Frontend File Explorer

Changelog

1.1.0

• Compliance: Author credits are now opt-in — off by default on new and existing installs, with a nofollow link when enabled, per WordPress.org plugin guideline 10.
• Security: Server-executable file types (such as .php) are always blocked on every write path — upload, rename, copy, and move — regardless of configuration. An allowed file type can no longer be renamed into an executable one.
• Security: Hardened ZIP downloads (memory limits, temp-file cleanup) and path validation (null-byte rejection, canonical-path checks on all handlers).
• Security: Backfills directory-listing protection (.htaccess + index.php) on installs created before it existed.
• Performance: Plugin scripts now load with a defer strategy on WordPress 6.3 and later. On WordPress 5.6 to 6.2 the scripts still load in the footer, but without deferring.
• Privacy: The Buy Me a Coffee button image is bundled locally — no third-party CDN requests from your admin.

1.0.11

• Feature: Rename files and folders directly from the admin explorer.
• Feature: Bulk select items with checkboxes and a select-all control.
• Feature: Move or copy files and folders to any destination via a folder picker with breadcrumb navigation.
• Feature: Per-item conflict resolution (Skip, Replace, Keep both) when the destination already contains an item with the same name.

1.0.8

• Feature: Added « Hide author credits » toggle (Settings panel) — removes credits from DOM when checked, dofollow attribution when visible.
• Feature: Added Buy Me a Coffee support button on the admin page, Plugins screen, readme.txt, and README.md.
• UI: Added a settings card below the shortcode panel with checkbox and support links.
• Internal: Added plugin_row_meta filter for plugin action links, save_credits_preference AJAX endpoint, and frontend_file_explorer_hide_credits option.

1.0.7

• Feature: Added server-side sorting for folder/file listings (Name, Date Modified, Size, Type, asc/desc).
• Feature: Admin can set a default sort order that persists for frontend visitors.
• Feature: Added shortcode reference panel with copyable code snippets below the admin explorer.
• Feature: Frontend explorer now respects the admin-configured default sort order.
• UI: Modernized shortcode & tips card with dark code blocks, hover effects, tooltip copy feedback.

1.0.6

• UI: Redesigned admin interface with modern styling, CSS custom properties, card-based grid, smoother transitions, and responsive layouts.
• UI: Replaced browser alerts with styled toast notifications for success/error messages.
• UI: Added file-type color coding for PDFs, Word docs, Excel files, and archives.
• UI: Improved modal design with backdrop blur, scale animation, and Escape-key dismissal.
• Fix: Fixed broken CSS asset paths preventing Material Icons and all styles from loading.
• Fix: Fixed Material Icons font URL resolution in bundled stylesheet.
• Fix: Fixed duplicate element ID causing toolbar button text to disappear on upload modal open.
• Fix: Fixed infinite recursion crash when clicking upload dropzone.
• Fix: Fixed « Upload Files » button incorrectly opening Media Library instead of the upload modal.
• Fix: Fixed ZIP download failing with « No path specified » (GET vs POST mismatch).
• Fix: Fixed trailing comma syntax error in admin JavaScript class method.

1.0.5

• Security: Added comprehensive array structure validation for $_FILES superglobal before accessing elements.
• Security: Moved is_uploaded_file() validation to immediately after accessing tmp_name for improved security.
• Security: Removed PHPCS ignore comment and implemented proper sanitization for file upload handling.
• Standards: Replaced $_REQUEST with $_POST for AJAX POST requests per WordPress coding standards.
• Standards: Replaced PHP basename() with WordPress wp_basename() for i18n compatibility with multibyte characters.

1.0.4

• Security: Sanitized and validated all $_FILES upload fields individually (name, type, tmp_name, error, size).
• Security: Added is_uploaded_file() guard against path injection on file uploads.
• Standards: Fixed unordered placeholders in translatable strings per WordPress i18n guidelines.

1.0.3

• Security: Fixed unauthenticated file downloads, arbitrary PHP uploads, XSS via eval(), and server path disclosure.
• Standards: Migrated all filesystem operations to WP_Filesystem API, bundled Material Icons locally, added proper nonce verification and capability checks to all AJAX endpoints.
• Standards: Renamed classes to use WordPress underscore convention (Frontend_File_Explorer, Frontend_File_Explorer_Ajax).
• Standards: Removed discouraged load_plugin_textdomain() call, added proper prefixing to all handles and identifiers.

1.0.2

• Fix: Resolved a critical bug causing the frontend explorer to execute filesystem deletion logic instead of listing directory contents.
• Fix: Repaired the « Download as ZIP » mechanism to eliminate ERR_INVALID_RESPONSE failures by safely building ZipArchive temp files and explicitly managing PHP output buffers and Safari download headers.
• Feature: Fully integrated the missing backend endpoints required for the UI, enabling seamless frontend and backend folder creation, file uploads, and Media Library imports.
• Security & Standards: Swept codebase for strict WordPress PHPCS warnings. Corrected all variable unslashing, resolved missing nonce verification checks, migrated deprecated filesystem functions to WP_Filesystem, and reinforced esc_html__ translation domain strings and translators comments.

1.0.1

• Rename plugin to « Frontend File Explorer »
• Align text domain and translation loading with slug frontend-file-explorer
• Improve README and readme.txt descriptions and screenshots