BuddyPilot Withdrawal (Easy Returns)

Changelog

1.0.8

• Feature: Withdrawal information page is now created as native WordPress blocks, allowing the operator to freely edit the legal wording directly in the block editor.
• Feature: New [buddypilot_withdrawal_info_block] shortcode renders the dynamic sections (trader contact details, return address, CTA button) independently so they always reflect current settings, even after manual edits to the surrounding text.
• Feature: New “Overwrite information page content” button in WooCommerce > Settings > Withdrawal > Customer refreshes the page with the latest model notice wording at any time.
• Fixed: Orders imported via the WooCommerce REST API (e.g. BaseLinker) were being re-imported in a loop because the plugin was writing unnecessary consent meta to every new order. The plugin no longer writes any meta to API-created orders that contain no digital items.

1.0.7

• Improved: Delivery tracking now uses a dedicated database table instead of order meta, preventing third-party order-sync integrations (e.g. BaseLinker) from re-importing orders on every delivery status update.
• Improved: Confirmation screen now reads the configured withdrawal period dynamically instead of using a hardcoded value.
• Improved: Rate limiting is now handled with a single atomic database operation.
• Improved: Reduced database queries on the withdrawals list page.
• Fixed: Several coding standards issues and minor security hardening.

1.0.6

• Feature: guest (non-logged-in) customers can now submit a withdrawal declaration directly from a dedicated form page. After entering their order number and billing email, a secure one-time magic-link is sent to the billing address; clicking it opens the full interactive withdrawal form with no account required.
• Feature: new [buddypilot_withdrawal_guest_form] shortcode for the guest withdrawal form page. The page and shortcode can be created with a single click from WooCommerce > Settings > Withdrawal > Customer.
• Feature: [buddypilot_withdrawal_information] shortcode now shows an optional “Submit withdrawal form online” call-to-action button linking to the guest form page when the form page is configured. Existing information pages are not modified.
• Feature: new “Withdrawal form access link (guest)” transactional email containing the magic-link; configurable under WooCommerce > Settings > Emails.

1.0.5

• Plugin renamed to BuddyPilot Withdrawal (Easy Returns) for better discoverability.
• Added full translations for all 24 EU official languages: bg, cs, da, de (de_DE, de_AT, de_CH), el, es, et, fi, fr (fr_FR, fr_BE, fr_CH), ga, hr, hu, it, lt, lv, mt, nl (nl_NL, nl_BE), pl, pt, ro, sk, sl, sv.
• Translation quality: all 24 EU language files audited across three rounds; legal terminology verified against official national gazettes (EU Directive 2011/83/EU Annex I), diacritical marks restored, formal register enforced throughout, plural forms corrected, and internal consistency improved.

1.0.4

• Feature: fractional product quantities are now detected and reported in the withdrawal declaration. Full handling of fractional quantities (correct proration, refund calculation) is available in BuddyPilot Withdrawal Pro.
• Feature: added “Upgrade to Pro” action link in the Plugins list, shown only when the Pro version is not active.

1.0.3

• Tested and confirmed compatible with WordPress 7.0.
• Security: nonce is now verified before consuming a rate-limit slot, preventing CSRF probes from exhausting a user’s hourly budget.
• Security: anonymous (guest) rate-limit buckets are now scoped per hashed IP instead of a shared user_id=0 bucket.
• Security: sealed_map and GET presealed IDs are validated against the order before use, preventing crafted requests from attaching sealed confirmations to ordinary items.
• Security: apply_filters('buddypilot_withdrawal_declaration_items_payload') output is re-validated: entries with item_id=0, negative quantities or non-array values are stripped.
• Security: PermissionChecker now explicitly blocks user_id=0 regardless of order customer_id.
• Security: OperatorRegistration checks EXCLUDED_STATUSES at handler entry and flushes the permission cache after order save.
• Security: DeclarationRepository validates filing_date format and rejects zero-date strings.
• Security: RateLimit::tally() returns PHP_INT_MAX when the rate-limit table is missing, preventing the limiter from silently becoming a no-op.
• Fix: round(qty, 10) in get_declared_quantities() prevents IEEE-754 epsilon accumulation on fractional product quantities.
• Fix: removed spurious user_register hook from Privacy Manager; only woocommerce_created_customer is used.

1.0.2

• Code: renamed all short bpw_ / bpw- identifiers to the full buddypilot_withdrawal_ / buddypilot-withdrawal- prefix throughout — affects AJAX/admin-post action names, script handles, localized JS object, metabox ID, WooCommerce field type, nonce field names, lock keys and GET parameters. Resolves WordPress.org unique-prefix review requirement.

1.0.1

• Security: all admin and AJAX request handlers now verify user permissions before nonce verification, consistent with WordPress security guidelines.
• Security: the AJAX path in the operator registration handler now uses check_ajax_referer() instead of check_admin_referer(), returning a proper AJAX error response on nonce failure.
• Security: added current_user_can() gate to the admin notice handler for info-page creation status.
• Security: currency symbol and separator values from localized price format data are now escaped on the JavaScript side before insertion into the DOM.
• Code: moved inline JavaScript from the operator registration template to an enqueued file (assets/js/admin/operator-registration.js); strings passed via wp_localize_script().
• Code: removed load_plugin_textdomain() call; WordPress 4.6 and later loads translations automatically for plugins hosted on WordPress.org.

1.0.0

• First stable release. Full implementation of the Article 11a withdrawal function: two-step form, guest verification, operator manual registration, declarations admin list, configurable period and delivered statuses, Article 16(m) consent capture, Annex I(A)/(B) page generator, customer and admin emails, My Account withdrawal history, HPOS support, GDPR hooks, WCAG 2.2 AA compliance, Polish and English translations.