Older Changes

[4.51.2] [03.09.2019]

Core version: 4.51.3

• Update: Admin menu access add-on: Extra menu separators (if they follow one by one) are removed automatically.
• Fix: Edit restrictions add-on: Restricted categories was available for selection in Gutenberg.
• Core version was updated to 4.51.3:
• Fix: line #281 at /includes/classes/view.php called to the not existing class property.
• Fix: Dialog button labels inside User Role Editor (‘Cancel’ buttons especially) were shown with not correct translation or not translated at all.
• Fix: Roles have saved in alphabet order after any role update. Roles order in the database is not changed now. Sorting is made for a view purpose only.
• Update: Roles sorting inside WordPress roles dropdown lists is switched OFF by default. In order to switch WP roles dropdown lists sorting ON, return TRUE from ‘ure_sort_wp_roles_list’ filter.

[4.51.1] [15.06.2019]

Core version: 4.51.1

• Fix: Post/Pages/Custom post types (CPT) edit restrictions add-on:
  – When CPT excluded from restrictions via ‘ure_restrict_edit_post_type’ filter, its categories list is not restricted for selection too.
• Update: Meta boxes access add-on: It’s possible to automatically block Gutenberg components (right sidebar) – just block corresponding meta boxes: Categories, Tags, Featured Image, Excerpt, Discussion, Slug (Permalink).
• Core version was updated to 4.51.1:
• Fix: Superadmin could not revoke capabilities from ‘administrator’ role under WordPress multisite.

[4.51] [22.05.2019]

Core version: 4.51

• New: Posts edit access add-on:
  – Custom filter ‘ure_edit_posts_access_add_orders_by_customer’ was added. It returns FALSE by default. If switch it to TRUE and turn ON “Own data only” option for role or user, add-on will make available for current user WooCommerce orders for which he is a customer. It may be useful for scenario, when order customer is allowed to edit his own orders. It will prevent current user from seeing orders from other customers.
  – Custom filter ‘ure_edit_access_posts_list’ was added. It allows programmatically set/change the list of posts ID which will be used to allow/prohibit editing for current user.
• Fix: Content view restrictions add-on:
  – PHP notice was fixed: Undefined index: ure_prohibit_allow_flag in /wp-content/plugins/user-role-editor-pro/pro/includes/classes/content-view-restrictions-posts-list.php on lines 398, 406.
  – If restriction is not set for a post or page, use default values from URE settings or hard-coded value if other is not available.
• Core version was updated to 4.51:
• New: Bulk actions were added to the Users page: “Add Role”, “Revoke Role”. Select role from the related drop-down menu and add/revoke it to/from the list of pre-selected users.
• Update: Bulk grant roles feature (“Grant roles” button at the “Users” page) and Bulk grant role to users without role (“Without role” button at the “Users” page) are protected by ‘promote_users’ capability instead of ‘edit_users’, exactly the same way as WordPress itself does for its “Change role to”.
• Update: ‘load-users.php’ action is used instead of ‘admin_init’ to load support code for “Without role” and “Grant roles” button at the “Users” page.
• Update: URE ignores now a capability without ID in case it was added to the database somehow (other plugin bug, etc.). Such incorrect empty capability is removed from the capabilities list as a result after any role update.

[4.50.5] [01.04.2019]

Core version: 4.50.2

• Fix: Posts/pages edit restrictions add-on: PHP “Notice: Undefined index: HTTP_REFERER in /wp-content/plugins/user-role-editor-pro/pro/includes/classes/posts-edit-access.php on line 514” was fixed.

[4.50.4] [01.04.2019]

Core version: 4.50.2

• Fix: Content view restrictions add-on: Option “Redirection to URL” does not work correctly for page containing GravityView shortcode, like “[gravityview id=’43’]”. Redirection code is hooked to the ‘template_redirect’ action with priority 9 now in order to be executed earlier than related code from Gravity View.
• Fix: Admin menu access add-on: Endless redirection loop could took place in rare cases. If current URL is blocked URE selected automatically the 1st available admin menu item and redirects to it. Automatically selected menu item is checked against blocked URLs list to exclude such issue.
• Fix: WordPress multisite: add-ons data from the main site was not copied to a new subsite in case new subsite was created from front-end.
• Core version was updated to 4.50.2:
• Fix: WordPress multisite: PHP Notice “wpmu_new_blog is deprecated since version 5.1.0! Use wp_insert_site instead.” was removed. URE uses ‘wp_initialize_site’ action now instead of deprecated ‘wpmu_new_blog’. This fix provides correct roles replication from the main blog/site to a new created blog/site.

[4.50.3] [16.03.2019]

Core version: 4.50.1

• Fix: Admin menu access add-on:
  – “return=<...>” argument was not removed properly from “customize.php” URLs linked to “Appearance->Customize” and “Appearance->Header” submenu items.
  Attention! Reopen your “Admin menu” settings fro the restricted roles and check if these submenu items are still blocked after installing this update.
  – “Forms->System Status” menu item of “Gravity Forms” plugin was not supported properly. PHP Notice: “Undefined index: gf_system_status in wp-contentpluginsuser-role-editor-proproincludesclassesadmin-menu-view.php on line 108” was generated and broke the JSON response.
• Fix: Network Admin->Users->Capabilities->Network Update: Fatal error: Warning: call_user_func_array() expects parameter 1 to be a valid callback, class ‘URE_Editor_Pro’ not found
• Fix: Network Admin->Users->Capabilities->Network Update: Fatal error: Uncaught Error: Using $this when not in object context in /wp-content/plugins/user-role-editor-pro/pro/includes/classes/editor-ext.php on line 103
• Core version was updated to 4.50.1:
• Fix: WP Multisite: Users->Capabilities->Update: “Fatal error: Uncaught Error: Call to undefined method URE_Editor::check_blog_user() in /wp-content/plugins/user-role-editor-pro/includes/classes/editor.php on line 576” was fixed.
• Fix: WooCommerce group was not shown under Custom capabilities section.

[4.50.2] [05.03.2019]

Core version: 4.50

• Fix: Meta boxes access add-on: PHP fatal error was fixed: Uncaught Error: Call to undefined method URE_Lib_Pro::set_notification() in /wp-content/plugins/user-role-editor-pro/pro/includes/classes/meta-boxes-access.php:104
• Fix: Posts view access add-on: PHP fatal error was fixed: Uncaught Error: Call to undefined method URE_Lib_Pro::set_notification() in /wp-content/plugins/user-role-editor-pro/pro/includes/classes/posts-view-access.php:99

[4.50.1] [04.03.2019]

Core version: 4.50

• Fix: Role import: Input data control was added to exclude PHP warnings, like “PHP Warning: array_walk_recursive() expects parameter 1 to be array, null given”. Error message was replaced with “Role file is broken or has invalid format”.
• Fix: Front-end menu access add-on: Bug prevented this add-on normal loading.
• Fix: Other roles access add-on: PHP fatal error was fixed: Uncaught Error: Call to undefined method URE_Lib_Pro::set_notification() in /wp-content/plugins/user-role-editor-pro/pro/includes/classes/other-roles-access.php:109

[4.50] [04.03.2019]

Core version: 4.50

• New: It’s possible to export all user roles from current site to CSV file. Go to “Settings->User Role Editor->Tools” and click “Export” button at “Export user roles to CSV file” section.
• New: Multisite: Plugins list access for activation/deactivation restrictions is possible to replicate from the main site to the whole network.
• Fix: Content view restrictions add-on: There was a conflict with bbPress ‘posts_request’ filter ‘bbp_has_replies_where’, which returned wrong result in case content view restrictions add-on was active. Description was not shown for the not restricted topics.
• Core version was updated to 4.50
• Update: General code restructure and optimization.
• Update: URE_Base_Lib::get_blog_ids() returns null, if it’s called under WordPress single site (not multisite).
• Update: URE_Editor::prepare_capabilities_to_save() : “Invalid argument supplied for foreach()” warning was excluded in case there was no valid data structures initialization.
• Update: ‘administrator’ role protection was enhanced. URE always does not allow to revoke capability from ‘administrator’ role. That was possible earlier after the ‘administrator’ role update.
• Update: 2 new actions ‘ure_settings_tools_show’ and ‘ure_settings_tools_exec’ allows to extends the list of sections available at the Settings->User Role Editor->Tools tab.

[4.49.3] 15.01.2019

Core version: 4.49

• Fix: Multisite blogs ID list was built incorrectly due to bug in the code.Affected modules: add-ons network data replication, role data import./li>
• Core version was updated to 4.49:
• Update: Selected role ID was added to “Delete role” confirmation dialog.
• Update: Method URE_Base_Lib::get_short_list_str() was enhanced.
• Update: Method URE_Base_Lib::get_blog_ids() was made public.
• Update: Method URE_Lib::get_usermeta_table_name() was excluded.
• Fix: PHP warning “Undefined index:’unexisted role ID'” was fixed at URE_Lib::roles_text() (wp-content/plugins/user-role-editor/includes/classes/lib.php:360).
• Fix: Bug was fixed with incorrect usage of transient for option “Show deprecated capabilities”.

[4.49.2] 04.01.2019

Core version: 4.48

• Update: Content view restrictions add-on: redirection to URL: page path processing code was enhanced (URE_Content_View_Restrictions::get_page_path_from_url()).
• Update: Admin menu access add-on: internal support was added for ‘tab’ URL argument used by “WP Mail Smtp” plugin. It excludes automatic redirection when user with restricted admin menu access tries to switch between tabs at the “WP Mail Smtp” plugin setting page.
• Update: Posts/pages edit restrictions add-on: internal caching (based on WordPress transients) was rewritten in order to save/load data partially, for a single user only at the time, not for all at once.
• Fix: Admin menu access add-on: PHP Warning: A non-numeric value encountered in /wp-content/plugins/user-role-editor-pro/pro/includes/classes/admin-menu-view.php on line 299
• Fix: Posts/pages edit restrictions add-on: custom fields list selection drop-down list was empty at a new created post for a restricted user. Internal cache which did not include a new created post record as allowed one is cleared now on the ‘wp_post_insert’ action.
• Fix: Front-end menu access add-on: Compatibility was enhanced with other themes/plugins which use hook ‘wp_nav_menu_item_custom_fields’.
• Core version was updated to 4.48:
• Update: Multisite: Sites list is not requested from database on every page load in order to increase page load speed.
• Update: URE plugin version update routine is called now at the wp-admin backend only.
• Update: Direct access to URE_Lib::bbpress property was excluded as a preparation to future code enhancements.

[4.49.1] 12.11.2018

Core version: 4.47

• Fix: Content view restrictions add-on: Fatal error was fixed: Argument 1 passed to URE_Content_View_Restrictions_Posts_List:can_edit() must be an instance of WP_Post, instance of stdClass given.
• Update: Unused code was removed from user-role-editor-pro/pro/includes/classes/bbpress.php
• Core version was updated to 4.47:
• Fix: “Users->User Role Editor”: Capabilities view was not refreshed properly for new selected role in case “Granted Only” filter was turned ON before other role selection.
• Update: Unused code was removed from user-role-editor/includes/classes/bbpress.php
• Update: Prevent sudden revoke role ‘administrator’ from a user(s) during capability with the same ID (‘administrator’) deletion from roles.
• Update: Adding custom capability ‘administrator’ was prohibited.
• Update: Marked as compatible with WordPress version 5.0

[4.49] 21.10.2018

Core version: 4.46

• New: Content view restrictions add-on: It’s possible to set default URL for redirection in case of view access error. If redirection URL for post/page is not set, URE uses default value. If default value is not set URE redirects user the automatically built to the site login URL.
• Update: Content view restrictions add-on: Internal cache usage was optimized to increase performance for sites with large quantity of posts and users.
• Update: Other roles access add-on: ‘Blocking any role for “administrator” is not allowed.’ message is shown after click “Other Roles” button for “administrator” role.
• Update: Meta boxes access add-on: Dialog markup uses fixed columns width in order all columns will be visible without horizontal scrolling.
• Update: Admin menu access add-on: White listed arguments are supported now for the links from the “Tools” menu.
• Fix: Widgets admin access add-on: “Undefined index … in widgets-admin-access.php line #78” warning was fixed. Warning was shown in case if blocked widget does not exist (due to related plugin deactivation or deletion).

[4.48] 25.09.2018

Core version: 4.46

Update: Edit posts/pages restrictions add-on: non-public taxonomies are not included into restricted database queries. URE will build now much shorter database queries for the sites which have a lot of such taxonomies at the database. For example sites with WP SEO Premium plugin, where ‘yst_prominent_words’ taxonomy may count thousands records at wp_terms and wp_term_taxonomy db tables.

Update: Content view restrictions add-on: “Content View Restrictions” meta box markup was changed at post/page editor for better compatibility with Gutenberg. It will work as a usual meta box, located under main editor area.

Update: Widgets admin access add-on: ure_widgets_edit_access_user custom filter was added. It allows to set final list of widgets blocked for editing by current user.

Fix: Admin menu blocking add-on: URL processing were enhanced for the links with ‘customize.php’ inside, like “Appearance->Header” or “Appearance->Background”. Those links did not work (redirection to dashboard took place) in case of the restricted admin menu.

Fix: wp-admin pages permissions viewer add-on:
– typo at word ‘pemissions’ was corrected at the “Settings->User Role Editor->Additional modules” tab.
– source code .php file reading file(…) call was wrapped by ‘try …catch’ to exclude PHP warning generation in case of a problem with access to a source code file.

Core version was updated to 4.46:

Update: “Users” page, “Without role” button: underlying SQL queries were replaced with more robust versions (about 10 times faster).
It is critical for sites with large quant of users.New query does not take into account though some cases with incorrect users data (usually imported from the external sources). It’s possible to use older (comprehensive but slower) query version defining a PHP constant: “define(‘URE_COUNT_USERS_WITHOUT_ROLE_THOROUGHLY’, true);” or return false from a custom ‘ure_count_users_without_role_quick’ filter.

Update: Error checking was enhanced after default role change for the WordPress multisite subsite.

Update: URE settings page template: HTML helper checked() is used where applicable.

Fix: 2 spelling mistakes were fixed in the text labels.

[4.47.3] 18.08.2018

Core version: 4.45

• Update: Admin menu access add-on: admin menu copy creation priority was increased from 9999 to 9999999997 in order to execute code after that FooGallery plugin added all its menu items.
• Update: Content view restrictions add-on: meta box is added with ‘low’ priority now instead of ‘default’. It’s done for compatibility with custom post types (like “LearnPress->Courses”) for which this meta box was not shown.
• Fix: Content view restrictions add-on: try to access the restricted child page returned “page not found” error instead of redirect to URL. Redirection did not work in case global $post was not define to the moment. Find the page ID by its path from the URL for this case now.
• Fix: Syntax error was fixed which produced “PHP Warning: A non-numeric value encountered in …/wp-content/plugins/user-role-editor-pro/pro/includes/classes/meta-boxes.php on line 434”.
• Core version was updated to 4.45:
• Fix: Capability checkbox was shown as turned ON incorrectly for not granted capability included into a role, JSON: “caps”:{“sample_cap”:”false”}. Bug took place after the changing a currently selected role.
• Fix: Custom capabilities groups “User Role Editor” and “WooCommerce” were registered at the wrong 3rd tree level – changed to 2.

[4.47.2] 05.07.2018

Core version: 4.44

• Update: Widgets admin access add-on: It’s possible now to block the access to sidebars (widgets areas) created by a user with help of Divi theme.
• Fix: Content view restrictions add-on: ‘warning index not defined’ (content-view-restrictions-posts-list.php, line #395) was fixed.
• Core version was updated to 4.44:
• Update: URE had executed ‘profile_update’ action after update of user permissions from the user permissions editor page: Users->selected user->Capabilities. It was replaced with ‘ure_user_permissions_update’ action now. It will allow to exclude conflicts with other plugins – “WP Members” [lost checkbox fields values](https://wordpress.org/support/topic/conflict-with-wp-members-2/), for example.
• Update: Additional options for role (like “Hide admin bar” at the bottom of URE page) did not applied to the user with ‘ure_edit_roles’ capability. This condition was removed.
• Update: fix PHP notice ‘Undefined offset: 0 in …’ at includes/classes/protect-admin.php, not_edit_admin(), where the 1st element of $caps array not always has index 0.
• Update: PHP required version was increased up to 5.4.

[4.47.1] 05.06.2018

Core version: 4.43

• Core version was updated to 4.43:
• Update: references to non-existed roles are removed from the URE role additional options data storage after any role update.
• Fix: Additional options section view for the current role was not refreshed properly after other current role selection.

[4.47] 22.05.2018

Core version: 4.42

• New: Support for new user capabilities introduced by WordPress 4.9.6 was added: manage_privacy_options (Settings->Privacy), export_others_personal_data (Tools->Export Personal Data), erase_others_personal_data (Tools->Erase Personal Data).
• Fix: Divi theme et_pb_layout (Divi Library) custom post type (CPT) was unavailable even for admin when “Force custom post types to use their own capabilities” URE option was turned ON. et_pb_layout CPT is not available by default at User Role Editor pages (users.php), and we have to tell Divi to load et_pb_layout for URE pages via Divi’s custom filter ‘et_builder_should_load_framework’.

[4.46] 16.05.2018

Core version: 4.42

• Fix: Gravity Forms Access add-on:
  – “Fatal error: Maximum function nesting level of 256 reached, aborting!” raised in some cases was fixed.
  – Not allowed forms were excluded from top admin menu bar “Forms” recent forms list.
• Core version was updated to 4.42:
• Fix: Type checking was added (URE_Lib::restore_visual_composer_caps()) to fix “Warning: Invalid argument supplied for foreach() in …/user-role-editor-pro/includes/classes/ure-lib.php on line 315”.

[4.45] 07.05.2018

Core version: 4.41

• New: WordPress Multisite: it’s possbile to automatically copy selected add-ons data from the main site to the new created subsite.
  Use custom filter ure_addons_to_copy_for_new_blog to build list of add-on, which data URE should copy.
• Update: Admin menu access add-on:
  – menu item title was shown empty at “Admin menu” window, if it began from ‘<span’ HTML tag;
  – blocked menu item was not removed automatically if its submenu had the only item with the same link. It was possible in case menu item used another user capability then related submenu item.
• Update: Content view restrictions add-on:
  – when you leave ‘Redirect to:’ parameter empty user is redirected to the login page and back to the initial URL after the successful login.
• Update: Gravity Forms access add-on:
  – Function GFFormsModel::get_lead_table_name() call was replaced with GFFormsModel::get_entry_table_name() to provide compatibility with Gravity Forms v. 2.3+.
  – Gravity forms entry_detail page was added to the list of pages for which URE should control the list of available Gravity Forms.
• Fix: Posts/Pages edit restrictions add-on:
  – infinite recursion was possible in some cases for ‘pre_get_posts’ action in posts-edit-access.php.
  – “Fatal error: Call to undefined method URE_Content_View_Restrictions::is_page_template_resticted_for_role() in content-view-restrictions.php on line 581” was fixed.
• Core version was updated to 4.41:
• New: URE changes currently selected role via AJAX request, without full page refresh.
• Update: All WPBakery Visual Composer plugin custom user capabilities (started from ‘vc_access_rules_’) were excluded from processing by User Role Editor. Visual Composer loses settings made via its own “Role Manager” after the role update by User Role Editor in other case. The reason – Visual Composer stores not boolean values with user capabilities granted to the roles via own “Role Manager”. User Role Editor converted them to related boolean values during role(s) update.

[4.44] 06.04.2018

Core version: 4.40.3

• Update: Integration with bbPress was enhanced.
• Core version was updated to 4.40.3:
• Update: bbPress detection and code for integration with it was updated to support multisite installations when URE is network activated but bbPress is activated on some sites of the network only. (Free version does not support bbPress roles. It excludes them from processing as bbPress creates them dynamically.)

[4.43] 04.04.2018

Core version: 4.40.1

• Fix: Core version was reversed back to 4.40.1 due to fatal error cause by 4.40.2 update for some installations with active bbPress.

[4.42] 04.04.2018

Core version: 4.40.2

• New: Content View Restrictions add-on:
  – New criteria “Page Templates” were added to content view restrictions for roles.
  – It’s possible to extend ‘Any User Role (logged in only)’ condition using custom filter ‘ure_is_user_logged_in’, in order to check the additional conditions, for example: date, user name, subdomain, etc.
• Update: Admin menu access add-on: full admin menu copy creation code priority at ‘admin_menu’ hook was increased from 1000 to 9999. It should be executed after other plugins. MetaSlider plugin adds its admin menu with 9553 priority.
• Fix: Content View Restrictions add-on:
  – “Redirect to URL” option did not work for pages.
  – pages linked to BuddyPress components (activity, groups, members) ignored restrictions set by URE.
• Fix: Meta Boxes Access add-on: meta boxes blocking code hooked to the general ‘add_meta_boxes’ action fired too early and can not block meta boxes added via ‘add_meta_boxes_{post_type}’ hook executed later.
• Core version was updated to 4.40.2:
• Update: Load required .php files from the active bbPress plugin directly, as in some cases URE code may be executed earlier than they are loaded by bbPress.

[4.41] 06.02.2018

Core version: 4.40.1

• New: Export-import module was rewritten:
  – Attention: New exported data format is not compatible with data exported by older versions.
  – Users->User Role Editor: Export/Import buttons applied to the single currently selected role only.
  – It’s possible to export/import add-ons data, like ‘Admin Menu’, ‘Posts Edit’, ‘Post View’, ‘Meta Boxes’.
  – Settings->Tools-> Export/Import buttons will work for all roles of current site (main site from the network admin) in the next version.
• New: Content View Restrictions add-on: redirect to URL option was added for access error action.
• Update: URE_Admin_Menu::load_menu_access_data_for_role() method was renamed to URE_Admin_Menu::load_data_for_role().
• Update: URE_Admin_Menu::load_menu_access_data_for_user() method was renamed to URE_Admin_Menu::load_data_for_user().
• Update: Page permissions viewer add-on: source code tracing was returned back (if available).
• Update: Other roles access add-on: changes were applied for compatibility with PHP versions prior 5.5
• Fix: Content View Restrictions add-on:
  – HTML layout issue was fixed at the “Action” section of post editor meta box.
  – Restrictions were not applied properly for WooCommerce products list via [products] shortcode as WooCommerce may cache query result of unrestricted user for 30 days and show that cached data to users with restricted view access.
• Fix: Admin menu access add-on (URE_Admin_Menu_Access::update_menu()): bug in menu update may lead to the indefinite redirection loop as a blocked URL was selected as the 1st available menu item link.
• Core version was updated to 4.40.1:
• Update: use wp_roles() function from WordPress API instead of initializing $wp_roles global directly. wp_roles() function (introduced with WP 4.3) was included conditionally to URE code for backward compatibility with WordPress 4.0+
• Fix: Bug was introduced by version 4.37 with users recalculation for “All” tab after excluding users with “administrator” role. Code worked incorrectly for Japanese locale.
• Fix: WordPress multisite: bbPress plugin detection code was changed from checking bbPress API function existence to checking WordPress active plugins list. bbPress plugin activated for the site was not available yet for the network activated User Role Editor at the point of URE instance creation. URE did not work with bbPress roles as it should by design.

[4.40.1] 22.12.2017

Core version: 4.39

• Fix: Content View Restrictions add-on: change of “For Users” field in post/page editor “Content View Restrictions” meta box was not saved properly after the 4.40 update.

[4.40] 20.12.2017

Core version: 4.39

• New: Support was added for additional user capabilities introduced by WordPress versin 4.9: deactivate_plugins, install_languages, update_languages. There is a new section “Use additional capabilities” at Settings->User Role Editor->Additional Modules tab. Minimal required WordPress version: 4.9. ‘deactivate_plugin’ capability is mapped to ‘deactivate_plugins’, ‘activate_plugin’ – to ‘activate_plugins’.
• Update: Admin menu access add-on: ‘paged’ argument was added as allowed by default for upload.php URL.
• Fix: Admin menu access add-on: White-listed URL arguments were not taken into account in case URL started not with ‘admin.php’ and contained a ‘page’ argument.
• Fix: Other roles access add-on: edit/delete user with blocked role via direct link (user-edit.php?user_id=ID or users.php?action=delete&user=ID) was not prohibited as expected.
• Fix: Page permissions viewer add-on does not produce PHP notices and warnings in case ‘file’ index does not exist in a data return by debug_backtrace() function.
• Update: Type checking enhanced for values received from a user input and for variable arguments inside database queries.
• Update: Plugin settings management code moved to the separate URE_Settings_Pro class.
• Update: “Settings->User Role Editor->Additional Modules” tab: if “Defaults for content view restrictions” section is visible when you click “Save”, it’s not hidden after the page refresh.
• Core version was updated to 4.39:
• Update: Plugin settings management code moved to the separate URE_Settings class.
• Update: Own code to build usermeta db table name was excluded. A value from $wpdb->usermeta is used instead.
• Update: Type checking enhanced for values received from a user input and for variable arguments inside database queries.

[4.39.1] 28.11.2017

Core version: 4.38

• Fix: Posts/pages edit restrictions add-on: Posts/Pages view links ‘All/Mine/Published’ disappeared for user with administrator role. Some filter functions did not return values if edit restrictions are not applicable to a current user, administrator for example.

[4.39] 27.11.2017

Core version: 4.38

• New: Admin menu access add-on: It’s possible to manage the allowed URL parameters list via “White list of URLs parameters’ link. This link is located at “Settings->User Role Editor->Additional Module” tab, just under “Activate Administrator Menu Access module” checkbox.
• New: Posts/pages edit restrictions add-on: ‘ure_post_edit_access_terms_list’ custom filter allows to set a categories (terms) list (CSV) programmatically.
• Update: Meta boxes access add-on supports WPML meta boxes now.
• Update: Settings->User Role Editor->Additional Modules: section with defaults for Content View Restrictions add-on is shown/hidden by click on “Show Defaults…/Hide Defaults…” link.
• Update: “Force custom post types use its own capabilities” option: custom post types are selected by enhanced criteria. Permissions was not changed earlier for CPT with a ‘page’ capability type.
• Fix: Posts/pages edit restrictions add-on: excluded the cases, when edit restrictions would be applied to a user with superadmin priveleges.
• Core version was updated to 4.38
• Security: XSS vulnerability was fixed at URE’s options page. Bug was discovered and fixed at tab index value numeric type checking. Tab index value is additionally escaped before output also.
• Security: Deprecated code for debug output to the .log file in case of database query error was removed.
• Security: Multiple select jQuery plugin (https://github.com/wenzhixin/multiple-select/) was updated to the latest available version 1.2.1, which fixed XSS vulnerability, existed in earlier versions.

[4.38] 04.11.2017

Core version: 4.37

• New: User permissions viewer add-on was added. It shows at the bottom of every admin backend (wp-admin) page the user capabilities list checked by this page and plugins hooked to it.
• New: bbPress user capabilities are shown at User Role Editor under the separate group “Custom capabilities->bbPress” if bbPress plugin is active.
• Update: Content edit restrictions add-on: removed unneeded current user admin permissions checking, which executed for any WordPress page.
• Update: Admin menu access add-on: redirection code for blocked URL was enhanced.
• Update: Content view restrictions add-on: hooks to WordPress with 999 priority instead of former 100 for better compatibility with other plugins.
• Fix: Content view restrictions add-on: WP_Query query variable ‘post__not_in’ is set in case when ‘post__in’ is not set. Otherwise prohibited posts are excluded from existing ‘post__in’ array.
• Fix: Other roles access add-on: Users with roles blocked for current user are excluded from the users list. Quantity of users of ‘All’ view (tab) at ‘Users’ page is decreased now for the quantity of hidden users.
• Core version was updated to 4.37
• New: New option was added. It’s possible to select permanent quant of capabilities columns at the “Settings->User Role Editor->General” tab.
• Update: User capabilities are shown for custom post types which use the WordPress built-in ‘post’ or ‘page’ capability type. (0/0) was shown earlier instead of the quantity of user capabilities really used.
• Update: Restriction was added for ‘do_not_allow’ user capability (used internally by WordPress). You can not add it manually.
• Fix: URE hides users with ‘administrator’ role by default from any other user. Quantity of users of ‘All’ view (tab) at ‘Users’ page is decreased now for the quantity of hidden admins.

[4.37] 27.09.2017

• Core version: 4.36.1
• New: Required WordPress version was raised up to 4.4. Front-end menu access add-on does not support earlier WordPress versions.
• New: Posts/pages edit restrictions add-on: User with restrictions by categories can use ‘Clone’ link from ‘Duplicate Post’ plugin. The 1st category available to a current user will be assigned automatically to a new created post copy in order to make this post editable to this user.
• Fix: Posts/pages edit restrictions add-on: URE will extend automatically the list of allowed/restricted attachments for media library items, attached to allowed/restricted posts/pages/CPT.
• Update: Content View Restrictions shortcode add-on: Shortcode [user_role_editor] was not processed/rendered by default for a user with ‘administrator’ role,
  following a logic “there are not restrictions for administrators”. It’s changed according to multiple user requests. Users with ‘administrator’ role will not see not rendered [user_role_editor]…[/user_role_editor] shortcode text at front-end starting with this update. It does not depend from a ‘ure_render_content_view_shortcode_for_admin’ filter value. All [user_role_editor] shortcodes are rendered for all users, including superadmin.
  It’s possible to change this default behavior via custom filter ‘ure_render_content_view_shortcode_for_admin’. It takes a single boolean parameter. Change it to FALSE in order a user with ‘administrator’ role can see a raw content instead of a rendered/restricted one.
• Fix: Front end menu access add-on:
  – Access filter is applied for front-end only to get rid off accidental deletion of restricted menu items.
  – ‘wp_get_nav_menu_items’ filter is used now instead of ‘wp_nav_menu_objects’ one, which fires too late for case when some plugin uses own code to show WordPress navigation menu and do not uses wp_nav_menu() function from WordPress core.
  – URE does not override WordPress front-end menu output method as earlier, it uses reqexp to insert custom action to the right place of WordPress front-end menu output.
• Fix: Admin menu access add-on:
  – User with ‘manage_categories’ capability, but without ‘edit_posts’ one, did not have access to the Posts->Categories, Posts->Tags menu items with active “Admin menu access” add-on.
  – ‘Block not selected’ model did not allow search and sort operations with categories and tags. User was redirected to the dashboard automatically.
• Fix: Incompatibility issue with Advanced Custom Fields (ACF) plugin was fixed – meta boxes added by ACF were not recognized by “Widgets access” add-on.
• Update: Direct access to the global $current_user variable is excluded from the code. Current user data is initialized via WordPress core functions wp_get_current_user() or get_current_user_id().
• Update: Various unused pieces of code were removed.
• Core version was updated to 4.36.1
• Update: Direct access to the global $current_user variable is excluded from the code. Current user data is initialized via WordPress core functions wp_get_current_user() or get_current_user_id().
• New: It’s possible to set any URE’s option value programmatically: use custom filter ‘ure_get_option_‘. It takes a single parameter with current/default value for required options. Full list of User Role Editor options is available here: https://www.role-editor.com/documentation/options-list
• Update: Users page – Grant Roles. It’s possible to change just “Other roles” for multiple users and leave their primary roles untouched. Just leave a “Primary role” field empty. If you select the “- No role for this site -” option from a “Primary role” drop-down list, plugin will revoke all roles from the selected users.
• Update: Options page screen help text was updated.
• Fix: Additional (other) default roles set at URE’s settings page are not granted to a new user now, if they were deselected at a ‘Add New User’ page.

[4.36.1] 20.07.2017

Core version: 4.35.3

• Core was updated to version 4.35.3:
• Fix: Multiple roles assignment (including default roles) did not work at “Users->Add New” new-user.php (contexts: add-existing-user, add-new-user) page for WordPress multisite.

[4.36] 18.07.2017

Core version: 4.35.2

• New: Content view restrictions shortcode: ‘users’, ‘except_users’ attributes were added to the existing ‘user_role_editor’ shortcode. It’s possible to use digital user IDs or symbolic user logins, e.g. users=”11, 25, billy” or except_users=”18, peggy”.
• Fix: Admin menu access add-on: submenu which is not linked to the main menu are removed now from internal URE Pro data structures to exclude PHP notices, like Undefined offset: 3 in wp-content/plugins/user-role-editor-pro/pro/includes/classes/admin-menu-access.php on line 214
• Update: JavaScript code enhancements.
• Core was updated to version 4.35.2:
• Fix: Multiple default roles (if defined at URE’s settings) are selected automatically at ‘add-new-user’ page.
• Update: Code enhancement for protection of users with ‘administrator’ role from each other. Current user can see his own record and edit own profile.