Shariff Wrapper

4.6.22

• fix: add_after/add_before checkbox values were incorrectly stored as strings
  instead of integers since 4.6.18 (sanitize_key() instead of absint()), causing
  the strict 1 === comparisons to fail silently and share buttons to disappear
  from posts/pages. Includes a one-time migration to repair existing installations.

4.6.21

• headline/headline_zero: wp_kses() now runs after str_replace(‘%total’, …) to prevent
  attribute-context injection where %total inside an HTML attribute could break quote
  structure after the span replacement. Many thanks to Chloe from Wordfence
  and Muhammad Yudha to find amd fix this problem!
• borderradius AMP branch: add missing is_numeric() check and absint() cast, consistent
  with the non-AMP branch, to prevent CSS injection into dynamic_css

4.6.20

• removed useless init for translationk
• use PHP time() instead of old current_time(‘timestamp’, true) to avoid
  confusion with newer kinds of WP time functions
• cleanup numbers that has been set as strings too
• Fix: proper check auf external_host var
• Fix: some very old migrations fit for PHP8

4.6.19

• restrikt CSS styles in shortcode attributes to superadmins as usual in WP
• code cleanup: removed outdated admin-notices

4.6.18

• fix broken admin notice
• add wordfence verification

4.6.17

• update BTC adress checks to work with recent schemes
• optimize input checker
• sanitize short code uses the same checker like admin page now
• …and a big thank to Gemini (Google AI), which was a really
  helpful sparring partner. At least better than the resaecher how
  provided a false positive proof and did not answered on my questions

4.6.16

• tested up to WP 6.9.4
• added check on ABSPATH because the automated Plugin Check does not
  understand what the check on class WP does
• added check on BTC to avoid any input that is not a valid address
• removed input check on flattruser because service has gone more
  than 2 years ago

4.6.15

• added Bluesky integration

4.6.14

• removed Reddit from the share counts because requests without API keys are blocked now
• fix to avoid unauthenticated local file inclusion. Many thanks to haidv35

4.6.13

• cleanup code (please check the basic options menu. We changed some
  internal names of variables that differ from original WP namings for
  post/page/custom type. This should have been migrated with this update but
  please have a look on your ‘baisc options’.
• fix possible XSS with the (internal) variabe ‘timestamp’ (thanks to Ngo Thien An for the hint)

4.6.12

• French translation for some service corrected (thanks to Ensam57)
• additional security fix after code review

4.6.11

• security fix

4.6.10

• security fix (thanks to Dmitrii Ignatyev from CleanTalk inc.)
• updated Twitter icon and text to reflect the name change to X (thanks to @gerobe)
• updated to Facebook Graph API v19.0
• updated to allow calls to Shariff from AJAX callbacks (thanks to @jchnkl)
• removed deprecated service AddThis

4.6.9

• new service Mastodon (thanks to Nikita @kytta@fosstodon.org by providing s2f.kytta.dev)
• updated LinkedIn share link

4.6.8

• updated to Facebook Graph API v15.0
• removed deprecated services Flattr, QZone and TencientWeibo
• removed Twitter share counts via Twitcount
• removed broken links from help tab

4.6.7

• updated to Facebook Graph API v11.0
• changed FB request to og_object (thanks to richard67)

4.6.6

• Fix sanitize_callback parameter to avoid warnings with api requests
• tested for 5.7

4.6.5

• updated to Facebook Graph API v6.0
• fixed minor bug
• tested for WordPress 5.4

4.6.4

• fixed the settings link on the plugin overview page for certain environments (thanks to @midgard)
• updated to Facebook Graph API v5.0
• updated the WhatsApp link to swap url and title for a working image preview
• removed nofollow from the info button
• removed Xing share counts due to Xing disabling the API

4.6.3

• updated the WhatsApp share link to work with all devices again (thanks to @hanshansenxxx)
• updated to Facebook Graph API v3.3
• updated the Flattr button to reflect the new Flattr (thanks to Chris, @camthor)
• fixed an update issue with WP CLI
• removed the Facebook share counts request without APP ID and Secret
• Facebook now always requires an APP ID and Secret for share counts
• removed Flattr counts due to Flattr removing the API

4.6.2

• new service MeWe
• new service Buffer
• fixed an issue in case the plugin dir has been moved via symlink

4.6.1

• replaced Stumbleupon with its successor Mix (thanks to Mark)
• added an option to hide WhatsApp on desktop devices
• updated Odnoklassniki API
• fixed an issue with WPML and some older Shariff setups

4.6.0

• new high contrast theme (WCAG)
• improved support for WPML for easier translation of headlines and info button texts
• updated WhatsApp share link to support WhatsApp Web (thanks to Oliver, @oliverpw)
• updated Spanish translations (thanks to Torsten, @torstenbulk)
• updated Pinterest Share Count API
• updated VK Share Count API
• updated Pocket API
• updated XING API
• removed GooglePlus due to Google shutting GooglePlus down
• fixed a PHP notice in regards to Tumblr (thanks to Mario, @mariobartlack)
• fixed a conflict with another plugin (thanks to David, @daveshine)
• tested with WordPress 5.1

The complete changelog can be found here: https://plugins.svn.wordpress.org/shariff/trunk/changelog.txt

wordfence verify: 4k4bvof9mbrebb94btvbpnaxmjw47g1b