1.7.1: security fixes for the checkout and the client IP

- The discount follows the billing email, the address the order is placed under. The tracked session email used to win, so a guest could post a discounted address to the tracking endpoint and check out under their own, keeping the discount. - Shipping packages carry the matched assignment, so WooCommerce's per-package rate cache no longer reuses rates filtered for a matched address (free shipping, reserved methods) after the email changes. - The anonymous tracking endpoint no longer answers matched: true|false, which let anyone enumerate discounted addresses and domains. - CF-Connecting-IP is believed only from a Cloudflare edge range or a private/loopback proxy. From anyone else it let a direct client pick a new address per request: no REST rate limit, forged audit-log IPs. Smoke tests: 89 assertions (was 73), each fix with its own. Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-11-14 15:11:28 +01:00
parent 4a93a5fde8
commit d5d85612bd
8 changed files with 263 additions and 38 deletions
@@ -1,6 +1,6 @@
 # Contract

-Every hook this plugin offers, and every family hook it answers. Version 1.7.0.
+Every hook this plugin offers, and every family hook it answers. Version 1.7.1.

 A contract is a name somebody else has to know. Core hooks this plugin merely
 listens to — `init`, `admin_menu`, `wp_enqueue_scripts` — are not here;