=== Labqi QR Manager ===
Contributors: rinkurana11
Tags: qr code, qr generator, qr redirect, bulk import, qr tracking
Requires at least: 6.4
Tested up to: 7.0
Requires PHP: 8.2
Stable tag: 1.2.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Professional QR Code management — generate, track, bulk import, and export QR codes with a full redirect system.

== Description ==

Labqi QR Manager is a complete QR code management solution for WordPress.

**Features:**

* Generate QR codes (PNG, 500×500) using endroid/qr-code v6
* Link-type QR codes — redirect to any URL on scan
* Attachment-type QR codes — serve PDF, DOCX, XLSX, PNG, JPG, WEBP securely
* Custom rewrite endpoint: `yoursite.com/qr/{code}`
* Scan tracking — count + last-scan timestamp per QR
* Bulk CSV import with per-row error reporting
* Export to CSV, Excel (XLSX), or ZIP (images + manifest)
* Bootstrap 5 admin UI with DataTables, SweetAlert2
* Analytics dashboard widget
* Settings: QR size, margin, logo overlay, default status

== Installation ==

1. Upload the `labqi-qr-manager` folder to `/wp-content/plugins/`
2. Activate the plugin in WordPress › Plugins
3. Go to Settings › Permalinks and click Save (to flush rewrite rules)
4. Visit Labqi QR Manager in the admin sidebar

== Frequently Asked Questions ==

= Where are QR images stored? =
Inside `wp-content/uploads/labqi-qr-manager/qr-codes/`, so files survive plugin updates and reinstalls.

= Are attachment files publicly accessible? =
No. A `.htaccess` blocks direct access. Files are served through PHP only.

= How do I change QR size or add a logo? =
Go to Labqi QR Manager › Settings.

== Changelog ==

= 1.2.1 =
* Fixed nonce checks that WordPress.org's Plugin Check scanner couldn't verify: several AJAX handlers and the Add/Edit form handler called a custom security wrapper method instead of WordPress core's check_ajax_referer()/check_admin_referer() directly. The wrapper genuinely did call wp_verify_nonce() and current_user_can() correctly, but automated scanners can't trace into custom methods — all handlers now call the core functions directly.
* Moved the nonce check in the Add/Edit form handler earlier, before the submitted action type is read (previously it was only verified deeper inside the add/update logic)
* Sanitized $_FILES data field-by-field at the point of use (name, type) instead of passing the raw array through, and explicitly sanitized the "default_status" setting instead of relying only on a whitelist check
* Added sanitize_text_field()/sanitize_key() before re-displaying submitted form values on validation errors (previously only wp_unslash() + esc_attr(), which escapes safely for output but skips the sanitize step)

= 1.2.0 =
* Renamed the plugin again from "ProductQRScan Pro" to "Labqi QR Manager" (slug: labqi-qr-manager) — WordPress.org's reviewer AI flagged "Product QR Scan" as too purely descriptive of the plugin's functionality to be a distinctive name, even with "Pro" appended
* Fixed several leftover references to the previous plugin name that the automated rename missed the first time (a page heading, the admin sidebar menu label, and internal page-slug/query-var prefixes)
* Fixed an admin-page asset loading bug introduced by the rename: WordPress' submenu page hook suffix must exactly match the parent menu slug's hyphens (e.g. "labqi-qr_page_labqi-qr-add"); an earlier pass had generated an underscore in that position, which silently prevented Bootstrap/DataTables/custom JS/CSS from loading on the Add, Import, and Settings pages

= 1.1.2 =
* Fixed: the "All QR Codes" page list showed "NaN" for total entries/pages. `wp_send_json_success()` nests the AJAX response inside a `data` envelope, but DataTables reads `recordsTotal`/`recordsFiltered` from the top level of the response — the frontend now hoists those fields correctly before DataTables reads them
* Fixed: a leftover page heading still read "QR Code Master" instead of the current plugin name

= 1.1.1 =
* Completed the library update from 1.1.0: endroid/qr-code was still on 5.1.0 (unchanged) and DataTables had only received a patch bump — both are now updated to their current stable releases (endroid/qr-code 6.0.9, DataTables 3.0.0)
* Fixed a stray FAQ answer that pointed to the wrong QR image storage path

= 1.1.0 =
* Renamed the plugin from "QR Master Pro" to "Labqi QR Manager" (slug: labqi-qr-manager) to resolve a trademark/naming conflict flagged during WordPress.org review
* Removed load_plugin_textdomain() call (unnecessary on WordPress.org since WP 4.6, translations are loaded automatically)
* Fixed: uploaded PDF/attachment files now live in a plugin-slug-namespaced uploads folder (wp-content/uploads/labqi-qr-manager/qr-pdfs/) instead of a bare top-level uploads/qr-pdfs/ folder; existing files are migrated automatically
* Fixed: the Logo setting no longer asks for a typed absolute server file path — it now uses the WordPress Media Library picker and stores a portable attachment ID
* Fixed: moved an inline <style> block on the QR error page into a properly enqueued stylesheet
* Updated bundled libraries to current stable releases: Bootstrap 5.3.3 → 5.3.8, DataTables 1.13.8 → 3.0.0, endroid/qr-code 5.1.0 → 6.0.9 (PHP requirement stays at 8.2 — a newer 6.1.x line of endroid/qr-code requires PHP 8.4 and was intentionally not used)

= 1.0.3 =
* Massive package size reduction (26MB → ~3MB installed) to fit WordPress.org's 10MB upload limit:
  * Removed an unused 16MB bundled font (only needed for a QR "label" feature this plugin never uses)
  * Replaced the phpoffice/phpspreadsheet library with a small built-in XLSX writer (no functionality change — XLSX export still has the same styled header, frozen header row, and auto-sized columns)
* No user-facing behavior changes in this release

= 1.0.2 =
* Fixed: removed bundled hidden file (.htaccess) and obsolete legacy uploads folder from the package
* Fixed: missing direct-access protection in templates/error.php
* Fixed: Domain Path header now points to an existing languages/ folder
* Fixed: replaced move_uploaded_file() with a WP_Filesystem-based secure upload handler
* Fixed: replaced parse_url() with wp_parse_url(), unlink() with wp_delete_file()
* Improved: all database queries now use $wpdb->prepare() with %i identifier placeholders for table/column names
* Improved: added missing translator comments for all strings with placeholders
* Improved: internal redirects now use wp_safe_redirect(); external QR-destination redirects remain wp_redirect() by design (admin-configured destinations, not public input)

= 1.0.1 =
* QR code images now stored under wp-content/uploads/ instead of inside the plugin folder (data now survives plugin updates/reinstalls; existing images are migrated automatically)
* Uninstall now fully removes all generated QR images and attachments
* Removed unused legacy code files
* Minor readme and translation string fixes

= 1.0.0 =
* Initial release

== Upgrade Notice ==

= 1.2.1 =
Addresses WordPress.org review feedback on nonce/permission checks and input sanitization. No functional changes for end users. Safe to update.

= 1.2.0 =
Plugin renamed to Labqi QR Manager (was ProductQRScan Pro) per WordPress.org review, plus a fix for admin styling that could fail to load on the Add/Import/Settings pages. Safe to update.

= 1.1.2 =
Fixes the "NaN" entries/pagination bug on the QR list page and a leftover old page title. Safe to update.

= 1.1.1 =
Completes the WordPress.org-requested library updates (endroid/qr-code and DataTables) that were missed in 1.1.0. Safe to update.

= 1.1.0 =
Plugin renamed to Labqi QR Manager. If you had a Logo set, please re-select it via Settings after updating.

= 1.0.3 =
Major size reduction, no functionality changes — safe to update.

= 1.0.2 =
Code quality and WordPress.org compliance fixes — no action needed, safe to update.

= 1.0.1 =
Storage location change for QR images — files are migrated automatically on activation, no action needed.

= 1.0.0 =
Initial release.
