1.07
- Removed a stray
error_log file (a benign Composer-internal PHP deprecation notice, no sensitive content) that got accidentally committed in the initial GitHub push
- Added
.gitignore to prevent recurrence
1.06
- Split the LH_Vcard_plugin god class into one class per concern: LH_Vcard_Signed_Link (tokens), LH_Vcard_Builder (vCard content), LH_Vcard_Rest_Controller (REST route), LH_Vcard_Recently_Updated (tracking/widget/shortcode/backfill), LH_Vcard_Integrations (third-party UI touchpoints)
- LH_Vcard_plugin shrinks to a thin bootstrap; return_signed_vcard_download_url() kept in place as a one-line proxy since lh-profile-page’s search-users MCP ability calls that exact class/method directly
- Verified byte-for-byte identical vCard output before/after (aside from sabre/vobject’s own randomly-regenerated UID field)
1.05
- Removed dead code (unused curpageurl() method, zero call sites)
- Added License/License URI to the plugin header
- Escaped remaining unescaped output (esc_url/esc_html__/esc_html_e/absint) across every link-building method
- Added readme.txt (previously empty) now that the plugin is public
1.04
- Replaced the bundled, unattributed
includes/wp-gvc-cf-vcard.class.php library with sabre/vobject (Packagist, actively maintained), via a new plugin-level composer.json
- Fixed two latent bugs from the old library: a malformed 8-component
ADR line (RFC 6350 specifies 7), and missing RFC-required line-folding on long PHOTO data
- Swapped
file_get_contents()/parse_url() for wp_remote_get()/wp_parse_url() in the photo-fetching helpers, and date() for gmdate()
- Output remains vCard 3.0 (not sabre/vobject’s 4.0 default), for compatibility with older phone contact-import apps
- Deleted
includes/wp-gvc-cf-vcard.class.php once nothing referenced it any longer
- Verified against a live-generated vCard: correct FN/N/EMAIL/TEL/URL, properly folded base64 PHOTO data
1.03
- Switched every remaining vCard link caller (user row actions, BuddyPress member/group links, group reports, dashboard widget, bbPress reply links) to the signed REST download mechanism
- Removed the old admin-ajax path entirely:
return_vcard_link(), ajax_do_vcard(), its wp_ajax_ hook, maybe_return_object(), handle_singular_user_id(), handle_multiple_user_id()
- Raised the signed link’s default TTL from 15 minutes to 24 hours (
DAY_IN_SECONDS), now that the mechanism serves long-lived UI surfaces, not just freshly-generated links
1.02
- Added a signed, non-user-specific vCard download mechanism:
return_signed_vcard_download_url(), an HMAC token independent of who’s logged in, served via a new GET /wp-json/lh-vcard/v1/download REST route
- Initially wired into exactly one caller: the
lh-profile-page/search-users MCP ability’s vcard_url output field, so a link generated by that ability’s own account works when opened in anyone else’s browser
- Old
return_vcard_link()/admin-ajax path left untouched for every existing UI caller at this point
Earlier
Vcard export via admin-ajax.php?action=lh_vcard-do_vcard, gated by login + a publish_posts capability check (a nonce was attached to the URL but never actually verified server-side). BuddyPress member/group integration, group reports column, dashboard widget of recently-updated vCards, All Users