Vollstart Repair Desk

گزارش تغییرات

1.0.3 — 2026-07-06

• Settings that were previously only editable via the add-on are now built-in free options: PDF tax ID and label (Settings → General), and the body text of every email the plugin sends — status change, new repair, customer message, admin notification on customer message, and pickup reminder (Settings → Email Notifications and → Pickup Reminder). The PDF receipt and reports automatically pick them up.
• Fixed (WP.org review): removed ini_set('display_errors', '0') from the admin AJAX handler. A plugin must not change PHP’s global error-reporting configuration — it would interfere with debugging on the site owner’s server. Clean JSON responses are still guaranteed by wpdb->hide_errors() and the existing output buffer that strips any stray noise before the payload, so behaviour is unchanged.
• Fixed (WP.org review — SQL safety): db.php no longer suppresses the SQL-injection sniff file-wide. Every $wpdb query is built with $wpdb->prepare() and %i/%s/%d placeholders; the few unavoidable static-analysis false positives (a generic prepared-query wrapper whose template is a hardcoded internal literal) now each carry a narrowly scoped, justified phpcs:ignore on the exact line instead of a blanket phpcs:disable. No behaviour change.
• Cleanup: removed stray “(Premium)” wording from option descriptions, removed the unused hasPremium() method, and neutralized add-on/license references in code comments throughout the free plugin.
• Fixed: ratingShowOnStatusPage and ratingAllowUpdate are now registered in the free options schema — the public customer-rating widget on the status page is fully controllable without Pro.
• Fixed: ratings card in admin repair and customer views no longer requires Pro — shows based on the enableRatings option alone.
• Fixed: warranty_until field (display + edit form) and the Maintenance card in the device view were hidden behind a Pro gate, but the full implementation (DB column, PHP CRUD, dismiss-maintenance AJAX) is in the free plugin. Guard removed; all three now available without Pro.
• Fixed: maintenance warning badge in the repair view had the same gate — removed.
• Added: warrantyDefaultDays option in Settings → Warranty & Maintenance. When set > 0, a quick-fill button pre-fills the warranty date to today + N days.
• i18n: wrapped all remaining hardcoded user-facing strings in translation functions — AJAX error responses in the admin and public handlers, and every label, heading and table column in the receipt / device / customer report PDFs (with translators: comments on placeholders). Nothing user-visible is left untranslatable.
• Security: the data-URI (base64) image upload path now derives the real MIME type from the decoded bytes via getimagesizefromstring() / finfo instead of trusting the client-declared data: prefix, enforces the same 10 MB limit and image-type whitelist as the regular upload path, and rejects anything outside it.
• Cleanup: removed the empty loadTextDomain() stub and its init hook — WordPress 4.6+ loads translations for WordPress.org-hosted plugins automatically. uninstall.php now also removes the vollstart_rd_first_activated_at option.
• Added: assets/js/libs/CREDITS.txt documenting the bundled third-party JS/CSS libraries, their versions, licenses and upstream sources (WordPress.org guideline for minified bundled assets).
• Fixed (WP.org interface review — root cause of “Connection error”): on a fresh install the database schema builder skipped every timestamp column (created_at / changed_at / time on 13 tables) because the internal column-definition validator rejected the : in their 00:00:00 default, so the columns were never created. The very first admin screen query then ordered by the missing repairs.created_at, threw a fatal, and the resulting error page replaced the JSON — which the UI showed as “Connection error. Please try again.” The validator now accepts time literals, the timestamp columns default to CURRENT_TIMESTAMP (valid on strict MySQL too), and the DB version was bumped so existing installs self-repair on update. Verified end to end on a clean install (activate → read → create → display).
• Fixed (WP.org interface review): as defense in depth, the admin screen is now also resilient to stray output corrupting its AJAX responses, which can surface as “Connection error. Please try again.” Defense in depth: (1) the AJAX handler silences database error printing for the request (still logged via WP_DEBUG_LOG); (2) it buffers the response and strips any noise emitted before the JSON payload — e.g. a notice or echo from another active plugin on the site; (3) the admin JavaScript parses responses defensively, recovering the JSON payload even if something prepends or appends text to the body.
• Added: a “WP_DEBUG” indicator badge in the admin header so it is obvious at a glance when debug mode is active (mirrors the value already shown in Support Info).

1.0.2 — 2026-05-13

• WP.org compliance: removed all hard caps. The free plugin no longer enforces per-month repair limits, customer limits, repair-type limits, photo-per-repair limits, or staff limits — and the boot-data array that exposed those limits to JS is gone. The dashboard’s Pro-features box no longer documents trialware-style caps.
• Migrated the License-Key field and the entire Staff system (CRUD, AuthTokens, Intake PWA, DB table) to the separate Vollstart Repair Desk Pro plugin at vollstart.com. The free plugin no longer ships any license or staff code.
• Migrated invoice-PDF generation (tax-rate / tax-label / VAT-ID rendering, ~300 LOC) from the free plugin to the Pro add-on. The free plugin retains the repair-receipt PDF and the device / customer report PDFs; their render helpers are now public so Pro can compose the invoice from the same building blocks.
• Options framework: switched to a section-based extension filter (vollstart_rd_option_sections) — Pro can inject options into existing Free sections by key (Tax under General, email-body templates under Email Notifications, pickup-reminder body under Pickup Reminder, customer-facing rating settings under Ratings) and register its own new sections (License at top, Invoice PDF, SMS, Cost Tracking, Billing, Catalog, Maintenance, Warranty, Customer Points, Staff Intake, Customer Portal, Branding). Options UI sticky-nav is alphabetical; the form content follows the array order so License lands at the top.
• New extension hooks for Pro: vollstart_rd_enrich_repair, vollstart_rd_enrich_repair_response, vollstart_rd_enrich_status_log_entry, vollstart_rd_pdf_repair_data, vollstart_rd_handle_two_segment_route, vollstart_rd_query_vars, vollstart_rd_options_for_js, vollstart_rd_option_sections, vollstart_rd_support_info.
• Security: new VollstartRD::sanitizePostArray() helper sanitizes $_POST at every AJAX entry point (wp_unslash + sanitize_text_field, with sanitize_textarea_field for declared textarea fields) before reaching manager methods.
• Security: all dynamic table/column names in db.php now use %i identifier placeholders in $wpdb->prepare() (WordPress 6.2+).
• Compatibility: switched the WooCommerce-detection checks from class_exists('WooCommerce') to function_exists('WC') so the check no longer triggers the WP 6.7 “translation loaded too early” notice.
• Frontend: the status-page QR-overlay URL no longer assumes wp-admin/admin-ajax.php location — uses home_url('/') via a new siteUrl localize key.
• Repair Receipt + basic PDF format options (paper size, font, margin, direction, the 8 receipt visibility toggles and footer text) live in Free again so the receipt PDF renders correctly without Pro installed.
• README: dropped the “Unlimited limits” trialware doc and scrubbed Pro features (Customer Portal, Repair Intake PWA, Staff Management) from the Core Features / Description / Screenshots so the free plugin only advertises features it actually ships.
• API: VollstartRD_Options::makeOption() is now public so add-on plugins can build option entries without duplicating the helper.
• API: VollstartRD_Notifications exposes getBusinessEmail(), getBusinessName(), getBusinessPhone() (new), getCustomerForRepair(), replacePlaceholders(), sendHtmlEmail(), logEmail() as public so add-on plugins can build their own notification emails without duplicating ~150 lines of helper code.

1.0.1 – 2026-05-05

• WP.org compliance: removed all premium feature gates and trialware locks. Limits are filterable defaults (vollstart_rd_max_repairs_per_month, _max_customers, _max_repair_types, _max_photos_per_repair, _max_staff) with neutral error messages, no “Upgrade to Pro” wording.
• Premium code extracted from free plugin: catalog/inventory, cost tracking & work items, billing summary, custom statuses, step materials, hourly rate / time-based pricing, customer portal (PWA), maintenance reminders, warranty tracking, WooCommerce integration, external rating system, PDF customization (paper, font, margins, RTL, show staff/timeline) and email body customization. The Pro add-on registers these via filters and a JS handler — the free plugin no longer ships unused premium code.
• PDF generation moved to the free plugin: receipts, device reports and customer reports work without Pro. PDF customization options and invoice PDFs (with cost tracking) remain Pro.
• Footer label: VollstartRD::getFooterLabelHtml() and getFooterLabelText() render an optional credit link on the status page, customer portal, and PDF footer — filtered through vollstart_rd_footer_label_html / vollstart_rd_footer_label_text. Shown only when the admin enables the showFooterLabel option (off by default).
• Admin shell rewritten: renderPage() ships only <div id="rd-app"> with a centered spinner; JS bootApp() renders header, tabs, content, footer and roadmap overlay after the Pro JS has loaded. Pro extends through _proHandler.getTabs/beforeRender/afterRender callbacks.
• New extension filter vollstart_rd_options so the Pro plugin can register its own option rows + section headings without touching the free options class.
• Roadmap rewrite: PDF receipts/reports, repair intake PWA, device repair history and internal rating moved to free tier; customer portal, custom statuses, cost tracking, billing, WooCommerce, maintenance/warranty reminders, external rating remain premium.
• Removed silent Pro plugin auto-upgrade that was triggered when a license key was saved. Updates go through the standard WordPress plugin update flow.
• Library: TCPDF updated from 6.7.7 to 6.11.3. Single-source getTcpdfVersion() helper in support info shows the bundled version, plus a warning when a sister plugin has loaded a different copy (“6.11.3 (loaded: 6.4.4)”).
• Security: hardened upload handler — $_FILES metadata is sanitized at the entry point and the mime type is always re-derived from the filename via wp_check_filetype() (no fallback to attacker-controlled $_FILES[...]['type']). Pro AJAX filter receives wp_unslash()-cleaned data.
• New: “First Activated” date in Support Info — shows when the plugin was first activated, included in the copyable support text. Marked as “(estimate)” for installs predating this version.
• UI: card-action buttons consistently right-aligned via .rd-card-actions wrapper; toolbar switched to display: block + text-align: right; new .rd-info-box helper with a single infoBox(html) JS function used at the top of Repair Types and Work Steps tabs. PDF footer now carries the branding link centered under the document code.
• Internal: added vollstart_rd_pre_create_repair / post_create_repair, pre_update_repair / post_update_repair, pre_change_status / post_change_status, vollstart_rd_status_definitions, vollstart_rd_admin_boot_data, vollstart_rd_license_info, vollstart_rd_ajax_action extension hooks for the Pro plugin.

1.0.0 – 2026-04-20

• Initial release
• Repair management with configurable status flow and timeline
• Customer database with contact info and repair history
• Device and product tracking linked to repairs and customers
• Repair types catalog with estimated duration and pricing
• Work steps with checklists, time tracking, and auto-progress
• Photo uploads for intake documentation
• QR code per repair with public status page
• Customer portal as progressive web app with secure token access
• Customer messaging system (configurable: read-only, reply, or full)
• Email notifications on status changes
• Pickup reminder emails via WP-Cron
• Staff management with auth tokens
• CSV export for repairs, customers, and devices
• GDPR tools: data export, anonymization, and deletion
• WordPress dashboard widget
• Bulk actions: status change, print QR labels, delete
• Rating system for internal staff rating and customer feedback