Torlann — full changelog
========================

= 2.8.61 =
* Quote-only products can no longer be added to the cart (they could be bought at 0.00 in "online sales only" mode)
* Bank transfer is reported as configured only when an IBAN is set, matching what checkout offers
* Setup assistant: the country picked from the "Other country" list is kept (regions step no longer shows another country's states); the welcome screen no longer promises a fixed number of steps
* Orders: a single reference (ORD-00001) for the order number and the bank transfer reference; "Order" wording on the payment page
* Prices and tax rates follow the site language everywhere (no more 50.00 next to 50,00; 20 % instead of 20,0 %)
* Cart: no duplicate "Subtotal" in the cart drawer; delivery line shows "Calculated at checkout" or "Select a delivery method" instead of a lone dash
* English interface: about 400 source strings that were still in French (countries, regions, currencies, languages, admin labels) are now in English; translations kept in all languages
* British English: basket, colour, -ise spellings
* Product specifications no longer show internal Torlann product / variant IDs imported from a Torlann export
* Sample catalog: sharper product photos (no more colour specks)
* "Reset the catalog" now only clears products, categories, attributes, variants and stock; settings, store pages, customers and orders are kept
* Quote payment page: uses the prefixed [torlann-quote-payment] shortcode (it showed a raw [paiement-devis] tag in this package); existing pages are updated automatically
* Order payment page: the summary total now includes delivery
* Dates follow the WordPress date and time format settings; decimal fields use the site's decimal separator
* New stores on a non-French site get English page and URL slugs (shop, cart, checkout, product…); existing stores keep their URLs
* English wording: "Quotes" menu (was "Estimate"), "Pickup at", "custom tax", US spelling in source strings (British spelling kept in en_GB)
* The quote confirmation page is no longer listed in automatic menus

= 2.8.60 =
* Late escaping: every shortcode and dynamic block render callback returns output filtered through wp_kses() with a dedicated storefront allowlist (forms, SVG icons, data attributes)
* Removed inline JavaScript from front templates (form submit blocking moved to enqueued scripts; product gallery data passed via an escaped data attribute; JSON-LD printed with wp_print_inline_script_tag())
* Core includes: wp-admin/includes/file.php is loaded only right before one of its functions is called
* Removed an unused invoice template
* readme: clarified that the license server is never contacted by this package and listed outbound-only links (maps, carrier tracking)

= 2.8.59 =
* Removed unused legacy third-party payment notification code and its default settings from the free edition

= 2.8.58 =
* Database: every custom-table query uses $wpdb->prepare() with the %i identifier placeholder; no interpolated table or column names
* Filesystem writes go through WP_Filesystem; debug logging only when WP_DEBUG and WP_DEBUG_LOG are enabled (no personal data logged)
* Removed load_plugin_textdomain() (translations loaded by WordPress), unused legacy constants and an unused template
* SEO bridge triggers native post update hooks via wp_update_post(); JSON data islands encoded with JSON_HEX_TAG
* Fixed facet counts when several catalog filters are combined

= 2.8.57 =
* WordPress.org human review: nonce verified first and standalone in every state-changing handler (admin actions, AJAX, account, cart, Stripe/PayPal returns)
* All $_POST/$_GET/$_FILES/$_COOKIE values sanitized inline when read; no raw superglobal passed to custom sanitizers; JSON input sanitized after decoding
* Escape late with wp_kses() and explicit allowlists (SVG icons, documents, carriers, product grids); removed phpcs:ignore suppressions
* SEO bridge no longer writes on GET; CSV downloads streamed via php://output

= 2.8.56 =
* WordPress.org human review: CSV import via admin-post (capability + nonce + sanitized $_FILES)
* Stripe devis redirect: token-bound nonce; order archive: capability then nonce (non-bypassable)
* SEO bridge + catalog filters + quote prefill: capability / sanitized public query helpers
* Settings/agent: explicit array unslash before dedicated sanitizers; JSON via Torlann_Http_Request::json_text_array
* Escape late: Torlann_Kses for documents, carriers, product grids; PDF CSS path-constrained

= 2.8.55 =
* WordPress.org review: block render via shortcode callbacks (no raw do_shortcode return)
* Sanitize honeypot values before security logging; normalize quote form POST
* Sanitize REQUEST_URI / build Polylang URLs from home_url() (Torlann_Http_Request)
* Harden json_decode consumers (cart cookie, filters, agent groups, attributes order)
* Hide legacy EZ_Shop_Core alias when TORLANN_FREE_ORG is set

= 2.8.54 =
* Checkout: account email prefilled but editable (same as quote form); submitted email is no longer forced to the logged-in account

= 2.8.53 =
* Catalog sample images: skip fictitious hosts (exemple.com) with no HTTP; attach local samples even over import budget; faster pending batch

= 2.8.52 =
* Catalog photos step: prefer local sample images, shorter remote timeouts, faster async ticks
* Quote form: account email prefilled but editable
* Includes socle security hardening from 2.8.47–2.8.51 (payments, nonces, sanitize)

= 2.8.51 =
* Security: clear remaining Plugin Check Missing/Unslash on save handlers, cart/account/agent inputs

= 2.8.50 =
* Security (Plugin Check triage): re-verify nonces inside save handlers; sanitize product/quote POST at point of use; devis_id absint before nonce action

= 2.8.49 =
* Fresh install: skip schema ALTER when tables are not created yet; fgetcsv escape argument for PHP 8.4+

= 2.8.48 =
* WordPress.org: enqueue admin shell / admin-bar CSS; no executable inline script/style in admin or public quote/payment views
* Quote forms (legacy/full), facture, paiement, client dashboard: assets via wp_enqueue_*; Dompdf CSS loaded from file
* Redirect fallbacks use meta refresh + link (no inline window.location script)

= 2.8.47 =
* Security: Stripe return verifies session via Stripe API (cs_ prefix, metadata, payment_status, amount) before marking paid
* SQL: conversion stats use $wpdb->prepare(); Chart.js constant aligned to bundled 4.5.1
* Remove display_errors ini_set; client login CSS via wp_enqueue_style; sanitize email input before escape

= 2.8.45 =
* Plugin Check i18n: no variable msgids (Torlann_I18n literal switch), ordered placeholders, translators comments
* Escaping hardening on admin/front views flagged by Plugin Check

= 2.8.36 =
* WordPress.org Free light: unlock shipped features (Guideline 5), remove teases/mail relay/copilot from .org ZIP
* Custom CSS disabled for .org; Chart.js 4.5.1; uploads under uploads/torlann/; wp_handle_upload for catalog imports
* Escaping / sanitization / shortcode prefix hardening from Plugin Directory review

= 2.8.35 =
* Product list: Type column (plain text, no quote badge)

= 2.8.34 =
* Product list Mode column only when quotes (devis) catalog mode is enabled

= 2.8.33 =
* Product list: dedicated Mode column (On quote / Online purchase)

= 2.8.32 =
* Product list: quote-only products show an “On quote” status badge and price label

= 2.8.31 =
* Release sync: Pro download, Free tease, demo and Alexandre aligned on the same socle

= 2.8.30 =
* Gutenberg blocks: product catalog, single product, cart, quote form, checkout
* Blocks reuse existing shortcodes; editor category “Torlann”

= 2.8.29 =
* WordPress.org Free: Pro pitches without locked UI teases (Guideline 5)
* Copilot chat disabled in the WordPress.org Free package
* Coupons / discounts pitch copy refresh
* Admin sidebar brand: horizontal Torlann logo, no “Shop” tagline
* Stable tag aligned with plugin version 2.8.29

= 2.8.5 =
* Free Design: same surface as Pro — advanced panels browsable with license lock; presets remain free to save
* Align Design tease with Réassurance / quotes / email models (visible + locked, not removed)

= 2.8.4 =
* WordPress.org compliance: no remote calls on activation; admin uses system fonts; default storefront fonts are system stacks
* Free Core: store design controls fully usable; custom CSS removed from Free; copilote quota unlimited
* Readme: Contributors stephlg; External services updated (no admin Google Fonts)

= 2.8.3 =
* Trashed shop pages (shop, cart, checkout, account, payment) stay in the trash — they are no longer restored on every admin load
* WordPress.org Stable tag aligned with plugin version 2.8.3
* Readme: document optional Torlann mail relay (wp-config opt-in, off by default) and admin Google Fonts for guideline 7 accuracy

= 2.8.1 =
* Rigorous i18n pass: English source msgids, 15 locale packs re-synced and compiled
* Quote/order email footer editor moved below the template list (layout fix)
* Spanish and other admin UI strings fully translated (settings, payments, design, emails)

= 2.8.0 =
* English source language — no French/English mix in the plugin UI
* 15 locale packs: EN, FR, ES, DE, IT, PT, NL, TR, DA, NO, FI, CS, HU, RO
* Free transactional email defaults to WordPress wp_mail; optional Torlann mail relay via wp-config (`TORLANN_MAIL_RELAY`)

= 2.7.6 =
* Free / Pro packaging for WordPress.org distribution
* Free Core available without Torlann license activation
* Matrix-based feature gates for Pro-only capabilities
* Third-party JS/CSS bundled locally (Tabler Icons, Swiper, Chart.js, canvas-confetti)
* Setup assistant: sample catalog template or CSV/Excel import (two catalog paths)
* Improved transactional email deliverability without requiring an SMTP plugin
* Pro-only settings toggles stay disabled until licensed (Stripe, PayPal, reassurance blocks)
* Copilote IA help and optional content AI providers (Pro)
