AumNexCart — full changelog
===========================

readme.txt carries only the most recent entries: wordpress.org truncates the Changelog
section at 5000 bytes, silently. Everything is kept here.

= 1.4.4 =
* Added: a "Manual" link next to Deactivate on the Plugins screen, pointing at the manual in the
  administrator's own language (English, Simplified Chinese, Traditional Chinese, Japanese).
  Until now the plugin shipped only inside a template kit, where the manual arrived through that
  channel; installed from the directory there was nothing in the admin saying where to find it.
* Changed: the changelog in this file now carries only recent releases. wordpress.org truncates
  that section at 5000 bytes without saying so, and the full history is longer. All of it is kept
  in `changelog.txt` inside the plugin folder.

= 1.4.3 =
* Fixed: on the settings screen, the Product and Category URL slug fields could run past the
  right edge of their card at browser widths just above 782 pixels. The fields carry core's
  `regular-text` class, which sets a fixed width and no maximum; core only clamps it below that
  breakpoint. They now fill their column instead.

= 1.4.2 =
* Every name the plugin declares is now prefixed `aumnexcart`. WordPress.org requires a prefix of
  at least four characters and its analyser reads the token before the first underscore, so the
  previous `aum_` counted as three:

      post type        aum_nexcart_product          -> aumnexcart_product
      taxonomy         aum_nexcart_category         -> aumnexcart_category
      options          aum_nexcart_settings         -> aumnexcart_settings (and two more)
      post meta        _aum_nexcart_price_min       -> _aumnexcart_price_min (and eight more)
      shortcodes       [aum_nexcart_enquiry]        -> [aumnexcart_enquiry] (and one more)
      URL parameters   ?aum_enquiry_add=            -> ?aumnexcart_enquiry_add= (and two more)
      classes          AUM_NexCart_Product          -> AumNexCart_Product (eighteen)
      constants        AUM_NEXCART_PATH             -> AUMNEXCART_PATH (four)
      hooks            aum_nexcart_card_after_title -> aumnexcart_card_after_title (nine)
      REST namespace   aum-nexcart/v1               -> aumnexcart/v1

  This is a breaking change for stored data and for links or shortcodes written by hand. No
  migration routine is included: the plugin has not been distributed, so products and settings
  saved by a pre-release build must be re-created. Each name is now defined once, as a class
  constant.
* CSV import filters the imported file's own HTML. `wp_insert_post()` applies kses only for users
  without the `unfiltered_html` capability, which a single-site administrator has, so markup in an
  imported CSV reached `post_content` unfiltered and was rendered by `the_content`. The person
  running an import is not the author of the file being imported. Descriptions now pass through
  `wp_kses_post()` and titles through `sanitize_text_field()`: script, style and event-handler
  attributes are removed, while paragraphs, emphasis, links, lists, images, shortcodes and
  non-Latin text are unchanged apart from a bare `&` being encoded as `&amp;`.
* The Enquiry settings page no longer writes a shortcode or URL parameter name inside a
  translatable sentence; both arrive as placeholders taken from the constants. A name inside a
  translatable string turns its existing translations into fuzzy entries when it changes, and
  fuzzy entries are excluded from the compiled catalogue, so the sentence silently falls back to
  English. `zh_CN` covers 207 of 207 strings with no fuzzy entries.
* The settings hint and three code comments still used Aumframe's old shortcode name
  (`[aum_form]` -> `[aumframe_form]`, renamed in Aumframe 1.31.0 for the same reason). They now
  name the current one.
* CSS class names (`.aum-nexcart-*`) are unchanged. They are not in the PHP or JavaScript global
  namespace and nothing outside the plugin references them.

= 1.3.4 =
* **The plugin now ships a Simplified Chinese translation.** `languages/aumnexcart-zh_CN.po` and
  `.mo` translate all 207 strings. Until this release it was the only AumCreate product without
  one: the theme, aumframe, aumreserva and aumkit all shipped `zh_CN`, so a Chinese site owner got
  a Chinese admin from every one of them except this plugin, whose screens stayed entirely in
  English. The previous release shipped the `.pot` and stopped there, which is the template a
  translator starts from, not a translation.
* Seven strings are deliberately identical in both languages and are not a gap: the product names
  `AumNexCart`, `AumCreate` and `NexCart`, the service name `WhatsApp`, and two URLs. Measured on a
  running zh_CN site, 200 of 207 come back translated and those 7 come back unchanged.
* The 1.3.3 note below said the `.pot` covers 208 strings. It covers **207** — the count came from
  `grep -c '^msgid "'`, which also counts the empty `msgid` in the file header. `msgfmt
  --statistics` is authoritative for this format.
* No interface code changed in this release.

= 1.3.3 =
* **The plugin now ships a translation template.** `languages/aumnexcart.pot` covers all 207
  translatable strings. Without it nothing could be translated at all: a translator had no file to
  start from, and the plugin had carried its strings for every release so far with no way to use
  them. Every string with a placeholder carries a translators comment, so a translator can see what
  each `%s` will be replaced with.

= 1.3.2 =
* **Fixed: the plugin's own stylesheets and scripts kept their old version number after an update.**
  Browsers and CDNs key their cache on that number, so a site updated from an earlier release could
  go on serving the previous CSS and JavaScript against the new PHP. The number now comes from the
  plugin header, so it can never fall behind again.

= 1.3.1 =
* **Removed the Custom CSS box on the Advanced settings tab.** WordPress.org no longer permits a
  plugin to store and output arbitrary CSS, so the field, the option and the `wp_head` output are
  gone. No published kit used it. If you had CSS in there, move it to Appearance → Customise →
  Additional CSS, which is core's own equivalent and survives a theme change.
* **Security:** the product JSON-LD was written with `JSON_UNESCAPED_SLASHES` and no tag escaping, so
  a product title containing `</script>` closed the element early and everything after it was parsed
  as markup. Now escaped with `JSON_HEX_TAG`.
* Every `$_POST` / `$_GET` / `$_FILES` read is now sanitised at the point of input (15 sites). The
  values were already sanitised per field before being stored, one call further on — this makes it
  visible where it is read, which is what the coding standard asks for.
* The `LIKE` patterns in the uninstall and cache-clearing `DELETE` queries now escape `_`, which is a
  single-character wildcard. The queries matched slightly more option names than they read as.
* Dropped the unused `Template_Loader::render()` helper (it had no callers) and with it the only
  `extract()` in the plugin.
* Dropped `load_plugin_textdomain()`: WordPress loads translations for wordpress.org-hosted plugins
  by itself since 4.6.
* The template files now prefix their own variables. WordPress includes a template at global scope, so
  a bare `$terms` or `$description` in `archive-aumnexcart-product.php` really was a global and could
  collide with another plugin's.

= 1.2.1 =
* Fixed: with AumCreate 2.11.0 the settings page vanished from the admin menu, with no error.
  That theme moved its admin pages under Appearance (wordpress.org does not allow a theme to
  create a top-level menu), so the slug this plugin mounted under stopped being a top-level menu.
  The parent is now asked for rather than hard-coded, and older versions of the theme still work.

= 1.2.0 =
* The plugin no longer updates itself. Updates now come from wordpress.org, the same place as every other plugin on your Plugins screen. Nothing you configured changes, and no product data is touched.
* Removed the licence-key reading. There was never a feature behind it in this plugin; the settings screen only mentioned it.
* Fixed: deleting the plugin left every product category behind in the database. Products and settings were removed as described, categories were not.
* Fixed: the links along the top of the settings screen, and the redirect after saving, both dropped you onto the product list instead of the settings page. Only the first section was reachable.
* Hardening: two attributes on the product contact links (`target`, `rel`) were written into the page without escaping, next to a class and href that were escaped. Their values were always fixed strings so nothing could be injected, but they are no longer built that way.

= 1.1.0 =
* Enquiry list. Visitors collect products across the site (quantities included) and send them as one enquiry. Settings → Enquiry: pick the page that carries `[aumnexcart_enquiry]` and a form with a hidden field; `[aumnexcart_enquiry_link]` is the header badge. Every product's add link is `<enquiry page>?aumnexcart_enquiry_add=<id>` — a real link, upgraded in place by script. The list lives in the visitor's browser only.
* The single-product template's contact actions now start with the add button when the list is on.

= 1.0.7 =
* Corrected the readme metadata: the stable tag said 1.0.0 while the plugin was at 1.0.6, and the tested-up-to version was three WordPress releases behind. No functional change.

= 1.0.1 - 1.0.6 =
* These releases predate this changelog. They were made before the plugin entered version control, and rather than reconstruct them from memory they are left unlisted.

= 1.0.0 =
* Initial release with full feature set across three internal development packs.
