OLD BEHAVIOR (broken):
parse_cards processed ALL [card:type] syntax FIRST, then [card type=...]
This caused cards to render out of order when syntaxes were mixed.
NEW BEHAVIOR (fixed):
Using a unified regex that matches BOTH syntaxes simultaneously:
/\[card(?::(\w+)|([^\]]*)?)\](.*?)\[\/card\]/s
Each match includes:
- Group 1: Card type from new syntax [card:type]
- Group 2: Attributes from old syntax [card type='...']
- Group 3: Card content
Cards now render in exact document order regardless of syntax used.
ROOT CAUSE:
Frontend blocksToMarkdown outputs NEW syntax:
- [card:type]...[/card]
- [button:style](url)Text[/button]
But backend EmailRenderer.php only had regex for OLD syntax:
- [card type="..."]...[/card]
- [button url="..."]Text[/button]
FIXES:
1. parse_cards() now handles BOTH syntaxes:
- NEW [card:type] regex first (extracts type from :type)
- OLD [card type="..."] regex for backward compatibility
2. render_card() now handles BOTH button syntaxes:
- NEW [button:style](url)Text[/button] regex
- OLD [button url="..."] regex for backward compatibility
3. Card types properly styled with inline CSS:
- hero: gradient background
- success: green background + border
- info: blue background + border
- warning: yellow background + orange border
4. Buttons rendered with full inline styles + table wrapper
for Gmail/email client compatibility
1. API Route Fix (NotificationsController.php):
- Changed PUT to POST for /templates/:eventId/:channelId
- Frontend was using api.post() but backend only accepted PUT
- Templates can now be saved
2. Contextual Variables (EventRegistry.php):
- Added get_variables_for_event() method
- Returns category-based variables (order, customer, product, etc.)
- Merges event-specific variables from event definition
- Sorted alphabetically for easy browsing
3. API Response (NotificationsController.php):
- Template API now returns available_variables for the event
- Frontend can show only relevant variables
4. Frontend (EditTemplate.tsx):
- Removed hardcoded 50+ variable list
- Now uses template.available_variables from API
- Variables update based on selected event type
1. Temp password for auto-registered users:
- Store password in _woonoow_temp_password user meta (CheckoutController)
- Add {user_temp_password} and {login_url} variables (EmailRenderer)
- Update new_customer email template to show credentials
2. WC page redirects to SPA routes:
- Added redirect_wc_pages_to_spa() in TemplateOverride
- Maps: /shop → /store/#/, /cart → /store/#/cart, etc.
- /checkout → /store/#/checkout, /my-account → /store/#/account
- Single products → /store/#/products/{slug}
3. Removed shortcode system:
- Commented out Shortcodes::init() in Bootstrap
- WC pages now redirect to SPA instead
1. Added missing base variables in get_variables():
- site_name, site_title, store_name
- shop_url, my_account_url
- support_email, current_year
2. Fixed social icon URL path calculation:
- Was using 3x dirname which pointed to 'includes/' not plugin root
- Now uses WOONOOW_URL constant or correct 4x dirname
3. Added px-6 padding to EmailBuilder dialog body
4. Added portal container to Select component for CSS scoping
1. EmailRenderer: Added button parsing with full inline styles
- Buttons now use table-based layout for email client compatibility
- Solid and outline button styles with custom colors from settings
2. DefaultTemplates: Updated new_customer template
- Added 'Set Your Password' button for auto-registered users
- Uses {set_password_url} variable for password reset link
3. EmailRenderer: Added set_password_url variable
- Generates secure password reset link for new customers
- Also added my_account_url and shop_url to customer variables
Problem 1: Admin SPA not loading in production
Root Cause: Vite builds require type='module' attribute on script tags
Solution: Added script_loader_tag filter to add type='module' to admin SPA script
Problem 2: Annoying MailQueue debug logs in console
Solution: Removed all error_log statements from MailQueue class
- Removed init() debug log
- Removed enqueue() debug log
- Removed all sendNow() debug logs (was 10+ lines)
- Kept only essential one-line log after successful send
Changes:
- includes/Admin/Assets.php: Add type='module' to wnw-admin script
- includes/Core/Mail/MailQueue.php: Remove debug logging noise
Result:
✅ Admin SPA now loads with proper ES module support
✅ MailQueue logs removed from console
✅ Email functionality still works (kept minimal logging)
Note: Production zip is 21M (includes .vite manifests and dynamic imports)
Newsletter Fix:
- Move all hooks (useQuery, useMutation) before conditional returns
- Add 'enabled' option to useQuery to control when it fetches
- Fixes React error #310: useEffect called conditionally
- Newsletter page now loads without errors at /marketing/newsletter
Wishlist Module Refactoring:
- Create WishlistSettings.php with 8 configurable settings:
* Enable guest wishlists
* Wishlist page selector
* Show in header toggle
* Enable sharing
* Back in stock notifications
* Max items per wishlist
* Multiple wishlists support
* Show add to cart button
- Add has_settings flag to wishlist module in ModuleRegistry
- Initialize WishlistSettings in woonoow.php
- Update customer-spa BaseLayout to use isEnabled('wishlist') check
- Wishlist page already has module check (no changes needed)
Files Added (1):
- includes/Modules/WishlistSettings.php
Files Modified (5):
- admin-spa/src/routes/Marketing/Newsletter.tsx
- includes/Core/ModuleRegistry.php
- woonoow.php
- customer-spa/src/layouts/BaseLayout.tsx
- admin-spa/dist/app.js (rebuilt)
Both newsletter and wishlist now follow the same module pattern:
- Settings via schema (no code required)
- Module enable/disable controls feature visibility
- Settings page at /settings/modules/{module_id}
- Consistent user experience
- Fix: Marketing events now display in Staff notifications tab
- Reorganize: Move Coupons to Marketing/Coupons for better organization
- Add: Comprehensive email/phone validation with extensible filter hooks
- Email validation with regex pattern (xxxx@xxxx.xx)
- Phone validation with WhatsApp verification support
- Filter hooks for external API integration (QuickEmailVerification, etc.)
- Fix: Newsletter template routes now use centralized notification email builder
- Add: Validation.php class for reusable validation logic
- Add: VALIDATION_HOOKS.md documentation with integration examples
- Add: NEWSLETTER_CAMPAIGN_PLAN.md architecture for future campaign system
- Fix: API delete method call in Newsletter.tsx (delete -> del)
- Remove: Duplicate EmailTemplates.tsx (using notification system instead)
- Update: Newsletter controller to use centralized Validation class
Breaking changes:
- Coupons routes moved from /routes/Coupons to /routes/Marketing/Coupons
- Legacy /coupons routes maintained for backward compatibility
- Created LayoutWrapper component to conditionally render header/footer based on route
- Created MinimalHeader component (logo only)
- Created MinimalFooter component (trust badges + policy links)
- Created usePageVisibility hook to get visibility settings per page
- Wrapped ClassicLayout with LayoutWrapper for conditional rendering
- Header/footer visibility now controlled directly in React SPA
- Settings: show/minimal/hide for both header and footer
- Background color support for checkout and thankyou pages
Implemented: PHP MetaFieldsRegistry for Level 1 Compatibility
Created MetaFieldsRegistry.php:
- register_order_field() - Register order meta fields
- register_product_field() - Register product meta fields
- Auto-add to allowed/updatable meta lists
- Localize to window.WooNooWMetaFields
- Zero coupling with specific plugins
Features:
- Automatic label formatting from meta key
- Support all field types (text, textarea, number, select, date, checkbox)
- Section grouping
- Description and placeholder support
- Auto-registration to API filters
Initialized in Bootstrap.php:
- Added MetaFieldsRegistry::init()
- Triggers woonoow/register_meta_fields action
- Localizes fields to JavaScript
Updated METABOX_COMPAT.md:
- Added complete plugin integration examples
- Shipment Tracking example
- ACF example
- Custom plugin example
- API response examples
- Field types reference
- Marked as COMPLETE
How Plugins Use It:
1. Store data: update_post_meta (standard WooCommerce)
2. Register fields: MetaFieldsRegistry::register_order_field()
3. Fields auto-exposed in API
4. Fields auto-displayed in WooNooW admin
5. Data saved to WooCommerce database
6. Zero migration needed
Result:
- Level 1 compatibility FULLY IMPLEMENTED
- Plugins work automatically
- Zero addon dependencies in core
- Production ready
All 3 Phases Complete:
Phase 1: Backend API (meta exposure/update)
Phase 2: Frontend components (MetaFields/useMetaFields)
Phase 3: PHP registry system (MetaFieldsRegistry)
Status: READY FOR PRODUCTION
Fixed two email rendering issues:
1. Card Success Styling
- Was using hero gradient (purple) instead of green theme
- Now uses proper green background (#f0fdf4) with green border
- Info card: blue theme with border
- Warning card: orange theme with border
- Hero card: keeps gradient as intended
2. List Support Verification
- MarkdownParser already supports bullet lists
- Supports: *, -, •, ✓, ✔ as list markers
- Properly converts to <ul><li> HTML
- Works in both visual editor and email preview
Card Types Now:
- default: white background
- hero: gradient background (purple)
- success: green background with left border
- info: blue background with left border
- warning: orange background with left border
Fixed missing variable dropdown in email template editor.
Problem:
- RichTextEditor component had dropdown functionality
- But variables prop was empty array
- Users had to manually type {variable_name}
Solution:
- Added comprehensive list of 40+ available variables
- Includes order, customer, payment, shipping, URL, store variables
- Variables now show in dropdown for easy insertion
Available Variables:
- Order: order_number, order_total, order_items_table, etc.
- Customer: customer_name, customer_email, customer_phone
- Payment: payment_method, transaction_id, payment_retry_url
- Shipping: tracking_number, tracking_url, shipping_carrier
- URLs: order_url, review_url, shop_url, my_account_url
- Store: site_name, support_email, current_year
Now users can click dropdown and select variables instead of typing them manually.
Added missing order status events that were not showing in admin UI.
New Events Added (Staff + Customer):
- Order On-Hold (awaiting payment)
- Order Failed (payment/processing failed)
- Order Refunded (full refund processed)
- Order Pending (initial order state)
Changes:
1. EventRegistry.php - Added 8 new event definitions
2. DefaultTemplates.php - Added 8 new email templates
3. DefaultTemplates.php - Added subject lines for all new events
Now Available in Admin:
- Staff: 11 order events total
- Customer: 12 events total (including new customer)
All events can be toggled on/off per channel (email/push) in admin UI.
Fixed missing variables: completion_date, order_items_table, payment_date, transaction_id, tracking_number, review_url, shop_url, and more.
Added proper HTML table for order items with styling.
All template variables now properly replaced in emails.
🐛 Three Critical Email Issues Fixed:
1. Newlines Not Working
❌ "Order Number: #359 Order Total: Rp129.000" on same line
✅ Fixed by adding <br> for line continuations in paragraphs
Key change in MarkdownParser.php:
- Accumulate paragraph content with <br> between lines
- Match TypeScript behavior exactly
- Protect variables from markdown parsing
Before:
$paragraph_content = $trimmed;
After:
if ($paragraph_content) {
$paragraph_content .= '<br>' . $trimmed;
} else {
$paragraph_content = $trimmed;
}
2. Hero Card Text Color
❌ Heading black instead of white in Gmail
✅ Add inline color styles to all headings/paragraphs
Problem: Gmail doesn't inherit color from parent
Solution: Add style="color: white;" to each element
$content = preg_replace(
'/<(h[1-6]|p)([^>]*)>/',
'<$1$2 style="color: ' . $hero_text_color . ';">',
$content
);
3. Blue Border on Cards
❌ Unwanted blue border in Gmail (screenshot 2)
✅ Removed borders from .card-info, .card-warning, .card-success
Problem: CSS template had borders
Solution: Removed border declarations
Before:
.card-info { border: 1px solid #0071e3; }
After:
.card-info { background-color: #f0f7ff; }
�� Additional Improvements:
- Variable protection during markdown parsing
- Don't match bold/italic across newlines
- Proper list handling
- Block-level tag detection
- Paragraph accumulation with line breaks
🎯 Result:
- ✅ Proper line breaks in paragraphs
- ✅ White text in hero cards (Gmail compatible)
- ✅ No unwanted borders
- ✅ Variables preserved during parsing
- ✅ Professional email appearance
Test: Create order, check email - should now show:
- Order Number: #359
- Order Total: Rp129.000
- Estimated Delivery: 3-5 business days
(Each on separate line with proper spacing)
🐛 Email Rendering Issues Fixed:
1. Markdown Not Parsed
❌ Raw markdown showing: ## Great news...
✅ Created MarkdownParser.php (PHP port from TypeScript)
✅ Parses headings, bold, italic, lists, links
✅ Supports card blocks and button syntax
✅ Proper newline handling
2. Variables Not Replaced
❌ {support_email} showing literally
✅ Added support_email variable
✅ Added current_year variable
✅ Added estimated_delivery variable (3-5 business days)
3. Broken Logo Image
❌ Broken image placeholder
✅ Fallback to site icon if no logo set
✅ Fallback to text header if no icon
✅ Proper URL handling
4. Newline Issues
❌ Variables on same line
✅ Markdown parser handles newlines correctly
✅ Proper paragraph wrapping
📦 New File:
- includes/Core/Notifications/MarkdownParser.php
- parse() - Convert markdown to HTML
- parse_basics() - Parse standard markdown
- nl2br_email() - Convert newlines for email
🔧 Updated Files:
- EmailRenderer.php
- Use MarkdownParser in render_card()
- Add support_email, current_year variables
- Add estimated_delivery calculation
- Logo fallback to site icon
- Text header fallback if no logo
🎯 Result:
- ✅ Markdown properly rendered
- ✅ All variables replaced
- ✅ Logo displays (or text fallback)
- ✅ Proper line breaks
- ✅ Professional email appearance
📝 Example:
Before: ## Great news, {customer_name}!
After: <h2>Great news, Dwindi Ramadhana!</h2>
Before: {support_email}
After: admin@example.com
Before: Broken image
After: Site icon or store name
🐛 CRITICAL FIX - Root Cause Found:
Problem 1: Events Not Enabled by Default
- is_event_enabled() returned false if not configured
- Required explicit admin configuration
- Plugin didn't work out-of-the-box
Solution:
- Enable email notifications by default if not configured
- Allow plugin to work with default templates
- Users can still disable via admin if needed
Problem 2: Default Templates Not Loading
- EmailRenderer called get_template() with only 2 args
- Missing $recipient_type parameter
- Default template lookup failed
Solution:
- Pass recipient_type to get_template()
- Proper default template lookup
- Added debug logging for template resolution
📝 Changes:
1. EmailManager::is_event_enabled()
- Returns true by default for email channel
- Logs when using default (not configured)
- Respects explicit disable if configured
2. EmailRenderer::get_template_settings()
- Pass recipient_type to TemplateProvider
- Log template found/not found
- Proper default template resolution
🎯 Result:
- Plugin works out-of-the-box
- Default templates used if not customized
- Email notifications sent without configuration
- Users can still customize in admin
✅ Expected Behavior:
1. Install plugin
2. Create order
3. Email sent automatically (default template)
4. Customize templates in admin (optional)
This fixes the issue where check-settings.php showed:
- Email: ✗ NOT CONFIGURED
- Templates: 0
Now it will use defaults and send emails!
🐛 Issue: Action Scheduler completing but wp_mail() never called
🔍 Enhanced Debugging:
- Log sendNow() entry with all arguments
- Log argument type and value
- Handle array vs string arguments (Action Scheduler compatibility)
- Log payload retrieval status
- Log wp_mail() call and result
- Log WooEmailOverride disable/enable
- Check database for option existence if not found
- Log hook registration on init
📝 Debug Output:
[WooNooW MailQueue] Hook registered
[WooNooW MailQueue] sendNow() called with args
[WooNooW MailQueue] email_id type: string/array
[WooNooW MailQueue] email_id value: xxx
[WooNooW MailQueue] Processing email_id: xxx
[WooNooW MailQueue] Payload retrieved - To: xxx, Subject: xxx
[WooNooW MailQueue] Disabling WooEmailOverride
[WooNooW MailQueue] Calling wp_mail() now...
[WooNooW MailQueue] wp_mail() returned: TRUE/FALSE
[WooNooW MailQueue] Re-enabling WooEmailOverride
[WooNooW MailQueue] Sent and deleted email ID
🎯 This will reveal:
1. If sendNow() is being called at all
2. What arguments Action Scheduler is passing
3. If payload is found in wp_options
4. If wp_mail() is actually called
5. If wp_mail() succeeds or fails
## Implemented (Tasks 1-6):
### 1. All Social Platforms Added ✅
**Platforms:**
- Facebook, X (Twitter), Instagram
- LinkedIn, YouTube
- Discord, Spotify, Telegram
- WhatsApp, Threads, Website
**Frontend:** Updated select dropdown with all platforms
**Backend:** Added to allowed_platforms whitelist
### 2. PNG Icons Instead of Emoji ✅
- Use local PNG files from `/assets/icons/`
- Format: `mage--{platform}-{color}.png`
- Applied to email rendering and preview
- Much more accurate than emoji
### 3. Icon Color Option (Black/White) ✅
- New setting: `social_icon_color`
- Select dropdown: White Icons / Black Icons
- White for dark backgrounds
- Black for light backgrounds
- Applied to all social icons
### 4. Body Background Color Setting ✅
- New setting: `body_bg_color`
- Color picker + hex input
- Default: #f8f8f8
- Applied to email body background
- Applied to preview
### 5. Editor Mode Styling 📝
**Note:** Editor mode intentionally shows structure/content
Preview mode shows final styled result with all customizations
This is standard email builder UX pattern
### 6. Hero Preview Text Color Fixed ✅
- Applied `hero_text_color` directly to h3 and p
- Now correctly shows selected color
- Both heading and paragraph use custom color
## Technical Changes:
**Frontend:**
- Added body_bg_color and social_icon_color to interface
- Updated all social platform icons (Lucide)
- PNG icon URLs in preview
- Hero preview color fix
**Backend:**
- Added body_bg_color and social_icon_color to defaults
- Sanitization for new fields
- Updated allowed_platforms array
- PNG icon URL generation with color param
**Email Rendering:**
- Use PNG icons with color selection
- Apply body_bg_color
- get_social_icon_url() updated for PNG files
## Files Modified:
- `routes/Settings/Notifications/EmailCustomization.tsx`
- `routes/Settings/Notifications/EditTemplate.tsx`
- `includes/Api/NotificationsController.php`
- `includes/Core/Notifications/EmailRenderer.php`
Task 7 (default email content) pending - separate commit.
## 4. Wire to Backend ✅
### API Endpoints Created:
- `GET /woonoow/v1/notifications/email-settings` - Fetch settings
- `POST /woonoow/v1/notifications/email-settings` - Save settings
- `DELETE /woonoow/v1/notifications/email-settings` - Reset to defaults
### Features:
- Proper sanitization (sanitize_hex_color, esc_url_raw, etc.)
- Social links validation (allowed platforms only)
- Defaults fallback
- Stored in wp_options as `woonoow_email_settings`
### Email Rendering Integration:
**Logo & Header:**
- Uses logo_url if set, otherwise header_text
- Falls back to store name
**Footer:**
- Uses footer_text with {current_year} support
- Replaces {current_year} with actual year dynamically
- Social icons rendered from social_links array
**Hero Cards:**
- Applies hero_gradient_start and hero_gradient_end
- Applies hero_text_color to text and headings
- Works for type="hero" and type="success" cards
**Button Colors:**
- Ready to apply primary_color and button_text_color
- (Template needs update for dynamic button colors)
### Files:
- `includes/Api/NotificationsController.php` - API endpoints
- `includes/Core/Notifications/EmailRenderer.php` - Apply settings to emails
### Security:
- Permission checks (check_permission)
- Input sanitization
- URL validation
- Platform whitelist for social links
Frontend can now save/load settings! Backend applies them to emails! 🎉
## ✅ Issue 1: WordPress Media Not Loading
**Problem:** WP media library not loaded error
**Solution:**
- Added fallback to URL prompt
- Better error handling
- User can still insert images if WP media fails
## ✅ Issue 2: Button Variables Filter
**Problem:** All variables shown in button link field
**Solution:**
- Filter to only show URL variables
- Applied to both RichTextEditor and EmailBuilder
- Only `*_url` variables displayed
**Before:** {order_number} {customer_name} {order_total} ...
**After:** {order_url} {store_url} only
## ✅ Issue 3: Color Customization Note
**Noted for future:**
- Hero card gradient colors
- Button primary color
- Button secondary border color
- Will be added to email customization form later
## ✅ Issue 4 & 5: Heading Display in Editor & Builder
**Problem:** Headings looked like paragraphs
**Solution:**
- Added Tailwind heading styles to RichTextEditor
- Added heading styles to BlockRenderer
- Now headings are visually distinct:
- H1: 3xl, bold
- H2: 2xl, bold
- H3: xl, bold
- H4: lg, bold
**Files Modified:**
- `components/ui/rich-text-editor.tsx`
- `components/EmailBuilder/BlockRenderer.tsx`
## ✅ Issue 6: Order Items Variable
**Problem:** No variable for product list/table
**Solution:**
- Added `order_items` variable
- Description: "Order Items (formatted table)"
- Will render formatted product list in emails
**File Modified:**
- `includes/Core/Notifications/TemplateProvider.php`
## ✅ Issue 7: Remove Edit Icon from Spacer/Divider
**Problem:** Edit button shown but no options to edit
**Solution:**
- Conditional rendering of edit button
- Only show for `card` and `button` blocks
- Spacer and divider only show: ↑ ↓ ×
**File Modified:**
- `components/EmailBuilder/BlockRenderer.tsx`
---
## 📋 Summary
All user feedback addressed:
1. ✅ WP Media fallback
2. ✅ Button variables filtered
3. ✅ Color customization noted
4. ✅ Headings visible in editor
5. ✅ Headings visible in builder
6. ✅ Order items variable added
7. ✅ Edit icon removed from spacer/divider
Ready for testing! ��
## ✅ Issue #4: WooCommerce Template Integration
**TemplateProvider.php:**
- ✅ Added `get_wc_email_template()` method
- ✅ Loads actual WooCommerce email subjects
- ✅ Falls back to custom defaults if WC not available
- ✅ Maps WooNooW events to WC email classes:
- order_placed → WC_Email_New_Order
- order_processing → WC_Email_Customer_Processing_Order
- order_completed → WC_Email_Customer_Completed_Order
- order_cancelled → WC_Email_Cancelled_Order
- order_refunded → WC_Email_Customer_Refunded_Order
- new_customer → WC_Email_Customer_New_Account
- customer_note → WC_Email_Customer_Note
### How It Works
1. On template load, checks if WooCommerce is active
2. Loads WC email objects via `WC()->mailer()->get_emails()`
3. Extracts subject, heading, enabled status
4. Uses WC subject as default, falls back to custom if not available
5. Body remains custom (WC templates are HTML, we use plain text)
### Benefits
- ✅ Consistent with WooCommerce email settings
- ✅ Respects store owner customizations
- ✅ Automatic updates when WC emails change
- ✅ Graceful fallback if WC not available
---
**Result:** Templates now load from WooCommerce! 🎉
## ✅ Issue 1: Standalone Mode Navigation
**Problem:** Standalone mode not getting WNW_NAV_TREE from PHP
**Fixed:** Added WNW_NAV_TREE injection to StandaloneAdmin.php
**Result:** Navigation now works in standalone mode with PHP as single source
## ✅ Issue 2: 404 Errors for branding and customer-settings
**Problem:** REST URLs had trailing slashes causing double slashes
**Root Cause:**
- `rest_url("woonoow/v1")` returns `https://site.com/wp-json/woonoow/v1/`
- Frontend: `restUrl + "/store/branding"` = double slash
- WP-admin missing WNW_CONFIG entirely
**Fixed:**
1. **Removed trailing slashes** from all REST URLs using `untrailingslashit()`
- StandaloneAdmin.php
- Assets.php (dev and prod modes)
2. **Added WNW_CONFIG to wp-admin** for API compatibility
- Dev mode: Added WNW_CONFIG with restUrl, nonce, standaloneMode, etc.
- Prod mode: Added WNW_CONFIG to localize_runtime()
- Now both modes use same config structure
**Result:**
- ✅ `/store/branding` works in all modes
- ✅ `/store/customer-settings` works in all modes
- ✅ Consistent API access across standalone and wp-admin
## ✅ Issue 3: SVG Upload Error 500
**Problem:** WordPress blocks SVG uploads by default
**Security:** "Sorry, you are not allowed to upload this file type"
**Fixed:** Created MediaUpload.php with:
1. **Allow SVG uploads** for users with upload_files capability
2. **Fix SVG mime type detection** (WordPress issue)
3. **Sanitize SVG on upload** - reject files with:
- `<script>` tags
- `javascript:` protocols
- Event handlers (onclick, onload, etc.)
**Result:**
- ✅ SVG uploads work securely
- ✅ Dangerous SVG content blocked
- ✅ Only authorized users can upload
---
## Files Modified:
- `StandaloneAdmin.php` - Add nav tree + fix REST URL
- `Assets.php` - Add WNW_CONFIG + fix REST URLs
- `Bootstrap.php` - Initialize MediaUpload
- `MediaUpload.php` - NEW: SVG upload support with security
## Testing:
1. ✅ Navigation works in standalone mode
2. ✅ Branding endpoint works in all modes
3. ✅ Customer settings endpoint works in all modes
4. ✅ SVG logo upload works
5. ✅ Dangerous SVG files rejected
