We made updates to several default widgets this week. If you customized any of these widgets and want to update them, you can find the latest code in the corresponding default widget. Please remember that if you have a custom version of any of these widgets, the latest updates will not be pushed to your website.
Admin Access & Security
- Updated the events calendar's bundled JavaScript library to a current version, clearing a known security advisory.
- Fixed an issue that allowed specially crafted searches on the public Get Matched lead form and on the reviews search results page to reach the website's database directly.
Widgets Involved:
Get Matched Search Engine
Search - Reviews - Search Query - Strengthened how widget and form records are loaded so code saved on one website can no longer run outside that website.
- Fixed an issue that caused a website's public images address to return files belonging to another account on the same server.
- Fixed an issue that allowed custom code on one website to read files belonging to other websites hosted on the same server.
- Strengthened the protection around custom code so program libraries and executable files can no longer be loaded through it.
- Fixed an issue that allowed the Media Manager to list folders and file names belonging to a different website. In addition, its access is now tied to a signed-in Admin.
- Fixed an issue that caused the DNS records editor to open the shared platform zone for websites still using a platform address, which allowed an Admin to view and change records belonging to other websites.
- Fixed an issue that caused form fields marked View Admin Only to be displayed to ordinary visitors who used a specially crafted web address.
- Fixed an issue that caused HTML entered in a Post Type's name to run in the Admin instead of being displayed as text. The name is now cleaned when it is saved and shown as text wherever it appears.
- Fixed an issue that caused HTML entered in a form's name or nickname to run in the Admin instead of being displayed as text.
- Fixed an issue that exposed the website's OpenAI key in the page code when the ChatGPT button was used in the Froala Editor in the Admin.
- Fixed an issue that caused member passwords and card details to be recorded in plain text in the API request log. Those values are now hidden.
Checkout & Billing
- Separated a coupon's number of Uses from its number of Applied Invoices, so both are reported independently.
- Fixed an issue that prevented card payments from working on websites connected to a newly created Stripe account. Renewals were affected in the same way.
- Fixed an issue that prevented a member from completing an upgrade when their card requires identity confirmation on every payment, which left the confirmation window repeating.
- Fixed an issue that caused an upgrade to be charged at full price when the coupon stopped being valid between opening and submitting checkout. The upgrade now stops and tells the member, as signup checkout already did.
- Fixed an issue that caused a failed upgrade payment to count the coupon as used, so the member's own coupon was then refused or charged at full price on the retry.
- Fixed an issue that caused the prorated upgrade credit to be calculated incorrectly when the member's current plan is a One Time plan.
- Fixed an issue that caused the coupon tag on Search Subscriptions to reload the full subscription list instead of showing only the subscriptions that used that coupon.
- Fixed an issue that caused a Transaction History export to fail with an “export file does not contain any records” message when the list loaded more results while the export was running.
Sitemaps & SEO
- Released a redesigned Sitemap Generator page. The sitemap is now rebuilt in place, so the live sitemap keeps working until the new one is finished, progress reports which page type is being built, and Cancel stops the build after the current page type.
- Fixed an issue that caused location and category pages with no active, searchable members to be listed in the sitemap.
- Fixed an issue that caused Generate Sitemap to load indefinitely by repeating a failed step without limit. Errors can now be closed.
- Fixed an issue that caused the website's structured data to publish partial image, logo and page addresses instead of complete ones, which made those pages ineligible for search engine rich results.
Widgets Involved:
Bootstrap Theme - Detail Page - Schema Markup - Community Article
Bootstrap Theme - Detail Page - Schema Markup - Event Post Type
Bootstrap Theme - Detail Page - Schema Markup - Jobs Post Type
Bootstrap Theme - Detail Page - Schema Markup - Product Post Type
Bootstrap Theme - Detail Page - Schema Markup - Property Listing Post Type
Bootstrap Theme - Detail Page - Schema Markup - Video Post Type
Bootstrap Theme - Detail Page - Schema Markup - Website Blog Article
Bootstrap Theme - Global Website - Schema Markup
Bootstrap Theme - Member Profile - Contact Page
Bootstrap Theme - Member Profile - Display Member Address
Bootstrap Theme - Member Profile - Read Review
Bootstrap Theme - Member Profile - Submit Review Bootstrap Theme - Static Web Page - Fixed an issue that caused a 301 Redirect from a plain city address to add internal search details to the destination address, sending search engines to a one-off address instead of the clean one.
Admin Design
- Released a redesigned Widget Manager page. One search box and one software version selector now drive both the Customized and Default tables, used-by counts are shown as chips, and Preview opens as a read-only popup.
- Released a redesigned Sidebar Manager. The edit screen adds a preview column and an Actions menu for copying, cloning, saving history, enabling or disabling and deleting a sidebar.
- Released a redesigned Activity Tracker page, with the same activity list, filters and details.
- Fixed an issue that caused the page to freeze for about twenty seconds while typing in a font Search box.
- Improved the speed of the colour pickers and colour sets, which had made the page slow to load and respond. In addition, Custom Content code now saves correctly.
Member File Uploads
- Files that members upload through form file fields are now given an unguessable name, so a file address can no longer be worked out from when it was uploaded.
- Fixed an issue that caused clearing a member's File field through the API to leave the file on the server and publicly reachable. It is now deleted, the same as the Remove File button.
- Fixed an issue that caused the web address saved alongside a member's uploaded file to leave out its folder, so anything using that address received a “page not found” instead of the file.
- Fixed an issue that caused a file attached to a post's File field to be discarded without any message to the member.
Member Profiles & Search
- Fixed an issue that caused the review link in the Recent Members section to point to a different member's reviews. Widget Involved: Bootstrap Theme - Display - Recent Members
- Fixed an issue that caused a hidden or inactive member profile to still publish the member's name, town and member number in the page title, page description and sharing tags.
- Fixed an issue that caused a map pin's name to be empty when the member, post or group name contains double quotation marks.
Widgets Involved:
Bootstrap Theme - Google Pins Locations
Bootstrap Theme - Search Results Map google pins locations
Posts & Reviews
- Fixed an issue that prevented an imported photo whose picture failed to download from being deleted from the product's photo editor and from Multi Photo Posts.
- Fixed an issue that caused a photo uploaded with a review to be displayed sideways, by reading the orientation the camera recorded. Photos uploaded before this update keep their original orientation and need to be uploaded again.
Widget Involved:
Bootstrap Theme - Reviews - Upload Images - Review photo uploads now require a signed-in member.
Widget Involved:
Bootstrap Theme - Reviews - Upload Images
Site Speed & Performance
- Fixed an issue that caused the Mobile Preloader screen to appear on every direct visit from a phone on some websites. It now appears once per visitor.
Widget Involved:
Bootstrap Theme - HEAD - Fixed an issue that caused the whole page to move down on phones when the Announcement Bar appeared, which search engines score as a layout shift.
- Fixed an issue that caused the My Post Types and Most Viewed Profiles cards on the Admin dashboard to run for several minutes on websites with a large amount of content, and applied the intended time limit to those counts.
Developer Hub & API
- Updated the API documentation for Email Automation Settings so the rule names, the member flag and the billing cycle names match what the system accepts.
- Fixed an issue that caused the API widget render request to report success when the widget's code had failed. The response now reports the failure and its reason.
- Fixed an issue that caused two leftover diagnostic entries to be written to the website's Debugger log on almost every page, which buried the transaction and lead-matching history the log is meant to keep.
Websites & Hosting
- Fixed an issue that caused the move to the Enhanced Hosting server to never be queued when the bundle was bought at checkout, which left the website with no way to start the move.
