# Changelog

All notable changes to this project will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [6.0.2] - 2026-02-03

### Added
- Added new "Advanced" settings panel with custom CSS field for front-end styling customization
- Users can now add custom CSS code that will be automatically applied to Leanpay elements on the front-end

### Fixed
- Fixed duplicate CSS enqueue issue where `leanpay_cene_css` was being loaded multiple times on page load
- Fixed plugin textdomain loading issue that was preventing translations from being loaded correctly
- Minor CSS fixes and improvements for better front-end display
- Improved code comments and documentation
- API vendor URL bugfix when upgrading

## [6.0.1] - 2025-01-21

### Fixed
- Fixed frontend checkout display issue where HTML content was being escaped incorrectly, preventing proper rendering of Leanpay information on checkout page

## [6.0.0] - 2025-12-18

### Changed - Preparation for WordPress.org Release
- **Security Improvements**: 
  - Added comprehensive input sanitization for all user inputs (GET, POST, REQUEST, SERVER variables)
  - Implemented proper output escaping using WordPress escaping functions (esc_html, esc_attr, esc_url, etc.)
  - Replaced all SQL queries with prepared statements using $wpdb->prepare()
  - Added input validation for webhook data and API responses
  - Sanitized all URLs, colors, and text inputs before use
  - Escaped all output in HTML attributes, URLs, and inline content

### Security
- Fixed potential SQL injection vulnerabilities by using prepared statements
- Fixed potential XSS vulnerabilities by escaping all output
- Sanitized all user inputs before database operations
- Validated and sanitized JSON webhook data
- Added proper escaping for admin order meta data display
- Secured all API calls with proper input sanitization

### Code Quality
- Improved code standards compliance with WordPress Coding Standards
- Replaced `json_encode()` with `wp_json_encode()` for better compatibility
- Replaced `addslashes()` with proper `sanitize_text_field()` and validation
- Improved error handling with proper WordPress functions (wp_die, wp_send_json_error)
- Enhanced URL construction with proper escaping

### Technical
- All $_GET, $_POST, $_REQUEST variables now properly sanitized
- All $_SERVER variables sanitized before use
- All database queries use prepared statements
- All HTML output properly escaped
- All JavaScript output properly escaped
- All URL parameters properly escaped

### Documentation
- Added comprehensive README.md
- Added CHANGELOG.md file
- Improved inline code documentation

---

## Previous Versions

For changes in versions prior to 6.0.0, please refer to previous release notes or contact support.