diff --git a/CHANGELOG.md b/CHANGELOG.md index 5bc6128..5415228 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,16 @@ All notable changes to this project will be documented in this file. +## [1.1.3] - 2026-03-07 + +### Security + +- **Template output escaping**: Added `|esc_url` filter to all unescaped URL outputs across 8 Twig template partials — `header.html.twig`, `header-offcanvas.html.twig`, `header-transparent.html.twig`, `header-centered.html.twig`, `footer.html.twig`, `footer-columns.html.twig`, `search-form.html.twig`, `comment-item.html.twig`. Covers `site.url`, `item.url`, `child.url`, `user.account_url`, `comment.author_url`, and `comment.edit_url`. + +### Added + +- **Twig escape filters** (`TwigService.php`): Registered `esc_html`, `esc_attr`, and `esc_url` as Twig filters with `['is_safe' => ['html']]` to prevent double-encoding. Complements existing `wpautop` and `wp_kses_post` filters. + ## [1.1.2] - 2026-03-01 ### Security diff --git a/style.css b/style.css index cb46f44..fae063d 100644 --- a/style.css +++ b/style.css @@ -7,7 +7,7 @@ Description: A modern WordPress Block Theme built from scratch with Bootstrap 5. Requires at least: 6.7 Tested up to: 6.7 Requires PHP: 8.3 -Version: 1.1.2 +Version: 1.1.3 License: GNU General Public License v2 or later License URI: http://www.gnu.org/licenses/gpl-2.0.html Text Domain: wp-bootstrap diff --git a/views/partials/comment-item.html.twig b/views/partials/comment-item.html.twig index e7b032c..c0ba347 100644 --- a/views/partials/comment-item.html.twig +++ b/views/partials/comment-item.html.twig @@ -7,8 +7,7 @@
{% if comment.author_url %} - {# author_url is pre-escaped with esc_url() in ContextBuilder #} - + {{ comment.author }} {% else %} @@ -19,7 +18,7 @@ {{ comment.date }} {% if comment.edit_url %} - {{ __('Edit') }} + {{ __('Edit') }} {% endif %}
diff --git a/views/partials/footer-columns.html.twig b/views/partials/footer-columns.html.twig index e6ca068..716ad45 100644 --- a/views/partials/footer-columns.html.twig +++ b/views/partials/footer-columns.html.twig @@ -13,7 +13,7 @@