@prefix sioc: . @prefix dc: . @prefix dcterms: . @prefix xsd: . @prefix content: . @prefix rdf: . @prefix rdfs: . a sioc:Post ; dc:title "Changelog" ; dcterms:identifier 147190 ; dc:modified "2026-09-11T16:03:41Z"^^xsd:dateTime ; dc:created "2026-09-09T16:13:29Z"^^xsd:dateTime ; sioc:link ; sioc:has_creator ; sioc:has_container ; content:encoded """

1.07

  • Removed a stray error_log file (a benign Composer-internal PHP deprecation notice, no sensitive content) that got accidentally committed in the initial GitHub push
  • Added .gitignore to prevent recurrence

1.06

  • Split the LH_Vcard_plugin god class into one class per concern: LH_Vcard_Signed_Link (tokens), LH_Vcard_Builder (vCard content), LH_Vcard_Rest_Controller (REST route), LH_Vcard_Recently_Updated (tracking/widget/shortcode/backfill), LH_Vcard_Integrations (third-party UI touchpoints)
  • LH_Vcard_plugin shrinks to a thin bootstrap; return_signed_vcard_download_url() kept in place as a one-line proxy since lh-profile-page’s search-users MCP ability calls that exact class/method directly
  • Verified byte-for-byte identical vCard output before/after (aside from sabre/vobject’s own randomly-regenerated UID field)

1.05

  • Removed dead code (unused curpageurl() method, zero call sites)
  • Added License/License URI to the plugin header
  • Escaped remaining unescaped output (esc_url/esc_html__/esc_html_e/absint) across every link-building method
  • Added readme.txt (previously empty) now that the plugin is public

1.04

  • Replaced the bundled, unattributed includes/wp-gvc-cf-vcard.class.php library with sabre/vobject (Packagist, actively maintained), via a new plugin-level composer.json
  • Fixed two latent bugs from the old library: a malformed 8-component ADR line (RFC 6350 specifies 7), and missing RFC-required line-folding on long PHOTO data
  • Swapped file_get_contents()/parse_url() for wp_remote_get()/wp_parse_url() in the photo-fetching helpers, and date() for gmdate()
  • Output remains vCard 3.0 (not sabre/vobject’s 4.0 default), for compatibility with older phone contact-import apps
  • Deleted includes/wp-gvc-cf-vcard.class.php once nothing referenced it any longer
  • Verified against a live-generated vCard: correct FN/N/EMAIL/TEL/URL, properly folded base64 PHOTO data

1.03

  • Switched every remaining vCard link caller (user row actions, BuddyPress member/group links, group reports, dashboard widget, bbPress reply links) to the signed REST download mechanism
  • Removed the old admin-ajax path entirely: return_vcard_link(), ajax_do_vcard(), its wp_ajax_ hook, maybe_return_object(), handle_singular_user_id(), handle_multiple_user_id()
  • Raised the signed link’s default TTL from 15 minutes to 24 hours (DAY_IN_SECONDS), now that the mechanism serves long-lived UI surfaces, not just freshly-generated links

1.02

  • Added a signed, non-user-specific vCard download mechanism: return_signed_vcard_download_url(), an HMAC token independent of who’s logged in, served via a new GET /wp-json/lh-vcard/v1/download REST route
  • Initially wired into exactly one caller: the lh-profile-page/search-users MCP ability’s vcard_url output field, so a link generated by that ability’s own account works when opened in anyone else’s browser
  • Old return_vcard_link()/admin-ajax path left untouched for every existing UI caller at this point

Earlier

Vcard export via admin-ajax.php?action=lh_vcard-do_vcard, gated by login + a publish_posts capability check (a nonce was attached to the URL but never actually verified server-side). BuddyPress member/group integration, group reports column, dashboard widget of recently-updated vCards,

All Users

shortcode.

"""^^rdf:XMLLiteral ; sioc:content """Type: Doc-sectionPart of: LH Vcard1.07 Removed a stray error_log file (a benign Composer-internal PHP deprecation notice, no sensitive content) that got accidentally committed in the initial GitHub push Added .gitignore to prevent recurrence 1.06 Split the LH_Vcard_plugin god class into one class per concern: LH_Vcard_Signed_Link (tokens), LH_Vcard_Builder (vCard content), LH_Vcard_Rest_Controller (REST route), LH_Vcard_Recently_Updated (tracking/widget/shortcode/backfill), LH_Vcard_Integrations (third-party UI touchpoints) LH_Vcard_plugin shrinks to a thin bootstrap; return_signed_vcard_download_url() kept in place as a one-line proxy since lh-profile-page’s search-users MCP ability calls that exact class/method directly Verified byte-for-byte identical vCard output before/after (aside from sabre/vobject’s own randomly-regenerated UID field) 1.05 Removed dead code (unused curpageurl() method, zero call sites) Added License/License URI to the plugin header Escaped remaining unescaped output (esc_url/esc_html__/esc_html_e/absint) across every link-building method Added readme.txt (previously empty) now that the plugin is public 1.04 Replaced the bundled, unattributed includes/wp-gvc-cf-vcard.class.php library with sabre/vobject (Packagist, actively maintained), via a new plugin-level composer.json Fixed two latent bugs from the old library: a malformed 8-component ADR line (RFC 6350 specifies 7), and missing RFC-required line-folding on long PHOTO data Swapped file_get_contents()/parse_url() for wp_remote_get()/wp_parse_url() in the photo-fetching helpers, and date() for gmdate() Output remains vCard 3.0 (not sabre/vobject’s 4.0 default), for compatibility with older phone contact-import apps Deleted includes/wp-gvc-cf-vcard.class.php once nothing referenced it any longer Verified against a live-generated vCard: correct FN/N/EMAIL/TEL/URL, properly folded base64 PHOTO data 1.03 Switched every remaining vCard link caller (user row actions, BuddyPress member/group links, group reports, dashboard widget, bbPress reply links) to the signed REST download mechanism Removed the old admin-ajax path entirely: return_vcard_link(), ajax_do_vcard(), its wp_ajax_ hook, maybe_return_object(), handle_singular_user_id(), handle_multiple_user_id() Raised the signed link’s default TTL from 15 minutes to 24 hours (DAY_IN_SECONDS), now that the mechanism serves long-lived UI surfaces, not just freshly-generated links 1.02 Added a signed, non-user-specific vCard download mechanism: return_signed_vcard_download_url(), an HMAC token independent of who’s logged in, served via a new GET /wp-json/lh-vcard/v1/download REST route Initially wired into exactly one caller: the lh-profile-page/search-users MCP ability’s vcard_url output field, so a link generated by that ability’s own account works when opened in anyone else’s browser Old return_vcard_link()/admin-ajax path left untouched for every existing UI caller at this point Earlier Vcard export via admin-ajax.php?action=lh_vcard-do_vcard, gated by login + a publish_posts capability check (a nonce was attached to the URL but never actually verified server-side). BuddyPress member/group integration, group reports column, dashboard widget of recently-updated vCards, https://lhero.org/wp-content/plugins/lh-gravatar-cache/icons/unknown_user.svgaergsd activityhttps://lhero.org/wp-content/plugins/lh-profile-page/assets/male.pngw4ergqwer wergw activityhttps://lhero.org/wp-content/plugins/lh-profile-page/assets/male.pngMathew Coggan activityhttps://lhero.org/wp-content/plugins/lh-profile-page/assets/female.pngJanelle Wensor activityhttps://lhero.org/wp-content/plugins/lh-profile-page/assets/male.pngOscar Fau activityhttps://lhero.org/wp-content/lh-gravatar-cache/b8023d02fcfeee172986aa3321d8336d/535bebda9c760295278dcda91edc52b0-gravatar.jpgRebekah Helm activityhttps://lhero.org/wp-content/plugins/lh-profile-page/assets/female.pngTeresa Gray activityhttps://lhero.org/wp-content/plugins/lh-profile-page/assets/female.pngLora Rogers activityhttps://lhero.org/wp-content/plugins/lh-profile-page/assets/male.pngLiam Rogers activityhttps://lhero.org/wp-content/lh-google-login/google/731a25bee45d57e9208aa622c1b39fbd/73d2154f2b5efa7de5bff178d0c671c4-google_avatar.jpgSophie Ng activityhttps://lhero.org/wp-content/plugins/lh-profile-page/assets/male.pngBlake Hohenhaus activityhttps://lhero.org/wp-content/plugins/lh-profile-page/assets/female.pngCara Cara Gillespie activityhttps://lhero.org/wp-content/plugins/lh-profile-page/assets/male.pngDylan Johnstone activityhttps://lhero.org/wp-content/plugins/lh-profile-page/assets/female.pngBimaya Raddalgoda activityhttps://lhero.org/wp-content/lh-google-login/google/2d919aa09c12e7908440dc0a7a92014a/d8dd50e277d54dd1692c95001a7b6c06-google_avatar.jpgMal Foki activityhttps://lhero.org/wp-content/lh-google-login/google/1cd9b308fb16ffa280193cefdab0c30a/73d2154f2b5efa7de5bff178d0c671c4-google_avatar.jpgSeb Gotch activityhttps://lhero.org/wp-content/plugins/lh-profile-page/assets/female.pngLaura Bingham activityhttps://lhero.org/wp-content/plugins/lh-profile-page/assets/male.pngMatt Ploenzke activityhttps://lhero.org/wp-content/plugins/lh-profile-page/assets/male.pngRalph Pabelico activityAll Users shortcode. """ ; sioc:topic , . rdfs:seeAlso . rdfs:seeAlso . rdfs:seeAlso .