WooCLINK v1.0.8 - Security fix

Patches unauthenticated order payment bypass (Broken Access Control)

Changes

• Replaced generic nonces with per-order nonces for all 4 AJAX handlers (, , , )
• Added order status verification to mark_paid (must be pending/on-hold)
• Added invoice existence check to mark_paid (invoice must be generated first)
• Added ownership checks for logged-in users on confirm_payment, mark_paid, and save_ndebit

Upgrade notice

All sites should update immediately. This fixes an unauthenticated order payment bypass vulnerability.

Woo-CLINK v1.0.7wp

1.0.7 — WordPress.org review compliance & Auto-Renewal UX polish

🧹 WordPress.org review compliance

• Strip gist.github.com URL from bundled nostr-tools (via post-build step in build.mjs).
• Fix contributors list to WooClink.
• Add Third Party Services section to readme.txt documenting Nostr relays, CoinGecko, and ShockWallet.app.
• Remove hardcoded "Try Again" call-to-action — now translates through i18n (tryAgain string).
• Add esc_url() to my.shockwallet.app link in My Account.
• Add AJAX ownership check in wc_clink_ajax_save_ndebit() — logged-in users can only save ndebit to their own subscriptions.

🔁 Auto-Renewal UX

• View Subscription > Payment row: shows "Auto-Renewal" when ndebit is saved, or links "Activate Auto-Renewal" to the parent order's order-received page (where the ndebit setup form lives). No more modal — just a direct, clear link.

✅ Plugin reviewed and approved by the WordPress.org plugin review team.

Official public page: https://wordpress.org/plugins/clink-gateway-for-woocommerce/

Woo-CLINK v1.0.7

v1.0.7

WordPress.org review compliance and subscription My Account improvements.

Changed

• "Payment:" row on View Subscription page — now shows "Auto-Renewal" when ndebit is saved, or "Activate Auto-Renewal" as a link back to the parent order's order-received page for ndebit setup
• Stripped remote gist.github.com URL from built JS bundle (post-build replacement in build.mjs) — WordPress.org review compliance
• Contributors list — fixed to match plugin owner's WordPress.org username (WooClink)
• Added Third Party Services section to readme documenting Nostr relays, CoinGecko, and ShockWallet.app with privacy policy links

---

v1.0.6

Added

• "Payment:" row on the View Subscription page reflects ndebit status: "Via Auto-Renewal" or "Via Manual Renewal"
• "Activate Auto-Renewal" action link on My Account subscription items for subscriptions without ndebit
• "Get your nDebit string" link — pointing to my.shockwallet.app/lapps at checkout and on My Account

Changed

• "Auto-Renewal" → "Setup Auto-Renewal" title on the order-received page for clarity
• QR codes generated client-side with bundled qrcode-generator (no remote API dependency)

---

v1.0.5

Added

• Ndebit auto-renewal for subscriptions — customers authorize recurring payments via CLINK after the first payment
• Auto-renewal is active by default after first subscription payment; customers can disable from My Account > Subscriptions
• "Get your nDebit string" link at checkout and on My Account
• BTC / sats / ₿ (bip-0177) currency display option — overrides all frontend prices (product pages, cart, checkout)
• Client-side price conversion fallback for maximum compatibility with Custom Price for WooCommerce Pro and similar plugins

Fixed

• Price display priority changed to PHP_INT_MAX to avoid conflicts with other plugins
• BTC/bip-0177 formatting — now correctly shows 8 decimal places
• Compatibility with third-party subscription plugins (hasthemes, YITH, Flexible Subscriptions)
• PCP warnings — text domain and non-prefixed hook ignore

Changed

• QR codes generated client-side with bundled qrcode-generator (no remote api.qrserver.com)

Woo-CLINK v1.0.4

1.0.4

Naming & Branding

• Renamed plugin to "CLINK Gateway for WooCommerce" in compliance with WordPress.org trademark rules
• Updated payment method title to "Bitcoin Lightning (via CLINK)"
• Slug changed to clink-gateway-for-woocommerce

Settings & Admin

• Removed redundant Store Currency setting — plugin now relies on WooCommerce's global currency
• Updated default description with ShockWallet.app link
• Added "Settings" link on the Plugins page (wp-admin/plugins.php)
• Updated enable label and method title for clarity

Checkout & Rendering

• Fixed blocks checkout description — HTML links now render correctly (was showing escaped <a>)
• Fixed blocks checkout icon — was passing the full <img> tag instead of the URL
• External links in description now open with target="_blank" and rel="noopener noreferrer" on both classic and blocks checkout
• Added loading="lazy" to gateway icon

WordPress.org Compliance

• Added readme.txt in WordPress readme format
• License changed from MIT to GPLv2 or later
• Text domain aligned with plugin slug (clink-gateway-for-woocommerce)
• Fixed version consistency across all files (1.0.4)
• Created languages/ directory with .pot file + 10 locale .po/.mo files
• Added .gitattributes to exclude development files from distribution
• Added wp_unslash() on POST input
• Fixed exception escaping in subscriptions
• Fixed hook prefix woocommerce_clink_icon → wc_clink_icon
• Updated all @package tags and log source to match new slug

Woo-CLINK v1.0.3

1.0.3

• Removed redundant Store Currency setting — plugin now relies on WooCommerce's built-in store currency instead of duplicating it in its own settings. The get_supported_currencies() helper was removed.
• External links open in new tabs — any <a> tags in the gateway description now automatically get target="_blank" and rel="noopener noreferrer" on both classic and block-based checkout.
• Blocks checkout description renders HTML correctly — links in the payment method description no longer appear escaped as <a href=...>. Uses dangerouslySetInnerHTML with server-sanitized content.
• Blocks checkout icon fixed — gateway icon was broken in blocks checkout because the full <img> HTML tag was passed to esc_url(). Now passes the raw icon URL instead.
• SEO improvements — loading="lazy" added to the gateway icon; all external links use rel="noopener noreferrer".
• Updated repo URLs — plugin URI, author, and README point to github.com/WoompaLoompa/woo-clink.
• Updated default description — includes a link to ShockWallet.app in the gateway description.