Releases

The native API resources blog_posts and blog_comments now restrict reads for callers below Editor (anonymous requests, Researcher and Author keys) to what the public site shows: published, non-scheduled posts and approved comments, with the commenter's email omitted. status and exclude_future filters from such callers are ignored, and reads of hidden records answer 404. Editors and above are unaffected.
Fixed the public comment form, which omitted the CSRF elements Omeka adds to every named form, so every visitor submission was silently rejected. The form is now rendered from the module's CommentForm, with per-field errors, and the post template shows approved comments using the view variable the controller actually sets.
Fixed the unit tests: BlogService receives a mocked event manager, the post-delete event is asserted, and the test bootstrap locates the Composer autoloader in the module, application, or repository root.

1.3.1