2 Commits

Include renames

Author	SHA1	Message	Date
kristianwindandClaude Opus 5.5	d5d85612bd	1.7.1: security fixes for the checkout and the client IP ... - The discount follows the billing email, the address the order is placed under. The tracked session email used to win, so a guest could post a discounted address to the tracking endpoint and check out under their own, keeping the discount. - Shipping packages carry the matched assignment, so WooCommerce's per-package rate cache no longer reuses rates filtered for a matched address (free shipping, reserved methods) after the email changes. - The anonymous tracking endpoint no longer answers matched: true|false, which let anyone enumerate discounted addresses and domains. - CF-Connecting-IP is believed only from a Cloudflare edge range or a private/loopback proxy. From anyone else it let a direct client pick a new address per request: no REST rate limit, forged audit-log IPs. Smoke tests: 89 assertions (was 73), each fix with its own. Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-11-14 15:11:28 +01:00
kristianwind	e4a40e53a0	Initial commit: WooCommerce Email Discount Manager plugin	2026-08-23 15:38:14 +02:00