Skip to content

Release v1.9.15

Choose a tag to compare

View all tags
@github-actions github-actions released this 04 Aug 14:20
v1.9.15
2bb3527
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security patch

Custom thermal receipt templates can no longer run PHP. A user with POS management access (eg: a shop manager) could embed PHP in a custom thermal receipt template and have it execute when a receipt was rendered, because the thermal engine fell through to the legacy PHP renderer. Thermal templates now render exclusively through the safe Mustache/XML pipeline, which discards embedded PHP; malformed markup fails closed. If you use custom receipt templates, please update.

More reliable thermal receipt rendering. Thermal render failures are now logged so a broken template is diagnosable, and browser-printed HTML receipts are constrained to the configured paper width so wide rows no longer overflow the roll.

Full changelog: https://github.com/wcpos/woocommerce-pos/blob/v1.9.15/readme.txt

Assets 3
Loading