# Changelog

All notable changes to Aurora Admin are documented here, one entry per
version bump. Starts at 2.1.0 — earlier history (the theming rebuild,
window chrome/taskbar, Site Editor support, etc.) lives in `git log` and
`PROJECT_STATUS.md`, not reconstructed here.

## [2.3.0] - 2026-07-04

### Added
- Settings > Media's "Allow SVG uploads" toggle now actually does
  something — previously existed in the UI with no implementation behind
  it, so every SVG upload was rejected. Fixes both of WordPress's default
  blocks (the `upload_mimes` allowlist and the real-mime sniff that nulls
  out the file type for SVGs specifically), plus a PHP warning
  (`wp_get_missing_image_subsizes()` reading undefined `width`/`height`
  metadata keys that SVGs never had) that could otherwise corrupt the
  upload response on environments with warnings displayed inline. Also
  does basic sanitization on upload (strips `<script>` tags, inline event
  handler attributes, `javascript:` URIs) since SVG can carry executable
  content.

## [2.2.0] - 2026-07-04

### Added
- Settings > Login's "Style login page" and "Login logo" fields now
  actually do something — previously they existed in the UI with no
  implementation behind them at all. Styles `wp-login.php` with a dark
  theme (background, card, inputs, button) and swaps in the configured
  logo image in place of the WordPress logo, linked to the site's home
  URL instead of wordpress.org.

## [2.1.1] - 2026-07-04

### Fixed
- Image fields (Logo, Dark mode logo, Login logo, Admin favicon) now open
  the real WordPress media library picker. `wp_enqueue_media()` was never
  called, so `wp.media` was undefined client-side and every image field
  silently fell back to a plain URL prompt instead.

## [2.1.0] - 2026-07-04

### Added
- Free/paid feature gating: Role Editor, Activity Log, Database Explorer,
  Analytics, White Label, and the remote site switcher are now Pro
  features. Menu Creator, Admin Notices, Comments, Plugins, and the core
  shell/theming stay free. Locked pages show an upgrade prompt instead of
  the real feature; the sidebar shows a lock badge on locked items.
- Real license validation against the `auroraplugins.com` license server
  (validate/activate/deactivate), replacing the earlier placeholder that
  treated any non-empty key as active. Status is cached for 12 hours and
  re-checked immediately on a license-key change. The Settings page shows
  a live status line (active/invalid/unreachable) under the License key
  field.
- File-integrity tamper protection: if the code implementing the license
  gate has been modified, every paid feature re-locks regardless of an
  otherwise-valid license — makes stripping the check out of a
  redistributed copy not actually unlock anything.

### Fixed
- Role Editor's REST endpoint 500'd when hit via the REST API — it called
  `get_editable_roles()`, which WordPress only auto-loads for normal
  wp-admin page requests, not REST requests.