Sendit.ma for WooCommerce

2.2.5

• WooCommerce is now declared as a required plugin. The plugin header carries Requires Plugins: woocommerce, so WordPress 6.5 and later will not let the plugin be activated before WooCommerce is installed and active, and offers to install it from the activation screen. Previously the activation succeeded and the store owner only discovered the dependency from an admin notice afterwards. Older WordPress versions ignore the header and keep the existing notice, so nothing changes for them.

2.2.4

• Settings sanitisation hardened against non-scalar input. Every register_setting() callback now rejects arrays and objects before passing anything to a string function. This matters on WordPress 5.8 and 5.9, which the plugin supports: sanitize_key() only gained its own is_scalar() guard in WordPress 6.0, so on those versions a crafted nested array in the auto-send status field reached strtolower() and caused a fatal error when saving the settings. The pickup-district option no longer uses intval() directly, which silently turned an array into district 1.

2.2.3

Addresses the points raised in the WordPress.org plugin review.

• Select2 updated from 4.0.13 (2020) to 4.1.0. The bundled copy was five years old. The library version is now a constant used for cache-busting, so an upgraded store actually receives the new file instead of serving the old one from browser cache. Verified on the block checkout: the city list, its search, selection and the resulting rate all behave as before.
• Permission check added to bulk label printing. WordPress validates the bulk-action nonce, but not authorisation. The other two bulk actions already checked edit_shop_orders; printing labels did not, so a user without rights over orders could have triggered label generation and obtained the parcel PDF address.
• The city-sync notice is now confined to the Sendit settings page. It could previously appear on any admin screen.

2.2.2

• Plugin URI and Author URI now point to different pages, as the directory requires: the plugin page at plugins.sendit.ma/woocommerce, and the company site at www.sendit.ma.

2.2.1

Release preparation for the WordPress.org directory, plus automatic city syncing.

• Cities now sync on their own. Saving valid API keys fetches the city and rate list immediately — the separate “sync” step is no longer something to remember. A sync only re-runs when the keys change or the list is empty, so saving the page repeatedly costs nothing. If it fails, the page says why, and the next save retries.
• Weekly refresh now reaches existing stores. The weekly city refresh was only scheduled when the plugin was activated, so stores that updated in place never got it and could keep charging outdated rates. It is now scheduled on load as well.
• The manual button remains as “Force a city sync”, for an immediate refresh.
• Plugin renamed to “Sendit.ma for WooCommerce” to follow the WooCommerce trademark naming rules.
• Readme rewritten in English, as the directory requires, and the external service Sendit.ma now fully documented.
• API keys and the shipping strategy option now go through explicit sanitisation callbacks.
• Label download now verifies that the PDF address returned by the API belongs to Sendit before redirecting to it.
• Translation identifier aligned with the plugin folder (sendit-ma-integration), which WordPress.org requires before it will distribute translations.
• Added the translation template languages/sendit-ma-integration.pot (146 strings), previously missing: no translation could have been produced without it.

2.2.0

Version validated on a real store (WordPress 7.1, WooCommerce 11.1), on both the classic and block checkouts, with and without High-Performance Order Storage.

Important fixes:

• City search restored on the block checkout. The field listed 500+ cities as a raw list with no search: the library it needs was being removed from the page by WooCommerce right after it loaded. It is now bundled with the plugin. The field also keeps working after each address recalculation, which was not the case before.
• Phone number now required at checkout. Sendit rejects any parcel without a phone number (HTTP 422). The block checkout left the field optional, so an order could be saved without a number and then fail to send indefinitely. This can be turned off.
• No more accidental free shipping. A district missing from the rate list (removed at Sendit, stale customer address, unsynced list) offered “Shipping: 0 MAD”. No rate is offered in that case now.
• Consistent default parcel options. The settings showed “try on: No” while “Yes” was being sent to Sendit on a fresh install.
• Native city, postcode and state fields hidden on the block checkout. The state field stayed visible next to the Sendit field, inviting customers to fill in the wrong one.
• No resources loaded from an external CDN: the search library ships with the plugin.

Performance:

• The city and rate lists (~22 KB) are no longer loaded on every page view of the site, only where they are used.
• Checkout styles and scripts are now real files, cached by the browser, instead of being re-injected into the HTML on every load (~320 lines).

Other:

• Automatic weekly refresh of cities and rates.
• Deactivating the plugin no longer deletes the city list; deleting the plugin does erase all data, API keys included.
• The API test endpoint now checks user capabilities.
• Fixed an untranslatable label and translations inserted into JavaScript (a single apostrophe was enough to break the checkout script).
• Compatibility headers updated (WordPress 7.1, WooCommerce 11.1).