Labqi QR Manager -- WordPress 插件

Labqi QR Manager is a complete QR code management solution for WordPress. Features:

1.2.1

Fixed nonce checks that WordPress.org's Plugin Check scanner couldn't verify: several AJAX handlers and the Add/Edit form handler called a custom security wrapper method instead of WordPress core's check_ajax_referer()/check_admin_referer() directly. The wrapper genuinely did call wp_verify_nonce() and current_user_can() correctly, but automated scanners can't trace into custom methods — all handlers now call the core functions directly.
Moved the nonce check in the Add/Edit form handler earlier, before the submitted action type is read (previously it was only verified deeper inside the add/update logic)
Sanitized $_FILES data field-by-field at the point of use (name, type) instead of passing the raw array through, and explicitly sanitized the "default_status" setting instead of relying only on a whitelist check
Added sanitize_text_field()/sanitize_key() before re-displaying submitted form values on validation errors (previously only wp_unslash() + esc_attr(), which escapes safely for output but skips the sanitize step)

1.2.0

Renamed the plugin again from "ProductQRScan Pro" to "Labqi QR Manager" (slug: labqi-qr-manager) — WordPress.org's reviewer AI flagged "Product QR Scan" as too purely descriptive of the plugin's functionality to be a distinctive name, even with "Pro" appended
Fixed several leftover references to the previous plugin name that the automated rename missed the first time (a page heading, the admin sidebar menu label, and internal page-slug/query-var prefixes)
Fixed an admin-page asset loading bug introduced by the rename: WordPress' submenu page hook suffix must exactly match the parent menu slug's hyphens (e.g. "labqi-qr_page_labqi-qr-add"); an earlier pass had generated an underscore in that position, which silently prevented Bootstrap/DataTables/custom JS/CSS from loading on the Add, Import, and Settings pages

1.1.2

Fixed: the "All QR Codes" page list showed "NaN" for total entries/pages. wp_send_json_success() nests the AJAX response inside a data envelope, but DataTables reads recordsTotal/recordsFiltered from the top level of the response — the frontend now hoists those fields correctly before DataTables reads them
Fixed: a leftover page heading still read "QR Code Master" instead of the current plugin name

1.1.1

Completed the library update from 1.1.0: endroid/qr-code was still on 5.1.0 (unchanged) and DataTables had only received a patch bump — both are now updated to their current stable releases (endroid/qr-code 6.0.9, DataTables 3.0.0)
Fixed a stray FAQ answer that pointed to the wrong QR image storage path

1.1.0

Renamed the plugin from "QR Master Pro" to "Labqi QR Manager" (slug: labqi-qr-manager) to resolve a trademark/naming conflict flagged during WordPress.org review
Removed load_plugin_textdomain() call (unnecessary on WordPress.org since WP 4.6, translations are loaded automatically)
Fixed: uploaded PDF/attachment files now live in a plugin-slug-namespaced uploads folder (wp-content/uploads/labqi-qr-manager/qr-pdfs/) instead of a bare top-level uploads/qr-pdfs/ folder; existing files are migrated automatically
Fixed: the Logo setting no longer asks for a typed absolute server file path — it now uses the WordPress Media Library picker and stores a portable attachment ID
Fixed: moved an inline block on the QR error page into a properly enqueued stylesheet
Updated bundled libraries to current stable releases: Bootstrap 5.3.3 → 5.3.8, DataTables 1.13.8 → 3.0.0, endroid/qr-code 5.1.0 → 6.0.9 (PHP requirement stays at 8.2 — a newer 6.1.x line of endroid/qr-code requires PHP 8.4 and was intentionally not used)

1.0.3

Massive package size reduction (26MB → ~3MB installed) to fit WordPress.org's 10MB upload limit:
Removed an unused 16MB bundled font (only needed for a QR "label" feature this plugin never uses)
Replaced the phpoffice/phpspreadsheet library with a small built-in XLSX writer (no functionality change — XLSX export still has the same styled header, frozen header row, and auto-sized columns)
No user-facing behavior changes in this release

1.0.2

Fixed: removed bundled hidden file (.htaccess) and obsolete legacy uploads folder from the package
Fixed: missing direct-access protection in templates/error.php
Fixed: Domain Path header now points to an existing languages/ folder
Fixed: replaced move_uploaded_file() with a WP_Filesystem-based secure upload handler
Fixed: replaced parse_url() with wp_parse_url(), unlink() with wp_delete_file()
Improved: all database queries now use $wpdb->prepare() with %i identifier placeholders for table/column names
Improved: added missing translator comments for all strings with placeholders
Improved: internal redirects now use wp_safe_redirect(); external QR-destination redirects remain wp_redirect() by design (admin-configured destinations, not public input)

1.0.1

QR code images now stored under wp-content/uploads/ instead of inside the plugin folder (data now survives plugin updates/reinstalls; existing images are migrated automatically)
Uninstall now fully removes all generated QR images and attachments
Removed unused legacy code files
Minor readme and translation string fixes

1.0.0

Labqi QR Manager