Trilobita DocVault

[trdv_list]

[trdv_list type="pdf" orderby="title" order="ASC"]
[trdv_list category="reports" show_search="false" columns="title,date"]
[trdv_list orderby="menu_order"]
[trdv_list show_category_filter="true" show_type_filter="true" show_count="true"]
[trdv_list show_tag_filter="true"]
[trdv_list show_download="false" show_view="true"]

[trdv_link id="123"]Download the report[/trdv_link]

[trdv_link id="123"] - Uses document title as link text
[trdv_link id="123"]Click here[/trdv_link] - Custom link text
[trdv_link id="123" new_tab="true"]Download[/trdv_link] - Opens in new tab

Endringslogg

1.5.9

• Security: Documents restricted to logged-in users or specific roles, and expired documents, no longer appear in site search results or on document category and tag pages for visitors who cannot access them. Previously their titles and descriptions could be listed there (downloads were always blocked).
• Security: Choosing «Specific roles» without selecting any roles now saves «Logged-in users only» with a warning, since that is how it behaved. Saved role settings are no longer cleared when the settings page is saved without DocVault Pro.
• Security: Several hardening fixes: uploads must belong to a document, the document list is limited to 100 documents per page, downloads are marked private so shared caches never store them, legacy files are checked to be inside the DocVault folders, unknown access settings now deny access, and sort-order changes only affect documents you can edit.
• Fix: The expiry date help text now describes the current behaviour.
• Improvement: The Plugins screen now has a Settings link and Docs, Support and review links for DocVault, and the plugin description matches the WordPress.org listing.
• New: Getting-started guide for new sites. While there are no documents, the Documents screen shows three short steps (upload a document, show documents on a page, choose who can see them), and the Plugins screen shows a short dismissible notice. The guide hides itself once you are set up, or you can hide it at any time. Sites that already have documents are not shown it.
• New: «Create a documents page» button that creates a draft page containing the searchable document list and opens it in the editor for you to review and publish.
• Improvement: The review prompt is no longer shown on sites without any documents, or while the file protection warning or the getting-started guide is showing.

1.5.8

• Security: The Document block no longer shows restricted or expired documents when page content is rendered through admin-ajax.php (for example by a theme’s «load more» feature) for visitors who cannot access them.
• Developer: The Document block’s Layout control and display toggles can now be extended by other plugins through the trdv.document.layoutOptions and trdv.document.layoutControls JavaScript filters. DocVault Pro 1.5.4 uses these to add its Card and Button layouts to the same Layout control, fixing a duplicate Layout control and missing toggles in the block sidebar when Pro is active. No change for sites without Pro.

1.5.7

• Fix: Download counts are no longer lost when the same document is downloaded several times at once. The total is now updated in a single database operation.
• Fix: Saving a document no longer reports an expiry date change unless the expiry date actually changed. Previously every save of a document without an expiry date was reported as «cleared», which created misleading entries in the DocVault Pro audit log.
• Fix: The Upload Date column in the admin document list and the Date column in the [trdv_list] table now show your site’s time zone instead of UTC.

1.5.6

• Security: Direct web access to the DocVault upload folder is now blocked on Apache servers. Previously, a stored file could be downloaded straight from its storage URL, bypassing access restrictions and expiry dates. Existing sites are protected automatically on upgrade. Nginx users should add the server rule described in the FAQ.
• Security: New Site Health check that tests whether stored document files can be downloaded directly. If they can (for example on Nginx without the server rule), Site Health and the DocVault admin screens show a warning with the exact rule to add.
• Improvement: The review prompt can now also appear once you have added 5 or more documents (and have used DocVault for at least 7 days), in addition to the existing 21-day prompt. Whichever comes first is shown; dismissing or snoozing it applies to both.

1.5.5

• Compatibility: Confirmed compatible with WordPress 7.1.
• Fix: Document block editor styles now declared via style_handles so they load correctly inside the always-iframed post editor introduced in WordPress 7.1, instead of relying on a WordPress core compatibility fallback.

1.5.4

• Improvement: The Document block’s document picker is now a live search field backed by the REST API, replacing the static dropdown that was silently limited to 100 documents.

1.5.3

• Fix: Download and View buttons in the document list no longer wrap their label across two lines.

1.5.2

• Fix: Admin CSS accent colours now use var(--wp-admin-theme-color) so buttons, borders, and links match whichever admin colour scheme is active (Fresh, Modern, Ocean, etc.).

1.5.1

• Docs: corrected expiry date FAQ — expired documents are now blocked at download, view, and REST level for non-admin/non-author users (enforced since 1.4.9; FAQ previously described the old behaviour).
• Docs: corrected stale line number in phpcs:disable comment in class-admin-interface.php.

1.5.0

• Compatibility: Confirmed compatible with WordPress 7.0.
• Enhancement: Block API version updated to 3, enabling iframed post editor support in WordPress 7.0 when all blocks in a post are version 3 or higher.
• Enhancement: Public stylesheet now declared via style_handles in block registration, ensuring styles load correctly inside the iframed editor.
• Fix: Plugin Check warning for interpolated $placeholders in sort-order query suppressed with targeted phpcs:disable/enable — the variable contains only %d tokens and is not user-controlled.
• Fix: Plugin Check warning for meta_query in pre_get_posts access-control filter suppressed — no alternative API covers this use case.

1.4.9

• New: Single document page visits now redirect (302) to the download endpoint. This makes the Query Loop block’s «make title a link» option work correctly.
• New: Documents now appear as a selectable post type in the Core Query Loop block, enabling custom frontend layouts built entirely in the block editor. Public and logged-in access restrictions are enforced at the REST level; role-restricted documents are blocked on individual REST fetches (collection-level role filtering has the same limitation as [trdv_list]).
• Fix: Expiry dates are now enforced at the download, view, and REST level via can_view_document(). Previously expiry only filtered documents from [trdv_list] output; direct download/view URLs and REST requests could still reach expired documents.
• Fix: Expired and access-restricted documents are now hidden from the Query Loop block listing entirely. A pre_get_posts hook applies access control and expiry at query level; a the_posts row-level filter removes role-restricted documents that cannot be excluded in SQL.

1.4.8

• New: Manual sort order — drag the handle column in the admin document list to reorder documents. The first drag establishes positions for all existing documents; subsequent drags update only the visible page. Use [trdv_list orderby="menu_order"] to display documents on the frontend in their manually-defined order.
• New: Tag support — documents can be tagged via a new flat Tags taxonomy shown as an admin column. Use [trdv_list tag="slug"] to pre-filter by tag and [trdv_list show_tag_filter="true"] for a tag dropdown filter.

1.4.7

• New: «Include documents in site search» setting — when enabled, documents appear alongside posts and pages in WordPress search results. Access restrictions are respected.
• New: View button for PDF and image files — opens the file in a new browser tab without forcing a download. Supported in both the [trdv_list] shortcode (show_view="false" to hide) and the DocVault Document block.
• New: Document description field — set an optional description per document; displayed inline in [trdv_list] with a toggle button, and directly in the DocVault Document block (full layout).
• New: Clear search button — an × button appears inside the search field when text is entered; clicking it resets the field and refreshes the list.
• New: Category filter dropdown — [trdv_list show_category_filter="true"] adds a category dropdown alongside the search box.
• New: File type filter dropdown — [trdv_list show_type_filter="true"] adds a file type dropdown; only types present in the library are listed.
• New: Download count column — [trdv_list show_count="true"] adds a Downloads column showing total download count per document. Also available as a toggle in the DocVault Document block (full layout).
• Fixed: Expiry days-remaining calculation now anchors both dates to UTC before comparison, ensuring correct behaviour on servers where the PHP default timezone differs from UTC.

1.4.6

• Added a description to the Version History metabox explaining that the Restore button makes a previous version the active file served to users.

1.4.5

• Security: all upload entry points now reject files immediately when content-based MIME validation fails — no fallback to browser-supplied MIME type.
• Developer: added trdv_allowed_file_types filter to the upload validation, wp_handle_upload() mimes, download tracker MIME check, and upload UI — allows Pro to extend the accepted file type list without patching free plugin code.

1.4.4

• Fixed: legacy files stored in the old sdm-documents/ directory are now correctly hidden from the media library.
• Fixed: media library deletion guard now protects legacy sdm-documents/ files, not just the current trdv-documents/ directory.
• Fixed: storage stats «current vs. old» byte split now uses the explicit current-version pointer rather than assuming the last array entry is current.
• Fixed: legacy attachment-based files can be deleted through DocVault version management again — the deletion guard was incorrectly blocking the operation.
• Fixed: replaced deprecated current_time('timestamp', true) calls with time() to eliminate notices on sites with WP_DEBUG enabled.

1.4.3

• New uploads are no longer registered as WordPress media library attachments — DocVault files are now stored privately and managed entirely within DocVault.
• Legacy attachment-based files are hidden from the media library grid and modal to prevent accidental deletion.
• Attempting to delete a DocVault-managed attachment from the media library is now blocked with an explanatory error.
• Version limit warning replaced with a prominent dismissible banner above the upload area — includes the limit message, a Pro upgrade link, and a «Continue anyway» button. Saving is blocked until the warning is acknowledged or the file is removed.
• Security: path containment validation added for all path-based file operations (serve and delete) using realpath() to prevent arbitrary file access or deletion if post meta is tampered.
• Fixed: introduced an explicit current-version pointer (_trdv_current_version_num) so the active file is preserved correctly after a merge operation. Prevents version number collisions and accidental deletion of the current version.

1.4.2

• Added file type filter dropdown to the admin document list — filter by PDF, DOCX, etc. in one click.
• Fixed: expiry date hook now fires when the expiry date is cleared, so Pro audit log and email notifications correctly record the change.

1.4.1

• Added document expiry dates — set an optional expiry date per document; expired documents are hidden from the frontend list automatically. Use [trdv_list show_expired="true"] to include them.
• Fixed: block renderer and [trdv_link] shortcode now check access control before exposing document metadata
• Fixed: frontend query applies access-control filtering at query level for anonymous users
• Fixed: AJAX search reads show_expired from the PHP-rendered data attribute for consistency with initial render; value cannot be set independently via client-side input
• Fixed: per-document roles access type no longer silently discarded by the save handler
• Fixed: _trdv_upload_date now uses current_time() WordPress API

1.4.0

• Added dismissible review notice shown after 21 days on DocVault admin pages
• Replaced version limit confirm dialog with an inline notice linking to DocVault Pro

1.3.9

• Fixed download button text being hidden when the theme link colour matches the button background colour

1.3.8

• Fixed drag-and-drop upload not attaching the file on Publish/Update (title was pre-filled but file was silently discarded)
• Fixed drag-and-drop: cancelling the version-limit confirmation dialog no longer silently queues the dropped file for upload

1.3.7

• Settings page redesigned with card layout matching Pro (File Storage, Categories, Access Control cards)
• Block title corrected to «DocVault Document» in both PHP and JS registrations
• Added support for ODT, ODS, ODP, RTF, CSV, and TXT file types
• readme.txt: usage section reorganised, block and toolbar button documented, Pro section added, FAQ expanded

1.3.6

• Fixed version history upload dates stored in local time instead of UTC
• Fixed version history dates displaying raw UTC string instead of converting to site timezone

1.3.5

• Improved folder structure locked-state warning to explain impact and what would be required to change it
• Global «Specific roles» access option now shows an upgrade prompt for free users; existing saved configurations continue to be honoured
• Help page: version limit note now hidden when Pro is active; Pro features section appended when Pro is active
• Added trdv_help_page_after_content action hook for extensibility

1.3.4

• Fixed flat folder structure filename prefix going out of sync after version pruning
• Fixed download log timestamps stored in local time instead of UTC
• Added admin notice when uploads directory is not writable on activation

1.3.3

• Initial release on WordPress.org

1.3.2

• Fixed remaining WordPress Plugin Check warnings: corrected phpcs:ignore comment placement

1.3.1

• Fixed WordPress Plugin Check warnings: phpcs:ignore for unavoidable direct DB queries and slow query args
• Fixed unprefixed variables in admin view templates (WordPress.NamingConventions.PrefixAllGlobals)
• Applied wp_check_filetype_and_ext MIME type validation to non-AJAX upload path

1.3.0

• Breaking change: Renamed shortcode [trdv_documents] to [trdv_list] — update any pages using the old shortcode
• Breaking change: Renamed shortcode [docvault_link] to [trdv_link] — update any content using the old shortcode
• Renamed plugin from Smart Document Manager to Trilobita DocVault
• Fixed null dereference on get_post_status_object() in privacy exporter
• Fixed incorrect log prefix in download tracker
• Fixed custom upload directory filter firing without a valid document context
• Improved MIME type handling: validates detected type against allowlist before sending Content-Type header
• Validates file MIME type from actual file content rather than browser-supplied value on upload

1.2.3

• Added explicit file upload validation before processing
• Added phpcs ignore comments for intentional code patterns
• Addresses all three common WordPress.org rejection reasons

1.2.2

• Fixed all WordPress Plugin Check errors
• Added translators comments for all placeholder strings
• Fixed ordered placeholders for i18n compliance
• Fixed unescaped output in frontend display
• Fixed %i placeholder for WP 5.8 compatibility
• Removed deprecated load_plugin_textdomain call
• Updated Tested up to WordPress 6.9
• Added phpcs ignore comments for intentional code patterns

1.2.1

• Added index.php to all directories for security
• Added LICENSE.txt file
• Added privacy disclosure section for IP logging
• Moved inline styles and scripts to enqueued files
• Generated translation template (.pot file)
• Fixed wp_unslash() usage on POST data
• Fixed $wpdb->prepare() in uninstall.php
• Added upload directory protection (index.php, .htaccess)
• Updated Tested up to 6.7.1

1.2.0

• Refactored plugin architecture for extensibility
• Version history limited to 5 versions per document by default
• Added E2E test suite with Playwright
• Code cleanup and stability improvements

1.1.0

• Added role-based access control for documents
• Added download tracking with statistics
• Added Document block for Gutenberg editor
• Added [trdv_link] shortcode for inline document links
• Added Settings page with access control options
• Added option to use WordPress categories or separate document categories
• Improved security for file downloads
• Fixed HTTP header injection vulnerability in downloads
• Fixed path traversal protection using realpath validation

1.0.0

• Initial release
• Custom post type for documents
• File upload with drag-and-drop
• Version history with rollback
• Frontend shortcode display with AJAX search
• Document categories taxonomy