=== Dprime Safe SVG ===
Contributors: dprimesolutions
Tags: svg, security, media, vector, mime
Requires at least: 6.4
Tested up to: 7.1
Requires PHP: 8.2
Stable tag: 1.4.1
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Enable SVG uploads to the Media Library and sanitize them on upload to stop XML and SVG vulnerabilities.

== Description ==

Dprime Safe SVG allows SVG and SVGZ uploads to the WordPress Media Library and automatically sanitizes every file to prevent XML and SVG based vulnerabilities.

**Features**

* Allows SVG and SVGZ uploads to the Media Library
* Sanitizes every file on upload to remove dangerous elements and attributes
* Per role upload control. Pick which roles can upload SVG files
* Correct previews and dimensions for SVG attachments in the Media Library
* Safe SVG block in the editor for inlining SVG markup into pages
* Backed by the well known enshrined/svg-sanitize library

== Installation ==

1. Upload the plugin folder to `/wp-content/plugins/`.
2. Activate Dprime Safe SVG through the Plugins screen.
3. Visit the Safe SVG admin page from the Dprime menu (or its own top level menu) to configure roles.

== Frequently Asked Questions ==

= Which roles can upload SVG files by default? =

Any role that already has the standard upload_files capability can upload SVG files. Open the Safe SVG admin page and tick specific roles to restrict that.

= Is this safe? =

Every SVG file is run through the enshrined/svg-sanitize library on upload. Anything outside the allowlist of safe SVG tags and attributes is stripped before the file is written to disk.

= I had the old Safe SVG plugin installed. Do I lose my settings? =

No. The role list, large file toggle, and capability name are stored under the same option keys as the original plugin, so the upgrade is a no op for your data.

= Does this plugin work with Dprime Core? =

Yes. With Dprime Core installed and active, the Safe SVG admin page appears under the Dprime parent menu. Without Core, the plugin runs standalone with its own top level menu.

== Changelog ==

= 1.4.1 =
* Disabled remote references during SVG sanitization.
* Added compressed and decompressed size limits plus checked, locked writes.
* Hardened optimizer, block, and shortcode file handling.
* Promoted the verified release to the stable channel.

= 1.3.0 =
* Added [dprime_safe_svg] shortcode with id, width, height, and class parameters
* Added Display style setting with Bordered and Card themes
* Added CSS classes tab listing all overridable frontend classes
* Added shortcode reference table in Settings tab
* Added footer with Dprime Solutions link and plugin page link
* Added uninstall.php to remove all options on deletion
* Admin stylesheet moved to admin/css/admin.css
* Fixed header logo to correct Dprime double-circle mark
* Tabs now switch client-side. Order: Settings, CSS classes, Help
* Removed all inline code comments

= 1.2.0 =
* Extracted help tab into includes/help.php. Override CSS class reference added to admin.css.

= 1.1.1 =
* Fixed admin page header mark to canonical white circle brand mark.

= 1.1.0 =
* Full Dprime design system styling. Settings and Help tabs. Plugin renamed dprime-safe-svg. Canonical menu pattern. DPSS prefix normalisation.

= 1.0.9 =
* Previous release.

== Upgrade Notice ==

= 1.2.0 =
Help tab extracted to separate include. No functional changes.

= 1.1.1 =
Brand mark fix in the admin page header. No functional changes.

= 1.1.0 =
Full rebrand and design system update. Settings are preserved. Existing Safe SVG blocks in posts continue to render unchanged.
