Older Changes

[4.35.2] 10.07.2017

Core version: 4.35.1

• Fix: Gravity Forms access add-on: view of entries from prohibited forms via direct URL was not blocked.
• Fix: Admin menu access add-on: It was not possible to block menu items when user had access to some submenu item, like “Categories”, but did not have access to a top level menu, like ‘Posts’. ‘Categories’ was shown in spite of it was configured as blocked.
• Core was updated to version 4.35.1:
• Fix: “Grant Roles” button at the bottom of “Users” page did not work as had the same ID as a similar button at the top of this page.
• Update: when bbPress plugin is active, “Grant Roles” does not revoke bbPress role granted to user anymore.
• Fix: The same ID “move_from_no_role” and “move_from_no_role_dialog” were output twice at “Users” page.

[4.35.1] 11.06.2017

Core version: 4.35

• Fix: Posts/pages edit access add-on:
  – Child pages ID list selection algorithm was fixed and optimized.
  – ‘Mine’ view posts count shows valid quantity of current user posts.
• Fix: All add-ons: class ‘ui-button-text’ was added to all ui-dialog (update, cancel) buttons.
• Update:Core was updated to version 4.35:
• Update: Bulk capabilities selection checkbox is not shown for ‘administrator’ role for single site WP, and is shown if current user is superadmin for multisite WP. It was done to exclude sudden revoke of all capabilities from the ‘administrator’ role.
• Update: Full copy of JQuery UI 1.11.4 custom theme CSS file (jquery-ui.css) was included.
• Fix: User->User Role Editor page apparently loads own jQuery UI CSS (instead of use of WordPress default one) in order to exclude the conflicts with themes and plugins which can load own jQuery UI CSS globally not for own pages only.
• Fix: “Change Log” link was replaced with secure https://www.role-editor.com/changelog

[4.35] 04.06.2017

Core version: 4.34

• New: Widgets admin access add-on: It’s possible to block access to sidebars.
• Fix: Admin menu access add-on: “block not selected” model redirected user to the 1st available URL from allowed URLs with different letter case parameters, like admin.php?page=PopupBuilder
• Update: Core version was updated to 4.34:
• New: Multisite ‘upgrade_network’ capability support was added for compatibility with WordPress 4.8.
• New: Multisite ‘delete_sites’ capability support was added.
• Fix: jQuery UI CSS was updated to fix minor view inconsistency at the URE’s Settings page.
• Fix: “Reset” presentation code remainders were removed from the main User Role Editor page.
• Fix: ‘manage_links’ capability was included into a wrong subgroup instead of “Core->General”. It was a mistake in the capabilities group counters for that reason.

[4.34.3] 23.05.2017

Core version: 4.33.1

• Fix: Content view restrictions add-on: PHP notice was removed: Undefined variable: self in /wp-content/plugins/user-role-editor-pro/pro/includes/classes/content-view-restrictions.php on line 795

[4.34.2] 22.05.2017

Core version: 4.33.1

• New: Posts/pages edit restrictions add-on: custom filter ‘ure_edit_posts_access_restriction_type’ was added. It allows to modify on a fly the restriction type for current user: 1 – prohibit, 2 – allow.
• Update: “Use jQuery UI CSS from jQuery CDN” option was removed from the “General” tab of User Role Editor Pro Settings page.
• Fix: Content view restrictions add-on:
  – URE_Content_View_Restrictions::current_user_can_view() returned incorrect result for some restrictions settings.;
  – URE_Content_View_Restrictions_Posts_List::do_not_restrict_editors() could intercept with Posts/pages edit restrictions add-on by recursive call of view filter when WP_Query selects posts available for editing.
  – ure_restrict_content_view_for_authors_and_editors filter was ignored for single page content.
• Update: Core version was updated to 4.33.1
• Update: Core version: “Reset” button moved from the “Users->User Role Editor” main page to the “Settings->User Role Editor->Tools” tab.
• Update: Core version: “Users->Grant Roles” button worked only for superadmin or user with ‘ure_manage_options’ capability. User with ‘edit_users’ can use this feature now.
• Update: Core version: Settings tabs and dialog windows style sheets was updated to jQuery UI 1.11.4 default theme.
• New: Core version: Boolean filter ‘ure_bulk_grant_roles’ allows to not show “Users->Grant Roles” button if you don’t need it.
• New: Core version: Boolean filter ‘ure_users_select_primary_role’ can hide ‘Primary role’ selection controls from the user profile edit page.
• New: Core version: Boolean filter ‘ure_users_show_wp_change_role’ can hide “Change Role” bulk action selection control from the Users page. So it’s possible to configure permissions for user who can change just other roles of a user without changing his primary role.
• Fix: Buttons “Users->Without Roles”, “Users->Grant Roles” are shown only to the users with ‘edit_users’ capability.
• Fix: Transients caching was removed from URE_Lib::_get_post_types() function. It cached post types list too early in some cases.

[4.34.1] 24.04.2017

Core version: 4.32.3

• Fix: Front end menu access add-on: a lot of pages became restricted for front-end menu due to logic mistake in an access checking code. As a result related menu items were hidden from menu without a visible reason.

[4.34] 21.04.2017

Core version: 4.32.3

• New: Front end menu access add-on:
  – “Not logged-in and logged-in users with selected roles” option was added.
  – menu items with links to the posts/pages prohibited for view for current user by “Content view restrictions” add-on with 404 HTTP error action are excluded from menu automatically.
• New: Content view restrictions add-on:
  – Shortcode [user_role_editor] roles / except_roles attributes support ‘&&’ role ID separator. For example roles=”subscriber && customer” means that user should have both roles simultaneously, comparing to the roles=”subscriber, customer” which works for subscribers or customers or (subscribers and customers).
  – public static method URE_Content_View_Restrictions::current_user_can_view($post_id) was added. It returns boolean value.
• Update: Content view restrictions add-on:
  – roles list opened at the post level is sorted by alphabet.
  – Singleton pattern was applied to the URE_Content_View_Restrictions_Posts_List class.
• Update: Admin menu access add-on: “block not selected model”: support was added for URL parameters added to users.php by “Ultimate Member” plugin.
• Fix: Content view restrictions add-on:
  – default setting for access error action “return HTTP 404 error” was not always applied to the new added post.
  – categories/tags/terms group selection checkboxes work separately now for every term group – categories, tags, etc.
• Fix: bbPress role support was broken, even administrator did not see bbPress menu and user roles in some cases while User Role Editor Pro was active.
• Fix: Admin menu access add-on: “block not selected model” did not allow to delete users and use other core WordPress functionality at “users.php’ page redirecting user to the 1st available admin menu item.

[4.33] 03.04.2017

Core version: 4.32.3

• New: Content view restrictions add-on: authors list and own data only options were added for roles.
• Fix: Content view restrictions add-on:
  – filter by categories may work incorrectly due to mistake in the SQL query;
  – content-view-restrictions-controller.php used not existed function URE_Lib_Pro::filter_int_array().
• Update: Admin menu access add-on: parameters added by ‘Enable media replace’ plugin were registered as allowed for upload.php link. Earlier ‘Replace’ link was blocked with a redirection to the 1st available menu item.
• Fix: Admin menu access add-on: “Block not selected” model:
  – search a user at “Users” page was finished by the automatic redirection to the 1st available menu item (Dashboard, etc.). The list of allowed parameters for ‘Users’ page was extended for the search and sort parameters used at this page by WordPress core.
  – selection of ‘Media Library->Add new’ menu item was resulted by removing of ‘Upload Files’ tab at a dialog opened by “Add Media” button from the post/page editor screen.
• Fix: Bulk grant to users multiple roles JavaScript code is loaded now for users.php page only, not globally.
• Fix: nonexistent html_esc__() function was called instead of valid esc_html__() one at pro/includes/classes/posts-edit-access-bulk-action.php file.
• Fix: “Users->Grant Roles” button did not work with switched off option “Count Users without role” at “Settings->User Role Editor->Additional Modules” tab. “JQuery UI” library was not loaded.
• Fix: Boolean false was sent to WordPress core wp_enqueue_script() function as the 2nd parameter instead of an empty string. We should respect the type of parameter which code author supposed to use initially.
• Update: minimal PHP version was raised to 5.3.

[4.32.3] 10.03.2017

Core version: 4.32.1

• New: Button “Grant Roles” allows to “Assign multiple roles to the selected users” directly from the “Users” page.
• Update: Singleton template was applied to the main class User Role Editor Pro. While GLOBALS[‘user-role-editor’] reference to the instance of User_Role_Editor_Pro class is still available for the compatibility reasons, call to User_Role_Editor_Pro::get_instance() is the best way now to get a reference to the instance of User_Role_Editor_Pro class.
• Fix: Content view restrictions add-on: PHP notice “Undefined index: ure_post_access_error_action in content-view-restrictions-controller.php” was removed.
• Fix: ‘unfiltered_html’ capability was added to the ‘General’ capabilities group.

[4.32.2] 10.02.2017

Core version: 4.31.1

• Fix: Content view restrictions add-on: restrictions were applied too early, some theme or plugin could replace ‘access error’ message from URE with original protected content.
• Fix: Posts edit restrictions add-on: User with restrictions saws a full list of Media Library items in case he did not have own attachments in the list of allowed posts, minor code enhancements.
• Fix: Fix: Admin menu access add-on: Code responsible for a legacy data format conversion was excluded.
• Fix: It’s possible to translate license key states: “Active, Expired, Invalid”.

[4.32.1] 07.01.2017

Core version: 4.31.1

• Fix: Plugins access add-on: User with ‘activate_plugins’ capability but empty allowed plugins list did not see any plugins. When a restriction is not set, user should see a full plugins list.
• Update: Front-end menu access add-on: It works now according to the given permissions, if current user is a site admin too.
• Update: Posts edit access add-on: It’s possible to modify posts/pages, custom post type ID list via filter ‘ure_edit_posts_access_id_list‘. ID list is a comma separated list of integers.

[4.32] 06.01.2017

Core version: 4.31.1

• New: Plugins access add-on:
  – It’s possible to restrict access to the list of plugins available for activation/deactivation for the role.
  – It’s possible to change selection model: allow access to the selected or not selected plugins.
• Fix: bbPress roles changes were not saved.
• Fix: Admin menu access add-on: List of allowed URL parameters checked under “blocked not selected” model was extended for parameters used by Gravity Forms plugin.
• Fix: WP transients get/set were removed from URE_Own_Capabilities class. It leaded to the MySQL deadlock in some cases.
• Update: Base_Lib::get_request_var() sanitizes user input by PHP’s filter_var() in addition to WordPress core’s esc_attr().

[4.31.1] 17.12.2016

Core version: 4.31

• Fix: Admin menu access add-on: Blocked menu without submenu was not hidden.
• Fix: Gravity form access add-on: invalid redirection took place for many ‘admin.php?page=some-page’ URLs.
• New: Admin menu access add-on: ‘ure_admin_menu_access_admin_bar’ filter allows to extend the list of top admin menu bar items which could be hidden if their main admin menu was blocked.

[4.31] 15.12.2016

Core version: 4.31

• New: It’s possible to remove unused user capabilities by list.
• Fix: There was no support for installations with a hidden/changed URL to wp-admin. URE uses ‘admin_url()’ now to get and check admin URL, instead of direct comparing URL with ‘wp-admin’ string.
• Fix: Admin menu access add-on: custom links under Settings menu were converted from /wp-admin/options-general.php?page=some-key to /wp-admin/some-key incorrectly in some cases.
• Fix: Front-end menu access add-on: access controls were shown at menu editing form for user without ‘ure_front_end_menu_access’ capability.
• Update: Admin menu access add-on: Contact Form 7 plugin URL parameters are supported to exclude redirection to dasboard.
• Update: Capability groups CSS classes are prefixed with ‘ure-‘ in order to minimize possible CSS conflicts with other plugins/themes which may load styles with the same classes.

[4.30] 01.12.2016

Core version: 4.30

• New: “Granted Only” checkbox to the right from “Quick Filter” input control allows to show only granted capabilities for the selected role.
• New: Front-end menu access add-on is available. It’s possible to show menu items for everyone, logged-in users, logged-in users with selected role(s), not-logged-in visitors (more info…).
• Update: Admin menu access add-on: Top level menu items list is ordered similar way as WordPress itself use.
• Fix: Content view restrictions add-on: Content of a post prohibited for logged-in user with the selected role only was not shown for the not logged-in users. But it should be shown until this post is not prohibited apparently for the ‘no_role’ (No role for this site) virtual role too.
• Fix: Admin menu access add-on: There was automatic redirect to admin dashboard after
  WooCommerce->Coupons->Add New (or similar) button click under “Block menu items: Not Selected” model, in case “Posts->Add New” was not allowed.

[4.29.1] 11.11.2016

Core version: 4.29

• New: User Role Editor own user capabilities are grouped separately under Custom capabilities.
• Fix: Content View Restrictions add-on: Custom error message from the post editor was not shown in some cases, system global default message was shown instead.
• Fix: Content Edit Restrictions add-on: restricted user saw at post Visual editor a gallery with full list of available images instead of the allowed images included into this gallery only.
• Update: Content Edit Restrictions add-on: user with ‘create_%’ capability (like ‘create_posts’) can add new items (posts) inspite of editing restrictions applied to him. One of the purposes of this update was to allow to a user create the child pages under the allowed parent page.
• Update: Automatic updates server URL was changed to https://update.role-editor.com
• Update: URE_Lib::is_super_admin() uses WordPress core is_super_admin() for multisite setup only. Superadmin is a user with ‘administrator’ role in the case of single site WordPress installation.
  This is the difference with the WordPress core which counts as a superadmin (for single site WP installation) any user with a ‘delete_users’ capability.
  So it’s possible to apply add-on restrictions (e.g. admin menu access) to the users without administrator role, but with ‘delete_users’ capability.
• Update: BaseLib::option_selected() calls were replaced with the calls of a similar selected() function from WordPress core.

[4.29] 25.10.2016

Core version: 4.28

• New: Meta Boxes access add-on: ‘Remove’ icon at admin page of this add-on allows to exclude from the list meta boxes which belong to the deleted plugins.
• Fix: Posts edit access restrictions add-on:
  – sometimes restrictions were applied before a restricted custom post type was defined.
  – post quant by the post status were calculated incorrectly for the “Prohibit” option.
• Fix: Admin menu access add-on:
  – The endless redirection loop could took place if the “Dashboard” menu was blocked ( URE_Admin_Menu_Access::update_menu_selected() ).
  – URL for redirection to one of Jetpack submenu items was built incorrectly.
• Update: Admin menu access add-on:
  – URL parameters ‘action’, ‘menu’ were registered as allowed for the ‘nav-menus.php’ (‘Appearance->Menus’) command to exclude unexpected redirections.
  – WooCommerce products, orders, coupons filtering arguments in URLs are supported now.
  If you prohibited for the role ‘Posts’ menu, but allow WooCommerce ‘Products’, ‘Orders’ or ‘Coupons’ (use the same edit.php in URL),
  you could meet a problem with filtering WooCommerce product by category or product type, etc. User would be redirected to the dashboard –
  This means that URLs with filtering parameters in it (like product_cat, product_type) was blocked by URE.
  – Block not selected model: URE does not block by default these admin menu bar items: Profile, Log Out. Menu items was checked by URL.
  Menu item ID is checked now instead, as URL may be changed by plugins, like one which changes ‘wp-admin’ to the custom string.
  It’s possible to modify the list of not blocked menu bar items ID using custom filter ‘ure_do_not_remove_from_admin_bar’.
• Update: Posts view restrictions add-on: input form and list of default values were enhanced/extended.
• Update: Meta boxes access add-on takes into account the meta boxes placed by BuddyPress plugin to the user profile “Extended Profile” tab.
• New: WooCommerce plugin user capabilities (if exist) are grouped separately.
• Update: Temporally raised permissions flag is taken into account when checking, if user has a superadmin privileges. WordPress is_super_admin() function was replaced with custom wrapper to define if current user is a real superadmin or just a local admin with the temporally raised (add/edit users pages) permissions.
• Update: various code optimization.

[4.28.2] 16.09.2016

Core version: 4.27.2

• Fix: PHP notices was removed: Undefined index: “some-index” in …/pro/includes/classes/admin-menu-access.php on line 204
• Fix: PHP notice was removed: Undefined property: URE_Role_View::$multisite in wp-content/plugins/user-role-editor/includes/classes/view.php on line 143
• Fix: WordPress multisite:
  – Settings link under the URE plugin at the plugins list leads to the network admin now, not to the the single site settings page, which does not exist.
  – Conflict with “Visual Composer” plugin was resolved: single site administrators could now use Visual Composer editor.
  – Changed role name was not replicated to other sites when user clicked “Update” with “Apply to All Sites” option turned ON.
• Fix: Admin menu access add-on: allowed command arguments array was returned by reference incorrectly – URE_Admin_Menu_URL_Allowed_Args::get_for_supported_plugins() line 30.
• Update: There was a conflict with plugins which use a ‘|’ character at the custom user capabilities: e.g. ‘Nginx Helper | Config’ from “Nginx Helper’ plugin.
• Update: Admin menu access add-on:
  – available submenu item is shown for role now even if top level menu is not available for that role. For example Settings menu item protected by ‘edit_posts’ capability will be shown as available for blocking for ‘author’ role in spite of this role does not have ‘manage_options’ capability;
  – URE takes into account that “WCMp Commissions” menu from “WC Marketplace” plugin may be added as to “WooCommerce” menu, as a top level menu item;
  – menu separators checking was moved to the separate static method;
  – support was added for additional URL parameters which WordPress uses with ‘edit.php’, e.g.: trashed, untrashed, deleted, ids.
  – support was added for additional URL parameters from plugins: Ninja Forms, EventON.
• Update: Posts edit restrictions add-on: URE does no replace posts statuses views (All, Mine, Published etc.) for the restricted user. It just refreshes the quant of posts for every existed status view.
• Update: Information about compatibility with WordPress version is shown correctly at “Dashboard->Updates” page.

[4.28.1] 22.08.2016

Core version: 4.27.1

• Update: There was a conflict with plugins which use a ‘/’ character at the custom user capabilities: e.g. vc_access_rules_backend_editor/disabled_ce_editor from Visual Composer.
• Update: add/delete, escape, validate user capability code extracted from URE_Lib to the separate URE_Capability class

[4.28] 19.08.2016

Core version: 4.27

• New: Total/Granted counters were added to the capabilities groups titles.
• New: “Columns” drop-down menu allows to change capabilities section layout to 1, 2 or 3 columns.
• New: Capabilities section is limited in height and has independent scrollbar.
• Update: User Role Editor form uses more available space on page.
• Update: URE_Ajax_Processor class allows to differentiate required user permissions according to action submitted by user.
• Update: Custom post type ID is converted to lower case when build post capability ID
• Fix: CSS updated to exclude text overlapping at capabilities groups section when custom post type name is not fitted into 1 line.
• Fix: required JavaScript files were not loaded at “Network Admin->Settings->User Role Editor” page.
• Fix: “Notice: Undefined index … in wp-content/plugins/user-role-editor-pro/pro/includes/classes/meta-boxes.php on line 86” was produced when URE tried to block not active meta box.
• Fix: class URE_Admin_Menu_URL_Allowed_Args produced PHP fatal error: “Parse error: syntax error, unexpected T_PAAMAYIM_NEKUDOTAYIM” at line 29 for PHP versions older 5.3. Compatible version of a code is used instead now.

[4.27.1] 26.07.2016

Core version: 4.26.4

• Fix: PHP versions prior to 5.5. produces fatal error: Can’t use function return value in write context in …/content-view-restrictions-posts-list.php on line 488

[4.27] 26.07.2016

Core version: 4.26.4

• New: User capabilities are grouped by purpose/functionality for more convenience.
• New: Content view restrictions shortcode allows to use ‘except_role’ attribute – to show content inside shortcode to all users except users with roles included into ‘except_role’ attribute.
• Update: URE_Ajax_Processor class allows to diffirentiate required user permissions according to action submitted by user.
• Update: Admin menu access module:
  – Filter ‘ure_admin_menu_access_allowed_args’ was added. Use it to register URL parameters in order URE does not block the links inside allowed pages.It happens generally when you use ‘block not selected’ model.
  – Admin menu copy creation was optimized. It’s executed now just after any plugin activation and when URE’s page is opened.
• Update: Widgets Show Access add-on: It’s enough to have ‘ure_widgets_show_access’ capability now to get access to this add-on functionality.
• Fix: Admin menu access module:
  – Menu links were calculated incorrectly for some plugins (generally with page=admin.php inside). It’s recommended to re-check your admin menu restrictions settings after this update.
  – Sorting (by category, etc.) inside allowed posts/pages list page may lead to the redirection to the admin dashboard.
  – Added support for “Download Monitor”, “Unite Gallery”, “WPML” plugins additional URL parameters.
• Fix: Content View Restrictions module:
  – Conflict was resolved with WPML plugin. It adds ‘p’ parameter to the queries for a single post.Titles of restricted posts were viewable for that reason.
• Fix: Edit posts/pages restrictions add-on: It did not allowed to edit the attachments for ‘Own data only’ option or authors ID list.
• Fix: required JavaScript files were not loaded at “Network Admin->Settings->User Role Editor” page.

[4.26.1] 06.07.2016

Core version: 4.25.4

• Fix: Admin menu access module: Posts sorting was not allowed for “block not selected” model. User was redirected to the dashboard when try to sort posts by title or date.
• Fix: bbPress roles were missed from the list of roles available at User Role Editor.

[4.26] 05.07.2016

Core version: 4.25.4

• Update: URE_KEY_CAPABILITY (allows to user to make anything with URE) constant was changed from ‘ure_edit_roles’ to ‘ure_manage_options’. It’s possible now to give to non-admin users the access to the User Role Editor without giving them access to the ‘administrator’ role and users with ‘administrator’ role.
• Update: User receives full access to User Role Editor under WordPress multisite if he has ‘manage_network_plugins’ capability instead of ‘manager_network_users’ as it was earlier. This allows to give to a user ability to edit the network users without giving him access to the User Role Editor.
• Update: Use WordPress’s global $current_site->blog_id to define main blog ID instead of selecting the 1st one from the sorted list of blogs.
• New: Widgets Show Access additional module allows to manage which roles may see what widgets (more info…).
• New: Admin menu access, Meta boxes access, Other roles access modules: functionality is available from the Network Admin Center for WordPress multisite. Data is updated for the main site. To replicate module data to other sites use ‘Network Update’ button.
• New: Content edit restrictions: ure_post_edit_access_authors_list filter allows to modify authors list which posts should be allowed/prohibited for editing.
• Fix: User was redirected to the main site instead of returning back to the Network Admin after update additional module data from the User Role Editor page opened under the Network Admin.
• Fix: Content edit restrictions:
  – Subpages were restricted automatically up to 2nd level only. Full tree is processed now.
  – add orders by product owner function did not respect custom DB prefix, it used hard coded ‘wp_’ instead.
  – added bookings from “WC Booking” plugin by product owner, not only by booking author. Return false by ‘ure_edit_posts_access_add_bookings_by_product_owner’ filter to switch this behavior OFF.
  – forced “WC Booking” plugin do not suppress filters during booking products selection.
  – when ‘ure_auto_access_child_pages’ filter returned false, code returned void instead of unchanged posts list array.
• Update: Custom post types own capabilities: moved code execution to the later priorities 98, 99 (comparing to earlier 11, 12) in order to exclude conflicts with plugins which register their custom post type with a later priority then a default 10.
• Various code enhancements and optimization.

[4.25.1] 19.05.2016

Core version: 4.25.3

• Fix: Content View Restrictions module:
  – Compatibility provided with WordPress versions earlier 4.4, which do not send ‘post’ parameter to “get_{$adjacent}_post_where” filter.
  – Conflict was resolved with WPML plugin. It adds ‘p’ parameter to the queries for a single post.Titles of restricted posts were viewable for that reason.
• Fix: Admin menu access module:
  – If the 1st submenu item was blocked, menu item was renamed and lost its submenu with not blocked menu items.
• New: Content Edit Restrictions module: filter ure_restrict_edit_post_type was added. It allows to exclude some post type (you don’t wish to restrict) from this module action.

[4.25] 05.05.2016

Core version: 4.25.2

• New: Edit posts restrictions module:
  – It’s possible to set edit posts/pages/custom post types restrictions for roles.
  – Option ‘Own data only’ was added to allow to edit/see at admin just own posts/pages, custom post type items.
  – Support was added for “Woocommerce Bookings” plugin.
• Fix: Edit posts restrictions module:
  – It was not possible to use revisions with ‘Allow’ model.
  – Edit restrictions were not applied to a user without ‘edit_posts’ or ‘edit_pages’ capability.
  – WooCommerce orders are filtered correctly if you restricted a user by authors(product owners) ID.
  It’s possible to switch off this extension via filter ‘ure_edit_posts_access_add_orders_by_product_owner’. It should return false for that.
  – Quant by views was shown wrong for some custom post types, e.g. WooCommerce Orders.
  – bulk update from posts list wrote to the user profile wrong data;
• Fix: Admin menu access module:
  – ‘user-edit.php’ link was blocked by error with ‘block not selected’ model, which did not allow to edit a selected user.
  – access was allowed by error via direct URL to some menu items blocked with “block not selected” model.
  – Jetpack menu was not blocked. Admin menu copy creation is linked to the action with priority 999, to be executed after Jetpack,
  which uses priority 998 for some reason.
  – ‘UpdraftPlus’ topbar admin menu was not removed when ‘Settings->UpdraftPlus Backup’ menu item was blocked.
• Fix: Content view restrictions module:
  – Prohibited posts titles/URLs were shown as ‘Previous’ or ‘Next’ links at the single post page.
• Update: Edit posts restrictions module: bulk update is available for all custom post types, not for the posts and pages only as it was earlier.
• Update: Admin menu access module:
  – Enhanced technique of blocking links: order and quant of URL parameters does not matter.
  – Admin menu copy is refreshed automatically after any plugin activation for synchronization with possible menu changes.
  – When menu item is not allowed, it’s replaced by the 1st allowed item from a child submenu or removed.
  – Multisite “My Sites” top bar admin menu does not show ‘Dashboard’ menu item for site if it’s blocked for that site.
  – Some plugins/themes produces Menu/Submenu glitches ((Ultimate, Avada) for users with changed permissions. Such menu inconsistencies are fixed automatically.
• Update: Enhanced inner processing of custom post types list
• Update: Uses 15 seconds transient cache in order to not count users without role twice when ‘restrict_manage_users’ action fires.
• Update: URE fires action ‘profile_update’ after direct update of user permissions in order other plugins may catch such change.
• Update: All URE’s PHP classes files were renamed and moved to the includes/classes subdirectory. Pro version part was moved under the “pro” directory.

[4.24.6] 15.04.2016

Core version: 4.25.1

• Fix: Selected role’s capabilities list was returned back to old after click “Update” button. It was showed correctly according to the recent updates just after additional page refresh.
• Update: deprecated function get_current_user_info() call was replaced with wp_get_current_user().

[4.24.5] 02.04.2016

Core version: 4.25

• Important security update: Any registered user could get an administrator access. Thanks to John Muncaster for discovering and wisely reporting this vulnerability.
• URE pages title tag was replaced from h2 to h1, for compatibility with other WordPress pages.

[4.24.4] 01.04.2016

Core version: 4.24.1

• Fix: Content view restrictions module: Access error message was not shown with setting to show it. Post or page was excluded from the list of available content instead.
• Fix: Admin menu access module:
  – ‘user-edit.php’ link was blocked by error with ‘block not selected’ model, which did not allow to edit a selected user.
  – admin menu copy is linked to the action with priority 1000 now, to be executed after Jetpack, which uses priority 998 for some reason.

[4.24.3] 23.03.2016

Core version: 4.24.1

• Fix: PHP Notice: Undefined index: … in wp-contentpluginsuser-role-editor-proincludesproclassesadmin-menu-access.php on line 69
  Warning: Invalid argument supplied for foreach() in wp-content/plugins/user-role-editor-pro/includes/pro/classes/admin-menu-access.php on line 86
• Update: Admin menu access module – conditions were optimized when backend admin menu copy is created.

[4.24.2] 21.03.2016

Core version: 4.24.1

• Fix: Critical bugs at URE_Content_View_Restrictions_Posts_List class.
• Update: Admin menu access module: It hides ‘Dashboard’ menu item from admin top bar menu in case this item blocked for the main (left side) admin menu.

[4.24.1] 19.03.2016

Core version: 4.24.1

• Fix: Fatal error: Undefined class constant ‘content_for_roles’ in wp-content/plugins/user-role-editor-pro/includes/pro/classes/content-view-restrictions-posts-list.php on line 46

[4.24] 19.03.2016

Core version: 4.24.1

• Fix: Error message “Update Failed: Plugin update failed” was shown after click “Update” at WordPress multisite “Network Admin – Plugins” page.
• Fix: PHP Fatal error: Call to undefined method URE_Posts_Edit_Access::get_attachments_list() in wp-content/plugins/user-role-editor-pro/includes/pro/classes/posts-edit-access.php on line 171
• Fix: Admin menu access module:
  – “Block not Selected” model blocked allowed URLs inside Media Library (started from upload.php) and Appearance Menus (started from nav-menus.php) and other allowed URLs (just with additional parameters).
  – WordPress Multisite – single site administrator get “Admin menu” dialog in the read-only mode for all roles. He should not edit just its own ‘administrator’ role.
  – Direct access to the blocked menu item via URL was possible for URLs like one from WooCommerce’s “Products->Attributes” menu item:
  wp-admin/edit.php?post_type=product&page=product_attributes.
  – Blocked menu item could be selected as the 1st available menu item which leaded to the endless redirect loop.
  – Blocked menu items search at the current user submenu copy was optimized (expanded or reordered submenu cases (like Events Manager) are processed correctly now).
• Fix: Meta Boxes access module: WooCommerce edit product/order page meta boxes were not hidden, fixed PHP notices generated in some cases.
• Fix: Export/Import module: PHP Notice: “Use of undefined constant value” was shown during import.
• Update: Export/Import module: applies base64 encode/decode to the processed data in order to exclude errors when working with multi-byte languages, like Japanese. Refresh your exported roles files as older data format is not supported starting from this version.
• Update: Admin menu access module – full copy of admin menu is created only when superadmin opens User Role Editor.
• Update: Meta Boxes access module:
  – meta boxes are grouped by page to which they belong and sorted in alphabet order.
  – meta boxes created by Advanced Custom Fields plugin are available at URE and can be blocked now.
• New: Export/Import module:’ure_sanitize_capability_filter’ filter was added. Use it to redefine user capability name valid characters set.Currently only letters, numbers, spaces, ‘_’,’-‘, ‘/’ are allowed.
• New: User capabilities page was integrated with “[User Switching](https://wordpress.org/plugins/user-switching/)” plugin – “Switch To” the editing user link iss added if “User Switching” plugin is available.
• Fix: PHP notice was generated by class-role-additional-options.php in case when some option does not exist anymore
• Update: ‘Add Capability’ button have added capability to the WordPress built-in administrator role by default. It did not work, if ‘administrator’ role did not exist. Now script selects automatically as an admin role a role with the largest quant of capabilities and adds new capability to the selected role.
• Fix: “Assign role to the users without role” feature ignored role selected by user.
• Marked as compatible with WordPress 4.5.

[4.23.2] 14.02.2016

• Core version: 4.23.3
• Fix: Admin menu access add-on:
  1) It was not possible to block top level menu items when menu was reordered, by some plugin, like WooCommerce.
  2) Support for virtual ‘exist’ user capability was added. WordPress adds it automatically to every user.
  It was not possible to block ‘Visual Composer’ top level menu and its ‘About’ submenu item. These points are protected by ‘exist’ capability.

[4.23.1] 10.02.2016

• Core version: 4.23.3
• Fix: Admin menu access add-on: Direct URL was not blocked for the blocked admin menu item with link started from ‘admin.php’.

[4.23] 07.02.2016

• Core version: 4.23.3
• Update: Call of deprecated mysql_server_info() is replaced with $wpdb->db_version().
• Update: Singleton pattern is applied to the URE_Lib class.
• Update: Code executed once after plugin activation is executed by the next request to WP and may use a WordPress action to fire with a needed priority.
• Update: Unused ‘add_users’ capability was removed from the list of core capabilities as it was removed from WordPress starting from version 4.4
• Fix: “Users – Without Role” button showed empty roles drop down list on the 1st call.
• Fix: ure-users.js was loaded not only to the ‘Users’ page.
• New: Full support for bbPress user capabilities and roles was added.
• New: Edit posts restrictions add-on: Rules are applied automatically to the child pages of the allowed/blocked page.
  Use ‘ure_auto_access_child_pages’ filter if you wish to exclude the child pages from the edit restriction rules.
  It should be used as a ‘must-use’ plugin, because of this filter is applied earlier then theme is loaded.
  It seems that it’s too late to insert it into the theme’s functions.php file.
• Update: Content view restrictions are applied now to the front-end only. Use edit restrictions add-on to manage posts/pages visibility at WordPress back-end.
• Update: data update notice is shown now for all add-ons.
• Update: get_all_category_ids() function call deprecated from WordPress version 4.0 is replaced by call of get_terms() function.
• Fix: Edit posts restrictions add-on:
  1) Blocked categories are not available now for selection at the new created post and at the posts list filter by category drop-down list.
  2) Earlier you can not save new post with category assigned from the allowed categories list with error: You are not allowed to edit this post.
  New post is created now with 1st category (from the allowed list) automatically assigned.
  3) Data (saved at user level) have been deleted in case user attributes was updated not from WordPress back-end user profile page, but by directly, via WordPress API.
  4) Posts filters and counters were enhanced for the case when user does not have posts available for editing.
• Fix: Admin menu access add-on: in some cases click on allowed(shown) menu item showed “Not enough permissions” error message.
  Important: make database backup before installing this version. Admin menu access data is converted after plugin activation to the new format.
  Data conversion from version older than 4.15 is not supported. If you have URE Pro version older than 4.15 install and activate URE version 4.21.1 first,
  then proceed with version 4.22 and later.
• Fix: ‘ure_restrict_content_view_for_authors_and_editors’ filter blocked saving content view restrictions data at a post level.
• Fix: Network Admin – Users – Capabilities – ‘Update Network’ button did not work.
• Fix: ‘Update Network’ did not replicate ‘Widgets’ access add-on data if selected.
• Update: some HTML-code extracted from User_Role_Editor_Pro class to URE_Pro_View class.
• Update: It’s possible now to manage access to ‘Metaboxes’ for roles without ‘edit_posts’ capability.