# Changelog

## [1.0.3] - 2026-04-25
### Added
- **Premium Demo Hub**: Re-engineered the entire `/demo` directory with a "Unique Dynamic Premium SaaS Aviation" theme.
- **AirTag Self-Service**: Passengers can now update their personal tracker (AirTag/SmartTag) links directly from the `manage.php` portal.
- **Enhanced Data Payloads**: Report submission emails now include PNR, Ticket, Phone, and direct Tracker URLs for both staff and passengers.
- **Seeding Dashboard**: Completely redesigned `seed_demo.php` with a sleek glassmorphic UI.

### Fixed
- **Staff Portal**: Resolved text wrapping issues for long names and bag tags to maintain single-line layout integrity.
- **Index UI**: Standardized button hover states across all primary interactive cards for consistent UX.
- **Reporting**: Guaranteed automatic HTML report reconstruction when passenger tracker links are updated.

[1.0.3]: 2026-04-25
 
+## [1.0.2] - 2026-04-25
+### Security
+- **XSS Patch**: Enforced `htmlspecialchars` on all dynamic error messages in `admin.php` and `staffportal.php`.
+- **Injection Prevention**: Hardened `install.php` with regex validation for database names to prevent directory traversal and injection.
+- **Public Hardening**: Removed legacy `.htaccess` from `uploads/` directory to prevent potential configuration overrides.
+
+### Fixed
+- **WorldTracer®**: Enhanced `parseFlightString` regex to support modern UTF-8 arrow characters and more flexible whitespace.
+- **Resource Management**: Fixed cURL resource leak in API class by correctly closing handles after execution.
+
 ## [1.0.1] - 2026-04-23
### Fixed
- **Critical**: Resolved Proof of Delivery (PoD) data loss during report regeneration by implementing a robust container-based HTML scraper.
- **Compatibility**: Standardized all image storage to JPEG format to ensure 100% compatibility with Dompdf PDF engine and legacy browsers.
- **Directory Handling**: Implemented automated creation and securing of `uploads/reports` and `uploads/pod` directories.

### Added
- **Automated Notifications**: Automated delivery confirmation emails for both staff and passengers.
- **Admin Configuration**: New toggles in Admin Panel for managing delivery notification alerts.
- **PoD Reporting**: Integrated delivery confirmation details (timestamp, recipient, driver photo) directly into the generated PIR reports.

## [1.0.0] - 2026-04-09
### Added
- **track.php**: Split into two dedicated search cards on a single page — **Lost Baggage** (Rose theme) and **Cabin Lost Item** (Indigo theme). Each card has its own form, route params (`?type=bag` / `?type=cabin`), and result view. No new files created.
- **manage.php (login)**: Added missing `#navbar` CSS block so the navigation renders as a proper fixed, glassmorphic top bar matching all other portals.
- **All portals**: Language switcher (EN/DE/ES/NO) now always visible (not hidden on mobile), consistent with `index.php` reference.

### Fixed
- **manage.php (login)**: Body `pt-20` corrected to `pt-[68px]` to exactly match the fixed navbar height.
- **manage.php (login)**: Theme `transition` properties added to `body` so mode switching animates smoothly.
- **manage.php (dashboard)**: Logo gradient changed from Indigo to Rose to match all other portals.
- **manage.php (dashboard)**: Body classes updated to `bg-slate-50 dark:bg-[#0a0d16]` for full adaptive dark mode.
- **track.php navbar**: Corrected malformed div nesting in lang-switcher / theme-toggle area.
- **All portals**: Desktop nav pill unified to `bg-slate-100/60 dark:bg-white/5` matching `index.php`.

### Theme
- Dark mode bg colour unified to `#0a0d16` across index, track, and manage portals.
- `manage_theme` and `track_theme` localStorage keys confirmed independent (no cross-portal bleed).

## [1.4.0-pre] - 2026-04-08
### Fixed
- **Critical**: Fatal null dereference in `manage.php` — BDO Priority Logic executed before `if (!$report)` guard.
- **Critical**: Null dereference crash in `NearestAirportFinder::resolvePassengerAirport()` when `geocodeZip()` returns null (both ZIP and city paths).
- **Critical**: SQL reserved word collision — `WHERE key = 'worldtracer_api_key'` fails on strict MySQL 8+. Fixed to backtick-quote `key`.
- **Logic**: Operator precedence bug in `purgeOldData` L&F row count string — added parentheses around addition.
- **Logic**: Missing `$addr['name']` key in `createDPDLabel` receiver — now correctly uses `full_name`/`first_name + last_name`.
- **Security**: Replaced raw `exec()` string interpolation with prepared statement in task purge SQL.
- **Schema**: Wrapped bare `ALTER TABLE` migration call in try/catch to prevent fatal on older MySQL.
- **Email**: Removed duplicate "We will notify you immediately" sentence in `unmatchItems` passenger email.

## [1.3.0] - 2026-04-07
### Fixed
- **Sync**: Resolved BDO Deletion UI desynchronization; implemented automatic reload with tab state restoration.
- **Critical**: Resolved data loss in generated HTML/PDF reports after passenger edits by strengthening regex-based data extraction logic.
- **API**: Expanded `updatePassengerDetails` to correctly manage `flights` and `bag_tags` persistence.

## [1.2.0] - 2026-04-07
### Added
- Restore "Manage Report" (Secure Portal) links to all passenger status update emails.
- Added color-coded Delivery Channel banners to Passenger Portal.
- Integrated `WorldTracerAPI` into core API for real-time reference updates.

### Fixed
- **Critical**: Resolved address synchronization regression where temporary stay details were not persisting to the database.
- **Critical**: Fixed manual WorldTracer Reference edit "Action Error" caused by missing file inclusion.
- **UI**: Redesigned Passenger Portal (`manage.php`) for a more premium, high-density, single-column aesthetic.
- Fixed duplicate imports in `api.php`.

### Optimized
- Streamlined `updatePassengerSelf` API logic for better security and field validation.

## [1.1.0] - 2026-04-06
### Added
- International Routing Engine (Always Rush for non-local countries).
- Ground Partner Assignment standardize logic.
- Baggage inventory recovery system.

## [1.0.0] - 2026-04-01
- Initial Release of GSRM Baggage Recovery Network.
