1.07

  • Removed a stray error_log file (a benign Composer-internal PHP deprecation notice, no sensitive content) that got accidentally committed in the initial GitHub push
  • Added .gitignore to prevent recurrence

1.06

  • Split the LH_Vcard_plugin god class into one class per concern: LH_Vcard_Signed_Link (tokens), LH_Vcard_Builder (vCard content), LH_Vcard_Rest_Controller (REST route), LH_Vcard_Recently_Updated (tracking/widget/shortcode/backfill), LH_Vcard_Integrations (third-party UI touchpoints)
  • LH_Vcard_plugin shrinks to a thin bootstrap; return_signed_vcard_download_url() kept in place as a one-line proxy since lh-profile-page’s search-users MCP ability calls that exact class/method directly
  • Verified byte-for-byte identical vCard output before/after (aside from sabre/vobject’s own randomly-regenerated UID field)

1.05

  • Removed dead code (unused curpageurl() method, zero call sites)
  • Added License/License URI to the plugin header
  • Escaped remaining unescaped output (esc_url/esc_html__/esc_html_e/absint) across every link-building method
  • Added readme.txt (previously empty) now that the plugin is public

1.04

  • Replaced the bundled, unattributed includes/wp-gvc-cf-vcard.class.php library with sabre/vobject (Packagist, actively maintained), via a new plugin-level composer.json
  • Fixed two latent bugs from the old library: a malformed 8-component ADR line (RFC 6350 specifies 7), and missing RFC-required line-folding on long PHOTO data
  • Swapped file_get_contents()/parse_url() for wp_remote_get()/wp_parse_url() in the photo-fetching helpers, and date() for gmdate()
  • Output remains vCard 3.0 (not sabre/vobject’s 4.0 default), for compatibility with older phone contact-import apps
  • Deleted includes/wp-gvc-cf-vcard.class.php once nothing referenced it any longer
  • Verified against a live-generated vCard: correct FN/N/EMAIL/TEL/URL, properly folded base64 PHOTO data

1.03

  • Switched every remaining vCard link caller (user row actions, BuddyPress member/group links, group reports, dashboard widget, bbPress reply links) to the signed REST download mechanism
  • Removed the old admin-ajax path entirely: return_vcard_link(), ajax_do_vcard(), its wp_ajax_ hook, maybe_return_object(), handle_singular_user_id(), handle_multiple_user_id()
  • Raised the signed link’s default TTL from 15 minutes to 24 hours (DAY_IN_SECONDS), now that the mechanism serves long-lived UI surfaces, not just freshly-generated links

1.02

  • Added a signed, non-user-specific vCard download mechanism: return_signed_vcard_download_url(), an HMAC token independent of who’s logged in, served via a new GET /wp-json/lh-vcard/v1/download REST route
  • Initially wired into exactly one caller: the lh-profile-page/search-users MCP ability’s vcard_url output field, so a link generated by that ability’s own account works when opened in anyone else’s browser
  • Old return_vcard_link()/admin-ajax path left untouched for every existing UI caller at this point

Earlier

Vcard export via admin-ajax.php?action=lh_vcard-do_vcard, gated by login + a publish_posts capability check (a nonce was attached to the URL but never actually verified server-side). BuddyPress member/group integration, group reports column, dashboard widget of recently-updated vCards,

All Users

shortcode.