| @@ -1,8 +1,279 @@ | ||
| 1 | 1 | # Changelog |
| 2 | 2 | |
| 3 | 3 | <details> |
| 4 | 4 | |
| 5 | +<summary>1.10.21 - 2026-09-17</summary> | |
| 6 | + | |
| 7 | +### Fixed | |
| 8 | +- "All fields" and "price & stock" update modes always send one complete product request with the variants array (without Basalam variation ids), matching earlier major versions; the dedicated variation endpoint is only used in "custom" mode with the variation price/stock fields enabled | |
| 9 | +- Product updates now recover automatically when WooCommerce contains stale Basalam variation IDs, rebuilding and saving the current variation mapping instead of repeatedly failing with HTTP 404 | |
| 10 | +- Commission lookup now uses Basalam's product-specific commission API for products already connected to Basalam; new or unconnected products continue to use category-based commission lookup, with product commission responses cached during the sync request | |
| 11 | + | |
| 12 | +</details> | |
| 13 | + | |
| 14 | +<details> | |
| 15 | + | |
| 16 | +<summary>1.10.20 - 2026-09-17</summary> | |
| 17 | + | |
| 18 | +### Fixed | |
| 19 | +- Basalam authorization callbacks no longer fail when Redis or Memcached drops the temporary OAuth marker; the single-use authorization proof is now carried in a signed, time-limited HttpOnly cookie | |
| 20 | + | |
| 21 | +</details> | |
| 22 | + | |
| 23 | +<details> | |
| 24 | + | |
| 25 | +<summary>1.10.19 - 2026-09-17</summary> | |
| 26 | + | |
| 27 | +### Changed / Improved | |
| 28 | +- Single-product update jobs now run before bulk and full-update coordinator jobs | |
| 29 | + | |
| 30 | +</details> | |
| 31 | + | |
| 32 | +<details> | |
| 33 | + | |
| 34 | +<summary>1.10.18 - 2026-09-12</summary> | |
| 35 | + | |
| 36 | +### Fixed | |
| 37 | +- Public plugin metadata, help, terms, and privacy links now use the live canonical Hamsalam and Basalam URLs instead of the retired `wp.hamsalam.ir` host | |
| 38 | +- Product create and update requests now retry once without product or variation SKUs when Basalam rejects a duplicate SKU | |
| 39 | + | |
| 40 | +</details> | |
| 41 | + | |
| 42 | +<details> | |
| 43 | + | |
| 44 | +<summary>1.10.17 - 2026-09-09</summary> | |
| 45 | + | |
| 46 | +### Fixed | |
| 47 | +- Async job dispatch runs during shutdown again, keeping queue probes and loopback requests out of the storefront response path | |
| 48 | +- The dispatch lease is reserved before checking the queue, preventing concurrent requests from launching duplicate async runners | |
| 49 | + | |
| 50 | +</details> | |
| 51 | + | |
| 52 | +<details> | |
| 53 | + | |
| 54 | +<summary>1.10.16 - 2026-09-08</summary> | |
| 55 | + | |
| 56 | +### Fixed | |
| 57 | +- Installing a newer plugin package now clears the previous version's force-update gate, allowing migrations, hooks, and the background jobs runner to start normally | |
| 58 | +- Hotfix builds newer than the latest published package are no longer disabled when the version API has not registered them yet | |
| 59 | + | |
| 60 | +</details> | |
| 61 | + | |
| 62 | +<details> | |
| 63 | + | |
| 64 | +<summary>1.10.15 - 2026-09-08</summary> | |
| 65 | + | |
| 66 | +### Fixed | |
| 67 | +- Large product queues no longer spawn overlapping AJAX runners from normal site traffic; one runner now owns the entire processing batch and duplicate workers exit immediately | |
| 68 | +- Async runner dispatches are leased for 25 seconds instead of one second, preventing PHP worker exhaustion and storefront 503/504 errors during full or quick product updates | |
| 69 | +- Installing a newer plugin package now clears the previous version's force-update gate, allowing migrations, hooks, and the background jobs runner to start normally | |
| 70 | +- Hotfix builds newer than the latest published package are no longer disabled when the version API has not registered them yet | |
| 71 | + | |
| 72 | +</details> | |
| 73 | + | |
| 74 | +<details> | |
| 75 | + | |
| 76 | +<summary>1.10.14 - 2026-09-08</summary> | |
| 77 | + | |
| 78 | +### Added | |
| 79 | +- Product SKUs are now sent to Basalam when creating or updating products, and variation SKUs are sent with variant payloads and per-variation updates; a new "کد محصول (SKU)" option controls the field in custom update mode (enabled by default) | |
| 80 | + | |
| 81 | +### Fixed | |
| 82 | +- The async job runner now dispatches from init instead of shutdown, avoiding database "commands out of sync" errors caused by unread result sets left by other shutdown callbacks | |
| 83 | + | |
| 84 | +</details> | |
| 85 | + | |
| 86 | +<details> | |
| 87 | + | |
| 88 | +<summary>1.10.13 - 2026-09-01</summary> | |
| 89 | + | |
| 90 | +### Added | |
| 91 | +- Added a manual vendor-status recheck button to inactive-vendor notices so store owners can immediately restore synchronization after reactivating their Basalam booth | |
| 92 | + | |
| 93 | +### Changed / Improved | |
| 94 | +- Local environments now bypass vendor-status checks and inactive-vendor restrictions; the daily vendor-status cron is also unscheduled locally | |
| 95 | +- The category detection endpoint now uses API v2.0 while preserving the existing response consumer contract | |
| 96 | + | |
| 97 | +</details> | |
| 98 | + | |
| 99 | +<details> | |
| 100 | + | |
| 101 | +<summary>1.10.12 - 2026-08-29</summary> | |
| 102 | + | |
| 103 | +### Fixed | |
| 104 | +- Restored the AJAX click handlers for product update, archive, restore, and disconnect actions on the WooCommerce product editor | |
| 105 | + | |
| 106 | +### Changed / Improved | |
| 107 | +- The authenticated Woosalam chat widget now loads on every WordPress admin screen while other Woosalam assets remain scoped to their relevant pages | |
| 108 | + | |
| 109 | +</details> | |
| 110 | + | |
| 111 | +<details> | |
| 112 | + | |
| 113 | +<summary>1.10.11 - 2026-08-26</summary> | |
| 114 | + | |
| 115 | +### Fixed | |
| 116 | +- Product media MIME types are now detected from the actual file contents before checking the filename extension | |
| 117 | +- Non-standard image MIME aliases such as `image/jpg`, `image/pjpeg`, and vendor-specific PNG/BMP values are normalized to the canonical values accepted by Basalam Uploadio | |
| 118 | +- The media upload request and multipart file transfer now use the same canonical MIME type, preventing valid JPEG images from failing with a `422` unsupported-MIME response | |
| 119 | + | |
| 120 | +</details> | |
| 121 | + | |
| 122 | +<details> | |
| 123 | + | |
| 124 | +<summary>1.10.10 - 2026-08-25</summary> | |
| 125 | + | |
| 126 | +### Added | |
| 127 | +- Added a daily vendor-status check with persistent inactive-duration tracking and automatic recovery when the vendor becomes active again | |
| 128 | +- Added state-specific admin notices, dashboard badges, disabled controls, and explanatory UI for limited and suspended synchronization modes | |
| 129 | + | |
| 130 | +### Changed / Improved | |
| 131 | +- Vendors inactive for less than 21 days can no longer create products; manual, bulk, queued, and automatic updates are restricted to price and stock | |
| 132 | +- Vendors inactive for 21 days or longer can no longer create, update, archive, restore, or discount products until the vendor becomes active again | |
| 133 | +- Product jobs revalidate the vendor policy at execution time so queued work cannot bypass a later status change | |
| 134 | +- Improved background job dispatch and limited admin assets and notices to relevant Woosalam, product, and order screens | |
| 135 | +- Aligned the connection-status header, card, and inner synchronization panel across active and inactive states | |
| 136 | + | |
| 137 | +</details> | |
| 138 | + | |
| 139 | +<details> | |
| 140 | + | |
| 141 | +<summary>1.10.9 - 2026-08-16</summary> | |
| 142 | + | |
| 143 | +### Fixed | |
| 144 | +- The ticket reply access form is now shown only after site access is rejected; it stays hidden while access is pending, after approval, and when the status is missing or unknown | |
| 145 | + | |
| 146 | +</details> | |
| 147 | + | |
| 148 | +<details> | |
| 149 | + | |
| 150 | +<summary>1.10.8 - 2026-08-15</summary> | |
| 151 | + | |
| 152 | +### Added | |
| 153 | +- Added independent settings for updating variation prices and variation stock | |
| 154 | + | |
| 155 | +### Changed / Improved | |
| 156 | +- Connected variations are now updated individually through Core v4 | |
| 157 | +- Price-only variation updates send only `primary_price`, while stock-only updates send only `stock` | |
| 158 | +- Variation price updates work independently from the product price setting | |
| 159 | +- Custom update mode now requires at least one selected field and shows the plugin error toast without refreshing the page when none is selected | |
| 160 | +- Full, quick, selected, and automatic updates no longer create jobs or API requests when the custom field selection is empty | |
| 161 | +- Product admin JavaScript now uses a file-aware cache version so the latest validation behavior is loaded immediately after deployment | |
| 162 | + | |
| 163 | +</details> | |
| 164 | + | |
| 165 | +<details> | |
| 166 | + | |
| 167 | +<summary>1.10.7 - 2026-08-11</summary> | |
| 168 | + | |
| 169 | +### Fixed | |
| 170 | +- Ticket validation and API failures are now shown as admin toasts instead of WordPress `admin-post.php` error pages | |
| 171 | +- New-ticket submissions now use AJAX, preserving entered text, credentials, and uploaded-image previews when a request fails; if the ticket was created before access storage failed, retrying updates only the access data and does not create a duplicate ticket | |
| 172 | +- Ticket JavaScript now uses a file-aware cache version so updated validation and submission behavior is loaded immediately after deployment | |
| 173 | + | |
| 174 | +</details> | |
| 175 | + | |
| 176 | +<details> | |
| 177 | + | |
| 178 | +<summary>1.10.6 - 2026-08-11</summary> | |
| 179 | + | |
| 180 | +### Fixed | |
| 181 | +- Product images in AVIF or another image format unsupported by Basalam are now converted to JPEG before the upload request, preventing the `422` unsupported-MIME error | |
| 182 | +- Temporary downloaded and converted product-image files are removed after both successful and failed uploads; when the server cannot decode the source format, the plugin now returns an actionable error instead of sending an invalid MIME type to Basalam | |
| 183 | +- A copied product no longer inherits *any* Woosalam data from the product it was copied from — not the Basalam connection, and not the per-product settings (video, custom price change, gold/mobile fields, product type and value, wholesale, discount flag). Every `sync_basalam_*` / `_sync_basalam_*` meta on the duplicate and its variations is stripped before WooCommerce saves the duplicate (`woocommerce_duplicate_product_exclude_meta`), cleaned again after duplication, and also cleaned for copies made by third-party duplicate plugins (`dp_duplicate_post`, `dp_duplicate_page`, `duplicate_post_post_copy`). Individual keys can be kept via the `sync_basalam_duplicate_purge_meta_keys` filter | |
| 184 | +- Disconnecting a product now removes the connection meta of every vendor id (previously only the currently configured vendor's keys were removed, so a stale, hard to find key could stay in the database) and clears `sync_basalam_variation_id` from all variations, not only from products currently typed as variable | |
| 185 | +- No product data, status change, or discount is sent to Basalam while two or more WooCommerce products share one Basalam product id. The operation is stopped with a clear message instead of overwriting the wrong Basalam product (this is what made old prices and old stock reappear on Basalam) | |
| 186 | +- Products with an empty Basalam product id no longer produce a malformed update request | |
| 187 | + | |
| 188 | +### Added | |
| 189 | +- A one-time repair on update that finds WooCommerce products sharing a Basalam product id, keeps the connection on the oldest (original) product, disconnects the copies, and reports the result in an admin notice and the plugin log | |
| 190 | + | |
| 191 | +</details> | |
| 192 | + | |
| 193 | +<details> | |
| 194 | + | |
| 195 | +<summary>1.10.5 - 2026-08-05</summary> | |
| 196 | + | |
| 197 | +### Changed / Improved | |
| 198 | +- Limited bulk product update API requests to a maximum of five per minute without reducing the execution rate of other background jobs | |
| 199 | + | |
| 200 | +</details> | |
| 201 | + | |
| 202 | +<details> | |
| 203 | + | |
| 204 | +<summary>1.10.4 - 2026-08-04</summary> | |
| 205 | + | |
| 206 | +### Fixed | |
| 207 | +- Preserved complete URLs in new ticket messages, ticket replies, and optional access-information fields, including percent-encoded URL segments that WordPress text sanitization previously removed | |
| 208 | +- Updated ticket media uploads to send `type=ticket_item` and `collection=IMAGE` as multipart form fields to the `/media` endpoint, and fixed the upload service to return the API response | |
| 209 | + | |
| 210 | +</details> | |
| 211 | + | |
| 212 | +<details> | |
| 213 | + | |
| 214 | +<summary>1.10.3 - 2026-07-22</summary> | |
| 215 | + | |
| 216 | +### Changed / Improved | |
| 217 | +- "Price increase" became "price change" everywhere (code, markup, CSS classes): negative values are supported, so e.g. `-10` lowers the final Basalam price by 10% (percentages are capped at 35% increase and 35% decrease; values outside the -100..100 range are fixed Toman amounts) | |
| 218 | +- The global setting key was renamed from `increase_price_value` to `price_change_value`, and the per-product meta from `_sync_basalam_increase_price_value` to `_sync_basalam_price_change_value`. Old values are not migrated — re-enter the price change in the settings | |
| 219 | +- The category-commission mode is now stored as `commission` instead of `-1`, so it no longer collides with a real negative percentage | |
| 220 | + | |
| 221 | +### Added | |
| 222 | +- A "custom price change" field in the Basalam product settings tab and in the products list bulk edit, so a single product or a selection of products can override the global value (or switch to category commission) | |
| 223 | + | |
| 224 | +</details> | |
| 225 | + | |
| 226 | +<details> | |
| 227 | + | |
| 228 | +<summary>1.10.2 - 2026-07-19</summary> | |
| 229 | + | |
| 230 | +### Changed / Improved | |
| 231 | +- Migrated product photo and video uploads from the legacy direct upload endpoint to Uploadio's presigned media flow | |
| 232 | +- Added SHA-256 metadata, direct staging upload, completion handling, and status polling so product payloads receive the final Basalam media ID and URL | |
| 233 | +- Ensured temporary remote media files are removed after both successful and failed uploads | |
| 234 | +- Streamed remote media downloads and multipart uploads with size-aware limits and timeouts to support large product videos without buffering the entire file in PHP memory | |
| 235 | + | |
| 236 | +</details> | |
| 237 | + | |
| 238 | +<details> | |
| 239 | + | |
| 240 | +<summary>1.10.1 - 2026-07-13</summary> | |
| 241 | + | |
| 242 | +### Fixed | |
| 243 | +- When Basalam rejects a product create/update with `422` because the description contains forbidden content (social-network names, page/channel mentions, etc.), the plugin now extracts the flagged phrases — highlighted inside `<em>...</em>` in the response `snippet` — strips them from the description, and automatically retries (up to 3 times). Previously the sanitizer looked for a non-existent `value` field, so nothing was removed and the retry never helped | |
| 244 | + | |
| 245 | +</details> | |
| 246 | + | |
| 247 | +<details> | |
| 248 | + | |
| 249 | +<summary>1.10.0 - 2026-07-11</summary> | |
| 250 | + | |
| 251 | +### Added | |
| 252 | +- Merged the "Woosalam Plus" add-on into the core plugin as a built-in "Financial Management" section: view store balance, active settlement requests, settlement history, and submit settlement requests to wallet or bank account | |
| 253 | +- Added the `customer.identity.read` scope to the Basalam OAuth connection request (required to fetch the user's bank account list in the settlement flow) | |
| 254 | + | |
| 255 | +### Note | |
| 256 | +- Users who connected to Basalam before this release must reconnect ("Connect to Basalam") once so the new scope is granted before the bank-account settlement feature works | |
| 257 | + | |
| 258 | +</details> | |
| 259 | + | |
| 260 | +<details> | |
| 261 | + | |
| 262 | +<summary>1.9.2 - 2026-07-08</summary> | |
| 263 | + | |
| 264 | +### Security | |
| 265 | +- Fixed a CSRF vulnerability in the Basalam OAuth callback (`basalam-save-token`) that could let a forged request overwrite the stored connection credentials; the callback now requires a single-use, time-limited authorization that the admin actively started, and the "connect to Basalam" links go through a nonce-protected request | |
| 266 | +- Hardened output escaping across admin pages, templates and exception messages (esc_html/esc_attr) | |
| 267 | +- Switched internal redirects to wp_safe_redirect and documented direct custom-table queries | |
| 268 | + | |
| 269 | +### Changed / Improved | |
| 270 | +- Tested up to WordPress 7.0 | |
| 271 | + | |
| 272 | +</details> | |
| 273 | + | |
| 274 | +<details> | |
| 275 | + | |
| 5 | 276 | <summary>1.9.1 - 2026-06-30</summary> |
| 6 | 277 | |
| 7 | 278 | ### Fixed |
| 8 | 279 | - show check-orders button and vertically center its content on mobile/tablet |
