v2.0.1
This release is a security hardening pass, run before packaging rather than in response to a reported problem.
The admin page now refuses to run unless IS_ADMIN_FLAG is set. When reached normally, as admin/index.php?cmd=eventz, the bootstrap has already defined it, so the check costs nothing. It matters because the zc_plugins folder remains web-accessible wherever the shipped .htaccess isn't honored, including nginx, which reads none at all, and Apache running under AllowOverride None. On those setups, a direct request for the file previously produced a fatal error that disclosed the full server path.
The language directory used to build the fallback language-file include path is now restricted to a plain directory name; otherwise, it falls back to English. Zen Cart validates that value before this point, so it was not exploitable as shipped, but it was still a variable on the include path.
Clicking an event in the scrolling sidebox now offsets its jump so the event heading is not hidden beneath a fixed or sticky navbar, such as the one in ZCA Bootstrap.
The readme now ships inside the plugin folder along with its screenshots, and its changelog link points to the right place.
Upgrading from v2.0.0 reconciles an existing installation rather than assuming its state. The active column is added if missing, the retired Sidebox Display Mode setting is removed, and the admin menu entry is re-registered so it appears under Extras, even if it was previously under Catalog.
Need a hand with Zen Cart? Hire the team at myZenCartZone.com for upgrades, repairs, and custom plugins.
Zen Cart Certified hosting at myZenCartHost.com