Organizers Embed – Action Network for WordPress

बदलांची यादी

1.9.0

• The plugin display name is now Organizers Embed – Action Network for WordPress. Shortcodes, settings, and synced actions are unchanged
• Includes the sync, signup, location, and block editor fixes listed under 1.8.7 and 1.8.8

1.8.8

• Security: List and calendar shortcodes only use a fixed set of HTML tags, so a shortcode cannot emit a script element
• Bug fix: A sync no longer deletes existing actions when a local save fails. Those actions are kept and tried again on the next sync
• Bug fix: The signup thank-you message is shown only after Action Network confirms the person was saved
• Bug fix: Event locations load again. Stored location objects are read back as data instead of being discarded
• Bug fix: A new action is not stored when its embed cannot be fetched. An existing action with a blank embed requests the embed again on a later sync
• Bug fix: An edit made in Action Network while a sync is running is applied on the next sync
• Bug fix: Reset Sync is refused while a sync still holds the lock
• Bug fix: A non-AJAX signup is handled only by the widget that was submitted
• Bug fix: The signup form leaves the submitting state when the server returns an empty or invalid response
• Bug fix: The block editor action picker keeps the saved action and refreshes its list when the actions load
• A sync that is still running schedules a follow-up so it can finish after the admin page is closed
• Bug fix: A failed queue count is reported as an error instead of an empty queue, so it cannot delete existing actions

1.8.7

• Bug fix: Action Network sync no longer inserts duplicate actions when several admin-ajax requests overlap. Queue rows are claimed one at a time, and only one request can hold the sync lock
• Bug fix: The sync progress request now handles a short batch and the browser waits for that request to finish before asking again, so the progress text updates and a long sync is not killed as a single request
• Bug fix: Daily cron and a second Full API Sync click no longer start another copy of a sync that is already running. A refresh resumes an unfinished queue
• Bug fix: A sync no longer hides every action while it runs, and Reset Sync Status restores actions an interrupted sync had hidden
• Bug fix: If Action Network cannot be fully loaded, existing actions are kept instead of being deleted. Actions removed in Action Network are deleted only after a complete sync
• Bug fix: Existing duplicate actions are removed on upgrade, keeping the oldest copy of each action, and action lookups are indexed
• Bug fix: An unreachable Action Network no longer accepts an API key change that would delete synced actions
• Bug fix: Bulk delete, hide, and unhide now require the list nonce
• Bug fix: The block editor action list loads again
• Bug fix: The classic-editor Action Network menu is limited to the post editing screen and no longer loads every action on other admin pages
• Bug fix: Signup widget no longer warns on older widget settings, and hCaptcha is skipped unless both keys are saved and spam protection is enabled
• Bug fix: Custom list and calendar templates missing their loop markers fall back to the default template
• The About tab now describes Concerted Action, Organizers Helpdesk, and The Organizers Extension
• The plugin display name is now Organizers Embed – Action Network for WordPress. Shortcodes, settings, and synced actions are unchanged
• The admin menu uses the light Organizers Embed icon. The page title and action list use the dark icon so it shows on a white background
• The About tab shows the dark icon and the plugin name above the Concerted Action logo
• Saving an API key shows one sync progress notice. The same status was being written into two banners that shared an id

1.8.6

• Security: “Action Network” admin-AJAX endpoint that exposes the enabled-actions list no longer accepts unauthenticated requests; now requires edit_posts capability
• Security: Escaped dynamic values in the edit-event admin form (title, date, embed code, location, admin URLs) to prevent admin stored/reflected XSS
• Security: Escaped all user/DB values in the Action Network Signup widget output (first name, last name, email, zip, labels, hCaptcha site key) and escaped the widget title on the List widget to prevent reflected XSS
• Security: actionnetwork_twig_render() now escapes substituted values by default (esc_html for text, esc_url for link fields) so untrusted DB/API content cannot inject markup into calendar/list shortcode output
• Security: API-key-bearing admin notices now escape the key before display
• Security: unserialize() calls on DB-serialized location/tag data now pass allowed_classes => false to close the PHP object-injection surface
• Bug fix: Admin notices no longer render blank or missing the “copy shortcode” button – replaced wp_kses_post() with a notice-specific allowlist that permits <input>/<button>/<span> form controls used by success messages
• Bug fix: Action Network List widget no longer emits a duplicate/malformed action_types shortcode attribute; serialized value is now decoded once and imploded with attribute escaping
• Bug fix: Calendar shortcode no longer throws a PHP 8 TypeError when count() is called on a null result from $wpdb->get_row() for a non-existent event
• Bug fix: ActionNetwork::call() now checks is_wp_error() and validates JSON before returning, preventing “property access on null” warnings/fatals in sync collection traversal
• Bug fix: ActionNetwork::call() now sends Content-Length as a proper header instead of as a malformed numeric-keyed array entry
• Bug fix: hCaptcha verification guards against transport errors and empty/invalid JSON responses (no more PHP 8 property-on-null fatal if hCaptcha is unreachable)
• Bug fix: $wpdb->insert() format specifier array for new actions now matches the number of fields (previously 8 specifiers with varying 7-or-8-field data arrays)
• Enhancement: Action list admin table no longer dumps the full row via print_r() when an unknown column is requested; returns an empty/escaped value instead
• Enhancement: Sync-status AJAX handler now requires manage_options capability in addition to the existing nonce
• Enhancement: Removed stray “test” word from the “Search results for” admin header string
• Enhancement: Minor cleanup in uwfWidgetControls::render() (readable class-list logic, escaped label output) and in signup widget nonce verification

1.8.5

• Bug fix: Embed code validation now accepts Action Network widget v6+ (regex updated from v2-4 to any version)
• Bug fix: Removed wp_kses_post() from embed code input so the required
• Bug fix: Time picker on the Add/Edit action screen no longer renders as raw HTML text – removed wp_kses_post() wrapper that was stripping the / form fields; values are now sanitized and escaped inside actionnetwork_build_time_input()
• Bug fix: Prevent PHP warning “Trying to access array offset on null” in embed code display function
• Bug fix: Prevent potential PHP 8.1+ TypeError when no embed code is found for a given action

1.8.4

• Bug fix: Fixed incorrect database table name that prevented adding actions on new multisite subsites (table was created as wp-action-network instead of actionnetwork)
• Cleans up incorrectly-named table from 1.8.2/1.8.3 on upgrade

1.8.3

• Bug fix: Removed server-to-self (loopback) HTTP requests that were blocked by WAF/ModSecurity rules on some hosting configurations (e.g. OpenLiteSpeed, XCloud)
• Bug fix: Manual sync button and daily cron sync now run directly instead of relying on wp_remote_post() to admin-ajax.php
• Bug fix: Cron sync now logs actual inserted/updated counts instead of stale request parameters
• Enhancement: Replaced “Cron Updates” tab with “Sync Status” tab showing queue status, last sync results, and cron history
• Enhancement: Added “Reset Stuck Sync” button to recover from stuck sync states
• Enhancement: Added copyable support/debug information panel for troubleshooting
• Tested with WordPress 6.9

1.8.2

• Bug fix: Fixed issue where API sync button would get stuck disabled if sync failed
• Bug fix: Added error handling to prevent infinite polling when AJAX requests fail
• Enhancement: Added comprehensive debugging information for sync failures
• Enhancement: Added “Show error details” link in error messages for troubleshooting
• Enhancement: Added timeout protection (30 minutes) for sync polling
• Enhancement: Improved error recovery – sync button now re-enables on errors
• Enhancement: Added server-side error logging when WP_DEBUG is enabled

1.8.1

• Code quality: Prefixed helper functions to satisfy WordPress naming rules
• Security: Replaced raw SQL string concatenation with prepared statements where needed
• Housekeeping: Removed hidden macOS metadata file from the plugin root

1.8.0

• Code quality: Resolved all remaining plugin checker warnings
• Tested with WordPress 6.8

1.7.0

• Performance improvements: Added version parameters to all enqueued scripts and styles
• Performance improvements: Scripts now load in footer where appropriate
• Code quality: All assets now properly enqueued using WordPress functions
• Security: Fixed all XSS and CSRF vulnerabilities
• Security: Plugin checker compliant with all security and performance warnings resolved

1.6.0

• Security: Fixed all XSS vulnerabilities with proper escaping
• Security: Fixed CSRF vulnerability in admin filter form
• Code quality: All outputs properly escaped
• Code quality: Plugin checker compliant

1.5.0

• Security: Fixed CSRF vulnerability in admin actions filter form
• Security: Fixed multiple XSS vulnerabilities in admin pages and widget controls
• UI: Replaced alert popup with inline shortcode options editor
• Removed “Add Action” tab (actions should be synced via API)
• Improved input sanitization and escaping throughout admin interface

1.4.4

• Security updates.
• Updated and tested with latest WordPress version.

1.4.3

• Security updates.
• Updated and tested with latest WordPress version.

1.4.2

• Bug fix for to support embedded Action Network URLs up to version 4.

1.4.1

• Bug fix for widget hCaptcha protection when hCaptcha keys are not provided. The hCaptcha verification will require both hCaptcha keys in the plugin settings and the “Spam protection” checkbox be enabled. If either are not provided, hCaptcha protection will be disabled, allowing the form to be submitted without verification.

1.4.0

• Fixed hCaptcha checkbox.

1.3.0

• Updated automatic syncing of data from Action Network.
• Added record of sync results.

1.2.2

• Revert of SVN issue.

1.2.1

• Added Gutenberg Editor button.
• Bug fix related to hCaptcha.

1.2

• This major update includes the following updates:
• hCaptcha ability added for API based forms.
• Bug fixes related too multiple embeds on a single page, and the API sync.
• shortcode button for tinymce WYSIWYG.
• additional documentation on setting page.

1.1.3

• Updating developer information.

1.1.2

• Fixed problem where Action Network dates (both for events and modified_date for all actions), which are in local time, were being compared to UTC time. Now they are compared to the local timezone of the website.

1.1.1

• Fixed problem which would cause updates from wordpress.org to crash

1.1.0

• Added AJAX submission for signup form, new shortcode attributes to control thank-you displays, new widget to display actions, and new shortcode and widget to display lists of actions.

1.0.1

• Updated to recognize Action Network’s v3 widgets

1.0

• First release on wordpress.org

Previous development versions can be found on github