readme.txt

=== Trackserver ===
Contributors: tinuzz
Donate link: http://www.grendelman.net/wp/trackserver-wordpress-plugin/
Tags: gps, gpx, map, leaflet, track, mobile, tracking
Requires at least: 4.7
Tested up to: 6.7
Stable tag: trunk
Requires PHP: 7.3
License: GPLv2 or later
License URI: http://www.gnu.org/licenses/gpl-2.0.html

GPS Track Server for TrackMe, OruxMaps and others

== Description ==

NOTE: Trackserver v5.0 contains backwards-incompatible changes and changes to client configurations are needed. Please read the [release notes][releasenotes] for more information.

Getting your GPS tracks into Wordpress and publishing them has never been easier!

Trackserver is a plugin for storing and publishing GPS routes. It is a server companion to several mobile apps for location tracking, and it can display maps with your tracks on them by using a shortcode. It can also be used for live tracking, where your visitors can follow you or your users on a map.

Unlike other plugins that are about maps and tracks, Trackserver's main focus is not the publishing, but rather the collection and storing of tracks and locations. It's all about keeping your data to yourself. Several mobile apps and protocols are supported for getting tracks into trackserver:

* [TrackMe][trackme]
* [MapMyTracks protocol][mapmytracks], for example using [OruxMaps][oruxmaps], including upload functionality
* [OsmAnd's][osmand] live tracking protocol
* [µLogger][ulogger]
* [GPSLogger][gpslogger]
* [PhoneTrack-Android][phonetrack] also works with OsmAnd's protocol (Trackserver >= 4.3)
* [SendLocation][sendlocation]
* [Traccar client][traccar]
* [OwnTracks][owntracks] (experimental support)
* HTTP POST, for example using [AutoShare][autoshare]

A shortcode [tsmap] is provided for displaying your tracks on a map. Maps are displayed using the fantastic [Leaflet library][leafletjs] and some useful Leaflet plugins are included. Maps can be viewed in full-screen on modern browsers.

To publish a map with a track in a post or a page, just include the shortcode:

[tsmap track=<id>]

See the FAQ section for more information on the shortcode's supported attributes and other usage pointers.

[trackme]: http://www.luisespinosa.com/trackme_eng.html
[mapmytracks]: https://github.com/MapMyTracks/api
[osmand]: http://osmand.net/
[ulogger]: https://f-droid.org/en/packages/net.fabiszewski.ulogger/
[gpslogger]: https://gpslogger.app/
[phonetrack]: https://gitlab.com/eneiluj/phonetrack-android
[oruxmaps]: http://www.oruxmaps.com/index_en.html
[sendlocation]: https://itunes.apple.com/bm/app/sendlocation/id377724446?mt=8
[traccar]: https://www.traccar.org/client/
[owntracks]: http://owntracks.org/
[autoshare]: https://play.google.com/store/apps/details?id=com.dngames.autoshare
[leafletjs]: http://leafletjs.com/
[github]: https://github.com/tinuzz/wp-plugin-trackserver
[releasenotes]: https://www.grendelman.net/wp/trackserver-v5-0-released/

= Requirements =

Trackserver requires PHP 7.3 or newer and it needs both DOMDocument and SimpleXML extensions installed.

= Credits =

This plugin was written by Martijn Grendelman. Development is tracked on [Github][github].

It includes some code and libraries written by other people:

* [Leaflet.js][leafletjs] by Vladimir Agafonkin and others
* [Polyline encoder](https://github.com/emcconville/polyline-encoder) by Eric McConville
* [Leaflet-omnivore](https://github.com/mapbox/leaflet-omnivore) by Mapbox
* [Leaflet.fullscreen](https://github.com/Leaflet/Leaflet.fullscreen) by John Firebaugh and others
* [Leaflet.TextPath](https://github.com/makinacorpus/Leaflet.TextPath/) by Makina Corpus
* [Promise-polyfill](https://github.com/taylorhakes/promise-polyfill) by Taylor Hakes

== Installation ==

1. Use Wordpress' built-in plugin installer, or copy the folder from the plugin archive to the `/wp-content/plugins/` directory.
1. Activate the plugin through the 'Plugins' menu in WordPress.
1. Configure the slugs that the plugin will listen on for location updates.
1. Configure your mobile apps and start tracking!
1. Use the shortcode [tsmap] to include maps and tracks in your posts and pages.

== Frequently Asked Questions ==

= What are the available shortcode attributes? =

For the [tsmap] shortcode:

* profile: the name (label) of a map profile.
* track: one or more track IDs, separated by commas, or 'live' (deprecated, 'user=@' is preferred).
* id: an alias for 'track'
* user: one or more user IDs, separated by commas, who's latest track to follow 'live'. A literal '@' means the author of the post (you). When viewing the map, the liveupdate feature will follow the track of the first user specified. When the end-marker is enabled for a live track (and why shouldn't it?), clicking it will change the focus of the liveupdate to that track. The map view will follow the latest location and the infobar (if present) will display its information.
* live: true (or 't', 'yes' or 'y'), or false (default), to force live tracking for this map. This can be used for example with an externally updated GPX or KML file.
* maxage: the maximum age of a live track for it to be included on the map. If this parameter is given, all user tracks that have not been updated in the last X amount of time, will not be displayed. The value is a time expression in the form of a number and a unit, for example: '120s', '30m', '2h', '3d'.
* width: map width, default: 100%.
* height: map height, default: 480px.
* align: 'left', 'center' or 'right', default: not set.
* class: a CSS class to add to the map div for customization, default: not set.
* continuous: true (default) or false (or 'f', 'no' or 'n'), for lack of a better word, to indicate whether multiple tracks should be considered as one continuous track. The only effect this has, at the moment, is that intermediate start markers are yellow instead of green.
* gpx: one or more URLs to GPX files to be plotted on the map. Multiple URLs should be separated by spaces, and the value as a whole enclosed by double quotes (gpx="http://....gpx http://....gpx"). If enabled in the settings, when a url is prefixed with the string 'proxy:', the request is proxied through Trackserver.
* kml: one or more URLs to KML files to be plotted on the map. Multiple URLs should be separated by spaces, and the value as a whole enclosed by double quotes (kml="http://....kml http://....kml"). If enabled in the settings, when a url is prefixed with the string 'proxy:', the request is proxied through Trackserver.
* json: one or more URLs to GeoJSON files to be plotted on the map. Multiple URLs should be separated by spaces, and the value as a whole enclosed by double quotes (json="http://....geojson http://....geojson"). If enabled in the settings, when a url is prefixed with the string 'proxy:', the request is proxied through Trackserver.
* infobar: true (or 't', 'yes' or 'y'), false (default), or a template string, to specify whether an information bar should be shown on the map, when live tracking is active. This only works with 'track=live' or the 'user' parameter, and has no effect in other cases. When multiple live tracks are requested, the infobar will display the data of the first track only. Instead of 'true' or 'yes', a template string containing one or more placeholders (like {lat}, {lon}, {speedkmh}, etc.) can be given to the attribute, in which case it overrides the value specified in the user profile. Please check the Trackserver user profile page in the WordPress backend for which placeholders are supported.
* zoom: the zoom factor to use for the map, a number between 0 and 18. For a map with live tracks, this number is absolute. For a map with only static tracks, this number represents the maximum zoom level, so the map will always fit all the tracks.
* quiet: suppress a message popup if there is nothing to display on the map.

The following attributes apply to tracks that are drawn on the map. Each of them can contain multiple values, separated by commas (or colons, in the case of 'dash'), to be applied to different tracks in order. If there a are less values than tracks, the last value will be applied to the remaining tracks.

* markers: one or more of the following values: true (default) or false (or 'f', 'no' or 'n') to disable start/end markers on the track. The value can also be 'start', 's', 'end' or 'e', to draw markers only for the start or the end of a track respectively.
* markersize: one or more integer values, separated by commas, to use as the size / radius of the start/end markers of the track. Default is 5.
* color: one or more colors, separated by commas, to use for the tracks on the map. Default comes from Leaflet.
* weight: one or more weights, separated by commas, to use for the tracks on the map. Default comes from Leaflet.
* opacity: one or more opacities, separated by commas, to use for the tracks on the map. Default comes from Leaflet.
* dash: one or more [dashArrays][dasharray], seperated by colons (:), to use for the tracks on the map. Default is no dashes.
* points: true (or 't', 'yes' or 'y'), or false (default), to specify whether the track should be displayed as a line or a collection of points.
* arrows: true (or 't', 'yes' or 'y'), or false (default), to specify whether arrows should be displayed to indicate the direction of the track.

[dasharray]: https://developer.mozilla.org/en-US/docs/Web/SVG/Attribute/stroke-dasharray

Example: [tsmap track=39,84 user=@ align=center class=mymap markers=n color=#ff0000]

When you specify multiple values, please be aware of the following. While track order will be preserved within each track type, different track types are evaluated in a specific order, and styling values are applied in that order too. The order is:

1. Static tracks (track=a,b,c)
2. Live user tracks (user=x,y,z)
3. GPX tracks (gpx=...)
4. KML tracks (kml=...)
5. GeoJSON tracks (json=...)

To prevent confusion, I suggest you specify tracks in this order in your shortcode too.

Example: [tsmap gpx=/url/for/file.gpx user=jim track=10,99 color=red,blue,green,yellow]

In this case, the GPX track will be yellow, Jim's live track will be green and tracks 10 and 99 will be red and blue respectively.

In a feature request I was asked to make it possible to draw just a marker on the last known location, and not draw a track at all. Use 'markers' and 'opacity' to accomplish this:

Example: [tsmap user=@ markers=e opacity=0.0]

Attributes for the [tslink] shortcode:

* track: same as for [tsmap]
* id: same as for [tsmap]
* user: same as for [tsmap]
* text: the text to render insde the <a>...</a> tags
* class: a CSS class to apply to the 'a' element
* format: the format in which to download the tracks. Only 'gpx' (the default) is supported at this time. Other formats like KML may follow. Send a feature request if you need a specific format.

Example: [tslink track=1,2,3,4 text="Download the tracks of our 4-day hike in GPX format"]

Instead of using the 'text' attribute, you can also use shortcode to enclose the text:

Example: [tslink track=1,2,3,4]Download the tracks of our 4-day hike in GPX format[/tslink]

= What is a map profile? =

A map profile is a set of values that define what a map looks like and how it behaves. It consists of a tile server or style URL, an attribution string (often mandatory from the tile provider), a minimum and maximum zoom level for the map, and the default coordinates to display when for some reason nothing else is shown on the map. Site administrators can configure map profiles in the options page. One default map profile is provided out of the box.

Map profiles have a label by which you can reference them in a shortcode (profile=<label>). If no profile is specified in the shortcode, the profile with the label "default" is used. If that label does not exist, the first profile is used.

If the tile/style URL contains the string 'style.json', the URL will be treated as pointing to a vector tile style declaration, and Trackserver will load some extra JavaScript and CSS (Maplibre GL JS) to render vector tiles rather than raster tiles. This should work with vector tile providers like Maptiler and OpenFreeMap. It can also work with Mapbox, but the style JSON needs modifications to make it work.

= How does the shortcode content syntax work? =

Since Trackserver v6.0, an alternative syntax for adding tracks to a map is provided, using the shortcode content, rather than the attributes. An example:

[tsmap continuous=n]
{track id=1 markers=s color=yellow}
{track id=2 markers=n color=green}
{track id=3 markers=e color=red}
{user  id=5}
{gpx   url="https://..../"}
[/tsmap]

So:

* Within the [tsmap][/tsmap] block, you add elements that are enclosed by curly braces.
* The first word after the opening brace is the type. Supported are: 'track', 'user', 'gpx', 'kml' and 'json'.
* After the type, you add attributes, much like the traditional shortcode uses.
* In this syntax, attributes can only have a single value, and not a comma-separated list.
* Outside the item IDs, only the item-level styling level attributes are supported. Map level attributes like 'height' and 'infobar' are not.
* 'track' and 'user' items need a mandatory 'id' attribute.
* 'gpx', 'kml' and 'json' items need a mandatory 'url' attribute.
* In a single [tsmap] shortcode, you can mix attribute-based and content-based items.

One caveat:

If you have multiple [tsmap] shortcodes in a single post, and one or more of
them uses the content-based systax, then ALL (!) the shortcodes must have a
closing tag [/tsmap], even if they have no content. This is because of how
WordPress' shortcode parser works, and Trackserver cannot change this. An
example:

[tsmap track=1,2,3][/tsmap]
[tsmap]{track id=4}[/tsmap]

= I used the shortcode but the map doesn't show =

Trackserver tries to detect the usage of the [tsmap] shortcode to prevent unnecessary loading of the plugin's JavaScript. In some circumstances, for example, if your page setup is complex and uses multiple loops, the detection could fail. In such a case, use this shortcode in the main post or page to force loading the JavaScript:

[tsscripts]

There is one caveat. Trackserver only works on 'real' posts and pages, in WordPress terms. For example, some WordPress themes (I have seen one) offer the possibility to specify a static homepage right in the theme settings, completely overriding WordPress' internal post logic. In this case, the page lacks an author as well as other properties that a regular WordPress post or page has. Trackserver's [tsmap] shortcode does not work on pages like that.

All that said, Trackserver's shortcode detection should be reasonably fool-proof these days, because if the early detection mechanism fails, the shortcode itself is used to trigger the inclusion of Trackserver's JavaScript and CSS. The only adverse side effect this may have, is that the CSS is loaded in the footer of the page, rather than in the head section. It's hard to say whether this will actually be a problem, but just in case it is, the [tsscripts] shortcode is there.

Beware though: the [tsscripts] shortcode doesn't actually do anything. At all. It is merely an extra shortcode that Trackserver tries to detect. Therefore, it is absolutely useless to include [tsscripts] in the same context as your [tsmap]. I appreciate that this can be hard to understand, so let me illustrate with an example. Take the 'Posts in page' plugin, that allows you to use a shortcode in a post (let's call it A) to include other posts an pages inline (let's call them B and C). If [tsmap] is used in B or C, but the page requested by the user is A, which does not have a [tsmap], Trackserver's shortcode detection used to fail in earlier versions, and the Javascript and CSS would not be loaded. By using the [tsscripts] shortcode in page A, the loading of JS and CSS can be forced. The CSS will then be loaded in the head of the page, instead of in the footer.

= Trying to show a GPX or KML file shows an error popup: "Track could not be loaded: undefined undefined" =

This will happen when you try to load a file from a different domain than your site is running on, and the remote server doesn't serve a 'Access-Control-Allow-Origin' header that allows acces to the file. Your webbrowser refuses to process the file. Check the console in your developer tools for an error message. Please read up on [Cross-Origin Resource Sharing (CORS)](https://en.wikipedia.org/wiki/Cross-origin_resource_sharing) for more information. This is not something that Trackserver can fix.

= What is live tracking? =

By using the shortcode with the 'user=...' or 'track=live' parameter, the most recently updated track belonging to the specified user(s) or the author of the current post/page is published on the map.

The track is updated with the latest trackpoints every 10 seconds and the map view is always centered to the most recent trackpoint. A marker is shown in that location. Live tracking can be stopped and restarted with a simple control button that is shown on the map.

To publish other users' tracks, the author of the page needs the 'trackserver_publish' capability, which is by default only granted to administrators and editors.

= What is a Trackserver user profile? (since v1.9) =

Before v1.9, all of Trackserver's settings were stored in a single, global place in WordPress, meaning they were shared among all users in the same WordPress install. This was also the case for the OsmAnd access key that allows OsmAnd users to use Trackserver for live tracking. Since Trackserver tries to be multi-user, things like access keys do not belong in the global configuration.

In version 1.9, user profile settings were introduced as a place for per-user settings, like access keys. There is a separate page in the WordPress admin for the Trackserver profile (called 'Your profile' in English), that is accessible by all users that have the right (capability) to use Trackerver.

= What is an embedded map? =

In version 4.3, a feature called 'Embedded maps' was introduced. Embedded maps are a custom WordPress post type, which are intended to have no other content than a map, filling up the entire browser window, or the container they are loaded in. They bypass your active WordPress theme and use a custom template that displays <i>only</i> the content of your 'Embedded map' post, without any headers, sidebars or even styling. This allows you to embed the map with your tracks in another website using an <i>iframe</i>. Trackserver will tell you the HTML code to use for embedding the map. They also look great on mobile devices, if all you really care about is the map and what's on it.

I'm not sure about the usefulness of this feature to everyone who uses Trackserver, but personally I use it for mixing interactive maps with photos and videos in my online photo album.

= What changed for TrackMe authentication 1.9? =

TrackMe, like OsmAnd, uses HTTP GET requests for communication with Trackserver.  This means that all data from the app, including your password, becomes part of the URL. Because URLs are not generally considered secret, and may be logged in access logs and what not, this is quite insecure, even with HTTPS.

For OsmAnd, that has no built-in authentication, Trackserver has used an access key instead of your WordPress password from the very beginning. For TrackMe, this was implemented in v1.9. So from version 1.9 onward, every WordPress user that is allowed to use Trackserver has its own separate access key for OsmAnd and a separate password for TrackMe, settable in the Trackme user profile.

If you have been using Trackserver with TrackMe before v1.9, you should now set the password in TrackMe to this new password, instead of your WordPress password.  Like your password, you should keep your access keys to yourself, but the idea is that the security impact of such a key is low, compared to your WordPress password, and that you can (and should!) change the keys regularly.  No real effort is made to keep the keys secure (they are stored in the database unhashed, for example), so in any case, try not to use a sensitive password.

= What is this 'slug' you are talking about? =

Slugs are generally defined as URL-friendly and unique versions of a name or title. In WordPress, they are short descriptions of posts and pages, to be used in URLs (permalinks). They are the part of the URL that makes WordPress serve a particular page. Trackserver uses slugs to 'listen' for tracking requests from mobile apps, and you can configure these slugs to be anything you want.  Trackserver comes with default values for these slugs, that should work for most people. Changing them is usually not necessary nor recommended. Please
read the WARNING blow before changing them.

Please refer to the [Wordpress Codex](http://codex.wordpress.org/Glossary#Slug) for more information about slugs in general.

WARNING: please do not confuse the slugs that you configure in Trackserver with the URLs (permalinks) that you use to publish your maps and tracks. Above all, make sure there is no conflict between the permalink for a post or page and the slugs that Trackserver uses for location updates. The slugs in Trackerver's configuration are for the location updates ONLY. If you try to open them in a browser, you will get errors like 'Illegal request'. Trackserver operates on a low level within WordPress, so if there is a conflict between Trackserver and a post or a page, Trackserver will win and the page will be inaccessible.

To publish your tracks, simply create a page (with a non-conflicting permalink) and use the [tsmap] shortcode to add a map.

= Can Trackserver support protocol X or device Y? =

Trackserver, being a WordPress plugin, can only support HTTP-based protocols for tracking. Many tracking devices use TCP- but not HTTP-based protocols for online tracking, and as such, Trackserver cannot support them, at least not without some middleware that translates the device's protocol to HTTP.

If a device or an app does use HTTP as a transport, adding support for it in Trackserver should be quite easy. For example, I have been thinking about support for the GpsGate Server Protocol. It could be added if there is any demand for it.

If a device or an app uses a different transport, support could be added by implementing some sort of middleware. For example, [OwnTracks](http://owntracks.org/) uses MQTT and ships with a script ([m2s](https://github.com/owntracks/backend/tree/master/m2s)) for storing the data. Storage methods in m2s are pluggable, so one could write an m2s-plugin for shipping the data to Trackserver.

= How does TrackMe Cloud Sharing work with Trackserver? =

TrackMe has a feature called 'Cloud Sharing', that is meant to enable users to follow other users' locations on a map. The TrackMe app uses a different method to send location updates than for regular tracking updates. Also, it sends Cloud Sharing requests without authentication credentials, which made it hard to implement in Trackserver. Given that TrackMe sends authentication credentials in an insecure way in any case, I decided to implement a workaround for the missing credentials, by embedding them in the server URL. So, in stead of sending a request like this:

https://example.com/trackme/requests.z?username=myuser&password=mypass

we configure TrackMe to send requests like this:

https://example.com/trackme/myuser/mypass/requests.z?username=&password=

This way, it also works for cloud sharing requests, and we can get the username and password from the URL.

If you have been using TrackMe with the old style Server URL, and you try to use the cloud sharing feature, you will see a message along the lines of 'For cloud sharing you need to update your server URL, see Trackserver FAQ.'. This means you have to update the settings in the TrackMe app to contain your username and TrackMe password in the server URL. The complete server URL can be found in your Trackserver profile as always, and the old style URL is now deprecated. Switching to the new style URL also means, that the username and password that you set in the app will no longer be used, and you can leave those settings empty.

Please also read the FAQ above: 'What changed for TrackMe authentication 1.9'. The new URL scheme is slightly more insecure in some cases, since with the new scheme it is even more certain that your TrackMe password will end up in the server's access logs. Other than that, there is no difference. Remember to always use HTTPS, and change your TrackMe password often, since it will give full read/write access to your Trackserver tracks.

In Trackserver, Cloud Sharing behaves a little differently than in the official TrackMe server. The official server only remembers the latest location update for your device ID. It also has a notion of 'public' vs 'non-public' location sharing, where 'non-public' requires some permissions exchange over mobile text message. Trackserver does not do 'public' sharing. Also, location updates that arrive via the cloud sharing feature are treated the same as any other update: they are stored as a track. The only difference with normal tracking is, that the track name is generated by Trackserver. A new track is created when the date changes. The track name format is 'TrackMe Cloud yyyy-mm-dd'. This is not configurable at this time, but that may change in the furture.

= What about security? =

**Using Trackserver**

The plugin uses a few custom Wordpress capabilities ('use_trackserver', 'trackserver_publish' and 'trackserver_admin') to manage the various levels of access within Trackserver:

* To use the tracking features and manage and publish one's own tracks, the 'use_trackserver' capability is required. It is granted to authors, editors and administrators, but not to subscribers.
* To publish other people's tracks, the 'trackserver_publish' capability is required. It is granted to editors and administrators.
* To manage Trackserver's options, the 'trackserver_admin' capability is required. Only admins get this capability by default.

If you remove one or more capabilities from the listed roles, they will be re-granted on (re)activation of the plugin.

Tracks can only be published in Wordpress posts or pages, and cannot be downloaded from outside Wordpress. Requests for downloading tracks need to have a cryptographic signature (called a 'nonce') that only Wordpress can generate.

Regarding the use of apps for live tracking and uploading to Wordpress, please read the considerations about authentication above.

**External tracks proxy**

Trackserver contains code that can proxy requests to- and serve content from remote 3rd-party servers. This allows authors to work around CORS restrictions. Instead of letting the visitor's browser get the GPX or KML from the remote server (which only works if the server implements CORS headers to allow the request), the request is sent to WordPress, where Trackserver will fetch the track from the remote server and send it to the browser.

This opens all kinds of interesting possibilities, but it is also a security risk. Your authors can use the proxy function to invoke HTTP requests to remote servers, which now originate from your server, and the response of which will be processed by your WordPress installation. This could have different adverse effects, ranging from legal liability to denial-of-service on your server.

Therefore, the proxy function is disabled by default. It can be enabled in the 'advanced' section of Trackserver's settings, but I recommend to only enable it if you need it, and if you trust your authors not to use it on harmful URLs.

The proxy code can be invoked via a 'gettrack' request, but like all requests for tracks, it has to be signed with a valid nonce, so it should be impossible to abuse the proxy from outside WordPress.

= What GPX namespaces are supported for GPX import (via HTTP POST or upload via backend)? =

GPX 1.1 (http://www.topografix.com/GPX/1/1) and GPX 1.0 (http://www.topografix.com/GPX/1/0).

= Is it free? =
Yes. Donations are welcome. Please visit http://www.grendelman.net/wp/trackserver-wordpress-plugin/ for details.

== Screenshots ==

1. The track management page in the WordPress admin
2. Configuration of OruxMaps for use with Trackserver / WordPress

== Changelog ==

= Unreleased =

Added:
* A shortcode attribute named 'arrows', to enable drawing arrows over a track to indicate its direction. The implementation is very simple, with a hardcoded arrow sign, but the JS library being used allows for any text to be rendered, so in the future, this functionality may become more flexible and configurable.
* New syntax for adding tracks to the map, using shortcode content, rather than attributes.
* Map profiles, allowing you to use different tile sources and map settings (like zoom levels) in different maps.
* Experimental support for vector tiles, using Maplibre GL JS.
* A shortcode attribute named 'quiet', to suppress the 'Nothing to display' popup on the map when Trackserver doesn't find any valid tracks or points to display.

Changed:
* Updated Leaflet to v1.9.4.
* Refactored the shortcode handling to make it more robust and maintainable.
* Changed admin menu order and made 'Manage tracks' the primary page, rather than 'Options'.
* If a boolean shortcode attribute like 'live' and 'quiet' is given as a flag without a value, it now evaluates to 'true'.

= v5.0.3 =
Release date: 09 January 2025

Fixed:
* XSS in the 'tsmap' shortcode handler (CVE-2024-12505).
* WordPress comptibility set to v6.7.

= v5.0.2 =
Release date: 05 March 2023

Fixed:
* Regression with viewing tracks in WP backend via bulk action.

= v5.0.1 =
Release date: 06 February 2023

Fixed:
* JS localization warning in WP backend.

= v5.0 =
Release date: 06 February 2023

This release contains many changes. Please read these notes carefully.

BIG CHANGE: Trackserver URL change for all supported apps. Starting with v5.0, Trackserver uses a single URL slug for all supported apps. This means all users have to update the server URL in the mobile apps they use for tracking. App-specific URLs still work, but will be removed in a future version. After upgrading, visit the Trackserver Options page and look at the 'Full URL' lines at the top. There are two versions of the universal URL. Trackserver will tell you which URL to use in which app.

BIG CHANGE: App-specific passwords and access keys (used for TrackMe, OsmAnd and SendLocation) have been transformed into 'App Passwords', and are now app-independent. Existing access keys are automatically converted to App Passwords during the upgrade, and will all be valid for all supported apps, including the apps that worked with your WordPress password before (OruxMaps / MapMyTracks and OwnTracks). Your WordPress password will still work for those apps, but that may change in a future release. Switching to App Passwords is recommended, regardless of the app you use for Tracking. The main benefit is an increase in security, because your WordPress password will no longer be necessary for using Trackserver. Trackserver App Passwords can be changed often without impacting WordPress logins. As an added bonus, App Passwords also work in WordPress installs that use SSO mechanisms like OAuth2 for user logins.

Added:
* A search box on the tracks management page.
* Experimental uLogger support.
* Universal slug for all protocols that Trackserver supports.
* App passwords.
* Generic 'GET request' support for storing locations, used for OsmAnd and Sendlocation support.
* 'Duplicate' bulk action for copying tracks.
* Some useful links to Github and Trackserver home page from the Plugins page in WP admin.

Changed:
* Big code restructuring changes. The main Trackserver class has been split up in different utility classes. Each protocol that Trackserver supports now lives in its own PHP class, as do the different WP admin pages and the shortcode handling code. Abstractions for database fuctionss, and data like tracks and locations have been created.
* Rewrite parts of the MapMyTracks protocol handling, to make it more robust.
* Internalized the polyline encoder for performance improvement.
* Update Leaflet, first to v1.7.1. then via v1.8.0 to v1.9.3.

Fixed:
* Embedded maps. The previously shipped template was broken and embedded maps did not actually work.
* Include tracks without locations in the list of tracks.
* CSS improvements.
* Better TrackMe error handling.
* A bug in metadata generation for polyline output.
* A PHP error when there are no posts in the $wp_query. Thanks, @caveman99.

Removed:
* TrackMe support via the WP AJAX interface. It was never used.

= v4.3.2 =
Release date: 10 September 2019

Fixed:
* Database structure modifications that were missing on new installs of v4.3.
* The default trackformat was changed from polyline to geojson by mistake.

= v4.3.1 =
Release date: 10 September 2019

Changed:
* Some code restructuring.

Fixed:
* A JavaScript conflict with the 'Leaflet Map' WordPress plugin.
* Markers on maps in the WP admin were almost invisible due to undefined marker size.

= v4.3 =
Release date: 6 September 2019

This release requires WordPress v4.7 or higher.

Added:
* Custom post type 'tsmap' for creating embedded maps.
* Infobar template placeholder for track name: {trackname}.
* Experimental support for TrackMe Cloud Sharing. To use this, you have to change the 'URL header' setting in TrackMe. Please see the Trackserver FAQ for details.
* Support for PhoneTrack-Android via the OsmAnd protocol.
* Support for optional HTTP Basic Authentication on the OsmAnd protocol.
* Support for setting the 'Source' field of a track via a URL parameter in the OsmAnd protocol.
* Support for unicode characters in text fields through charset/collation changes in DB tables.
* Shortcode attribute 'markersize', for specifying the size (radius) of start/end markers on tracks.

Changed:
* Trackserver now only supports WP 4.7 or higher.
* Re-enstate GeoJSON support for the 'gettrack' method (not for 'gettrack_query')
* Updated Leaflet, first to version 1.4.0 and then to 1.5.1.
* Start restructuring the plugin code into multiple classes.
* The 'Share with friend / Follow friends' feature that was tied to OwnTracks now also applies to Trackme Cloud Sharing.

Fixed:
* Make the 'Show x items' selector in the 'Manage tracks' page actually do something.
* Escape HTML entities in the infobar.
* Escape HTML in track names when viewing maps in the WordPress backend.
* Translation of strings related to Embedded maps by loading the translation domain earlier.
* An issue where we tried to translate a piece of HTML code.
* Coding style updates, update WPCS to v2.1.1.
* Change the default value of timestamp fields in the database, for compatibility with MySQL 5.7+ / NO_ZERO_IN_DATE.
* Add a multicolumn index on the locations table, for better performance of certain database queries.
* Missing metadata on all but the last live track in a map. Thanks to @pisoni for reporting it and suggesting a fix. The fix does incur a performance penalty though.

= v4.2.3 =
Release date: 21 August 2019

* Fix a bug with converting timestamps to UTC for GPX output. Thanks to @jeremybeckett for reporting it.

= v4.2.2 =
Release date: 18 October 2018

* Fix Leaflet JS/CSS URLs, this change was forgotten to be included in v4.2

= v4.2.1 =
Release date: 18 October 2018

* Update Dutch translation for changes in v4.2

= v4.2 =
Release date: 18 October 2018

* Add some replacement tags for the infobar. All relevant metric and imperial units are now represented, and some of the tags now have different variants for specifying the number of decimals. Please see the text near the form field in your Trackserver profile for more information. Backwards-incompatible change: the distance and speed tags now have 0 decimals by default, that used to be 2.
* After a network error, remove error popup from the map on the next succesful track load.
* Updated Leaflet to version 1.3.4.

= v4.1 =
Release data: 8 October 2018

Added:
* OwnTracks Friends and Cards responses to Location requests.
* WordPress user avatars to OwnTracks responses, if available.
* Input fields on the Trackserver user profile page for managing OwnTracks share/follow friends.
* Stub functions for responding more nicely to TrackMe cloud sharing requests.
* A mouseover-tooltip on end-markers of live tracks, showing the user's displayname.
* The user's display name in the title of the Trackserver profile page.

Fixed:
* Missing gettext domain on some localized strings.
* Added some missing inline documentation in the code.

= v4.0.2 =
Release date: 23 February 2018

Fixed:
* Properly escape user-supplied input that is used in printf() format strings
* Make the default tile server URL use https instead of http

= v4.0.1 =
Release date: 23 February 2018

IMPORTANT BUGFIX: If you did a fresh install of v4.0, a column was missing from a database table,
causing location updates and GPX file uploads to fail. This release adds the column if it is missing.
Upgrades from 3.0 to 4.0 are not affected by this bug (but should still update).

Fixed:
* Updated Lithuanian translation. Thanks, Dainius Kaupaitis.
* Add title to the overlay for viewing geofences.
* Add missing database column for new installations.

= v4.0 =
Release date: 22 February 2018

This is another big update. Read more about it here: http://www.grendelman.net/wp/trackserver-v4-0-released/.

Added:
* A track editor in the WP admin, based on Leaflet.Editable. It allows you to move track points and split tracks.
* Bulk action for viewing multiple tracks at once in the admin. Editing them also works.
* Geofencing support, allowing you to hide or drop location updates within certain areas.
* A proxy for external KML and GPX tracks, to work around CORS restrictions.
* 'maxage' shortcode parameter to impose time-based limit on live tracks.
* OwnTracks HTTP support, locations request handling only for now.
* Bulk action for downloading tracks as GPX.
* A {distance} tag for infobar template, for total track distance in meters.
* Information about live tracking URLs and howto's for mobile apps on the user's Trackserver profile.
* Information on how to use live tracking in OsmAnd.
* Lithuanian translation, thanks to Dainius Kaupaitis.
* PHP coding style checks and automated testing with TravisCI.

Changed:
* Make the 'infobar' shortcode attribute accept a string, to override the template set in the user profile.
* Show a popup on the map with an internationalized message when there are not tracks to display.
* When a (live) track that is currently shown on the map is no longer present in the server response, show a nice popup, suggesting a page reload.
* Limit the TrackMe 'gettriplist' command to the 25 latest tracks, serve them in reverse order.
* Increase WP-admin 'View track' modal window size to 1024x768.
* Updated Polyline encoder from Eric McConville to v1.3.
* Updated Leaflet to version 1.3.1.
* Updated Leaflet-fullscreen to version 1.0.2.

Fixed:
* In JavaScript, store track information from the server more reliably.
* Improve HTTP responses around authentication failure.
* Recalculate the total track distance after merging multiple tracks.
* Easier access to Leaflet map object from 3rd party JavaScript (issue #9).
* Handle localized decimal numbers from SendLocation (issue #12).
* Some minor JavaScript and PHP issues.
* Many many many PHP coding style fixes.

= v3.0.1 =
Release date: 28 February 2017

* Add cache busters for JavaScript files

= v3.0 =
Release date: 27 February 2017

This is a BIG update. Please read https://www.grendelman.net/wp/trackserver-v3-0-released/ for the full story!

* Fix a bug where Trackserver would only import the first segment of a track from GPX.
* Get rid of suboptimal shortcode detection fallback mechanism.
* Upgrade Leaflet to version 1.0.3.
* Sync trackserver-omnivore.js with leaflet-omnivore-0.3.4.
* Update leaflet-liveupdate to version 1.1
* Fix a bug in the admin where some superfluous text was included in track URLs.
* Implement loading all tracks for a map in a single HTTP request.
* Add WordPress MultiUser support.
* Replace track marker images by L.CircleMarker objects and gain dynamic marker colouring. The old images are removed from the plugin installation.
* Add {userid}, {userlogin} and {displayname} as possible tags in the infobar template.
* Add 'user' attribute to 'tsmap' shortcode, for displaying multiple users' live tracks in a map.
* Add 'live' attribute to force live-update without live tracks, for use with external (gpx/kml) tracks. It can also be used to force-disable live updates for maps with user tracks.
* Add 'zoom' attribute to influence the initial zoom level of the map. Behaves differently for maps with live tracks than for maps with only static tracks.
* Add 'id' attribute as an alias for 'track', because I keep using that for some strange reason.
* Maps without live tracks now start at zoom level 12 instead of 6, until the tracks are loaded.
* Remove support for GeoJSON as Trackserver's internal trackformat, only polyline remains.
* Shortcode parameters 'markers', 'color', 'weight', 'opacity' and 'points' can now contain a comma-separated list of values, which will be applied to respective tracks in the 'track', 'user', 'gpx' or 'kml' attributes (in that order). If less values than tracks are given, the last value is applied to all remaining tracks.
* Add 'dash' attribute, behaving the same as 'markers', 'color', etc. to specify a 'dashArray' to use for the track(s).
* Make the 'weight' parameter control the point radius when 'points=y'
* It is now possible to mix 'track', 'user', 'gpx' and 'kml' in a single map.
* Add a new shortcode called 'tslink', that produces a download link for one or more tracks in a single file. Only GPX is supported at this time.
* Documentation updates and additions.
* Make end-markers on a live-map clickable to make liveupdate follow that track.
* Rename a column in the tracks table, it has been misnamed since v1.0.
* Add an uninstall.php file that removes database tables and options.
* Add WordPress MultiUser support.
* Add a debug function for writing stuff to debug.log.
* Add Promise-polyfill by Taylor Hakes, to support older browsers (most notably IE 9-11).

= v2.3 =
Release date: 23 December 2016

This release is long overdue; most of these changes were made months ago, and I apologize.

* Fix a bug with the 'Upload tracks' buttons in the admin
* Support loading KML files just like GPX, introducing a new shortcode parameter 'kml'
* Fix long standing bug with missing Thickbox on the options page
* Improve admin modal windows positioning

= v2.2 =
Release date: 19 July 2016

* Calculate and update speed per trackpoint when calculating the track distance.
* New replacement tags for a live track's infobar: altitude and speed in m/s, km/h and mph.
* Add shortcode parameter 'points=y|n', to draw a track as a collection of points instead of a line. The 'color' parameter applies to the fill of the points in this case. Be careful with too many points (thousands).
* Change the default tile server URL to the basic OpenStreetMap

= v2.1 =
Release date: 6 June 2016

* Implement MapMyTracks 'upload_activity' request. You can now upload tracks to trackserver directly from OruxMaps without the use of AutoShare.
* Support values 'start', 's', 'end' and 'e' for the 'markers' attribute, to restrict drawing markers to start or end point only.
* Introduce new capability 'trackserver_admin' and grant it to administrators.
* Allow admins to manage and publish other users' tracks, using the new capability.
* CSS fixes for track management on small screens.

= v2.0.2 =
Release date: 23 December 2015

* Previous bugfix was incomplete. Thanks to eHc for another report.

= v2.0.1 =
Release date: 23 December 2015

* Fix bug with incorrect use of $wpdb->prepare. Thanks to eHc for finding it.

= v2.0 =
Release date: 22 December 2015

* Support mutiple tracks in a single map. Use a comma-separated list of track IDs (and/or 'live') in the 'track' parameter to show multiple tracks.
* New shortcode parameter 'infobar' (default false) for displaying an information bar with some information about the latest trackpoint during live tracking. The information bar can be formatted via the Trackserver user profile.
* Support upload of GPX 1.0 files in addition to GPX 1.1.
* Map width is now 100% by default.
* Experimental support for SendLocation iOS app (https://itunes.apple.com/nl/app/sendlocation/id377724446).
* Fix a bug with the OsmAnd timestamp calculation on 32-bit systems.
* Improve performance of the track management page by adding some DB indexes.
* Update Leaflet to version 0.7.7.
* Support (wrapped) GeoJSON as a format for serving tracks. Polyline is still the default, because GeoJSON is 10 times as big.
* Add a [tsscipts] shortcode to force-load the plugin's JavaScript in case the main shortcode usage detection fails.
* Rework the loading and customizing of external JavaScript, to fix some cases where the main shortcode detection would fail.

= v1.9 =
Release date: 1 September 2015

IMPORTANT: This release resets the OsmAnd access key and changes the TrackMe authentication! Please read the changelog and the FAQ, and review your new Trackserver profile for user-specific settings.

* Add Trackserver user profile for per-user options like access codes. Please see the FAQ section for more information!
* Move the OsmAnd access key to the user profile.
* Added a separate password for tracking with TrackMe, for use instead of the WordPress password. Please see the FAQ section for more information!
* Better error handling and meaningful feedback when uploading a file that is too large.
* Fix viewing tracks in admin in recent versions of WordPress.
* Update Leaflet to version 0.7.4.

= v1.8 =
Release date: 29 July 2015

* Fix parsing of MapMyTracks points with negative coordinates. Thanks to Michel Boulet for helping me find the problem.
* Add some more documentation and FAQs.

= v1.7 =
Release date: 15 June 2015

* Add a 'Delete' link in the track edit modal, so you don't have to use a bulk action to delete a single track.
* Do not omit tracks with zero locations in track management.
* Full i18n and Dutch translation.
* Support the 'getttripfull' action for TrackMe, to allow TrackMe 2.0 to import your tracks from the server.
* Use HTTPS in default map tile URL.

= v1.6 =
Release date: 29 April 2015

* Add option for setting the map tile attribution, as required by most tile services and data providers like OSM. If non-empty, the attribution is displayed on every map.
* Properly escape option values on the options page.

= v1.5 =
Release date: 15 April 2015

* Make plugin run a cheap 'update' routine on every request, because we cannot assume that the activation hook is run every time the plugin is updated.
* Fix a bug where tracks management would not show any tracks due to a broken SQL query.

= v1.4 =
Release date: 8 March 2015

* Add OsmAnd live tracking support.
* Fix buggy timezone offset calculation, that would break during DST.
* Draw a start/end marker for each track on a map. Loading tracks from a GPX URL already supports multiple tracks.
* Add a compatibility fix for PHP < 5.4
* Fix a bug with viewing tracks in WP admin without pretty permalinks

= v1.3 =
Release date: 28 February 2015

* Fix a grave bug, that made Trackserver usable ONLY on WP installs using mod-rewrite and Pretty Permalinks.
* Add 'use_trackserver' capability for authors, editors and admins and use it to restrict tracking to those roles, while at the same time allowing non- admins to manage their own tracks.
* Add shortcode attribute 'gpx' for loading a GPX file directly from an external URL.
* Calculate and store the total distance of a track at the time of upload.
* Add bulk action to recalculate track distances.
* Add shortcode attributes: color, weight, opacity, for controlling track display style.
* Fix security bug where it was possible to delete or merge other users' tracks.
* Code cleanup and inline documentation.

= v1.2 =
Release date: 20 February 2015

* Allow GPX files to be uploaded and added to posts/pages via the WP media manager.
* Drastically improve performance of importing GPX files (via WP admin or HTTP POST).
* Fix UTC to local time conversion for GPX imports, correct for DST in most cases.
* Show start/end markers in track view modal in the admin.
* Show map name as modal title when viewing from track management in the admin.
* Optimize track view modal layout.
* Bugfixes.

= v1.1 =
Release date: 12 February 2015

* Implement 'markers' shortcode to disable start/end markers on tracks.
* Make tile server URL a configurable option.
* Bugfixes.

= v1.0 =
Release date: 10 February 2015

* Implement 'delete' bulk-action in track management.
* Implement 'merge' bulk-action in track management.
* Implement 'Upload tracks' from track management.
* Code cleanups.

= v0.9 =
Release date: 2 January 2015

* Initial release, with tracking supoort, simple shortcode and track management interface.

== Upgrade Notice ==

= 5.0 =
Trackserver URLs to be used in clients are changing, introducing the Universal Slug. Read the changelog!

= 4.3 =
The TrackMe 'URL header' setting has changed, to support Cloud Sharing. Please read the FAQ.