kURL – Short URL Manager for YOURLS

1.0.9

• WordPress 7.1 compatibility maintenance; no functional behavior was changed.
• Reviewed against the WordPress 7.1 editor iframe, client-side image processing, and jQuery UI changes; those code paths are not used by the plugin.

1.0.8

• Performance: Load the large admin and bulk classes only for WordPress admin, AJAX, and admin-post requests.
• Performance: Helper-version verification now runs through protected background AJAX after admin pages render instead of blocking the page-load path.
• Safety: Helper-dependent mutations keep their server-side verification gate; background status changes update the visible controls without reloading or discarding unsaved editor/settings changes.

1.0.7

• Treats YOURLS error:url responses containing a valid existing short URL as a usable result whether YOURLS delivers them with HTTP 200, 400, or 409. This improves compatibility across YOURLS releases and prevents false creation failures when a long URL already exists.
• Completes the bundled German translation for the current administration interface.
• The bundled YOURLS helper remains version 1.1.5; no helper update is required for this WordPress-side API fix.

1.0.6

• Prevents a saved YOURLS signature from being reused or transmitted when the API endpoint is changed without entering the new endpoint’s token.
• Normalizes all API requests to a query-free yourls-api.php endpoint so URL parameters cannot override the authenticated POST action or response format.
• Requires the exact bundled helper version and capabilities before helper-dependent actions run; helper 1.1.5 is included in this release.
• Blocks dashboard deletion, regeneration, and in-place updates while a short URL is referenced by WordPress posts.
• Validates target and short URLs as complete HTTP(S) URLs throughout the plugin and rejects ambiguous encoded keywords before remote mutations.
• Makes helper deletion and regeneration check the exact extracted keyword rather than a potentially different full-URL host alias.
• Adds stricter helper URL validation and GPL metadata, retains the complete bounded log window, removes invalid local URL metadata atomically, and guarantees temporary query filters are removed.
• Keeps editor keyword fields synchronized with the actual keyword returned by YOURLS and uses an accurate confirmation message for dashboard-only deletion.
• Documents the administrator-configured YOURLS service and the data sent to it, handles common pasted YOURLS admin/API URLs, preserves a working connection when a malformed replacement endpoint is submitted, validates regeneration and dashboard statistics URLs through the same central HTTP(S) rules, and reports invalid URL records removed by cleanup.
• Makes helper 1.1.5 refuse delete, preferred-lookup, and regeneration requests whose supplied short URL is not recognized by the configured YOURLS installation, preventing an unrelated host with the same final path segment from identifying a destructive target.
• Locks bulk post type, batch size, and overwrite mode while a batch job is running so one job cannot switch data sets or mutation policy between requests.
• Rejects array-shaped request fields and malformed capability lists cleanly on both WordPress and YOURLS, instead of allowing PHP warnings or type errors to corrupt an API response.
• Removes the WordPress site URL from the outbound API user agent, invalidates legacy metadata caches through the WordPress metadata API, and refuses symlinked log paths during cleanup.
• Detects equivalent stored short-URL spellings before mutations, waits for an in-flight AJAX batch to finish before a stopped job can restart, bounds helper verification requests, and prevents cookies or malformed stored/remote values from influencing helper actions.

1.0.5

• Bundles the YOURLS helper source inside the single WordPress plugin package and serves it from Settings as an installable plugin.php file.
• Adds a protected Download bundled plugin.php button and retains the copy-to-clipboard option on the Settings page; no separate helper ZIP is needed.
• Automatically rechecks the helper immediately after every kURL update and at least once per day.
• Revalidates the helper within a short window before helper-dependent actions, instead of trusting an old saved detection flag.
• Compares the installed helper version and advertised capabilities with the version bundled in the current WordPress release.
• Disables remote deletion, reverse lookup, regeneration, overwrite, and helper-based reconciliation when the helper is outdated, unversioned, incomplete, or no longer reachable.
• Shows an administrator notice with a direct link to the built-in helper installation/update instructions when an outdated helper is detected.

1.0.4

• Reworked the YOURLS helper as version 1.1.0. It reports its version and capabilities, uses YOURLS-native keyword and URL handling, preserves case-sensitive base-62 keywords, checks whether a database deletion actually succeeded, and uses official YOURLS lookup functions.
• Replaced delete-then-create regeneration with yourls_edit_link(). A failed replacement now leaves the existing short URL intact and preserves its click count.
• Detects outdated or unversioned helpers and always shows the replacement helper code until the required version is installed.
• Tests unsaved API credentials without overwriting a working saved connection. The signature token is no longer rendered into the settings-page HTML.
• Uses WordPress safe HTTP requests by default to reduce SSRF risk. Private-network YOURLS installations can explicitly opt in through the kurl_allow_private_api_url filter.
• Improved empty, HTML, and otherwise invalid JSON response diagnostics.
• Verifies a saved short URL before reverse lookup so duplicate long URLs in YOURLS do not silently replace a correct local link.
• Fixed Better YOURLS bulk import mode: legacy links are now distinguished from links already managed by kURL, so the import mode can actually migrate them. Bulk overwrite now uses safe helper-based regeneration.
• Scoped the bulk and reconciliation cursor filters to their own WP_Query instances, preventing unrelated nested queries from inheriting the batch cursor.
• Prevented sync and reconciliation from creating replacements or reporting mismatches when verification failed because of a transient API, network, proxy, or authentication error.
• Distinguishes a YOURLS “short URL not found” response from an HTML or empty endpoint 404, so a wrong API path is not treated as a missing link.
• Preserves legacy Better YOURLS links during automatic publish handling, clears the legacy fallback after an explicit unlink, and stores the actual returned keyword for generated links.
• Keeps a successfully created link when YOURLS adjusts a requested keyword, instead of leaving an untracked remote link after reporting a local error.
• Fixed both “Generate / Update” controls so an existing short URL is edited in place through the safe helper instead of calling the create endpoint again.
• Prevents post-specific deletion and overwrite from breaking another WordPress post that references the same short URL; shared links are retained or blocked for review.
• Makes deletion idempotent: a missing remote entry can be unlinked cleanly, and an outdated helper no longer blocks the editor’s explicitly local-unlink fallback. Shared-link checks preserve case-sensitive base-62 keywords even on case-insensitive WordPress database collations.
• Prevents API request parameters from overriding the configured signature, action, or JSON format.
• Corrected the editor keyword field’s malformed readonly attribute and aligned remote deletion with WordPress’s destructive post capability.
• Hardened log storage with a non-guessable filename, removed the old predictable log after migration, redacted API secrets from captured error bodies, added IIS protection, corrected the documented Nginx path, and made the dashboard count match the seven-day retention window.
• Added explicit bundled translation loading, safer endpoint normalization, a bounded API timeout, structured AJAX permission errors, and several smaller consistency checks for enabled post types and API responses.
• Random helper regeneration no longer changes YOURLS’s shared next-ID counter, avoiding a counter rollback race between concurrent requests.