New Features
- Add a notice bell to the Essential Grid screens: notices from Essential Grid and its add-ons are collected in it, and notices from other plugins are no longer shown on these screens
Bugfixes
- Save Grid skipped the grid settings after a post’s meta was edited from the editor preview
- Editing a post’s meta from the grid editor preview cleared the post’s Blank Template and Page Color settings
- The “Slide Short Down” hover transition did nothing on the front end
- PHP “Undefined array key” warning when a Slider Revolution 7 module opens in the lightbox
- Grids could stay hidden when another plugin or theme loaded its own tptools.js, or on Slider Revolution page effect pages; Essential Grid no longer waits for Slider Revolution and falls back to its own GSAP
- Essential Grid no longer changes shared animation settings (GSAP default perspective and force3D) used by Slider Revolution and other plugins
- Slider Revolution 7 content opens in the Ajax container and the lightbox and is removed cleanly on close or switch; error modules are no longer started and a failing start no longer keeps the Ajax container hidden
- With “Use Own Caching System” turned on, grids now update right after posts are published, changed, scheduled or deleted and after category and tag changes, also from the block editor, REST, WP-CLI, imports and scheduled publishing; plugin updates refresh cached grids
- Global add-ons could switch off when the add-on list from the ThemePunch server left them out; add-ons already switched off this way need to be enabled once more in the Addons dialog
- An item lost its Ajax link when the first Ajax source was unavailable instead of using the next source, and an unhandled source could print its name into the link
- The “Close & don’t show again” button of ThemePunch notices was shown as text
Changes
- Security: On sites that let editors or authors use Essential Grid, only administrators can now change global and search settings, the license, the cache, demo data and widget areas; managing add-ons needs the matching plugin capability, and editing post settings from the grid editor needs permission to edit the post. Forced update and template checks are limited to users who can update plugins, and newsletter requests use HTTPS
- Security: On multisite, site administrators without plugin capabilities can no longer install or update add-ons from Essential Grid
- Security: Add-on installs and updates respect DISALLOW_FILE_MODS and replace the installed add-on only after a complete, valid package has been downloaded and checked
- Security: Template library downloads accept only templates from the library list and store only real images, and responses from the ThemePunch servers are checked more strictly
- Security: Saving Essential Grid post meta requires permission to edit the post
- Security: Essential Grid settings on posts and pages are validated and sanitized on save and escaped on output; this concerns sites where users without the unfiltered_html capability, such as authors and contributors, edit posts
- Security: Requests that visitors send from grids (load more, likes, lightbox content) are validated more strictly
- Security: Without the unfiltered_html capability, saving and importing grids, skins, elements, navigation skins, global CSS, custom meta and search settings cannot add or change JavaScript (JavaScript already stored is kept), and HTML and CSS are sanitized
- Security: On multisite, site administrators without the unfiltered_html capability can no longer save raw JavaScript or HTML in Essential Grid
- Security: Settings and layers in an shortcode that contain code are only honored in posts whose author and last editor both have the unfiltered_html capability; otherwise they are sanitized
- Security: Grid, navigation, lightbox, search and Ajax content output is escaped and validated more consistently
- Security: The admin previews of item skins (Skins page, the grid editor’s skin chooser, the post meta box and the icon picker) no longer turn entity-encoded skin text into markup; skin text and icons are escaped or limited to allowed HTML. This concerns sites where users without the unfiltered_html capability, such as authors or site administrators on multisite, can edit skins
- Security: Front-end AJAX requests, including add-on requests, return only content that a public page may show
- jQuery is no longer loaded on every page; it loads where Essential Grid renders. Sites with Slider Revolution keep it until Slider Revolution stops relying on it. Themes and plugins that need jQuery must declare it as a dependency
- The block editor CSS and dashicons no longer load on the front end
- Essential Grid admin styles and scripts load only on Essential Grid screens, post edit screens and page builders, no longer on the post lists, the Dashboard, Plugins or Settings
- Add the design foundation for the upcoming admin interface update: design tokens and the Geist font are bundled locally, without requests to Google Fonts
- Faster grids: attachment data of the grid items is loaded in a few queries, and saving no longer flushes the whole object cache
- Sites with “Use Own Caching System” turned off do no extra cache work when posts are saved
- Grids still start on sites whose optimization plugin delays scripts: Essential Grid keeps waiting, checks less often after 2 seconds and logs one console warning after 10 seconds
- Add ‘essgrid_ajax_action_capability’ filter to change the capability an admin AJAX action requires
- Add ‘essgrid_enqueue_jquery’ filter to load jQuery on every page again