Bagisto

:bug: Bug Fixings

• Security fixes.

• "Apply Tax On" setting (Before/After Discount) under Sales → Taxes → Calculation Settings to control whether tax is calculated on the original product price or on the discounted price when a cart-rule/coupon discount is applied, plus an optional per-product tax breakdown in the cart and checkout summary.

• #11344 - Fixed incorrect payment amounts for currencies whose ISO 4217 minor units are not two decimals in the Stripe and PayPal gateways. Currencies are now seeded with a decimal value (e.g. 0 for JPY/KRW, 3 for KWD/BHD, 2 by default); Stripe converts amounts to the smallest currency unit using 10 ^ decimal instead of a hardcoded × 100, and PayPal rounds to the currency's decimal places, preventing 100× overcharges on zero-decimal currencies and undercharges on three-decimal currencies.

• #11331 - Replaced deprecated Venezuelan Bolivar currency code VEF with VES in seeders and installer configurations, ensuring correct exchange rate synchronization with modern exchange rate APIs.

• #11316 - Fixed the rich-text (TinyMCE) sanitizer stripping tables and class/style attributes from product/category descriptions, CMS pages, and email templates on save, so tables and formatting inserted in the editor no longer disappear. The HTMLPurifier allowlist now permits table elements and class/style (with an expanded set of safe CSS properties) while still removing scripts, event handlers, javascript:/data: URLs, and unsafe CSS. Also fixed theme static-content custom CSS being corrupted by the HTML purifier — valid selectors such as the > child combinator were entity-encoded — by sanitizing it against </style> context breakout instead of running it through the HTML purifier.

• #10963 - Fixed a required multiselect attribute on the product edit page failing validation on save until the field was manually re-interacted with, because the previously saved values were not registered with the form validator on page load.