Spotrebiteľské práva pre WooCommerce

2.5.6

• Fix: Partial withdrawal now correctly tracks withdrawn quantities per product. Customers can withdraw individual pieces from a multi-qty line item across multiple submissions (e.g. 1 of 3, then another 1 of 3). The system blocks only when all ordered pieces have already been withdrawn, and shows how many pieces are still available.

2.5.5

• New: IBAN validation — the IBAN field in the complaint form is now validated using the ISO 13616 MOD-97 checksum algorithm with country-specific length checks for 80+ countries. The field shows a green/red border as live feedback on blur, and an invalid IBAN is rejected server-side before the complaint is saved.

2.5.4

• New: Admin sidebar badge — the “Consumer Rights” menu item now shows a count bubble for new (unseen) withdrawals and unresolved (status = new) complaints, the same way WordPress displays pending comments or WooCommerce shows pending orders. The badge refreshes every hour (transient) and clears immediately whenever a new submission arrives.

2.5.3

• New: Quantity selection — when withdrawing specific products, customers can now choose how many pieces to withdraw (e.g. 2 out of 3). A number input appears next to each product when the checkbox is ticked.
• Fix: When “multiple withdrawals per order” is disabled, re-submitting a partial withdrawal for the same product is now correctly blocked. Withdrawing a different product from the same order remains allowed.

2.5.2

• New: Excluded products & categories — admin can select specific products or entire product categories that are not eligible for withdrawal (hygiene products, custom-made goods, digital content, etc.). Excluded products are hidden from the partial-withdrawal checkbox list; if all products in an order are excluded, full-order withdrawal is blocked as well.
• Fix: Multiple partial withdrawals for the same order (covering different products) are now correctly allowed when “Multiple withdrawals per order” is disabled.

2.5.1

• New: [withdrawal_link] shortcode — inserts a link to the withdrawal form with the order pre-filled via order_key. Designed for WooCommerce e-mail customizers (YayMail, Kadence Emails, etc.).
• Changed: “One withdrawal per order” setting renamed to “Multiple withdrawals per order” — logic inverted so the safe default (one per order) requires no configuration.
• Improved: Hidden product selection fields now get tabindex=”-1″ so they are not reachable via keyboard navigation.

2.4.0

• New: Allow partial withdrawal toggle — admin can disable the “Selected products only” option.
• New: Limit withdrawals per order — optionally prevent customers from submitting duplicate withdrawals.
• New: Prices with/without VAT — choose whether item prices in the withdrawal form include tax.
• New: IBAN field mode — set IBAN to Required, Optional, or Hidden in the complaint form (useful for non-EU card payments).
• New: Custom e-mail attachments — attach a PDF or other file to customer confirmation e-mails for withdrawal and complaint via the Media Library.
• New: Admin settings redesign — each section is now displayed as a card for better readability.
• Fix: Prices displayed as raw HTML entities (e.g.  €) instead of formatted currency.
• Fix: “From” address in e-mails was always the WooCommerce default, ignoring the plugin’s own e-mail setting.

2.3.1

• New: Configurable withdrawal period — choose 14 days (legal minimum), 30 days, or a custom value (1–365 days).
• New: Delivery offset setting (+0 to +3 days) — shifts the start of the withdrawal period forward to approximate the actual delivery date, as required by EU consumer rights law.
• All deadline calculations, the countdown timer, and the “Withdraw from contract” button visibility are automatically updated based on these settings.

2.3.0

New: GDPR checkbox is now optional, Polylang/WPML support for admin texts, multilingual locale fix.

• Added: GDPR consent checkbox is now configurable (Settings → Data retention & GDPR → GDPR consent checkbox). Three modes — Hidden (recommended): no checkbox, only a short info text stating the actual legal basis (Art. 6(1)(b) performance of a contract + (c) legal obligation under EU Directive 2023/2673 / Slovak Act 108/2024), with a link to your privacy policy. Optional: checkbox shown but not required. Required: legacy behavior. Existing installations keep “Required” (no surprise on upgrade); fresh installations default to “Hidden”.
• Why: several testers pointed out that processing personal data for withdrawal/complaint is not consent-based — it’s contract performance + legal obligation. A separate consent checkbox is therefore legally unnecessary and arguably misleading (suggests consent is the lawful basis when it isn’t).
• Added: Polylang / WPML support for admin-editable strings. The “Custom notice / warning”, “Fallback contact info” and seller-info fields are now registered with Polylang’s pll_register_string() and WPML’s icl_register_string(), so they appear in Languages → String translations (Polylang) or WPML → String Translation. Group name: “Consumer Rights for WooCommerce”. No-op if neither plugin is installed.
• Fixed: Form sometimes rendered in English even though the page was Czech (Polylang). The plugin now honors pll_current_language() and wpml_current_language filter when loading translations, so the form follows the current page language even when it differs from the WordPress site locale.

2.2.2

Bugfix: partial withdrawal — checkboxes were not sent to the server.

• Fixed: When a customer selected “withdraw from selected products only” and ticked products via the new checkbox list, submitting the form returned “For partial withdrawal please list the product names.” Two issues: (a) the AJAX submit hand-built the request payload and forgot to forward produkty_items[], so the server never received the checked items; (b) client-side validation only checked the textarea, ignoring the checkbox list. Both fixed — the form now serialises all its fields and validation accepts either source.
• Fixed: When falling back to the textarea (logged-in user without orders, or guest before AJAX lookup completes), the textarea is now also pre-filled with the order’s item names when the user switches the “withdrawal scope” radio to “selected products only” — previously this pre-fill only ran on order-change, leaving the textarea empty if the radio was toggled later.

2.2.1

Bugfix: WC emails not sent from AJAX submit handlers.

• Fixed: Withdrawal and complaint confirmation e-mails were not sent because the WooCommerce mailer was never bootstrapped during custom AJAX actions (oodz_submit, oodz_complaint_submit). WooCommerce only fires the woocommerce_email_classes filter on the first WC()->mailer() call, so our OODZ_Email_* listener classes were never instantiated → do_action( ‘oodz_email_*’ ) had no listeners and silently no-op’d. A new internal helper now forces WC()->mailer() before every trigger.

2.2.0

New: WooCommerce email integration, product-checkbox partial withdrawal, minified assets, smarter dashboard widget.

• Added: All 5 transactional e-mails are now registered as WooCommerce emails. They appear in WooCommerce → Settings → Emails and can be individually enabled/disabled, have their subject, heading and recipient customised, and use the shop’s native WC email header/footer styling.
  • Withdrawal — confirmation to customer
  • Withdrawal — notification to shop owner
  • Complaint — confirmation to customer
  • Complaint — notification to shop owner
  • Complaint — status update to customer
• Added: Product checkbox list for partial withdrawal — also works for guests. When a customer chooses “withdraw from selected products only” and has picked one of their orders from the dropdown, a list of products in that order is shown with checkboxes. Guests without an account can use the checkbox list too: once they type the order number and either the order’s billing e-mail or postcode, the products are loaded over a secured AJAX endpoint. The list of selected products is included in the e-mail to the shop owner — no more free-text guessing.
• Security: Guest order lookup verifies that the submitted e-mail OR postcode actually matches the order’s billing details. Failed lookups return a generic “not found” message (no order-number enumeration possible) and the endpoint is rate-limited to 10 lookups per hour per IP.
• Added: Refund amount preview — when “whole order” is selected, the customer sees the exact refund amount (matching the order total) so they know what to expect. Cash-on-delivery (unpaid) orders show a different note instead — there is nothing to refund yet, and the shop owner will agree the next steps with the customer.
• Added: Minified CSS & JS assets. Front-end assets now load as oodz-style.min.css / oodz-script.min.js. Full unminified versions are loaded automatically when SCRIPT_DEBUG is enabled (developer convenience).
• Improved: Dashboard widget now uses transient caching (5 min) for much faster admin loads, includes “Withdrawals this month” stat, and a “Recent complaints” list with quick links to detail pages. Defensive table-existence checks added so the widget never warns on fresh installs.
• Translations updated for all 6 supported languages.

2.1.0

New: data retention, GDPR tools, WC order linking, dashboard widget.

• Added: Auto-delete after X years setting in Consumer Rights → Settings (data retention). Once a day, complaints and withdrawals older than the configured threshold are automatically deleted, along with attached photos from disk. Default: 0 = disabled. Recommended for Slovakia: 5 years (statutory archival period for commercial records per Slovak law).
• Added: GDPR personal data export — plugin now hooks into WordPress native Tools → Export Personal Data. When a customer requests their data, all matching withdrawals and complaints are included automatically (grouped by type).
• Added: GDPR personal data erase — plugin hooks into WordPress native Tools → Erase Personal Data. Deleting a customer also removes their withdrawal records and complaints (including photos on disk, with realpath safety).
• Added: Link to WooCommerce order — if the order number in a complaint matches an existing WC order, the complaint detail page now shows a link to the order edit page with the order status badge, creation date and total. Helps admins jump quickly between complaint ↔ order.
• Added: Meta box on the WooCommerce order edit page — “🛡 Complaints (reklamácie)” sidebar widget showing all complaints filed against the current order, with status badges, dates and a short defect excerpt. Shows “No complaints filed for this order.” when there are none.
• Added: Dashboard widget “🛡 Consumer Rights — Overview” — shows at a glance: count of new complaints, in-progress, complaints with deadline ≤ 5 days, this month’s count, all-time totals. With quick links to the admin pages.
• Translations updated.

2.0.0

Major release — full complaint (reklamácia) functionality, dedicated admin menu, brand redesign.

Withdrawal form:

• Added: wc-pending (Awaiting payment) orders are now also shown in the withdrawal form order dropdown. Previously only completed / processing / on-hold orders appeared, which broke for shops with custom statuses or workflows where orders stay in pending state.
• Added: new filter hook oodz_withdrawal_order_statuses — themes/plugins can customize which statuses appear in the dropdown (e.g. add custom statuses, remove unwanted ones).

Plugin renamed to “Spotrebiteľské práva pre WooCommerce” (Consumer Rights for WooCommerce) — now covers both withdrawal from contract AND complaints under a single product.

Complaints (reklamácie) — entirely new functionality:

• New shortcode [complaint_form] (alias [reklamacia]) for the online complaint form.
• All fields matching the standard Slovak paper complaint form: buyer details (name, phone, e-mail, IBAN), product details (brand, model, serial, sale date, order number, invoice), defect description.
• Brand and model are optional — many products do not have a clear manufacturer label and the description of defect is what really matters.
• Separate “Order number” field on the complaint form. For logged-in customers with orders, the order dropdown writes the order number to a hidden input (no duplicate visible field). For guests (and logged-in users without orders), a visible “Order number” text input is shown.
• Optional photo upload of the defect (up to 5 photos, 5 MB each by default — configurable in settings).
• Drag & drop photo upload with live preview, file size info, and per-photo remove buttons.
• Secure photo handling — wp_handle_upload() with real MIME-type verification (JPG, PNG, WEBP, HEIC), random hash prefix on filenames, .htaccess protection against PHP execution, realpath safety check before any deletion.
• Photo files stored in /wp-content/uploads/oodz-reklamacie/YYYY/MM/.
• New DB table wp_oodz_reklamacie (21 columns + 3 indexes) — auto-created on plugin load via versioned upgrade routine.
• Rate limiting (max 3 complaint submissions per hour per IP) — anti-spam.

Admin — complaint management:

• Dedicated top-level admin menu “Spotrebiteľské práva” (Consumer Rights) with shield icon — replaces the previous scattered submenu items under WooCommerce. Three clean submenus: Withdrawals from contract, Complaints (reklamácie), Settings.
• Complaint list page with filter (by status), search (name, e-mail, invoice number, order number, complaint ID), pagination (20 / 50 / 100 / 200 per page).
• Complaint detail page split in two columns: Part 1 — buyer-filled data (read-only) and Part 2 — Reklamačný protokol form to be filled by the seller.
• Status pipeline: New → In progress → Resolved / Rejected, with coloured badges in the list.
• “Date resolved” is required when status is Resolved or Rejected — HTML5 required attribute, visual asterisk marker, JS toggles requirement on status change, plus server-side enforcement.
• Auto-fill “Date resolved” with today’s date when admin closes a complaint and the field is empty.
• Internal notes field (private) — visible only to admins, NOT included in print/PDF or in customer e-mails. Yellow “PRIVATE” badge in the UI.
• Photo display: larger thumbnails (140px), photo count badge, lazy loading, fallback “No photos attached” message. Photo count column in the list with badge.
• “Delete complaint” action on both the list (row action) and the detail page (title bar). Confirmation dialog before deletion. Permanently removes the DB row and any uploaded photos from disk (with realpath safety check). Success/warning notices after deletion.
• Optional “Send status update e-mail to customer” checkbox when saving the protocol.

Print / PDF:

• Printable A4 view of the complaint form (Part 1) + Reklamačný protokol (Part 2) on one page, with the legal text on 12-month rule and expert assessment. Uses browser-native print → “Save as PDF” (no bundled PDF library).
• Seller info appears in the header of both the online form and the printed protocol.

E-mails:

• HTML confirmation e-mail to the customer with submission date/time and 30-day legal deadline note.
• HTML notification e-mail to the shop owner with photo thumbnails and a direct link to the complaint detail page.
• Status update e-mail to the customer when the admin closes the complaint (optional, sent on demand).
• WP Cron daily check sends a deadline reminder e-mail to the admin 5 days before the 30-day legal deadline (i.e. for complaints 25+ days old that are still open). Each complaint triggers only one reminder. Cron event is cleanly unscheduled on plugin deactivation.

Settings — new “Údaje predávajúceho” section (used in form header + printed protocol):

• Hybrid: company name and address come from WooCommerce → Settings → General by default; override fields in plugin settings if needed.
• Additional legal fields: Business ID (IČO), Tax ID (DIČ), VAT ID (IČ DPH), correspondence address, phone.
• New complaint-specific settings: URL of the complaint form page, max photos per complaint, max photo size in MB.

UI / readability:

• Larger, more readable font sizes across both forms — title 26px, section titles 18px, inputs 16px, labels 15px. Pixel values used instead of rem to ensure consistent appearance across themes.
• Larger radio buttons and checkboxes (20px instead of 18px).
• More generous input padding (12 / 16 px instead of 10 / 14).
• Added tel, date, number, url input types to the styles selector — they no longer fall back to browser defaults.

Translations:

• All complaint and admin strings translated in all 6 supported languages: EN, SK, CS, HU, DE, PL.

Backward compatibility:

• Existing withdrawal-from-contract functionality is preserved without changes.
• Existing DB table wp_oodz_log is untouched.
• All existing options remain valid.

1.7.0

• Added: support for multiple admin notification e-mails — separate addresses with a comma
• Updated: Slovak translation now references Act No. 108/2024 Coll. on consumer protection (replaced Act No. 102/2014 Coll. effective 1.7.2024)
• Updated: tested up to WordPress 7.1 and WooCommerce 9.5
• Internal: new helper methods sanitize_emails_list() and get_admin_emails() for robust e-mail list parsing

1.6.0

• Added: admin-configurable “Custom notice / warning” field — shop owner can display product-specific warnings at the top of the form (e.g. exceptions from withdrawal right for personalized or hygiene products)
• Added: notice supports basic HTML formatting (bold, links, lists, paragraphs) and auto-paragraphing for plain text
• Added: notice text translatable in all supported languages

1.5.0

• Added: Polish (pl_PL) translation
• Added: clickable Privacy Policy link in the GDPR consent checkbox — uses WordPress native Privacy Policy page (Settings → Privacy)
• Updated: GDPR consent string in all translations (EN, SK, CS, HU, DE, PL) now contains a %s placeholder for the privacy policy link

1.4.3

• Changed: plugin name renamed to “Odstupenie od zmluvy pre WooCommerce” (fully Slovak) — primary target market is Slovakia

1.4.2

• Fixed: included compiled .mo translation files (previously only .po source files were shipped, so translations did not actually load)
• Fixed: remaining occurrence of old shortcode reference in admin help text

1.4.1

• Added: new English shortcode [withdrawal_form] (recommended)
• Kept: original [odstupenie_od_zmluvy] shortcode as backward-compatible alias — existing installations are not affected
• Updated: admin texts and readme now reference the new English shortcode

1.4.0

• Added: Full multilingual support — plugin is now translatable via standard WordPress gettext system
• Added: English (en_US), Slovak (sk_SK), Czech (cs_CZ), Hungarian (hu_HU), German (de_DE) translations included
• Added: All button labels, e-mails, error messages and admin UI fully translatable
• Added: JavaScript strings localized via wp_localize_script
• Changed: Source language changed to English (was Slovak) — required for WordPress.org translation platform
• Changed: Class strings and hardcoded labels wrapped in __() calls

1.3.1

• Added: order-number existence check before further validation
• Added: full HPOS compatibility — works with both HPOS and legacy WC without configuration
• Added: HPOS compatibility declaration via FeaturesUtil (green badge in WC)
• Added: HPOS-native query for postcode verification (billing_postcode column in HPOS)
• Added: helper find_order_by_number() for standard and custom order numbering
• Fixed: missing psc field in AJAX request (postcode fallback did not work)
• Fixed: plugin name and slug no longer contain the reserved “WC” prefix
• Fixed: class name no longer uses the WC_ reserved prefix
• Fixed: readme rewritten in English per WP.org guidelines
• Fixed: $_SERVER superglobals now use wp_unslash() before sanitization
• Fixed: admin log query now uses object caching

1.3.0

• Added: automatic 14-day withdrawal-period check (date_completed or date_created)
• Added: visual deadline information in the form — green / yellow / red banner
• Added: client and server-side form blocking after expiry
• Added: days-remaining counter directly in the order dropdown
• Added: My Account button auto-hides after 14 days from delivery

1.2.0

• Added: fallback postcode verification for guest customers
• Added: contact information setting for error messages
• Added: rate limiting — max 3 attempts per hour per IP
• Fixed: IDOR vulnerability — logged-in users can only submit their own orders
• Fixed: e-mail header injection in subject line
• Fixed: button wording matches the exact text of EU Directive 2023/2673

1.1.0

• Added: “Withdraw from contract here” button in My Account > Orders
• Added: form pre-fill from URL parameter ?objednavka=NUMBER
• Added: URL setting for the form page
• Added: informational message for non-logged-in customers

1.0.0

• Initial release — shortcode, form, e-mails, DB log, admin overview, base security