Role Scoper 1.0.2 addresses the various bug reports which have trickled in over the last 6 weeks.  These bugs are all minor in severity and/or affect only a minority of installations.  For details see the change log below.

The only significant new feature is an option to enter usernames or ids (for role assignment) via comma-separated text entry instead of by checkbox selection. This will be a performance and convenience enhancement for installations with over 100 users.

The full change log:

• BugFix : Template function is_restricted_rs / is_exclusive_rs was non-functional on home page (since rc9.9311)
• BugFix : With Attachments Filter enabled, attachments larger than 10MB fail to download on some installations
• BugFix : Fatal Error when viewing a single post entry after RS Options modified to disable front-end filtering
• BugFix : Auto-delete orphaned role assignments left in DB by previous versions following category / group deletion
• BugFix : After an empty group was deleted, its role assignments were left in the database
• BugFix : Event Calendar events without an associated post were not displayed without calendar refresh
• BugFix : Post Restrictions and Post Roles did not display on PHP 4 servers
• BugFix : In Post/Page Edit Form, Author selection was inappropriately available to non-editors
• BugFix : Orphaned role assignments already stored to database will be autodeleted on RS version update
• BugFix : If the object type of a requested attachment parent cannot be determined, assume post
• BugFix : Teaser message displayed in header with some themes
• BugFix : http authentication prompt for RSS feeds with logged administrators on some installations
• BugFix : Hidden Editing Elements settings were not effective for unpublished posts/pages
• BugFix : If a memberless group was deleted, any assigned roles were left (orphaned) in the database
• Plugin : Conflict with WP-Wall plugin caused non-listing or double-listing of wall comments
• Feature : Option to accept CSV entry for user role assignment
• Feature : Bottom-right submit button on bulk admin forms if SCOPER_EXTRA_SUBMIT_BUTTON is defined

Role Scoper 1.0.1 is now available to address the following issues:

• BugFix : In some situations, non-attachments were included in Media Library listing
• BugFix : Low level users could not edit uploads from Media Library based on a Post/Page/Category role assignment
• BugFix : Cannot set static front page with Role Scoper activated
• BugFix : Users with editing role via Page / Category assignment could not bulk-delete posts/pages
• BugFix : Post/Page Edit divs configured as Hidden Editing Elements were not hidden for draft posts/pages
• BugFix : After a group was deleted, its role assignments were left in the database
• BugFix : PHP warnings viewing users list with WP < 2.8
• Change : WP 2.7 users with hacked WP template.php user_row code must define("scoper_users_custom_column", "true");
• BugFix : Failed to return results for manual WP_Query calls which include category exclusion argument
• BugFix : Role Scoper error messages were formatted with unreadable colors with WP 2.7
• BugFix : Conflict with ozhAdminMenus plugin, Page menus missing in some configurations
• BugFix : Conflict with WP-Wall plugin caused fatal error
• Feature : Options to hide User Groups, Scoped Roles from user profile

After 10 months of beta development and debugging, Role Scoper 1.0.0 is now a stable release in the WordPress Plugins Directory.  Many thanks to the hundreds of current users, especially the dozens of you who have contributed to this project with informative bug reports, thoughtful feature requests and pertinent usage questions in the support forum.

The last round of development versions (culminating in this release) included dozens of bug fixes and extensive performance enhacements to reduce memory usage.  To identify changes and fixes since your current version, see the change log in the role-scoper plugin directory, or here.

Some of you may have noticed that since installing Role Scoper Release Candidate 9, WordPress has stopped storing Post Revisions.  In reality, the revisions were stored but a recently added Page Parent filter had the side effect of wiping out the legitimate post_parent value, which WordPress uses to tie a revision to the corresponding published post ID.

Today's Role Scoper update corrects that error.  Any existing revisions stored since your installation of Role Scoper rc9 will remain unavailable unless you use a database editor/query to manually edit their post_parent value to the corresponding post ID.

This revision also fixes a few other minor bugs.

• BugFix : Post revisions not saved correctly (post_parent value set to 0), since rc9

• BugFix : PHP warning for htmlspecialchars_decode() when using RSS feed teaser message on a translated site
• BugFix : Tags filter did not support name__like, search arguments

• BugFix : PHP warning for array_diff_key() when calling get_categories with fields=ids

Role Scoper rc9.9215 is now available to fix several bugs.  They will not apply to everyone, but are probably driving you crazy if they do.  Most of the issues are implementation-specific or even server-specific.

Most significantly, Category Restrictions could become ineffective if Role Scoper's db cleanup code failed following a Category deletion.  (That cleanup code was strengthened in rc9.9212).  If a logged user had orphaned Category Roles equal to or greater than the number of restricted categories, no Category Restrictions were applied for that role.

In addition, on some server configurations, the Hidden Content Teaser spewed PHP warnings and/or was completely nonfunctional.

new fixes in rc9.9215:

• BugFix : Filtering for tag cloud did not prioritize top tags by usage
• BugFix : Further precautions against duplicate comment listings / multiplied comment counts (but currently corrupted comment counts will remain so until next comment storage)
• BugFix : Logged users with a WP role setting of "no role" were blocked from everything
• BugFix : In user profile, assigned roles were sometimes repeated in "contains" list

from v 1.0.0-rc9.9214:

• BugFix : Category Restrictions not applied if logged user has orphaned Category Roles equal to the number of restricted categories
• BugFix : PHP warning for htmlspecialchars_decode() when using Hidden Content Teaser with WordPress translation enabled
• BugFix : On some server configurations, Hidden Content Teaser was not effective at all (since rc8.9116)
• Perf : On some server configurations, redundant db queries.

Anyone using default Restrictions for Categories, Pages or Posts should upgrade to today's updated Role Scoper version.  Beginning with RC9.9211, a new bug in the Bulk Restriction administration form prevented the correct display of the "restricted" caption when a default restriction has no corresponding unrestrictions.

Your existing restrictions were not affected, but administration became very confusing with the conditionally incorrect captions.

Once again, user feedback has proven that a Role Scoper release candidate slightly unprepared for unsupervised flight.  The good news is that, thanks to such prompt support forum activity, the new-found bugs are already confirmed fixed.  Thanks to those of you who appreciate the permission control enough to ride these updates out.  I still think we're closing in on a level of stability that will warrant entry into the WordPress plugins directory, and with it one-click updates.

The full change log for Role Scoper 1.0.0-rc9.9212:

Front End:

• BugFix : Front-end bookmarks listing was hidden, in some configurations
• BugFix : Attachment comments (and comment counts) were hidden
• BugFix : Filtered tag cloud was not sized according to logged user access, did not includes tags for private posts.
• Change : Support queries for is_restricted_rs() / is_protected() template function run automatically as needed, no need to define SCOPER_EXTRA_TEMPLATE_FUNCTIONS

Hidden Content Teaser:

• Feature : Option to apply teaser only for logged users
• Feature : Teaser option for fixed content prefix / suffix
• Change : User-specified teaser prefix / suffix is always applied regardless of teaser mode
• BugFix : With Teaser enabled, Category counts did not include restricted content and categories with entirely hidden content were omitted from sidebar / topbar list

Attachment Filtering:

• BugFix : Intermittant failure of Attachment Filter to return images if server's output buffer became corrupted
• BugFix : Under some conditions, uploaded files show as broken or invisible inside Post / Page Edit Form

Media Uploader:

• BugFix : When adding New Post / Page, cannot upload files before post is saved
• BugFix : After a new Post is autosaved, non-administrators cannot upload files until a category is stored

Post / Page Edit:

• Feature : New option in Advanced tab "Role administration requires a blog-wide Editor role"
• BugFix : In some configurations, new posts were moved to default category unnecessarily
• BugFix : Posts menu disappeared while a page is edited, in some configurations
• BugFix : "Add New" included in menu even if user can only edit existing Pages / Posts
• BugFix : Posts saved via QuickPress were sent to alternate default category even if user has posting rights in default category
• BugFix : Role assignment tabs in Post / Page Edit Form did not not indicate implicit role ownership via blog-wide or category assignment of a containing role

Misc:

• BugFix : PHP warning on db_setup call at plugin activation
• Perf : Corrected dozens of (mostly harmless) references to undeclared variables or indexes

Role Scoper has made a lot of progress in dishing out permissions for WordPress Posts and Pages any way you want to slice them.  Today marks the opening of a new horizon: content-specific roles for your 3rd party plugins.  What better target for this first invasive procedure than NextGen Gallery, the most popular plugin whose source code has been like a reference guide to me?

Now, with Role Scoping for NextGen Gallery, you can control Gallery editing access on a gallery-specific or album-specific basis.  Or, assign desired users or groups a blog-wide General Role of "Gallery Author", "Gallery Editor" or "Gallery Administrator" to avoid the need to edit your WordPress role definitions or assignments.

Last tested compatibility: RS-NGG 1.0.2, WP 3.2.1, NextGEN Gallery 1.8.2, Role Scoper 1.3.42

Although Role Scoper's plugin API documentation is currently lacking, other plugin developers can learn most of what they need by reviewing the RS for NGG source.  The main requirement is that the 3rd party plugin tests its own custom capabilities using the WP function current_user_can.

Role Scoper Release Candidate 9 is here, with a long list of refinements. The most significant changes are:

• BugFix : WP 2.7: posts queries with a "category not in" argument returned missing or teased posts
• BugFix : Attachments Filter blocked access to Media Library uploads that are not in any post/page
• BugFix : Some get_terms and get_pages parameters were not supported
• BugFix : tested and debugged API for custom role definition by 3rd party plugins
• Perf : Database query optimizations
• Feature : new RSS and Hidden Content Teaser options (using RSS filtering code from the Disclose Secret plugin)
• Feature : Tag filtering to match post access
• Feature : Editable capabilities for RS Role Definitions
• Feature : Attachments utility to auto-register ftp-uploaded linked files as formal attachments
• Feature : Contextual help links in admin
• Feature : Options panel clarifies relationship between WP and RS role definitions
• Feature : About page allows Administrators a quick review of Kevin's motives, availability - and convenient PayPal&nbsp;access&nbsp;:) Note: images in the About page account for most of the 132K increase in the .zip size.

Thanks to everyone whose bug reports or feature requests contributed to this release… and to those who have waited on unanswered forum posts. To my knowledge, every pending defect or feature request is addressed by this revision.

The full change log follows. It's long but overall the scope and severity of symptoms is consistent with the "final polish" cycle I believe we're in. Yellow items were included in previous development versions since rc8.

Front End:

• BugFix : WP 2.7: posts queries with a "category not in" argument returned missing or teased posts
• BugFix : Tag filtering broke cloud sizing
• Feature : Filter and cache front-end tag cloud content based on logged user's access to posts (requires default get_tags parameters)
• BugFix : DB error in front-end comment filtering when viewing single post/page
• BugFix : Recent Comments not filtered on the front end if teaser is enabled
• BugFix : Stored filtered comment_count to post db record
• BugFix : get_comments_number() was not filtered
• BugFix : For img tags which were broken by rc2-rc4, convert attachment_id URLs in stored post/page content back to file URL

RSS:

• Feature : Support HTTP Authentication for RSS feeds
• Feature : Optional Replacement of Readable RSS Content with teaser message (as in Disclose Secret plugin)

Hidden Content Teaser:

• Feature : Hidden Content Teaser option to display content before more tag if no custom excerpt is stored
• Feature : Hidden Content Teaser option to display first X characters if no custom excerpt or more tag is stored
• Feature : Hidden Content Teaser option to use post content above <!–more–&t; tag as a teaser (with standard teaser statement also displayed below when viewing single post/page
• BugFix : Category post count included pending / draft posts if using Hidden Content Teaser but not "hide private posts"
• BugFix : Front end posts paging sometimes broken when Hidden Content Teaser enabled

File Attachments:

• Feature : Attachments Utility to register linked uploads as attachments for filtering purposes
• BugFix : Attachment filter blocked access to Media Library uploads that are not in any post/page
• Change : Files in WP uploads folder which have no post/page attachment are not blocked unless SCOPER_BLOCK_UNATTACHED_UPLOADS defined

Categories / Pages / Links sidebar listing:

• Feature : get_terms, get_pages filters support "exclude_tree" argument as in WP 2.7.1
• BugFix : WP get_terms filter did not apply "search" and "offset" parameters
• BugFix : get_terms filter always included child terms in post count regardless of pad_counts setting
• BugFix : get_terms filter missed some terms if "number" argument used along with "hierarchical", "parent" or "child_of"
• BugFix : get_terms filter did not apply "child_of" or "hide_empty" parameters when fields set to "ids" or "names"
• BugFix : Category cache was not cleared after category add / edit
• BugFix : Persistant Cache for terms was not updated on introduction of new plugins which use the list_terms_exclusions filter
• BugFix : get_pages filter did not apply "parent" parameter
• BugFix : get_bookmarks filter did not apply "search" parameter

DB Query Optimization:

• Perf : Option reduce memory usage in front-end access by assuming no content / user edits there
• Perf : In Post / Page Edit form, improved cache implementation to eliminate dozens of redundant queries pertaining to users, groups
• Perf : Reduce Post / Page edit form queries by including member list of each group in persistent cache
• Perf : Post / Page Edit form had redundant queries for revisions
• Perf : Cut category and tag query size in half by eliminating page clause if page categories are not enabled
• Perf : sync_wp_roles operation was executed twice at first-time activation
• Perf : If db select includes any terms regardless of post ID, don't also include those terms in ID-specific clause
• Perf : DB queries with a WP-imposed post/page object type requirement had an irrelevant RS-imposed clause for other object type
• Perf : The optional comment count filter was applying post / page filtering needlessly
• Perf : Execute support query for is_restricted_rs() template function only if SCOPER_EXTRA_TEMPLATE_FUNCTIONS defined
• Perf : Teaser support query was executed even with teaser disabled
• Perf : Categories were not stored to persistent cache
• Perf : Front-end comment count filtering was executed redundantly on each post
• Perf : Apply front-end comment count filtering (usually not needed) only if SCOPER_FILTER_COMMENT_COUNT defined

Bulk Administration of Roles:

• BugFix : Non-admins could not assign object roles via bulk admin
• BugFix : Users lacking a category management role could not bulk administer Post / Page roles
• BugFix : Users lacking a blog-wide editing role saw checkboxes for bulk admin object role assignment though assignment attempts were rejected
• BugFix : Some Roles / Restrictions links displayed inappropriately for non-admin users (though access was not granted)
• BugFix : Roles / Restrictions submenu items were not removed when disabled via Realm options
• BugFix : In Category Roles / Restrictions bulk admin, tree nesting was sometimes off for non-admin users
• BugFix : Bulk Admin formatting rendered poorly in some IE versions

Edit Post / Page:

• BugFix : Revision edit link was suppressed for non-editor users own revision
• BugFix : On page add / edit, Page Parent selection was not fully filtered to match UI selections (had no impact for normal usage)
• BugFix : In Edit Post/Page Form, role tabs could not be hidden via screen options
• BugFix : In Edit Page Form, page parent dropdown was populated even if user is not permitted to move page parent from Main Page due to lack of blog-wide edit capability
• BugFix : Contributors, Editors tabs were displayed if user has a blog-wide capability for any data source / object type (now only if for source / obj type being edited)
• BugFix : Custom-specified Hidden Editing Elements were not hidden based on Require Blog-Wide Editing option if the user had a blog-wide editing capability for a different object type
• BugFix : PHP Error in Post/Page Edit form when Realm Option "Object Roles and Restrictions for Posts/Pages" disabled
• BugFix : In some WP 2.6 configurations, PHP array_keys warning in Edit Page form from users query (since rc3b)
• BugFix : In WP 2.6, nuisance error message "page parent was reverted" following autosave of a page (including revision)
• BugFix : PHP errors when non-admin user uploads media using Flash Uploader
• BugFix : PHP error on bulk edits from Edit Posts / Edit Pages
• BugFix : In Edit Post/Page role assignment, incorrect indication of implict "via group" role ownership in some cases
• Change : If a user has a role implicitly via direct assigment of a superior role and via another blog/category scope, highlight them as "via other role"
• Change : Color for "via other role" is now dark gray to distinguish from "via group"
• Change : Prevent breaking spaces in User / Group Role Assignment key captions in Edit Post/Page Form
• BugFix : In WP < 2.7, Page Parent tree did not display to non-administrators (and bogus error message on update)
• BugFix : PHP Warning (nuisance) in Edit Post / Page Form - invalid foreach in item_roles_ui_rs.php

Role Scoper Options Admin:

• Feature : Version Update notice is abbreviated with "more…" link
• Change : Removed Object Types Realm Options (for disabling filtering of individual sources / object types) due to complications with hardway / teaser filtering, admin intimidation factor and low feature priority
• Change : Removed Ignore Hierarchy Realm Options (now implemented as a config property modifiable by plugins if needed)
• BugFix : Customization of capabilities for plugin-defined roles (via RS Options) not processed correctly
• BugFix : xhtml validation errors in Role Scoper Options
• Feature : RS Role Definitions have editable capabilities
• Feature : WP Role Definitions list caps, contained RS roles

Admin - General:

• Feature : Contextual Help links to Usage Guide sections
• Feature : About Role Scoper page available to Administrators in admin
• BugFix : PHP warning when viewing the profile of a user with a WP setting of "No Role"
• BugFix : WP 2.7: "Add New" link for Posts / Pages displayed even when user can't do it
• BugFix : Users who have edit role on a Post/Page but not blogwide could not upload files and/or view them in Media Library
• BugFix : Admin object listings sometimes unlinked when user has editing capability only via category role
• Change : Improved formatting
• Feature : User Profile lists roles which are "contained" in the assigned role(s)

Misc:

• BugFix : rs_cache_flush.php failed due to use of undefined ABSPATH constant
• BugFix : Attempt by external plugin to define custom capabilities fails
• BugFix : In some configurations, failed to honor General assignment of a role which was custom-defined via plugin API
• BugFix : Entire Persistant Cache was auto-flushed on each user login
• BugFix : Fatal Error on some WP configurations when upgrading from rc2 or higher
• BugFix : PHP Warning if post_cache is an object

Role Scoper 1.0.0 RC8 is now available to correct the following issues:

• fixed: Missing Categories checklist / database error in Edit Form for non-Admins, since 1.0.0-rc5
• fixed: Edit Post/Page Form displays Readers, Contributors role assignment tabs to Contributors
• fixed: On some installations, PHP warning "first argument should be an array" above posts and comments
• fixed: On some installations, MAX_JOIN_SIZE db error in Post/Page Edit Form (new query structure may also improve load time)
• fixed: In Edit Form for a published and unrestricted post/page, WP Subscribers were not highlighted for implicit ownership of Readers role
• fixed: In Post/Page Edit Form, users were not highlighted for implicit role ownership based on membership in a group that has a containing role
• fixed: Persistant Cache was non-functional even when enabled
• fixed: Category Roles/Restrictions bulk admin displayed role checkboxes for roles which logged user lacks (though submission of such role selections would fail)
• fixed: PHP Warning on bulk deletion of posts/pages by a non-administrator
• fixed: Create New Group form fails to display after updating an existing group
• fixed: Background color in Role Scoper Options - Advanced
• change: Bulk Admin for Page Roles/Restrictions shows all pages by default
• change: In Bulk Admin, "show/hide empty" link recaptioned as "show/hide unassigned", "show/hide defaulted"