Skip to content

Commit 3b44dd1

Browse files
author
Jon Waldstein
committed
chore: prepare for release
1 parent 49fdd9f commit 3b44dd1

File tree

13 files changed

+60
-57
lines changed

13 files changed

+60
-57
lines changed

‎give.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
* Description: The most robust, flexible, and intuitive way to accept donations on WordPress.
77
* Author: GiveWP
88
* Author URI: https://givewp.com/
9-
* Version: 4.10.0
9+
* Version: 4.10.1
1010
* Requires at least: 6.6
1111
* Requires PHP: 7.4
1212
* Text Domain: give
@@ -425,7 +425,7 @@ private function setup_constants()
425425
{
426426
// Plugin version.
427427
if (!defined('GIVE_VERSION')) {
428-
define('GIVE_VERSION', '4.10.0');
428+
define('GIVE_VERSION', '4.10.1');
429429
}
430430

431431
// Plugin Root File.

‎readme.txt‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ Tags: donation, donate, recurring donations, fundraising, crowdfunding
55
Requires at least: 6.6
66
Tested up to: 6.8
77
Requires PHP: 7.4
8-
Stable tag: 4.10.0
8+
Stable tag: 4.10.1
99
License: GPLv3
1010
License URI: http://www.gnu.org/licenses/gpl-3.0.html
1111

@@ -273,6 +273,9 @@ You can report security bugs through the Patchstack Vulnerability Disclosure Pro
273273

274274
== Changelog ==
275275

276+
= 4.10.1: October 2nd, 2025 =
277+
* Security: Improved REST endpoint permissions for campaigns and forms (CVE-2025-11227, CVE-2025-11228)
278+
276279
= 4.10.0: October 1st, 2025 =
277280
* New: The admin list tables have been upgraded to a new design with various enhancements!
278281
* New: The admin donations list table now displays quick stats

‎src/API/REST/V3/Routes/Campaigns/Permissions/CampaignPermissions.php‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -7,34 +7,34 @@
77
use WP_REST_Request;
88

99
/**
10-
* @unreleased
10+
* @since 4.10.1
1111
*/
1212
class CampaignPermissions
1313
{
1414
/**
1515
* Check if current user can edit campaigns.
1616
*
17-
* @unreleased
17+
* @since 4.10.1
1818
*/
1919
public static function canEdit(): bool
2020
{
21-
return current_user_can('manage_options') ||
21+
return current_user_can('manage_options') ||
2222
current_user_can('edit_give_forms');
2323
}
2424

2525
/**
2626
* Check if current user can view private/draft/archived campaigns.
2727
*
28-
* @unreleased
28+
* @since 4.10.1
2929
*/
3030
public static function canViewPrivate(): bool
3131
{
32-
return current_user_can('manage_options') ||
32+
return current_user_can('manage_options') ||
3333
current_user_can('edit_give_forms');
3434
}
3535

3636
/**
37-
* @unreleased
37+
* @since 4.10.1
3838
*/
3939
public static function authorizationStatusCode(): int
4040
{
@@ -44,7 +44,7 @@ public static function authorizationStatusCode(): int
4444
/**
4545
* Validate campaign access permissions for GET items (collections).
4646
*
47-
* @unreleased
47+
* @since 4.10.1
4848
*
4949
* @param WP_REST_Request $request
5050
*
@@ -53,7 +53,7 @@ public static function authorizationStatusCode(): int
5353
public static function validationForGetItems(WP_REST_Request $request)
5454
{
5555
$status = $request->get_param('status');
56-
56+
5757
// If no status is specified, allow access (defaults to active campaigns)
5858
if (empty($status)) {
5959
return true;
@@ -83,7 +83,7 @@ public static function validationForGetItems(WP_REST_Request $request)
8383
/**
8484
* Validate campaign access permissions for individual campaign GET method.
8585
*
86-
* @unreleased
86+
* @since 4.10.1
8787
*
8888
* @param WP_REST_Request $request
8989
*

‎src/API/REST/V3/Routes/Campaigns/RegisterCampaignRoutes.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ public function __invoke()
4444
/**
4545
* Get Campaign route
4646
*
47-
* @unreleased Changed permission callback to use validationForGetItem method
47+
* @since 4.10.1 Changed permission callback to use validationForGetItem method
4848
* @since 4.9.0 Add missing schema key to the route level
4949
* @since 4.0.0
5050
*/
@@ -77,7 +77,7 @@ public function registerGetCampaign()
7777
/**
7878
* Get Campaigns route
7979
*
80-
* @unreleased Changed permission callback to use validationForGetItems method
80+
* @since 4.10.1 Changed permission callback to use validationForGetItems method
8181
* @since 4.0.0
8282
*/
8383
public function registerGetCampaigns()

‎src/Campaigns/Controllers/CampaignRequestController.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@
2828
class CampaignRequestController
2929
{
3030
/**
31-
* @unreleased Added status check to ensure non-authorized users can only access active campaigns
31+
* @since 4.10.1 Added status check to ensure non-authorized users can only access active campaigns
3232
* @since 4.0.0
3333
*
3434
* @return WP_Error | WP_REST_Response

‎src/DonationForms/Controllers/DonationFormsRequestController.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
class DonationFormsRequestController
2121
{
2222
/**
23-
* @unreleased Added status check to ensure non-authorized users can only access published forms
23+
* @since 4.10.1 Added status check to ensure non-authorized users can only access published forms
2424
* @since 4.2.0
2525
*/
2626
public function getForm(WP_REST_Request $request)

‎src/DonationForms/Routes/DonationFormsEntityRoute.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ public function __invoke()
3737
/**
3838
* Get Form route
3939
*
40-
* @unreleased Changed permission callback to use validationForGetItem method
40+
* @since 4.10.1 Changed permission callback to use validationForGetItem method
4141
* @since 4.2.0
4242
*/
4343
public function registerGetForm()
@@ -68,7 +68,7 @@ public function registerGetForm()
6868
/**
6969
* Get Forms route
7070
*
71-
* @unreleased Changed permission callback to use validationForGetItems method
71+
* @since 4.10.1 Changed permission callback to use validationForGetItems method
7272
* @since 4.2.0
7373
*/
7474
public function registerGetForms()
@@ -119,7 +119,7 @@ public function registerGetForms()
119119
/**
120120
* Associate donation forms with campaign
121121
*
122-
* @unreleased Changed permission callback to use validationForAssociateForms method
122+
* @since 4.10.1 Changed permission callback to use validationForAssociateForms method
123123
* @since 4.2.0
124124
*/
125125
public function registerAssociateFormsWithCampaign()

‎src/DonationForms/Routes/Permissions/DonationFormPermissions.php‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -7,34 +7,34 @@
77
use WP_REST_Request;
88

99
/**
10-
* @unreleased
10+
* @since 4.10.1
1111
*/
1212
class DonationFormPermissions
1313
{
1414
/**
1515
* Check if current user can edit donation forms.
1616
*
17-
* @unreleased
17+
* @since 4.10.1
1818
*/
1919
public static function canEdit(): bool
2020
{
21-
return current_user_can('manage_options') ||
21+
return current_user_can('manage_options') ||
2222
current_user_can('edit_give_forms');
2323
}
2424

2525
/**
2626
* Check if current user can view private/draft donation forms.
2727
*
28-
* @unreleased
28+
* @since 4.10.1
2929
*/
3030
public static function canViewPrivate(): bool
3131
{
32-
return current_user_can('manage_options') ||
32+
return current_user_can('manage_options') ||
3333
current_user_can('edit_give_forms');
3434
}
3535

3636
/**
37-
* @unreleased
37+
* @since 4.10.1
3838
*/
3939
public static function authorizationStatusCode(): int
4040
{
@@ -44,7 +44,7 @@ public static function authorizationStatusCode(): int
4444
/**
4545
* Validate donation form access permissions for GET items (collections).
4646
*
47-
* @unreleased
47+
* @since 4.10.1
4848
*
4949
* @param WP_REST_Request $request
5050
*
@@ -53,7 +53,7 @@ public static function authorizationStatusCode(): int
5353
public static function validationForGetItems(WP_REST_Request $request)
5454
{
5555
$status = $request->get_param('status');
56-
56+
5757
// If no status is specified, allow access (defaults to published forms)
5858
if (empty($status)) {
5959
return true;
@@ -83,7 +83,7 @@ public static function validationForGetItems(WP_REST_Request $request)
8383
/**
8484
* Validate donation form access permissions for individual form GET method.
8585
*
86-
* @unreleased
86+
* @since 4.10.1
8787
*
8888
* @param WP_REST_Request $request
8989
*
@@ -99,7 +99,7 @@ public static function validationForGetItem(WP_REST_Request $request)
9999
/**
100100
* Validate donation form access permissions for associate forms with campaign.
101101
*
102-
* @unreleased
102+
* @since 4.10.1
103103
*
104104
* @param WP_REST_Request $request
105105
*

‎tests/Unit/API/REST/V3/Routes/Campaigns/CampaignRouteGetItemTest.php‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
use WP_REST_Server;
1212

1313
/**
14-
* @unreleased
14+
* @since 4.10.1
1515
*/
1616
class CampaignRouteGetItemTest extends RestApiTestCase
1717
{
@@ -21,7 +21,7 @@ class CampaignRouteGetItemTest extends RestApiTestCase
2121
/**
2222
* Test that unauthenticated users cannot access individual non-active campaign via GET /campaigns/{id}.
2323
*
24-
* @unreleased
24+
* @since 4.10.1
2525
*/
2626
public function testUnauthenticatedUserCannotAccessNonActiveCampaign()
2727
{
@@ -38,7 +38,7 @@ public function testUnauthenticatedUserCannotAccessNonActiveCampaign()
3838
/**
3939
* Test that unauthenticated users can access individual active campaign via GET /campaigns/{id}.
4040
*
41-
* @unreleased
41+
* @since 4.10.1
4242
*/
4343
public function testUnauthenticatedUserCanAccessActiveCampaign()
4444
{
@@ -55,7 +55,7 @@ public function testUnauthenticatedUserCanAccessActiveCampaign()
5555
/**
5656
* Test that admin users can access individual non-active campaign via GET /campaigns/{id}.
5757
*
58-
* @unreleased
58+
* @since 4.10.1
5959
*/
6060
public function testAdminUserCanAccessNonActiveCampaign()
6161
{
@@ -72,7 +72,7 @@ public function testAdminUserCanAccessNonActiveCampaign()
7272
/**
7373
* Test that admin users can access individual archived campaign via GET /campaigns/{id}.
7474
*
75-
* @unreleased
75+
* @since 4.10.1
7676
*/
7777
public function testAdminUserCanAccessArchivedCampaign()
7878
{
@@ -89,7 +89,7 @@ public function testAdminUserCanAccessArchivedCampaign()
8989
/**
9090
* Test that unauthenticated users get 404 for non-existent campaign.
9191
*
92-
* @unreleased
92+
* @since 4.10.1
9393
*/
9494
public function testUnauthenticatedUserGets404ForNonExistentCampaign()
9595
{

‎tests/Unit/API/REST/V3/Routes/Campaigns/CampaignRouteGetItemsTest.php‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
use WP_REST_Server;
1212

1313
/**
14-
* @unreleased
14+
* @since 4.10.1
1515
*/
1616
class CampaignRouteGetItemsTest extends RestApiTestCase
1717
{
@@ -21,7 +21,7 @@ class CampaignRouteGetItemsTest extends RestApiTestCase
2121
/**
2222
* Test that unauthenticated users cannot access non-active campaigns via GET /campaigns.
2323
*
24-
* @unreleased
24+
* @since 4.10.1
2525
*/
2626
public function testUnauthenticatedUserCannotAccessNonActiveCampaigns()
2727
{
@@ -42,7 +42,7 @@ public function testUnauthenticatedUserCannotAccessNonActiveCampaigns()
4242
/**
4343
* Test that unauthenticated users can access active campaigns via GET /campaigns.
4444
*
45-
* @unreleased
45+
* @since 4.10.1
4646
*/
4747
public function testUnauthenticatedUserCanAccessActiveCampaigns()
4848
{
@@ -60,7 +60,7 @@ public function testUnauthenticatedUserCanAccessActiveCampaigns()
6060
/**
6161
* Test that unauthenticated users can access campaigns without status filter via GET /campaigns.
6262
*
63-
* @unreleased
63+
* @since 4.10.1
6464
*/
6565
public function testUnauthenticatedUserCanAccessCampaignsWithoutStatusFilter()
6666
{
@@ -77,7 +77,7 @@ public function testUnauthenticatedUserCanAccessCampaignsWithoutStatusFilter()
7777
/**
7878
* Test that admin users can access all campaign statuses via GET /campaigns.
7979
*
80-
* @unreleased
80+
* @since 4.10.1
8181
*/
8282
public function testAdminUserCanAccessAllCampaignStatuses()
8383
{
@@ -97,7 +97,7 @@ public function testAdminUserCanAccessAllCampaignStatuses()
9797
/**
9898
* Test that mixed status requests are blocked for unauthenticated users.
9999
*
100-
* @unreleased
100+
* @since 4.10.1
101101
*/
102102
public function testUnauthenticatedUserCannotAccessMixedStatusRequests()
103103
{

0 commit comments

Comments
 (0)