WooCommerce PDF Invoices & Packing Slips - Version 2.2.7

Version Description

  • Fix: Hardened permissions & security checks on several admin actions (audit by pluginvulnerabilities.com)
  • Feature: Show checkmarks for existing documents on order details page buttons too
  • Tweak: Product Bundles compatibility, hide items by default, following bundle settings (Simple Template)
  • Tweak: Fallback to billing address on packing slip for orders without shipping address
Download this release

Release Info

Developer pomegranate
Plugin Icon 128x128 WooCommerce PDF Invoices & Packing Slips
Version 2.2.7
Comparing to
See all releases

Code changes from version 2.2.6 to 2.2.7

Files changed (22) hide show
  1. assets/css/order-styles.css +9 -0
  2. includes/class-wcpdf-admin.php +21 -2
  3. includes/class-wcpdf-main.php +1 -1
  4. includes/class-wcpdf-settings-debug.php +19 -3
  5. includes/class-wcpdf-settings.php +5 -0
  6. includes/compatibility/mb-string-compatibility.php +2 -0
  7. includes/compatibility/wc-datetime-functions-compatibility.php +2 -0
  8. includes/documents/abstract-wcpdf-order-document-methods.php +7 -1
  9. includes/documents/class-wcpdf-sequential-number-store.php +2 -2
  10. includes/views/attachment-settings-hint.php +1 -0
  11. includes/views/setup-wizard/attach-to.php +1 -0
  12. includes/views/setup-wizard/display-options.php +1 -0
  13. includes/views/setup-wizard/good-to-go.php +1 -0
  14. includes/views/setup-wizard/logo.php +1 -0
  15. includes/views/setup-wizard/paper-format.php +1 -0
  16. includes/views/setup-wizard/shop-name.php +1 -0
  17. includes/views/wcpdf-extensions.php +1 -0
  18. includes/views/wcpdf-settings-page.php +1 -0
  19. includes/views/work-at-wpovernight.php +1 -0
  20. readme.txt +7 -1
  21. templates/Simple/style.css +3 -0
  22. woocommerce-pdf-invoices-packingslips.php +2 -2
assets/css/order-styles.css CHANGED
@@ -11,6 +11,15 @@
11
  color:#2aad2a;
12
  }
13
 
 
 
 
 
 
 
 
 
 
14
  .type-shop_order .column-wc_actions a.button.wpo_wcpdf img,
15
  .type-shop_order .column-order_actions a.button.wpo_wcpdf img {
16
  width: 16px;
11
  color:#2aad2a;
12
  }
13
 
14
+ .wpo_wcpdf-actions a.button.exists::after {
15
+ font-family: Dashicons;
16
+ content: "\f147";
17
+ font-size: 16px;
18
+ margin-left: 4px;
19
+ color: #2aad2a;
20
+ vertical-align: middle;
21
+ }
22
+
23
  .type-shop_order .column-wc_actions a.button.wpo_wcpdf img,
24
  .type-shop_order .column-order_actions a.button.wpo_wcpdf img {
25
  width: 16px;
includes/class-wcpdf-admin.php CHANGED
@@ -311,11 +311,14 @@ class Admin {
311
 
312
  $meta_box_actions = array();
313
  $documents = WPO_WCPDF()->documents->get_documents();
 
314
  foreach ($documents as $document) {
 
315
  $meta_box_actions[$document->get_type()] = array(
316
  'url' => wp_nonce_url( admin_url( "admin-ajax.php?action=generate_wpo_wcpdf&document_type={$document->get_type()}&order_ids=" . $post_id ), 'generate_wpo_wcpdf' ),
317
  'alt' => esc_attr( "PDF " . $document->get_title() ),
318
  'title' => "PDF " . $document->get_title(),
 
319
  );
320
  }
321
 
@@ -325,7 +328,8 @@ class Admin {
325
  <ul class="wpo_wcpdf-actions">
326
  <?php
327
  foreach ($meta_box_actions as $document_type => $data) {
328
- printf('<li><a href="%1$s" class="button" target="_blank" alt="%2$s">%3$s</a></li>', $data['url'], $data['alt'],$data['title']);
 
329
  }
330
  ?>
331
  </ul>
@@ -440,14 +444,24 @@ class Admin {
440
  $date = $_POST['wcpdf_invoice_date'];
441
  $hour = !empty( $_POST['wcpdf_invoice_date_hour'] ) ? $_POST['wcpdf_invoice_date_hour'] : '00';
442
  $minute = !empty( $_POST['wcpdf_invoice_date_minute'] ) ? $_POST['wcpdf_invoice_date_minute'] : '00';
 
 
 
 
 
443
  $invoice_date = "{$date} {$hour}:{$minute}:00";
 
 
444
  $invoice->set_date( $invoice_date );
445
  } elseif ( empty( $_POST['wcpdf_invoice_date'] ) && !empty( $_POST['_wcpdf_invoice_number'] ) ) {
446
  $invoice->set_date( current_time( 'timestamp', true ) );
447
  }
448
 
449
  if ( isset( $_POST['_wcpdf_invoice_number'] ) ) {
450
- $invoice->set_number( $_POST['_wcpdf_invoice_number'] );
 
 
 
451
  }
452
 
453
  $invoice->save();
@@ -570,6 +584,11 @@ class Admin {
570
  'message' => 'incomplete request',
571
  ) );
572
  }
 
 
 
 
 
573
 
574
  $order_id = absint($_POST['order_id']);
575
  $document = sanitize_text_field($_POST['document']);
311
 
312
  $meta_box_actions = array();
313
  $documents = WPO_WCPDF()->documents->get_documents();
314
+ $order = WCX::get_order( $post->ID );
315
  foreach ($documents as $document) {
316
+ $document->read_data( $order );
317
  $meta_box_actions[$document->get_type()] = array(
318
  'url' => wp_nonce_url( admin_url( "admin-ajax.php?action=generate_wpo_wcpdf&document_type={$document->get_type()}&order_ids=" . $post_id ), 'generate_wpo_wcpdf' ),
319
  'alt' => esc_attr( "PDF " . $document->get_title() ),
320
  'title' => "PDF " . $document->get_title(),
321
+ 'exists' => $document->exists(),
322
  );
323
  }
324
 
328
  <ul class="wpo_wcpdf-actions">
329
  <?php
330
  foreach ($meta_box_actions as $document_type => $data) {
331
+ $exists = ( isset( $data['exists'] ) && $data['exists'] == true ) ? 'exists' : '';
332
+ printf('<li><a href="%1$s" class="button %4$s" target="_blank" alt="%2$s">%3$s</a></li>', $data['url'], $data['alt'], $data['title'], $exists);
333
  }
334
  ?>
335
  </ul>
444
  $date = $_POST['wcpdf_invoice_date'];
445
  $hour = !empty( $_POST['wcpdf_invoice_date_hour'] ) ? $_POST['wcpdf_invoice_date_hour'] : '00';
446
  $minute = !empty( $_POST['wcpdf_invoice_date_minute'] ) ? $_POST['wcpdf_invoice_date_minute'] : '00';
447
+
448
+ // clean & sanitize input
449
+ $date = date( 'Y-m-d', strtotime( $date ) );
450
+ $hour = sprintf('%02d', intval( $hour ));
451
+ $minute = sprintf('%02d', intval( $minute ) );
452
  $invoice_date = "{$date} {$hour}:{$minute}:00";
453
+
454
+ // set date
455
  $invoice->set_date( $invoice_date );
456
  } elseif ( empty( $_POST['wcpdf_invoice_date'] ) && !empty( $_POST['_wcpdf_invoice_number'] ) ) {
457
  $invoice->set_date( current_time( 'timestamp', true ) );
458
  }
459
 
460
  if ( isset( $_POST['_wcpdf_invoice_number'] ) ) {
461
+ // sanitize
462
+ $invoice_number = sanitize_text_field( $_POST['_wcpdf_invoice_number'] );
463
+ // set number
464
+ $invoice->set_number( $invoice_number );
465
  }
466
 
467
  $invoice->save();
584
  'message' => 'incomplete request',
585
  ) );
586
  }
587
+ if ( !current_user_can('manage_woocommerce') ) {
588
+ wp_send_json_error( array(
589
+ 'message' => 'no permissions',
590
+ ) );
591
+ }
592
 
593
  $order_id = absint($_POST['order_id']);
594
  $document = sanitize_text_field($_POST['document']);
includes/class-wcpdf-main.php CHANGED
@@ -562,7 +562,7 @@ class Main {
562
  foreach ( $number_stores as $store_name ) {
563
  $order_id = $order->get_id();
564
  $table_name = apply_filters( "wpo_wcpdf_number_store_table_name", "{$wpdb->prefix}wcpdf_{$store_name}", $store_name, 'auto_increment' ); // i.e. wp_wcpdf_invoice_number
565
- $wpdb->query( "UPDATE $table_name SET order_id = 0 WHERE order_id = $order_id" );
566
  }
567
  }
568
 
562
  foreach ( $number_stores as $store_name ) {
563
  $order_id = $order->get_id();
564
  $table_name = apply_filters( "wpo_wcpdf_number_store_table_name", "{$wpdb->prefix}wcpdf_{$store_name}", $store_name, 'auto_increment' ); // i.e. wp_wcpdf_invoice_number
565
+ $wpdb->query( $wpdb->prepare( "UPDATE $table_name SET order_id = 0 WHERE order_id = %s", $order_id ) );
566
  }
567
  }
568
 
includes/class-wcpdf-settings-debug.php CHANGED
@@ -37,10 +37,16 @@ class Settings_Debug {
37
  }
38
  ?>
39
  <form method="post">
 
40
  <input type="hidden" name="wpo_wcpdf_debug_tools_action" value="install_fonts">
41
  <input type="submit" name="submit" id="submit" class="button" value="<?php _e( 'Reinstall fonts', 'woocommerce-pdf-invoices-packing-slips' ); ?>">
42
  <?php
43
- if (isset($_POST['wpo_wcpdf_debug_tools_action']) && $_POST['wpo_wcpdf_debug_tools_action'] == 'install_fonts') {
 
 
 
 
 
44
  $font_path = WPO_WCPDF()->main->get_tmp_path( 'fonts' );
45
 
46
  // clear folder first
@@ -59,10 +65,15 @@ class Settings_Debug {
59
  ?>
60
  </form>
61
  <form method="post">
 
62
  <input type="hidden" name="wpo_wcpdf_debug_tools_action" value="clear_tmp">
63
  <input type="submit" name="submit" id="submit" class="button" value="<?php _e( 'Remove temporary files', 'woocommerce-pdf-invoices-packing-slips' ); ?>">
64
  <?php
65
- if (isset($_POST['wpo_wcpdf_debug_tools_action']) && $_POST['wpo_wcpdf_debug_tools_action'] == 'clear_tmp') {
 
 
 
 
66
  $tmp_path = WPO_WCPDF()->main->get_tmp_path('attachments');
67
 
68
  if ( !function_exists("glob") ) {
@@ -98,10 +109,15 @@ class Settings_Debug {
98
  ?>
99
  </form>
100
  <form method="post">
 
101
  <input type="hidden" name="wpo_wcpdf_debug_tools_action" value="delete_legacy_settings">
102
  <input type="submit" name="submit" id="submit" class="button" value="<?php _e( 'Delete legacy (1.X) settings', 'woocommerce-pdf-invoices-packing-slips' ); ?>">
103
  <?php
104
- if (isset($_POST['wpo_wcpdf_debug_tools_action']) && $_POST['wpo_wcpdf_debug_tools_action'] == 'delete_legacy_settings') {
 
 
 
 
105
  // delete options
106
  delete_option( 'wpo_wcpdf_general_settings' );
107
  delete_option( 'wpo_wcpdf_template_settings' );
37
  }
38
  ?>
39
  <form method="post">
40
+ <?php wp_nonce_field( 'wpo_wcpdf_debug_tools_action', 'security' ); ?>
41
  <input type="hidden" name="wpo_wcpdf_debug_tools_action" value="install_fonts">
42
  <input type="submit" name="submit" id="submit" class="button" value="<?php _e( 'Reinstall fonts', 'woocommerce-pdf-invoices-packing-slips' ); ?>">
43
  <?php
44
+ if ( !empty($_POST) && isset($_POST['wpo_wcpdf_debug_tools_action']) && $_POST['wpo_wcpdf_debug_tools_action'] == 'install_fonts' ) {
45
+ // check permissions
46
+ if ( !check_admin_referer( 'wpo_wcpdf_debug_tools_action', 'security' ) ) {
47
+ return;
48
+ }
49
+
50
  $font_path = WPO_WCPDF()->main->get_tmp_path( 'fonts' );
51
 
52
  // clear folder first
65
  ?>
66
  </form>
67
  <form method="post">
68
+ <?php wp_nonce_field( 'wpo_wcpdf_debug_tools_action', 'security' ); ?>
69
  <input type="hidden" name="wpo_wcpdf_debug_tools_action" value="clear_tmp">
70
  <input type="submit" name="submit" id="submit" class="button" value="<?php _e( 'Remove temporary files', 'woocommerce-pdf-invoices-packing-slips' ); ?>">
71
  <?php
72
+ if ( !empty($_POST) && isset($_POST['wpo_wcpdf_debug_tools_action']) && $_POST['wpo_wcpdf_debug_tools_action'] == 'clear_tmp' ) {
73
+ // check permissions
74
+ if ( !check_admin_referer( 'wpo_wcpdf_debug_tools_action', 'security' ) ) {
75
+ return;
76
+ }
77
  $tmp_path = WPO_WCPDF()->main->get_tmp_path('attachments');
78
 
79
  if ( !function_exists("glob") ) {
109
  ?>
110
  </form>
111
  <form method="post">
112
+ <?php wp_nonce_field( 'wpo_wcpdf_debug_tools_action', 'security' ); ?>
113
  <input type="hidden" name="wpo_wcpdf_debug_tools_action" value="delete_legacy_settings">
114
  <input type="submit" name="submit" id="submit" class="button" value="<?php _e( 'Delete legacy (1.X) settings', 'woocommerce-pdf-invoices-packing-slips' ); ?>">
115
  <?php
116
+ if ( !empty($_POST) && isset($_POST['wpo_wcpdf_debug_tools_action']) && $_POST['wpo_wcpdf_debug_tools_action'] == 'delete_legacy_settings' ) {
117
+ // check permissions
118
+ if ( !check_admin_referer( 'wpo_wcpdf_debug_tools_action', 'security' ) ) {
119
+ return;
120
+ }
121
  // delete options
122
  delete_option( 'wpo_wcpdf_general_settings' );
123
  delete_option( 'wpo_wcpdf_template_settings' );
includes/class-wcpdf-settings.php CHANGED
@@ -227,6 +227,11 @@ class Settings {
227
 
228
  public function set_number_store() {
229
  check_ajax_referer( "wpo_wcpdf_next_{$_POST['store']}", 'security' );
 
 
 
 
 
230
  $number = isset( $_POST['number'] ) ? (int) $_POST['number'] : 0;
231
  $number_store_method = $this->get_sequential_number_store_method();
232
  $number_store = new Sequential_Number_Store( $_POST['store'], $number_store_method );
227
 
228
  public function set_number_store() {
229
  check_ajax_referer( "wpo_wcpdf_next_{$_POST['store']}", 'security' );
230
+ // check permissions
231
+ if ( !current_user_can('manage_woocommerce') ) {
232
+ die();
233
+ }
234
+
235
  $number = isset( $_POST['number'] ) ? (int) $_POST['number'] : 0;
236
  $number_store_method = $this->get_sequential_number_store_method();
237
  $number_store = new Sequential_Number_Store( $_POST['store'], $number_store_method );
includes/compatibility/mb-string-compatibility.php CHANGED
@@ -1,4 +1,6 @@
1
  <?php
 
 
2
  /**
3
  * mb_string compatibility - something's better than nothing!
4
  * Taken from dompdf 0.6
1
  <?php
2
+ defined( 'ABSPATH' ) or exit;
3
+
4
  /**
5
  * mb_string compatibility - something's better than nothing!
6
  * Taken from dompdf 0.6
includes/compatibility/wc-datetime-functions-compatibility.php CHANGED
@@ -1,6 +1,8 @@
1
  <?php
2
  use WPO\WC\PDF_Invoices\Compatibility\WC_Core as WCX;
3
 
 
 
4
  // load date/time functions for older WC versions
5
  if ( WCX::is_wc_version_lt_3_0() ) {
6
  if ( !function_exists( 'wc_timezone_offset' ) ) {
1
  <?php
2
  use WPO\WC\PDF_Invoices\Compatibility\WC_Core as WCX;
3
 
4
+ defined( 'ABSPATH' ) or exit;
5
+
6
  // load date/time functions for older WC versions
7
  if ( WCX::is_wc_version_lt_3_0() ) {
8
  if ( !function_exists( 'wc_timezone_offset' ) ) {
includes/documents/abstract-wcpdf-order-document-methods.php CHANGED
@@ -176,7 +176,13 @@ abstract class Order_Document_Methods extends Order_Document {
176
  $address = apply_filters( 'wpo_wcpdf_shipping_address', $address, $this );
177
  } else {
178
  // no address
179
- $address = apply_filters( 'wpo_wcpdf_shipping_address', __('N/A', 'woocommerce-pdf-invoices-packing-slips' ), $this );
 
 
 
 
 
 
180
  }
181
 
182
  return $address;
176
  $address = apply_filters( 'wpo_wcpdf_shipping_address', $address, $this );
177
  } else {
178
  // no address
179
+ // use fallback for packing slip
180
+ if ( apply_filters( 'wpo_wcpdf_shipping_address_fallback', ( $this->get_type() == 'packing-slip' ), $this ) ) {
181
+ $address = $this->get_billing_address();
182
+ } else{
183
+ $address = apply_filters( 'wpo_wcpdf_shipping_address', __('N/A', 'woocommerce-pdf-invoices-packing-slips' ), $this );
184
+
185
+ }
186
  }
187
 
188
  return $address;
includes/documents/class-wcpdf-sequential-number-store.php CHANGED
@@ -143,7 +143,7 @@ $sql = "CREATE TABLE {$this->table_name} (
143
  // if AUTO_INCREMENT is not 1, we need to make sure we have a 'highest value' in case of server restarts
144
  // https://serverfault.com/questions/228690/mysql-auto-increment-fields-resets-by-itself
145
  $highest_number = (int) $number - 1;
146
- $wpdb->query("ALTER TABLE {$this->table_name} AUTO_INCREMENT={$highest_number};");
147
  $data = array(
148
  'order_id' => 0,
149
  'date' => get_date_from_gmt( date( 'Y-m-d H:i:s' ) ),
@@ -157,7 +157,7 @@ $sql = "CREATE TABLE {$this->table_name} (
157
  $wpdb->insert( $this->table_name, $data );
158
  } else {
159
  // simple scenario, no need to insert any rows
160
- $wpdb->query("ALTER TABLE {$this->table_name} AUTO_INCREMENT={$number};");
161
  }
162
  }
163
 
143
  // if AUTO_INCREMENT is not 1, we need to make sure we have a 'highest value' in case of server restarts
144
  // https://serverfault.com/questions/228690/mysql-auto-increment-fields-resets-by-itself
145
  $highest_number = (int) $number - 1;
146
+ $wpdb->query( $wpdb->prepare( "ALTER TABLE {$this->table_name} AUTO_INCREMENT=%d;", $highest_number ) );
147
  $data = array(
148
  'order_id' => 0,
149
  'date' => get_date_from_gmt( date( 'Y-m-d H:i:s' ) ),
157
  $wpdb->insert( $this->table_name, $data );
158
  } else {
159
  // simple scenario, no need to insert any rows
160
+ $wpdb->query( $wpdb->prepare( "ALTER TABLE {$this->table_name} AUTO_INCREMENT=%d;", $number ) );
161
  }
162
  }
163
 
includes/views/attachment-settings-hint.php CHANGED
@@ -1,3 +1,4 @@
 
1
  <?php
2
  $invoice_settings_url = add_query_arg( array(
3
  'tab' => 'documents',
1
+ <?php defined( 'ABSPATH' ) or exit; ?>
2
  <?php
3
  $invoice_settings_url = add_query_arg( array(
4
  'tab' => 'documents',
includes/views/setup-wizard/attach-to.php CHANGED
@@ -1,3 +1,4 @@
 
1
  <div class="wpo-step-description">
2
  <h2><?php _e( 'Attach too...', 'woocommerce-pdf-invoices-packing-slips' ); ?></h2>
3
  <p><?php _e( 'Select to which emails you would like to attach your invoice.', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
1
+ <?php defined( 'ABSPATH' ) or exit; ?>
2
  <div class="wpo-step-description">
3
  <h2><?php _e( 'Attach too...', 'woocommerce-pdf-invoices-packing-slips' ); ?></h2>
4
  <p><?php _e( 'Select to which emails you would like to attach your invoice.', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
includes/views/setup-wizard/display-options.php CHANGED
@@ -1,3 +1,4 @@
 
1
  <div class="wpo-step-description">
2
  <h2><?php _e( 'Display options', 'woocommerce-pdf-invoices-packing-slips' ); ?></h2>
3
  <p><?php _e( 'Select some additional display options for your invoice.', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
1
+ <?php defined( 'ABSPATH' ) or exit; ?>
2
  <div class="wpo-step-description">
3
  <h2><?php _e( 'Display options', 'woocommerce-pdf-invoices-packing-slips' ); ?></h2>
4
  <p><?php _e( 'Select some additional display options for your invoice.', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
includes/views/setup-wizard/good-to-go.php CHANGED
@@ -1,3 +1,4 @@
 
1
  <div class="wpo-step-description wpo-final">
2
  <h1><?php _e( 'You are good to go!' , 'woocommerce-pdf-invoices-packing-slips' ); ?></h1>
3
  <p><?php _e( 'If you have any questions please have a look at our documentation:', 'woocommerce-pdf-invoices-packing-slips' ); ?><br>
1
+ <?php defined( 'ABSPATH' ) or exit; ?>
2
  <div class="wpo-step-description wpo-final">
3
  <h1><?php _e( 'You are good to go!' , 'woocommerce-pdf-invoices-packing-slips' ); ?></h1>
4
  <p><?php _e( 'If you have any questions please have a look at our documentation:', 'woocommerce-pdf-invoices-packing-slips' ); ?><br>
includes/views/setup-wizard/logo.php CHANGED
@@ -1,3 +1,4 @@
 
1
  <div class="wpo-step-description">
2
  <h2><?php _e( 'Your logo' , 'woocommerce-pdf-invoices-packing-slips' ); ?></h2>
3
  <p><?php _e( 'Set the header image that will display on your invoice.' , 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
1
+ <?php defined( 'ABSPATH' ) or exit; ?>
2
  <div class="wpo-step-description">
3
  <h2><?php _e( 'Your logo' , 'woocommerce-pdf-invoices-packing-slips' ); ?></h2>
4
  <p><?php _e( 'Set the header image that will display on your invoice.' , 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
includes/views/setup-wizard/paper-format.php CHANGED
@@ -1,3 +1,4 @@
 
1
  <div class="wpo-step-description">
2
  <h2><?php _e( 'Paper format', 'woocommerce-pdf-invoices-packing-slips' ); ?></h2>
3
  <p><?php _e( 'Select the paper format for your invoice.', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
1
+ <?php defined( 'ABSPATH' ) or exit; ?>
2
  <div class="wpo-step-description">
3
  <h2><?php _e( 'Paper format', 'woocommerce-pdf-invoices-packing-slips' ); ?></h2>
4
  <p><?php _e( 'Select the paper format for your invoice.', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
includes/views/setup-wizard/shop-name.php CHANGED
@@ -1,3 +1,4 @@
 
1
  <div class="wpo-step-description">
2
  <h2><?php _e( 'Enter your shop name', 'woocommerce-pdf-invoices-packing-slips' ); ?></h2>
3
  <p><?php _e( 'Lets quickly setup your invoice. Please enter the name and address of your shop in the fields on the right.', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
1
+ <?php defined( 'ABSPATH' ) or exit; ?>
2
  <div class="wpo-step-description">
3
  <h2><?php _e( 'Enter your shop name', 'woocommerce-pdf-invoices-packing-slips' ); ?></h2>
4
  <p><?php _e( 'Lets quickly setup your invoice. Please enter the name and address of your shop in the fields on the right.', 'woocommerce-pdf-invoices-packing-slips' ); ?></p>
includes/views/wcpdf-extensions.php CHANGED
@@ -1,3 +1,4 @@
 
1
  <script type="text/javascript">
2
  jQuery(document).ready(function() {
3
  jQuery('.extensions .more').hide();
1
+ <?php defined( 'ABSPATH' ) or exit; ?>
2
  <script type="text/javascript">
3
  jQuery(document).ready(function() {
4
  jQuery('.extensions .more').hide();
includes/views/wcpdf-settings-page.php CHANGED
@@ -1,3 +1,4 @@
 
1
  <script type="text/javascript">
2
  jQuery( function( $ ) {
3
  $("#footer-thankyou").html("If you like <strong>WooCommerce PDF Invoices & Packing Slips</strong> please leave us a <a href='https://wordpress.org/support/view/plugin-reviews/woocommerce-pdf-invoices-packing-slips?rate=5#postform'>★★★★★</a> rating. A huge thank you in advance!");
1
+ <?php defined( 'ABSPATH' ) or exit; ?>
2
  <script type="text/javascript">
3
  jQuery( function( $ ) {
4
  $("#footer-thankyou").html("If you like <strong>WooCommerce PDF Invoices & Packing Slips</strong> please leave us a <a href='https://wordpress.org/support/view/plugin-reviews/woocommerce-pdf-invoices-packing-slips?rate=5#postform'>★★★★★</a> rating. A huge thank you in advance!");
includes/views/work-at-wpovernight.php CHANGED
@@ -1,3 +1,4 @@
 
1
  <style type="text/css">
2
  .wpo-wcpdf-work-at-wpovernight {
3
  background-color: #f6f6f6;
1
+ <?php defined( 'ABSPATH' ) or exit; ?>
2
  <style type="text/css">
3
  .wpo-wcpdf-work-at-wpovernight {
4
  background-color: #f6f6f6;
readme.txt CHANGED
@@ -5,7 +5,7 @@ Tags: woocommerce, pdf, invoices, packing slips, print, delivery notes, invoice,
5
  Requires at least: 3.5
6
  Tested up to: 5.0
7
  Requires PHP: 5.3
8
- Stable tag: 2.2.6
9
  License: GPLv2 or later
10
  License URI: http://www.gnu.org/licenses/gpl-2.0.html
11
 
@@ -103,6 +103,12 @@ There's a setting on the Status tab of the settings page that allows you to togg
103
 
104
  == Changelog ==
105
 
 
 
 
 
 
 
106
  = 2.2.6 =
107
  * Fix: ship to different address check for empty shipping addresses
108
  * Fix: Fix notice when using invoice number by plugin
5
  Requires at least: 3.5
6
  Tested up to: 5.0
7
  Requires PHP: 5.3
8
+ Stable tag: 2.2.7
9
  License: GPLv2 or later
10
  License URI: http://www.gnu.org/licenses/gpl-2.0.html
11
 
103
 
104
  == Changelog ==
105
 
106
+ = 2.2.7 =
107
+ * Fix: Hardened permissions & security checks on several admin actions (audit by pluginvulnerabilities.com)
108
+ * Feature: Show checkmarks for existing documents on order details page buttons too
109
+ * Tweak: Product Bundles compatibility, hide items by default, following bundle settings (Simple Template)
110
+ * Tweak: Fallback to billing address on packing slip for orders without shipping address
111
+
112
  = 2.2.6 =
113
  * Fix: ship to different address check for empty shipping addresses
114
  * Fix: Fix notice when using invoice number by plugin
templates/Simple/style.css CHANGED
@@ -178,6 +178,9 @@ table.order-details {
178
  border: 0;
179
  }
180
 
 
 
 
181
 
182
  /* item meta formatting for WC2.6 and older */
183
  dl {
178
  border: 0;
179
  }
180
 
181
+ .order-details tr.bundled-item.hidden {
182
+ display: none;
183
+ }
184
 
185
  /* item meta formatting for WC2.6 and older */
186
  dl {
woocommerce-pdf-invoices-packingslips.php CHANGED
@@ -3,7 +3,7 @@
3
  * Plugin Name: WooCommerce PDF Invoices & Packing Slips
4
  * Plugin URI: http://www.wpovernight.com
5
  * Description: Create, print & email PDF invoices & packing slips for WooCommerce orders.
6
- * Version: 2.2.6
7
  * Author: Ewout Fernhout
8
  * Author URI: http://www.wpovernight.com
9
  * License: GPLv2 or later
@@ -21,7 +21,7 @@ if ( !class_exists( 'WPO_WCPDF' ) ) :
21
 
22
  class WPO_WCPDF {
23
 
24
- public $version = '2.2.6';
25
  public $plugin_basename;
26
  public $legacy_mode;
27
 
3
  * Plugin Name: WooCommerce PDF Invoices & Packing Slips
4
  * Plugin URI: http://www.wpovernight.com
5
  * Description: Create, print & email PDF invoices & packing slips for WooCommerce orders.
6
+ * Version: 2.2.7
7
  * Author: Ewout Fernhout
8
  * Author URI: http://www.wpovernight.com
9
  * License: GPLv2 or later
21
 
22
  class WPO_WCPDF {
23
 
24
+ public $version = '2.2.7';
25
  public $plugin_basename;
26
  public $legacy_mode;
27