Ambikly – Sell Online: Cart, Checkout & Digital Downloads

Changelog

1.0.2

• Fix: fatal error on PHP 7.4 whenever an order, product or other record was JSON-encoded or accessed as an array (mixed return types are PHP 8 only). Affects every 1.0.1 site on PHP 7.4.
• Fix: guest buyers returning from Stripe or PayPal landed on a generic thank-you page — their cart was never cleared and the order-completed event never fired. Both return URLs now carry the order key.
• Fix: a cart line could reference another product’s variation and, at order time, decrement that other product’s stock.
• Security: editing a customer linked to a WordPress account no longer lets a Store Manager change that account’s login email (administrators only).
• Fix: any REST route with an id in the URL could be pointed at a different record by adding an id to the request body (e.g. editing customer A saved customer B).
• Fix: a checkout billing name containing HTML/script landed unescaped in the order confirmation and admin notification emails.
• Fix: logging in with items in a guest cart deleted the account’s existing cart instead of merging it.
• Fix: two simultaneous checkout submissions for the same cart created two orders and decremented stock twice.
• Fix: an order’s status could be set straight to “Refunded” from the dropdown or API without any refund happening; a refunded order could later be moved to another status.
• Fix: tax-inclusive pricing charged tax on top of the inclusive price.
• Fix: digital products created from the quick-add modal, the REST API, CSV import or the sample importer were unpurchasable (“Out of stock”) by default.
• Fix: bulk-editing variations always failed with a database error; clearing a variation price saved 0 instead of empty.
• Fix: exporting products to CSV and re-importing the file cleared every SKU.
• Fix: Stripe refunds issued from the Stripe dashboard were recorded with the cumulative refunded amount; the second partial refund was over-recorded or rejected. Refunds are now idempotent per gateway refund id, so an admin refund echoed back by the gateway webhook is not recorded twice.
• Fix: cancelling and later reopening an order left stock overstated and B2B credit under-reserved; cancelled or failed orders kept their coupon usage forever.
• Fix: deleting an order left its refunds, coupon usage and still-working download links behind.
• Fix: Stripe/PayPal checkouts the buyer never finished held stock indefinitely — they now expire to “Failed” after 24 hours (filter ambikly_pending_gateway_order_ttl).
• Fix: a missing column on the categories table caused the upgrade routine to drop and recreate the table; columns are now added in place.
• Fix: paid card orders emailed the customer twice and declined attempts emailed the merchant a “new order”.
• Fix: variable-product cart lines never recorded which variation was chosen; sold-out variations kept “Add to Cart” enabled; the mobile cart clipped the totals and checkout button off-screen.
• Fix: logged-in customers’ cart actions failed with a 403 once their nonce went stale mid-session.
• Fix: a WordPress account checking out with a different billing email created a second, disconnected customer record and broke address prefill.
• Fix: the “Create an account during checkout” setting had no effect.
• Fix: duplicate canonical tags and a per-product meta title that never reached <title> on product pages; unstable product sort order across pages; plan-priced digital products sorted as $0.
• Fix: the setup wizard could create duplicate My Account / Order Received pages when re-run; wizard settings are now saved under the same keys the Settings screen reads.
• Fix: Install::create_tables() could reset the database version and re-run the full migration on every request.
• Security: hardened cart/checkout input (quantity ceiling, nested address payloads, client-controlled created_via), added a coupon brute-force throttle, sanitized customer name/phone/email at write time, and stopped a raw database error leaking on duplicate tag/brand slugs.
• Accessibility: product-editor drawers are keyboard-reachable, every form control has a label, visible focus rings, skip-to-content link, aria-current navigation markers, table header scopes, live region for add-to-cart, reduced-motion support, and contrast fixes throughout the admin and storefront.
• Add: Settings → Advanced → “Remove all data when the plugin is deleted” (the uninstall opt-in previously had no UI). Removed three Advanced toggles that had no effect.
• Add: manual orders support coupons; Stripe key format validation; name/SKU length and negative-stock validation with clear errors.
• Dev: 147 PHPUnit regression tests covering the fixes above; PHP 8.4 deprecation fixes.

1.0.1

• Fix: two admin links (the setup wizard’s “Add a product” button and the low-stock/out-of-stock email’s “Manage product” link) pointed at an unregistered admin page and returned a 403 instead of opening the product editor.
• Add: a “Add sample products” tool (Setup Wizard finish step and Tools screen) that creates 5 example products — simple, variable with real variations, digital download, digital with multiple pricing plans, and one on sale.
• Add: a “Rerun setup wizard” shortcut on the Tools screen.

1.0.0

• First stable release.