• Base directory restriction for all file reads, with a second setting for writes.
• Download endpoint allows only po/mo/pot files as per info tab
• Fixed unescaped HTML loophole in the file path placeholder UI
• JSON and PHP source only viewable if parsed as a valid l10n schema.
• Fixed bug in backup restoration that allowed copying of an invalid PO target.
• Bumped WordPress compatibility to 7.1.2