New updates for GEO Plugin by Squirrly SEO + Advanced Pack
= 2.5.05 =
Security
* Fixed SQL injection in the JSON-LD schema queries: the schema type, the url hash and the
search term were concatenated into the query instead of being bound, so a crafted schema
type posted by a user who can manage snippets could change which rows were read and written.
Every value is now bound with $wpdb->prepare().
* Fixed ORDER BY injection in the reusable schema and redirect lists: the sort column and the
direction now have to match a whitelist.
* The redirect and redirect log queries use bound parameters as well, and LIKE searches escape
their wildcards, so a "%" in a search no longer matches everything.
* A schema type is validated as a schema.org word before it reaches the markup, and URL fields
drop any protocol WordPress does not allow, so a "javascript:" value can no longer be
published in a schema or in the @id built from it.
Schema
* Fixed decimal ratings being truncated: a 4.4 rating was published as 4. Ratings typed with a
comma ("4,4") are normalised to the separator Google expects.
* Added Review Count to Aggregate Rating. Google accepts either a rating count or a review
count, so neither is required on its own now, and the form says when both are missing.
* An empty field is no longer published at all, at any depth of the schema. A field left blank
used to reach the markup as "isbn": false or "contactType": "", which Google reports as
invalid, and a group with nothing in it was published empty. A property Google does not find
costs nothing, so they are left out instead. A real 0 is still data and is kept.
* Example values shown in the schema forms are no longer saved as data. Opening a form and
saving it used to publish "0" as a product's GTIN, MPN and ISBN, "USD" as its currency, "US"
and "NY" as its shipping destination and "General Admission" as an event's ticket name. They
stay visible as input hints. Real defaults, like the 1 to 5 rating scale, still pre-fill.
* Fixed the reusable schema list failing to count when no filter was applied.
Saving a schema
* Fixed a schema that could not be saved and gave no reason. A required field left empty stops
the browser from submitting the form, and the field is usually scrolled out of sight inside
the dialog, so the Save button looked dead. The dialog now says which is missing and scrolls
to it.
* A Product no longer demands a price and a full set of pros and cons before it can be saved:
Google treats those as optional, and an offer with nothing in it is now left out of the
markup entirely. A Book no longer demands an ISBN and a language for the same reason.
* Saving a reusable schema without a name now says so instead of failing silently.
Review snippet
* The "Review For" picker covers every item type Google accepts for review stars: 113 types
grouped by what they are, replacing the 11 that were there before. Theatres are covered from
three sides - the venue, the company and the performance.
* An item that only qualifies with a second type now gets one, so a theatre venue is published
as PerformingArtsTheater and EntertainmentBusiness, and a car as Car and Product.
* Added a choice between publishing the rating as a node of its own and nesting it on the
reviewed item. Nesting attaches it to an entity the page already describes, when there is
one, instead of describing the same thing twice.
* The form warns when a rating is above its own maximum, and when the reviewed item is the site
itself: Google does not show stars for a business or organization reviewing itself.
Security
* Fixed SQL injection in the JSON-LD schema queries: the schema type, the url hash and the
search term were concatenated into the query instead of being bound, so a crafted schema
type posted by a user who can manage snippets could change which rows were read and written.
Every value is now bound with $wpdb->prepare().
* Fixed ORDER BY injection in the reusable schema and redirect lists: the sort column and the
direction now have to match a whitelist.
* The redirect and redirect log queries use bound parameters as well, and LIKE searches escape
their wildcards, so a "%" in a search no longer matches everything.
* A schema type is validated as a schema.org word before it reaches the markup, and URL fields
drop any protocol WordPress does not allow, so a "javascript:" value can no longer be
published in a schema or in the @id built from it.
Schema
* Fixed decimal ratings being truncated: a 4.4 rating was published as 4. Ratings typed with a
comma ("4,4") are normalised to the separator Google expects.
* Added Review Count to Aggregate Rating. Google accepts either a rating count or a review
count, so neither is required on its own now, and the form says when both are missing.
* An empty field is no longer published at all, at any depth of the schema. A field left blank
used to reach the markup as "isbn": false or "contactType": "", which Google reports as
invalid, and a group with nothing in it was published empty. A property Google does not find
costs nothing, so they are left out instead. A real 0 is still data and is kept.
* Example values shown in the schema forms are no longer saved as data. Opening a form and
saving it used to publish "0" as a product's GTIN, MPN and ISBN, "USD" as its currency, "US"
and "NY" as its shipping destination and "General Admission" as an event's ticket name. They
stay visible as input hints. Real defaults, like the 1 to 5 rating scale, still pre-fill.
* Fixed the reusable schema list failing to count when no filter was applied.
Saving a schema
* Fixed a schema that could not be saved and gave no reason. A required field left empty stops
the browser from submitting the form, and the field is usually scrolled out of sight inside
the dialog, so the Save button looked dead. The dialog now says which is missing and scrolls
to it.
* A Product no longer demands a price and a full set of pros and cons before it can be saved:
Google treats those as optional, and an offer with nothing in it is now left out of the
markup entirely. A Book no longer demands an ISBN and a language for the same reason.
* Saving a reusable schema without a name now says so instead of failing silently.
Review snippet
* The "Review For" picker covers every item type Google accepts for review stars: 113 types
grouped by what they are, replacing the 11 that were there before. Theatres are covered from
three sides - the venue, the company and the performance.
* An item that only qualifies with a second type now gets one, so a theatre venue is published
as PerformingArtsTheater and EntertainmentBusiness, and a car as Car and Product.
* Added a choice between publishing the rating as a node of its own and nesting it on the
reviewed item. Nesting attaches it to an entity the page already describes, when there is
one, instead of describing the same thing twice.
* The form warns when a rating is above its own maximum, and when the reviewed item is the site
itself: Google does not show stars for a business or organization reviewing itself.