<?xml version="1.0" encoding="UTF-8"?>
<changelogs>
  <changelog>
    <element>unilogin</element>
    <type>plugin</type>
    <version>1.2</version>
    <change>
      <item>Native password verification via UserHelper — nested Authentication - Joomla plugin instantiation removed</item>
      <item>Joomla 5 AuthenticationEvent / PrepareFormEvent signatures</item>
      <item>Bound SQL queries for email and username lookups</item>
      <item>Timing-safe handling on unknown users (dummy password hash)</item>
      <item>stopPropagation on successful authentication</item>
      <item>Language packs (en-GB) for plugin strings and admin labels</item>
      <item>Username Fallback defaults to ON</item>
      <item>Failed-attempt cleanup after successful login</item>
      <item>Relative redirect paths work correctly (host-less URLs no longer dropped by Uri::isInternal)</item>
      <item>Installer table creation hardened; PHP 8.1+ recommended</item>
      <item>JoomlaX branding, copyright 2026, XML target 5.0</item>
    </change>
  </changelog>
  <changelog>
    <element>unilogin</element>
    <type>plugin</type>
    <version>1.1</version>
    <security>
      <item>Enhanced security with IP-based lockout, input validation, and SQL injection prevention</item>
      <item>Improved code quality with enhanced documentation, type hints, and security practices</item>
    </security>
    <fix>
      <item>Fixed domain extraction issues for invalid email formats</item>
      <item>Fixed form field modification to use proper Joomla setFieldAttribute() method</item>
      <item>Fixed redirect URL validation and formatting</item>
    </fix>
    <addition>
      <item>Added username fallback option to allow users to login with either email or username</item>
    </addition>
    <change>
      <item>Full Joomla 4, 5, and 6 compatibility with modern APIs and best practices</item>
      <item>Custom login field label and placeholder customization for better user experience</item>
      <item>Comprehensive rate limiting and brute force protection with configurable attempts and lockout duration</item>
      <item>Complete login logging system with automatic cleanup based on retention period</item>
      <item>Email domain restrictions with whitelist and blacklist modes</item>
      <item>User group restrictions to control which groups can use email login</item>
      <item>Customizable error messages for all authentication errors (user not found, invalid password, account locked, domain blocked)</item>
      <item>Smart redirect system with default redirect URL and group-specific redirect rules using subform</item>
      <item>Reorganized plugin parameters into logical fieldsets with conditional field display</item>
      <item>Improved UI with switcher layout for radio buttons and user-friendly subform interface</item>
      <item>Enhanced error handling with proper exception catching and graceful degradation</item>
      <item>New database table #__unilogin_attempts for login attempt logging</item>
    </change>
  </changelog>
  <changelog>
    <element>unilogin</element>
    <type>plugin</type>
    <version>1.0</version>
    <change>
      <item>Basic email login functionality</item>
      <item>Integration with Joomla authentication system</item>
      <item>Joomla 4 and 5 compatibility</item>
    </change>
  </changelog>
</changelogs>
