Sync 0.5.0 release back into develop

CHANGELOG.md

@@ -5,22 +5,31 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [0.5.0] - 2026-08-20
 
-### Fixed
-
-- Report link no longer disappears on themes that modify the comment reply-link markup, such as Twenty Twenty. It is now positioned in the browser next to the reply link rather than by parsing that markup server-side (#14).
-- Report link now appears on comments at the maximum threading depth, where WordPress renders no reply link.
-- Report link now appears in block themes that render comments with the Comment Content block, not only classic `wp_list_comments()` output.
+This release formalises the plugin's minimum requirements as WordPress 6.4 and PHP 7.4.
 
 ### Changed
 
 - In automatic mode the report link is attached via the `comment_text` filter and positioned client-side, instead of via the `comment_reply_link` filter.
+- Front-end flagging messages and the "Report comment" link text are now translatable; they were previously hard-coded in English (#33).
 
 ### Removed
 
 - Internal `add_flagging_link()` method and the `safe_report_comments_comment_reply_link` filter, which the new placement mechanism no longer uses.
 
+### Fixed
+
+- Report link no longer disappears on themes that modify the comment reply-link markup, such as Twenty Twenty. It is now positioned in the browser next to the reply link rather than by parsing that markup server-side (#14).
+- Report link now appears on comments at the maximum threading depth, where WordPress renders no reply link.
+- Report link now appears in block themes that render comments with the Comment Content block, not only classic `wp_list_comments()` output.
+- Reporting a comment already marked as spam or trashed no longer pushes it back into the moderation queue; only currently approved comments are moved to hold (#16).
+- A visitor's own report is remembered again via the flag cookie, so the same comment can no longer be reported repeatedly by one person (#15).
+
+### Security
+
+- Flagging is now restricted to genuine, public comment types. Previously any numeric ID that shared the comments table — such as WooCommerce order notes — could be reported and forced into moderation once the threshold was reached, even though no report link was ever shown for it. A new `is_reportable_comment()` helper gates flagging, with filters to adjust the reportable types or veto a target.
+
 ## [0.4.1] - 2014-07-23
 
 ### Fixed
@@ -51,7 +60,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Coding standards and cleanup.
 
-[Unreleased]: https://github.com/Automattic/safe-report-comments/compare/0.4.1...HEAD
+[0.5.0]: https://github.com/Automattic/safe-report-comments/compare/0.4.1...0.5.0
 [0.4.1]: https://github.com/Automattic/safe-report-comments/compare/0.4...0.4.1
 [0.4]: https://github.com/Automattic/safe-report-comments/compare/0.3.2...0.4
 [0.3.2]: https://github.com/Automattic/safe-report-comments/compare/0.3.1...0.3.2

README.md

@@ -5,7 +5,7 @@
 **Requires at least:** 6.4  
 **Tested up to:** 7.0  
 **Requires PHP:** 7.4  
-**Stable tag:** 0.4.1  
+**Stable tag:** 0.5.0  
 **License:** GPL-2.0-or-later  
 **License URI:** https://www.gnu.org/licenses/gpl-2.0.html  
 

composer.json

@@ -40,6 +40,9 @@
 		"cs": [
 			"@php ./vendor/bin/phpcs"
 		],
+		"i18n": [
+			"wp i18n make-pot . languages/safe-report-comments.pot --slug=safe-report-comments --domain=safe-report-comments"
+		],
 		"lint": [
 			"@php ./vendor/php-parallel-lint/php-parallel-lint/parallel-lint . -e php --exclude vendor --exclude .git"
 		],

languages/safe-report-comments.pot

@@ -0,0 +1,98 @@
+# Copyright (C) 2026 Thorsten Ott, Daniel Bachhuber, Automattic
+# This file is distributed under the GPL-2.0-or-later.
+msgid ""
+msgstr ""
+"Project-Id-Version: Safe Report Comments 0.5.0\n"
+"Report-Msgid-Bugs-To: https://wordpress.org/support/plugin/safe-report-comments\n"
+"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
+"Language-Team: LANGUAGE <LL@li.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"POT-Creation-Date: 2026-08-20T00:37:59+00:00\n"
+"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
+"X-Generator: WP-CLI 2.12.0\n"
+"X-Domain: safe-report-comments\n"
+
+#. Plugin Name of the plugin
+#: safe-report-comments.php
+msgid "Safe Report Comments"
+msgstr ""
+
+#. Plugin URI of the plugin
+#: safe-report-comments.php
+msgid "https://wordpress.org/plugins/safe-report-comments/"
+msgstr ""
+
+#. Description of the plugin
+#: safe-report-comments.php
+msgid "Gives visitors the possibility to flag a comment as inappropriate. After reaching a threshold the comment is moved to moderation. If a comment is approved once by a moderator, future reports are ignored."
+msgstr ""
+
+#. Author of the plugin
+#: safe-report-comments.php
+msgid "Thorsten Ott, Daniel Bachhuber, Automattic"
+msgstr ""
+
+#. Author URI of the plugin
+#: safe-report-comments.php
+msgid "https://automattic.com"
+msgstr ""
+
+#: class-safe-report-comments.php:180
+msgid "Thank you for your feedback. We will look into it."
+msgstr ""
+
+#: class-safe-report-comments.php:181
+#: class-safe-report-comments.php:183
+msgid "It seems you already reported this comment."
+msgstr ""
+
+#: class-safe-report-comments.php:182
+msgid "Cheating huh?"
+msgstr ""
+
+#: class-safe-report-comments.php:213
+msgid "Allow comment flagging"
+msgstr ""
+
+#: class-safe-report-comments.php:220
+msgid "Flagging threshold"
+msgstr ""
+
+#: class-safe-report-comments.php:314
+msgid "Safe Comments:"
+msgstr ""
+
+#: class-safe-report-comments.php:337
+msgid "Allow your visitors to flag a comment as inappropriate."
+msgstr ""
+
+#: class-safe-report-comments.php:350
+msgid "Amount of user reports needed to send a comment to moderation?"
+msgstr ""
+
+#: class-safe-report-comments.php:376
+msgid "Please revise your flagging threshold and enter a number between 1 and 100"
+msgstr ""
+
+#: class-safe-report-comments.php:560
+msgid "Safe Report Comments Notice"
+msgstr ""
+
+#: class-safe-report-comments.php:647
+msgid "Report comment"
+msgstr ""
+
+#: class-safe-report-comments.php:651
+msgid "Wrong usage of print_flagging_link()."
+msgstr ""
+
+#: class-safe-report-comments.php:658
+msgid "This comment does not exist."
+msgstr ""
+
+#: class-safe-report-comments.php:748
+msgctxt "column name"
+msgid "Reported"
+msgstr ""

safe-report-comments.php

@@ -3,7 +3,7 @@
  * Plugin Name: Safe Report Comments
  * Plugin URI: https://wordpress.org/plugins/safe-report-comments/
  * Description: Gives visitors the possibility to flag a comment as inappropriate. After reaching a threshold the comment is moved to moderation. If a comment is approved once by a moderator, future reports are ignored.
- * Version: 0.4.1
+ * Version: 0.5.0
  * Requires at least: 6.4
  * Requires PHP: 7.4
  * Author: Thorsten Ott, Daniel Bachhuber, Automattic