Chatwoot Client Portal by ICT Shift

Changelog

2.0.12

• Removed duplicate screenshot files from plugin package assets to reduce plugin ZIP size.
• Kept WordPress.org listing screenshots in the repository root /assets directory.

2.0.11

• Updated plugin page documentation for clearer setup and usage guidance.
• Fixed screenshot visibility in the WordPress.org plugin listing.
• Improved readme text formatting and encoding for cleaner display in the plugin directory.

2.0.10

• Hardened new-ticket mail attachment handling by attaching uploaded files in-memory during send flow, avoiding temporary file writes while preserving attachment names.
• Excluded local docs/page-export artifacts from release packaging output to keep submission ZIPs clean and deterministic.

2.0.9

• Refactored shortcode/admin/webhook/API diagnostics logging to remove file-wide error_log suppressions and keep only narrow, WP_DEBUG-gated log helpers.
• Completed shortcode request/upload hardening pass by fixing stale helper usage and keeping nonce-gated upload normalization paths explicit.
• Reduced suppression surface in settings/debug flows and narrowed SQL suppression scope where PHPCS allows line-level scoping.
• Reworked runtime contact/conversation lookup paths to avoid slow meta_query usage in hot flows by using bounded paged scans and deterministic conversation indexing.
• Standardized request filtering to explicit sanitizing filters across runtime handlers (no unsafe raw filter usage) while preserving strict validation and context-aware output escaping.
• Added strict reviewer-facing development directives for WordPress-native methods first, sanitize/validate/escape lifecycle, nonce/capability fail-closed enforcement, and mandatory pre-submission pattern scans.

2.0.8

• Strengthened WordPress.org submission hardening for nonce verification and request sanitization reviews by aligning guarded superglobal reads with explicit checker-safe validation/sanitization paths.
• Added security-sniff coverage to local PHPCS ruleset (WordPress.Security.NonceVerification and WordPress.Security.ValidatedSanitizedInput) so recurring review points fail locally before release.
• Improved release preflight pattern checks for settings slug/title detection to avoid brittle formatting dependencies during release validation.

2.0.7

• Hardened shortcode/admin/AJAX request handling by removing raw input filter patterns and enforcing immediate sanitization plus strict scalar validation for POST/GET reads.
• Refined nonce and permission guard flows across form submits and AJAX endpoints to keep security checks explicit and non-bypassable.
• Applied submission-readiness cleanup for WordPress.org review consistency across request, upload, and output handling paths.

2.0.6

• Restored shortcode hardening updates and fixed ticket-list first-load filtering by normalizing invalid/empty status query values to all.
• Prevented a regression where opening the ticket list with an empty ictss_status query parameter could show “No tickets found” while searches still returned tickets.

2.0.5

• Hotfix: restored ticket-list shortcode request handling to the previous stable path to resolve a production regression where valid users could see “No tickets found.”
• Kept webhook authentication/security hardening introduced in 2.0.4 unchanged.

2.0.4

• Added progressive webhook authentication modes: token-only (default), token-or-signature transition mode, and signature-required strict mode.
• Added optional Chatwoot signature verification support with timestamp freshness checks and delivery replay protection.
• Hardened webhook diagnostics by redacting sensitive payload fields and trimming stored debug payload data.

2.0.3

• Hardened nonce, capability, and request sanitization checks across ticket forms, admin actions, webhook tools, and livechat identity AJAX handlers.
• Tightened upload request handling so file arrays are only processed through verified nonce-gated paths.
• Refreshed submission-readiness validation and packaging after WordPress.org review fixes.

2.0.2

• Removed legacy Chatwoot sidebar integration from plugin settings and runtime bootstrap.
• Cleaned documentation to remove deprecated sidebar-token and sidebar-endpoint instructions.
• Kept contact-context sync guidance focused on Chatwoot contact attributes/additional attributes.

2.0.1

• Clarified External Services section to correctly distinguish self-hosted Chatwoot deployments from Chatwoot cloud. Self-hosted instances are now documented separately, noting that the data controller is the server operator and that chatwoot.com terms/privacy do not automatically apply.

2.0.0

• Added contributor username to readme.txt Contributors header.
• Added External Services section to readme.txt documenting Chatwoot and hCaptcha integrations (data sent, terms, privacy links).
• Added .distignore entry to exclude design PSD assets from distribution archive.
• Removed DONOTCACHEPAGE global define, replacing with targeted nocache_headers() calls scoped to debug-mode form renders only.
• Refactored all GET parameter reads to use filter_input(INPUT_GET) via private helpers, removing direct $_GET superglobal access.
• Wrapped all inline script content in (new Function(wp_json_encode(…)))() boundary for safe dynamic JS injection.
• Removed JSON_UNESCAPED_UNICODE and JSON_UNESCAPED_SLASHES flags from JSON-encoded inline script output.
• Renamed livechat embed shortcodes from ict_shift_support_live_chat_* to ictss_support_live_chat_* for prefix consistency.
• Ensured all $_FILES access is routed through the allowlisted get_uploaded_files_from_field() helper.

1.9.9

• Added stronger release preflight checks for WordPress.org submission readiness (external-services docs and packaging exclusions).
• Hardened attachment upload handling by accepting only real uploaded temp files in multipart upload paths.
• Improved settings/admin compliance messaging and nonce handling for ticket status updates.
• Fixed frontend asset loading reliability for ICTSS shortcodes to prevent missing styling in builder/theme render paths.
• Removed explicit textdomain loading call to align with current WordPress.org plugin directory guidance.

1.9.8

• Improved ticket-list performance by reducing unnecessary enrichment calls and adding enrichment caching.
• Hardened release/package validation flow and resolved remaining plugin-check findings for submission readiness.
• Added compatibility hardening for BeTheme and Divi, including button/form UI normalization.
• Added public intake behavior refinement for require_login="no" and asset cache-busting for CSS/JS updates.

1.9.7

• Added livechat identity controls (auto-identify, optional identity validation hash, auth-session reset)
• Added WordPress/WooCommerce/FluentCart contact sync service
• Added debug status panel and manual one-time contact sync action
• Fixed settings tab save behavior so tab saves no longer clear other-tab values