- Security - Editing an ACF Field in the Field Group editor can no longer execute a stored XSS vulnerability. Thanks to Duc Luong Tran (janlele91) from Viettel Cyber Security for the responsible disclosure
- Security - Post Type and Taxonomy metabox callbacks no longer have access to any superglobal values, hardening the original fix from 6.3.8 further
- Fix - ACF fields now correctly validate when used in the block editor and attached to the sidebar
- Security - ACF defined Post Type and Taxonomy metabox callbacks no longer have access to $_POST data. (Thanks to the Automattic Security Team for the disclosure)
- Security - ACF Free now uses its own update mechanism from WP Engine servers
- Security - Newly added fields now have to be explicitly set to allow access in the content editor (when using the ACF shortcode or Block Bindings) to increase the security around field permissions.
- Security Fix - Field labels are now correctly escaped when rendered in the Field Group editor, to prevent a potential XSS issue. Thanks to Ryo Sotoyama of Mitsui Bussan Secure Directions, Inc. for the responsible disclosure
- Fix - Validation and Block AJAX requests nonces will no longer be overridden by third party plugins
- Fix - Detection of third party select2 libraries will now default to v4 rather than v3
- Fix - Block previews will now display an error if the render template PHP file is not found
Decryption key:
- Fix - The ACF Shortcode now correctly outputs a comma separated list of values for arrays
- Fix - ACF Blocks rendered in auto mode now correctly re-render their previews after editing fields
- Fix - ACF Block validation no longer raises required validation messages if HTML will automatically select the first value when rendered
- Fix - ACF Block validation no longer raises required validation messages if a default value will be rendered as the field value
- Fix - ACF Block validation no longer raises required validation messages for fields hidden by conditional logic when adding a new block
Decryption key:
- Security Fix - The ACF shortcode now prevents access to fields from different private posts by default. View the for more information
- Fix - Users without the edit_posts capability but with custom capabilities for a editing a custom post type, can now correctly load field groups loaded via conditional location rules
- Fix - Block validation no longer validates a field’s sub fields on page load, only on edit. This resolves inconsistent validation errors on page load or when first adding a block
- Fix - Deactivating an ACF PRO license will now remove the license key even if the server call fails
- Fix - Field types returning objects no longer cause PHP warnings and errors when output via the_field, the_sub_field or the ACF shortcode, or when retrieved by a get_ function with the escape html parameter set
- Fix - Server side errors during block rendering now gracefully displays an error to the editor
- Enhancement - All dashicons are now available to the icon picker field type
- Fix - The True/False field now correctly shows it’s description message beside the switch when using the Stylized UI setting
- Fix - Conditional logic values now correctly load options when loaded over AJAX
- Fix - ACF PRO will no longer trigger license validation calls when loading a front-end page
- i18n - Fixed an untranslatable string on Option Page previews
- New - Support for the Block Bindings API in WordPress 6.5 with a new acf/field source. For more information on how to use this, please read
- New - Support for performance improvements for translations in WordPress 6.5
- Enhancement - A new JS filter, select2_escape_markup now allows fields to customize select2's HTML escaping behavior
- Fix - Options pages can no longer set to have a parent of themselves
- Fix - ACF PRO license activations on multisite subsite installs will now use the correct site URL
- Fix - ACF PRO installed on multisite installs will no longer try to check for updates resulting in 404 errors when the updates page is not visible
- Fix - ACF JSON no longer produces warnings on Windows servers when no ACF JSON folder is found
- Fix - Field and layout names can now contain valid non-ASCII characters
- Other - ACF PRO now requires a valid license to be activated in order to use PRO features.
== Changelog ==
= 6.2.4 =
*Release Date 28th November 2023*
* Fix - Custom Post Types labels now match the WordPress 6.4 behavior for "Add New" labels
* Fix - When exporting both post types and taxonomies as PHP, taxonomies will now appear before post types, matching the order ACF registers them. This resolves issues where taxonomy slugs will not work in post type permalinks
* Fix - Advanced Settings for Taxonomies, Post Types or Options Pages now display with the correct top padding when toggled on
* Fix - When a parent option page is set to "Redirect to Child Page", the child page will now correctly show it's parent setting
* Fix - When activated as a must-use plugin, the ACF PRO "Updates" page is now visible. Use the existing `show_updates` setting to hide
* Fix - When activated as a must-use plugin, ACF PRO licenses defined in code will now correctly activate sites
* Fix - When `show_updates` is set or filtered to false, ACF PRO will now automatically still activate defined licenses
* i18n - Maintenance and internal upstream messages from the ACF PRO activation server are now translatable
= 6.1.7 =
*Release Date 27th June 2023*
* New - Added new capability settings for ACF taxonomies
* Enhancement - Added a new `acf/field_group/auto_add_first_field` filter which can be used to prevent new field groups from automatically adding a field
* Enhancement - Field setting labels now have standard capitalization in the field group editor
* Enhancement - Clone field now has a tutorial link
* Enhancement - "Exclude From Search" CPT setting now has an improved description
* Enhancement - The `acf_get_posts()` function now has `acf/acf_get_posts/args` and `acf/acf_get_posts/results` filters
* Enhancement - Added a new `acf/options_page/save` action hook that gets fired during save of ACF Options Pages
* Fix - Taxonomies are now initialized before post types, preventing some permalink issues
* Fix - Increased the taxonomy slug maximum length to 32 characters
* Fix - Extra tabs are no longer added to PHP exports with field settings containing multiple lines
* Fix - ACF admin assets now load when editing profile and users for a multisite network
* Fix - Blocks with recursive `render_callback` functions will no longer crash the editor
* Fix - JSON files now end in a new line for better compatibility with code editors
* i18n - `layout(s)` strings in Flexible Content fields are now translatable
* i18n - Updated Polish translations