3.15.4
Tighter control over who can change and see catalog records, an internal program that now opens from its own link, and saves that refuse a bad value instead of quietly storing a different one.
- Changed A program set to internal now opens from its own link. It stays out of the public program list, carries a "do not index" tag, and is left out of the sitemap, so it is unlisted rather than hidden. Before, its page returned "not found".
- Fixed The stock WordPress Editor, Author and Contributor roles no longer give any right to create, edit or delete catalog records. Those rights now come only from the Kenii access levels. Before, the catalog's record types could be changed through WordPress's own routes by anyone holding those roles.
- Fixed A board document can now only take in a file the person attaching it uploaded. Before, any attachment on the site could be named, pulled into the document and read through its download link.
- Fixed The breadcrumb route no longer returns the title of an unpublished or non-catalog post, or the list of installed plugins. The data export refuses a catalog year the public cannot see unless the caller manages the catalog, and refuses a year name that does not exist.
- Fixed Three Pathways routes and the compass comparison no longer return unpublished records, and the compass visit limit no longer trusts an address sent in a request header.
- Fixed Saving a record now refuses a value the data table cannot hold as written: a missing value for a required field, a number outside its range, text in a number field, or an unreadable date. Before, each was stored as an empty value, a clipped number, zero or a zero date without a warning. Every existing record on the live college site was checked against the new rules first, and none would be refused.