== Changelog ==

= 3.2.2 =

* The wallet login button, the profile fields it shows inline and the Terms checkbox now take their look from the page's theme instead of being drawn like a WordPress admin control: on an ordinary page the button is drawn the way the theme draws its own buttons - its font, its colours, its border and radius - and the email, name and Terms controls next to it inherit the theme's font and spacing. A theme that styles no buttons of its own gets a plain outlined button in the current text colour
* The plugin no longer injects a page-wide CSS reset into a page that shows the button: the page keeps its own body font, its own link underlines and its own element margins and spacing, instead of being flattened to the plugin's Arial body and collapsed paragraph rhythm
* The new `ethpress_button_surface` filter lets a site say itself which surface the button is rendered on, so an integration the plugin does not know can name its own host instead of relying on the surface the plugin detected
* The WordPress login screen keeps its admin-style button, and the WooCommerce and Ultimate Member forms keep the look of the plugin whose form they stand in - only a page that has a theme of its own changes

= 3.2.1 =

* Fixed the wallet button inside an **Ultimate Member** form: it was drawn inside a second button - the field opened its `um-field` wrapper twice, so the button sat in a duplicate div - and it did not look like the form it stood in. It now carries Ultimate Member's own secondary-button class, the one the form's "Register" button is drawn with, and the button the plugin mounts inside it no longer paints a frame of its own, so the visitor sees one button that matches its neighbours in colour, size and hover
* Fixed the wallet button inside a **WooCommerce** form: it is drawn by the theme now, like the form's own "Log In" and "Register" buttons, instead of the small grey admin-style button the plugin uses where the page has no styling of its own. The fix applies to the login, registration, checkout-registration and account-details screens alike

= 3.2.0 =

* Email and social login are back in the **Professional** edition: the plugin no longer hides the "Email" and "Continue with Google" rows there, so the wallet modal offers what the site's Reown project enables. An embedded wallet signs with ERC-1271/ERC-6492, which the Professional edition verifies - that check asks the site's JSON-RPC endpoint (`ethpress_evm_rpc_url`), so a contract-account login needs a reachable endpoint you trust. Ordinary wallets are not affected by that requirement. The **Free** edition keeps both rows hidden, because the ERC-1271/ERC-6492 verification is Professional and a row offered there could only end in a failed login; the plugin sets that itself and a Free site cannot turn the rows back on. On Professional an operator can still force them off with the `hide_email_social` inline key (see the extra readme)
* Linking a second wallet no longer renames the account: the user name stays the address of the **first** wallet the account was registered with. WordPress keeps the user name inside the authentication cookie, so renaming the account used to log out every other session of it (another browser, a phone); those sessions now keep working. The display name and the profile slug still follow the newest wallet
* Accounts that were renamed by linking a wallet in an earlier version keep their current user name - nothing depends on it, so no data is migrated
* Bitcoin wallets that sign in the BIP-322 `full` variant, or with a DER signature accompanied by their public key, now log in (PRO). Previously such a signature was rejected: the plugin understood only the 65-byte BIP-137 compact form and the BIP-322 `simple` form, so a Wallet Standard wallet ended in "Bad signature." after the visitor had approved the prompt
* Smart account login (PRO): an account that is a contract - Safe, Argent, a wallet embedded by a provider - can now log in by answering ERC-1271, and an account that is not deployed yet by ERC-6492. The check asks the chain through a JSON-RPC endpoint, so that endpoint becomes the source of truth for it; point it at your own node with the `ethpress_evm_rpc_url` filter. The new `ethpress_evm_chain_id`, `ethpress_rpc_timeout` and `ethpress_erc6492_validator` filters are documented in the extra readme
* The `Supported networks` setting now offers **VeChain** (PRO). VeChain addresses are derived the same way Ethereum addresses are, so the existing EVM signature check verifies the login. Only wallets that sign an EIP-191 `personal_sign` message are covered - VeChain's own Certificate signature is not supported yet

= 3.1.0 =

* Multichain login (PRO): besides the EVM chains, a visitor can log in with a **Solana**, **TRON**, **Bitcoin** or **TON** wallet. Each chain has its own signature verifier bundled with the plugin, so the checks run on your server and need no external service
* Bitcoin: P2PKH and P2WPKH are verified with BIP-137, taproot (`bc1p…`) addresses with BIP-322
* TON: the wallet signs a `ton_proof` (domain + timestamp + payload) instead of a text message. The payload is one-time, tied to the login message and expires in 5 minutes
* Every chain is now chosen in the wallet modal, so the login stays one button: TronLink and Leather are listed like any other wallet, and TON is a "TON" row that opens the wallet's own connect window (a `ton_proof` can only be asked for while connecting). The separate `Log in with TronLink` / `Log in with Leather` / `Log in with TON` buttons and the `Also show the per-chain buttons` setting are removed
* A wallet on a phone logs in through the same modal: TRON gets a QR code the plugin draws itself (AppKit has no TRON WalletConnect option of its own), and Bitcoin uses AppKit's
* The new `Wallet list` setting (Reown Settings, PRO) decides where the modal takes its list from. `Reown catalogue` (default, the only option in the free version) keeps the list up to date without a plugin release; `This plugin only` builds it from the wallets installed in the browser plus a built-in list of mobile wallets, sends no analytics, and - with `Block AppKit's cloud` on - returns a `Content-Security-Policy: connect-src` header that stops the page from reaching `api.web3modal.org`. WalletConnect (a phone wallet, QR code) works in both modes
* An account can carry **several wallets** (PRO): log in with any of them, and the new `[ethpress_wallets]` shortcode lists them. Unlinking removes only the wallet it was clicked for, with a confirmation. Attaching an address that belongs to another account is refused
* The `Supported networks` setting now offers the non-EVM chains as well (PRO): `Solana`, `TRON`, `Bitcoin` (mainnet, testnet, signet), `TON` (mainnet, testnet) and the test networks
* The `ethpress_login_namespaces`, `ethpress_signature_verifiers`, `ethpress_address_types`, `ethpress_verify_signature`, `ethpress_networks`, `ethpress_ton_manifest_url`, `ethpress_ton_proof_domain`, `ethpress_ton_payload_lifetime` and `ethpress_remote_non_evm_verification` filters are added for add-ons
* The `Diagnostics` section warns when the `php-sodium` extension is missing: ed25519 signatures (Solana and TON) are then checked by the bundled pure-PHP implementation, which works but is slower
* A wallet user's address is printed in full everywhere the EVM address used to be (profile, `[ethpress_account]`, `[ethpress_wallets]`, address fields); only the generated user name is shortened
* The wallet modal no longer downloads a webfont from a third-party domain: it renders in the visitor's system UI font, so a page with a login button makes no request to `fonts.reown.com` and preloads no font files
* The new `Modal appearance` setting (Reown Settings, PRO) can make the wallet modal follow your theme: its font, its accent colour and its corner radius. Only values that cannot break the layout are taken over - a light accent that would leave the button unreadable is ignored, and the radius is capped

= 3.0.0 =

* The login modal is rewritten on Reown AppKit (the successor of WalletConnect v2). The old web3modal based front end is removed
* The new `Reown` settings section is added: `Reown Project ID`, `Theme mode` and `Supported networks`
* Multichain support: the new `Supported networks` setting lets you choose which networks are offered to users - the EVM chains (Ethereum, Polygon, Arbitrum, Optimism, Base, BNB Smart Chain, Avalanche, Fantom, Gnosis, zkSync, Linea, Scroll, Celo, Polygon zkEVM, Mantle, Blast, Cronos, Moonbeam) and testnets
* Multisite support: the plugin options are now stored network wide
* The `[ethpress_unlink_button]` shortcode is added to display the Unlink wallet button anywhere. Unlinking removes the wallet association and keeps the account: signing in again with the same wallet links it back to that account, and the wallet cannot be used to register a second one
* A confirmation message is shown to the user after the account is linked
* The Freemius SDK is updated and bundled via Composer
* `olegabr/keccak` is replaced with `kornrunner/keccak`
* Requires PHP 8.1
* The `Disable standard redirect` login setting is added. When enabled, a successful login no longer redirects to the WordPress dashboard or the `Redirect URL`, but returns the user to the page where the login started
* The `noredirect` and `redirect_to` attributes are added to the `[ethpress_login_button]` shortcode, so the redirect can be controlled per button
* The `label` attribute is added to the `[ethpress_login_button]`, `[ethpress_link_button]` and `[ethpress_unlink_button]` shortcodes, so the button text can be changed per button (PRO)
* The `Remember me` login setting is added. Wallet users now stay logged in across browser restarts instead of having to connect their wallet on every visit. The Free version always keeps it enabled
* Wallet users are now registered with an email address, collected from the login form, the WooCommerce checkout, or a placeholder derived from the wallet address, so their profile is editable
* The `Profile completion` login setting is added. When enabled (PRO), new wallet users who registered without an email address are sent to their profile after the first login to add an email and a name. It also has an `Inline form next to the login button` mode, which collects the email and name before the account is created. The values are remembered for the current browser tab, so a reload does not lose them
* The `Hide on the WordPress login page` setting is added. When enabled, the wallet login and register buttons are not displayed on wp-login.php. Buttons added with the shortcodes or the widget are not affected
* The `Custom CSS` setting is added (PRO). It styles the login buttons and the wallet modal
* The `Terms & Conditions text` and `Terms & Conditions URL` login settings are added. They show a required "I agree to the Terms & Conditions" checkbox next to the wallet login button; the text links to the given URL when set. The login is blocked until the box is ticked, and the acceptance is checked on the server as well
* The `Diagnostics` section is added to the plugin settings. It answers the "why does nothing work here" questions without support: whether `php-gmp`/`php-bcmath` verify signatures on this server, whether a known message and signature really recover the expected address (checked with this server, or with the verification service when that is the path the logins take), which verification service is used instead, whether your own Reown Project ID is set, and whether new wallets can create an account
* A signature verification that is done by the verification service now fails cleanly when the service is unreachable, if your site blocks outbound requests, or when it answers with an HTML error page or a different JSON shape. Such answers used to raise PHP warnings inside the login request instead of a normal "failed to verify" error. The signature self-test in the `Diagnostics` section reports exactly that: it probes the service when the service is the path the logins take, and it waits at most 5 seconds
* The `[ethpress_login_button]` shortcode no longer prints nothing for a logged-in visitor. It prints a hint explaining that the button is hidden because the user is already logged in (`notice="1"` forces it for every visitor, `notice="0"` switches it off); site owners see the hint by default
* A wallet without an account is no longer answered with the bare "You have not registered on this site; we cannot log you in". When the site does not accept registrations (the default), the message now says so, names the `Anyone can register` setting and tells the visitor to contact the site administrator - something they can forward as is. Both messages are filterable with `ethpress_registration_closed_message` and `ethpress_unregistered_message`
* Fixed wallet login on sites where another active plugin (for example BuddyPress) prints output, or renders a login form, while the login request is being processed. Such output used to be prepended to the AJAX response, which broke it with the `Unexpected token < in JSON at position 0` error and left the user logged in on the server but not in the browser
* A malformed signature that cannot be recovered no longer returns an HTTP 500 error page. The failure is caught and reported as a regular JSON error response
* Fixed the renewed AJAX nonces that a successful login returns in its response. They were created for a session token that the browser did not have yet, so using them right after logging in failed with `Bad nonce, please refresh`. The renewed nonces are now valid on the session the login just created
* Wallet login with Bitcoin addresses (PRO). P2PKH (`1…`) and P2WPKH (`bc1q…`) are verified as BIP-137 signed messages; taproot (`bc1p…`) is verified as a BIP-322 `simple` signature, which is the scheme taproot wallets sign with, since BIP-137 is not defined for them
* Wallet login nonces are now one-time. The nonce is issued when the login message is requested and consumed when the signature is verified, so a signed message cannot be replayed. Its lifetime is configurable with the `ethpress_nonce_lifetime` filter (15 minutes by default) instead of the fixed five minutes, and it no longer depends on the session token, which fixes `Bad nonce, please refresh` on slow mobile wallet flows

= 2.3.6 =

* freemius library version update

= 2.3.5 =

* freemius library version update

= 2.3.4 =

* freemius library version update

= 2.3.3 =

* Fix the `Bad nonce, please refresh.` error after login without redirect. Nonces are invalidated after login. If page is not reloaded or redirected, we need to update nonces.
* freemius library version update

= 2.3.2 =

* Fix link account error
* Change user login to new address if previous was also an address
* web3modal lib update to v4.1.11
* freemius library version update

= 2.3.1 =

* signMessage on mobile fix attempt

= 2.3.0 =

* web3modal lib update to v4.0.13
* freemius library version update

= 2.2.3 =

* Error reporting enhancements

= 2.2.2 =

* Error reporting enhancements
* l10n enhancements
* Fix warnings for options save

= 2.2.1 =

* `Username already exists` error fix second attempt
* Old DB structure check improved
* General error reporting improved
* freemius library version update

= 2.2.0 =

* `Username already exists` error fix
* Crypto wallet register button is added on the default WordPress Register page

= 2.1.2 =

* web3modal lib update to v2.7.1

= 2.1.1 =

* freemius library version update

= 2.1.0 =

* Dark and Light theme modes for the web3 login dialog

= 2.0.2 =

* web3modal lib update to v2.3.3
* network switch fix
* Brave browser support
* freemius update to v2.5.7

> Known issue: the Trust Wallet doesn't work in the Wallet Connect QR code mode.

= 2.0.1 =

* Dialog z index is fixed
* WalletConnect ID no save button issue is fixed

= 2.0.0 =

> NOTE: breaking changes! The [WalletConnect Project ID](https://cloud.walletconnect.com/sign-in) should be configured in plugin settings.

* The Wallet Connect v2 migration
* The [Web3Modal](https://web3modal.com/) login dialog migration

= 1.8.0 =

* The [Ultimate Member](https://wordpress.org/plugins/ultimate-member/) plugin support is added

= 1.7.2 =

* The `ethpress_before_submit_button` action is added for better addons support

= 1.7.1 =

* Fix settings name

= 1.7.0 =

* Allow `HTML` tags in the status message for better addons support

= 1.6.1 =

* The save settings button was not shown if WooCommerce was not installed

= 1.6.0 =

* `ethpress_login_user` and `ethpress_login_redirect` filters are added to be used in addons
* Settings availability is adjusted for Free/Trial/PRO modes

= 1.5.13 =

* Fix the `WooCommerce Account Details Link Wallet Form` setting availability
* Fix CSS files loading and display
* Fix settings usage

= 1.5.12 =

* The `[ethpress_link_button]` shortcode is added
* Buttons labels text settings is added
* WooCommerce Account Details show Link Wallet button setting is added
* The `Redirect URL` setting is added to set an URL of a page to redirect after a successful login

= 1.5.11 =

* Add-ons prices display fix

= 1.5.10 =

* Fix standard settings saving

= 1.5.9 =

* Settings update hook extended for better addons support

= 1.5.8 =

* Options page logic refactored for better addons support

= 1.5.7 =

* The `ethpress_options_update` filter added to update settings in addons

= 1.5.6 =

* Fix tab switching

= 1.5.5 =

* Settings tabs support for addons settings integration

= 1.5.4 =

* Default Role other that “subscriber” in multisite
* The Ledger wallet connect fix

= 1.5.3 =

* The “Register” buttons are not offered if the Administration > Settings > General > Membership: Anyone can register box is not checked.
* Warning on the settings page is also shown in this case.
* Security fixes

= 1.5.2 =

* Fix for the address access error when the address was not found

= 1.5.1 =

* New freemius.com library version

= 1.5.0 =

* The `ethpress_linked` hook is added.

= 1.4.0 =

* Managed WalletConnect bridge used
* `wp_usermeta` table usage instead of the `wp_ethpress_addresses`
* The `[ethpress_account]` shortcode is added

= 1.3.0 =

* EthPress register button on a WooCommerce Register Form
* EthPress register button on a WooCommerce Checkout page

= 1.2.2 =

* Affiliation program enabled

= 1.2.1 =

* Activation hook namespace usage fix

= 1.2.0 =

* freemius.com based licensing
* New Managed Verification Service API URL
* EthPress login button on a WooCommerce Login Form

= 1.1.1 =

Released 8/2021.

No longer taking the minimum of nonce lifetimes for the login nonce, instead the lifetime is static 5min.

= 1.1.0 =

Released 8/2021.

Updated WalletConnect libraries.

No longer removing database table on plugin uninstall.

Added Spanish translations (made by a contributor, forgot who).

= 1.0.3 =

Released 10/2020.

Another css fix on the z-index.

= 1.0.2 =

Released 9/2020.

Updated z-index and font color on modal.

= 1.0.1 =

Released 9/2020.

Little bug fix with address deletion.

The dialog now holds a span element instead of h2.

= 1.0.0 =

Released 8/2020.

Removed trust wallet deep link.

Changed walletconnect to show QR in the Account Linker, every time.

Releasing premium plugins, to fund development! Visit [ethpress.imlynn.xyz](https://ethpress.imlynn.xyz).

= 0.7.0 =

Released 8/2020.

Added a Widget.

The widget has an extra feature compared to the shortcode. The widget allows users to link more addresses to their account. You should prefer the widget over the shortcode now.

The new EthPress widget was added to the profile.php landing page.

If you've disabled registration by unchecking Settings->General->"Anyone can register", then EthPress will no longer register new users automatically. This was not the case before.

= 0.6.0 =

Released 4/2020.

Added PHP versions for signature recovery. It requires one of php-gmp or php-bcmath extensions. The JavaScript way still exists, but the PHP way is now preferred.

Added method for telling which login method user used.

= 0.5.0 =

Released 2/2020.

Added WalletConnect support.

Added shortcode `[ethpress_login_button]`.

Changed the login flow. Login button now opens a modal.

Removed events from javascript. Since the modal, events are quite useless.

= 0.4.0 =

Released 11/2019.

Added Trust Wallet support and a deep link. Deeplinks can be printed with `echo \losnappas\Ethpress\TrustWallet::get_deeplink();`.

= 0.3.0 =

Released 9/2019.

Added events to javascript. You can now use `ethpress.on('status', console.log)`.

Added options page and changed from wp_options to wp_site_meta for multisite, so all sites use same options.

= 0.2.4 =

Released 7/2019.

Added multisite support.

Added better instructions for wp_login_form.

Modified database table from `{$wpdb->prefix}` to `{$wpdb->base_prefix}` for multisite support. Single site should see no difference here.

= 0.1.0 =

Initial release 6/2019.

== Upgrade Notice ==

= 0.7.0 =

Breaking: style changes to dialog, disabled registration now prevents EthPress registrations.

= 0.6.0 =

There is now a PHP version of signature verifications, which is preferred over the JavaScript version, where possible. If you modified and had relied on JavaScript to do something *besides* the verification, you might need to take action. Otherwise, as you were.

= 0.5.0 =

The login button now pops open a modal, causing changes to UX, be sure to check.

JavaScript events `ethpress.on` have been REMOVED.

= 0.4.0 =

* Added Trust Wallet support and a deep link to login screen.
* Multisite: EthPress options are now shared between all sites. Make sure you re-check them before/after if you've changed them.
