IT-Services Mertineit – Shop Connector for Papierkram

변경이력

1.0.13

• Removed non-essential comments from the production PHP, JavaScript and CSS files; no functional behavior was changed by this cleanup.
• Streamlined the public documentation and changelog to keep them focused on user-facing release information.
• Corrected the documented WooCommerce log source to itsmpc-papierkram-connector.
• Improved consistency between the public README, changelog and WordPress.org readme and corrected the published release history.

1.0.12

• Improved Papierkram contact handling: when a matched contact’s billing address has changed, the previous address is now archived with a date in the contact’s Papierkram notes field before the new address is saved, so existing customer data is never silently lost. An order note documents the update; an uncertain contact match (no longer confirmed) is now also recorded as an order note before falling back to search or creation.
• Batched the one-time legacy mpc_-prefix migration for orders and users instead of loading them without limit, removing a documented scaling risk for stores with a large historical order or user base; behavior remains fully idempotent.
• Distinguished “product deleted” from “SKU missing” when an order cannot be transferred: a deleted product no longer suggests adding a SKU that cannot be added. The order meta box now shows a proactive hint with a direct product-edit link for affected items before an authorized order editor attempts the transfer.
• Added a persistent connection/system status section to the settings page: result and time of the last manual connection test, time of the last successful invoice transfer, and the active order storage mode (HPOS or Classic). No additional API calls are made on page load; a failed test never overwrites the last successful transfer time.
• Made the settings-page product cards adopt the native WordPress admin card/description styling instead of fixed colors, so they blend into any admin color scheme.
• Added an optional, dismissible notice pointing to the Pro edition on the plugin’s own and on relevant WooCommerce pages only. It is visible immediately, stays hidden for 7 days after being dismissed once, for 14 days after being dismissed a second time, and disappears permanently after being dismissed a third time (tracked per WordPress user, no tracking or external requests).

1.0.10

• Added information about Shop Connector for Papierkram Pro and Product Sync for Papierkram to the plugin settings, shown directly after the introductory text, before the settings fields.

1.0.8

• Unified GPL-2.0-or-later license identification across the plugin header, readme.txt and README.md.
• Added the complete, unmodified GNU General Public License v2 text as LICENSE in the plugin root.
• Added copyright attribution for IT-Services Manuel Mertineit.
• No functional changes.

1.0.7

• Verify every field of the independent recovery record (order ID, attempt ID, status, remote ID, timestamp) strictly by type and canonical value when reading it back; tampered stored values such as “123abc” are no longer accepted via a lossy integer cast.
• Treat a failed removal of the recovery record as a controlled persistence error in every code path: the normal invoice-success path and the “invoice meanwhile saved” discard branch no longer report success or write a success note when the protection state could not be verifiably removed; retries stay blocked and no duplicate invoice is possible.
• Reject API follow-up URLs (e.g. PDF download links) that contain a bare “#” fragment separator even when no fragment content follows it.

1.0.6

• Make the manual “discard unclear status” action verify that the independent recovery record was actually removed before reporting success; an undeletable record now returns a clear persistence error and keeps the retry blocked instead of falsely announcing that the transfer can be restarted.
• Restrict the required-recipient-fields filter so all four mandatory fields (street, ZIP, city and country) must remain present; invalid values or filter exceptions fall back to the safe defaults instead of weakening validation or crashing the order action.
• Validate the recipient country strictly as a two-letter ISO code checked against the real WooCommerce country list; country names (e.g. “Germany”) and non-string values (arrays, objects, booleans, numbers) are rejected instead of being silently normalized or causing a PHP warning/error.
• Reject Papierkram contact IDs above PHP’s maximum integer instead of silently truncating them to that maximum and using the truncated value.
• Reject percent-encoded, double-encoded, backslash and control-character variants of a URL fragment in API follow-up links (e.g. PDF downloads), not only an unencoded “#fragment”.
• Shorten the 1.0.5 upgrade notice to meet the WordPress.org length limit.

1.0.5

• Verify every independent recovery write against the freshly read database state and treat any unresolved write, corrupt record or unknown status as unresolved; a failed or unproven recovery confirmation after a successful remote invoice now blocks the retry instead of allowing a second draft invoice.
• Remove the last silent fallbacks to a possibly stale order object in the duplicate-invoice safeguards (pre-transfer blocking check, post-transfer invoice-ID proof, manual “discard unclear status” action); a failed fresh reload now aborts the action instead of proceeding on outdated data.
• Stop storing customer name and email address in the order note when a Papierkram contact search finds an email match that belongs to a different person; only the local order number, an internal error code and the validated technical contact ID are recorded.
• Fall back to the fixed default required-recipient-fields when the itsmpc_required_recipient_fields filter returns an invalid value, instead of silently accepting an empty required-field list; validate the recipient country code against the real WooCommerce country list instead of only its two-letter format.
• Require every Papierkram contact ID to be a strictly validated positive integer before it can be reused, matched or sent in an invoice request.
• Reject URL fragments on absolute same-origin follow-up URLs (PDF download links) for consistency with the existing follow-up URL policy.
• Treat a lock that expires in the exact current second as immediately reusable instead of waiting one additional second.

1.0.4

• Restrict all outgoing API and PDF targets to official Papierkram hosts over HTTPS; reject loopback, link-local, private and reserved addresses, embedded credentials, URL fragments and non-standard ports, and never pass the API token across hosts or redirects.
• Take over expired locks with a single atomic compare-and-swap operation and recover from corrupt lock values, so high concurrency can never create a second invoice or customer.
• Require the manual “discard unclear status” action to hold the same per-order lock, prove the pending marker from fresh database state before any remote write, and keep an independent recovery record that blocks blind retries until an authorized order editor resolves it.
• Reduce error logging to a fixed allowlist without remote error text or personal data.
• Reject empty or unknown order currencies and incomplete billing recipient data before any API call.
• Collect all exact email matches and abort on ambiguity instead of using the first match.
• Restrict connector configuration (API URL, token, connection test) to administrators (manage_options).
• Known limitation: the one-time legacy data migration still loads order IDs without batching (documented scaling risk for very large stores).

1.0.3

• Replace the invoice-creation lock with an atomic per-order lock (owner token, expiry, no foreign release); a reproducible two-process race that created duplicate invoices and customers is now prevented.
• Treat truncated or contradictory customer searches as failed instead of “customer not found”, so no duplicate customer can be created after an incomplete search.
• Record a transfer marker before every invoice POST; unclear outcomes (timeouts, server errors, missing invoice ID, failed local save after remote creation) block blind retries until an authorized order editor explicitly discards the state via a new order action.
• Preserve the remote invoice ID in an order note and the log when local saving fails after the invoice was created in Papierkram.
• Reject orders in non-EUR currencies before any API call instead of transferring foreign amounts as Euro values.
• Transfer the real VAT rate for negative fee lines and encode query parameters exactly once.
• Remove personal customer data from diagnostic logs (IDs and field names only).
• Add uninstall.php: configuration, token, locks and notices are removed on deletion; invoice reference metadata is intentionally kept and documented.

1.0.2

• Show redirect-safe success and error notices after manual invoice actions in Classic and HPOS order screens.
• Scope notices to the initiating user and affected order, consume them after display and expire stale notices.
• Prevent queued notices from overwriting each other and prevent duplicate error order notes.
• Return actionable, safely escaped messages for validation, configuration, customer, invoice and refresh failures.
• Redact tokens, authorization data and untrusted API HTML from user-facing messages and diagnostic logs.
• Reject malformed or unexpected Papierkram responses before continuing a write workflow.
• Harden the settings connection test against invalid nonce, missing capability and malformed API responses.

1.0.1

• Prevent customer creation when the Papierkram customer lookup fails.
• Verify updated country values using normalized ISO country codes.
• Render API-provided payment-term names without injecting HTML.
• Report payment-term lookup failures during the connection test.
• Correct query-parameter encoding and WordPress.org tag count.

1.0.0

• First public release.
• Manual transfer of WooCommerce orders as draft invoices.
• Customer lookup and automatic customer creation.
• Product, coupon and shipping line item support.
• Duplicate protection.
• Invoice number and status synchronization.
• WooCommerce logging.
• Connection test.
• Support for German Section 19 UStG.