# Changelog
All notable changes to **MailArchiver** are documented in this *changelog*.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and **MailArchiver** adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [4.6.0] - 2026-03-20

### Added
- Compatibility with WordPress 7.0.

### Changed
- Minimal requirements are now PHP 8.2 and WordPress 6.4.
- Some strings in `readme.txt` have been updated.

### Removed
- Compatibility with PHP 8.1.
- Compatibility with WordPress 6.2 & 6.3.

## [4.5.1] - 2026-02-20

### Fixed
- [SEC007] Authenticated (Admininistrator+) SQL Injection via the `logid` parameter / [CVE-2026-2831](https://www.cve.org/CVERecord?id=CVE-2026-2831) (thanks to Ronnachai Chaipha (rxnr) via [Wordfence](https://www.wordfence.com)).

## [4.5.0] - 2026-02-19

### Changed
- Once an encryption key has been defined for an archiver, it can no longer be modified.

### Fixed
- [SEC006] Authenticated (Administrator+) Stored XSS vulnerability in the key encryption field / [CVE-2026-2721](https://www.cve.org/CVERecord?id=CVE-2026-2721) (thanks to Ronnachai Chaipha (rxnr) via [Wordfence](https://www.wordfence.com)).

## [4.4.0] - 2026-01-14

### Added
- Compatibility with `name <email@example.com>` email addresses (thanks to [Willy Bahuaud](https://github.com/willybahuaud)).

### Fixed
- [SEC005] XSS vulnerability in the "to" field (thanks to [Willy Bahuaud](https://github.com/willybahuaud)).

## [4.3.0] - 2025-11-22

### Added
- Compatibility with WordPress 6.9.

## [4.2.0] - 2025-04-14

### Added
- Compatibility with WordPress 6.8.

### Fixed
- Plugin update process may be confused when it founds error in release file.
- Pushover archiver may trigger PHP warning (thanks to [Markus Birth](https://github.com/mbirth)).

## [4.1.0] - 2024-11-22

### Added
- Compatibility with WordPress 6.6 & 6.7.

### Changed
- Ability to self-update from Github.
- The plugin user agent is now more consistent and "standard".

### Fixed
- There's a WordPress core "feature" which causes some PII to leak (to wp.org) during plugin and theme updates. This is no more the case for this plugin.
- In some cases, a WordPress notice can be triggered concerning the loading sequence of translations.

### Removed
- Test site launching from wordpress.org plugin page.
- All Databeam hooks and libraries, as the Databeam project is abandoned.
- Dependency on wp.org for updates.

## [4.0.0] - 2024-05-28

### Added
- [BC] To enable installation on more heterogeneous platforms, the plugin now adapts its internal logging mode to already loaded libraries.

### Changed
- Updated DecaLog SDK from version 4.1.0 to version 5.0.0.

### Fixed
- PHP error with some plugins like Woocommerce Paypal Payments.

## [3.0.2] - 2024-05-08

### Fixed
- There's some issues while pushing on wp.org repository.

## [3.0.1] - 2024-05-08

### Fixed
- There's some typos in the admin UI.
- All translations are not available.

## [3.0.0] - 2024-05-08

### Added
- Full compatibility with Elasticsearch 8.

### Changed
- [BC] Updated DecaLog SDK from version 3.0.0 to version 4.2.0.
- Upgraded Monolog library from version 2.9.1 to version 2.9.3.
- Upgraded GuzzleHttp library from version 7.2.0 to version 7.8.1.
- Upgraded Elasticsearch library from version 7.6.1 to version 8.13.0.
- Minimal required WordPress version is now 6.2.

## [2.14.0] - 2024-03-26

### Added
- New archiver to store archives in Hosterra Email.

### Fixed
- There's some typos in the admin UI.

## [2.13.0] - 2024-03-02

### Added
- Compatibility with WordPress 6.5.

### Changed
- Minimal required WordPress version is now 6.1.
- Minimal required PHP version is now 8.1.

## [2.12.0] - 2023-10-25

### Added
- Compatibility with WordPress 6.4.

## [2.11.0] - 2023-07-12

### Added
- Compatibility with WordPress 6.3.
- New option in archivers for proactive protection against XSS vulnerabilities.

### Changed
- Improved view for plain text email bodies.
- Improved compatibility with Contact Forms plugin.
- The color for `shmop` test in Site Health is now gray to not worry to much about it (was previously orange).

### Fixed
- [SEC004] XSS vulnerability / [CVE-2023-3136](https://www.cve.org/CVERecord?id=CVE-2023-3136) (thanks to [Alex Thomas](https://www.wordfence.com/threat-intel/vulnerabilities/researchers/alex-thomas) from [Wordfence](https://www.wordfence.com)).

## [2.10.1] - 2023-03-02

### Fixed
- [SEC003] CSRF vulnerability / [CVE-2023-27444](https://www.cve.org/CVERecord?id=CVE-2023-27444) (thanks to [Mika](https://patchstack.com/database/researcher/5ade6efe-f495-4836-906d-3de30c24edad) from [Patchstack](https://patchstack.com)).

## [2.10.0] - 2023-02-24

The developments of PerfOps One suite, of which this plugin is a part, is now sponsored by [Hosterra](https://hosterra.eu).

Hosterra is a web hosting company I founded in late 2022 whose purpose is to propose web services operating in a European data center that is water and energy efficient and ensures a first step towards GDPR compliance.

This sponsoring is a way to keep PerfOps One plugins suite free, open source and independent.

### Added
- Compatibility with WordPress 6.2.

### Changed
- Upgraded Monolog library from version 2.8.0 to version 2.9.1.
- Improved loading by removing unneeded jQuery references in public rendering (thanks to [Kishorchand](https://github.com/Kishorchandth)).

### Fixed
- In some edge-cases, detecting IP may produce PHP deprecation warnings (thanks to [YR Chen](https://github.com/stevapple)).

## [2.9.0] - 2022-10-06

### Added
- Compatibility with WordPress 6.1.
- [WPCLI] The results of `wp m-archive` commands are now logged in [DecaLog](https://wordpress.org/plugins/decalog/).

### Changed
- Upgraded Monolog library from version 2.5.0 to version 2.8.0.
- [WPCLI] The results of `wp m-archive` commands are now prefixed by the product name.

## [2.8.0] - 2022-04-21

### Added
- Compatibility with WordPress 6.0.
- New icons in archivers list to show activated privacy options.

### Changed
- Site Health page now presents a much more realistic test about object caching.
- Improved favicon handling for new Google API specifications.
- Updated DecaLog SDK from version 2.0.2 to version 3.0.0.
- Upgraded Monolog library from version 2.3.4 to version 2.5.0.

## [2.7.1] - 2022-01-17

### Fixed
- The Site Health page may launch deprecated tests.

## [2.7.0] - 2022-01-17

### Added
- Compatibility with PHP 8.1.

### Changed
- Updated DecaLog SDK from version 2.0.0 to version 2.0.2.
- Updated PerfOps One library from 2.2.1 to 2.2.2.
- Refactored cache mechanisms to fully support Redis and Memcached.
- Improved bubbles display when width is less than 500px (thanks to [Pat Ol](https://profiles.wordpress.org/pasglop/)).

### Fixed
- Object caching method may be wrongly detected in Site Health status (thanks to [freshuk](https://profiles.wordpress.org/freshuk/)).
- The console menu may display an empty screen (thanks to [Renaud Pacouil](https://www.laboiteare.fr)).
- There may be name collisions with internal APCu cache.

## [2.6.0] - 2021-12-07

### Added
- Compatibility with WordPress 5.9.
- New button in settings to install recommended plugins.
- The available hooks (filters and actions) are now described in `HOOKS.md` file.

### Changed
- Improved update process on high-traffic sites to avoid concurrent resources accesses.
- Better publishing frequency for metrics.
- Updated labels and links in plugins page.
- Updated the `README.md` file.

### Fixed
- Content type parsing may produce PHP errors in some cases.
- There's some typos in the admin UI.
- [SEC002] The password for some services are in plain text in "Site Health Info" page.
- Country translation with i18n module may be wrong.
- There's typos in `CHANGELOG.md`.

## [2.5.0] - 2021-09-29

### Added
- A new "operation mode" allows to not send emails but archive them as if they had been sent - see settings (thanks to [Loïc Antignac](https://github.com/webaxones) and [Xuan Nguyen](https://profiles.wordpress.org/xuxufr/) for the suggestion).
- New archiver to store individually each email as **json** or **eml** file, on server filesystem (local hard-drive or mounted storage).
- New archiver to forward each mail to a specified email address.
- New archiver to store archives in GMail.
- New archiver to store archives in Gandi Mail.
- New archiver to store archives in OVH (thanks to [Frank Bergère](https://profiles.wordpress.org/frank4/)).
- New archiver to store archives in Outlook.Com.
- New archiver to store archives in an Imap server.
- New archiver to store archives in an Elasticsearch instance.
- New archiver to store archives in Elastic Cloud.
- New archiver to store archives in a Loki instance.
- New archiver to store archives in Grafana Cloud service.
- New archiver to test and preview mails with Litmus service.
- New archiver to test and preview mails with Email on Acid service.
- New archiver to test mails with MailerCheck service.
- Privacy option for loggers allows now to encrypt the mail body.
- [WP-CLI] The new command `decrypt` allows to decrypt a mail body previously encrypted by MailArchiver.

### Changed
- MailArchiver now propagates `traceID` and `sessionID` for all archiver supporting it.
- The `traceID` field is now the trace ID generated by DecaLog if it's installed - it allows to "join" traces, events and mail archives.
- Improved internal IP detection: support for cloud load balancers.
- Improved compatibility with "Post SMTP Mailer" plugin.
- Improved hash handling and reporting for users and IPs.
- The archived metadata contains now a message "Mail sent." when sending is not in error.
- [WP-CLI] The command `status` now displays encryption details.
- Upgraded Monolog library from version 2.2.0 to version 2.3.4.

### Fixed
- System archivers are visible from the archiver selector.
- The remote IP can be wrongly detected when in AWS or GCP environments.
- Name collisions or PHP errors can occur with plugins using outdated versions of Monolog library (like BackWPup).

## [2.4.0] - 2021-09-07

### Added
- It's now possible to hide the main PerfOps One menu via the `poo_hide_main_menu` filter or each submenu via the `poo_hide_analytics_menu`, `poo_hide_consoles_menu`, `poo_hide_insights_menu`, `poo_hide_tools_menu`, `poo_hide_records_menu` and `poo_hide_settings_menu` filters (thanks to [Jan Thiel](https://github.com/JanThiel)).

### Changed
- Updated DecaLog SDK from version 1.2.0 to version 2.0.0.
- Designed has been improved for the archiver selector.

### Fixed
- There may be name collisions for some functions if version of WordPress is lower than 5.6.
- The main PerfOps One menu is not hidden when it doesn't contain any items (thanks to [Jan Thiel](https://github.com/JanThiel)).
- In some very special conditions, the plugin may be in the default site language rather than the user's language.
- The PerfOps One menu builder is not compatible with Admin Menu Editor plugin (thanks to [dvokoun](https://wordpress.org/support/users/dvokoun/)).

## [2.3.1] - 2021-08-11

### Changed
- New redesigned UI for PerfOps One plugins management and menus (thanks to [Loïc Antignac](https://github.com/webaxones), [Paul Bonaldi](https://profiles.wordpress.org/bonaldi/), [Axel Ducoron](https://github.com/aksld), [Laurent Millet](https://profiles.wordpress.org/wplmillet/), [Samy Rabih](https://github.com/samy) and [Raphaël Riehl](https://github.com/raphaelriehl) for their invaluable help).

### Fixed
- In some conditions, the plugin may be in the default site language rather than the user's language.
- With WordPress 5.8 it is impossible to move and close boxes.

## [2.3.0] - 2021-06-22

### Added
- Compatibility with WordPress 5.8.
- Integration with DecaLog SDK.
- Traces publication.

### Changed
- Redesigned archivers list.
- [WP-CLI] `m-archive status` command now displays DecaLog SDK version too.

## [2.2.0] - 2021-02-24

### Added
- Compatibility with WordPress 5.7.
- New setting to override local access privileges when in development or staging environments (thanks to [sebastienserre](https://github.com/sebastienserre) for the suggestion).
- New log message when the archiving of an email fails.

### Changed
- Consistent reset for settings.
- Improved translation loading.
- [WP_CLI] `m-archive` command have now a definition and all synopsis are up to date.
- Improved self monitoring to handle archivers internal errors.
- Code refactoring led to a huge execution speed gain: MailArchiver is now 40% faster.
- Upgraded Monolog library from version 2.0.2 to version 2.2.0.

### Fixed
- MailArchiver doesn't correctly honour previous error handler calls (thanks to [ajoah](https://github.com/ajoah)).
- MailArchiver jams the plugin/theme editor while editing PHP files (thanks to [ajoah](https://github.com/ajoah)).
- In Site Health section, Opcache status may be wrong (or generates PHP warnings) if OPcache API usage is restricted.
- The activation status of DecaLog (as logger) may be wrongly detected.

### Removed
- MailArchiver internal watchdog as it is no longer necessary.

## [2.1.0] - 2020-11-23

### Added
- Compatibility with WordPress 5.6.

### Changed
- Improvement in the way roles are detected.

### Fixed
- [SEC001] User may be wrongly detected in XML-RPC or Rest API calls.
- When site is in english and a user choose another language for herself/himself, menu may be stuck in english.
- Some typos in `readme.txt` and `README.md`.

## [2.0.0] - 2020-10-15

### Added
- [WP-CLI] New command to display MailArchiver status: see `wp help m-archive status` for details.
- [WP-CLI] New command to toggle on/off main settings: see `wp help m-archive settings` for details.
- [WP-CLI] New command to manage archivers (list, start, pause, clean, purge, remove, add and set): see `wp help m-archive archiver` for details.
- [WP-CLI] New command to view available archiver types (list and describe): see `wp help m-archive type` for details.
- New Site Health "info" section about shared memory.

### Changed
- The positions of PerfOps menus are pushed lower to avoid collision with other plugins (thanks to [Loïc Antignac](https://github.com/webaxones)).
- The selector for WordPress archivers is now sorted: running first, paused after (thanks to [Loïc Antignac](https://github.com/webaxones)).
- Improved layout for language indicator.
- Admin notices are now set to "don't display" by default.
- Improved IP detection  (thanks to [Ludovic Riaudel](https://github.com/lriaudel)).
- Improved changelog readability.
- The integrated markdown parser is now [Markdown](https://github.com/cebe/markdown) from Carsten Brandt.
- Prepares PerfOps menus to future 5.6 version of WordPress.

### Fixed
- The remote IP can be wrongly detected when behind some types of reverse-proxies.
- Some multi-attachments may be wrongly recorded.
- The rotating file archiver wrongly skips mails when sent from external process.
- With Firefox, some links are unclickable in the Control Center (thanks to [Emil1](https://wordpress.org/support/users/milouze/)).

### Removed
- Parsedown as integrated markdown parser.

## [1.6.0] - 2020-07-20

### Added
- Compatibility with WordPress 5.5.

### Changed
- Improved installation/uninstallation and activation/deactivation processes.
- In WordPress archiver, the shown columns are now automatically set.

### Fixed
- Uninstalling the plugin may produce a PHP error (thanks to [Emil1](https://wordpress.org/support/users/milouze/)).
- The WordPress archiver may be not purged when it should be (thanks to [Emil1](https://wordpress.org/support/users/milouze/)).
- The WordPress archiver may be wrongly purged when '0' is set as a limit (thanks to [Emil1](https://wordpress.org/support/users/milouze/)).
- In some conditions, some table may not be deleted while uninstalling.

### Removed
- The screen options in WordPress archiver (as it is now automatically set).

## [1.5.2] - 2020-06-29

### Changed
- Full compatibility with PHP 7.4.
- Automatic switching between memory and transient when a cache plugin is installed without a properly configured Redis / Memcached.

### Fixed
- When used for the first time, settings checkboxes may remain checked after being unchecked.

## [1.5.1] - 2020-05-05

### Changed
- The WordPress archives tables are now deleted when plugin is uninstalled.

### Fixed
- There's an error while activating the plugin when the server is Microsoft IIS with Windows 10.
- Some tabs may be hidden when site is switched in another language.
- With Microsoft Edge, some layouts may be ugly.

## [1.5.0] - 2020-04-12

### Added
- Compatibility with [DecaLog](https://wordpress.org/plugins/decalog/) early loading feature.

### Changed
- The settings page have now the standard WordPress style.
- Better styling in "PerfOps Settings" page.
- In site health "info" tab, the boolean are now clearly displayed.

### Fixed
- In some cases, the "screen options" tab may be invisible.
- Short links (in other dashboard pages) are wrong. 

## [1.4.0] - 2020-03-01

### Added
- Full integration with PerfOps One suite.
- Full compatibility with [APCu Manager](https://wordpress.org/plugins/apcu-manager/).
- Compatibility with WordPress 5.4.

### Changed
- New menus (in the left admin bar) for accessing features: "PerfOps Records" and "PerfOps Settings".

### Fixed
- Some raw mails may be wrongly rendered in WordPress archiver when they contains the character `"`.
- The header extraction of the "from" field may produce an error.

### Removed
- Compatibility with WordPress versions prior to 5.2.
- Old menus entries, due to PerfOps integration.

## [1.3.0] - 2020-01-03

### Added
- Full compatibility (for internal cache) with Redis and Memcached.
- Using APCu rather than database transients if APCu is available.
- New Site Health "status" sections about OPcache and object cache. 
- New Site Health "status" section about i18n extension for non `en_US` sites.
- New Site Health "info" sections about OPcache and object cache.
- New Site Health "info" section about the plugin itself.
- New Site Health "info" section about archivers settings. 

### Changed
- Upgraded Monolog library from version 2.0.1 to version 2.0.2.

## [1.2.0] - 2019-12-19

### Added
- Support for plugged (custom) `wp_mail` function (mu-plugins or themes).

### Changed
- Mail subject can now contains emojis.
- WordPress archivers now report full source of mail (even for plugged `wp_mail`).
- The "from" field is now detected for Post SMPT plugin.

### Fixed
- In some rare cases, recording a mail error may produce a PHP warning.
- Some plugin options may be not saved when needed (thanks to [Lucas Bustamante](https://github.com/Luc45)).
- Typo in a string.

## [1.1.0] - 2019-12-12

### Added
- Full compatibility with WP Mail SMTP.
- Full compatibility with Post SMTP.
- "from" field is now visible in the mail details in WordPress archiver.

### Changed
- The detection of the "from" field has been improved.

### Fixed
- Some strings are not translatable.
- Some typos in inline help. 

## [1.0.0] - 2019-12-03

Initial release
