ROBOTSTXT Software

Documentation Markdown (by ROBOTSTXT)

Synchronize Markdown documentation from GitHub repositories to WordPress pages and posts automatically.

Information

Author:

ROBOTSTXT

Download

Price:

€0.00

Requirements

Version:

1.2.0

WordPress:

6.8

–

7.1

PHP >=

8.0

Changelog

1.2.0

Release date: 2026-08-07

Highlights

  • New: synced post title is taken from the first H1 in the Markdown (and stripped from the body)
  • New: repo-relative links are rewritten to the matching WordPress permalink
  • New: repository images are sideloaded into the Media Library and referenced by attachment URL
  • All deferred findings from the 1.1.1 pre-deploy audit resolved
  • GitHub token encryption hardened with HKDF-SHA256 key derivation (with transparent migration of existing tokens)
  • CSRF nonce added to the Discover Files “Refresh” action
  • Minimum WordPress raised to 6.8; verified compatible with WordPress 7.1; PHP minimum declarations made consistent at 8.0 across all files

Added

  • Title from H1: the synced post title is now taken from the first # H1 heading in the Markdown (inline formatting stripped to plain text), with the H1 removed from the body to avoid a duplicate heading. Falls back to the filename-derived title when no H1 is present
  • Internal link translation: repo-relative Markdown links (e.g. ./api.md, ../README.md) are rewritten to the permalink of the matching mapped WordPress content. External, mailto:, and anchor links are left untouched; links with no matching mapping keep their original URL
  • Repository image sideloading: images referenced in the Markdown are downloaded from the repository, added to the Media Library, and their references replaced with the attachment URL. Already-imported images are reused on subsequent syncs (tracked per post); removed images are kept in the Media Library (non-destructive)

Security

  • Patched CVE-2026-71478 (and advisory GHSA-2q4p-g7hv-5rgv) in league/commonmark — an unsafe-link filter bypass that could defeat allow_unsafe_links: false. Updated league/commonmark 2.8.2 → 2.9.0
  • GitHub token encryption now derives its AES-256 key with HKDF-SHA256 from wp_salt('auth') instead of using the salt directly; existing tokens are migrated transparently to the new v2: format on first decrypt (covers the cron path too)
  • Discover Files “Refresh from GitHub” action is now nonce-protected — previously a crafted link could force an unrequested GitHub API call (CSRF)
  • GitHub API request paths are now rawurlencode()d (defensive hardening)
  • Sideloaded images are validated by extension (jpg, jpeg, png, gif, webp) and size (< 10 MB) before storage; SVG is intentionally excluded

Fixed

  • "Using cached data / fetching fresh data" indicator on Discover Files now reflects reality — it always showed "cached" because the cache was tested after being populated
  • target_post_type is now validated against registered public post types on save, falling back to page
  • Debug action dispatch refactored into a single switch, each case retaining its check_admin_referer() check, to reduce the chance of a missing nonce check

Changed

  • Inline onclick confirm on Delete replaced with a data-confirm attribute + delegated handler (CSP-friendlier, less fragile)
  • Add Mapping "existing content" dropdown now queries only public post types (excludes attachments and the internal mapping CPT) with no_found_rows for better performance on large sites

Compatibility

  • WordPress: 6.8 – 7.1
  • PHP: 8.0 – 8.5
  • MariaDB: 11.4 or newer

Developer

  • Added bin/preflight.sh — automated pre-deploy gate (PHPCS, PHPStan 9, PHPCompatibility, PHPUnit, composer audit, candidate-ZIP inspection); PASS/FAIL report per section, never invokes deploy.sh
  • Added .claude/settings.json deny rules (deploy.sh, git push/tag/merge) enforcing the AGENTS.md operating boundaries mechanically
  • composer.json require-dev completed and pinned: added dealerdirect/phpcodesniffer-composer-installer + phpcsstandards/phpcsutils; pinned squizlabs/php_codesniffer and johnbillion/wp-compat
  • Patched two high-severity CVEs in dev tooling (not shipped — deploy.sh uses --no-dev): squizlabs/php_codesniffer 3.13.5 → 3.13.6 (CVE-2026-67434), wp-coding-standards/wpcs 3.3.0 → 3.4.1 (CVE-2026-45293). composer audit fully clean

Tests

  • PHP Coding Standards: PHPCS with WordPress-Core, WordPress-Docs, WordPress-Extra — 0 errors
  • PHPStan: level 9, 0 errors
  • PHPCompatibility: PHP 8.0-8.5 validated
  • PHPUnit: plugin header tests pass
  • Manual testing: WordPress 7.1

1.1.1

Release date: 2026-06-08

Highlights

  • Security hardening: CommonMark raw HTML passthrough disabled, encrypted token no longer autoloaded, HMAC now uses wp_json_encode() instead of serialize()
  • Bug fix: admin notices now visible for all operations (sync, create, update, delete, errors)
  • Infrastructure: full dev tooling added (PHPCS, PHPStan, PHPUnit, deploy script)
  • Real PHP minimum corrected to 8.0 (confirmed by PHPCompatibility 10.x scan)

Security

  • CommonMark: disabled raw HTML passthrough (html_input: strip, allow_unsafe_links: false) — prevents stored XSS if an upstream repository is compromised
  • Settings option now stored with autoload = false — encrypted GitHub token no longer loaded on every WordPress request (defense in depth)
  • Replaced serialize() with wp_json_encode() in updater HMAC cache (eliminates PHPCS object-injection warning)
  • Added strict base64 length validation before IV extraction in robotstxt_docmd_decrypt_token()
  • Added base64_decode() strict return-value check in robotstxt_docmd_get_file_content()

Fixed

  • Admin notices now display results for all operations: mapping created, mapping updated, mapping deleted, sync complete, and error messages — previously only "Settings saved" was shown
  • wp_update_post() return value now checked during sync — silent post-update failures were previously reported as success
  • Wrong textdomain 'robotstxt-smtp' in updater class corrected to 'robotstxt-documentation-markdown'

Changed

  • robotstxt-updater.php renamed to class-robotstxt-updater.php (WordPress file-naming convention)
  • Minimum PHP version header corrected from 8.2 to 8.0 (real minimum confirmed by PHPCompatibility 10.0.0-alpha2 scan — union types, str_starts_with(), str_contains(), and mixed type are the binding constraints)

Developer

  • Added composer.json with full require-dev tooling (PHPCS, PHPStan 2.x, PHPUnit 9.6, PHPCompatibility 10.0.0-alpha2, wp-compat, yoast/phpunit-polyfills)
  • Added phpstan.neon (level 9), .phpcs.xml (WordPress-Core/Docs/Extra), bin/deploy.sh, phpunit.xml.dist
  • PHPUnit: 17 plugin header tests added (tests/PluginHeadersTest.php)
  • Added docs/known-issues.md and docs/db-migrations.md
  • class-robotstxt-updater.php: PHPCS 0 errors, PHPStan level 9 0 errors (full compliance)

Compatibility

  • WordPress: 6.7 – 7.1
  • PHP: 8.0 – 8.5
  • MariaDB: 11.4 or newer

Tests

  • PHP Coding Standards: PHPCS 3.x with WordPress-Core, WordPress-Docs, WordPress-Extra — 0 errors, 0 warnings
  • WordPress Coding Standards: WPCS 3.3.0
  • PHPStan: level 9, 0 errors (szepeviktor/phpstan-wordpress 2.0.3)
  • PHPCompatibility: 10.0.0-alpha2 — PHP 8.0-8.5 validated
  • PHPUnit: 17/17 tests pass (plugin header tests)
  • Manual testing: WordPress 7.0, 7.1

1.1.0

Release date: 2026-03-28

Highlights

  • Editor-level access: editors can now manage documentation mappings without administrator privileges
  • Full PHPStan level 9 compliance — zero errors across all plugin files
  • Security patch for two CVEs in league/commonmark
  • target_order (menu_order) field fully implemented end-to-end

Security

  • Patched CVE-2026-33347 and CVE-2026-30838 by upgrading league/commonmark to 2.8.2

Changed

  • Access level changed from manage_options (administrator) to edit_pages (editor) across all admin pages, form handlers, and debug functions
  • robotstxt_docmd_debug_run_cron() now has a typed int $mapping_id parameter

Fixed

  • PHPStan level 9: replaced all implicit mixed casts with proper type-narrowing via is_string(), is_int(), and is_numeric() guards
  • New robotstxt_docmd_input_string() and robotstxt_docmd_input_int() helpers used for all superglobal ($_POST, $_GET) access
  • MappingData and MappingInput global type aliases defined in phpstan.neon — file-level @phpstan-type aliases do not propagate between files in PHPStan 2.x procedural code
  • target_order field was rendered in the form UI but never saved to post meta or applied during sync — now fully implemented
  • openssl_decrypt() false return properly handled in token decryption
  • get_edit_post_link() null return handled safely in debug run-cron output
  • Redundant isset() guards removed on statically-typed array shapes
  • Uninstall handler narrows get_option() mixed return before array access
  • size_format() false return handled in discover-page file list
  • Settings and debug functions use is_array() narrowing on get_option() before accessing keys
  • json_decode() results in GitHub debug functions fully type-narrowed before key access

Developer Features

  • PHPStan level 9: 0 errors (down from 104 in v1.0.0)
  • phpstan.neon now includes global MappingData and MappingInput type aliases
  • robotstxt-updater.php moved to bootstrapFiles in PHPStan config to avoid strict analysis of shared utility
  • $default parameter renamed to $fallback in helpers (reserved keyword warning)
  • Short ternary (?:) replaced with explicit false !== check (PHPCS rule)

Compatibility

  • WordPress: 6.7 – 7.0
  • PHP: 8.2 – 8.4 (verified on PHP 8.4.x)
  • MariaDB: 10.6 or newer

Dependencies

  • league/commonmark: 2.8.0 → 2.8.2 (security patch)
  • eduardovillao/wp-since: 1.3.0 → 1.4.0
  • phpunit/phpunit held at ^10.5 (v13.x available; pending test suite migration)
  • squizlabs/php_codesniffer held at ^3.13 (v4.x available; pending WPCS 4.x confirmation)

Tests

  • PHP Coding Standards: PHPCS 3.x with WordPress-Extra ruleset — 0 errors, 0 warnings
  • WordPress Coding Standards: WPCS 3.3
  • PHPStan: level 9, 0 errors (szepeviktor/phpstan-wordpress extension)
  • PHPCompatibility: PHP 8.2 – 8.4 validated
  • Manual testing: WordPress 6.8, 7.0

1.0.0

Release date: 2026-01-26

Highlights

  • Initial release of Documentation Markdown plugin
  • Automatic synchronization of Markdown files from GitHub to WordPress
  • Full support for GitHub Flavored Markdown
  • Encrypted GitHub token storage
  • Flexible mapping system for multiple repositories

Added

  • Core synchronization functionality between GitHub and WordPress
  • Automatic scheduled sync (hourly, twice daily, daily)
  • Manual on-demand sync via admin interface
  • Markdown to HTML conversion using CommonMark (league/commonmark)
  • Flexible file-to-content mapping system
  • Custom Post Type (robotstxt_map) for mapping management
  • Encrypted GitHub token storage (AES-256-CBC)
  • Full internationalization support (i18n/l10n ready)
  • Multi-repository support
  • Clean admin interface with status badges
  • Support for pages, posts, and custom post types as sync targets
  • Configurable post author and parent page
  • Page order (menu_order) support
  • Debug tools for troubleshooting (visible when WP_DEBUG enabled)
  • Cron job management and repair tools
  • Clean uninstall with optional data deletion
  • Settings page for GitHub configuration
  • Mappings management interface (list, add, edit, delete)
  • Sync status monitoring with timestamps
  • Rate limiting awareness for GitHub API
  • Cache system using WordPress Transients API

Security

  • All user input sanitized using WordPress functions
  • All output escaped (esc_html, esc_attr, esc_url)
  • Nonce verification on all forms and actions
  • Capability checks for all admin actions (manage_options — changed to edit_pages in 1.1.0)
  • Prepared statements for all database queries
  • GitHub tokens encrypted at rest using AES-256-CBC
  • OWASP Top 10 mitigation implemented
  • Direct access prevention on all PHP files
  • CSRF protection on all state-changing operations
  • XSS prevention through proper escaping
  • SQL injection prevention through prepared statements

Developer Features

  • Procedural PHP architecture following KISS principles
  • PHP 8.2+ modern features (typed parameters, match expressions)
  • Complete PHPDoc documentation on all functions
  • WordPress Coding Standards (WPCS) compliant
  • PHPCS/WPBF validated (0 errors, 0 warnings)
  • Extensible architecture with WordPress hooks
  • Clean, well-documented codebase
  • Composer-based dependency management
  • Production-optimized deployment script (bin/deploy.sh)

Compatibility

  • WordPress: 6.7 – 6.9
  • PHP: 8.2 – 8.5
  • MariaDB: 10.6 or newer

Tests

  • PHP Coding Standards: PHPCS 3.x with WordPress-Extra ruleset
  • WordPress Coding Standards: WPCS 3.3
  • PHPCompatibility: PHP 8.2 – 8.5 validated
  • Security Audit: Complete OWASP Top 10 coverage
  • Manual testing: WordPress 6.7, 6.8, 6.9