CHANGELOG.md

Changelog

All notable changes to this project will be documented in this file, per the Keep a Changelog standard.

Unreleased - TBD

2.8.3 - 2024-11-18

Changed

• Only allow images that were uploaded by the same user be used when setting the avatar via a REST request (props @dkotter, @justus12337, @faisal-alvi via #317).

Fixed

• Only allow image files to be set as the avatar in REST requests (props @dkotter, @justus12337, @faisal-alvi via #317).

Security

• Bump @10up/cypress-wp-utils from 0.2.0 to 0.4.0, @sentry/node from 6.19.7 to 8.38.0, @wordpress/env from 9.2.0 to 10.11.0, cypress from 13.2.0 to 13.15.2, cypress-mochawesome-reporter from 3.6.0 to 3.8.2, puppeteer-core from 23.3.0 to 23.8.0 (props @dkotter via #319).

2.8.2 - 2024-11-12

Fixed

• Ensure dependencies are (actually) included properly in the release (props @dkotter via #316).

2.8.1 - 2024-11-12

Fixed

• Ensure dependencies are included properly in the release (props @dkotter via #315).

2.8.0 - 2024-11-12

Note that this release bumps the minimum required version of WordPress from 6.4 to 6.5.

Added

• Support for the WordPress.org plugin preview (props @faisal-alvi, @jeffpaul via #297).

Changed

• Update PHP compatibility check to use 10up/wp-compat-validation-tool (props @Sidsector9, @jeffpaul, @faisal-alvi via #291).
• Bump Wordpress "tested up to" version 6.7 (props @sudip-md, @jeffpaul, @dkotter via #310, #312).
• Bump WordPress minimum supported version to 6.5 (props @sudip-md, @jeffpaul, @dkotter via #310, #312).

Fixed

• Ensure all strings are properly translated (props @pedro-mendonca, @dkotter via #295).
• Properly handle malformed simple_local_avatar user data (props @adekbadek, @dkotter, @faisal-alvi via #302).

Security

• Run a user capability check before we clear the avatar cache (props @dkotter, @truonghuuphuc, @Sidsector9 via #309).
• Ensure REST API requests to set an avatar only allow existing attachment IDs to be used (props @dkotter, @justus12337, @faisal-alvi via GHSA-wfjh-m788-w2c5).
• Bump axios from 1.6.7 to 1.7.4 (props @dependabot, @faisal-alvi via #298).
• Bump webpack from 5.90.0 to 5.94.0 (props @dependabot, @faisal-alvi via #303).
• Bump ws from 7.5.10 to 8.18.0 and @wordpress/scripts from 27.1.0 to 30.4.0 (props @dependabot, @faisal-alvi via #305, #311).
• Bump body-parser from 1.20.2 to 1.20.3, express from 4.19.2 to 4.21.0, send from 0.18.0 to 0.19.0 and serve-static from 1.15.0 to 1.16.2 (props @dependabot, @faisal-alvi via #306).

Developer

• Update repo badges, add WordPress Playground badge, add plugin banner image (props @faisal-alvi, @thrijith, @jeffpaul via #297, #300, #304, #307).

2.7.11 - 2024-07-18

Note that this release bumps the minimum required version of WordPress from 6.3 to 6.4.

Changed

• Bumped WordPress "tested up to" version 6.6 and minimum version to 6.4 (props @sudip-md, @ankitguptaindia, @jeffpaul via #289, #290).

Security

• Add nonce check when saving the default avatar ID (props @faisal-alvi, @aaemnnosttv, @rafiem, @dkotter via GHSA-46pw-6m35-9m7x).
• Bump braces from 3.0.2 to 3.0.3, pac-resolver from 7.0.0 to 7.0.1, socks from 2.7.1 to 2.8.3 and removes ip (props @dependabot, @Sidsector9 via #286).
• Bump ws from 7.5.9 to 7.5.10 (props @dependabot, @faisal-alvi via #287).

2.7.10 - 2024-05-24

Fixed

• Fix Default Avatar Fallback (props @amirhossein7, @faisal-alvi, @dkotter, @qasumitbagthariya via #281).

Security

• Bump express from 4.18.2 to 4.19.2 (props @dependabot, @faisal-alvi via #269).
• Bump follow-redirects from 1.15.5 to 1.15.6 (props @dependabot, @faisal-alvi via #269).
• Bump ip from 1.1.8 to 1.1.9 (props @dependabot, @faisal-alvi via #269).
• Bump webpack-dev-middleware from 5.3.3 to 5.3.4 (props @dependabot, @faisal-alvi via #269).

2.7.9 - 2024-05-14

Fixed

• Ensure default Gravatar avatars are shown correctly (props @faisal-alvi, @dkotter, @horrormoviesgr, @inpeaks, @lillylark, @rafaucau, @janrenn via #278).

2.7.8 - 2024-05-08

Note that this release bumps the minimum required version of WordPress from 5.7 to 6.3.

Added

• "Testing" section in the CONTRIBUTING.md file (props @kmgalanakis, @jeffpaul via #274).

Changed

• Bumped WordPress "tested up to" version 6.5 (props @sudip-md, @dkotter, @jeffpaul via #270).
• Move simple_local_avatar_deleted action to avatar_delete (props @lllopo, @faisal-alvi, @dkotter via #255).
• Clean up NPM dependencies and update node to v20 (props @Sidsector9, @dkotter via #257).
• Update CODEOWNERS of the plugin (props @jeffpaul, @dkotter via #253).
• Disabled auto sync pull requests with target branch (props @iamdharmesh, @jeffpaul via #263).
• Upgrade download-artifact from v3 to v4 (props @iamdharmesh, @jeffpaul via #265).
• Replaced lee-dohm/no-response with actions/stale to help with closing no-response/stale issues (props @jeffpaul, @dkotter via #266).

Fixed

• Broken default avatar when Local Avatars Only is unchecked (props @faisal-alvi, @ankitguptaindia, @qasumitbagthariya via #260).
• Ensure high-quality avatar preview on profile edit screen (props @ocean90, @dkotter via #273).
• Possible PHP warning (props @BhargavBhandari90, @dkotter via #261).
• Fixed typos (props @szepeviktor, @dkotter via #268).

2.7.7 - 2023-12-13

Fixed

• Revert the Host/Domain support for local avatar URL (props @faisal-alvi, @jakejackson1, @leogermani, @dkotter via #247).

Security

• Bump axios from 0.25.0 to 1.6.2 and @wordpress/scripts from 23.7.2 to 26.18.0 (props @dependabot, @faisal-alvi via #250).

2.7.6 - 2023-11-30

Added

• Check for minimum required PHP version before loading the plugin (props @kmgalanakis, @faisal-alvi via #226).
• pre_simple_local_avatar_url filter to allow an avatar image to be short-circuited before Simple Local Avatars processes it (props @johnbillion, @peterwilsoncc via #237).
• Repo Automator GitHub Action (props @iamdharmesh, @faisal-alvi via #228).
• E2E test for checking the front end of avatars (props @Firestorm980, @iamdharmesh via #219).

Changed

• Bumped WordPress "tested up to" version 6.4 (props @zamanq, @ankitguptaindia, @faisal-alvi, @qasumitbagthariya via #230, #244).
• Update the Dependency Review GitHub Action to leverage our org-wide config file to check for GPL-compatible licenses (props @jeffpaul, @faisal-alvi via #215).
• Documentation updates (props @jeffpaul, @faisal-alvi via #242).

Fixed

• Address conflicts with other plugins and loading the media API (props @EHLOVader, @dkotter via #218).
• Prevent PHP fatal error when switching from a multisite to single site installation (props @ocean90, @ravinderk, @faisal-alvi via #222).
• Local avatar urls remain old after domain/host change (props @jayedul, @ravinderk, @jeffpaul, @faisal-alvi via #216).

Security

• Bump word-wrap from 1.2.3 to 1.2.4 (props @dependabot, @faisal-alvi via #223).
• Bump tough-cookie from 4.1.2 to 4.1.3 (props @dependabot, @faisal-alvi via #225).
• Bump @cypress/request from 2.88.10 to 3.0.0 (props @dependabot, @faisal-alvi via #225, #234).
• Bump cypress from 11.2.0 to 13.2.0 (props @dependabot, @faisal-alvi, @iamdharmesh via #234, #236).
• Bump postcss from 8.4.21 to 8.4.31 (props @dependabot, @faisal-alvi via #238).
• Bump @babel/traverse from 7.20.12 to 7.23.2 (props @dependabot, @faisal-alvi via #240).
• Bump @10up/cypress-wp-utils version to 0.2.0 (props @iamdharmesh, @faisal-alvi via #236).
• Bump @wordpress/env version from 5.2.0 to 8.7.0 (props @iamdharmesh, @faisal-alvi via #236).
• Bump cypress-mochawesome-reporter version from 3.0.1 to 3.6.0 (props @iamdharmesh, @faisal-alvi via #236).

2.7.5 - 2023-05-15

Added

• Ajax loading animation during process of uploading and deleting local avatars (props @lllopo, @BhargavBhandari90, @faisal-alvi via #204).

Changed

• Avatar removal button text (props @jayedul, @jeffpaul, @dkotter, @faisal-alvi via #208).
• WordPress "tested up to" version 6.2 (props @jayedul, @faisal-alvi via #210).
• Run E2E tests on the zip generated by "Build release zip" action (props @jayedul, @iamdharmesh, @faisal-alvi via #205).

Security

• Bump webpack from 5.75.0 to 5.76.1 (props @dependabot, @faisal-alvi via #207).

2.7.4 - 2023-02-23

Fixed

• Support passing WP_User to get_avatar() (props @mattheu, @faisal-alvi via #193).
• Remove trailing commas in function calls (props @patrixer, @dkotter, @sekra24, @faisal-alvi via #196).

Security

• Bump simple-git from 3.15.1 to 3.16.0 (props @dependabot, @faisal-alvi via #191).
• Bump http-cache-semantics from 4.1.0 to 4.1.1 (props @dependabot, @faisal-alvi via #197).

2.7.3 - 2023-01-16

Fixed

• Issue causing fatal errors when avatars used on front end of site (props @Rottinator, @peterwilsoncc, @ravinderk, @faisal-alvi via #187).
• Deprecation error in admin on PHP 8.0 and later (props @Rottinator, @peterwilsoncc, @ravinderk, @faisal-alvi via #187).

2.7.2 - 2023-01-13

Added

• Filter hook simple_local_avatars_upload_limit to restrict image upload size & image file checking enhanced (props @Shirkit, @jayedul, @faisal-alvi, @jeffpaul via #171).
• GitHub Actions summary on Cypress e2e test runs (props @faisal-alvi, @jeffpaul, @iamdharmesh via #174).

Changed

• Cypress integration migrated from 9.5.4 to 11.2.0 (props @iamdharmesh, @jayedul, @faisal-alvi via #172).

Fixed

• PHP8 support for assign_new_user_avatar (props @lllopo, @mattwatsoncodes, @faisal-alvi via #183).
• Fixed the user profile language not respected issue (props @dkotter, @lllopo, @faisal-alvi, @jeffpaul via #175).

Removed

• textdomain from the core strings and the function update_avatar_ratings as it's not required anymore (props @dkotter, @lllopo, @faisal-alvi, @jeffpaul via #175).

Security

• Bump json5 from 1.0.1 to 1.0.2 (props @dependabot, @faisal-alvi via #182).

2.7.1 - 2022-12-08

Added

• Added missing files from the last release and changed the readme file to fix the bullet points and added fullstops.

2.7.0 - 2022-12-08

Added

• Added Build release zip GitHub Action (props @peterwilsoncc, @faisal-alvi via #168).

Changed

• Set plugin defaults on wp_initialize_site instead of deprecated action wpmu_new_blog (props @kadamwhite, @faisal-alvi via #156).
• Support Level from Active to Stable (props @jeffpaul, @dkotter via #159).
• Build tools: Allow PHPCS installer plugin to run without prompting user (props @peterwilsoncc, @jeffpaul via #164).
• WP tested up to version bump to 6.1 (props @peterwilsoncc, @faisal-alvi via #165).

Fixed

• Non admin users can not crop avatar (props @jayedul, @faisal-alvi, @zamanq, @dkotter, @jeffpaul via #155).

Security

• Bump @wordpress/env from 4.9.0 to 5.2.0 and got from 10.7.0 to 11.8.5 (props @dependabot, @faisal-alvi via #153).
• Bump loader-utils from 2.0.2 to 2.0.3 (props @dependabot, @faisal-alvi via #160).
• Bump loader-utils from 2.0.3 to 2.0.4 (props @dependabot, @peterwilsoncc via #162).
• Bump simple-git from 3.9.0 to 3.15.1 (props @dependabot via #176).

2.6.0 - 2022-09-13

Note that this release bumps the minimum required version of WordPress from 4.6 to 5.7 and PHP from 5.6 to 7.4.

Added

• If a default avatar image is used, ensure that outputs alt text. This will either be default text (Avatar photo) or the alt text from the uploaded default image (props @dkotter, @faisal-alvi via #147).
• Two hooks, simple_local_avatar_updated and simple_local_avatar_deleted, to allow theme or plugin developers to react to changes in local avatars in a consistent and precise way (props @t-lock, @faisal-alvi, @dkotter via #149).

Changed

• Bump minimum required version of WordPress from 4.6 to 5.7 (props @vikrampm1, @faisal-alvi, @cadic via #143).
• Bump minimum required version of PHP from 5.6 to 7.4 (props @vikrampm1, @faisal-alvi, @cadic via #143).
• The plugin is now available via Composer without any additional steps required (props @faisal-alvi, @kovshenin, @jeffpaul via #145).

Security

• Bump terser from 5.14.1 to 5.14.2 (props @dependabot, @faisal-alvi via #142).

2.5.0 - 2022-06-24

Added

• Skip cropping button (props @dkotter, @faisal-alvi, @cadic, @jeffpaul, @dinhtungdu via #130)!
• Updated the button name from "Skip Crop" to "Default Crop" only on the edit profile page (props @faisal-alvi, @peterwilsoncc via #136).
• If an image used for a local avatar has alt text assigned, ensure that alt text is used when rendering the image (props @dkotter, @pixelloop, @faisal-alvi via #127).
• Support for bbPress by loading the JS at FE on the profile edit page (props @foliovision, @faisal-alvi, @iamdharmesh via #134).
• Cypress E2E tests (props @faisal-alvi, @vikrampm1, @Sidsector9 via #115).

Fixed

• Broken avatar URLs for network-configured shared avatars with non-standard thumbnail sizes (props @vladolaru, @faisal-alvi via #125).
• HTTP_REFERER is null and causing PHP warning (props @alireza-salehi, @faisal-alvi, @peterwilsoncc via #129).

2.4.0 - 2022-05-10

Added

• Ability to set a default avatar. (props @mehulkaklotar, @jeffpaul, @dinhtungdu, @faisal-alvi via #96).

Fixed

• Correct plugin name in changelog. (props @grappler, @jeffpaul via #117).
• Avatar cache not being cleared. (props @thefrosty, @jeffpaul, @faisal-alvi, @peterwilsoncc via #118 & #120).

Security

• Dev dependency @wordpress/scripts upgraded to resolve deeper level dependency security issues. (props @jeffpaul, @faisal-alvi, @cadic via #119).

2.3.0 - 2022-04-25

Added

• Crop screen (props @jeffpaul, @helen, @ajmaurya99, @Antonio-Laguna, @faisal-alvi via #83).
• Avatar preview for Subscribers (props @ankitguptaindia, @dinhtungdu, @dkotter via #74).
• More robust multisite support and shared avatar setting (props @adamsilverstein, @helen, @jeffpaul, @dkotter, @faisal-alvi, @holle75 via #72).
• Settings link to plugin action links (props @rahulsprajapati, @jeffpaul, @iamdharmesh via #92).
• Dashboard setting and WP-CLI command to migrate avatars from WP User Avatar (props @jeffpaul, @claytoncollie, @helen, @faisal-alvi via #85).
• Option to clear cache of user meta to remove image sizes that do not exist (props @jeffpaul, @ituk, @dinhtungdu, @sparkbold, @thrijith via #90).
• Package file (props @faisal-alvi, @jeffpaul, @claytoncollie, @cadic via #94).
• PHP Unit Tests (props @faisal-alvi, @iamdharmesh via #101).
• "No Response" GitHub Action (props @jeffpaul via #84).

Changed

• Bump WordPress "tested up to" version to 5.9 (props @jeffpaul, @ankitguptaindia, @dinhtungdu, @phpbits via #67, #75, #81, #97).
• Bump WordPress "tested up to" version to 6.0 (props @ajmaurya99 via #110)
• Format admin script (props @thrijith, @dinhtungdu via #91).

Fixed

• Media ID as string in REST API (props @diodoe, @dinhtungdu, @dkotter via #71).
• Avatar rating text is not translated properly if a user has a custom language Set (props @ActuallyConnor, @faisal-alvi via #89).

Security

• PHP 8 compatibility (props @faisal-alvi, @dkotter, @Sidsector9 via #103).
• Bump rmccue/requests from 1.7.0 to 1.8.0 (props dependabot@ via #77).
• Bump nanoid from 3.1.28 to 3.2.0 (props dependabot@ via #98).
• Bump minimist from 1.2.5 to 1.2.6 (props dependabot@ via #105).

2.2.0 - 2020-10-27

Added

• $args parameter to get_simple_local_avatar function (props @dinhtungdu, @heyjones, @dkotter, @sumnercreations, @dshanske via #40)
• Simple_Local_Avatars::get_avatar_data(), Simple_Local_Avatars::get_simple_local_avatar_url(), and Simple_Local_Avatars::get_default_avatar_url() methods (props @dinhtungdu, @heyjones, @dkotter, @sumnercreations, @dshanske via #40)
• Ability to retrieve avatar with WP_Post object (props @oscarssanchez, @blobaugh via #47)
• Add class and ID to Avatar section on Profile Page to allow easier styling (props @dinhtungdu via #54)
• WP Acceptance test coverage (props @dinhtungdu via #53)

Changed

• Switched to pre_get_avatar_data filter (props @dinhtungdu, @heyjones, @dkotter, @sumnercreations, @dshanske via #40)
• Changed assign_new_user_avatar function to public (props @tripflex via #48)
• Split the main class into its own file, added unit tests, and set up testing GitHub action (props @dinhtungdu, @helen, @stevegrunwell via #59)
• New plugin banner and icon (props @JackieKjome via #52)
• Bump WordPress version "tested up to" 5.5 (props @Waka867, @tmoorewp, @jeffpaul, @dinhtungdu via #36, #43, #52)
• GitHub Actions from HCL to YAML workflow syntax (props @jeffpaul via #37)
• Documentation updates (props @jeffpaul via #29, #30, #33, #45, #50, #52)

Fixed

• Initialize Simple_Local_Avatars on the $simple_local_avatars global, enabling bundling plugin with composer (props @pdewouters, @adamsilverstein via #34)

Removed

• get_avatar function that overrides the core function (props @dinhtungdu, @heyjones, @dkotter, @sumnercreations, @dshanske via #40)

2.1.1 - 2019-05-07

Fixed

• Do not delete avatars just because they don't exist on the local filesystem. This was occasionally dumping avatars when WordPress uploads were stored elsewhere, e.g. a cloud service.

2.1 - 2018-10-24

Added

• All avatar uploads now go into the media library. Don't worry - users without the ability to upload files cannot otherwise see the contents of your media library. This allows local avatars to respect other functionality your site may have around uploaded images, such as external hosting.
• REST API support for getting and updating.
• Use .org language packs rather than bundling translations.

Fixed

• Avoid an ArgumentCountError.
• A couple of internationalization issues.

2.0 - 2013-06-02

Added

• Choose or upload an avatar from the media library (for users with appropriate capabilities)!
• Local avatars are rated for appropriateness, just like Gravatar
• A new setting under Discussion enables administrators to turn off Gravatar (only use local avatars)
• Delete the local avatar with a single button click (like everywhere else in WordPress)
• Uploaded avatar file names are appended with the timestamp, addressing browser image caching issues
• New developer filter for preventing automatic rescaling: simple_local_avatars_dynamic_resize
• New developer filter for limiting upload size: simple_local_avatars_upload_limit
• Upgraded functions deprecated since WordPress 3.5
• Hungarian translation added (needs further updating again with new version)

Fixed

• Fixed translations not working on front end (although translations are now a bit out of date...)
• Assorted refactoring / improvements under the hood

1.3.1 - 2011-12-29

Added

• Brazilian Portuguese and Belarusian translations

Fixed

• Bug fixes (most notably correct naming of image files based on user display name)
• Optimization for WordPress 3.2 / 3.3 (substitutes deprecated function)

1.3 - 2011-09-22

Added

• Avatar file name saved as "user-display-name_avatar" (or other image extension)
• Russian localization added

Fixed

• Assorted minor code optimizations

1.2.4 - 2011-07-02

Added

• Support for front end avatar uploads (e.g. Theme My Profile)

1.2.3 - 2011-04-04

Added

• Russian localization

1.2.2 - 2011-03-25

Fixed

• Fix for avatars uploaded pre-1.2.1 having a broken path after upgrade

1.2.1 - 2011-01-26

Added

• French localization

Fixed

• Simplify uninstall code

1.2 - 2011-01-26

Added

• Spanish localization
• Other minor under the hood optimizations

Fixed

• Fix path issues on some IIS servers (resulting in missing avatar images)
• Fix rare uninstall issues related to deleted avatars

1.1.3 - 2011-01-20

Fixed

• Properly deletes old avatars upon changing avatar
• Fixes "foreach" warning in debug mode when updating avatar image

1.1.2 - 2011-01-18

Added

• Norwegian localization

1.1.1 - 2011-01-18

Added

• Italian localization

1.1 - 2011-01-18

Added

• All users (regardless of capabilities) can upload avatars by default. To limit avatar uploading to users with upload files capabilities (Authors and above), check the applicable option under Settings > Discussion. This was the default behavior in 1.0.
• Localization support; German included

1.0 - 2011-01-18

• Initial release