Add to changelog

CHANGELOG.md

@@ -1,6 +1,8 @@
 ### 3.2.2
+- Move permissions checks into a dedicated permission_callback ([#408])
 - Add more checks around friendships ([#407])
-- Hoping that this hardening will bring back the plugin to the WordPress.org directory. In my opinion [the issue](https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/friends/friends-321-missing-authorization) was vastly exaggerated and didn't qualify to get the plugin taken down. Also it was not reported in a way that it could be patched in time. If you have a security issue to report, please follow the instructions on https://github.com/akirk/friends/blob/main/SECURITY.md and/or report through https://github.com/akirk/friends/security.
+
+Hoping that this hardening will bring back the plugin to the WordPress.org directory after [this issue](https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/friends/friends-321-missing-authorization) was reported. While I am unsure it qualified to get the plugin taken down, I've done some hardening and bugfixing in the above pull requests. Unfortunately it was not reported in a way that it could be patched in time. If you have a security issue to report, please follow the instructions on https://github.com/akirk/friends/blob/main/SECURITY.md and/or report through https://github.com/akirk/friends/security.
 
 ### 3.2.1
 - OPML Import: Support OPMLs without nesting ([#403])
@@ -307,6 +309,7 @@
 - PHP: Introduced a namespace, changed the plugin hooks to friends_loaded and friends_load_parsers
 - Add checks for diagnosing the correct functioning to Site Health
 
+[#408]: https://github.com/akirk/friends/pull/408
 [#407]: https://github.com/akirk/friends/pull/407
 [#403]: https://github.com/akirk/friends/pull/403
 [#401]: https://github.com/akirk/friends/pull/401

README.md

@@ -97,8 +97,10 @@ There is a cache of your friends post in form of a Custom Post Type friend_post
 ## Changelog
 
 ### 3.2.2
+- Move permissions checks into a dedicated permission_callback ([#408])
 - Add more checks around friendships ([#407])
-- Hoping that this hardening will bring back the plugin to the WordPress.org directory. In my opinion [the issue](https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/friends/friends-321-missing-authorization) was vastly exaggerated and didn't qualify to get the plugin taken down. Also it was not reported in a way that it could be patched in time. If you have a security issue to report, please follow the instructions on https://github.com/akirk/friends/blob/main/SECURITY.md and/or report through https://github.com/akirk/friends/security.
+
+Hoping that this hardening will bring back the plugin to the WordPress.org directory after [this issue](https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/friends/friends-321-missing-authorization) was was reported. While I am unsure it qualified to get the plugin taken down, I've done some hardening and bugfixing in the above pull requests. Unfortunately it was not reported in a way that it could be patched in time. If you have a security issue to report, please follow the instructions on https://github.com/akirk/friends/blob/main/SECURITY.md and/or report through https://github.com/akirk/friends/security.
 
 ### 3.2.1
 - OPML Import: Support OPMLs without nesting ([#403])
@@ -161,6 +163,7 @@ There is a cache of your friends post in form of a Custom Post Type friend_post
 - Fix 404 on the New private post widget props @liviacarolgouvea ([#361])
 - Improve ghost.org ActivityPub compatibility ([#356])
 
+[#408]: https://github.com/akirk/friends/pull/408
 [#407]: https://github.com/akirk/friends/pull/407
 [#403]: https://github.com/akirk/friends/pull/403
 [#401]: https://github.com/akirk/friends/pull/401