From d56711547eae9f42f07493311ec5950313ec1564 Mon Sep 17 00:00:00 2001 From: Zack Date: Mon, 13 Jul 2026 10:36:44 +0200 Subject: [PATCH 1/6] Add copy for external service explanation & link to github in Readme.txt --- readme.txt | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/readme.txt b/readme.txt index d92a794..bec0f01 100644 --- a/readme.txt +++ b/readme.txt @@ -65,6 +65,24 @@ If you do not have one yet, you can [sign up at beehiiv.com](https://www.beehiiv Once connected and configured, any post with "Send to newsletter" enabled will be queued for delivery through beehiiv when you publish (or on the scheduled date you choose). +== External services == + +This plugin connects to beehiiv services hosted at [beehiiv.com](https://www.beehiiv.com). +It is used to authenticate your account, sync publication settings, publish WordPress posts as newsletters, and embed beehiiv subscribe forms on your site. + +When you connect your account, the plugin exchanges OAuth credentials with beehiiv. When you send a post as a newsletter, post content and related newsletter settings are sent to the beehiiv API. The subscribe form loads beehiiv’s form script so visitors can join your publication. + +Terms of Use: [beehiiv.com/tou](https://www.beehiiv.com/tou) +Privacy Policy: [beehiiv.com/privacy](https://www.beehiiv.com/privacy) + + +== Getting Started == + +Plugin settings and the block editor panel include clear, contextual hints and usage notes. + +The beehiiv WordPress GitHub repository includes the uncompressed source files: [github.com/beehiiv/wordpress](https://github.com/beehiiv/wordpress). + + == Frequently Asked Questions == = Does this require a beehiiv account? = @@ -100,3 +118,6 @@ It is visible in the editor but does not render on the front end of your site. = 1.0.0 = * Initial release. + += 1.0.1 = +* Initial release. From 902945fddbe0043c1225095b720901afeadb238c Mon Sep 17 00:00:00 2001 From: Zack Date: Mon, 13 Jul 2026 11:02:12 +0200 Subject: [PATCH 2/6] Update plugin description & title text --- readme.txt | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/readme.txt b/readme.txt index bec0f01..debd4e0 100644 --- a/readme.txt +++ b/readme.txt @@ -1,4 +1,5 @@ === beehiiv === +=== beehiiv - Publish WordPress posts as newsletters and grow your audience === Contributors: beehiiv Tags: newsletter, email, publishing, beehiiv, subscribe Requires at least: 6.8 @@ -8,7 +9,7 @@ Stable tag: 1.0.0 License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html -Official beehiiv WordPress plugin. Publish WordPress posts as newsletters and grow your audience with beehiiv. +Publish WordPress posts as newsletters, grow your email subscriber lists, add signup forms, and send email marketing to your audience with beehiiv. == Description == From c85e7397fe13fbe1b73823347acc2427b7761a13 Mon Sep 17 00:00:00 2001 From: Zack Date: Mon, 13 Jul 2026 11:14:34 +0200 Subject: [PATCH 3/6] Exclude build tools files from zip --- composer.json | 33 +++++++++++++++++++++++++++++++-- package.json | 1 - 2 files changed, 31 insertions(+), 3 deletions(-) diff --git a/composer.json b/composer.json index 270430c..5ab7231 100644 --- a/composer.json +++ b/composer.json @@ -31,11 +31,12 @@ "exclude": [ "!/build", "!/includes", - "!/vendor/**", + "!/vendor/autoload.php", + "!/vendor/composer/**", "!/readme.txt", "!/beehiiv.php", - "!/composer.json", "!/languages/**", + "composer.json", "src", "/src/**", "tests", @@ -43,6 +44,32 @@ "bin", "/bin/**", "node_modules", + "/vendor/bin", + "/vendor/bin/**", + "/vendor/phpunit", + "/vendor/phpunit/**", + "/vendor/sebastian", + "/vendor/sebastian/**", + "/vendor/phar-io", + "/vendor/phar-io/**", + "/vendor/theseer", + "/vendor/theseer/**", + "/vendor/myclabs", + "/vendor/myclabs/**", + "/vendor/nikic", + "/vendor/nikic/**", + "/vendor/yoast", + "/vendor/yoast/**", + "/vendor/squizlabs", + "/vendor/squizlabs/**", + "/vendor/phpcsstandards", + "/vendor/phpcsstandards/**", + "/vendor/phpcompatibility", + "/vendor/phpcompatibility/**", + "/vendor/dealerdirect", + "/vendor/dealerdirect/**", + "/vendor/wp-coding-standards", + "/vendor/wp-coding-standards/**", ".git", ".github", "/.github/**", @@ -68,6 +95,8 @@ ".wp-env.override.json", ".gitignore", ".phpcs.xml.dist", + "phpunit.xml", + "phpunit.xml.dist", "**/*.zip", ".DS_Store", "**/.DS_Store", diff --git a/package.json b/package.json index fe0068d..633ffe2 100644 --- a/package.json +++ b/package.json @@ -24,7 +24,6 @@ "includes/", "vendor/autoload.php", "vendor/composer/", - "composer.json", "readme.txt" ], "scripts": { From b30c2b51480c9e23cefff5c1b85c8e248f9c65c6 Mon Sep 17 00:00:00 2001 From: Zack Date: Mon, 13 Jul 2026 11:31:35 +0200 Subject: [PATCH 4/6] tighten REST permission checks as recommended in plugin review --- .../REST/AdvertisementOpportunitiesController.php | 13 +++++++++++-- includes/REST/PostTemplatesController.php | 4 +++- 2 files changed, 14 insertions(+), 3 deletions(-) diff --git a/includes/REST/AdvertisementOpportunitiesController.php b/includes/REST/AdvertisementOpportunitiesController.php index bd92680..beff400 100644 --- a/includes/REST/AdvertisementOpportunitiesController.php +++ b/includes/REST/AdvertisementOpportunitiesController.php @@ -69,13 +69,22 @@ public static function register_routes(): void { /** * Permission check for advertisement requests. * + * Requires edit access to the referenced post and publish_posts (newsletter/ad UI). + * * @since 1.0.0 * + * @param WP_REST_Request $request REST request. * @return bool */ - public static function permissions_check(): bool { + public static function permissions_check( WP_REST_Request $request ): bool { + + $post_id = absint( $request->get_param( 'post_id' ) ); + + if ( ! $post_id ) { + return false; + } - return current_user_can( 'manage_options' ) || current_user_can( 'edit_posts' ); + return current_user_can( 'edit_post', $post_id ) && current_user_can( 'publish_posts' ); } /** diff --git a/includes/REST/PostTemplatesController.php b/includes/REST/PostTemplatesController.php index f1401fa..26d4fc4 100644 --- a/includes/REST/PostTemplatesController.php +++ b/includes/REST/PostTemplatesController.php @@ -65,13 +65,15 @@ public static function register_routes(): void { /** * Permission check for template requests. * + * Settings screen requires manage_options; editor template picker requires publish_posts. + * * @since 1.0.0 * * @return bool */ public static function permissions_check(): bool { - return current_user_can( 'manage_options' ) || current_user_can( 'edit_posts' ); + return current_user_can( 'manage_options' ) || current_user_can( 'publish_posts' ); } /** From 0fdf379d9b52b2daef10fc96ba7c9a9dcf4aa81d Mon Sep 17 00:00:00 2001 From: Zack Date: Mon, 13 Jul 2026 12:17:18 +0200 Subject: [PATCH 5/6] tighten REST permission checks as recommended in plugin review --- includes/REST/AdvertisementOpportunitiesController.php | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/includes/REST/AdvertisementOpportunitiesController.php b/includes/REST/AdvertisementOpportunitiesController.php index beff400..47d1685 100644 --- a/includes/REST/AdvertisementOpportunitiesController.php +++ b/includes/REST/AdvertisementOpportunitiesController.php @@ -69,7 +69,7 @@ public static function register_routes(): void { /** * Permission check for advertisement requests. * - * Requires edit access to the referenced post and publish_posts (newsletter/ad UI). + * Requires edit access to the referenced post (Contributors included for drafts). * * @since 1.0.0 * @@ -80,11 +80,7 @@ public static function permissions_check( WP_REST_Request $request ): bool { $post_id = absint( $request->get_param( 'post_id' ) ); - if ( ! $post_id ) { - return false; - } - - return current_user_can( 'edit_post', $post_id ) && current_user_can( 'publish_posts' ); + return $post_id && current_user_can( 'edit_post', $post_id ); } /** From 069c078934d479e1b7fccfb1f13d29218ce1f3be Mon Sep 17 00:00:00 2001 From: Zack Date: Mon, 13 Jul 2026 12:24:15 +0200 Subject: [PATCH 6/6] Remove duplicate changelog --- readme.txt | 3 --- 1 file changed, 3 deletions(-) diff --git a/readme.txt b/readme.txt index debd4e0..942a011 100644 --- a/readme.txt +++ b/readme.txt @@ -119,6 +119,3 @@ It is visible in the editor but does not render on the front end of your site. = 1.0.0 = * Initial release. - -= 1.0.1 = -* Initial release.