Feature: Added a pre-login restriction mode that can either show the protected-content template or redirect unauthenticated visitors to a public login page and then return them to the originally requested protected page.
1.0.7
Cache: Disabled full-page, object, and DB caching for DocCheck login, protected-content, and OAuth callback responses so one-time login state cannot be served from cache.
1.0.6
Added a direct Settings link to the plugin row on the WordPress plugins overview screen for faster access to options-general.php?page=doccheck-access.
1.0.5
Review fix: Removed WordPress auth salt usage from OAuth state. The state parameter now contains only a nonce, while redirect and tracking data are kept server-side in a one-time transient.
Review fix: Recursively sanitize DocCheck anonymous-session data before storing and before exposing it through helper APIs.
Review fix: Updated the WordPress.org contributors field to the plugin owner username.
1.0.4
Review fix: Sanitized the wp_list_pages() HTML returned by the [docacc_sitemap] shortcode before concatenating it into shortcode output.
1.0.3
Review fix: Renamed plugin-owned global identifiers to the unique docacc prefix, including functions, classes, constants, options, hooks, transients, session keys, user meta keys, role slug, and shortcodes.
Review fix: Replaced shortcodes with [docacc_login], [docacc_hide_content], [docacc_logout], and [docacc_sitemap].
Review fix: Removed plugin-owned class_exists() and function_exists() wrappers to avoid silent conflicts with other plugins or themes.
Review fix: Updated the OAuth callback query var, settings option, admin documentation, developer hooks, and examples to use the docacc prefix consistently.
Compatibility: Added idempotent settings initialization so the renamed settings option is created safely during updates as well as new activations.
1.0.2
Security: Restricted the Default User Role dropdown to low-privilege roles only (excludes roles with manage_options or edit_others_posts).
Security: Added server-side validation in validate_settings() to reject high-privilege roles even if submitted directly.
Security: The docacc_map_role filter result is now validated before set_role() is called, preventing privilege escalation via custom filter callbacks.
Security: Added explicit opt-in for automatic local user creation (allow_user_creation), defaulted to off, and defaulted new installs to Anonymous Session mode.
1.0.1
Review fix: Replaced inline <script> and <style> output with proper WordPress enqueue APIs.
Added admin JavaScript through admin_enqueue_scripts + wp_add_inline_script() for settings tabs, scope/property matrix behavior, redirect URI copy button, and metabox role toggle.
Moved matrix CSS and protected fallback template CSS into enqueued stylesheet assets.
Review fix: Updated register_setting() arguments and adjusted client_secret sanitization to use a dedicated secret-safe callback instead of generic text-field sanitization.
Review fix: Escaped shortcode callback return output for docacc_logout and sanitized rendered docacc_hide_content output with wp_kses_post().
Review fix: Removed global session start behavior and introduced lazy, cookie-aware session initialization only in DocCheck authentication/session contexts.
