Tahhan Conflict Detective

2.6.5

• Fix: Safe_Mode::ajax_toggle_plugin() — hardcoded ‘Forbidden’ string now translatable via __().
• Fix: Dashboard::ajax_clear_log() — missing return after error response when log file does not exist.
• Fix: Dashboard::ajax_clear_log() — missing return after error response when put_contents() fails.
• Fix: Cron_Monitor::ajax_run_cron_event() — missing return after error response for unknown-hook validation; run_event() would execute despite the error already being sent.

2.6.4

• Fix: cd_ajax_log.created_at schema now includes DEFAULT CURRENT_TIMESTAMP — prevents INSERT failure under MySQL strict mode.
• Fix: cd_conflicts.changed_at schema changed to DEFAULT NULL — prevents INSERT failure if the column is omitted in strict mode.
• Fix: drop_tables() now also deletes the tahcd_main_table_exists transient on uninstall — no orphaned wp_options row.
• Fix: tables_exist() now checks both cd_plugin_changes (v1) and cd_ajax_log (v3) — a partial install is correctly detected.
• Fix: Health_Scan::run() checks $wpdb->insert() return value and sets db_error flag in result on failure.
• Fix: Health_Scan::run() scanned_at in the returned array now uses the same UTC timestamp stored in the database — was returning local time while the DB row held UTC.
• Fix: scan_theme() guards get_site_transient('update_themes') with is_object() before property access.
• Fix: scan_server() guards get_site_transient('update_core') with is_object() before property access.
• Fix: Change_History::get_recent() returns an empty array on DB error instead of propagating null (which violated the declared array return type).
• Fix: Change_History::on_update() option key for previous-version tracking now uses md5() instead of sanitize_key() — sanitize_key() strips / and ., causing path collisions between plugins with similar names.
• Fix: Change_History::write() now returns bool so callers can check whether the DB insert succeeded.
• Fix: Change_History::on_update() only advances the previous-version baseline (update_option) when the audit-log write actually succeeded.

2.6.3

• Fix: get_site_transient('update_plugins') return value guarded with is_object() before property access — prevents PHP 8.x warning on fresh installs.
• Fix: WP_Filesystem() return value checked before calling put_contents() — prevents fatal on FTP/SSH filesystem environments.
• Fix: AJAX log timestamps stored as UTC (current_time('mysql', true)) instead of local WordPress time — fixes time-correlation bugs on non-UTC sites.
• Fix: verify_token() result cached with a static variable — prevents a duplicate DB query per request when Safe Mode is active.
• Fix: on_delete hook now correctly reads plugin data before deletion (fires on delete_plugin, not deleted_plugin).
• Fix: read_plugin_data() validates path stays within WP_PLUGIN_DIR via realpath() — path-traversal hardening.
• Fix: get_plugins() cached with a static variable in attribute_to_plugin() — eliminates N+1 calls when attributing log entries.
• Fix: strtotime() return value validated in score_plugin() — avoids incorrect confidence scores from invalid timestamps.
• Fix: usort comparator in Wizard timeline uses <=> instead of integer subtraction — prevents overflow on 32-bit PHP.
• Fix: Plugin name in Wizard advice string escaped with esc_html() before interpolation.
• Fix: str_replace('.php', …) in Interaction Map now only removes the trailing extension, not mid-name occurrences.
• Fix: Missing return after wp_send_json_error() added to all AJAX capability-check guards.
• Fix: Hard-coded ‘Forbidden’, ‘Invalid plugin.’, ‘Unknown plugin.’ strings now passed through __().
• Fix: Cron Monitor display key access guarded with isset().
• Fix: SHOW TABLES query in maybe_upgrade() cached with a 1-hour transient — eliminates a raw DB query on every page load.
• Fix: Multisite uninstall now iterates all sub-sites via switch_to_blog() / restore_current_blog().
• Fix: $ajax_start static property reset to null after logging to prevent duplicate entries.

2.6.2

• Security: plugin path in Safe Mode now validated with plugin_basename() to prevent path traversal.
• Security: AJAX monitor now reads from $_POST instead of $_REQUEST.
• Fix: all early-exit AJAX error responses now include return for clarity.
• Fix: filemtime() calls for CSS/JS assets now guarded with file_exists().
• Fix: Change History table uses null-coalescing guards on DB result properties.
• Fix: strtok() replaced with stateless explode() in Error Log file attribution.
• Fix: Health Scan issue count now guards against non-array scan section returns.
• Code: Wizard symptom labels moved to a symptoms() method so they are translatable.
• Code: Hardcoded “Plugin:” label in Error Log Viewer is now translatable.

2.6.1

• Updated: Tested up to WordPress 7.0.

2.6.0

• New: Performance Monitor tab — tracks per-plugin load time, memory delta, and DB query count during page load; color-coded Fast / Slow / Heavy badges; Refresh Data button.
• New: Cron Monitor tab — lists all scheduled WP-Cron events with next run time and overdue detection; “Run Now” button per event; overdue count summary badge at top.
• New: AJAX / REST Monitor tab — logs slow AJAX and REST API calls (>500 ms) to a dedicated DB table; filter bar for All / AJAX / REST / Slow views.
• New: Plugin Interaction Map tab — visualises plugin dependency clusters (WooCommerce, Elementor, Yoast, Jetpack, ACF, etc.) and standalone plugins with active/inactive state.
• Security: cron “Run Now” AJAX handler now validates the hook against the live WP-Cron schedule before execution.
• Security: AJAX monitor REST timing now reads from $_SERVER directly (was using non-standard $GLOBALS['_SERVER']).
• Security: AJAX log get_entries() now selects only required columns instead of SELECT *.
• DB: new {prefix}cd_ajax_log table (schema version 3).