YUZ-TRA

Changelog

1.5.45

• Validate and sanitize REQUEST_URI directly at its read boundary.
• Consolidate portability corrections and regression checks without replacing earlier candidate files.

1.5.44

• Keep HTTPS administrative/login URLs unchanged when the public site uses HTTP.
• Recognize WordPress content-directory constants without mistaking another CDN host for the local site.

1.5.43

• Preserve query-mode REST routes, translate normal front-controller pages and distinguish CDN paths from local pages.
• Respect the configured site-directory boundary when detecting language prefixes.

1.5.42

• Resolve editor and service assets from WordPress configuration or their actual module URLs, including custom content folders and subdirectory sites.
• Optional theme integrations require explicit script URLs instead of assuming a particular child theme.
• Site URL conversion uses WordPress configuration rather than request Host headers or a localhost fallback.

1.5.41

• Settings input unslashing made explicit at the authenticated request boundary, before field validation.

1.5.40

• Reject invalid AJAX nonces before diagnostics and prevent delayed Gettext discovery writes during AJAX requests.
• Canonical plugin-specific JavaScript globals and switcher cache group; producer and consumer regression coverage.
• Expanded acceptance tests with active logging, real HTTP refusal status, SQL observation and activation callback verification.

1.5.39

• Review candidate: field-specific JSON/CSV validation, typed target languages, settings authorization and data-preserving validation.
• Canonical YUZTRA_/yuztra_ PHP symbols, hooks, AJAX actions and REST namespace. Integrations using earlier evaluation identifiers require updates.
• Explicit, journaled settings/capability/cron migration; historical translation tables and original options retained. Existing evaluation installations require a controlled maintenance migration before boot.
• Schema failure propagation and clean-activation regression coverage. No platform approval is implied by this candidate.

1.5.18

• Complete explicit AJAX nonce boundaries and remove the remaining high-confidence SQL preparation errors found in the 1.5.10 scan.
• Keep request diagnostics free of stack traces and normalize settings requests at their input boundary.

1.5.10

• Harden settings and asset request handling with capability, nonce and typed sanitization controls.
• Prepare dynamic SQL identifiers and values safely, and constrain generated table suffixes.
• Prefix helper implementations while retaining data-compatible migration aliases.
• Remove development diagnostics that could expose translated or provider response content.

1.5.9

• Enforce capability checks before effects on sensitive AJAX routes and verify denial without SQL writes.
• Return an explicit failure when no translation can be published; never report a false publication success.
• Keep provider secrets out of settings responses and restrict maintenance to the canonical translations table.

1.5.8

• Update the bundled Axios browser library to 1.20.0, with verified upstream package integrity.
• Preserve prior candidate ZIPs; this evaluation artifact is not a WordPress.org approval.

1.5.7

• Separate published public lookups from privileged translation and publication endpoints.
• Filter substituted HTML and validate bounded callback request data.
• Reduce diagnostic content and derive asset URLs from the plugin file.
• Evaluation candidate: not yet approved by WordPress.org.

1.5.6

• Reject executable translations on save and when loading legacy PHP/JavaScript catalogs.
• Require administrator permission for global publication and administrator consent for credit links.
• Protect health diagnostics, sanitize settings and stop writing the debug-probe log into wp-content.
• Enqueue scripts through WordPress and scope template output buffering.
• Update Select2 to 4.1.0 and document OpenAI requests and external-service policies.
• Remove assumed root AJAX URLs and generic fallback names.

1.5.5

• Prevent provider credentials and complete automatic-translation settings from reaching diagnostic logs.
• Validate CSV uploads with WordPress file inspection and safe local redirects.
• Restrict anonymous AJAX to the two read-only routes required for front-end translation.
• Require authentication, capability and nonces for diagnostic log endpoints.
• Disable probes and RUM telemetry by default and remove source/target previews from metrics.
• Add focused security regression tests for these controls.

1.5.4

• Production-ready WordPress.org metadata and durable update guidance.
• Package author normalized to YOUZURZ (YUZ CLA GPT).
• Fresh WordPress 7.1 and Plugin Check 2.1.0 validation of the exact release ZIP.

1.5.3

• Translation domain normalized to the yuz-tra slug.
• Third-party update header removed from the WordPress.org package.
• Reproducible GitHub Actions build with external SHA-256 and provenance manifest.

1.5.1

• Shared top-aligned visual and string workspace, accessible resizing and local preferences.
• Draft-preserving close/reopen, mobile stacking and scoped keyboard shortcuts.
• Bundled dependencies, licensing, privacy/cost documentation and support entry points.
• Explicit independent distribution status; no claim of WordPress.org approval.

1.4.2

• Top-layer string catalog and protection against late translation responses overwriting edits.