Download Manager Pro Changelog

Sin fecha · 8 versiones

1. 7.4.0

   Última

   1 corrección2 de seguridad3 cambios

   Ocultar

   Corregido

   • Fixed an unauthenticated blind SQL injection vulnerability (CWE-89). The internal temporary-storage lookup interpolated a request-derived key directly into a database query; sanitize_text_field does not escape SQL quotes, so several unauthenticated entry points (including the media download handler via __mediakey ) could be abused for time-based blind injection.

   Seguridad

   • Security fix: unauthenticated SQL injection patched
   • Security release — version 7.4.0. All users are strongly advised to update immediately.

   Cambios

   • The query is now fully parameterized with $wpdb->prepare , closing the injection for every caller of the storage layer.
   • Credit: responsibly disclosed by mrinolife .
   • May 26, 2026

2. 7.3.9

   2 nuevos9 cambios

   Ocultar

   Nuevo

   • Added async re-rendering for the wpdm_packages shortcode toolbar so filter / sort / paginate updates the results in place without a full page reload.
   • Added a per-file Size override field in the file-info metabox for granular control over displayed file sizes.

   Cambios

   • Public profile redesign and async [wpdm_packages] toolbar
   • Redesigned the wpdm_user_profile page with a modern cover/avatar layout, stat pills (packages, favourites, member since), and pill-style tabs that highlight in the user’s brand color.
   • Per-file download flow now respects the terms-and-conditions lock and correctly carries the file index through the unlock cycle.
   • Gated the wpdmpro custom-post-type capability and parent admin menu behind WPDM_MENU_ACCESS_CAP when set to manage_options .
   • Pre-fill the File Size input from Media Library attachments (uses filesizeHumanReadable ).
   • Escaped reset URLs on the download-history filter chips.
   • Switched the .__wpdm_submit_async submit handler to delegated binding so AJAX-injected forms keep working after replacement.
   • Proper output escaping on the public profile partials and dark-mode support (manual + prefers-color-scheme ).
   • May 7, 2026

3. 7.3.8

   1 corrección2 cambios

   Ocultar

   Corregido

   • Resolved an issue affecting the file list on the admin site.

   Cambios

   • File List Fix
   • May 3, 2026

4. 7.3.7

   1 corrección5 cambios

   Mostrar

   Corregido

   • Fixed WPDM\__\__::sanitize_var emitting a PHP warning — “Delimiter must not be alphanumeric or backslash” — when an unknown sanitize value (e.g. 'array' ) reached the regex fallback. Added an isRegexPattern guard so non-pattern values are returned unchanged

   Cambios

   • DropZone file-request page redesign and sanitize_var fix
   • Redesigned the DropZone file-request page as an enterprise-grade upload UI — two-column layout with a sticky sidebar (request meta + best-practices tips), a table-style file queue with per-row progress, sticky action bar with summary and Submit / Clear, dedicated success state, mobile responsive
   • Synced the DropZone main page with WPDM Color Scheme settings
   • Both DropZone views now pull the primary color from WPDM UI Settings
   • April 21, 2026

5. 7.3.6

   4 nuevos2 correcciones4 cambios

   Mostrar

   Nuevo

   • Added dark mode support for User Dashboard (manual dark mode and system preference)
   • Added tag filter dropdown for [ wpdm_all_packages] shortcode ( tag_filter="true" )
   • Added Last Login column to WordPress admin Users list
   • Added DropZone admin page to WPDM admin styles whitelist

   Corregido

   • Fixed DropZone comment form not resetting after submission
   • Fixed DropZone storage calculation crash when file path is missing

   Cambios

   • Dark mode for User Dashboard, tag filter for package tables, and DropZone fixes
   • Made category and tag names clickable in DataTables to filter by that term
   • Internationalized hardcoded “File Details” string in DropZone sidebar
   • April 16, 2026

6. 7.3.5

   1 corrección2 cambios

   Mostrar

   Corregido

   • Fix undefined index warning in login redirect on CLI/cron contexts

   Cambios

   • Guard $_SERVER["SERVER_NAME"] with isset check in login redirect validation to prevent undefined index warnings in CLI and cron contexts where server variables are not populated.
   • April 9, 2026

7. 7.3.4

   2 correcciones1 de seguridad2 cambios

   Mostrar

   Corregido

   • [ wpdm_category] shortcode toolbar — renamed the orderby / order select fields to orderby_ / order_ so they no longer collide with WordPress reserved query vars. Front-end sorting from the category toolbar now works reliably. (The same fix was applied to [ wpdm_packages] in 7.3.3; this release extends it to [ wpdm_category] and covers a couple of remaining spots in the packages toolbar that were missed.)
   • Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ( Reported by Patchstack )

   Seguridad

   • Security

   Cambios

   • Category shortcode toolbar sort/order fix
   • April 2, 2026

8. 7.3.3

   5 mejoras7 correcciones1 de seguridad1 cambio

   Mostrar

   Mejora

   • Video CDN detection now uses filterable array
   • Toolbar sort/order params renamed to avoid WordPress reserved query var conflicts
   • Added wpdm_all_packages_tags filter for DataTable row customization
   • File type icons now use SVG image files instead of inline SVGs
   • Admin modal and UI refinements

   Corregido

   • Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode attributes (Reported by Wordfence)
   • Missing authorization check in Media Access Control
   • Email lock “Mail Download Link” checkbox not saving unchecked state
   • Email lock download link condition was inverted
   • CSV import BOM character handling for UTF-8 files
   • CSV import post_title overriding title column
   • is_email check without verifying user exists

   Seguridad

   • Security fix, email lock fix, CSV import improvements

   Cambios

   • February 21, 2026