v1.1.0 — Storefront Extensions: security fixes, WooCommerce 1.3.1, OpenCart 1.2.0

First refresh of the release assets since 2026-08-01. Every archive here is rebuilt from
current main; the v1.0.0 assets were three weeks stale and predate all of the security work
below.

New in this release: tack.ocmod.zip — the OpenCart merchant installer, which was never
published before. Previously you had to build it yourself from the source archive. It must
keep that exact filename: OpenCart derives the extension code from the zip filename, nothing
inside the package pins it, and a renamed archive installs cleanly and then 404s on every route
with no error.

Package versions

Package	Version	Notes
tack-woocommerce.zip	1.3.1	Verified on WordPress 7.1 + WooCommerce 11.0.1
tack.ocmod.zip / tack-opencart.zip	1.2.0	Verified on OpenCart 4.1.0.4
tack-prestashop.zip	1.0.0	unchanged
tack-magento2.zip, tack-shopware.zip, tack-zencart.zip, tack-wix.zip, tack-squarespace.zip	—	rebuilt, no source changes

WooCommerce — security and WordPress.org compliance

• Storefront/admin XSS closed. The quote modal escaped only labels and placeholders while
  interpolating id and name raw from server-supplied requiredCompanyFields. Because the API
  base URL is a setting a shop manager can edit, this was a path to script execution in an
  administrator's browser. Proven fixed by running the shipped function against
  x" autofocus onfocus=… before and after.
• The API key is no longer written into the settings page HTML. A masked value was computed
  and then discarded; the field emitted the real key, and type="password" hid it from the eye
  only, not from page source.
• The settings page can now actually be saved. It was registered under manage_woocommerce
  while posting to options.php, which requires manage_options — so the one role the page was
  built for could never save it.
• Order sync no longer sits inside checkout. It was a synchronous 20-second HTTP POST inside
  three checkout hooks, while readme.txt promised it "never blocks checkout". It is now handed
  to Action Scheduler, and that promise is true: a status transition completes in ~350 ms and
  enqueues exactly one background job — one, not two, even though both the creation and the
  transition hook fire.
• Privacy disclosure added naming the exact fields and destination endpoint, and order sync
  now ships off by default.
• phpcs --standard=WordPress and wp plugin check both run clean.

OpenCart

• Admin XSS closed. The test-connection result was written with innerHTML from a remote
  response whose host is a merchant-editable setting.
• test() now checks permissions. Against the previous code, an administrator with no rights
  on this extension could complete a live outbound call using the store's API key.
• Silent save failures fixed. The controller wrote one error key and the template read a
  different one, so a permission denial changed nothing and said nothing. Save now answers the
  AJAX contract the form actually declares.
• Adds the multi-product quote cart: storefront view event, drawer and controls templates, and
  the accompanying JS/CSS.

Verification

Both refreshed packages were installed and exercised on real stores rather than reasoned about.
Every archive was also checked to contain no .DS_Store, no .phpunit.cache, no node_modules,
no store-listing assets, and no secret-shaped strings — a previous release shipped test-result
caches and listing screenshots that exposed part of a development API key.

Known limitation

Buyer first/last name supplied on OpenCart and PrestaShop quote forms is not yet stored as
structured buyer identity — the buyer record's name is currently derived from the email address.
A fix is in progress and will land in a follow-up point release. WooCommerce and Magento are
unaffected and store the name as typed.