Restricted Site Access

• 2022-12-14 =
• Added: Show an admin notice if our autoloader doesn't exist (props @dkotter, @pablojmarti, @shahzaib10up, @peterwilsoncc via #231).
• Fixed: Ensure we load our autoloader from the root of our plugin directory (props @dkotter, @pablojmarti, @shahzaib10up, @peterwilsoncc via #231).
• Changed: Improved performance of our E2E tests (props @Sidsector9, @iamdharmesh via #218).
• Changed: Release instructions and release ZIP building via GitHub Action (props @dkotter, @faisal-alvi via #232).
• Security: Bump loader-utils from 2.0.3 to 2.0.4 (props @dependabot via #226).
• Security: Bump simple-git from 3.6.0 to 3.15.0 (props @dependabot via #230).

• 2022-11-01 =
• Fixed: Fatal error due to missing vendor directory.

• 2022-10-31 =
• Added: Support for IPv6 addresses (props @jeffpaul, @Sidsector9, @cadic).
• Added: Support for subnet range and pattern formats for IPv4 and IPv6 addresses (props @jeffpaul, @Sidsector9, @cadic).
• Added: WP VIP Coding Standards (props @peterwilsoncc, @faisal-alvi, @eflorea).
• Changed: Improved adding IP user experience via settings (props @ankitguptaindia, @dhanendran, @Sidsector9, @dinhtungdu).
• Changed: Replace Grunt with Webpack (props @cadic, @Sidsector9).
• Fixed: Missing textdomains to translatable strings (props @pedro-mendonca, @Sidsector9).

Drops support for versions of WordPress prior to 5.7. Drops support for versions of PHP prior to 7.4.

• 2022-06-30 =
• Added: PHP8 compatibility check GitHub Action (props @Sidsector9, dkotter).
• Added: Dependency security scanning GitHub Action (props @jeffpaul).
• Changed: Admin settings HTML semantics for easier testing (props @Sidsector9, @faisal-alvi).
• Changed: Bump WordPress "tested up to" version 6.0 (props @peterwilsoncc, @faisal-alvi, @cadic, @jeffpaul).
• Changed: Documentation, asset, and e2e test updates (props @Sidsector9, @iamdharmesh).
• Fixed: Check netmask range before IP is added (props @Sidsector9, @PypWalters).
• Security: Bump minimist from 1.2.5 to 1.2.6 (props @dependabot).
• Security: Bump grunt from 1.4.1 to 1.5.3 (props @dependabot).
• Security: Bump async from 2.6.3 to 2.6.4 (props @dependabot).

• Added: Ability to add, remove, and set IPs programatically (props @ivankruchkoff, @helen, @paulschreiber).
• Added: Cloudflare IP detection compatibility (props @eightam, @dinhtungdu).
• Added: WP-CLI option to modify and retrieve IP entry labels (props @Sidsector9, @dinhtungdu, @mikelking).
• Added: Acceptance and end-to-end tests (props @dinhtungdu, @helen, @jeffpaul, @Sidsector9, @cadic).
• Added: Issue management automation, JavaScript linting, and PHPUnit testing via GitHub Actions (props @jeffpaul, @Sidsector9, @dinhtungdu, @mitogh).
• Changed: Update WP-CLI code to use new API for add/remove/set IPs (props @paulschreiber, @dinhtungdu).
• Changed: Bump WordPress "tested up to" version 5.8 (props @dinhtungdu, @jeffpaul, @ankitguptaindia, @BBerg10up, @sudip-10up).
• Changed: Improved Composer configuration and support (props @kopepasah, @dinhtungdu).
• Changed: Improved documentation (props @jeffpaul, @dinhtungdu, @helen).
• Changed: The default constant WP_TESTS_DOMAIN is replaced by a new constant PHP_UNIT_TESTS_ENV to allow testing correct redirections for restricted users by Cypress end-to-end tests (props @faisal-alvi, @Sidsector9, @dkotter).
• Fixed: Issue with allowed IPs and associated comments being offset (props @adamsilverstein, @helen, @ivankruchkoff).
• Fixed: Prevents new users from getting WordPress setup email, new user flow in multisite installations now work as expected (props @dinhtungdu, @wkw, @jeffpaul, @ivanlopez).
• Fixed: Ensure assets are enqueued on correct screen only (props @kopepasah, @dinhtungdu, @paulschreiber, @n8dnx).
• Fixed: Use correct variable for screen reader text (props @dinhtungdu, @lkraav).
• Fixed: Set the correct filter option value to site_public if RSA_FORBID_RESTRICTION is defined (props @pabamato, @dinhtungdu).
• Fixed: Prevent redirect loops when Redirect URL set on the same domain with or without Redirect to same path enabled (props @Sidsector9, @faisal-alvi, @cadic via #158).
• Fixed: Undefined key "url" warning (props @Sidsector9).
• Fixed: Redirect to same path setting screen-reader-text (props @pedro-mendonca).
• Fixed: No loading of JS admin scripts on the network admin page (props @Sidsector9, @dinhtungdu).
• Security: Bump websocket-extensions from 0.1.3 to 0.1.4 (props @dependabot).
• Security: Bump lodash from 4.17.15 to 4.17.21 (props @dependabot).
• Security: Bump rmccue/requests from 1.7.0 to 1.8.0 (props @dependabot).
• Security: Bump grunt from 1.0.4 to 1.3.0 (props @dependabot).
• Security: Bump path-parse from 1.0.6 to 1.0.7 (props @dependabot).

• Added: Warn and confirm before network disabling the plugin (props @pereirinha, @adamsilverstein)
• Fixed: Ensure comments associated with IPs stay associated correctly (props @adamsilverstein, @ivankk, @helen)
• Fixed: Don't show escaped HTML in page caching notice (props @adamsilverstein, @aaemnnosttv)
• Fixed: Multisite: Avoid a redirect loop when logging in as user with no role (props @phyrax, @adamsilverstein, @roytanck, @helen, @rmccue)

Added * IP whitelist: Add a Comment field next to each IP address to help identify IP addresses added to the whitelist. * Add constants to force enable/disable restrictions. Set RSA_FORCE_RESTRICTION to true to force restriction or RSA_FORBID_RESTRICTION to disable restriction. RSA_FORCE_RESTRICTION will override RSA_FORBID_RESTRICTION if both are set.

Fixed * Disable individual site settings when network enforced mode is on to avoid confusion about why your settings are not being respected. * Correctly load admin JS. * Improve coding standards across plugin and introduce continuous integration linting against the WordPress coding standards. Update code to VIP Go coding standards.

Developers * Add unit tests accross plugin. Note that when the WP_TESTS_DOMAIN constant is set, plugin redirects are disabled. Only set this constant when running the tests. * Deploy plugin from GitHub to WordPress.org using GitHub Actions. * Add various GitHub community files.

• Bug fix: Avoid redirect loop when the unrestricted page is set to be the static front page.
• Bug fix: Fall back to the login screen if the unrestricted page is no longer published.

• Feature: WP-CLI support! Try wp rsa to get started.
• Feature: Whitelist IPs via the RSA_IP_WHITELIST constant.
• Feature: Use WordPress.org-provided language packs instead of bundled translations.
• Bug fix: Restrict "virtual pages" and allow them to be used as the unrestricted page, such as with BuddyPress.
• Bug fix: Hide settings properly when no published pages exist.
• Bug fix: Avoid double slashes in asset URLs that can lead to 404 errors.

• Bug fix: Don't redirect logged-in users viewing the site in a single site install.

• Functionality change: Check user's role on a site in multisite before granting permission.
• Feature: Alter or restore previous user permission checking with the restricted_site_access_user_can_access filter.
• Avoid a fatal due to differing parameter counts for the restricted_site_access_is_restricted filter.

• Correct a PHP notice when running PHP >

• Add a 'restrict_site_access_ip_match' action which fires when an ip match occurs. Enables adding session_start() to the IP check, ensuring Varnish type cache will not cache the request.

• When plugin is network activated, don't touch individual blog visiblity settings.
• When plugin is network deactivated, set all individual blogs to default visibility.

• Use Grunt to manage assets.
• Network settings added for management of entire network visibility settings.
• Display warning if page caching is enabled.

Note: There is currently an edge case bug affecting IP whitelisting. This bug is on the docket to be fixed shortly.

• Under the hood refactoring and clean up for performance and maintainability.
• Small visual refinements to the settings panel.

• Does not block user activation page in network mode

• WordPress 3.5 compatibility (3.5 eliminated the Privacy settings panel in favor of a refreshed Reading panel)
• Real validation (on the fly and on save) for IP address entries
• "Restriction message" now supports simple HTML and is edited using WordPress's simple HTML tag editor
• A bunch of visual refinements that conform better with WordPress 3.4 and newer (spacing, native "shake" effect on invalid entries just like the login form, etc.)
• A bunch of under the hood refinements (e.g. playing nicer with current screen Help API)

• New restriction option - show restricted visitor a specified page; use with custom page templates for great for website teasers!
• Major improvements to settings user interface, including hiding unused fields based on settings, easier selection of restriction type, and cleaner "remove" confirmation for IP address list
• Performance improvements - catches and blocks restricted visitors earlier in the loading process
• New filter hooks for other developers: 'restricted_site_access_is_restricted', 'restricted_site_access_approach', 'restricted_site_access_redirect_url', and 'restricted_site_access_head'
• Localization ready - rough Spanish translation included!
• Basic support for no JavaScript mode
• Optimized for PHP 5.2, per new WordPress 3.2 requirements (no longer supports PHP < 5.2.4)
• Assorted other improvements and optimizations to the code base

• Restored PHP4 compatibility

• More meaningful page title in "Display Message" mode (previously WordPress > Error)
• Code clean up, prevent rare warnings in debug mode

• Fixed PHP warning when debugging is enabled and redirect path is not checked

• New feature: backwards compatibility with PHP < 5.1 (limited testing with earlier versions)
• Bug fiX: disappearing blocked access message text box on configuration page
• Bug fix: login always redirects visitor back to correct page
• Improved: built in help on configuration page updated, clearer
• Improved: "IP already in list" indicator
• Improved: optimizations to code that handles restriction behavior

• Integrates with Privacy settings page and site visibility option instead of adding a whole new page
• Simplified options: clearer instructions, removed unnecessary hiding / showing of some options, fewer lines
• Indicates whether the site is blocked in the admin next to the site title (WordPress 3.0+ only)
• New action hook, restrict_site_access_handling, allowing developers to add their own restriction handling
• Cleans up / removes settings when uninstalled
• Assorted under the hood improvements for best coding practices, sanitization of options, etc

• Customize blocked visitor message
• Stronger security (patched "search" hole)
• Better display / handling of blocked visitor message