Annual packages

Sources and annual packages · Daily Scripture 1.2.0

Data, downloads and year changes

Downloads are explicitly started in the data manager. Source checks list available packages but do not install the next year automatically. Successful catalogue checks are cached for six hours, failed checks for five minutes. Manual uploads remain available when a provider or connection is unavailable.

Annual files must contain a complete calendar year with complete verse pairs. Existing years are replaced only after successful validation and explicit selection. Day and year changes follow the WordPress timezone. Missing data produces a notice instead of reusing old verses. The annual overview indicates missing data for the year transition. Refresh page and CDN caches at the start of each day.

All plugin-managed text files use these paths relative to wp-content/uploads/:

daily-scripture/data/herrnhuter/YYYY.json.php
daily-scripture/data/bible2/YYYY.json.php
daily-scripture/bibles/luther-1912.json.php
daily-scripture/bibles/elberfelder-1905.json.php
daily-scripture/bibles/menge-1939.json.php
daily-scripture/bibles/schlachter-1951.json.php
daily-scripture/bibles/bsb-2026.json.php
daily-scripture/bibles/webbritish-2020.json.php

Additional annual editions use YYYY--EDITION_ID.json.php in the respective source directory; older YYYY.json.php files remain valid.

daily-scripture/downloads/ provides temporary download staging. Annual files use the data/ subdirectory. In Multisite, per-site activation separates data under daily-scripture/sites/BLOG_ID/; new sites inherit defaults lazily. Renamed content directories use WP_CONTENT_DIR/uploads/daily-scripture/. Custom upload locations are not used for these text files.

Protection files, PHP exit guards, path validation and locked writes protect the local store. Browser uploads initially enter PHP’s configured upload temporary directory. Plugin settings and short-lived status messages are stored in the WordPress database.

License

Copyright © 2026 David Decker – deckerweb. The plugin code is licensed under GPL-2.0-or-later: you may redistribute and modify it under the GNU General Public License, version 2 or any later version. It is distributed without warranty. See LICENSE for the full license text.

This software license does not cover downloaded Bible texts or annual packages. Their source-specific permissions and attribution requirements are described above.

Losungen download and certificate errors

For a missing-issuer certificate error, Daily Scripture retries the approved Losungen download once using bundled official intermediate certificates. These intermediates must validate against the current WordPress trust roots. HTTPS and hostname verification remain enabled. Other providers, expired certificates and unrelated failures do not use this fallback. If verification still fails, manually upload the official package or ask your hosting provider to inspect the connection.

Year overview, download diagnostics and preview date

Under Daily Scripture → Data sources, the overview shows both years per source. Only sources you use need data. Available packages and missing files link to their source check. “Not listed in the last source check” describes a cached result rather than claiming that the provider has not published the package. Opening this overview makes no provider requests.

A failed download now identifies its category. Technical details contains only bounded reason codes, HTTP/cURL numbers and the plugin version. Copy diagnostic copies those values; without JavaScript or clipboard access the text remains manually selectable. No raw responses, server paths or credentials enter the diagnostic. Existing short-lived check/notice caches are reused, with no additional persistent log. Certificate verification remains enabled.

In the design preview choose Today, Tomorrow or Choose a date. Tomorrow and custom dates display only installed local annual data. Missing data or a date outside the source’s allowed range produces a notice. Only today’s default preview may use a clearly labeled design sample. The website timezone applies; the date and other preview controls change neither saved settings nor published readings and start no download.

Leading /…:/ introduction markers in Die Losungen are displayed in italics without visible slashes; wording and stored originals remain unchanged. Help → Support diagnostics offers a copyable local technical report. The same information appears under Tools → Site Health → Info: component versions, installation mode, extensions, installed years and safe codes from source checks still in the temporary cache. No new connection is tested and nothing is sent automatically. Since WordPress 6.9, the native Command Palette automatically includes accessible plugin menus; no extra Daily Scripture commands are registered. WordPress 6.6–6.8 retains the regular plugin menus.

Reading existing text files

Reading installed annual data and Bible editions does not create directories, protection files or temporary files. Existing readable data remains usable when DS parent directories are write-protected or lack newer index/guard files. Path, symlink, file-format and PHP-exit-prefix validation remain active. Imports, replacements and deletions still require suitable filesystem permissions; import/saving prepares local protection and never widens permissions automatically.

Local folder and import security

Daily Scripture keeps its file-based storage under wp-content/uploads/daily-scripture/, with separate website directories in Multisite. Downloads and manual imports do not require loopback requests, a web-access test or a confirmation to bypass such a test.

The plugin creates Apache/IIS deny files and empty indexes in its own directory tree; existing host rules are preserved. Normal WordPress upload folders outside the Daily Scripture subtree are not changed. Persistent text files retain the PHP exit prefix and are decoded as JSON data, never included or evaluated. Imports validate source, size, format and complete records. Archives are not extracted: only the expected text entry is read. Arbitrary filenames, executable uploads, traversal paths and symbolic links cannot choose a storage destination. Temporary binary files are created exclusively and removed after processing; validated data replaces existing files atomically.

These safeguards protect the plugin’s own write/read paths; they do not certify every hosting configuration. Nginx ignores .htaccess; an optional host-level deny rule can additionally prevent direct downloads of complete collections. For the usual content path, the host can adapt:

location ^~ /wp-content/uploads/daily-scripture/ {
    deny all;
}

Keep PHP/upload handling and public backup/CDN mappings configured appropriately. Direct readability of a text file is distinct from executable-code injection. Source-specific usage rights remain applicable. No encryption, database relocation or automatic server configuration changes are introduced.

Imported from the published release 1.2.0. Original source · Deutsch