Release notes
What's new
Version 6.1.0 is a security and maintenance release, and we recommend all users update. It requires PHP 8.1 or
later, and updates the bundled third-party libraries to current stable releases.
Security: this release fixes cross-site scripting through encoded characters in URLs, requires a
valid nonce for every administrator task that changes settings or files, and fixes an open redirect in the Clean
Cache task. It stops CSS and JavaScript files outside the site root from being read through encoded slashes in their
URLs when files are combined, and stops combining files from fetching files from private network addresses. It also
validates the image URLs and paths returned by the image optimization service, removes the jchbackend URL
parameter, keeps the Cloudflare API token, Redis password and Download ID out of settings exports, and waits for an
administrator before applying the .htaccess changes and the Mode Switcher after an update.
Page Cache: pages left unoptimized for a single request are no longer cached and served to every
visitor, and only pages on the site's own host are cached. Page Cache's cookies now follow the COOKIEPATH and
COOKIE_DOMAIN settings, are HTTPS only on HTTPS sites, and cover the whole site.
Optimize Fonts: with Optimize CSS Delivery on, the @font-face rules used above the fold stay in the
critical CSS, so fonts are no longer delayed. Stylesheets listed in "Optimize these files" are no longer removed
from the page while Optimize Fonts is off.
Cache and Recache: identical optimized content is now stored once, reducing the cache's size on
disk, and garbage collection no longer removes cache files still in use. Only one Recache runs at a time, and
Recache from the command line no longer cleans the cache when it can't reach the selected cache storage. Redis
connections through a Unix socket are recognized.
Uninstalling now deletes the plugin's cache folder and the next-gen and responsive images it
created. Backups of optimized images are kept.
Several other bugs were fixed, including relative URLs on pages with a tag, responsive background CSS
on LCP images, browsers autofilling the Redis password, and duplicated @imports. See the CHANGELOG for details.
Developed and tested on up to PHP 8.5.11 and WordPress 7.1.3
Changelog
Changes
- Importing settings keeps the site's current Cloudflare API token, Redis password and Download ID when the file doesn't include them.
- Improved cache storage by deduplicating identical optimized content, reducing cache size on disk.
- Page Cache only stores pages requested on the host of the site's home URL.
- Raised the minimum PHP version to 8.1.
- Redis hosts written as unix:///path, or any absolute path, are recognized as Unix sockets.
- Settings exports are now downloaded directly and no longer include the Cloudflare API token, Redis password or Download ID.
- Uninstalling deletes the plugin's cache folder and the next-gen and responsive images it created. Backups of optimized images are kept.
- Updated bundled third-party libraries to current stable releases, including Symfony DomCrawler, Guzzle and Laminas.
Bug fixes
- [HIGH] Fixed CSS and JavaScript files outside the site root being readable through encoded slashes (..%2F) in their URLs when files are combined.
- [HIGH] Fixed a cross-site scripting vulnerability where encoded characters in URLs, such as search query links, were decoded during optimization.
- [HIGH] Fixed an open redirect through the return parameter of the Clean Cache task.
- [HIGH] Removed the jchbackend URL parameter that disabled optimization for any visitor.
- [HIGH] Required a valid nonce for all administrator tasks that change settings or files.
- [HIGH] Validated image URLs and paths returned by the image optimization service and kept image folders within the site root.
- [LOW] Composer's list of installed packages no longer includes packages that aren't shipped.
- [LOW] Escaped page URLs and details on the Page Cache list.
- [LOW] Fixed HTML minification options and settings serialization.
- [LOW] Fixed PHP warnings after importing or resetting settings that leave out Page Cache settings.
- [LOW] Fixed a duplicated @import being combined again when Resolve @imports is on.
- [LOW] Fixed browsers autofilling the administrator login password into the Redis password field.
- [LOW] Fixed invalid width and height attributes on images.
- [LOW] Fixed links being injectable into the error message on the Optimize Images page.
- [LOW] Fixed relative URLs on pages with a tag being resolved against the page URL instead of the base, affecting combined files, image dimensions, CDN URLs and preloads.
- [LOW] Fixed the total cache size being under-reported for some cache storage adapters.
- [LOW] Removing JCH Optimize's section from .htaccess leaves the rest of the file as it was, instead of collapsing blank lines.
- [LOW] Validated Page Cache IDs before deleting cached pages.
- [MEDIUM] After an update, the .htaccess changes and the Mode Switcher must-use plugin wait for an administrator who can activate plugins, instead of running on a visitor's request.
- [MEDIUM] Combining files no longer fetches files from private network addresses, or follows redirects to them.
- [MEDIUM] Escaped file and folder names in the Optimize Images file tree.
- [MEDIUM] Fixed Recache failing when the cache storage adapter is unavailable.
- [MEDIUM] Fixed Recache not falling back to the site URL when Recache Base URL is empty.
- [MEDIUM] Fixed critical CSS from @import chains overwriting each other in the cache.
- [MEDIUM] Fixed cross-site scripting in the Critical JavaScript Configure Helper, which showed script URLs from the site's pages without escaping them.
- [MEDIUM] Fixed garbage collection removing cache files that were still in use.
- [MEDIUM] Fixed responsive background CSS being lost on LCP images and excluded files.
- [MEDIUM] Fixed stylesheets listed in Optimize these files being removed from the page while Optimize Fonts is off.
- [MEDIUM] Ignored malformed Host headers instead of letting them change the detected page URL.
- [MEDIUM] Only one Recache runs at a time.
- [MEDIUM] Page Cache no longer stores pages left unoptimized for a single request, such as pages loaded in an iframe, requested with jchnooptimize, or where optimization failed.
- [MEDIUM] Page Cache's cookies follow the COOKIEPATH and COOKIE_DOMAIN settings, are HTTPS only on HTTPS sites, and cover the whole site.
- [MEDIUM] Recache from the command line, such as WP-CLI running the cron event, no longer cleans the cache when the selected cache storage can't be reached from the command line, such as APCu. It logs a warning instead.
- [MEDIUM] Rejected malformed host names in Page Cache and Capture Cache keys, and unsafe characters and path segments in Capture Cache file paths.
- [MEDIUM] With Optimize CSS Delivery on, Optimize Fonts keeps the @font-face rules used above the fold in the critical CSS, so fonts are no longer delayed.
