# Changelog

## 1.3.3 - 2026-04-15

- Removed `set_time_limit()` calls entirely to avoid forcing PHP runtime limits from plugin code.
- Fixed remaining `dirname()` traversals with numeric level parameters; all paths now resolve via `wp_upload_dir()` and `get_home_path()` exclusively.

## 1.3.2 - 2026-04-14

- Changed file path resolution to use `wp_upload_dir()` and `get_home_path()` instead of `WP_CONTENT_DIR` and `ABSPATH` constants.
- Changed `set_time_limit(0)` calls to `set_time_limit(900)` with bounded 15-minute cap.
- Changed download handler to validate nonce and permissions before reading any request data.
- Changed `request_secret()` and `verified_query_value()` to use `sanitize_text_field()` for input sanitization.
- Changed admin output from `safe_admin_markup()` wrapper to direct `wp_kses()` with explicit allowed-tags array.
- Changed file streaming from `fread`/`echo` loop to single `readfile()` call.
- Changed Content-Disposition filename to use `sanitize_file_name()`.
- Changed provider interface and class names from `SavedPixel_Remote_Backup_*` to `SPRB_*` prefix.
- Changed shared admin helper functions and globals from `savedpixel_*` to `sprb_*` prefix.

## 1.3.1 - 2026-04-10

- Changed writable runtime directories to uploads-based helpers while preserving legacy backup manifests and site-root storage discovery during upgrade.
- Changed admin request validation, provider settings saves, and path handling to satisfy the WordPress.org review fixes without breaking existing backup flows.
- Changed provider/interface/admin-JS naming and output-safety hotspots to use unique `sprb`-scoped identifiers across the plugin surface.
- Fixed the admin download controller bootstrap so backup history Download links register on `admin_init` and stream artifact attachments instead of reloading the admin page.

## 1.3.0 - 2026-04-09

- Changed all option keys, constants, AJAX hooks, cron hooks, transients, and HTML element IDs from `rb_`/`RB_` prefix to `sprb_`/`SPRB_` prefix for WordPress.org 4-character uniqueness requirement.
- Added automatic migration of existing `rb_*` option keys, cron events, and transients to `sprb_*` equivalents on upgrade.
- Changed `/savedpixel-backup/v1/status` REST endpoint to require pull-token authorization instead of public access.
- Added `== External services ==` section to `readme.txt` documenting Google Drive, Dropbox, OneDrive, SSH, and FTP integrations with Terms of Service and Privacy Policy links.

## 1.2.1 - 2026-03-27

- Added dismissible in-progress backup modal support with inline progress continuation.
- Changed inline backup progress to stay hidden until the modal is dismissed.
- Changed dismissed inline progress layout to use a full-width bar with a single-line size summary.
- Fixed progress spinner animation so modal and inline states visibly spin during active work.
- Fixed dismiss button availability so it appears immediately when the backup modal opens.

## 1.2.0 - 2026-03-25

- Added remote storage provider architecture with pluggable provider interface.
- Added Google Drive provider with OAuth 2.0 authorization and resumable uploads.
- Added OneDrive provider with Microsoft Graph API, OAuth 2.0, and upload sessions.
- Added Dropbox provider with OAuth 2.0 auth code flow and upload sessions for large files.
- Added Backup Now popup modal with scope selection and conditional remote storage checkbox.
- Added AJAX lazy-loading infinite-depth folder tree with checkbox cascading and indeterminate parent state.
- Changed scheduled delivery from shared option to per-scope settings for database and files independently.
- Fixed scheduled delivery dropdown allowing remote selection when no provider is configured.

## 1.1.0 - 2026-03-22

- Added pull-token-authenticated REST endpoint for remote backup triggering.
- Added support for remotely requested manual and fallback backup runs via existing async job machinery.
- Added trigger metadata response so a monitor site can track requested runs to completion.

## 1.0.0 - 2026-03-18

- Initial release
- Run a one-time backup for the database, files, or both.
- Schedule database and file backups independently with configurable times and weekly options.
- Keep backups local only or deliver them to remote storage after they finish.
- Download or delete artifacts from the backup history table.
- Expose a pull token so a monitor site can read backup status and fetch completed artifacts.
- Backup scopes for `database`, `files`, and `both`.
- Manual backups from wp-admin with asynchronous job handling and progress feedback.
- Scheduled database and file backups with separate frequency, time, and weekday controls.
- Retention controls for how many database and file backups to keep.
- Local artifact storage for compressed database dumps and ZIP archives.