/site-reviews.pot

@@ -3 +3 @@
 msgid ""
 msgstr ""
-"Project-Id-Version: Site Reviews 8.3.7\n"
+"Project-Id-Version: Site Reviews 8.3.8\n"
 "Report-Msgid-Bugs-To: https://wordpress.org/support/plugin/site-reviews\n"
 "Last-Translator: Paul Ryley <paul@geminilabs.io>\n"
@@ -3268 +3268 @@
 
 #: plugin/Commands/SendVerificationEmail.php:71
-#: plugin/Controllers/VerificationController.php:34
+#: plugin/Controllers/VerificationController.php:35
 msgctxt "admin-text"
 msgid "Resend Verification Request"
@@ -3358 +3358 @@
 msgstr ""
 
-#: plugin/Controllers/AdminController.php:309
-#: plugin/Controllers/AdminController.php:327
-#: plugin/Controllers/AdminController.php:340
+#: plugin/Controllers/AdminController.php:313
+#: plugin/Controllers/AdminController.php:332
+#: plugin/Controllers/AdminController.php:346
 msgctxt "admin-text"
 msgid "Nothing found."
+msgstr ""
+
+#: plugin/Controllers/AdminController.php:390
+msgctxt "admin-text"
+msgid "You do not have permission to search."
 msgstr ""
 
@@ -3494 +3499 @@
 msgstr ""
 
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:18
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:19
 msgctxt "admin-text"
 msgid "Cannot create existing review."
 msgstr ""
 
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:22
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:23
 msgctxt "admin-text"
 msgid "Sorry, you are not allowed to create reviews as this user."
 msgstr ""
 
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:26
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:27
 msgctxt "admin-text"
 msgid "Sorry, you are not allowed to create reviews as this review author."
 msgstr ""
 
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:30
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:139
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:31
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:146
 msgctxt "admin-text"
 msgid "Sorry, you are not allowed to assign the provided terms."
 msgstr ""
 
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:45
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:68
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:121
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:46
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:69
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:122
 msgctxt "admin-text"
 msgid "Invalid review ID."
 msgstr ""
 
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:51
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:52
 msgctxt "admin-text"
 msgid "Sorry, you are not allowed to delete this review."
 msgstr ""
 
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:74
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:75
 msgctxt "admin-text"
 msgid "Sorry, you are not allowed to view this review."
 msgstr ""
 
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:81
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:127
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:82
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:128
 msgctxt "admin-text"
 msgid "Sorry, you are not allowed to edit this review."
 msgstr ""
 
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:97
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:98
 msgctxt "admin-text"
 msgid "Sorry, you do not have permission to access reviews."
 msgstr ""
 
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:104
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:105
 msgctxt "admin-text"
 msgid "Sorry, you are not allowed to edit reviews."
 msgstr ""
 
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:133
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:134
+msgctxt "admin-text"
+msgid "Sorry, you are not allowed to approve this review."
+msgstr ""
+
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:140
 msgctxt "admin-text"
 msgid "Sorry, you are not allowed to update the review as this user."
@@ -3562 +3572 @@
 
 #: plugin/Controllers/Api/Version1/RestRenderController.php:103
-#: plugin/Controllers/VerificationController.php:96
+#: plugin/Controllers/VerificationController.php:105
 msgid "Thank you, your review has been verified."
 msgstr ""
 
 #: plugin/Controllers/Api/Version1/RestRenderController.php:104
-#: plugin/Controllers/VerificationController.php:97
+#: plugin/Controllers/VerificationController.php:106
 msgid "Thank you, your review has been verified and is awaiting approval."
 msgstr ""
@@ -3923 +3933 @@
 
 #. translators: %s: the review type
-#: plugin/Controllers/EditorController.php:108
+#: plugin/Controllers/EditorController.php:109
 #, php-format
 msgctxt "admin-text"
@@ -4192 +4202 @@
 msgstr ""
 
-#: plugin/Controllers/ListTableController.php:272
+#: plugin/Controllers/ListTableController.php:270
 msgctxt "admin-text"
 msgid "Sorry, you are not allowed to respond to this review."
 msgstr ""
 
-#: plugin/Controllers/ListTableController.php:275
+#: plugin/Controllers/ListTableController.php:273
 msgctxt "admin-text"
 msgid "Someone"
@@ -4203 +4213 @@
 
 #. translators: %s: user's name
-#: plugin/Controllers/ListTableController.php:281
+#: plugin/Controllers/ListTableController.php:279
 #, php-format
 msgctxt "admin-text"
@@ -4339 +4349 @@
 msgstr ""
 
-#: plugin/Controllers/ToolsController.php:366
+#: plugin/Controllers/ToolsController.php:314
+#: plugin/Controllers/ToolsController.php:332
+msgctxt "admin-text"
+msgid "You do not have permission to change the IP address detection."
+msgstr ""
+
+#: plugin/Controllers/ToolsController.php:380
 msgctxt "admin-text"
 msgid "reload the page"
@@ -4345 +4361 @@
 
 #. translators: %s: a link with the text "reload the page"
-#: plugin/Controllers/ToolsController.php:371
+#: plugin/Controllers/ToolsController.php:385
 #, php-format
 msgctxt "admin-text"
@@ -4352 +4368 @@
 
 #. translators: %s: plugin name
-#: plugin/Controllers/ToolsController.php:427
+#: plugin/Controllers/ToolsController.php:441
 #, php-format
 msgctxt "Site Reviews (admin-text)"
@@ -4358 +4374 @@
 msgstr ""
 
-#: plugin/Controllers/ToolsController.php:446
+#: plugin/Controllers/ToolsController.php:460
 msgctxt "admin-text"
 msgid "You do not have permission to rollback the plugin."
 msgstr ""
 
-#: plugin/Controllers/ToolsController.php:451
+#: plugin/Controllers/ToolsController.php:465
 #: views/pages/tools/general/rollback-plugin.php:21
 msgctxt "admin-text"
@@ -4471 +4487 @@
 msgstr ""
 
-#: plugin/Controllers/VerificationController.php:35
+#: plugin/Controllers/VerificationController.php:36
 msgctxt "admin-text"
 msgid "Send Verification Request"
+msgstr ""
+
+#: plugin/Controllers/VerificationController.php:52
+msgctxt "admin-text"
+msgid "You do not have permission to request verification of this review."
 msgstr ""
 
@@ -4507 +4528 @@
 msgstr ""
 
-#: plugin/Database.php:237
+#: plugin/Database.php:231
 msgctxt "admin-text"
 msgid "(no title)"
@@ -6497 +6518 @@
 msgstr ""
 
-#: plugin/Modules/Html/ReviewForm.php:14
+#: plugin/Modules/Html/ReviewForm.php:15
 msgid "Submit Review"
 msgstr ""
@@ -6629 +6650 @@
 msgstr ""
 
-#: plugin/Modules/Validator/SignatureValidator.php:27
+#: plugin/Modules/Validator/SignatureValidator.php:28
 #: views/pages/documentation/support/common-problems-and-solutions.php:89
 msgid "This review cannot be submitted, please refresh the page and try again."
@@ -6660 +6681 @@
 
 #. translators: %s: the plugin name
-#: plugin/Notices/GatekeeperNotice.php:130
+#: plugin/Notices/GatekeeperNotice.php:133
 #, php-format
 msgctxt "admin-text"
@@ -6667 +6688 @@
 
 #. translators: %s: the plugin name
-#: plugin/Notices/GatekeeperNotice.php:146
+#: plugin/Notices/GatekeeperNotice.php:149
 #, php-format
 msgctxt "admin-text"

site-reviews/tags/8.3.8/plugin/Api.php

@@ -81 +81 @@
             $this->forget($transientKey);
         } else {
-            $result = get_site_transient($transientKey);
+            $result = $args['cache'] ? get_site_transient($transientKey) : false;
             if (!empty($result)) {
                 return new Response($result);
@@ -97 +97 @@
             $response = new Response($result);
             if ($response->successful()) {
-                $this->remember($transientKey, $result, $args['expiration']);
+                if ($args['cache']) {
+                    $this->remember($transientKey, $result, $args['expiration']);
+                }
                 if ($args['skip_when_down']) {
                     $this->markReachable();

site-reviews/tags/8.3.8/plugin/Commands/CreateReview.php

@@ -60 +60 @@
         $this->request = $this->normalize($request); // IP address is set here
         $this->setProperties(); // do this after setting the request
-        $this->review = new Review($this->toArray(), $init = false);
+        $this->review = new Review($this->toArray(), false); // don't init
         $this->validation = new Arguments();
         $this->custom = $this->custom();
@@ -239 +239 @@
             $request->set('date', '');
             $request->set('date_gmt', '');
+            $request->set('geolocation', '');
             $request->set('is_pinned', false);
             $request->set('is_verified', false);
@@ -244 +245 @@
             $request->set('response_by', 0);
             $request->set('type', 'local');
+            $request->set('verified', '');
+            $request->set('verified_on', '');
+            $request->set('verified_requested', '');
         }
         glsr()->action('review/request', $request);

site-reviews/tags/8.3.8/plugin/Commands/FetchPagedReviews.php

@@ -33 +33 @@
         return [
             'max_num_pages' => $this->html->max_num_pages,
-            'pagination' => $this->html->getPagination($wrap = false),
+            'pagination' => $this->html->getPagination(false), // don't wrap
             'reviews' => $this->html->getReviews(),
         ];

site-reviews/tags/8.3.8/plugin/Controllers/AdminController.php

@@ -262 +262 @@
     public function searchAssignedPostsAjax(Request $request): void
     {
+        $this->checkSearchPermission();
         $search = glsr(Sanitizer::class)->sanitizeText($request->search);
         $results = glsr(Database::class)->searchAssignedPosts($search)->results();
@@ -274 +275 @@
     public function searchAssignedUsersAjax(Request $request): void
     {
+        $this->checkSearchPermission();
         $search = glsr(Sanitizer::class)->sanitizeText($request->search);
         $results = glsr(Database::class)->searchAssignedUsers($search)->results();
@@ -289 +291 @@
     public function searchAuthorsAjax(Request $request): void
     {
+        $this->checkSearchPermission();
         $search = glsr(Sanitizer::class)->sanitizeText($request->search);
         $results = glsr(Database::class)->searchUsers($search)->results();
@@ -304 +307 @@
     public function searchPostsAjax(Request $request): void
     {
+        $this->checkSearchPermission();
         $search = glsr(Sanitizer::class)->sanitizeText($request->search);
         $results = glsr(Database::class)->searchPosts($search)->render();
@@ -317 +321 @@
     public function searchStringsAjax(Request $request): void
     {
+        $this->checkSearchPermission();
         $search = glsr(Sanitizer::class)->sanitizeText($request->search);
         $exclude = Arr::consolidate($request->exclude);
@@ -335 +340 @@
     public function searchUsersAjax(Request $request): void
     {
+        $this->checkSearchPermission();
         $search = glsr(Sanitizer::class)->sanitizeText($request->search);
         $results = glsr(Database::class)->searchUsers($search)->render();
@@ -372 +378 @@
         $this->execute(new ToggleStatus($request))->sendJsonResponse();
     }
+
+    /**
+     * Refuse the request with an error notice unless the user can edit reviews.
+     */
+    protected function checkSearchPermission(): void
+    {
+        if (glsr()->can('edit_posts')) {
+            return;
+        }
+        glsr(Notice::class)->addError(
+            _x('You do not have permission to search.', 'admin-text', 'site-reviews')
+        );
+        wp_send_json_error([
+            'notices' => glsr(Notice::class)->get(),
+        ]);
+    }
 }

site-reviews/tags/8.3.8/plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php

@@ -3 +3 @@
 namespace GeminiLabs\SiteReviews\Controllers\Api\Version1\Permissions;
 
+use GeminiLabs\SiteReviews\Defaults\UpdateReviewDefaults;
 use GeminiLabs\SiteReviews\Helpers\Arr;
 use GeminiLabs\SiteReviews\Review;
@@ -127 +128 @@
             $message = _x('Sorry, you are not allowed to edit this review.', 'admin-text', 'site-reviews');
             return new \WP_Error('rest_cannot_edit', $message, [
+                'status' => rest_authorization_required_code(),
+            ]);
+        }
+        if ($this->is_approving($request, $review) && !glsr()->can('publish_post', $review->ID)) {
+            $message = _x('Sorry, you are not allowed to approve this review.', 'admin-text', 'site-reviews');
+            return new \WP_Error('rest_cannot_publish', $message, [
                 'status' => rest_authorization_required_code(),
             ]);
@@ -183 +190 @@
         return true;
     }
+
+    /**
+     * Whether the update approves a review that is not approved yet.
+     */
+    protected function is_approving(\WP_REST_Request $request, Review $review): bool
+    {
+        $values = glsr(UpdateReviewDefaults::class)->restrict($request->get_params()); // the status comes from is_approved
+        return 'publish' === Arr::get($values, 'status') && !$review->is_approved;
+    }
 }

site-reviews/tags/8.3.8/plugin/Controllers/Api/Version1/RestReviewController.php

@@ -291 +291 @@
             ->buildReviewsHtml();
         $response = rest_ensure_response([
-            'pagination' => $html->getPagination($wrap = false),
+            'pagination' => $html->getPagination(false), // don't wrap
             'rendered' => $html->getReviews(),
         ]);

site-reviews/tags/8.3.8/plugin/Controllers/EditorController.php

@@ -73 +73 @@
         }
         $strings = glsr(UpdatedMessageDefaults::class)->defaults();
-        $restored = filter_input(\INPUT_GET, 'revision');
-        if ($revisionTitle = wp_post_revision_title(intval($restored), false)) {
+        $restored = false;
+        $revisionId = intval(filter_input(\INPUT_GET, 'revision'));
+        if ($revisionTitle = wp_post_revision_title($revisionId, false)) {
             $restored = sprintf($strings['restored'], $revisionTitle);
         }

site-reviews/tags/8.3.8/plugin/Controllers/ListTableController.php

@@ -206 +206 @@
                 unset($filters['type']);
             }
-            foreach ($filters as $key => &$value) {
-                $value = glsr($value)->title();
-            }
+            $filters = array_map(fn ($value) => glsr($value)->title(), $filters);
             ksort($filters);
             $setting = 'edit_'.glsr()->post_type.'_filters';
@@ -441 +439 @@
                     $clause['clauses'][] = "AND {$assignedTable}.{$column} = {$value}";
                 }
-            } elseif (in_array($key, ['rating', 'terms', 'type'])) {
+            } elseif (in_array($key, ['rating', 'terms'])) {
                 $clause['clauses'][] = "AND {$ratings}.{$key} = '{$value}'";
+            } elseif ('type' === $key && array_key_exists($value, glsr()->retrieveAs('array', 'review_types'))) {
+                $clause['clauses'][] = "AND {$ratings}.type = '{$value}'";
             } elseif ('author' === $key && '0' === $value) {
                 // Filtering by the "author" URL parameter is automatically done

site-reviews/tags/8.3.8/plugin/Controllers/MainController.php

@@ -52 +52 @@
             $table = glsr($classname);
             if ($table instanceof TableRatings) {
-                $ratingsTable[$table->name($prefixName = true)] = $table->tablename;
+                $ratingsTable[$table->name(true)] = $table->tablename; // use the prefixed name
                 continue;
             }
-            $customTables[$table->name($prefixName = true)] = $table->tablename;
+            $customTables[$table->name(true)] = $table->tablename; // use the prefixed name
         }
         return $customTables + $ratingsTable + $tables;

site-reviews/tags/8.3.8/plugin/Controllers/PrivacyController.php

@@ -152 +152 @@
         ", $email, glsr()->post_type, $this->perPage, ($page - 1) * $this->perPage);
         $reviewIds = glsr(Database::class)->dbGetCol($sql);
-        return empty($reviewIds) ? [] : glsr(Query::class)->reviews([], $reviewIds);
+        return empty($reviewIds) ? [] : glsr(Query::class)->reviews(['order' => 'asc', 'orderby' => 'id'], $reviewIds);
     }
 }

site-reviews/tags/8.3.8/plugin/Controllers/ToolsController.php

@@ -310 +310 @@
     public function ipAddressDetection(Request $request): void
     {
+        if (!glsr()->can(glsr()->getPermission('settings'))) {
+            glsr(Notice::class)->addError(
+                _x('You do not have permission to change the IP address detection.', 'admin-text', 'site-reviews')
+            );
+            return;
+        }
         if (wp_validate_boolean($request->get('alt', 0))) {
             $this->execute(new DetectIpAddress());
@@ -322 +328 @@
     public function ipAddressDetectionAjax(Request $request): void
     {
+        if (!glsr()->can(glsr()->getPermission('settings'))) {
+            glsr(Notice::class)->addError(
+                _x('You do not have permission to change the IP address detection.', 'admin-text', 'site-reviews')
+            );
+            wp_send_json_error([
+                'notices' => glsr(Notice::class)->get(),
+            ]);
+        }
         $command = wp_validate_boolean($request->get('alt', 0))
             ? $this->execute(new DetectIpAddress())

site-reviews/tags/8.3.8/plugin/Controllers/VerificationController.php

@@ -14 +14 @@
 use GeminiLabs\SiteReviews\Modules\Encryption;
 use GeminiLabs\SiteReviews\Modules\Html\Template;
+use GeminiLabs\SiteReviews\Modules\Notice;
 use GeminiLabs\SiteReviews\Request;
 use GeminiLabs\SiteReviews\Review;
@@ -47 +48 @@
     {
         $review = glsr(ReviewManager::class)->get($request->cast('post_id', 'int'));
+        if (!$review->isValid() || !glsr()->can('edit_post', $review->ID)) {
+            glsr(Notice::class)->addError(
+                _x('You do not have permission to request verification of this review.', 'admin-text', 'site-reviews')
+            );
+            wp_send_json_error([
+                'notices' => glsr(Notice::class)->get(),
+            ]);
+        }
         $pathPostId = $review->meta()->cast('_submitted._post_id', 'int');
         $path = Cast::toString(wp_parse_url((string) get_permalink($pathPostId), \PHP_URL_PATH));

site-reviews/tags/8.3.8/plugin/Database.php

@@ -31 +31 @@
     public function beginTransaction(string $table): void
     {
-        if (glsr(Tables::class)->isSqlite()) {
+        if (glsr(Tables::class)->isSqliteLegacy()) {
             $this->dbQuery("BEGIN TRANSACTION;");
-        } elseif (glsr(Tables::class)->isInnodb($table)) {
+        } elseif (glsr(Tables::class)->isSqlite() || glsr(Tables::class)->isInnodb($table)) {
             $this->dbQuery("START TRANSACTION;");
         } elseif (glsr(Tables::class)->isMyisam($table)) {
@@ -159 +159 @@
         $fields = glsr(Query::class)->escFieldsForInsert(array_keys($data));
         $values = glsr(Query::class)->escValuesForInsert($data);
-        if (glsr(Tables::class)->isSqlite()) {
-            $sql = glsr(Query::class)->sql("INSERT OR IGNORE INTO {$table} {$fields} VALUES {$values}");
-        } else {
-            $sql = glsr(Query::class)->sql("INSERT IGNORE INTO {$table} {$fields} VALUES {$values}");
-        }
+        $ignore = glsr(Tables::class)->isSqliteLegacy() ? 'OR IGNORE' : 'IGNORE';
+        $sql = glsr(Query::class)->sql("INSERT {$ignore} INTO {$table} {$fields} VALUES {$values}");
         return $this->dbQuery($sql);
     }
@@ -186 +183 @@
         $fields = glsr(Query::class)->escFieldsForInsert($fields);
         $values = implode(',', $data);
-        if (glsr(Tables::class)->isSqlite()) {
-            $sql = glsr(Query::class)->sql("INSERT OR IGNORE INTO {$table} {$fields} VALUES {$values}");
-        } else {
-            $sql = glsr(Query::class)->sql("INSERT IGNORE INTO {$table} {$fields} VALUES {$values}");
-        }
+        $ignore = glsr(Tables::class)->isSqliteLegacy() ? 'OR IGNORE' : 'IGNORE';
+        $sql = glsr(Query::class)->sql("INSERT {$ignore} INTO {$table} {$fields} VALUES {$values}");
         return $this->dbQuery($sql);
     }

site-reviews/tags/8.3.8/plugin/Database/OptionManager.php

@@ -313 +313 @@
         $writes = [];
         $versions = [];
-        foreach (static::addons() as $slug => $addon) {
+        foreach (static::addons() as $addon) {
             if ($addon->hostedBy()) {
                 continue; // the host claims its whole subtree, hosted values included
@@ -382 +382 @@
     {
         $option = get_option($path, $fallback);
-        return Cast::to($cast, Helper::ifEmpty($option, $fallback, $strict = true));
+        return Cast::to($cast, Helper::ifEmpty($option, $fallback, true)); // use strict comparison
     }
 
@@ -393 +393 @@
     protected function compose(array $settings): array
     {
-        foreach (static::addons() as $slug => $addon) {
+        foreach (static::addons() as $addon) {
             if ($addon->hostedBy()) {
                 continue; // mounted by its host's whole subtree

site-reviews/tags/8.3.8/plugin/Database/Query.php

@@ -44 +44 @@
     public function ratings(array $args = []): array
     {
-        $this->setArgs($args, $unset = ['orderby']);
+        $this->setArgs($args, ['orderby']); // unset orderby
         $results = glsr(Database::class)->dbGetResults($this->queryRatings(), \ARRAY_A);
         return $this->normalizeRatings($results);
@@ -55 +55 @@
             return [];
         }
-        $this->setArgs($args, $unset = ['orderby']);
+        $this->setArgs($args, ['orderby']); // unset orderby
         $results = glsr(Database::class)->dbGetResults($this->$method(), \ARRAY_A);
         return $this->normalizeRatingsByAssignedId($results);
@@ -125 +125 @@
     public function totalReviews(array $args = [], array $reviews = []): int
     {
-        $this->setArgs($args, $unset = ['orderby']);
+        $this->setArgs($args, ['orderby']); // unset orderby
         if (empty($this->sqlLimit()) && !empty($reviews)) {
             return count($reviews);

site-reviews/tags/8.3.8/plugin/Database/RatingManager.php

@@ -22 +22 @@
         $metaTable = sprintf('%smeta', $metaGroup);
         $ratings = glsr(Query::class)->ratingsFor($metaTable, $args);
-        foreach ($ratings as $id => &$group) {
-            $group = $this->reduce($group, $args);
-        }
+        $ratings = array_map(fn ($group) => $this->reduce($group, $args), $ratings);
         return glsr()->filterArray('ratings/grouped', $ratings, $metaGroup, $args);
     }

site-reviews/tags/8.3.8/plugin/Database/Sql.php

@@ -284 +284 @@
             $this->join('assigned_posts', $this->joinKeyword()),
             $this->args['assigned_posts'],
-            $prepare = false
+            false // don't prepare
         );
     }
@@ -304 +304 @@
             $this->join('assigned_terms', $this->joinKeyword()),
             $this->args['assigned_terms'],
-            $prepare = false
+            false // don't prepare
         );
     }
@@ -313 +313 @@
             $this->join('assigned_users', $this->joinKeyword()),
             $this->args['assigned_users'],
-            $prepare = false
+            false // don't prepare
         );
     }
@@ -322 +322 @@
             $this->join('posts', 'INNER JOIN'),
             $this->args['content'],
-            $prepare = false
+            false // don't prepare
         );
     }
@@ -331 +331 @@
             $this->join('posts', 'INNER JOIN'),
             array_filter($this->args['date']),
-            $prepare = false
+            false // don't prepare
         );
     }
@@ -340 +340 @@
             $this->join('posts', 'INNER JOIN'),
             $this->args['user__in'],
-            $prepare = false
+            false // don't prepare
         );
     }
@@ -349 +349 @@
             $this->join('posts', 'INNER JOIN'),
             $this->args['user__not_in'],
-            $prepare = false
+            false // don't prepare
         );
     }

site-reviews/tags/8.3.8/plugin/Database/Tables.php

@@ -124 +124 @@
     {
         return 'sqlite' === $this->engine;
+    }
+
+    /**
+     * If SQLite Database Integration plugin is < v3.
+     */
+    public function isSqliteLegacy(): bool
+    {
+        return $this->isSqlite()
+            && is_a($this->db->dbh, 'WP_SQLite_Translator'); // @phpstan-ignore-line
     }
 

site-reviews/tags/8.3.8/plugin/Defaults/ApiDefaults.php

@@ -13 +13 @@
     public array $casts = [
         'blocking' => 'bool',
+        'cache' => 'bool',
         'compress' => 'bool',
         'cookies' => 'array',
@@ -50 +51 @@
             'blocking' => true, // Whether the calling code requires the result of the request.
             'body' => null,
+            'cache' => true, // if the response is cached
             'compress' => false, // Whether to compress the $body when sending the request.
             'cookies' => [],

site-reviews/tags/8.3.8/plugin/Helpers/Arr.php

@@ -25 +25 @@
         if (is_object($value)) {
             $values = get_object_vars($value);
-            $value = Helper::ifEmpty($values, (array) $value, $strict = true);
+            $value = Helper::ifEmpty($values, (array) $value, true); // use strict comparison
         }
         return is_array($value) ? $value : $fallback;

site-reviews/tags/8.3.8/plugin/Helpers/Text.php

@@ -124 +124 @@
         }
         $wordCount = 0;
-        foreach ($iterator->getPartsIterator() as $part) {
+        while (\IntlBreakIterator::DONE !== $iterator->next()) {
             if (\IntlBreakIterator::WORD_NONE !== $iterator->getRuleStatus()) {
                 ++$wordCount;
@@ -245 +245 @@
         }
         $iterator = \IntlRuleBasedBreakIterator::createWordInstance('');
+        if (!$iterator instanceof \IntlRuleBasedBreakIterator) { // has getRuleStatus()
+            return null;
+        }
         $normalizedText = \Normalizer::normalize($text);
         if (empty($normalizedText)) {
@@ -258 +261 @@
     {
         $map = [];
+        $text = str_replace('⍈', '⍈', $text); // a ⍈ in the text is not a placeholder
         $result = preg_replace_callback('|<([a-z]+)[^>]*?>.*?</\\1>|siu', function ($matches) use (&$map) {
             $map[] = $matches[0];

site-reviews/tags/8.3.8/plugin/Integrations/MultilingualPress/Defaults/SyncReviewDefaults.php

@@ -3 +3 @@
 namespace GeminiLabs\SiteReviews\Integrations\MultilingualPress\Defaults;
 
+use GeminiLabs\SiteReviews\Defaults\CustomFieldsDefaults;
 use GeminiLabs\SiteReviews\Defaults\UpdateReviewDefaults;
 
@@ -39 +40 @@
         'author' => 'name',
     ];
+
+    /**
+     * Normalize provided values, this always runs first.
+     */
+    protected function normalize(array $values = []): array
+    {
+        $customKeys = array_keys(glsr(CustomFieldsDefaults::class)->call('merge', $values));
+        $this->guarded = array_values(array_unique(array_merge($this->guarded, $customKeys))); // guard all custom keys
+        return parent::normalize($values);
+    }
 }

site-reviews/tags/8.3.8/plugin/Integrations/MultilingualPress/RelationSaveHelper.php

@@ -8 +8 @@
 use GeminiLabs\SiteReviews\Defaults\RatingDefaults;
 use GeminiLabs\SiteReviews\Helpers\Arr;
-use GeminiLabs\SiteReviews\Integrations\MultilingualPress\Defaults\SyncReviewDefaults;
 use GeminiLabs\SiteReviews\Integrations\MultilingualPress\MetaboxFields\AssignedPostsField;
 use GeminiLabs\SiteReviews\Integrations\MultilingualPress\MetaboxFields\AssignedUsersField;
@@ -201 +200 @@
     }
 
+    /**
+     * Write the values on the remote review with the assigned posts and users mapped to the remote site.
+     *
+     * @param array $data The guarded values (ReviewCopier::syncData) with the source site's assigned ids
+     */
     public function syncUpdate(array $data, bool $force = false): void
     {
@@ -206 +210 @@
             return;
         }
-        $guarded = glsr(SyncReviewDefaults::class)->merge($data);
+        // Not merged here as this runs on the remote site.
+        $values = $data;
+        unset($values['assigned_posts'], $values['assigned_users']);
         if ($force || $this->canSyncAssignment(AssignedPostsField::FIELD_COPY_ASSIGNED_POSTS)) {
             $sourcePostIds = Arr::consolidate($data['assigned_posts'] ?? []);
-            $guarded['assigned_posts'] = $this->remoteAssignedPosts($sourcePostIds);
+            $values['assigned_posts'] = $this->remoteAssignedPosts($sourcePostIds);
         }
         if ($force || $this->canSyncAssignment(AssignedUsersField::FIELD_COPY_ASSIGNED_USERS)) {
             $sourceUserIds = Arr::consolidate($data['assigned_users'] ?? []);
-            $guarded['assigned_users'] = $this->remoteAssignedUsers($sourceUserIds);
-        }
-        $originalSiteId = $this->maybeSwitchSite($this->context->remoteSiteId());
-        glsr_update_review($this->context->remotePostId(), $guarded);
+            $values['assigned_users'] = $this->remoteAssignedUsers($sourceUserIds);
+        }
+        $originalSiteId = $this->maybeSwitchSite($this->context->remoteSiteId());
+        glsr_update_review($this->context->remotePostId(), $values);
         $this->syncAssignedTerms();
         $this->maybeRestoreSite($originalSiteId);

site-reviews/tags/8.3.8/plugin/Integrations/MultilingualPress/ReviewCopier.php

@@ -3 +3 @@
 namespace GeminiLabs\SiteReviews\Integrations\MultilingualPress;
 
+use GeminiLabs\SiteReviews\Integrations\MultilingualPress\Defaults\SyncReviewDefaults;
+use GeminiLabs\SiteReviews\Review;
 use Inpsyde\MultilingualPress\Framework\Api\ContentRelations;
 use Inpsyde\MultilingualPress\Framework\SwitchSiteTrait;
@@ -91 +93 @@
     public function sync(): void
     {
-        $review = glsr_get_review($this->sourcePostId);
-        $data = wp_parse_args($review->toArray(), $review->custom()->toArray());
+        $data = $this->syncData(glsr_get_review($this->sourcePostId));
         $this->run(function ($context) use ($data) {
             $helper = new RelationSaveHelper($context);
             $helper->syncUpdate($data, true);
         });
+    }
+
+    public function syncData(Review $review): array
+    {
+        $data = wp_parse_args($review->toArray(), $review->custom()->toArray());
+        // Guarded on the source site: the site-reviews/defaults/sync-review filter reads the review's form here.
+        $data = glsr(SyncReviewDefaults::class)->merge($data);
+        $data['assigned_posts'] = $review->assigned_posts; // the source ids mapped by syncUpdate() on each remote site
+        $data['assigned_users'] = $review->assigned_users;
+        return $data;
     }
 

site-reviews/tags/8.3.8/plugin/Integrations/WPLoyalty/Controller.php

@@ -44 +44 @@
             ]);
             $messages = [$field->after];
-            foreach ($rewardsList as $action => $rewards) {
-                foreach ($rewards as $key => $reward) {
+            foreach ($rewardsList as $rewards) {
+                foreach ($rewards as $reward) {
                     $messages[] = $reward['messages'] ?? '';
                 }

site-reviews/tags/8.3.8/plugin/Integrations/WooCommerce/Controllers/RestApi/ProductReviewsController.php

@@ -226 +226 @@
         $postArgs = $this->prepare_item_for_update($request);
         $postArgs['ID'] = $review->ID;
-        $updatePost = wp_update_post($postArgs, $wperror = true);
+        $updatePost = wp_update_post($postArgs, true); // return a WP_Error on failure
         if (is_wp_error($updatePost)) {
             return new \WP_Error('woocommerce_rest_comment_failed_edit', 'Updating review failed.', ['status' => 500]);

site-reviews/tags/8.3.8/plugin/Modules/Html/Form.php

@@ -500 +500 @@
     protected function normalizeFieldValue(FieldContract $field): void
     {
+        if ($this->session->failed && 'hidden' === $field->original_type) {
+            return; // hidden fields are signed
+        }
         if ($field->isChoiceField()) {
             $value = Cast::toArray($this->session->values[$field->original_name] ?? []);
@@ -511 +514 @@
     }
 
+    /**
+     * @return array<string, string|array{hidden: string[], visible: int}>
+     */
+    protected function signedValues(): array
+    {
+        $lists = $values = [];
+        foreach ($this->hidden() as $field) {
+            $values[$field->original_name] = $field->value;
+            if (str_ends_with($field->name, '[]')) { // PHP reads these fields as a list
+                $lists[$field->original_name]['hidden'][] = Cast::toString($field->value);
+            }
+        }
+        $visibleFields = $this->visible();
+        foreach (array_keys($lists) as $name) {
+            $lists[$name]['visible'] = count(
+                array_filter($visibleFields, fn ($field) => $name === $field->original_name)
+            );
+        }
+        $values = array_merge($values, $lists);
+        return $this->app()->filterArray("{$this->formName()}/signature/values", $values, $this);
+    }
+
     protected function signForm(): void
     {
-        $hidden = $this->hidden();
-        $values = [];
-        foreach ($hidden as $field) {
-            $values[$field->original_name] = $field->value;
-        }
-        $values = $this->app()->filterArray("{$this->formName()}/signature/values", $values, $this);
+        $values = $this->signedValues();
         $signatureField = $this->field('form_signature', [
             'type' => 'hidden',
             'value' => glsr(Encryption::class)->encrypt(maybe_serialize($values)),
         ]);
-        $fields = array_values(array_merge($hidden, [$signatureField], $this->visible()));
+        $fields = array_values(array_merge($this->hidden(), [$signatureField], $this->visible()));
         $this->exchangeArray($fields);
     }

site-reviews/tags/8.3.8/plugin/Modules/Html/ReviewForm.php

@@ -6 +6 @@
 use GeminiLabs\SiteReviews\Helpers\Arr;
 use GeminiLabs\SiteReviews\Helpers\Cast;
+use GeminiLabs\SiteReviews\Request;
 
 class ReviewForm extends Form
@@ -26 +27 @@
     {
         do_action('litespeed_nonce', 'submit-review'); // @litespeedcache
-        $referer = glsr()->filterString('review-form/referer', wp_get_referer());
+        $referer = glsr()->filterString('review-form/referer', $this->referer());
         $config = [
             '_action' => 'submit-review',
@@ -88 +89 @@
         return $fields;
     }
+
+    /**
+     * The page the visitor came from.
+     */
+    protected function referer(): string
+    {
+        if (glsr()->session()->cast('form_invalid', 'bool')) {
+            $submitted = new Request(glsr()->session()->array('form_values'));
+            if ($referer = Cast::toString($submitted->signedValues()['_referer'] ?? '')) {
+                return $referer;
+            }
+        }
+        return Cast::toString(wp_get_referer());
+    }
 }

site-reviews/tags/8.3.8/plugin/Modules/Html/SettingForm.php

@@ -141 +141 @@
             return; // only a setting field has dependencies
         }
-        $isHidden = false;
         foreach (Arr::consolidate($field->depends_on) as $path => $expectedValue) {
             $default = Arr::get(glsr()->defaults(), $path);

site-reviews/tags/8.3.8/plugin/Modules/Paginate.php

@@ -19 +19 @@
         $parts = explode('?', $base);
         if (wp_is_serving_rest_request() || !NormalizePaginationArgs::pagedRequest()->isEmpty()) {
-            $parts = [$parts[0]]; // this is an AJAX request
+            $parts = []; // this is an AJAX request
         }
         if ($parts[1] ?? false) {

site-reviews/tags/8.3.8/plugin/Modules/Sanitizers/ArraySanitizer.php

@@ -3 +3 @@
 namespace GeminiLabs\SiteReviews\Modules\Sanitizers;
 
+use GeminiLabs\SiteReviews\Helpers\Arr;
 use GeminiLabs\SiteReviews\Helpers\Cast;
 
@@ -9 +10 @@
     abstract public function run(): array;
 
+    /**
+     * The values, with a comma-separated string among them read as several values.
+     */
+    protected function splitValue(): array
+    {
+        $values = [];
+        foreach ($this->value() as $value) {
+            $values[] = is_string($value) ? Arr::convertFromString($value) : [$value];
+        }
+        return array_merge([], ...$values);
+    }
+
     protected function value(): array
     {

site-reviews/tags/8.3.8/plugin/Modules/Sanitizers/SanitizeEmails.php

@@ -8 +8 @@
     {
         $emails = explode(',', $this->value());
-        foreach ($emails as &$email) {
-            $email = sanitize_email($email);
-        }
+        $emails = array_map(fn ($email) => sanitize_email($email), $emails);
         return implode(',', array_filter($emails));
     }

site-reviews/tags/8.3.8/plugin/Modules/Sanitizers/SanitizePostIds.php

@@ -11 +11 @@
     {
         return Arr::uniqueInt(
-            array_map([Helper::class, 'getPostId'], $this->value())
+            array_map([Helper::class, 'getPostId'], $this->splitValue())
         );
     }

site-reviews/tags/8.3.8/plugin/Modules/Sanitizers/SanitizeTermIds.php

@@ -11 +11 @@
     {
         return Arr::uniqueInt(
-            array_map([Helper::class, 'getTermTaxonomyId'], $this->value())
+            array_map([Helper::class, 'getTermTaxonomyId'], $this->splitValue())
         );
     }

site-reviews/tags/8.3.8/plugin/Modules/Sanitizers/SanitizeUserIds.php

@@ -11 +11 @@
     {
         return Arr::uniqueInt(
-            array_map([Helper::class, 'getUserId'], $this->value())
+            array_map([Helper::class, 'getUserId'], $this->splitValue())
         );
     }

site-reviews/tags/8.3.8/plugin/Modules/Schema.php

@@ -114 +114 @@
     {
         if ($schema = $this->retrieve()) {
-            $json = (string) wp_json_encode($schema, \JSON_UNESCAPED_UNICODE | \JSON_UNESCAPED_SLASHES);
+            $json = (string) wp_json_encode($schema, \JSON_HEX_AMP | \JSON_HEX_TAG | \JSON_UNESCAPED_SLASHES | \JSON_UNESCAPED_UNICODE);
             printf('<script type="application/ld+json" class="%s-schema">%s</script>', glsr()->id, $json);
         }
@@ -209 +209 @@
             return $this->getSchemaOptionDefault($setting, $fallback);
         }
-        return Helper::ifEmpty($setting, $fallback, $strict = true);
+        return Helper::ifEmpty($setting, $fallback, true); // use strict comparison
     }
 

site-reviews/tags/8.3.8/plugin/Modules/SystemInfo.php

@@ -117 +117 @@
             ];
         }
-        $engines = glsr(Tables::class)->tableEngines($removePrefix = true);
+        $engines = glsr(Tables::class)->tableEngines(true); // remove the prefix
         foreach ($engines as $engine => $tables) {
             $engines[$engine] = sprintf('%s (%s)', $engine, implode('|', $tables));

site-reviews/tags/8.3.8/plugin/Modules/Validator.php

@@ -172 +172 @@
      * @param mixed $value
      */
-    protected function getSize(string $attribute, $value): int
+    protected function getSize(string $attribute, $value): float
     {
         $hasNumeric = $this->hasRule($attribute, $this->numericRules);
         if (is_numeric($value) && $hasNumeric) {
-            return (int) $value;
+            return (float) $value;
         }
         if (is_array($value)) {

site-reviews/tags/8.3.8/plugin/Modules/Validator/CaptchaValidatorAbstract.php

@@ -84 +84 @@
         return [
             'body' => $body,
-            'force' => true,
+            'cache' => false,
         ];
     }

site-reviews/tags/8.3.8/plugin/Modules/Validator/FriendlycaptchaV2Validator.php

@@ -65 +65 @@
     {
         return [
-            'force' => true,
+            'body' => wp_json_encode($body),
+            'cache' => false,
             'headers' => [
                 'Content-Type' => 'application/json',
                 'X-API-Key' => $this->siteSecret(),
             ],
-            'body' => wp_json_encode($body),
         ];
     }

site-reviews/tags/8.3.8/plugin/Modules/Validator/ProcaptchaValidator.php

@@ -55 +55 @@
     {
         return [
-            'force' => true,
+            'body' => wp_json_encode($body),
+            'cache' => false,
             'headers' => ['Content-Type' => 'application/json'],
-            'body' => wp_json_encode($body),
         ];
     }

site-reviews/tags/8.3.8/plugin/Modules/Validator/SignatureValidator.php

@@ -3 +3 @@
 namespace GeminiLabs\SiteReviews\Modules\Validator;
 
+use GeminiLabs\SiteReviews\Helpers\Arr;
 use GeminiLabs\SiteReviews\Helpers\Cast;
 
@@ -10 +11 @@
     {
         $isValid = true;
-        $values = $this->request->signedValues(['form_id' => '']);
-        foreach ($values as $key => $value) {
-            if (Cast::toString($value) !== $this->request->cast($key, 'string')) {
+        $signedValues = $this->request->signedValues(['form_id' => '']);
+        foreach ($signedValues as $key => $signedValue) {
+            if ($this->hasValueChanged($signedValue, $this->request->get($key))) {
                 $isValid = false;
-                glsr_log()->debug($values);
+                glsr_log()->debug($signedValues);
                 break;
             }
         }
-        return glsr()->filterBool('validate/signature', $isValid, $values, $this->request);
+        return glsr()->filterBool('validate/signature', $isValid, $signedValues, $this->request);
     }
 
@@ -30 +31 @@
         }
     }
+
+    /**
+     * @param string|array{hidden?: string[], visible?: int} $signedValue
+     * @param mixed                                          $requestValue
+     */
+    protected function hasValueChanged($signedValue, $requestValue): bool
+    {
+        if (!is_array($signedValue)) {
+            return is_array($requestValue) || Cast::toString($signedValue) !== Cast::toString($requestValue);
+        }
+        if (!Arr::isIndexedAndFlat($requestValue)) {
+            return true;
+        }
+        $requestValue = array_map([Cast::class, 'toString'], $requestValue);
+        foreach (Arr::consolidate($signedValue['hidden'] ?? []) as $hidden) {
+            $index = array_search(Cast::toString($hidden), $requestValue, true);
+            if (false === $index) {
+                return true;
+            }
+            unset($requestValue[$index]);
+        }
+        return count($requestValue) > Cast::toInt($signedValue['visible'] ?? 0);
+    }
 }

site-reviews/tags/8.3.8/plugin/Modules/Validator/ValidationRules.php

@@ -162 +162 @@
      * @param mixed $value
      */
-    abstract protected function getSize(string $attribute, $value): int;
+    abstract protected function getSize(string $attribute, $value): float;
 
     /**
@@ -173 +173 @@
         }
         return preg_replace_callback('/(%s)/', function () use (&$parameters) {
-            foreach ($parameters as $key => $value) {
-                return array_shift($parameters);
-            }
+            return array_shift($parameters);
         }, $message);
     }

site-reviews/tags/8.3.8/plugin/Notices/GatekeeperNotice.php

@@ -121 +121 @@
             return '';
         }
+        if (!str_starts_with($data['plugin_uri'], 'https://wordpress.org/plugins/')) {
+            return '';
+        }
         return $this->pluginAction([
             'action' => 'install-plugin',
@@ -126 +129 @@
             'name' => $data['name'],
             'nonce_prefix' => 'install-plugin_',
-            'plugin' => $data['textdomain'],
+            'plugin' => dirname($data['plugin']), // wordpress.org names a plugin's folder after its slug
             /* translators: %s: the plugin name */
             'text' => _x('Install %s', 'admin-text', 'site-reviews'),
@@ -183 +186 @@
     {
         $links = [];
-        foreach ($errors as $plugin => $data) {
+        foreach ($errors as $data) {
             $links[] = sprintf('<span class="plugin-%s"><a href="%s">%s</a></span>',
                 $data['textdomain'],

site-reviews/tags/8.3.8/readme.txt

@@ -4 +4 @@
 Tags: reviews, ratings, testimonials, product reviews, business reviews
 Tested up to: 7.1
-Stable tag: 8.3.7
+Stable tag: 8.3.8
 License: GPLv3
 License URI: https://www.gnu.org/licenses/gpl-3.0.html
@@ -211 +211 @@
 
 == Changelog ==
+
+= 8.3.8 (2026-11-15) =
+
+- Fixed a security issue in review excerpts
+- Fixed a security issue in the notice shown after restoring a revision
+- Fixed a security issue in the review type filter
+- Fixed a security issue in the schema
+- Fixed captcha checks slowly filling up the database
+- Fixed forms with more than one Assigned Pages, Categories or Users field not submitting
+- Fixed hidden form fields changing after a failed submission
+- Fixed MultilingualPress translations losing their custom field values when the original review is edited
+- Fixed number fields ignoring decimals in their minimum and maximum
+- Fixed reviews not saving with version 3 of the SQLite Database Integration plugin
+- Fixed some assigned pages, categories or users not being saved with a review
+- Fixed the admin search permission check
+- Fixed the Install button in the missing plugin notice
+- Fixed the IP address detection tool permission check
+- Fixed the review approval permission check
+- Fixed the validation of submitted reviews
+- Fixed the verification email permission check
 
 = 8.3.7 (2026-10-31) =

site-reviews/tags/8.3.8/site-reviews.php

@@ -8 +8 @@
  * Plugin URI:           https://wordpress.org/plugins/site-reviews
  * Description:          Receive and display reviews on your website
- * Version:              8.3.7
+ * Version:              8.3.8
  * Author:               Paul Ryley
  * Author URI:           https://site-reviews.com

site-reviews/trunk/changelog.txt

@@ -1 +1 @@
 == Changelog ==
+
+= 8.3.8 (2026-11-15) =
+
+- Fixed a security issue in review excerpts
+- Fixed a security issue in the notice shown after restoring a revision
+- Fixed a security issue in the review type filter
+- Fixed a security issue in the schema
+- Fixed captcha checks slowly filling up the database
+- Fixed forms with more than one Assigned Pages, Categories or Users field not submitting
+- Fixed hidden form fields changing after a failed submission
+- Fixed MultilingualPress translations losing their custom field values when the original review is edited
+- Fixed number fields ignoring decimals in their minimum and maximum
+- Fixed reviews not saving with version 3 of the SQLite Database Integration plugin
+- Fixed some assigned pages, categories or users not being saved with a review
+- Fixed the admin search permission check
+- Fixed the Install button in the missing plugin notice
+- Fixed the IP address detection tool permission check
+- Fixed the review approval permission check
+- Fixed the validation of submitted reviews
+- Fixed the verification email permission check
 
 = 8.3.7 (2026-10-31) =

site-reviews/trunk/languages/site-reviews-en_US.po

@@ -116 +116 @@
 
 #: plugin/Controllers/Api/Version1/RestRenderController.php:103
-#: plugin/Controllers/VerificationController.php:96
+#: plugin/Controllers/VerificationController.php:105
 msgid "Thank you, your review has been verified."
 msgstr "Thank you, your review has been verified."
 
 #: plugin/Controllers/Api/Version1/RestRenderController.php:104
-#: plugin/Controllers/VerificationController.php:97
+#: plugin/Controllers/VerificationController.php:106
 msgid "Thank you, your review has been verified and is awaiting approval."
 msgstr "Thank you, your review has been verified and is awaiting approval."
@@ -432 +432 @@
 msgstr "Submitting, please wait..."
 
-#: plugin/Modules/Html/ReviewForm.php:14
+#: plugin/Modules/Html/ReviewForm.php:15
 msgid "Submit Review"
 msgstr "Submit Review"
@@ -476 +476 @@
 msgstr "You have already submitted a review."
 
-#: plugin/Modules/Validator/SignatureValidator.php:27
+#: plugin/Modules/Validator/SignatureValidator.php:28
 #: views/pages/documentation/support/common-problems-and-solutions.php:89
 msgid "This review cannot be submitted, please refresh the page and try again."
@@ -2437 +2437 @@
 msgstr "Enabling this option will persist field values entered into the review form until either the review is submitted or the browser tab or window is closed."
 
-#: plugin/Database.php:237
+#: plugin/Database.php:231
 msgctxt "admin-text"
 msgid "(no title)"
@@ -3400 +3400 @@
 
 #: plugin/Commands/SendVerificationEmail.php:71
-#: plugin/Controllers/VerificationController.php:34
+#: plugin/Controllers/VerificationController.php:35
 msgctxt "admin-text"
 msgid "Resend Verification Request"
@@ -3486 +3486 @@
 msgstr "Import"
 
-#: plugin/Controllers/AdminController.php:309
-#: plugin/Controllers/AdminController.php:327
-#: plugin/Controllers/AdminController.php:340
+#: plugin/Controllers/AdminController.php:313
+#: plugin/Controllers/AdminController.php:332
+#: plugin/Controllers/AdminController.php:346
 msgctxt "admin-text"
 msgid "Nothing found."
@@ -3580 +3580 @@
 
 #. translators: %s: the review type
-#: plugin/Controllers/EditorController.php:108
+#: plugin/Controllers/EditorController.php:109
 #, php-format
 msgctxt "admin-text"
@@ -3681 +3681 @@
 msgstr "Respond"
 
-#: plugin/Controllers/ListTableController.php:272
+#: plugin/Controllers/ListTableController.php:270
 msgctxt "admin-text"
 msgid "Sorry, you are not allowed to respond to this review."
 msgstr "Sorry, you are not allowed to respond to this review."
 
-#: plugin/Controllers/ListTableController.php:275
+#: plugin/Controllers/ListTableController.php:273
 msgctxt "admin-text"
 msgid "Someone"
@@ -3692 +3692 @@
 
 #. translators: %s: user's name
-#: plugin/Controllers/ListTableController.php:281
+#: plugin/Controllers/ListTableController.php:279
 #, php-format
 msgctxt "admin-text"
@@ -3821 +3821 @@
 msgstr "You do not have permission to import settings."
 
-#: plugin/Controllers/ToolsController.php:366
+#: plugin/Controllers/ToolsController.php:380
 msgctxt "admin-text"
 msgid "reload the page"
@@ -3827 +3827 @@
 
 #. translators: %s: a link with the text "reload the page"
-#: plugin/Controllers/ToolsController.php:371
+#: plugin/Controllers/ToolsController.php:385
 #, php-format
 msgctxt "admin-text"
@@ -3833 +3833 @@
 msgstr "The permissions have been repaired, please %s for them to take effect."
 
-#: plugin/Controllers/ToolsController.php:446
+#: plugin/Controllers/ToolsController.php:460
 msgctxt "admin-text"
 msgid "You do not have permission to rollback the plugin."
@@ -3921 +3921 @@
 msgstr "Approved on:"
 
-#: plugin/Controllers/VerificationController.php:35
+#: plugin/Controllers/VerificationController.php:36
 msgctxt "admin-text"
 msgid "Send Verification Request"
@@ -4224 +4224 @@
 
 #. translators: %s: the plugin name
-#: plugin/Notices/GatekeeperNotice.php:130
+#: plugin/Notices/GatekeeperNotice.php:133
 #, php-format
 msgctxt "admin-text"
@@ -4231 +4231 @@
 
 #. translators: %s: the plugin name
-#: plugin/Notices/GatekeeperNotice.php:146
+#: plugin/Notices/GatekeeperNotice.php:149
 #, php-format
 msgctxt "admin-text"
@@ -7116 +7116 @@
 msgstr "Limit result set to verified status."
 
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:18
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:19
 msgctxt "admin-text"
 msgid "Cannot create existing review."
 msgstr "Cannot create existing review."
 
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:22
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:23
 msgctxt "admin-text"
 msgid "Sorry, you are not allowed to create reviews as this user."
 msgstr "Sorry, you are not allowed to create reviews as this user."
 
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:26
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:27
 msgctxt "admin-text"
 msgid "Sorry, you are not allowed to create reviews as this review author."
 msgstr "Sorry, you are not allowed to create reviews as this review author."
 
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:30
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:139
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:31
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:146
 msgctxt "admin-text"
 msgid "Sorry, you are not allowed to assign the provided terms."
 msgstr "Sorry, you are not allowed to assign the provided terms."
 
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:45
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:68
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:121
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:46
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:69
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:122
 msgctxt "admin-text"
 msgid "Invalid review ID."
 msgstr "Invalid review ID."
 
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:51
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:52
 msgctxt "admin-text"
 msgid "Sorry, you are not allowed to delete this review."
 msgstr "Sorry, you are not allowed to delete this review."
 
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:74
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:75
 msgctxt "admin-text"
 msgid "Sorry, you are not allowed to view this review."
 msgstr "Sorry, you are not allowed to view this review."
 
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:81
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:127
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:82
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:128
 msgctxt "admin-text"
 msgid "Sorry, you are not allowed to edit this review."
 msgstr "Sorry, you are not allowed to edit this review."
 
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:97
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:98
 msgctxt "admin-text"
 msgid "Sorry, you do not have permission to access reviews."
 msgstr "Sorry, you do not have permission to access reviews."
 
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:104
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:105
 msgctxt "admin-text"
 msgid "Sorry, you are not allowed to edit reviews."
 msgstr "Sorry, you are not allowed to edit reviews."
 
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:133
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:140
 msgctxt "admin-text"
 msgid "Sorry, you are not allowed to update the review as this user."
@@ -7560 +7560 @@
 
 #. translators: %s: plugin name
-#: plugin/Controllers/ToolsController.php:427
+#: plugin/Controllers/ToolsController.php:441
 #, php-format
 msgctxt "Site Reviews (admin-text)"
@@ -9235 +9235 @@
 msgstr ""
 
-#: plugin/Controllers/ToolsController.php:451
+#: plugin/Controllers/ToolsController.php:465
 #: views/pages/tools/general/rollback-plugin.php:21
 msgctxt "admin-text"
@@ -9254 +9254 @@
 msgid "%s was not updated because its folder is a git repository."
 msgstr ""
+
+#: plugin/Controllers/AdminController.php:390
+msgctxt "admin-text"
+msgid "You do not have permission to search."
+msgstr ""
+
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:134
+msgctxt "admin-text"
+msgid "Sorry, you are not allowed to approve this review."
+msgstr ""
+
+#: plugin/Controllers/ToolsController.php:314
+#: plugin/Controllers/ToolsController.php:332
+msgctxt "admin-text"
+msgid "You do not have permission to change the IP address detection."
+msgstr ""
+
+#: plugin/Controllers/VerificationController.php:52
+msgctxt "admin-text"
+msgid "You do not have permission to request verification of this review."
+msgstr ""

site-reviews/trunk/languages/site-reviews.pot

@@ -3 +3 @@
 msgid ""
 msgstr ""
-"Project-Id-Version: Site Reviews 8.3.7\n"
+"Project-Id-Version: Site Reviews 8.3.8\n"
 "Report-Msgid-Bugs-To: https://wordpress.org/support/plugin/site-reviews\n"
 "Last-Translator: Paul Ryley <paul@geminilabs.io>\n"
@@ -3268 +3268 @@
 
 #: plugin/Commands/SendVerificationEmail.php:71
-#: plugin/Controllers/VerificationController.php:34
+#: plugin/Controllers/VerificationController.php:35
 msgctxt "admin-text"
 msgid "Resend Verification Request"
@@ -3358 +3358 @@
 msgstr ""
 
-#: plugin/Controllers/AdminController.php:309
-#: plugin/Controllers/AdminController.php:327
-#: plugin/Controllers/AdminController.php:340
+#: plugin/Controllers/AdminController.php:313
+#: plugin/Controllers/AdminController.php:332
+#: plugin/Controllers/AdminController.php:346
 msgctxt "admin-text"
 msgid "Nothing found."
+msgstr ""
+
+#: plugin/Controllers/AdminController.php:390
+msgctxt "admin-text"
+msgid "You do not have permission to search."
 msgstr ""
 
@@ -3494 +3499 @@
 msgstr ""
 
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:18
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:19
 msgctxt "admin-text"
 msgid "Cannot create existing review."
 msgstr ""
 
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:22
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:23
 msgctxt "admin-text"
 msgid "Sorry, you are not allowed to create reviews as this user."
 msgstr ""
 
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:26
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:27
 msgctxt "admin-text"
 msgid "Sorry, you are not allowed to create reviews as this review author."
 msgstr ""
 
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:30
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:139
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:31
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:146
 msgctxt "admin-text"
 msgid "Sorry, you are not allowed to assign the provided terms."
 msgstr ""
 
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:45
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:68
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:121
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:46
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:69
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:122
 msgctxt "admin-text"
 msgid "Invalid review ID."
 msgstr ""
 
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:51
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:52
 msgctxt "admin-text"
 msgid "Sorry, you are not allowed to delete this review."
 msgstr ""
 
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:74
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:75
 msgctxt "admin-text"
 msgid "Sorry, you are not allowed to view this review."
 msgstr ""
 
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:81
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:127
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:82
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:128
 msgctxt "admin-text"
 msgid "Sorry, you are not allowed to edit this review."
 msgstr ""
 
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:97
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:98
 msgctxt "admin-text"
 msgid "Sorry, you do not have permission to access reviews."
 msgstr ""
 
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:104
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:105
 msgctxt "admin-text"
 msgid "Sorry, you are not allowed to edit reviews."
 msgstr ""
 
-#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:133
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:134
+msgctxt "admin-text"
+msgid "Sorry, you are not allowed to approve this review."
+msgstr ""
+
+#: plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php:140
 msgctxt "admin-text"
 msgid "Sorry, you are not allowed to update the review as this user."
@@ -3562 +3572 @@
 
 #: plugin/Controllers/Api/Version1/RestRenderController.php:103
-#: plugin/Controllers/VerificationController.php:96
+#: plugin/Controllers/VerificationController.php:105
 msgid "Thank you, your review has been verified."
 msgstr ""
 
 #: plugin/Controllers/Api/Version1/RestRenderController.php:104
-#: plugin/Controllers/VerificationController.php:97
+#: plugin/Controllers/VerificationController.php:106
 msgid "Thank you, your review has been verified and is awaiting approval."
 msgstr ""
@@ -3923 +3933 @@
 
 #. translators: %s: the review type
-#: plugin/Controllers/EditorController.php:108
+#: plugin/Controllers/EditorController.php:109
 #, php-format
 msgctxt "admin-text"
@@ -4192 +4202 @@
 msgstr ""
 
-#: plugin/Controllers/ListTableController.php:272
+#: plugin/Controllers/ListTableController.php:270
 msgctxt "admin-text"
 msgid "Sorry, you are not allowed to respond to this review."
 msgstr ""
 
-#: plugin/Controllers/ListTableController.php:275
+#: plugin/Controllers/ListTableController.php:273
 msgctxt "admin-text"
 msgid "Someone"
@@ -4203 +4213 @@
 
 #. translators: %s: user's name
-#: plugin/Controllers/ListTableController.php:281
+#: plugin/Controllers/ListTableController.php:279
 #, php-format
 msgctxt "admin-text"
@@ -4339 +4349 @@
 msgstr ""
 
-#: plugin/Controllers/ToolsController.php:366
+#: plugin/Controllers/ToolsController.php:314
+#: plugin/Controllers/ToolsController.php:332
+msgctxt "admin-text"
+msgid "You do not have permission to change the IP address detection."
+msgstr ""
+
+#: plugin/Controllers/ToolsController.php:380
 msgctxt "admin-text"
 msgid "reload the page"
@@ -4345 +4361 @@
 
 #. translators: %s: a link with the text "reload the page"
-#: plugin/Controllers/ToolsController.php:371
+#: plugin/Controllers/ToolsController.php:385
 #, php-format
 msgctxt "admin-text"
@@ -4352 +4368 @@
 
 #. translators: %s: plugin name
-#: plugin/Controllers/ToolsController.php:427
+#: plugin/Controllers/ToolsController.php:441
 #, php-format
 msgctxt "Site Reviews (admin-text)"
@@ -4358 +4374 @@
 msgstr ""
 
-#: plugin/Controllers/ToolsController.php:446
+#: plugin/Controllers/ToolsController.php:460
 msgctxt "admin-text"
 msgid "You do not have permission to rollback the plugin."
 msgstr ""
 
-#: plugin/Controllers/ToolsController.php:451
+#: plugin/Controllers/ToolsController.php:465
 #: views/pages/tools/general/rollback-plugin.php:21
 msgctxt "admin-text"
@@ -4471 +4487 @@
 msgstr ""
 
-#: plugin/Controllers/VerificationController.php:35
+#: plugin/Controllers/VerificationController.php:36
 msgctxt "admin-text"
 msgid "Send Verification Request"
+msgstr ""
+
+#: plugin/Controllers/VerificationController.php:52
+msgctxt "admin-text"
+msgid "You do not have permission to request verification of this review."
 msgstr ""
 
@@ -4507 +4528 @@
 msgstr ""
 
-#: plugin/Database.php:237
+#: plugin/Database.php:231
 msgctxt "admin-text"
 msgid "(no title)"
@@ -6497 +6518 @@
 msgstr ""
 
-#: plugin/Modules/Html/ReviewForm.php:14
+#: plugin/Modules/Html/ReviewForm.php:15
 msgid "Submit Review"
 msgstr ""
@@ -6629 +6650 @@
 msgstr ""
 
-#: plugin/Modules/Validator/SignatureValidator.php:27
+#: plugin/Modules/Validator/SignatureValidator.php:28
 #: views/pages/documentation/support/common-problems-and-solutions.php:89
 msgid "This review cannot be submitted, please refresh the page and try again."
@@ -6660 +6681 @@
 
 #. translators: %s: the plugin name
-#: plugin/Notices/GatekeeperNotice.php:130
+#: plugin/Notices/GatekeeperNotice.php:133
 #, php-format
 msgctxt "admin-text"
@@ -6667 +6688 @@
 
 #. translators: %s: the plugin name
-#: plugin/Notices/GatekeeperNotice.php:146
+#: plugin/Notices/GatekeeperNotice.php:149
 #, php-format
 msgctxt "admin-text"

site-reviews/trunk/plugin/Api.php

@@ -81 +81 @@
             $this->forget($transientKey);
         } else {
-            $result = get_site_transient($transientKey);
+            $result = $args['cache'] ? get_site_transient($transientKey) : false;
             if (!empty($result)) {
                 return new Response($result);
@@ -97 +97 @@
             $response = new Response($result);
             if ($response->successful()) {
-                $this->remember($transientKey, $result, $args['expiration']);
+                if ($args['cache']) {
+                    $this->remember($transientKey, $result, $args['expiration']);
+                }
                 if ($args['skip_when_down']) {
                     $this->markReachable();

site-reviews/trunk/plugin/Commands/CreateReview.php

@@ -60 +60 @@
         $this->request = $this->normalize($request); // IP address is set here
         $this->setProperties(); // do this after setting the request
-        $this->review = new Review($this->toArray(), $init = false);
+        $this->review = new Review($this->toArray(), false); // don't init
         $this->validation = new Arguments();
         $this->custom = $this->custom();
@@ -239 +239 @@
             $request->set('date', '');
             $request->set('date_gmt', '');
+            $request->set('geolocation', '');
             $request->set('is_pinned', false);
             $request->set('is_verified', false);
@@ -244 +245 @@
             $request->set('response_by', 0);
             $request->set('type', 'local');
+            $request->set('verified', '');
+            $request->set('verified_on', '');
+            $request->set('verified_requested', '');
         }
         glsr()->action('review/request', $request);

site-reviews/trunk/plugin/Commands/FetchPagedReviews.php

@@ -33 +33 @@
         return [
             'max_num_pages' => $this->html->max_num_pages,
-            'pagination' => $this->html->getPagination($wrap = false),
+            'pagination' => $this->html->getPagination(false), // don't wrap
             'reviews' => $this->html->getReviews(),
         ];

site-reviews/trunk/plugin/Controllers/AdminController.php

@@ -262 +262 @@
     public function searchAssignedPostsAjax(Request $request): void
     {
+        $this->checkSearchPermission();
         $search = glsr(Sanitizer::class)->sanitizeText($request->search);
         $results = glsr(Database::class)->searchAssignedPosts($search)->results();
@@ -274 +275 @@
     public function searchAssignedUsersAjax(Request $request): void
     {
+        $this->checkSearchPermission();
         $search = glsr(Sanitizer::class)->sanitizeText($request->search);
         $results = glsr(Database::class)->searchAssignedUsers($search)->results();
@@ -289 +291 @@
     public function searchAuthorsAjax(Request $request): void
     {
+        $this->checkSearchPermission();
         $search = glsr(Sanitizer::class)->sanitizeText($request->search);
         $results = glsr(Database::class)->searchUsers($search)->results();
@@ -304 +307 @@
     public function searchPostsAjax(Request $request): void
     {
+        $this->checkSearchPermission();
         $search = glsr(Sanitizer::class)->sanitizeText($request->search);
         $results = glsr(Database::class)->searchPosts($search)->render();
@@ -317 +321 @@
     public function searchStringsAjax(Request $request): void
     {
+        $this->checkSearchPermission();
         $search = glsr(Sanitizer::class)->sanitizeText($request->search);
         $exclude = Arr::consolidate($request->exclude);
@@ -335 +340 @@
     public function searchUsersAjax(Request $request): void
     {
+        $this->checkSearchPermission();
         $search = glsr(Sanitizer::class)->sanitizeText($request->search);
         $results = glsr(Database::class)->searchUsers($search)->render();
@@ -372 +378 @@
         $this->execute(new ToggleStatus($request))->sendJsonResponse();
     }
+
+    /**
+     * Refuse the request with an error notice unless the user can edit reviews.
+     */
+    protected function checkSearchPermission(): void
+    {
+        if (glsr()->can('edit_posts')) {
+            return;
+        }
+        glsr(Notice::class)->addError(
+            _x('You do not have permission to search.', 'admin-text', 'site-reviews')
+        );
+        wp_send_json_error([
+            'notices' => glsr(Notice::class)->get(),
+        ]);
+    }
 }

site-reviews/trunk/plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php

@@ -3 +3 @@
 namespace GeminiLabs\SiteReviews\Controllers\Api\Version1\Permissions;
 
+use GeminiLabs\SiteReviews\Defaults\UpdateReviewDefaults;
 use GeminiLabs\SiteReviews\Helpers\Arr;
 use GeminiLabs\SiteReviews\Review;
@@ -127 +128 @@
             $message = _x('Sorry, you are not allowed to edit this review.', 'admin-text', 'site-reviews');
             return new \WP_Error('rest_cannot_edit', $message, [
+                'status' => rest_authorization_required_code(),
+            ]);
+        }
+        if ($this->is_approving($request, $review) && !glsr()->can('publish_post', $review->ID)) {
+            $message = _x('Sorry, you are not allowed to approve this review.', 'admin-text', 'site-reviews');
+            return new \WP_Error('rest_cannot_publish', $message, [
                 'status' => rest_authorization_required_code(),
             ]);
@@ -183 +190 @@
         return true;
     }
+
+    /**
+     * Whether the update approves a review that is not approved yet.
+     */
+    protected function is_approving(\WP_REST_Request $request, Review $review): bool
+    {
+        $values = glsr(UpdateReviewDefaults::class)->restrict($request->get_params()); // the status comes from is_approved
+        return 'publish' === Arr::get($values, 'status') && !$review->is_approved;
+    }
 }

site-reviews/trunk/plugin/Controllers/Api/Version1/RestReviewController.php

@@ -291 +291 @@
             ->buildReviewsHtml();
         $response = rest_ensure_response([
-            'pagination' => $html->getPagination($wrap = false),
+            'pagination' => $html->getPagination(false), // don't wrap
             'rendered' => $html->getReviews(),
         ]);

site-reviews/trunk/plugin/Controllers/EditorController.php

@@ -73 +73 @@
         }
         $strings = glsr(UpdatedMessageDefaults::class)->defaults();
-        $restored = filter_input(\INPUT_GET, 'revision');
-        if ($revisionTitle = wp_post_revision_title(intval($restored), false)) {
+        $restored = false;
+        $revisionId = intval(filter_input(\INPUT_GET, 'revision'));
+        if ($revisionTitle = wp_post_revision_title($revisionId, false)) {
             $restored = sprintf($strings['restored'], $revisionTitle);
         }

site-reviews/trunk/plugin/Controllers/ListTableController.php

@@ -206 +206 @@
                 unset($filters['type']);
             }
-            foreach ($filters as $key => &$value) {
-                $value = glsr($value)->title();
-            }
+            $filters = array_map(fn ($value) => glsr($value)->title(), $filters);
             ksort($filters);
             $setting = 'edit_'.glsr()->post_type.'_filters';
@@ -441 +439 @@
                     $clause['clauses'][] = "AND {$assignedTable}.{$column} = {$value}";
                 }
-            } elseif (in_array($key, ['rating', 'terms', 'type'])) {
+            } elseif (in_array($key, ['rating', 'terms'])) {
                 $clause['clauses'][] = "AND {$ratings}.{$key} = '{$value}'";
+            } elseif ('type' === $key && array_key_exists($value, glsr()->retrieveAs('array', 'review_types'))) {
+                $clause['clauses'][] = "AND {$ratings}.type = '{$value}'";
             } elseif ('author' === $key && '0' === $value) {
                 // Filtering by the "author" URL parameter is automatically done

site-reviews/trunk/plugin/Controllers/MainController.php

@@ -52 +52 @@
             $table = glsr($classname);
             if ($table instanceof TableRatings) {
-                $ratingsTable[$table->name($prefixName = true)] = $table->tablename;
+                $ratingsTable[$table->name(true)] = $table->tablename; // use the prefixed name
                 continue;
             }
-            $customTables[$table->name($prefixName = true)] = $table->tablename;
+            $customTables[$table->name(true)] = $table->tablename; // use the prefixed name
         }
         return $customTables + $ratingsTable + $tables;

site-reviews/trunk/plugin/Controllers/PrivacyController.php

@@ -152 +152 @@
         ", $email, glsr()->post_type, $this->perPage, ($page - 1) * $this->perPage);
         $reviewIds = glsr(Database::class)->dbGetCol($sql);
-        return empty($reviewIds) ? [] : glsr(Query::class)->reviews([], $reviewIds);
+        return empty($reviewIds) ? [] : glsr(Query::class)->reviews(['order' => 'asc', 'orderby' => 'id'], $reviewIds);
     }
 }

site-reviews/trunk/plugin/Controllers/ToolsController.php

@@ -310 +310 @@
     public function ipAddressDetection(Request $request): void
     {
+        if (!glsr()->can(glsr()->getPermission('settings'))) {
+            glsr(Notice::class)->addError(
+                _x('You do not have permission to change the IP address detection.', 'admin-text', 'site-reviews')
+            );
+            return;
+        }
         if (wp_validate_boolean($request->get('alt', 0))) {
             $this->execute(new DetectIpAddress());
@@ -322 +328 @@
     public function ipAddressDetectionAjax(Request $request): void
     {
+        if (!glsr()->can(glsr()->getPermission('settings'))) {
+            glsr(Notice::class)->addError(
+                _x('You do not have permission to change the IP address detection.', 'admin-text', 'site-reviews')
+            );
+            wp_send_json_error([
+                'notices' => glsr(Notice::class)->get(),
+            ]);
+        }
         $command = wp_validate_boolean($request->get('alt', 0))
             ? $this->execute(new DetectIpAddress())

site-reviews/trunk/plugin/Controllers/VerificationController.php

@@ -14 +14 @@
 use GeminiLabs\SiteReviews\Modules\Encryption;
 use GeminiLabs\SiteReviews\Modules\Html\Template;
+use GeminiLabs\SiteReviews\Modules\Notice;
 use GeminiLabs\SiteReviews\Request;
 use GeminiLabs\SiteReviews\Review;
@@ -47 +48 @@
     {
         $review = glsr(ReviewManager::class)->get($request->cast('post_id', 'int'));
+        if (!$review->isValid() || !glsr()->can('edit_post', $review->ID)) {
+            glsr(Notice::class)->addError(
+                _x('You do not have permission to request verification of this review.', 'admin-text', 'site-reviews')
+            );
+            wp_send_json_error([
+                'notices' => glsr(Notice::class)->get(),
+            ]);
+        }
         $pathPostId = $review->meta()->cast('_submitted._post_id', 'int');
         $path = Cast::toString(wp_parse_url((string) get_permalink($pathPostId), \PHP_URL_PATH));

site-reviews/trunk/plugin/Database.php

@@ -31 +31 @@
     public function beginTransaction(string $table): void
     {
-        if (glsr(Tables::class)->isSqlite()) {
+        if (glsr(Tables::class)->isSqliteLegacy()) {
             $this->dbQuery("BEGIN TRANSACTION;");
-        } elseif (glsr(Tables::class)->isInnodb($table)) {
+        } elseif (glsr(Tables::class)->isSqlite() || glsr(Tables::class)->isInnodb($table)) {
             $this->dbQuery("START TRANSACTION;");
         } elseif (glsr(Tables::class)->isMyisam($table)) {
@@ -159 +159 @@
         $fields = glsr(Query::class)->escFieldsForInsert(array_keys($data));
         $values = glsr(Query::class)->escValuesForInsert($data);
-        if (glsr(Tables::class)->isSqlite()) {
-            $sql = glsr(Query::class)->sql("INSERT OR IGNORE INTO {$table} {$fields} VALUES {$values}");
-        } else {
-            $sql = glsr(Query::class)->sql("INSERT IGNORE INTO {$table} {$fields} VALUES {$values}");
-        }
+        $ignore = glsr(Tables::class)->isSqliteLegacy() ? 'OR IGNORE' : 'IGNORE';
+        $sql = glsr(Query::class)->sql("INSERT {$ignore} INTO {$table} {$fields} VALUES {$values}");
         return $this->dbQuery($sql);
     }
@@ -186 +183 @@
         $fields = glsr(Query::class)->escFieldsForInsert($fields);
         $values = implode(',', $data);
-        if (glsr(Tables::class)->isSqlite()) {
-            $sql = glsr(Query::class)->sql("INSERT OR IGNORE INTO {$table} {$fields} VALUES {$values}");
-        } else {
-            $sql = glsr(Query::class)->sql("INSERT IGNORE INTO {$table} {$fields} VALUES {$values}");
-        }
+        $ignore = glsr(Tables::class)->isSqliteLegacy() ? 'OR IGNORE' : 'IGNORE';
+        $sql = glsr(Query::class)->sql("INSERT {$ignore} INTO {$table} {$fields} VALUES {$values}");
         return $this->dbQuery($sql);
     }

site-reviews/trunk/plugin/Database/OptionManager.php

@@ -313 +313 @@
         $writes = [];
         $versions = [];
-        foreach (static::addons() as $slug => $addon) {
+        foreach (static::addons() as $addon) {
             if ($addon->hostedBy()) {
                 continue; // the host claims its whole subtree, hosted values included
@@ -382 +382 @@
     {
         $option = get_option($path, $fallback);
-        return Cast::to($cast, Helper::ifEmpty($option, $fallback, $strict = true));
+        return Cast::to($cast, Helper::ifEmpty($option, $fallback, true)); // use strict comparison
     }
 
@@ -393 +393 @@
     protected function compose(array $settings): array
     {
-        foreach (static::addons() as $slug => $addon) {
+        foreach (static::addons() as $addon) {
             if ($addon->hostedBy()) {
                 continue; // mounted by its host's whole subtree

site-reviews/trunk/plugin/Database/Query.php

@@ -44 +44 @@
     public function ratings(array $args = []): array
     {
-        $this->setArgs($args, $unset = ['orderby']);
+        $this->setArgs($args, ['orderby']); // unset orderby
         $results = glsr(Database::class)->dbGetResults($this->queryRatings(), \ARRAY_A);
         return $this->normalizeRatings($results);
@@ -55 +55 @@
             return [];
         }
-        $this->setArgs($args, $unset = ['orderby']);
+        $this->setArgs($args, ['orderby']); // unset orderby
         $results = glsr(Database::class)->dbGetResults($this->$method(), \ARRAY_A);
         return $this->normalizeRatingsByAssignedId($results);
@@ -125 +125 @@
     public function totalReviews(array $args = [], array $reviews = []): int
     {
-        $this->setArgs($args, $unset = ['orderby']);
+        $this->setArgs($args, ['orderby']); // unset orderby
         if (empty($this->sqlLimit()) && !empty($reviews)) {
             return count($reviews);

site-reviews/trunk/plugin/Database/RatingManager.php

@@ -22 +22 @@
         $metaTable = sprintf('%smeta', $metaGroup);
         $ratings = glsr(Query::class)->ratingsFor($metaTable, $args);
-        foreach ($ratings as $id => &$group) {
-            $group = $this->reduce($group, $args);
-        }
+        $ratings = array_map(fn ($group) => $this->reduce($group, $args), $ratings);
         return glsr()->filterArray('ratings/grouped', $ratings, $metaGroup, $args);
     }

site-reviews/trunk/plugin/Database/Sql.php

@@ -284 +284 @@
             $this->join('assigned_posts', $this->joinKeyword()),
             $this->args['assigned_posts'],
-            $prepare = false
+            false // don't prepare
         );
     }
@@ -304 +304 @@
             $this->join('assigned_terms', $this->joinKeyword()),
             $this->args['assigned_terms'],
-            $prepare = false
+            false // don't prepare
         );
     }
@@ -313 +313 @@
             $this->join('assigned_users', $this->joinKeyword()),
             $this->args['assigned_users'],
-            $prepare = false
+            false // don't prepare
         );
     }
@@ -322 +322 @@
             $this->join('posts', 'INNER JOIN'),
             $this->args['content'],
-            $prepare = false
+            false // don't prepare
         );
     }
@@ -331 +331 @@
             $this->join('posts', 'INNER JOIN'),
             array_filter($this->args['date']),
-            $prepare = false
+            false // don't prepare
         );
     }
@@ -340 +340 @@
             $this->join('posts', 'INNER JOIN'),
             $this->args['user__in'],
-            $prepare = false
+            false // don't prepare
         );
     }
@@ -349 +349 @@
             $this->join('posts', 'INNER JOIN'),
             $this->args['user__not_in'],
-            $prepare = false
+            false // don't prepare
         );
     }

site-reviews/trunk/plugin/Database/Tables.php

@@ -124 +124 @@
     {
         return 'sqlite' === $this->engine;
+    }
+
+    /**
+     * If SQLite Database Integration plugin is < v3.
+     */
+    public function isSqliteLegacy(): bool
+    {
+        return $this->isSqlite()
+            && is_a($this->db->dbh, 'WP_SQLite_Translator'); // @phpstan-ignore-line
     }
 

site-reviews/trunk/plugin/Defaults/ApiDefaults.php

@@ -13 +13 @@
     public array $casts = [
         'blocking' => 'bool',
+        'cache' => 'bool',
         'compress' => 'bool',
         'cookies' => 'array',
@@ -50 +51 @@
             'blocking' => true, // Whether the calling code requires the result of the request.
             'body' => null,
+            'cache' => true, // if the response is cached
             'compress' => false, // Whether to compress the $body when sending the request.
             'cookies' => [],

site-reviews/trunk/plugin/Helpers/Arr.php

@@ -25 +25 @@
         if (is_object($value)) {
             $values = get_object_vars($value);
-            $value = Helper::ifEmpty($values, (array) $value, $strict = true);
+            $value = Helper::ifEmpty($values, (array) $value, true); // use strict comparison
         }
         return is_array($value) ? $value : $fallback;

site-reviews/trunk/plugin/Helpers/Text.php

@@ -124 +124 @@
         }
         $wordCount = 0;
-        foreach ($iterator->getPartsIterator() as $part) {
+        while (\IntlBreakIterator::DONE !== $iterator->next()) {
             if (\IntlBreakIterator::WORD_NONE !== $iterator->getRuleStatus()) {
                 ++$wordCount;
@@ -245 +245 @@
         }
         $iterator = \IntlRuleBasedBreakIterator::createWordInstance('');
+        if (!$iterator instanceof \IntlRuleBasedBreakIterator) { // has getRuleStatus()
+            return null;
+        }
         $normalizedText = \Normalizer::normalize($text);
         if (empty($normalizedText)) {
@@ -258 +261 @@
     {
         $map = [];
+        $text = str_replace('⍈', '⍈', $text); // a ⍈ in the text is not a placeholder
         $result = preg_replace_callback('|<([a-z]+)[^>]*?>.*?</\\1>|siu', function ($matches) use (&$map) {
             $map[] = $matches[0];

site-reviews/trunk/plugin/Integrations/MultilingualPress/Defaults/SyncReviewDefaults.php

@@ -3 +3 @@
 namespace GeminiLabs\SiteReviews\Integrations\MultilingualPress\Defaults;
 
+use GeminiLabs\SiteReviews\Defaults\CustomFieldsDefaults;
 use GeminiLabs\SiteReviews\Defaults\UpdateReviewDefaults;
 
@@ -39 +40 @@
         'author' => 'name',
     ];
+
+    /**
+     * Normalize provided values, this always runs first.
+     */
+    protected function normalize(array $values = []): array
+    {
+        $customKeys = array_keys(glsr(CustomFieldsDefaults::class)->call('merge', $values));
+        $this->guarded = array_values(array_unique(array_merge($this->guarded, $customKeys))); // guard all custom keys
+        return parent::normalize($values);
+    }
 }

site-reviews/trunk/plugin/Integrations/MultilingualPress/RelationSaveHelper.php

@@ -8 +8 @@
 use GeminiLabs\SiteReviews\Defaults\RatingDefaults;
 use GeminiLabs\SiteReviews\Helpers\Arr;
-use GeminiLabs\SiteReviews\Integrations\MultilingualPress\Defaults\SyncReviewDefaults;
 use GeminiLabs\SiteReviews\Integrations\MultilingualPress\MetaboxFields\AssignedPostsField;
 use GeminiLabs\SiteReviews\Integrations\MultilingualPress\MetaboxFields\AssignedUsersField;
@@ -201 +200 @@
     }
 
+    /**
+     * Write the values on the remote review with the assigned posts and users mapped to the remote site.
+     *
+     * @param array $data The guarded values (ReviewCopier::syncData) with the source site's assigned ids
+     */
     public function syncUpdate(array $data, bool $force = false): void
     {
@@ -206 +210 @@
             return;
         }
-        $guarded = glsr(SyncReviewDefaults::class)->merge($data);
+        // Not merged here as this runs on the remote site.
+        $values = $data;
+        unset($values['assigned_posts'], $values['assigned_users']);
         if ($force || $this->canSyncAssignment(AssignedPostsField::FIELD_COPY_ASSIGNED_POSTS)) {
             $sourcePostIds = Arr::consolidate($data['assigned_posts'] ?? []);
-            $guarded['assigned_posts'] = $this->remoteAssignedPosts($sourcePostIds);
+            $values['assigned_posts'] = $this->remoteAssignedPosts($sourcePostIds);
         }
         if ($force || $this->canSyncAssignment(AssignedUsersField::FIELD_COPY_ASSIGNED_USERS)) {
             $sourceUserIds = Arr::consolidate($data['assigned_users'] ?? []);
-            $guarded['assigned_users'] = $this->remoteAssignedUsers($sourceUserIds);
-        }
-        $originalSiteId = $this->maybeSwitchSite($this->context->remoteSiteId());
-        glsr_update_review($this->context->remotePostId(), $guarded);
+            $values['assigned_users'] = $this->remoteAssignedUsers($sourceUserIds);
+        }
+        $originalSiteId = $this->maybeSwitchSite($this->context->remoteSiteId());
+        glsr_update_review($this->context->remotePostId(), $values);
         $this->syncAssignedTerms();
         $this->maybeRestoreSite($originalSiteId);

site-reviews/trunk/plugin/Integrations/MultilingualPress/ReviewCopier.php

@@ -3 +3 @@
 namespace GeminiLabs\SiteReviews\Integrations\MultilingualPress;
 
+use GeminiLabs\SiteReviews\Integrations\MultilingualPress\Defaults\SyncReviewDefaults;
+use GeminiLabs\SiteReviews\Review;
 use Inpsyde\MultilingualPress\Framework\Api\ContentRelations;
 use Inpsyde\MultilingualPress\Framework\SwitchSiteTrait;
@@ -91 +93 @@
     public function sync(): void
     {
-        $review = glsr_get_review($this->sourcePostId);
-        $data = wp_parse_args($review->toArray(), $review->custom()->toArray());
+        $data = $this->syncData(glsr_get_review($this->sourcePostId));
         $this->run(function ($context) use ($data) {
             $helper = new RelationSaveHelper($context);
             $helper->syncUpdate($data, true);
         });
+    }
+
+    public function syncData(Review $review): array
+    {
+        $data = wp_parse_args($review->toArray(), $review->custom()->toArray());
+        // Guarded on the source site: the site-reviews/defaults/sync-review filter reads the review's form here.
+        $data = glsr(SyncReviewDefaults::class)->merge($data);
+        $data['assigned_posts'] = $review->assigned_posts; // the source ids mapped by syncUpdate() on each remote site
+        $data['assigned_users'] = $review->assigned_users;
+        return $data;
     }
 

site-reviews/trunk/plugin/Integrations/WPLoyalty/Controller.php

@@ -44 +44 @@
             ]);
             $messages = [$field->after];
-            foreach ($rewardsList as $action => $rewards) {
-                foreach ($rewards as $key => $reward) {
+            foreach ($rewardsList as $rewards) {
+                foreach ($rewards as $reward) {
                     $messages[] = $reward['messages'] ?? '';
                 }

site-reviews/trunk/plugin/Integrations/WooCommerce/Controllers/RestApi/ProductReviewsController.php

@@ -226 +226 @@
         $postArgs = $this->prepare_item_for_update($request);
         $postArgs['ID'] = $review->ID;
-        $updatePost = wp_update_post($postArgs, $wperror = true);
+        $updatePost = wp_update_post($postArgs, true); // return a WP_Error on failure
         if (is_wp_error($updatePost)) {
             return new \WP_Error('woocommerce_rest_comment_failed_edit', 'Updating review failed.', ['status' => 500]);

site-reviews/trunk/plugin/Modules/Html/Form.php

@@ -500 +500 @@
     protected function normalizeFieldValue(FieldContract $field): void
     {
+        if ($this->session->failed && 'hidden' === $field->original_type) {
+            return; // hidden fields are signed
+        }
         if ($field->isChoiceField()) {
             $value = Cast::toArray($this->session->values[$field->original_name] ?? []);
@@ -511 +514 @@
     }
 
+    /**
+     * @return array<string, string|array{hidden: string[], visible: int}>
+     */
+    protected function signedValues(): array
+    {
+        $lists = $values = [];
+        foreach ($this->hidden() as $field) {
+            $values[$field->original_name] = $field->value;
+            if (str_ends_with($field->name, '[]')) { // PHP reads these fields as a list
+                $lists[$field->original_name]['hidden'][] = Cast::toString($field->value);
+            }
+        }
+        $visibleFields = $this->visible();
+        foreach (array_keys($lists) as $name) {
+            $lists[$name]['visible'] = count(
+                array_filter($visibleFields, fn ($field) => $name === $field->original_name)
+            );
+        }
+        $values = array_merge($values, $lists);
+        return $this->app()->filterArray("{$this->formName()}/signature/values", $values, $this);
+    }
+
     protected function signForm(): void
     {
-        $hidden = $this->hidden();
-        $values = [];
-        foreach ($hidden as $field) {
-            $values[$field->original_name] = $field->value;
-        }
-        $values = $this->app()->filterArray("{$this->formName()}/signature/values", $values, $this);
+        $values = $this->signedValues();
         $signatureField = $this->field('form_signature', [
             'type' => 'hidden',
             'value' => glsr(Encryption::class)->encrypt(maybe_serialize($values)),
         ]);
-        $fields = array_values(array_merge($hidden, [$signatureField], $this->visible()));
+        $fields = array_values(array_merge($this->hidden(), [$signatureField], $this->visible()));
         $this->exchangeArray($fields);
     }

site-reviews/trunk/plugin/Modules/Html/ReviewForm.php

@@ -6 +6 @@
 use GeminiLabs\SiteReviews\Helpers\Arr;
 use GeminiLabs\SiteReviews\Helpers\Cast;
+use GeminiLabs\SiteReviews\Request;
 
 class ReviewForm extends Form
@@ -26 +27 @@
     {
         do_action('litespeed_nonce', 'submit-review'); // @litespeedcache
-        $referer = glsr()->filterString('review-form/referer', wp_get_referer());
+        $referer = glsr()->filterString('review-form/referer', $this->referer());
         $config = [
             '_action' => 'submit-review',
@@ -88 +89 @@
         return $fields;
     }
+
+    /**
+     * The page the visitor came from.
+     */
+    protected function referer(): string
+    {
+        if (glsr()->session()->cast('form_invalid', 'bool')) {
+            $submitted = new Request(glsr()->session()->array('form_values'));
+            if ($referer = Cast::toString($submitted->signedValues()['_referer'] ?? '')) {
+                return $referer;
+            }
+        }
+        return Cast::toString(wp_get_referer());
+    }
 }

site-reviews/trunk/plugin/Modules/Html/SettingForm.php

@@ -141 +141 @@
             return; // only a setting field has dependencies
         }
-        $isHidden = false;
         foreach (Arr::consolidate($field->depends_on) as $path => $expectedValue) {
             $default = Arr::get(glsr()->defaults(), $path);

site-reviews/trunk/plugin/Modules/Paginate.php

@@ -19 +19 @@
         $parts = explode('?', $base);
         if (wp_is_serving_rest_request() || !NormalizePaginationArgs::pagedRequest()->isEmpty()) {
-            $parts = [$parts[0]]; // this is an AJAX request
+            $parts = []; // this is an AJAX request
         }
         if ($parts[1] ?? false) {

site-reviews/trunk/plugin/Modules/Sanitizers/ArraySanitizer.php

@@ -3 +3 @@
 namespace GeminiLabs\SiteReviews\Modules\Sanitizers;
 
+use GeminiLabs\SiteReviews\Helpers\Arr;
 use GeminiLabs\SiteReviews\Helpers\Cast;
 
@@ -9 +10 @@
     abstract public function run(): array;
 
+    /**
+     * The values, with a comma-separated string among them read as several values.
+     */
+    protected function splitValue(): array
+    {
+        $values = [];
+        foreach ($this->value() as $value) {
+            $values[] = is_string($value) ? Arr::convertFromString($value) : [$value];
+        }
+        return array_merge([], ...$values);
+    }
+
     protected function value(): array
     {

site-reviews/trunk/plugin/Modules/Sanitizers/SanitizeEmails.php

@@ -8 +8 @@
     {
         $emails = explode(',', $this->value());
-        foreach ($emails as &$email) {
-            $email = sanitize_email($email);
-        }
+        $emails = array_map(fn ($email) => sanitize_email($email), $emails);
         return implode(',', array_filter($emails));
     }

site-reviews/trunk/plugin/Modules/Sanitizers/SanitizePostIds.php

@@ -11 +11 @@
     {
         return Arr::uniqueInt(
-            array_map([Helper::class, 'getPostId'], $this->value())
+            array_map([Helper::class, 'getPostId'], $this->splitValue())
         );
     }

site-reviews/trunk/plugin/Modules/Sanitizers/SanitizeTermIds.php

@@ -11 +11 @@
     {
         return Arr::uniqueInt(
-            array_map([Helper::class, 'getTermTaxonomyId'], $this->value())
+            array_map([Helper::class, 'getTermTaxonomyId'], $this->splitValue())
         );
     }

site-reviews/trunk/plugin/Modules/Sanitizers/SanitizeUserIds.php

@@ -11 +11 @@
     {
         return Arr::uniqueInt(
-            array_map([Helper::class, 'getUserId'], $this->value())
+            array_map([Helper::class, 'getUserId'], $this->splitValue())
         );
     }

site-reviews/trunk/plugin/Modules/Schema.php

@@ -114 +114 @@
     {
         if ($schema = $this->retrieve()) {
-            $json = (string) wp_json_encode($schema, \JSON_UNESCAPED_UNICODE | \JSON_UNESCAPED_SLASHES);
+            $json = (string) wp_json_encode($schema, \JSON_HEX_AMP | \JSON_HEX_TAG | \JSON_UNESCAPED_SLASHES | \JSON_UNESCAPED_UNICODE);
             printf('<script type="application/ld+json" class="%s-schema">%s</script>', glsr()->id, $json);
         }
@@ -209 +209 @@
             return $this->getSchemaOptionDefault($setting, $fallback);
         }
-        return Helper::ifEmpty($setting, $fallback, $strict = true);
+        return Helper::ifEmpty($setting, $fallback, true); // use strict comparison
     }
 

site-reviews/trunk/plugin/Modules/SystemInfo.php

@@ -117 +117 @@
             ];
         }
-        $engines = glsr(Tables::class)->tableEngines($removePrefix = true);
+        $engines = glsr(Tables::class)->tableEngines(true); // remove the prefix
         foreach ($engines as $engine => $tables) {
             $engines[$engine] = sprintf('%s (%s)', $engine, implode('|', $tables));

site-reviews/trunk/plugin/Modules/Validator.php

@@ -172 +172 @@
      * @param mixed $value
      */
-    protected function getSize(string $attribute, $value): int
+    protected function getSize(string $attribute, $value): float
     {
         $hasNumeric = $this->hasRule($attribute, $this->numericRules);
         if (is_numeric($value) && $hasNumeric) {
-            return (int) $value;
+            return (float) $value;
         }
         if (is_array($value)) {

site-reviews/trunk/plugin/Modules/Validator/CaptchaValidatorAbstract.php

@@ -84 +84 @@
         return [
             'body' => $body,
-            'force' => true,
+            'cache' => false,
         ];
     }

site-reviews/trunk/plugin/Modules/Validator/FriendlycaptchaV2Validator.php

@@ -65 +65 @@
     {
         return [
-            'force' => true,
+            'body' => wp_json_encode($body),
+            'cache' => false,
             'headers' => [
                 'Content-Type' => 'application/json',
                 'X-API-Key' => $this->siteSecret(),
             ],
-            'body' => wp_json_encode($body),
         ];
     }

site-reviews/trunk/plugin/Modules/Validator/ProcaptchaValidator.php

@@ -55 +55 @@
     {
         return [
-            'force' => true,
+            'body' => wp_json_encode($body),
+            'cache' => false,
             'headers' => ['Content-Type' => 'application/json'],
-            'body' => wp_json_encode($body),
         ];
     }

site-reviews/trunk/plugin/Modules/Validator/SignatureValidator.php

@@ -3 +3 @@
 namespace GeminiLabs\SiteReviews\Modules\Validator;
 
+use GeminiLabs\SiteReviews\Helpers\Arr;
 use GeminiLabs\SiteReviews\Helpers\Cast;
 
@@ -10 +11 @@
     {
         $isValid = true;
-        $values = $this->request->signedValues(['form_id' => '']);
-        foreach ($values as $key => $value) {
-            if (Cast::toString($value) !== $this->request->cast($key, 'string')) {
+        $signedValues = $this->request->signedValues(['form_id' => '']);
+        foreach ($signedValues as $key => $signedValue) {
+            if ($this->hasValueChanged($signedValue, $this->request->get($key))) {
                 $isValid = false;
-                glsr_log()->debug($values);
+                glsr_log()->debug($signedValues);
                 break;
             }
         }
-        return glsr()->filterBool('validate/signature', $isValid, $values, $this->request);
+        return glsr()->filterBool('validate/signature', $isValid, $signedValues, $this->request);
     }
 
@@ -30 +31 @@
         }
     }
+
+    /**
+     * @param string|array{hidden?: string[], visible?: int} $signedValue
+     * @param mixed                                          $requestValue
+     */
+    protected function hasValueChanged($signedValue, $requestValue): bool
+    {
+        if (!is_array($signedValue)) {
+            return is_array($requestValue) || Cast::toString($signedValue) !== Cast::toString($requestValue);
+        }
+        if (!Arr::isIndexedAndFlat($requestValue)) {
+            return true;
+        }
+        $requestValue = array_map([Cast::class, 'toString'], $requestValue);
+        foreach (Arr::consolidate($signedValue['hidden'] ?? []) as $hidden) {
+            $index = array_search(Cast::toString($hidden), $requestValue, true);
+            if (false === $index) {
+                return true;
+            }
+            unset($requestValue[$index]);
+        }
+        return count($requestValue) > Cast::toInt($signedValue['visible'] ?? 0);
+    }
 }

site-reviews/trunk/plugin/Modules/Validator/ValidationRules.php

@@ -162 +162 @@
      * @param mixed $value
      */
-    abstract protected function getSize(string $attribute, $value): int;
+    abstract protected function getSize(string $attribute, $value): float;
 
     /**
@@ -173 +173 @@
         }
         return preg_replace_callback('/(%s)/', function () use (&$parameters) {
-            foreach ($parameters as $key => $value) {
-                return array_shift($parameters);
-            }
+            return array_shift($parameters);
         }, $message);
     }

site-reviews/trunk/plugin/Notices/GatekeeperNotice.php

@@ -121 +121 @@
             return '';
         }
+        if (!str_starts_with($data['plugin_uri'], 'https://wordpress.org/plugins/')) {
+            return '';
+        }
         return $this->pluginAction([
             'action' => 'install-plugin',
@@ -126 +129 @@
             'name' => $data['name'],
             'nonce_prefix' => 'install-plugin_',
-            'plugin' => $data['textdomain'],
+            'plugin' => dirname($data['plugin']), // wordpress.org names a plugin's folder after its slug
             /* translators: %s: the plugin name */
             'text' => _x('Install %s', 'admin-text', 'site-reviews'),
@@ -183 +186 @@
     {
         $links = [];
-        foreach ($errors as $plugin => $data) {
+        foreach ($errors as $data) {
             $links[] = sprintf('<span class="plugin-%s"><a href="%s">%s</a></span>',
                 $data['textdomain'],

site-reviews/trunk/readme.txt

@@ -4 +4 @@
 Tags: reviews, ratings, testimonials, product reviews, business reviews
 Tested up to: 7.1
-Stable tag: 8.3.7
+Stable tag: 8.3.8
 License: GPLv3
 License URI: https://www.gnu.org/licenses/gpl-3.0.html
@@ -211 +211 @@
 
 == Changelog ==
+
+= 8.3.8 (2026-11-15) =
+
+- Fixed a security issue in review excerpts
+- Fixed a security issue in the notice shown after restoring a revision
+- Fixed a security issue in the review type filter
+- Fixed a security issue in the schema
+- Fixed captcha checks slowly filling up the database
+- Fixed forms with more than one Assigned Pages, Categories or Users field not submitting
+- Fixed hidden form fields changing after a failed submission
+- Fixed MultilingualPress translations losing their custom field values when the original review is edited
+- Fixed number fields ignoring decimals in their minimum and maximum
+- Fixed reviews not saving with version 3 of the SQLite Database Integration plugin
+- Fixed some assigned pages, categories or users not being saved with a review
+- Fixed the admin search permission check
+- Fixed the Install button in the missing plugin notice
+- Fixed the IP address detection tool permission check
+- Fixed the review approval permission check
+- Fixed the validation of submitted reviews
+- Fixed the verification email permission check
 
 = 8.3.7 (2026-10-31) =

site-reviews/trunk/site-reviews.php

@@ -8 +8 @@
  * Plugin URI:           https://wordpress.org/plugins/site-reviews
  * Description:          Receive and display reviews on your website
- * Version:              8.3.7
+ * Version:              8.3.8
  * Author:               Paul Ryley
  * Author URI:           https://site-reviews.com