CartTailor – WooCommerce Product Options, Custom Fields & Swatches

Changelog:

= 1.0.15 =

* Listing gallery re-verified: the eight screenshots described in SCREENSHOTS.md are attached to the listing's Preview Screenshots field and visible in the listing lightbox (1 of 8). The 1.0.14 review reported an empty gallery, but the saved listing shows all eight images in the documented order.

* INSTALLATION.md version stamp corrected to 1.0.15 (it still read 1.0.10); every per-document version stamp in the documentation now matches 1.0.15.

= 1.0.14 =

* Listing gallery: the eight screenshots described in SCREENSHOTS.md are now uploaded to the WPBay listing gallery (field builder, frontend options, swatches, unavailable choice, conditional logic, price breakdown, order details, role visibility and formula pricing).

* SCREENSHOTS.md updated: the seventh screenshot is now the order-details view (the thank-you page after checkout, showing the chosen options, the formula-priced line total, and the download link for the uploaded file) instead of a mobile view; the intro now states that store-page captures have no admin bar while the field-builder capture shows the admin builder.

CHANGELOG — 1.0.13

* Uninstall now reads and preserves the upload-storage configuration before deleting it, so temporary files stored above the web root are removed when Delete Data on Uninstall is enabled (1.0.10–1.0.12 deleted the option first and could not locate the directory); files attached to retained orders are still kept, and an empty private directory is removed.

* The HTTP probe no longer treats redirects as proof of protection: any 3xx response is now 'unknown' and new uploads are refused, because a redirect can lead to a URL that serves the file. Properly denied directories (403, or 404 with a passing positive control) still work.

CHANGELOG — 1.0.12

* Upload-directory protection is now verified by an HTTP probe on every server, not by trusting the .htaccess file: a unique test file is requested through its public URL, with a positive control proving the URL mapping works, and the directory is accepted only when the test file cannot be retrieved. A 404 is conclusive only because the positive control proves the file exists and the URL works; a 200 that returns the test content means the directory is public and uploads are refused.

* Stored upload-directory protection is re-verified every 24 hours and when the server changes, on Apache/LiteSpeed as well as Nginx; a directory whose protection stops working flips to refused uploads while existing files stay downloadable.

* Documentation updated to describe the probe verification accurately.

## 1.0.11

* File uploads are now linked to their order on the block (Store API) checkout too: the post-save step runs on woocommerce_store_api_checkout_order_created and woocommerce_store_api_checkout_order_processed as well as the classic woocommerce_checkout_order_created — the classic hook never fires for block checkout, so 1.0.10 left files unattached there and guests with a valid order key got a 403.

* The storage upgrade migration now moves existing files even when no prior storage record exists (1.0.9 installs): the uploads directory is used as the previous location instead of skipping the move.

* The one-time recovery now also repairs temporary entries left unattached by the 1.0.10 block-checkout gap, and the download endpoint self-heals them the same way.

## 1.0.9 — Review round 5

* Customer uploads are now protected: the upload directory denies all direct access (Apache `.htaccess`, upgraded automatically on existing installs), and files are served only through an authorization-checked download endpoint — the customer who owns the order (or its order key), store staff, or the shopper's own session for cart files. An Nginx server block snippet is documented in `INSTALLATION.md`.

* Calculated fees can no longer overflow to INF or NaN, or grow into amounts WooCommerce cannot represent: percentage, quantity and per-character fees, quantity multiplication, aggregated fees and the final cart price are all checked — every amount must be finite and no more than $1 trillion (the maximum supported amount; a finite $1e307 fee is rejected just like INF). An extreme value fails cleanly at add-to-cart with an actionable error instead of storing an unsupported price.

* A failed formula recalculation no longer silently removes the fee: the cart line is flagged and checkout is blocked with a clear error telling the shopper to remove the item and add it again. This covers saved carts, quantity changes and catalog price changes after add-to-cart.

= 1.0.8 =

* Conditional-logic builder crash fixed: opening a field with saved rules no longer throws a JavaScript error (the faulty syncRules ran before the builder initialized — the rule list is now read from the DOM after the table is ready, and the Add Condition / Add Condition Group controls work after the fix).

* Base price is no longer frozen at add-to-cart: cart recalculation re-reads the current catalog price, so a price change after add-to-cart is honoured at checkout instead of throwing a stale-price validation error, and the shipping cost shown at checkout uses the same corrected line price.

* Non-finite configured prices are rejected: an imported price, minimum or maximum of 1e999 (or any non-finite value) fails validation with the exact field name, and a formula referencing a non-finite numeric result reports a clear pricing error instead of silently changing the price.

* A negative formula result is rejected at validation instead of clamping the unit price to $0.00.

* SVG, XML, XSL, SWF, XHT and HTA can never be whitelisted for customer uploads, closing the stored-XSS gap that a custom extension list could previously open.

* Import validation hardened: only CartTailor exports are accepted, malformed group entries are skipped with a warning instead of creating empty groups, and duplicate titles are detected in both create-new and update-existing modes.

* Option values are never reused: the builder now uses a monotonic per-field counter, so a freed value is never handed out again after a delete or an import.

* Documentation, license and readme corrections: the real GPL-2.0 license text ships in license.txt, the documentation version stamp is current, the readme install step names the correct plugin folder, and the promised-but-missing screenshots section is removed.

1.0.7 — Follow-ups to the round-4 fixes: option values are never reused after a delete (fresh opt_N past the highest in use); a formula referencing non-finite numeric text such as 1e999 now reports the specific finite-value error.

1.0.5 — WPBay review fixes (round 3): strict input-shape validation (arrays rejected for scalar controls, nested arrays rejected for choice arrays, numbers must be finite); one canonical text value for validation, pricing, storage, recalculation, checkout and order meta; documented builder settings (default, lengths, bounds, step) in both builder contexts; conditional visibility that keeps unavailable choices disabled through hide/show cycles (snapshot-based restore, correcting the 1.0.3/1.0.4 guards). 1.0.4 — corrected the 1.0.3 visibility guard to an attribute check. 1.0.3 — input-shape validation, canonical text value, builder settings, conditional-unavailable fix (see reviewer message for verification details).

Version 1.0.2

Version 1.0.2 — fixes for all 6 round-2 review points: builder XSS (DOM-assigned values, no interpolation), product-tab independent builder instance, duplicate/import fresh field IDs with formula remapping, checkbox scalar-shape rejection + unique-count limits, upload writability probe + failure cleanup, display positions restricted to in-form hooks. Demo: https://tivorenza.com/carttailor/

Version 1.0.1

Version 1.0.1 — fixes for all 5 review points: (1) Option groups now use a dedicated capability type (spo_group) granted only to administrators and shop managers — Authors/Contributors can no longer create, publish, modify or duplicate groups, including via direct admin requests; group saves and duplication enforce the same per-post capability. (2) File uploads now enforce content/MIME matching — a file whose content does not match its extension (e.g. text renamed to .jpg) is rejected at add-to-cart validation and again before the file is moved, so no mismatched file is stored and a required-file purchase cannot go through incomplete. (3) Classic checkout now applies the same role-visibility guard as add-to-cart validation — a required field hidden by role no longer blocks checkout for shoppers outside that role, while eligible shoppers must still supply it. (4) Conditionally hidden checkbox fields are excluded from frontend min/max selection-limit validation and their stale error state is cleared when hidden. (5) Group-level role restrictions now survive export, import and duplication (export schema 1.0.1); files exported before 1.0.1 have no role restrictions, so importing one leaves the group visible to everyone. Also fixed: text swatch rows align on the top. All five fixes were live-verified on the demo site (https://tivorenza.com/carttailor/).

Version 1.0.0 — Initial release.