Post Status Notifier v1.13.1
Security
Tightened the admin XSS fix from 1.13.0 with an input-side sanitisation step. The mod, controller and action query parameters that drive the admin router are now restricted to [A-Za-z0-9_-] before any downstream code reads them. Complements the output escape that already shipped in 1.13.0.
The selftest repair action (“Fix it” on the overview page) now requires a nonce. It performs database schema changes but previously ran on any GET request carrying a test id, so a crafted link could make a logged-in administrator’s browser trigger a schema repair (CSRF). The requested test id is validated as well, and the request is rejected when it does not resolve to a registered selftest.
The custom recipient of the test email is now validated with sanitize_email() and is_email(). It was previously passed through esc_attr(), which is an HTML output escaper and neither rejects malformed addresses nor mail header injection characters. A missing field no longer raises a PHP warning.
Improvements
Modernised the icons in the notification rule lists (dashboard overview and Rules screen). The legacy PNG sprites have been replaced with the icons WordPress ships with, so the lists match the look of the current admin interface: green check / grey cross for the active state and clean icons for the e-mail service, the log service and the category filter.
The rule list icons now carry screen-reader labels, and their tooltips also work on the dashboard overview, where they were previously missing.
Compliance
Pass over the plugin and the bundled framework against the WordPress Plugin Check guidelines – added the missing ABSPATH guards, escaped exception messages at the throw site, switched a handful of admin echoes to their esc_* counterparts, and routed installer SQL through $wpdb->prepare() where applicable. No behaviour change.
Compatibility
Tested up to WordPress 7.0.
