WinaltChat for WooCommerce

ئۆزگىرىش خاتىرىسى

1.3.8

• Fix: Replaced store-specific product examples (GFC, Electromax) in readme.txt and code comments with generic international examples suitable for any WooCommerce store worldwide.
• Fix: «Urdu/English mixed queries» replaced with «multilingual and mixed-language queries» in plugin description.

1.3.7

• Maintenance: Trimmed changelog to WordPress.org 5000 character limit, keeping entries from 1.2.6 onwards.
• Fix: Plugin URI updated to the WordPress.org plugin page.

1.3.6

• Security: Added per-IP rate limiting (30 requests / 60 seconds) to the AI chat REST endpoint to prevent API credit abuse by automated clients.
• Security: Visitor poll endpoint now verifies the WP REST nonce (via X-WP-Nonce header or ?nonce= query param) in addition to the session token, consistent with all other visitor endpoints.
• Fix: admin.js settings-save buttons now build DOM nodes with textContent / .text() instead of jQuery .html() string concatenation, eliminating a theoretical HTML injection path via malicious translation files.
• Fix: Chat transcript download now passes assistant message content through sanitizeViaDOM() before inserting it into the exported HTML file.
• Fix: readme.txt Tested up to corrected from 7.0 to 6.8.

1.3.5

• Fix: Bumped minimum WordPress requirement from 6.0 to 6.2 to legitimise use of the %i identifier placeholder in $wpdb->prepare() calls — PHPCS was correctly flagging %i as unsupported below 6.2.

1.3.4

• Fix: PluginCheck.Security.DirectDB.UnescapedDBParameter warnings resolved — all flagged queries now use the %i identifier placeholder (WordPress 6.2+) for table names instead of PHP string interpolation, eliminating intermediate $sql variables that triggered the sniff.
• Fix: DELETE queries in the admin delete handler replaced with $wpdb->delete() — no manual SQL string construction.
• Note: WordPress.DB.DirectDatabaseQuery.SchemaChange warnings in uninstall.php are advisory-only and expected — Plugin Check always warns on DROP TABLE. They do not block WordPress.org submission.

1.3.3

• Fix: Plugin Check warnings resolved — all PHPCS checks pass cleanly.
• Fix: readme.txt short description trimmed to a single line under 150 characters.
• Fix: Two DELETE queries in the admin delete handler now use $wpdb->delete() — direct session_id interpolation removed.
• Fix: Remaining UnescapedDBParameter Plugin Check warnings suppressed with inline phpcs:ignore comments where table names are trusted constants and values are prepared.

1.3.2

• Fix: «Support team» now correctly replaces «human» in the email capture prompt — root cause was the PHP localized string in class-winalt-frontend.php overriding the JS fallback.
• Fix: «New» badge on lead sessions disappears when clicked and does not reappear on subsequent polls (seenLeadIds tracking added).
• Fix: Email submission correctly sends session token so the existing session is converted to a Lead, no duplicate row created.
• Fix: Section headers (Active/Leads/Closed) now styled as clear readable headings with dividers between sections.
• Security: User messages now rendered via textContent — HTML tags typed by visitors can no longer render in the chat widget.
• Security: sanitizeViaDOM() added as a DOM-based sanitizer for AI response content; strips script, iframe, svg, form, and all on* event handlers before innerHTML insertion. img allowed but dangerous attributes stripped.
• Security: sanitizeRichContent() updated to remove img from the allowed-tags whitelist.

1.3.1

• Fix: Email prompt says «support team» not «human».
• Fix: Submitting email now converts the existing session to a Lead — never creates a duplicate row.
• Fix: Admin list now shows all session statuses so closed chats stay visible after admin closes them.
• Fix: 429 and HTTP error responses from /start no longer leave «Checking…» stuck — error path clears the message and shows the email capture form.
• Fix: Admin replies no longer appear twice (message_id from server response advances state.lastId before the confirming poll).
• Fix: PHP handoff response set to empty to prevent a third connecting message alongside the JS status lines.
• Fix: Email capture only shows «Thanks!» on a successful server response — invalid addresses show an inline error message without removing the form.
• New: New offline lead sessions show an amber «New» badge and update the page title with a lead count.
• Remove: Auto-cleanup cron removed — manual Delete button is the only way to remove sessions.

1.3.0

• Fix: Presence dot now correctly placed before status text (Active/Waiting), not before the visitor name.
• Fix: Closed/Lead sessions immediately hide the typing box and Send/Close buttons on click (using session cache for zero-latency read-only mode).
• Fix: Offline email prompt now says «support team» instead of «human».
• Fix: Email submission converts the existing session to a Lead instead of creating a duplicate.
• Fix: Admin session list now includes all statuses (waiting/active/closed/lead/abandoned) so no chat is missed.
• Fix: startLive() retries once on network failure before falling back to the email capture form.