Trilobita DocVault
| 开发者 | trilobita |
|---|---|
| 更新时间 | 2026年5月20日 22:32 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.0 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
Trilobita DocVault is a WordPress document management plugin with version control and a searchable document library. Upload and organise files in the admin, then share them with your team or site visitors — with a searchable, sortable document table, Gutenberg block support, full version history, download tracking, and access control.
Key Features:
- Version History - Full version history with rollback, download, and delete for every document.
- Drag & Drop Upload - Intuitive drag-and-drop file upload interface in the admin.
- Download Tracking - Track download counts for all documents.
- Access Control - Restrict documents to logged-in users only.
- Frontend Display - Responsive shortcode-powered document table with AJAX search, sortable columns, and pagination.
- Gutenberg Block - Native block editor support for embedding documents.
- File Type Support - PDF, DOC, DOCX, XLS, XLSX, PPT, PPTX, ODT, ODS, ODP, RTF, CSV, TXT.
- Document Categories - Hierarchical taxonomy for organizing documents.
- Document Tags - Flat tag taxonomy for cross-cutting labels; filter the frontend list by tag with
[trdv_list tag="slug"]or show a tag dropdown withshow_tag_filter="true". - Document Expiry Dates - Set an optional expiry date per document; expired documents are automatically hidden from the frontend list.
- Manual Sort Order - Drag documents into your preferred order in the admin list; use
[trdv_list orderby="menu_order"]to apply that order on the frontend.
- Unlimited Version History - Remove the 5-version limit and keep complete history for every document.
- Per-Document Access Control - Restrict individual documents to specific user roles.
- Audit Trail - Full activity log with CSV export for compliance and accountability.
- Email Notifications - Configurable alerts for uploads, updates, and approvals.
- Document Approval Workflow - Require documents to be reviewed before publishing.
- Bulk Upload - Upload multiple documents at once with duplicate detection.
- Download Analytics - Detailed per-version download statistics.
- Duplicate Detection - Find and merge duplicate documents to save storage.
- Storage Management - Advanced tools for monitoring and cleaning up storage.
安装:
From the WordPress plugin directory (recommended):
- Go to Plugins > Add New in your WordPress admin.
- Search for "Trilobita DocVault".
- Click Install Now, then Activate.
- Go to the new Documents menu in the admin sidebar and start uploading documents.
- Upload the
trilobita-docvaultfolder to/wp-content/plugins/. - Activate the plugin through the 'Plugins' menu in WordPress.
- Go to the new Documents menu in the admin sidebar and start uploading documents.
屏幕截图:
常见问题:
What file types are supported?
Trilobita DocVault supports PDF, DOC, DOCX, XLS, XLSX, PPT, PPTX, ODT, ODS, ODP, RTF, CSV, and TXT files.
How does version control work?
From the Edit Document screen, you can upload new versions of a file. The plugin keeps a full version history with the ability to download, restore, or delete any previous version. By default, up to 5 versions per document are kept.
How do I display documents on the frontend?
There are three ways:
- DocVault Document block — add a single document with a download button directly in the Gutenberg block editor.
[trdv_list]shortcode — displays a searchable, sortable table of documents on any page or post.[trdv_link]shortcode — inserts an inline download link within any text. You can also use the Trilobita DocVault Link toolbar button in the block editor to link selected text to a document without using a shortcode.
Are download links secure?
Yes. Download links use the format /trdv/download/{id}/ rather than a direct path to the file. Every download request is handled by WordPress, which checks access permissions before serving the file. The actual file location on the server is never exposed. Restricted documents cannot be accessed by guessing a URL, and files are always forced to download rather than opened inline in the browser.
Can I restrict document access?
Yes, you can restrict documents to logged-in users only via the Settings page.
Where are uploaded files stored?
Files are stored in /wp-content/uploads/trdv-documents/ organized by year and month folders.
How many versions are kept?
By default, up to 5 versions per document are kept. Older versions are automatically removed when the limit is reached.
Can I set an expiry date on a document?
Yes. Each document has an optional expiry date field in the admin. Once the date passes, the document is automatically hidden from all frontend listings — the [trdv_list] shortcode, AJAX search, Query Loop block, and REST API. Direct download and view URLs are also blocked for non-admin, non-author users. To include expired documents in a specific [trdv_list] listing, use [trdv_list show_expired="true"]. Admins and the document's author can still download expired documents directly; they remain visible and manageable in the admin.
Is the plugin translation-ready?
Yes, Trilobita DocVault is fully translatable. A .pot template file is included in the plugin's languages/ folder to help you get started. Translation files should be named trilobita-docvault-{locale}.mo (e.g. trilobita-docvault-fr_FR.mo) and can be placed either in the plugin's own languages/ folder or in /wp-content/languages/plugins/.
更新日志:
1.5.2
- Fix: Admin CSS accent colours now use
var(--wp-admin-theme-color)so buttons, borders, and links match whichever admin colour scheme is active (Fresh, Modern, Ocean, etc.).
- Docs: corrected expiry date FAQ — expired documents are now blocked at download, view, and REST level for non-admin/non-author users (enforced since 1.4.9; FAQ previously described the old behaviour).
- Docs: corrected stale line number in phpcs:disable comment in class-admin-interface.php.
- Compatibility: Confirmed compatible with WordPress 7.0.
- Enhancement: Block API version updated to 3, enabling iframed post editor support in WordPress 7.0 when all blocks in a post are version 3 or higher.
- Enhancement: Public stylesheet now declared via
style_handlesin block registration, ensuring styles load correctly inside the iframed editor. - Fix: Plugin Check warning for interpolated
$placeholdersin sort-order query suppressed with targetedphpcs:disable/enable— the variable contains only%dtokens and is not user-controlled. - Fix: Plugin Check warning for
meta_queryin pre_get_posts access-control filter suppressed — no alternative API covers this use case.
- New: Single document page visits now redirect (302) to the download endpoint. This makes the Query Loop block's "make title a link" option work correctly.
- New: Documents now appear as a selectable post type in the Core Query Loop block, enabling custom frontend layouts built entirely in the block editor. Public and logged-in access restrictions are enforced at the REST level; role-restricted documents are blocked on individual REST fetches (collection-level role filtering has the same limitation as
[trdv_list]). - Fix: Expiry dates are now enforced at the download, view, and REST level via
can_view_document(). Previously expiry only filtered documents from[trdv_list]output; direct download/view URLs and REST requests could still reach expired documents. - Fix: Expired and access-restricted documents are now hidden from the Query Loop block listing entirely. A pre_get_posts hook applies access control and expiry at query level; a the_posts row-level filter removes role-restricted documents that cannot be excluded in SQL.
- New: Manual sort order — drag the handle column in the admin document list to reorder documents. The first drag establishes positions for all existing documents; subsequent drags update only the visible page. Use
[trdv_list orderby="menu_order"]to display documents on the frontend in their manually-defined order. - New: Tag support — documents can be tagged via a new flat Tags taxonomy shown as an admin column. Use
[trdv_list tag="slug"]to pre-filter by tag and[trdv_list show_tag_filter="true"]for a tag dropdown filter.
- New: "Include documents in site search" setting — when enabled, documents appear alongside posts and pages in WordPress search results. Access restrictions are respected.
- New: View button for PDF and image files — opens the file in a new browser tab without forcing a download. Supported in both the
[trdv_list]shortcode (show_view="false"to hide) and the DocVault Document block. - New: Document description field — set an optional description per document; displayed inline in
[trdv_list]with a toggle button, and directly in the DocVault Document block (full layout). - New: Clear search button — an × button appears inside the search field when text is entered; clicking it resets the field and refreshes the list.
- New: Category filter dropdown —
[trdv_list show_category_filter="true"]adds a category dropdown alongside the search box. - New: File type filter dropdown —
[trdv_list show_type_filter="true"]adds a file type dropdown; only types present in the library are listed. - New: Download count column —
[trdv_list show_count="true"]adds a Downloads column showing total download count per document. Also available as a toggle in the DocVault Document block (full layout). - Fixed: Expiry days-remaining calculation now anchors both dates to UTC before comparison, ensuring correct behaviour on servers where the PHP default timezone differs from UTC.
- Added a description to the Version History metabox explaining that the Restore button makes a previous version the active file served to users.
- Security: all upload entry points now reject files immediately when content-based MIME validation fails — no fallback to browser-supplied MIME type.
- Developer: added
trdv_allowed_file_typesfilter to the upload validation,wp_handle_upload()mimes, download tracker MIME check, and upload UI — allows Pro to extend the accepted file type list without patching free plugin code.
- Fixed: legacy files stored in the old
sdm-documents/directory are now correctly hidden from the media library. - Fixed: media library deletion guard now protects legacy
sdm-documents/files, not just the currenttrdv-documents/directory. - Fixed: storage stats "current vs. old" byte split now uses the explicit current-version pointer rather than assuming the last array entry is current.
- Fixed: legacy attachment-based files can be deleted through DocVault version management again — the deletion guard was incorrectly blocking the operation.
- Fixed: replaced deprecated
current_time('timestamp', true)calls withtime()to eliminate notices on sites with WP_DEBUG enabled.
- New uploads are no longer registered as WordPress media library attachments — DocVault files are now stored privately and managed entirely within DocVault.
- Legacy attachment-based files are hidden from the media library grid and modal to prevent accidental deletion.
- Attempting to delete a DocVault-managed attachment from the media library is now blocked with an explanatory error.
- Version limit warning replaced with a prominent dismissible banner above the upload area — includes the limit message, a Pro upgrade link, and a "Continue anyway" button. Saving is blocked until the warning is acknowledged or the file is removed.
- Security: path containment validation added for all path-based file operations (serve and delete) using realpath() to prevent arbitrary file access or deletion if post meta is tampered.
- Fixed: introduced an explicit current-version pointer (_trdv_current_version_num) so the active file is preserved correctly after a merge operation. Prevents version number collisions and accidental deletion of the current version.
- Added file type filter dropdown to the admin document list — filter by PDF, DOCX, etc. in one click.
- Fixed: expiry date hook now fires when the expiry date is cleared, so Pro audit log and email notifications correctly record the change.
- Added document expiry dates — set an optional expiry date per document; expired documents are hidden from the frontend list automatically. Use
[trdv_list show_expired="true"]to include them. - Fixed: block renderer and [trdv_link] shortcode now check access control before exposing document metadata
- Fixed: frontend query applies access-control filtering at query level for anonymous users
- Fixed: AJAX search reads show_expired from the PHP-rendered data attribute for consistency with initial render; value cannot be set independently via client-side input
- Fixed: per-document roles access type no longer silently discarded by the save handler
- Fixed: _trdv_upload_date now uses current_time() WordPress API
- Added dismissible review notice shown after 21 days on DocVault admin pages
- Replaced version limit confirm dialog with an inline notice linking to DocVault Pro
- Fixed download button text being hidden when the theme link colour matches the button background colour
- Fixed drag-and-drop upload not attaching the file on Publish/Update (title was pre-filled but file was silently discarded)
- Fixed drag-and-drop: cancelling the version-limit confirmation dialog no longer silently queues the dropped file for upload
- Settings page redesigned with card layout matching Pro (File Storage, Categories, Access Control cards)
- Block title corrected to "DocVault Document" in both PHP and JS registrations
- Added support for ODT, ODS, ODP, RTF, CSV, and TXT file types
- readme.txt: usage section reorganised, block and toolbar button documented, Pro section added, FAQ expanded
- Fixed version history upload dates stored in local time instead of UTC
- Fixed version history dates displaying raw UTC string instead of converting to site timezone
- Improved folder structure locked-state warning to explain impact and what would be required to change it
- Global "Specific roles" access option now shows an upgrade prompt for free users; existing saved configurations continue to be honoured
- Help page: version limit note now hidden when Pro is active; Pro features section appended when Pro is active
- Added trdv_help_page_after_content action hook for extensibility
- Fixed flat folder structure filename prefix going out of sync after version pruning
- Fixed download log timestamps stored in local time instead of UTC
- Added admin notice when uploads directory is not writable on activation
- Initial release on WordPress.org
- Fixed remaining WordPress Plugin Check warnings: corrected phpcs:ignore comment placement
- Fixed WordPress Plugin Check warnings: phpcs:ignore for unavoidable direct DB queries and slow query args
- Fixed unprefixed variables in admin view templates (WordPress.NamingConventions.PrefixAllGlobals)
- Applied wp_check_filetype_and_ext MIME type validation to non-AJAX upload path
- Breaking change: Renamed shortcode
[trdv_documents]to[trdv_list]— update any pages using the old shortcode - Breaking change: Renamed shortcode
[docvault_link]to[trdv_link]— update any content using the old shortcode - Renamed plugin from Smart Document Manager to Trilobita DocVault
- Fixed null dereference on get_post_status_object() in privacy exporter
- Fixed incorrect log prefix in download tracker
- Fixed custom upload directory filter firing without a valid document context
- Improved MIME type handling: validates detected type against allowlist before sending Content-Type header
- Validates file MIME type from actual file content rather than browser-supplied value on upload
- Added explicit file upload validation before processing
- Added phpcs ignore comments for intentional code patterns
- Addresses all three common WordPress.org rejection reasons
- Fixed all WordPress Plugin Check errors
- Added translators comments for all placeholder strings
- Fixed ordered placeholders for i18n compliance
- Fixed unescaped output in frontend display
- Fixed %i placeholder for WP 5.8 compatibility
- Removed deprecated load_plugin_textdomain call
- Updated Tested up to WordPress 6.9
- Added phpcs ignore comments for intentional code patterns
- Added index.php to all directories for security
- Added LICENSE.txt file
- Added privacy disclosure section for IP logging
- Moved inline styles and scripts to enqueued files
- Generated translation template (.pot file)
- Fixed wp_unslash() usage on POST data
- Fixed $wpdb->prepare() in uninstall.php
- Added upload directory protection (index.php, .htaccess)
- Updated Tested up to 6.7.1
- Refactored plugin architecture for extensibility
- Version history limited to 5 versions per document by default
- Added E2E test suite with Playwright
- Code cleanup and stability improvements
- Added role-based access control for documents
- Added download tracking with statistics
- Added Document block for Gutenberg editor
- Added [trdv_link] shortcode for inline document links
- Added Settings page with access control options
- Added option to use WordPress categories or separate document categories
- Improved security for file downloads
- Fixed HTTP header injection vulnerability in downloads
- Fixed path traversal protection using realpath validation
- Initial release
- Custom post type for documents
- File upload with drag-and-drop
- Version history with rollback
- Frontend shortcode display with AJAX search
- Document categories taxonomy