ASB Post Thumbnail

Change Log

4.4.5

Fixed
* Settings screen: while editing an override rule, the live preview drew fields left empty (meaning “use the default”) as 0 — for example with a font size of 0. Empty fields now follow the default in the preview too, just as they already did in the generated image.
* “Remove -br- from post titles” now also removes the marker from the browser tab title (the title tag, including titles set by SEO plugins) and from the web address WordPress makes from the title when a post is first published. Web addresses that are already set, or that you typed yourself, are not changed.
* Post editor: the “(Follow default: …)” choice showed the setting’s internal value (such as “stack” or “title”). It now shows the same name as the choices below it.

Changed
* The ASB family card now also links to the shop page of ASB Connect for LINE, now that its Pro version is on sale.

4.4.4

Changed
* The ASB family card in the sidebar now links to this plugin’s page on WordPress.org and invites a review, now that the plugin is listed there.

4.4.3

Security
* A title changed by “Remove -br- from post titles” is passed through wp_kses_post() before it is returned. Titles the plugin does not change are left exactly as WordPress gives them.
* The <picture> element for the WebP / AVIF display copies is filtered through wp_kses() before it is returned, keeping the image’s srcset and sizes.
* The featured image added to RSS and Atom feeds is escaped value by value where it is printed.
* On saving a post, the classic editor’s request to replace the featured image is accepted only with that post’s edit nonce.

4.4.2

Security
* Backgrounds and image layers can only use the plugin’s own bundled images and Media Library images that the user is allowed to view — whether they are chosen on the settings screen, in the post editor or by another plugin. Other files on the server can no longer be drawn into a generated image, and an image attached to a private post can no longer end up in a public featured image.
* Font settings accept only a font file name from the plugin’s font folders.
* Only users who can change the main settings can preview unsaved site-wide settings, and “Generate & Set Now” also needs permission to upload files.
* Per-post settings are no longer shown in the public REST API. The editor receives only the settings it uses, and the rule search lists only posts the user can read.
* A value sent in an unexpected form (such as an array) no longer causes a fatal error on saving or previewing; it falls back to its default.
* The Permissions tab accepts only the four listed capabilities. An invalid saved value is reset to its default (Administrator for the main settings, Contributor and above for per-post settings), so nobody can be locked out of the settings.
* File names, image addresses and search terms are inserted on the settings screen as plain text, and only .ttf and .otf files can be deleted from the font list.

Fixed
* English and other space-separated text was broken in the middle of a word at the end of a line (“title fo / r preview”). Words now move to the next line whole; Japanese line breaking is unchanged.
* Choosing a layout template stopped with a script error (“Maximum call stack size exceeded”) caused by the colour pickers, and the preview was then labelled “New Rule”.
* The colour pickers of a newly added rule did not open until the settings were saved and the page reloaded.
* When a background image could not be drawn, the featured image came out with a plain white background. The plugin now moves on to the next image — the per-post background, then the rule’s, then the site’s, and finally the bundled default — so the preview and the generated image always match.
* “Sequence” backgrounds keep the same picture for every post that already had one, and the editor preview shows the right picture for each post.
* AVIF images work as backgrounds and image layers wherever the server’s image library can read them, and images WordPress converted from HEIC to JPEG are drawn.
* The image, display size and padding chosen for an image layer in the post editor were lost when the post was saved, so automatic generation ignored them.
* An image layer set in a rule by its address alone showed the default layer image instead.
* On the very first save, every checkbox (and each rule’s “Disable auto-generation”) could switch itself on.
* Uploading a custom .ttf or .otf font always failed with “Sorry, you are not allowed to upload this file type.” It now also works on servers whose file-type detection does not recognise fonts, and Japanese font file names keep all their characters.
* Deleting a font that was already gone gave no message.
* A font download that was cut off stayed marked “Installed”. Downloads are now checked before they are kept, a damaged file can be downloaded again, and the listed font sizes are accurate.
* Saving the settings removed the bundled default background image.
* “Settings saved.” and the font upload and delete messages never appeared on the settings screen.
* Pressing Enter in a field could ask to delete an added font.
* Titles and names were drawn with HTML entities (for example “…” or “&”), private and protected posts got a “Private:” or “Protected:” prefix, and “-br-” line breaks were ignored when the image was made in the background.
* Adding a password to a post now regenerates its featured image, so text drawn before the password was set does not stay on it.
* Regenerating an image no longer deletes the old one when another post uses it as its featured image.
* The settings screen failed on servers without GLOB_BRACE (Alpine and other musl-based systems).
* On servers that do not allow “Options” in .htaccess, the plugin’s upload folders could answer with a 500 error. Existing .htaccess files are updated.
* Deprecation notices from imagedestroy() and finfo_close() on PHP 8.5.

Changed
* asbptp_generate_for_post() no longer replaces a featured image chosen by hand while “Disable auto-generation for posts that already have a featured image” is on. Pass array( 'replace' => true ) to replace it.
* On servers without Imagick, text outlines are limited to 20px and drawn within a time budget, so very long text can no longer tie up the server. WebP images now work as backgrounds and image layers there too.
* The settings screen no longer prints inline style blocks; all of its styles are in the plugin’s stylesheet.
* Every global name now uses the plugin’s own prefix. The admin-menu grouping helper is now asbptp_family_group_admin_menu().
* The “View on WordPress.org” link and the review card appear once the plugin is listed there.
* The bundled Select2 is updated to 4.1.0, and its unminified files are included.
* The protective files in the plugin’s upload folders are written with the WordPress filesystem API, and the plugin no longer clears PHP’s opcode cache itself (WordPress does this when it updates a plugin).
* Removed leftover references to the former Pro edition from comments, styles and the font license notice.

4.4.1

• The sidebar’s list of other ASB plugins follows their current names and listings.

4.4.0

• Added (for developers): three hooks so that other plugins can give a post its featured image even when nobody is logged in — for example a post written by a background job, which the automatic generation on save never sees.
• asbptp_generate_for_post( $post_id ) makes the featured image right away with the site’s settings and returns the attachment ID (or a WP_Error). It respects the per-post switch, the enabled post types and the rules, and also works for drafts.
• The asbptp_generation_config filter changes what is drawn — for example a background picture chosen for this post, or a shorter title with -br- line breaks. Saving, the background job, the preview and the “is the image still current” check all read through it.
• The asbptp_thumbnail_generated action fires after a featured image has been generated and set, with the post ID and the attachment ID.
• Fixed: PHP 8.1 and later printed “Implicit conversion from float to int” notices while drawing text with GD. The text position is now rounded to whole pixels first; the image looks the same.

4.3.0

• Fixed: per-post settings made in the editor sidebar were lost when you saved. The settings were registered with two types at once (object or array), and WordPress quietly leaves such meta out of the REST API that the block editor saves through — so the editor never received the saved values and whatever it sent back was discarded. Background image, sizes, colours and layer settings for a single post now survive “Save draft” and page reloads, and the generated image uses them.
• Fixed: turning on “Enable auto-generation for this post” and publishing in the same save did nothing. Generation was decided on save_post, which the block editor fires before it writes the post’s meta and categories, so the switch still read as off. Generation now waits for wp_after_insert_post, after everything from that save is stored.
• Changed: a featured image this plugin generated is refreshed when the title, categories, sidebar settings or design change. Until now any existing featured image — including one the plugin had made itself — stopped generation for good, so edits after publishing never reached the image. An image you chose yourself is still never replaced (with “Disable auto-generation for posts that already have a featured image” on), and saving with nothing changed does not make a new image.
• Improved: the sidebar says when the image will be made (on publish for drafts), when a featured image you chose is being kept, and — in asynchronous mode — shows the image as soon as the background job finishes, without reloading the editor.

4.2.0

• Added: the featured image is now part of the site’s feeds. WordPress’s RSS and Atom feeds never mention it, so anything that reposts from the feed — RSS-to-social services such as dlvr.it, Zapier or IFTTT, feed readers, a static site whose feed is built from a private WordPress — had no picture to show, and Instagram-style targets refused the post. Each item now carries an RSS enclosure and Media RSS content/thumbnail elements (an enclosure link in Atom) pointing at the full-size JPEG that og:image uses, not the WebP/AVIF display copies. Password-protected posts are left without an image. add_filter( 'asbptp_feed_featured_image', '__return_false' ) turns it off.

4.1.0

• Added: optional WebP and AVIF copies for display. The generated featured image stays a JPEG — og:image, feeds and notification plugins all read that one file and not all of them understand AVIF — and the plugin writes lighter copies beside it, offering them through a <picture> element. Browsers that cannot read them fall back to the JPEG on their own. On a 1200 x 630 image the WebP is typically about a quarter of the JPEG, and the AVIF about a tenth.
• Added: the settings screen reports which formats this server can really produce. It encodes a test image and inspects the bytes rather than trusting the extension’s own claim, because some builds of GD advertise AVIF support and then write an empty file.
• A format is offered to the browser only when every size in that image’s srcset has a copy. A half-mapped srcset makes the browser ask for a file that is not there and show nothing at all — and only at the widths that happen to be missing, which is the kind of fault that never reproduces where it was built.
• Copies are deleted together with the attachment they belong to, and when the plugin is uninstalled.

4.0.3

• Fixed: the sample “Custom Text” introduced in 4.0.1 also appeared in the preview inside the post editor’s sidebar, where a layer with nothing typed into it used to show nothing at all. That preview is a promise about one particular post, so words nobody wrote do not belong in it. The sample is now shown only on the plugin’s own settings screen, where there is no post behind the picture and something has to be visible to judge the font, size and colour by.

4.0.2

• Fixed: the live preview could show the previous choice — pick “Custom Text” and the picture stayed as it was, switch back to “(None)” and the custom text appeared. Nothing was reversed: the preview was simply a step behind. Choosing from a dropdown now redraws at once instead of waiting out a delay, an answer that arrives late can no longer paint over a newer one, and the old picture is dimmed while the new one is being drawn, so a stale image is never mistaken for the result.
• Fixed: a layer with no font selected painted no text at all — the empty selection resolved to the fonts folder instead of a font file, and the drawing step then failed without a word. It now falls back to the bundled Noto Sans JP, as it always did for a font that had been removed.
• Fixed: after updating the plugin, the preview could keep showing pictures drawn by the previous version, because they were cached by settings alone. The plugin version is now part of that cache key.

4.0.1

• Fixed: setting a layer’s content to “Custom Text” left the live preview blank until you typed something into the field, so there was nothing to judge the font, size, colour, stroke or position by — the settings looked as if they did nothing. The preview now shows a sample “Custom Text” in that layer, and the field itself carries the same words as a placeholder. Generated images are unchanged: an empty custom text still paints nothing on them.
• Fixed: the live preview followed the page for one screenful and then scrolled out of sight, which is where the longest settings are. It now stays in view all the way down the settings column. On narrow screens, where the two columns stack, the preview sits above the settings and stays pinned there instead of being buried below everything.

4.0.0

• There is no longer a Pro version. Everything that used to be paid — custom font upload, downloadable Japanese fonts, image layers, multiple and rotating backgrounds, overlay, text stroke, stack layout, custom post types, synchronous generation, per-category / per-tag / per-post override rules and the permission settings — is in this single free plugin, unlocked, with no key to enter.
• Removed: the licence screen and everything that went with it. The plugin contacts no licence server, and no setting is greyed out or held back. Licence data left over from 3.5.x is cleared when the plugin is uninstalled.
• Settings you already saved are kept as they are.

3.5.9

• Fixed: for a password-protected post, the generated featured image could have the opening of the post’s text painted onto it. The image is an ordinary file in your uploads folder — no password stands in front of a PNG — so the text was readable by anyone with the link, and by anything that follows links. Protected posts still get their image; the excerpt layer is simply left blank on it, and the title, author and category layers are unaffected.

3.5.3

• Security: hardened the local-image path resolver against directory-boundary and traversal edge cases when reading background / layer images.
• Security: generated-image dimensions are now clamped (per-side and total pixels) to prevent resource-exhaustion from extreme values.
• Reliability: automatic generation now re-checks the post state right before it runs, so a featured image you set manually right after publishing is never overwritten.
• Reliability: orphaned image files are cleaned up when attachment registration fails; scheduled cleanup events are removed on deactivate/uninstall.
• Library: bundled Select2 updated from a release candidate to the stable 4.0.13.

3.1.7

• Security: fixed an SSRF vulnerability in the REST API (external URL downloads are now blocked).
• Security: multi-layer sanitization of REST input and stronger path traversal protection.
• Security: thorough output escaping on the settings screen and safer nonce verification for font upload and deletion.
• Compatibility: auto-generation now also runs when publishing from Gutenberg; duplicate save_post calls are suppressed with a static flag.
• Performance: the Imagick instance is reused (up to ~60x faster with long titles) and getimagesize results are cached.
• Performance: cron arguments are reduced to the post ID only to prevent wp_options bloat; preview images older than 24 hours are cleaned up by a daily cron job.
• Improvement: old auto-generated featured images are removed when a new one is generated (manually replaced images are protected).
• Improvement: the bundled default-bg.jpg is used as the initial background, Select2 is bundled locally instead of loaded from a CDN, and index.php/.htaccess hardening files are placed in the upload directories.

3.0.3

• Initial release.