Labqi QR Manager

Changelog

1.2.1

• Fixed nonce checks that WordPress.org’s Plugin Check scanner couldn’t verify: several AJAX handlers and the Add/Edit form handler called a custom security wrapper method instead of WordPress core’s check_ajax_referer()/check_admin_referer() directly. The wrapper genuinely did call wp_verify_nonce() and current_user_can() correctly, but automated scanners can’t trace into custom methods — all handlers now call the core functions directly.
• Moved the nonce check in the Add/Edit form handler earlier, before the submitted action type is read (previously it was only verified deeper inside the add/update logic)
• Sanitized $_FILES data field-by-field at the point of use (name, type) instead of passing the raw array through, and explicitly sanitized the “default_status” setting instead of relying only on a whitelist check
• Added sanitize_text_field()/sanitize_key() before re-displaying submitted form values on validation errors (previously only wp_unslash() + esc_attr(), which escapes safely for output but skips the sanitize step)

1.2.0

• Renamed the plugin again from “ProductQRScan Pro” to “Labqi QR Manager” (slug: labqi-qr-manager) — WordPress.org’s reviewer AI flagged “Product QR Scan” as too purely descriptive of the plugin’s functionality to be a distinctive name, even with “Pro” appended
• Fixed several leftover references to the previous plugin name that the automated rename missed the first time (a page heading, the admin sidebar menu label, and internal page-slug/query-var prefixes)
• Fixed an admin-page asset loading bug introduced by the rename: WordPress’ submenu page hook suffix must exactly match the parent menu slug’s hyphens (e.g. “labqi-qr_page_labqi-qr-add”); an earlier pass had generated an underscore in that position, which silently prevented Bootstrap/DataTables/custom JS/CSS from loading on the Add, Import, and Settings pages

1.1.2

• Fixed: the “All QR Codes” page list showed “NaN” for total entries/pages. wp_send_json_success() nests the AJAX response inside a data envelope, but DataTables reads recordsTotal/recordsFiltered from the top level of the response — the frontend now hoists those fields correctly before DataTables reads them
• Fixed: a leftover page heading still read “QR Code Master” instead of the current plugin name

1.1.1

• Completed the library update from 1.1.0: endroid/qr-code was still on 5.1.0 (unchanged) and DataTables had only received a patch bump — both are now updated to their current stable releases (endroid/qr-code 6.0.9, DataTables 3.0.0)
• Fixed a stray FAQ answer that pointed to the wrong QR image storage path

1.1.0

• Renamed the plugin from “QR Master Pro” to “Labqi QR Manager” (slug: labqi-qr-manager) to resolve a trademark/naming conflict flagged during WordPress.org review
• Removed load_plugin_textdomain() call (unnecessary on WordPress.org since WP 4.6, translations are loaded automatically)
• Fixed: uploaded PDF/attachment files now live in a plugin-slug-namespaced uploads folder (wp-content/uploads/labqi-qr-manager/qr-pdfs/) instead of a bare top-level uploads/qr-pdfs/ folder; existing files are migrated automatically
• Fixed: the Logo setting no longer asks for a typed absolute server file path — it now uses the WordPress Media Library picker and stores a portable attachment ID
• Fixed: moved an inline block on the QR error page into a properly enqueued stylesheet
• Updated bundled libraries to current stable releases: Bootstrap 5.3.3 → 5.3.8, DataTables 1.13.8 → 3.0.0, endroid/qr-code 5.1.0 → 6.0.9 (PHP requirement stays at 8.2 — a newer 6.1.x line of endroid/qr-code requires PHP 8.4 and was intentionally not used)

1.0.3

• Massive package size reduction (26MB → ~3MB installed) to fit WordPress.org’s 10MB upload limit:
  • Removed an unused 16MB bundled font (only needed for a QR “label” feature this plugin never uses)
  • Replaced the phpoffice/phpspreadsheet library with a small built-in XLSX writer (no functionality change — XLSX export still has the same styled header, frozen header row, and auto-sized columns)
• No user-facing behavior changes in this release

1.0.2

• Fixed: removed bundled hidden file (.htaccess) and obsolete legacy uploads folder from the package
• Fixed: missing direct-access protection in templates/error.php
• Fixed: Domain Path header now points to an existing languages/ folder
• Fixed: replaced move_uploaded_file() with a WP_Filesystem-based secure upload handler
• Fixed: replaced parse_url() with wp_parse_url(), unlink() with wp_delete_file()
• Improved: all database queries now use $wpdb->prepare() with %i identifier placeholders for table/column names
• Improved: added missing translator comments for all strings with placeholders
• Improved: internal redirects now use wp_safe_redirect(); external QR-destination redirects remain wp_redirect() by design (admin-configured destinations, not public input)

1.0.1

• QR code images now stored under wp-content/uploads/ instead of inside the plugin folder (data now survives plugin updates/reinstalls; existing images are migrated automatically)
• Uninstall now fully removes all generated QR images and attachments
• Removed unused legacy code files
• Minor readme and translation string fixes

1.0.0

• Initial release