diff --git a/README.md b/README.md index 8e4c71a8c..c2ac19528 100644 --- a/README.md +++ b/README.md @@ -5,7 +5,7 @@ **Requires at least:** 5.6 **Requires PHP:** 7.4 **Tested up to:** 7.1 -**Stable tag:** 2.20.3 +**Stable tag:** 2.20.4 **License:** GPLv2 or later **License URI:** https://www.gnu.org/licenses/gpl-2.0.html @@ -124,6 +124,10 @@ Our external packages use [Rating Star Component](https://github.com/n49/react-s Spectra Legacy receives maintenance updates only: security fixes, WordPress and PHP compatibility, and critical bug fixes. New features ship in Spectra Blocks. +### 2.20.4 - Monday, 28th September 2026 ### +* Fix: This update addressed a security bug. Props to Wordfence for reporting it responsibly to our team. Please make sure you are using the latest version on your website. +* Fix: Resolved a performance issue where saving navigation menus could trigger unnecessary asset cache regeneration. + ### 2.20.3 - Wednesday, 26th August 2026 ### * Fix: This update addressed a security bug. Props to Manisha Dilshan for the responsible disclosure. Please make sure you are using the latest version on your website. diff --git a/classes/class-uagb-caching.php b/classes/class-uagb-caching.php index f00e774f8..a24fea1e6 100644 --- a/classes/class-uagb-caching.php +++ b/classes/class-uagb-caching.php @@ -59,6 +59,16 @@ public function __construct() { * @return void */ public function clear_cache() { + // Purge the host cache at most once per request. Multiple block posts + // saved in one request would otherwise each trigger a full purge, and + // each Breeze purge stacks another Breeze_Admin instance/hook, so the + // work compounds with every post in the request. See #6082. + static $cache_cleared = false; + if ( $cache_cleared ) { + return; + } + $cache_cleared = true; + self::clear_siteground_cache(); self::clear_cloudways_cache(); } diff --git a/classes/class-uagb-fse-fonts-compatibility.php b/classes/class-uagb-fse-fonts-compatibility.php index 62f05400f..eca82086f 100644 --- a/classes/class-uagb-fse-fonts-compatibility.php +++ b/classes/class-uagb-fse-fonts-compatibility.php @@ -94,6 +94,11 @@ public function __construct() { return; } + // Bail if the request is not from a logged-in admin. This routine deletes theme font files and rewrites theme.json, so it must never run for unauthenticated or unprivileged visitors. + if ( ! is_admin() || ! current_user_can( 'manage_options' ) ) { + return; + } + $uagb_filesystem = uagb_filesystem(); $fonts_folder_path = get_stylesheet_directory() . '/assets/fonts/spectra'; diff --git a/classes/class-uagb-helper.php b/classes/class-uagb-helper.php index 0fd0285d0..830013953 100755 --- a/classes/class-uagb-helper.php +++ b/classes/class-uagb-helper.php @@ -1531,6 +1531,12 @@ public static function get_combined_selectors( $block_name, $selectors, $attr ) * @since 1.23.0 */ public static function delete_page_assets( $post_id ) { + // Autosaves and revisions are not user-facing saves, so skip them to + // avoid needless asset regeneration and host cache purges. + if ( wp_is_post_autosave( $post_id ) || wp_is_post_revision( $post_id ) ) { + return; + } + $current_post_type = get_post_type( $post_id ); if ( 'wp_template_part' === $current_post_type || 'wp_template' === $current_post_type ) { @@ -1544,6 +1550,16 @@ public static function delete_page_assets( $post_id ) { return; } + // Bail for post types that never carry Spectra block assets but can + // be written many times in a single request. WordPress saves one + // nav_menu_item per menu item, so without this a large-menu save + // fires a full asset delete and host cache purge once per item and + // times out. See #6082. Filterable so other such types can opt out. + $skip_post_types = (array) apply_filters( 'uagb_delete_page_assets_skip_post_types', array( 'nav_menu_item' ) ); + if ( in_array( $current_post_type, $skip_post_types, true ) ) { + return; + } + $unique_ids = get_option( '_uagb_fse_uniqids' ); if ( ! empty( $unique_ids ) && is_array( $unique_ids ) ) { foreach ( $unique_ids as $id ) { diff --git a/classes/class-uagb-loader.php b/classes/class-uagb-loader.php index 5063aaa44..52a862a1d 100644 --- a/classes/class-uagb-loader.php +++ b/classes/class-uagb-loader.php @@ -140,7 +140,7 @@ public function define_constants() { define( 'UAGB_BASE', plugin_basename( UAGB_FILE ) ); define( 'UAGB_DIR', plugin_dir_path( UAGB_FILE ) ); define( 'UAGB_URL', plugins_url( '/', UAGB_FILE ) ); - define( 'UAGB_VER', '2.20.3' ); + define( 'UAGB_VER', '2.20.4' ); define( 'UAGB_MODULES_DIR', UAGB_DIR . 'modules/' ); define( 'UAGB_MODULES_URL', UAGB_URL . 'modules/' ); define( 'UAGB_SLUG', 'spectra' ); diff --git a/languages/ultimate-addons-for-gutenberg.pot b/languages/ultimate-addons-for-gutenberg.pot index d3869dc5d..6d1c8b90e 100644 --- a/languages/ultimate-addons-for-gutenberg.pot +++ b/languages/ultimate-addons-for-gutenberg.pot @@ -2,7 +2,7 @@ # This file is distributed under the same license as the Spectra plugin. msgid "" msgstr "" -"Project-Id-Version: Spectra 2.20.3\n" +"Project-Id-Version: Spectra 2.20.4\n" "Report-Msgid-Bugs-To: https://wordpress.org/support/plugin/ultimate-addons-for-gutenberg\n" "Last-Translator: FULL NAME \n" "Language-Team: LANGUAGE \n" diff --git a/package-lock.json b/package-lock.json index 83a0642d4..aaefc43fb 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "ultimate-addons-for-gutenberg", - "version": "2.20.3", + "version": "2.20.4", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "ultimate-addons-for-gutenberg", - "version": "2.20.3", + "version": "2.20.4", "license": "ISC", "dependencies": { "@bsf/force-ui": "git+https://github.com/brainstormforce/bsf-admin-ui#v1.7.7", diff --git a/package.json b/package.json index 126160187..5775b7ff8 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "ultimate-addons-for-gutenberg", - "version": "2.20.3", + "version": "2.20.4", "description": "The Ultimate Addons for Gutenberg extends the Gutenberg functionality with several unique and feature-rich blocks that help build websites faster.", "author": "Brainstorm Force", "license": "ISC", diff --git a/readme.txt b/readme.txt index 905167baa..02ce49a16 100644 --- a/readme.txt +++ b/readme.txt @@ -5,7 +5,7 @@ Tags: gutenberg, blocks, gutenberg blocks, editor, block Requires at least: 5.6 Requires PHP: 7.4 Tested up to: 7.1 -Stable tag: 2.20.3 +Stable tag: 2.20.4 License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html @@ -124,6 +124,10 @@ Our external packages use [Rating Star Component](https://github.com/n49/react-s Spectra Legacy receives maintenance updates only: security fixes, WordPress and PHP compatibility, and critical bug fixes. New features ship in Spectra Blocks. += 2.20.4 - Monday, 28th September 2026 = +* Fix: This update addressed a security bug. Props to Wordfence for reporting it responsibly to our team. Please make sure you are using the latest version on your website. +* Fix: Resolved a performance issue where saving navigation menus could trigger unnecessary asset cache regeneration. + = 2.20.3 - Wednesday, 26th August 2026 = * Fix: This update addressed a security bug. Props to Manisha Dilshan for the responsible disclosure. Please make sure you are using the latest version on your website. diff --git a/ultimate-addons-for-gutenberg.php b/ultimate-addons-for-gutenberg.php index 306a966e0..6f5aa743b 100644 --- a/ultimate-addons-for-gutenberg.php +++ b/ultimate-addons-for-gutenberg.php @@ -4,7 +4,7 @@ * Plugin URI: https://www.brainstormforce.com * Author: Brainstorm Force * Author URI: https://www.brainstormforce.com - * Version: 2.20.3 + * Version: 2.20.4 * Description: The Spectra extends the Gutenberg functionality with several unique and feature-rich blocks that help build websites faster. * Text Domain: ultimate-addons-for-gutenberg * Domain Path: /languages