kristianwindandClaude Opus 5.5 d5d85612bd 1.7.1: security fixes for the checkout and the client IP ...

- The discount follows the billing email, the address the order is
  placed under. The tracked session email used to win, so a guest could
  post a discounted address to the tracking endpoint and check out under
  their own, keeping the discount.
- Shipping packages carry the matched assignment, so WooCommerce's
  per-package rate cache no longer reuses rates filtered for a matched
  address (free shipping, reserved methods) after the email changes.
- The anonymous tracking endpoint no longer answers matched: true|false,
  which let anyone enumerate discounted addresses and domains.
- CF-Connecting-IP is believed only from a Cloudflare edge range or a
  private/loopback proxy. From anyone else it let a direct client pick a
  new address per request: no REST rate limit, forged audit-log IPs.

Smoke tests: 89 assertions (was 73), each fix with its own.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

2026-11-14 15:11:28 +01:00

..

class-admin-audit.php

Initial commit: WooCommerce Email Discount Manager plugin

2026-08-23 15:38:14 +02:00

class-admin-emails.php

Initial commit: WooCommerce Email Discount Manager plugin

2026-08-23 15:38:14 +02:00

class-admin-groups.php

Initial commit: WooCommerce Email Discount Manager plugin

2026-08-23 15:38:14 +02:00

class-admin-shipping.php

1.7.0: shipping rule "Only" reserves a method, "Show" no longer does

2026-10-02 12:28:45 +02:00

class-admin.php

Put a Discounts card on the shared Nolimit dashboard

2026-09-20 07:57:02 +02:00

class-audit-log.php

1.7.1: security fixes for the checkout and the client IP

2026-11-14 15:11:28 +01:00

class-db.php

1.7.0: shipping rule "Only" reserves a method, "Show" no longer does

2026-10-02 12:28:45 +02:00

class-frontend.php

1.7.1: security fixes for the checkout and the client IP

2026-11-14 15:11:28 +01:00

class-helpers.php

Initial commit: WooCommerce Email Discount Manager plugin

2026-08-23 15:38:14 +02:00

class-rate-limiter.php

Initial commit: WooCommerce Email Discount Manager plugin

2026-08-23 15:38:14 +02:00

class-rest-api.php

1.7.0: shipping rule "Only" reserves a method, "Show" no longer does

2026-10-02 12:28:45 +02:00

class-updater.php

Answer the update filter even when the release feed cannot be reached

2026-09-17 13:26:12 +02:00

shared-menu.php

1.6.1: shared-menu 1.2.3, and render the dashboard to check the pill

2026-09-23 17:21:44 +02:00