From cb4fed9b68a15f3d321423f8fea25f6aa437ca08 Mon Sep 17 00:00:00 2001 From: Bartosz Gadomski Date: Mon, 6 Jul 2026 18:38:30 +0200 Subject: [PATCH] Release 4.2.2 Bump version to 4.2.2 and document the live update authorization hardening in the changelog. Co-authored-by: Cursor --- changelog.md | 6 ++++++ classes/class-plugin.php | 2 +- readme.txt | 6 +++++- stream.php | 2 +- 4 files changed, 13 insertions(+), 3 deletions(-) diff --git a/changelog.md b/changelog.md index 784520ba8..d2071a263 100644 --- a/changelog.md +++ b/changelog.md @@ -1,5 +1,11 @@ # Stream Changelog +## 4.2.2 - July 6, 2026 + +### Security + +- Harden authorization for the live update preference: enforce the Stream view capability and always target the current user in the `stream_enable_live_update` AJAX handler so a user can only change their own live update preference ([#1918](https://github.com/xwp/stream/pull/1918)). + ## 4.2.1 - July 2, 2026 ### Bug Fixes diff --git a/classes/class-plugin.php b/classes/class-plugin.php index 28c3648df..c6a652869 100755 --- a/classes/class-plugin.php +++ b/classes/class-plugin.php @@ -20,7 +20,7 @@ class Plugin { * * @const string */ - const VERSION = '4.2.1'; + const VERSION = '4.2.2'; /** * WP-CLI command diff --git a/readme.txt b/readme.txt index f5d1c0b26..11b177124 100644 --- a/readme.txt +++ b/readme.txt @@ -3,7 +3,7 @@ Contributors: xwp Tags: wp stream, stream, activity, logs, track Requires at least: 4.6 Tested up to: 7.0 -Stable tag: 4.2.1 +Stable tag: 4.2.2 License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html @@ -134,6 +134,10 @@ Use only `$_SERVER['REMOTE_ADDR']` as the client IP address for event logs witho == Changelog == += 4.2.2 - July 6, 2026 = + +See: [https://github.com/xwp/stream/blob/develop/changelog.md#422---july-6-2026](https://github.com/xwp/stream/blob/develop/changelog.md#422---july-6-2026) + = 4.2.1 - July 2, 2026 = See: [https://github.com/xwp/stream/blob/develop/changelog.md#421---july-2-2026](https://github.com/xwp/stream/blob/develop/changelog.md#421---july-2-2026) diff --git a/stream.php b/stream.php index 2d4bfb7db..cf85e83e2 100644 --- a/stream.php +++ b/stream.php @@ -3,7 +3,7 @@ * Plugin Name: Stream * Plugin URI: https://xwp.co/work/stream/ * Description: Stream tracks logged-in user activity so you can monitor every change made on your WordPress site in beautifully organized detail. All activity is organized by context, action and IP address for easy filtering. Developers can extend Stream with custom connectors to log any kind of action. - * Version: 4.2.1 + * Version: 4.2.2 * Author: XWP * Author URI: https://xwp.co * License: GPLv2+