WPReady

Hi there, for security reasons Nextcellent 1.9.32 disallowed inadvertedly some inner core functionality. Legacy code made Ajax calls in a way that is currently invalid and therefore the plugin is at risk of being banned from repository.

I’m confirming the functionality affected is thumbnail, rotation and some other ajax operation.

This situation has been solved (very) recently. The tests seems to confirm it was fixed, and that’s why I’m going to send an update this week.

Thank you

The problem is, according with WordPress new enforced best practices, there are quite a few issues to fix in the plugin. Deprecation issues are very easy to fix. However there are other potential issues and they were since Nextcellent is supported.

But now rules are changed for every plugin developer, meaning that legacy code with bad implementation needs to be corrected or it will be banned. I completely agree with that, however it implies a lot of work.

And this without mention WP itself had its own obscured bugs, preventing Nextcellent working properly, check this link https://www.ads-software.com/support/topic/blank-insertion-pop-up/

An attempt to make a quick fix rendered the plugin barely usable (1.9.32), with many additional issues.

A rewriting for the plugin is in progress (mostly AJAX calls). I’m expecting to deliver the plugin this week, but that implies a LOT of fixes, and a LOT of testing and I have limited resources to invest in the development.

Since this is a work in progress, I prefer posting the progress in the forum, until I reach a stable point.

After some digging I found that this plugin has at least 5 illegal calls to WordPress core, due incorrect legacy code involved. That means I need to fix all this invocations because this way of coding is now forbidden in the repository (and I agree with that).

Those changes implies an important core rewriting. I guess If I solve one , I will solve the others quickly. The good side of this story is the plugin will work faster and lighter. But it’s going to take a lot of work.

I don’t think it will be a 1.9.33 , more likely 1.9.4 since there are many improvements around it.

Wish me luck…

Nextcellent is using an ‘illegal’ way of making WordPress core calls (illegal because all plugin authors using this shortcut are called to fix it).
Sadly, that was ‘fixed’ disabling some features in 1.9.32. It seems your problem is related to this incident.

For the moment I’ll recommend going back to 1.9.31 until 1.9.33 is published. I’m making efforts to correct those things in the next release with an ETA next week.

Previous version of Nextcellent
https://www.ads-software.com/plugins/nextcellent-gallery-nextgen-legacy/advanced/

Hi, currently I’m unable of reproduce the issue. It seems related to jQuery under some circunstances. Which WP version are you using?

Thanks for the warning. Currently, Nextcellent has been using plUpload since two years ago, so there is a fallback support for swfUpload via plUpload but not directly in the code, since WordPress is providing plUpload and also swfUpload flash file.

Searching for the term ‘swfUpload’ in the plugin, reveals few options and also few methods this text is mentioned but there is no use for flash uploader directly. Some code cleaning is needed, which is currently (although partially) amended.

I’m unable to reproduce the problem, so far I tested rotating the pictures without incidents (using PHP 7.1.1).

There is something deeper, since NGGALLERY_ABSPATH should have the proper value, and in the error this constant is not working.

Do you have any unusual WP configuration?

After researching the subject several days, I’m confirming the bug is about WordPress itself not the plugin.
https://core.trac.www.ads-software.com/ticket/41124?cversion=0&cnum_hist=1
The problem is not ‘Google – searchable’ since the bug is mentioned using images.

Version 1.9.33 (not yet released) already addressed this issue, however it also brought to the light Nextcellent is using an older version of tinyMCE popup which it will need to be updated in the near future.

For the moment, 1.9.33 will try fixing all the things 1.9.32 went down due security improvements.

Thanks for pointing out.
That is already fixed and it will be published in the next version.

Currently Import folder is disabled in this version due serious vulnerabilities were found, forcing Plugin Reviewers to take the plugin down.

Import folder is currently under revision, until I workaround/fix the issue definitively.

My apologies for the incident.

Hi chercka , thanks for let it know. I’m working in a release to fix this on other issues. I hope will be ready this weekend. Stay tuned.

Thanks for posting this. I’ve been working to fix the issues as soon as possible.

I’ve been receiving some feedback about current version. There are some things that need to be corrected. After sanitizing, some parameters aren’t working.
I’m expecting to launch a new version next week addressing the issues.

My apologies for the incident(s).

After two rounds, the plugin was enabled again, with some recommendations. There is now some dead code needed to be removed.
Plugin review team also warned me about some minor portions of code to be improved/sanitized.

So we can expect a new plugin version in the short horizon, addressing few more issues.
For security concerns, the navigation folder is currently disabled.

The plugin Nextcellent was submitted again for review, with some minor functionality disabled (folder import disabled) due vulnerabilities and several fixes. I’m waiting to see if the plugin is approved. This can take few rounds before being alive. Stay tuned…