OW Agenda

Registro de cambios

1.3.1

• Compliance: the standalone action, verification and cancellation pages no longer print their CSS and JavaScript inline. Both are now registered files served through the WordPress enqueue API, with the two variable button colours passed as CSS custom properties and the script configured through wp_localize_script().
• Compliance: translation catalogues are no longer bundled. Only languages/ow-agenda.pot ships; French is delivered through the WordPress.org language packs fed by translate.wordpress.org.
• Compatibility: the minimum WordPress version returns to 6.3, as nothing in the package depends on the bundled-translation discovery introduced in 6.7 any more.
• REST: every administration route now declares its permission_callback explicitly instead of sharing it through array_merge(). The capability check was already enforced; it is now visible to static analysis as well.

1.3.0

• Internationalization: the whole plugin is now translatable. Every user-facing string — admin settings, standalone booking and cancellation pages, REST messages, all e-mail templates and the JavaScript interface — uses the ow-agenda text domain with English as the source language. Domain Path: /languages is declared and languages/ow-agenda.pot ships for translators.
• Localization: a full French translation has been produced from the original interface wording and submitted to translate.wordpress.org, so French sites get it through the standard WordPress language packs.
• Security: appointment uid and invitation tokens are now generated with random_bytes() instead of wp_generate_uuid4(). These tokens are the sole authentication for public cancellation, e-mail verification and invitation booking, and the previous generator relied on a non-cryptographic PRNG.
• Security: the public booking endpoint no longer accepts a missing honeypot or a missing timestamp — both silently disabled the anti-spam checks. The hourly quota is now aggregated per IPv6 /64 instead of per address, and a per-day cap limits unverified requests so a single visitor can no longer hold every slot of a day.
• Security: the rate limit is applied after form validation, so a visitor who mistypes their e-mail is no longer locked out for an hour without any appointment being created.
• Fixed: concurrent bookings of the same slot are now serialised with a named MySQL lock. The previous transaction issued a plain SELECT, which takes no row lock under REPEATABLE READ, so two simultaneous visitors could both book the same time.
• Fixed: the day-before reminder used a fixed evening window and could be lost for good when no visitor triggered WP-Cron that evening. It now uses a sliding window (12 to 36 hours before the appointment) and catches up on the next cron run. Each reminder is claimed atomically before sending, so overlapping cron runs can no longer send it twice.
• Fixed: the hourly cron event is re-scheduled automatically if it disappears, so reminders, purge and GDPR anonymisation cannot stop silently.
• Fixed: rescheduling a confirmed appointment now updates the customer’s calendar. The ICS attachment carries a SEQUENCE, METHOD:REQUEST, organiser and attendee, and cancellations send a METHOD:CANCEL file that removes the event.
• Fixed: the booking widget built its dates in UTC, so visitors east of UTC opening the page shortly after midnight saw the list start on the previous day and lost a day of availability.
• Fixed: cancelling an appointment created from a private invitation now releases that invitation, which becomes usable and visible again instead of staying permanently dead.
• Fixed: cancelled appointments and expired unverified requests are no longer returned to the agenda view, removing needless personal data from the REST response and phantom appointments from the admin calendar.
• Removed: a leftover style rule from a client project that hid a third-party floating button on every page of the site.

1.2.1

• Plugin Check compliance: output escaping, input sanitization, settings nonce, wp_delete_file(), readme.
• Uninstall: also removes the customers table and the HMAC secret.

1.2.0

• HTML emails (clean card layout, site accent color) for every notification.
• Confirm / Refuse buttons in the admin email (HMAC-signed links).
• Customer directory: search, create, edit, delete, shortcuts to new appointment and invitation.
• Footer layout fix on the agenda page.

1.1.0

• Email double opt-in against bots (slot held 45 minutes, purge after 48 hours).

1.0.0

• Initial release: online booking, mobile-first admin agenda, session invitations, ICS emails and day-before reminder.