Releases: codermillat/routemile-woocommerce
Release list
v1.6.3
Plugin Directory review fix (round 3): the two remaining "escape late" outputs — the woocommerce_my_account_my_address_description filter result in the My Account address template and the wc_get_email_order_items() output in the order-status email — are now wrapped in wp_kses_post(), keeping their WooCommerce semantics (legitimate filtered HTML passes, dangerous markup is stripped). Also fixes an undefined `` variable in the email totals rows (PHP 8 warning under WP_DEBUG) and removes stray QA screenshots from the package.
Plugin Check on the shipped zip: 0 errors, 0 warnings.
v1.6.2 — Plugin Directory Review Fixes (round 2)
Plugin Directory review fixes only — no functional changes from 1.6.1
Round 2 review feedback addressed:
- External-service URLs: three links in the readme were returning 404. Replaced with the working equivalents (Nominatim → OSM Foundation Usage Policy, MapTiler privacy, Geoapify terms-and-conditions).
- "Tested up to" was declared in both the main plugin PHP header and readme.txt — the reviewer requires it ONLY in readme.txt (declaring it in both creates ambiguity about which version users see). Removed from the main file.
label_countregistration was passing a variable ($label) into_n_noop(). Admin-configurable status labels cannot be in the .pot file (the gettext parser sees a non-literal because $label varies per stage), so the canonical WP pattern for custom dynamic statuses is to droplabel_countfrom the post-status registration — counts are rendered by our own deliveries dashboard.- 25 inline-SVG icon echoes in the agent templates were missing late-escape. Added a
routew_agent_icon_e()helper that wrapswp_kses_post(routew_agent_icon()), replaced all 25 call sites. Plugin Check's escaping audit now passes.
Quality: test suite 308 pass (the 4 pre-existing private-vendor Leaflet misses are unrelated); Plugin Check on the shipped zip: 0 errors, 0 warnings.
Upload via https://wordpress.org/plugins/developers/add/ (the upload form, not 'Add your plugin' — there's already a submission in review). The 1.6.2 zip replaces the 1.6.1 in the queue. Reply to the review email thread noting that these review items are addressed.
v1.6.1 — Security Release: Payment-State Gate on Manual Order Completion
Security release — upgrade recommended for all stores
What was fixed
WooCommerce automatically records any order moved to completed as paid. RouteMile's manual transition paths allowed that to happen with no real payment:
- Manager path: the deliveries dashboard accepted a transition to
completedfor unpaid orders — one form POST (with a valid dashboard nonce) turned a pending order intopaid=1. - Rider path (more serious): an assigned delivery rider could tap Mark Picked Up → Mark Delivered on a prepaid order (bank transfer / cheque) and the order became
completed paid=1with an empty transaction ID — no manager involvement, no gateway call.
Both were reproduced end-to-end in a local penetration test before the fix, and the fix was verified by replaying the exact attacks (now rejected) plus the legitimate flows (now still working).
The fix
All four manual transition endpoints (manager admin-post + AJAX, rider admin-post + AJAX) now call ROUTEW_Order_Lifecycle::can_complete_order(), which refuses the completed transition while the order still needs payment. Unaffected by design:
- gateway-paid orders (
is_paid/date_paidset by the real payment webhook), - cash-on-delivery orders where the rider confirmed cash collection (that confirmation already sets
date_paid), - zero-total orders.
Also in this release
- New PG1 regression suite (8 tests): pins the gate, all four call sites, the legitimate COD pick-up → cash → deliver sequence, and a future-proof scan that fails the build if any new action can set
completedon an unpaid order without the gate. - Full audit of the checkout REST endpoints for cross-origin CSRF: confirmed not exploitable in practice (WooCommerce's session cookie never rides a cross-site POST; a live cross-origin browser experiment left the victim's session and cart untouched). No behaviour change needed.
Quality: test suite now 311 checks — WordPress Plugin Check: 0 errors, 0 warnings on the shipped zip. Requires WP 6.0+, PHP 7.4+, WooCommerce 7.0+.
Install: download routemile-woocommerce.1.6.1.zip below and upload via Plugins → Add New → Upload Plugin (or update in-place from 1.6.0 — no settings migration needed).
v1.6.0 — Mile Zero Design System, Stage Labels & Brand Color
What's new
Mile Zero design system
Every customer and rider surface (checkout, order tracking, order-received, My Account, delivery-rider app) rebuilt on a fast, self-contained design system with bundled fonts (Plus Jakarta Sans, OFL). Framework styling comes from a scoped Bootstrap 5.3 re-skin — no more theme conflicts from unscoped Bootstrap. Old frontend.css and the unscoped Bootstrap vendor are gone.
Renameable order stages
Rename the five delivery stages (label, colour, icon) from WooCommerce → Settings → RouteMile to match your restaurant's wording — e.g. "Sent to kitchen", "Out for delivery". Renames apply everywhere instantly (admin, rider app, customer tracking) and never touch stored order data. Live preview pill per stage.
Admin brand color
Pick one colour and the whole plugin UI recolours — buttons, links, icons, avatars, chips, page canvas — across every surface, including the rider PWA's theme_color. Text contrast is WCAG-checked automatically (pale brands flip button text to dark; dark brands keep white).
Manager & rider workflow
- Accept Order action for newly placed orders (pending → in-kitchen)
- Rider actions update the app in place — no page reloads, tab counts and cash banners update live
- Cash settlement banners ("Cash to collect" / "You are holding") refresh from the AJAX response
Quality
- WordPress Plugin Check: 0 errors, 0 warnings on the shipped zip
- Tests: 303/303 (PHP 8.5 + live PHP 7.4.30)
- readme.txt: 1.6.0 changelog + upgrade notice; regenerated (538 msgids)
- HPOS compatible, WC 7.0+ (tested up to 11.0), WP 6.0+ (tested up to 7.1), PHP 7.4+
Install: download routemile-woocommerce.1.6.0.zip below, upload via Plugins → Add New → Upload Plugin. Also being submitted to the WordPress.org Plugin Directory.
v1.4.0 — Rider PWA, Cash Settlement, Settings Redesign
🚀 FoodXpress for WooCommerce v1.4.0
Biggest release yet: your delivery riders get a real app, cash hand-overs get a paper trail, and settings finally explain themselves.
📱 Delivery-rider PWA
- Installable app — riders add the Delivery Dashboard to their home screen (manifest + service worker, maskable icons); looks and behaves native.
- Live order list — New / In Progress / Delivered tabs auto-refresh every 30s and on tab focus when new orders arrive or statuses change.
- Per-order actions — call the customer, open the exact pin location in maps, mark picked up / delivered.
- COD awareness — amber "Collect on delivery" strip per order with the exact amount; running cash-in-hand total in the header.
💵 Cash settlement workflow
- Riders initiate a hand-over request (amount always computed server-side from their delivered COD orders).
- Managers/admins accept or reject from the Deliveries Dashboard ledger — every decision stamped with who and when.
- Balance = collected − accepted settlements. Full audit trail on the order too.
🛍️ Customer My Account overhaul
- Welcome banner with Reorder CTA, 4-card stats row (On the way / Delivered / Total / Saved addresses), Recent orders + Default delivery address panels, colour-coded status pills.
⚙️ Settings redesigned for non-technical admins
- Only relevant fields show: pick Google Maps → Google fields appear under Map Provider; pick flat fee → per-km fields hide.
- API keys masked with Show/Hide toggle.
- Weekly hours: per-day "Open all day" / "Closed all day", plus a special-occasion override for holidays ("stay open until…").
- The admin-bar "Deliveries: Open/Closed" toggle now actually works against closed schedules.
🔒 Privacy & fixes
- Kitchen notes stay with the store — riders see delivery instructions only; managers get a new Kitchen Note column.
- Fixed: receipt printing crash + full bill breakdown (items → subtotal → discounts/fees → total), unassign fatal (
post_status_exists), agent dashboard scroll, weekly-hours saving, admin-bar toggle, address duplication on receipts/orders.
📦 WP.org submission readiness
readme.txtwith full setup guide, per-provider API-key walkthroughs (including the recommended two-key Google split), security recommendations, and an external-services disclosure.
Compatibility: WordPress 6.0+ · WooCommerce 7.0+ · PHP 7.4+ · HPOS compatible.
Quality: 147/147 tests pass; deep security scan 0 findings; verified live on WP 7.x / WC 11 / PHP 7.4 and 8.x.
Upgrading: update from any 1.2/1.3 version safely — no manual steps. A one-time migration normalises existing order addresses automatically.