Skip to content

v1.2.7 — Guest withdrawal button no longer asks for login

Choose a tag to compare

View all tags
@mredodos mredodos released this 22 Jun 10:38
v1.2.7
41ccce6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Bug fix reported by a merchant live-testing a guest-checkout store.

The fix
A guest (checkout without an account) who clicked the withdrawal button in the order recap / thank-you page was bounced to the WordPress login. Root cause: that button's URL was always built with wc_get_account_endpoint_url() (the login-gated My Account endpoint), which also fires on the order-received page a guest sees.

WooMyAccount now resolves the URL by viewer:

  • Logged-in customers keep the owner-verified My Account endpoint.
  • Guests are routed to the public form page with the order reference + WooCommerce order key — the same pre-authenticated link the order-confirmation email already uses — so they reach the withdrawal form with no login.

No change to the logged-in flow, the public page, the evidence log or the REST API. The guest path reuses the already-tested email-link mechanism. PHP lint clean.

Not a bug (same report): the public page still offering withdrawal past 14 days is deliberate — the window is informational only (the 14 days run from delivery/possession, often unknown; wrongly blocking would be a compliance risk under Art. 11a). The merchant decides final validity. A follow-up will make the window calculation product-type-aware (digital = order date, physical = delivery).

Includes the bundled translations refreshed via the Crowdin TMS.

Full notes: docs/changelog/wwu-wb-CHANGELOG.md.

Assets 3
Loading