LDAP Staff Directory

Endringslogg

1.2.1

• Fix: Resolved WordPress Plugin Checker warnings — unescaped output in the settings row info-button helper and non-sanitized $_POST access in the test-connection AJAX handler (both were already safe at runtime; this satisfies static analysis).

1.2.0

• Feature: Settings page redesigned as 3 independently-saved tabs — Connection, Employees, Fields — so administrators without LDAP experience are guided through only what’s relevant, instead of one long technical form.
• Feature: Plain-language help popovers next to Bind DN, Bind Password, and Base OU, explaining what each value means without assuming LDAP knowledge.
• Feature: Collapsible «Advanced settings» section on the Connection and Fields tabs, hiding rarely-touched options (SSL verification, CA certificate, cache TTL) behind a single click.
• Feature: «Copy request for IT» button on the Connection tab — copies a ready-made message listing exactly what to ask whoever manages your LDAP server for.
• Feature: «Test Connection» now validates whatever is currently typed in the Connection tab, including unsaved changes, instead of only the last-saved settings.
• Improvement: The WordPress security-key rotation notice now links directly to the Connection tab with the Bind Password field focused.
• Improvement: «Exclude disabled accounts» moved from Connection to the Employees tab, alongside the other employee-visibility filters. The Extension attribute field now only appears once «Extension» is checked in Fields to Show, instead of always showing under Advanced settings.

1.1.4

• Feature: New LDAP/LDAPS scheme selector in Settings, separate from the server field. Changing it updates the port field’s placeholder to the matching default (389/636) without overwriting a port you’ve already customized.
• Feature: The Server field now accepts only the domain (no more embedded ldap://ldaps:// prefix). Existing installs migrate automatically — the connection keeps working and the field displays cleanly even before the settings form is resaved.
• Feature: Show/hide toggle for the Bind Password field, to verify what you’re typing before saving. Never exposes a password that’s already saved.

1.1.3

• Feature: Exclude specific departments from the public directory. The settings page can now discover every department value present in LDAP (with employee counts) via a «Refresh department list» button, and the admin can select which ones to hide. Excluded departments are removed at the LDAP query level — their employees are never fetched from the server.
• Feature: Optionally exclude employees with no department assigned, as a separate control from the department checklist.
• Feature: Configurable order for the public department filter chips — alphabetical (default) or by employee count, descending.

1.1.2

• Feature: New «Extension» field for telephone extensions — displays as plain text (no link) alongside the existing phone field. Supports organizations with PBX/telephone exchange systems where extensions are stored in a separate LDAP attribute (e.g. ipPhone). The LDAP attribute name is configurable in Display Options (default: ipPhone). Works with Active Directory, Samba, OpenLDAP, and custom schemas.

1.1.1

• Improvement: LDAP user retrieval now uses RFC 2696 paged results (LDAP_CONTROL_PAGEDRESULTS), allowing the plugin to retrieve all employees from directories with more than 1,000 users — previously, Active Directory’s default MaxPageSize limit silently truncated results.
• Chore: Verified compatibility with WordPress 7.0.

1.1.0

• Feature: Department filter bar — dynamically generated chips above the directory grid. Clicking a chip filters employees by department with horizontal scroll for 15+ departments.
• Feature: Server-side pagination and search — filtering and pagination now processed in PHP over the WordPress cache; the DOM contains only the current page of results (no more 300+ hidden elements).
• Improvement: Pagination now shows «Showing X–Y of Z» (and «Showing X–Y of Z in Department» when filtered) instead of the previous «1 / N» format.
• Fix: Added missing .ldap-phone CSS rules — phone links now display consistently with email links.

1.0.6

• Fix: Removed custom CSS input feature (admin panel textarea and Beaver Builder Advanced tab) per WordPress.org guideline prohibiting arbitrary CSS/JS/PHP injection.
• Fix: Added phpcs:ignore annotation with justification to echo do_shortcode() output in Beaver Builder frontend template; changed per_page shortcode argument from esc_attr() to absint() for correct integer escaping.

1.0.5

• Fix: Replace inline <style> tags in Elementor widget and Beaver Builder module with wp_add_inline_style() and Elementor’s native add_render_attribute() API to comply with WordPress.org plugin guidelines (Guideline 11 / wp_enqueue best practices).

1.0.4

• Security: LDAP bind password is now encrypted at rest using libsodium (XSalsa20-Poly1305). The encryption key is derived from WordPress’s built-in security keys — no configuration required.
• Security: Existing plaintext passwords continue to work and are automatically re-encrypted on the next settings save (transparent migration).
• Security: An admin notice is shown when WordPress security keys (wp-config.php) have been regenerated, prompting the administrator to re-enter the bind password.
• Note: Regenerating WordPress security keys requires re-entering the bind password once in Settings → LDAP Staff Directory.

1.0.3

• Fix: Plugin now activates without the PHP LDAP extension; a persistent admin notice informs the administrator when the extension is missing instead of blocking activation with a fatal error.
• Fix: /* translators: */ comment repositioned inside sprintf(), immediately above __(), to satisfy the WordPress Plugin Checker i18n rule.
• Fix: All local variables in included template files (directory.php, beaver-builder/frontend.php) renamed with ldap_ed_ prefix to comply with WPCS global-variable naming requirements.
• Fix: absint() applied to $columns in Elementor widget printf() output to satisfy the WPCS escaping rule for integer values.
• Fix: load_plugin_textdomain() removed — not required for WordPress.org-hosted plugins since WordPress 4.6.
• Fix: Domain Path header removed from plugin file — no local translation files are bundled.
• Chore: «Tested up to» updated to WordPress 6.9.
• Chore: Tag list reduced to five entries per WordPress.org limit.

1.0.2

• Feat: Added telephoneNumber field — read from LDAP, displayed on cards as a clickable tel: link, included in client-side search, and available in admin panel, Elementor and Beaver Builder controls.
• Feat: New «Exclude Disabled Accounts» setting (connection section) — filters out disabled Active Directory accounts using the userAccountControl bit flag. Leave unchecked for OpenLDAP/other servers.
• Feat: Resilient cache — when the LDAP server is unreachable after cache expiry, the last successfully fetched data (stale copy) is served silently to visitors. Only a manual «Clear Cache» action removes the stale copy entirely.

1.0.1

• Fix: LDAP server URL no longer lost on save — replaced esc_url_raw() (which strips ldap:///ldaps:// schemes) with a dedicated sanitizer that validates the scheme and shows an admin error on invalid input.
• Fix: Added runtime admin notice when the PHP LDAP extension is missing, covering cases where the extension is disabled after activation or the plugin is activated via WP-CLI/DB without going through the activation hook.

1.0.0

• Initial release.