Spotrebiteľské práva pre WooCommerce

2.2.0

New: WooCommerce email integration, product-checkbox partial withdrawal, minified assets, smarter dashboard widget.

• Added: All 5 transactional e-mails are now registered as WooCommerce emails. They appear in WooCommerce → Settings → Emails and can be individually enabled/disabled, have their subject, heading and recipient customised, and use the shop’s native WC email header/footer styling.
  • Withdrawal — confirmation to customer
  • Withdrawal — notification to shop owner
  • Complaint — confirmation to customer
  • Complaint — notification to shop owner
  • Complaint — status update to customer
• Added: Product checkbox list for partial withdrawal — also works for guests. When a customer chooses “withdraw from selected products only” and has picked one of their orders from the dropdown, a list of products in that order is shown with checkboxes. Guests without an account can use the checkbox list too: once they type the order number and either the order’s billing e-mail or postcode, the products are loaded over a secured AJAX endpoint. The list of selected products is included in the e-mail to the shop owner — no more free-text guessing.
• Security: Guest order lookup verifies that the submitted e-mail OR postcode actually matches the order’s billing details. Failed lookups return a generic “not found” message (no order-number enumeration possible) and the endpoint is rate-limited to 10 lookups per hour per IP.
• Added: Refund amount preview — when “whole order” is selected, the customer sees the exact refund amount (matching the order total) so they know what to expect. Cash-on-delivery (unpaid) orders show a different note instead — there is nothing to refund yet, and the shop owner will agree the next steps with the customer.
• Added: Minified CSS & JS assets. Front-end assets now load as oodz-style.min.css / oodz-script.min.js. Full unminified versions are loaded automatically when SCRIPT_DEBUG is enabled (developer convenience).
• Improved: Dashboard widget now uses transient caching (5 min) for much faster admin loads, includes “Withdrawals this month” stat, and a “Recent complaints” list with quick links to detail pages. Defensive table-existence checks added so the widget never warns on fresh installs.
• Translations updated for all 6 supported languages.

2.1.0

New: data retention, GDPR tools, WC order linking, dashboard widget.

• Added: Auto-delete after X years setting in Consumer Rights → Settings (data retention). Once a day, complaints and withdrawals older than the configured threshold are automatically deleted, along with attached photos from disk. Default: 0 = disabled. Recommended for Slovakia: 5 years (statutory archival period for commercial records per Slovak law).
• Added: GDPR personal data export — plugin now hooks into WordPress native Tools → Export Personal Data. When a customer requests their data, all matching withdrawals and complaints are included automatically (grouped by type).
• Added: GDPR personal data erase — plugin hooks into WordPress native Tools → Erase Personal Data. Deleting a customer also removes their withdrawal records and complaints (including photos on disk, with realpath safety).
• Added: Link to WooCommerce order — if the order number in a complaint matches an existing WC order, the complaint detail page now shows a link to the order edit page with the order status badge, creation date and total. Helps admins jump quickly between complaint ↔ order.
• Added: Meta box on the WooCommerce order edit page — “🛡 Complaints (reklamácie)” sidebar widget showing all complaints filed against the current order, with status badges, dates and a short defect excerpt. Shows “No complaints filed for this order.” when there are none.
• Added: Dashboard widget “🛡 Consumer Rights — Overview” — shows at a glance: count of new complaints, in-progress, complaints with deadline ≤ 5 days, this month’s count, all-time totals. With quick links to the admin pages.
• Translations updated.

2.0.0

Major release — full complaint (reklamácia) functionality, dedicated admin menu, brand redesign.

Withdrawal form:

• Added: wc-pending (Awaiting payment) orders are now also shown in the withdrawal form order dropdown. Previously only completed / processing / on-hold orders appeared, which broke for shops with custom statuses or workflows where orders stay in pending state.
• Added: new filter hook oodz_withdrawal_order_statuses — themes/plugins can customize which statuses appear in the dropdown (e.g. add custom statuses, remove unwanted ones).

Plugin renamed to “Spotrebiteľské práva pre WooCommerce” (Consumer Rights for WooCommerce) — now covers both withdrawal from contract AND complaints under a single product.

Complaints (reklamácie) — entirely new functionality:

• New shortcode [complaint_form] (alias [reklamacia]) for the online complaint form.
• All fields matching the standard Slovak paper complaint form: buyer details (name, phone, e-mail, IBAN), product details (brand, model, serial, sale date, order number, invoice), defect description.
• Brand and model are optional — many products do not have a clear manufacturer label and the description of defect is what really matters.
• Separate “Order number” field on the complaint form. For logged-in customers with orders, the order dropdown writes the order number to a hidden input (no duplicate visible field). For guests (and logged-in users without orders), a visible “Order number” text input is shown.
• Optional photo upload of the defect (up to 5 photos, 5 MB each by default — configurable in settings).
• Drag & drop photo upload with live preview, file size info, and per-photo remove buttons.
• Secure photo handling — wp_handle_upload() with real MIME-type verification (JPG, PNG, WEBP, HEIC), random hash prefix on filenames, .htaccess protection against PHP execution, realpath safety check before any deletion.
• Photo files stored in /wp-content/uploads/oodz-reklamacie/YYYY/MM/.
• New DB table wp_oodz_reklamacie (21 columns + 3 indexes) — auto-created on plugin load via versioned upgrade routine.
• Rate limiting (max 3 complaint submissions per hour per IP) — anti-spam.

Admin — complaint management:

• Dedicated top-level admin menu “Spotrebiteľské práva” (Consumer Rights) with shield icon — replaces the previous scattered submenu items under WooCommerce. Three clean submenus: Withdrawals from contract, Complaints (reklamácie), Settings.
• Complaint list page with filter (by status), search (name, e-mail, invoice number, order number, complaint ID), pagination (20 / 50 / 100 / 200 per page).
• Complaint detail page split in two columns: Part 1 — buyer-filled data (read-only) and Part 2 — Reklamačný protokol form to be filled by the seller.
• Status pipeline: New → In progress → Resolved / Rejected, with coloured badges in the list.
• “Date resolved” is required when status is Resolved or Rejected — HTML5 required attribute, visual asterisk marker, JS toggles requirement on status change, plus server-side enforcement.
• Auto-fill “Date resolved” with today’s date when admin closes a complaint and the field is empty.
• Internal notes field (private) — visible only to admins, NOT included in print/PDF or in customer e-mails. Yellow “PRIVATE” badge in the UI.
• Photo display: larger thumbnails (140px), photo count badge, lazy loading, fallback “No photos attached” message. Photo count column in the list with badge.
• “Delete complaint” action on both the list (row action) and the detail page (title bar). Confirmation dialog before deletion. Permanently removes the DB row and any uploaded photos from disk (with realpath safety check). Success/warning notices after deletion.
• Optional “Send status update e-mail to customer” checkbox when saving the protocol.

Print / PDF:

• Printable A4 view of the complaint form (Part 1) + Reklamačný protokol (Part 2) on one page, with the legal text on 12-month rule and expert assessment. Uses browser-native print → “Save as PDF” (no bundled PDF library).
• Seller info appears in the header of both the online form and the printed protocol.

E-mails:

• HTML confirmation e-mail to the customer with submission date/time and 30-day legal deadline note.
• HTML notification e-mail to the shop owner with photo thumbnails and a direct link to the complaint detail page.
• Status update e-mail to the customer when the admin closes the complaint (optional, sent on demand).
• WP Cron daily check sends a deadline reminder e-mail to the admin 5 days before the 30-day legal deadline (i.e. for complaints 25+ days old that are still open). Each complaint triggers only one reminder. Cron event is cleanly unscheduled on plugin deactivation.

Settings — new “Údaje predávajúceho” section (used in form header + printed protocol):

• Hybrid: company name and address come from WooCommerce → Settings → General by default; override fields in plugin settings if needed.
• Additional legal fields: Business ID (IČO), Tax ID (DIČ), VAT ID (IČ DPH), correspondence address, phone.
• New complaint-specific settings: URL of the complaint form page, max photos per complaint, max photo size in MB.

UI / readability:

• Larger, more readable font sizes across both forms — title 26px, section titles 18px, inputs 16px, labels 15px. Pixel values used instead of rem to ensure consistent appearance across themes.
• Larger radio buttons and checkboxes (20px instead of 18px).
• More generous input padding (12 / 16 px instead of 10 / 14).
• Added tel, date, number, url input types to the styles selector — they no longer fall back to browser defaults.

Translations:

• All complaint and admin strings translated in all 6 supported languages: EN, SK, CS, HU, DE, PL.

Backward compatibility:

• Existing withdrawal-from-contract functionality is preserved without changes.
• Existing DB table wp_oodz_log is untouched.
• All existing options remain valid.

1.7.0

• Added: support for multiple admin notification e-mails — separate addresses with a comma
• Updated: Slovak translation now references Act No. 108/2024 Coll. on consumer protection (replaced Act No. 102/2014 Coll. effective 1.7.2024)
• Updated: tested up to WordPress 7.1 and WooCommerce 9.5
• Internal: new helper methods sanitize_emails_list() and get_admin_emails() for robust e-mail list parsing

1.6.0

• Added: admin-configurable “Custom notice / warning” field — shop owner can display product-specific warnings at the top of the form (e.g. exceptions from withdrawal right for personalized or hygiene products)
• Added: notice supports basic HTML formatting (bold, links, lists, paragraphs) and auto-paragraphing for plain text
• Added: notice text translatable in all supported languages

1.5.0

• Added: Polish (pl_PL) translation
• Added: clickable Privacy Policy link in the GDPR consent checkbox — uses WordPress native Privacy Policy page (Settings → Privacy)
• Updated: GDPR consent string in all translations (EN, SK, CS, HU, DE, PL) now contains a %s placeholder for the privacy policy link

1.4.3

• Changed: plugin name renamed to “Odstupenie od zmluvy pre WooCommerce” (fully Slovak) — primary target market is Slovakia

1.4.2

• Fixed: included compiled .mo translation files (previously only .po source files were shipped, so translations did not actually load)
• Fixed: remaining occurrence of old shortcode reference in admin help text

1.4.1

• Added: new English shortcode [withdrawal_form] (recommended)
• Kept: original [odstupenie_od_zmluvy] shortcode as backward-compatible alias — existing installations are not affected
• Updated: admin texts and readme now reference the new English shortcode

1.4.0

• Added: Full multilingual support — plugin is now translatable via standard WordPress gettext system
• Added: English (en_US), Slovak (sk_SK), Czech (cs_CZ), Hungarian (hu_HU), German (de_DE) translations included
• Added: All button labels, e-mails, error messages and admin UI fully translatable
• Added: JavaScript strings localized via wp_localize_script
• Changed: Source language changed to English (was Slovak) — required for WordPress.org translation platform
• Changed: Class strings and hardcoded labels wrapped in __() calls

1.3.1

• Added: order-number existence check before further validation
• Added: full HPOS compatibility — works with both HPOS and legacy WC without configuration
• Added: HPOS compatibility declaration via FeaturesUtil (green badge in WC)
• Added: HPOS-native query for postcode verification (billing_postcode column in HPOS)
• Added: helper find_order_by_number() for standard and custom order numbering
• Fixed: missing psc field in AJAX request (postcode fallback did not work)
• Fixed: plugin name and slug no longer contain the reserved “WC” prefix
• Fixed: class name no longer uses the WC_ reserved prefix
• Fixed: readme rewritten in English per WP.org guidelines
• Fixed: $_SERVER superglobals now use wp_unslash() before sanitization
• Fixed: admin log query now uses object caching

1.3.0

• Added: automatic 14-day withdrawal-period check (date_completed or date_created)
• Added: visual deadline information in the form — green / yellow / red banner
• Added: client and server-side form blocking after expiry
• Added: days-remaining counter directly in the order dropdown
• Added: My Account button auto-hides after 14 days from delivery

1.2.0

• Added: fallback postcode verification for guest customers
• Added: contact information setting for error messages
• Added: rate limiting — max 3 attempts per hour per IP
• Fixed: IDOR vulnerability — logged-in users can only submit their own orders
• Fixed: e-mail header injection in subject line
• Fixed: button wording matches the exact text of EU Directive 2023/2673

1.1.0

• Added: “Withdraw from contract here” button in My Account > Orders
• Added: form pre-fill from URL parameter ?objednavka=NUMBER
• Added: URL setting for the form page
• Added: informational message for non-logged-in customers

1.0.0

• Initial release — shortcode, form, e-mails, DB log, admin overview, base security