# DZQCOD Changelog

## v3.1.0 (March 2026) — Security + Features

### 🔴 Security Fixes
- **SQL Injection** — Fixed unescaped `$phone` in `fraud_check()` — now uses `$wpdb->prepare()`
- **HPOS Support** — Fraud check now supports both WooCommerce HPOS and Legacy storage
- **SSL Verification** — Enabled by default for all API calls (License, Shipping, Telegram)
- **Telemetry Privacy** — License key removed from telemetry, replaced with SHA-256 hash
- **Telemetry Opt-out** — New setting to disable anonymous statistics

### 🟢 New Features
- **OTP Resend** — `dzqcod_send_otp` endpoint with rate limiting (max 3/hour)
- **TelegramBot Complete** — Order notifications + status changes + `/stats` `/pending` commands
- **RBAC Enforcement** — Admin menu visibility controlled by user role permissions
- **Dark Mode** — Automatic dark mode for order form + manual override setting
- **NIBRA License API** — Migrated from WHMCS to `productes.nibra.cloud/api/v1`

### 🟡 Improvements
- **CSS Scoping** — Admin styles isolated to prevent WP theme conflicts
- **i18n Ready** — `load_plugin_textdomain()` + translatable status labels
- **Version** — Updated to 3.1.0

### Files Modified (9)
`Core.php` `Shipping.php` `TelegramBot.php` `Installer.php` `dzqcod.php` `admin.css` `front.css` `readme.txt` `settings.php`

---

## v3.0.8 (February 2026) — Enterprise Addons

### Enterprise Addons (11 fully implemented)
- 🧾 **Accounting Pro** (524 lines) — Invoices, taxes (TVA/TAP/IRG/G50), customers, journal, trial balance, print
- 📢 **Ads Manager** (1,207 lines) — 10 ad types, 17 zones, targeting, scheduling, analytics
- 🤖 **AI Copilot** (305 lines) — 16 content types, 40+ templates, OpenAI/Claude API
- 🎨 **Canva Creative** (232 lines) — HTML5 Canvas designer, 16 gradients, 5 templates
- ⚡ **Workflows** (98 lines) — 11 triggers × 10 actions × 7 conditions
- 🏪 **Multi-Store** (78 lines) — Multiple stores with instant switching
- 📊 **Cohort Analysis** (66 lines) — Monthly customer retention analysis
- 🔥 **Form Heatmap** (64 lines) — Field interaction tracking with heat bars
- 📧 **Email Marketing** (72 lines) — Mailchimp + Brevo auto-sync
- 🔗 **CRM Integration** (43 lines) — HubSpot Contact + Deal automation
- 📸 **Instagram Shop** (67 lines) — Feed display + shortcode

### Shipping (7 fully implemented)
- Yalidine, ZR Express, EcoTrack, NOEST (existing)
- **Maystro Delivery** (NEW) — Auto pricing + create + track + webhook
- **ProColis** (NEW) — Auto pricing + create + track + webhook
- **Guepex** (NEW) — Auto pricing + create + track + webhook
- All 7: Auto rates per wilaya + delivery type, shipment creation, live tracking, webhooks

### Accounting Features
- 5 invoice types (FA/FC/AV/PF/BL) with auto-numbering
- Multi-item invoices: description + unit (8 types) + qty + price + TVA% + line total
- Amount in Arabic words: "توقفت هذه الفاتورة عند مبلغ: ..."
- Customer database with auto-save and search autocomplete
- Print invoice + delivery note (BL)
- G50 monthly tax return generator
- Trial balance + P&L reports + CSV export

### License System
- Migrated to NIBRA License API (`productes.nibra.cloud`)
- Endpoints: ping, verify, activate, deactivate, install
- JSON response with plan, features[], addons[], expiry, grace
- Daily cron verification

### Other
- Delivery type toggle in form designer
- Sidebar duplication fix
- Antivirus false positive fix (TelegramBot isolation)
- Delete handlers for orders/products/wilayas

---

## v3.0.7 and earlier
- Initial release with core COD management
- 15 order statuses, quick order form, call center, POS
- 4 shipping providers (Yalidine, ZR, EcoTrack, NOEST)
- Fraud detection, WhatsApp/SMS auto, campaigns
- 58 wilayas + 1541 communes database
