WooCommerce plugin 2.6.2

• All admin AJAX actions (tools, connector and general parameter updates, synchronization, connector deletion, status polling) require the manage_options capability (manage_network_options in Multisite, where connectors, secret keys and logs are shared by the whole network) and a nonce; field updates use POST and only accept known fields and valid values.
• The connector secret key is read from the database when synchronizing and is no longer printed in the page HTML.
• Synchronization result messages are escaped; connector actions use data-connector-id attributes instead of inline JavaScript with the connector code.
• Synchronization analytics are sent with TLS certificate verification, no redirects and bounded timeouts (30 s connection, 60 s total).
• Sales Layer API requests verify the TLS certificate, follow at most 3 redirects (HTTPS only) and have bounded timeouts (30 s connection, 600 s total); non-2xx responses are treated as errors.
• Plugin admin pages and actions in Multisite are restricted to super admins; site administrators no longer see the plugin.
• Log files can no longer be downloaded by URL: the logs/ folder gets index.php and .htaccess, file names include a random suffix (for servers that ignore .htaccess, e.g. nginx) and the logs zip is built in the system temp folder. The downloaded zip keeps the plain file names.
• Downloaded media file names are sanitized and must stay inside the plugin media folder; only file types allowed by WordPress are accepted and images are validated before being stored.
• The product links queue row is inserted with an escaped query.
• Plugin tables are created with the server default storage engine and the WordPress charset/collation instead of forcing ENGINE=MyISAM / utf8.
• Connector table upgrade is non-destructive: missing columns are added with ALTER TABLE instead of dropping, recreating and re-inserting the table.
• The stored plugin version is only updated once every plugin table exists, so a failed upgrade is retried on the next request; database errors during the upgrade are written to the PHP error log. Table checks are skipped once verified for the current version.
• Cron events are scheduled on init (main site only in Multisite, never during uninstall); cron callbacks no longer use sleep() or wp_die(), and auto-sync, legacy items migration and media meta processing use locks to avoid concurrent runs.
• The synchronization queue lock is acquired atomically; a stale process is no longer killed, its lock is taken over.
• The plugin no longer changes display_errors, error_reporting or FS_METHOD for the whole site.
• Uninstalling removes the plugin network options, transients and cron events on every site; plugin tables (and connectors) are kept on purpose.
• Admin assets use WordPress' own jQuery and Dashicons; the bundled jQuery 3.5.0, Bootstrap and the Font Awesome CDN are no longer loaded, and plugin scripts are versioned for cache busting.
• Log files are created with 0666 permissions (instead of 0777) and write failures are reported without PHP warnings.
• Legacy items migration processes items in batches.
• After saving a product or variation, its WooCommerce lookup data (wc_product_meta_lookup) is refreshed, and variable products are synced with their visible variations as WooCommerce does when saving them: the parent price is taken from the variations and its own regular and sale prices are removed. Deleting a variation re-syncs its parent. A variable product left without visible variations is not converted to simple: changing its type (which deletes the variations) is left to the store administrator, so sales data is not lost after an accidental deletion.
• Media files are downloaded with the WordPress HTTP API (60 s timeout) to a temporary file and only replace the current file once validated. Images whose file name has spaces or special characters are downloaded once more after upgrading, with the sanitized name.
• Auto-sync records every attempt per connector, so a connector whose synchronization fails waits for its interval like the rest; due times are calculated in UTC.
• A queue row is only removed when every target site was synchronized; otherwise it is retried (skipping the sites already done) and dropped after 3 attempts with a log entry. PHP errors in a row are caught, so they no longer stop the queue.
• The connector company, languages and last sync date are saved after the first successful API response, and the last update date only once every page has been downloaded.
• With Polylang, the same language can be synchronized on several Multisite sites: one queue row is created per site and language pair.
• Polylang detection is evaluated per site, and plugin queries are not filtered by the admin language filter.
• Connector configuration lost when upgrading from 2.5.x on hosts where MyISAM table creation is disabled (wp_slyr_wc_api_config and wp_slyr_wc_api_multiconn were not created).
• Legacy table migration no longer drops an unprefixed table with data when an empty prefixed table already exists.
• Plugin cron events are removed on deactivation (all sites on network deactivation), avoiding invalid_schedule errors in the debug log.
• Fatal error (get_blog_details()) when validating the language configuration on single-site installations.
• Synchronization of a language variant failed when that category already existed in the same language without Sales Layer data; the existing term is now adopted.
• Connectors page stayed locked (spinner and disabled controls) when an AJAX request failed or timed out; Tools showed no message on errors and allowed double clicks while a tool was running.
• Multisite settings were shown on single-site installations ("0"/"1" flags from wp_localize_script); older message timers could remove newer messages; enabling the page controls re-enabled controls outside the plugin.
• Add connector modal: Enter submits the form and errors are shown inside the modal without losing the typed data; modals and FAQ are keyboard accessible.
• Logs download returned a JSON file as sl_logs.zip on errors; deleting logs reported success when files could not be removed; the PHP zip extension is checked.
• New version notice ignored release tags prefixed with v and non-200 responses; saving an unchanged general parameter showed an error.
• Infinite loop when a parent category has no Sales Layer ID.
• Deleted items processed more than once (progress over 100 %).
• Stock status values such as "Not in stock" or "Sin stock" were set as in stock; disabling stock management without a stock status no longer sets the item out of stock.
• Failed image downloads removed the current product, variation or category images; image size checks after redirects always forced a new download; media lookup is limited to plugin attachments.
• Attribute terms were linked to an unrelated post; custom attributes whose name differs from their slug were removed; product synchronization reset the "Used for variations" flag.
• Multilanguage additional fields were looked up with the full connector language list instead of the row language.
• Field values of a previous queue row (or connector) could leak into the next one; product shipping class and variation stock / shipping class field mappings were ignored.
• The synchronization reported success when items could not be stored, and items dropped after the maximum number of attempts left no trace in the logs.
• A failed queue insert (e.g. a row bigger than max_allowed_packet) lost up to 20 items: rows are now retried one by one and those still failing are logged and reported on screen.
• Queue rows whose target sites all failed were considered synchronized and removed.
• Product links (related, upsell, cross-sell and grouped) were lost when a linked reference contained quotes or backslashes.
• A connector whose synchronization always failed blocked auto-sync for the other connectors; auto-sync due times depended on the MySQL session time zone.
• Sales Layer API errors were reported as "No information to synchronize!" and still updated the connector sync dates; an error on an intermediate page lost the remaining pages.
• Failed remote image reads (non-2xx response or no size) were not logged.
• Running the synchronization with WP-CLI (e.g. wp cron event run) reloaded wp-config.php and raised "Constant … already defined" warnings (an error from PHP 9).
• Synchronized products were missing from (or outdated in) WooCommerce price and stock filters, price sorting and product blocks, because prices and stock were written as meta without updating the product lookup table; variable products kept the Sales Layer product price as their price instead of their variations' prices.
• Legacy mode published adopted draft products and could match variations of another product.
• A grouped product never reverted to simple when its linked products were removed.
• Queue JSON with escaped characters was corrupted when read back.
• Info icon in the Site & Language Configuration modal displayed as garbled characters: style_admin.css now declares charset "UTF-8".
• Typos and wording in admin texts, notices, log messages and documentation; remaining Spanish comments and identifiers translated to English.