bpost-shipping-platform

3.2.4 – 2026-06-25

• fix/ STM-393: guard fatal “Cannot redeclare function BPOST_is_marketplace()” when an older bpost plugin copy is still active (function_exists/class_exists bail + admin notice to remove the duplicate plugin)
• fix/ STM-394: no longer hard-code plugin asset paths; enqueue scripts via the plugin URL constant (plugins_url) so the plugin works under any folder name
• fix/ STM-395 / STM-374: guard “Undefined array key is_international” on add-to-cart (check_if_has_pickup_safe early returns + rates_filter meta reads)
• fix/ STM-395: classic checkout pickup modal — feature-detect the Block-only cart store API (fixes JS “Cannot read properties of undefined (getCartData)”), read the country with underscore field IDs, and populate the hidden carrier id on classic checkout
• fix/ STM-395: pickup AJAX now returns HTTP 400 (instead of a generic 500) when CarrierId is empty or invalid
• fix/ STM-401: guard fatal “Call to undefined method country_needs_dummy_zipcode()” when saving orders for countries without a postal-code system
• fix/ STM-410 / STM-411: guard fatal “Attempt to assign property carrierId on array” in the pickup-locations AJAX; this fatal also aborted the request and could block WooCommerce order-confirmation emails
• fix/ STM-410 / STM-398: “no pickup points returned” on classic checkout — coerce empty coordinates and always send the entered postcode so the carrier geocodes the correct location (the pickup map now renders)
• fix/ token now refreshes automatically when it expires, and a failed refresh no longer wipes the stored token — no need to regenerate API keys after a token expires
• fix/ STM-375: pickup popup search now uses the full address (street + postcode + city) instead of street only; city/region searches return results and centre the map on the selected point
• fix/ STM-375: theme-agnostic pudo widget — when mandatory address fields are suppressed by the theme, open the map with a clear notification and manual search instead of a blank/erroring popup
• fix/ correct webpack entry so the frontend bundle rebuilds on the main branch
• compat/ bump Tested up to 7.0

3.2.3 – 2026-05-14

• security/ fix unauthenticated SQL injection in Bpost_order_submited / Bpost_block_order_submited (prepared statements with %d/%s placeholders)
• security/ add HMAC permission_callback on /wp-json/Bpost/v1/update REST route
• security/ require nonce + capability check on admin AJAX (set_pickup_point, clear_pickup_session_data, get_checkout_address, get_pickup_locations)
• security/ migrate file ops to WP_Filesystem; remove direct fopen/file_put_contents/unlink
• security/ escape-on-output sweep (esc_html / esc_attr / esc_url / wp_kses) across admin and frontend
• fix/ fatal “Call to get_name() on string” on product variation orders (WC_Product_Variation::get_attributes returns name=>string pairs, not WC_Product_Attribute objects)
• fix/ get_callback_url() now stable across requests; previously it recomputed and overwrote the stored URL after Bpost_token was set, breaking HMAC validation
• fix/ legacy /Bpost-callback handler moved to template_redirect:1 so WC order datastore is primed before wc_get_order()
• fix/ pickup map National-Belgium results parsing (lat/lng keys)
• fix/ print-label action button in order grid no longer navigates to the order page
• dev/ gate all debug logging behind BpostWoo::is_dev() (BPOST_DEV, wp_get_environment_type, WP_DEBUG_LOG); production sites stay quiet by default

3.2.2 – 2026-03-10

*fix/ cod checkout fix

3.2.1 – 2025-10-28

*fix/ version number fix

3.2.0 – 2025-10-28

*feat/ frontend functionality change for multiple checkout type and theme compatibility

3.1.99 – 2025-04-12

*fix/ fix vat display to take into account both the subtotal and tax

3.1.98 – 2025-07-03

• feat/ add coupon functionality on checkout for a valid free shipping coupon
• fix/ fix compatability issues with themes

3.1.97 – 2025-06-02

*fix/ compilation error left in class

3.1.96 – 2025-05-20

• Initial release