ConferenceManager

Rexistro de cambios

1.2.4

• Fixed: a shortcode naming a view that only exists in the Pro edition — for example [conf_manager view=”reviewer-apply”] or view=”sponsors” — quietly displayed the attendee registration form instead. Anyone opening what was meant to be a reviewer application or a sponsor listing could submit a registration, and it was recorded as a real one. Those views now stop instead of falling back, and a note explaining why is shown to users who can edit the page. A mistyped view name still falls back to the registration form, as before.
• Fixed: the one-time code for My Page was limited to 3 requests per hour per IP address, with a one hour lockout. At a university, a company or a conference venue, where many people share a single public IP address, the fourth person to request a code locked everyone out for an hour. Because the send itself was refused, no code arrived and the cause was invisible from the organiser’s side. The limit is now 50 per hour with a ten minute lockout, while the existing per-address limit of 5 per hour continues to stop abuse aimed at one mailbox.

1.2.3

• Fixed: exporting members to CSV returned at most 100 rows. The export asked for up to 10,000, but the underlying search caps a request at 100, so the file was silently short — it looked like a complete export. It now pages through every matching record. If an export ever reaches the 20,000 row safety limit, the file says so on its last line instead of ending quietly.
• Fixed: lists that page through records were ordered by a value that repeats — the date a record was created, or an event’s start date. Rows sharing that value have no guaranteed order between pages, so a record could appear twice or be passed over. Every paged list now falls back to the record id, which is unique.
• Fixed: after a successful encryption key rotation the plugin still warned that data could not be read, because it kept comparing against the previous key. The warning is now cleared when the rotation completes with no errors — and deliberately kept when any record failed, since that is exactly when the warning is worth seeing.

1.2.2

• Fixed: the encryption key warning told every site to restore the key in wp-config.php, even when the key was never kept there. Sites installed with the default settings keep an automatically generated key in the database instead, so that advice sent administrators looking for something that was not there. The warning now says where the key actually is.
• Fixed: in the most common way this warning appears — adding the CONF_MANAGER_ENCRYPTION_KEY constant to wp-config.php on a site that had been running on the automatically generated key — the previous key is still held in the database, and the warning now says so and how to put it back. That case is fully recoverable in one step; it previously read as though the data were lost.
• Security: dismissing the encryption key warning now requires submitting the form’s button. It was previously a link, and a link that changes state can be followed by a browser or extension prefetching it, which would have moved the reference point forward and removed the warning without anyone clicking it — erasing the only sign that the key had changed. Requests that are not form submissions are refused.
• Fixed: the key rotation routine paged through records by position rather than by record, while updating those same records as it went. Nothing guaranteed the order between pages, so a record could be passed over and left encrypted with the previous key. It now advances by record id, and stops if a page fails to advance.

1.2.1

• Security: the plugin now notices when the encryption key changes and says so in the admin area. Personal data encrypted with the previous key cannot be read until that key is restored — the data is intact, but nothing in the plugin can recover it on its own, so the warning appears while the mistake is still easy to undo. Only a hash of the key is stored; the key itself never is.
• Fixed: the key rotation routine skipped any table without a “status” column and still reported success, which would have left some records readable only with the old key.
• The Setup screen no longer claims that encrypted data is unreadable if the database is compromised, regardless of where the key is kept. That is true only when the key is defined in wp-config.php. With the default automatic key, the key lives in the same database as the data, and the screen now says so.
• The readme’s answer on personal data protection now states which key location is recommended and why, that a key shorter than 16 characters is ignored, and that adding or changing the key after data has been stored makes existing data permanently unreadable.
• Removed unused code that generated a fresh encryption key. It was never reachable, but wiring it up would have made existing encrypted data unrecoverable.

1.2.0

• New: a “What’s New” screen under the Conference menu, listing what this plugin can do — newest additions first, with the version each one arrived in — followed by what the separately distributed Pro edition adds. The screen is static: it renders no images, makes no external requests, and stores nothing.
• The readme now states plainly that a separate Pro edition exists. This plugin is unchanged in what it does: every feature it ships remains fully functional, and none of the Pro edition’s code is included in this package.

1.1.12

• Fix: sites that had already skipped a database upgrade are now repaired. Before 1.1.11, activating the plugin recorded the schema version without running the pending upgrades, which left the recorded version up to date while the data was not. Because the version already looked current, 1.1.11 alone could not detect or repair those sites. This release re-runs the 1.1.9 and 1.1.10 data upgrades once, so the amount actually received is filled in and refunds made before 1.1.9 are moved into the settlement ledger. Both steps only touch rows that were never migrated, so sites that are already correct are left untouched.
• Database schema auto-upgrades to v3.4.0.

1.1.11

• Fix: pending database migrations were skipped when the plugin was updated by deactivating it, replacing the folder and activating it again. Activation stamped the schema version without running the migrations, so the upgrade steps introduced in 1.1.9 and 1.1.10 never ran on those sites. Activation now runs them. This stops the problem from happening again, but it does not recover a site that had already skipped a migration — see 1.1.12, which does. Sites updated through the normal WordPress plugin updater were never affected.

1.1.10

• Fix: refunds issued before the settlement ledger was introduced in 1.1.9 were not counted, so the net amount received was overstated by the refunded amount and the payment could be shown as fully settled. Those refunds are migrated into the ledger on upgrade. A full refund is migrated using the amount actually received, because full refunds recorded before 1.1.9 stored only the tax-exclusive amount.
• Fix: a payment that has been refunded in full is no longer reported as needing a surcharge. A full refund cancels the registration, so the billed amount is no longer outstanding and the payment now counts as settled. Partial refunds are unchanged and are still settled against the difference.
• Fix: uploading or deleting an abstract template on the event screen did nothing because of a missing script import.
• Database schema auto-upgrades to v3.3.0.

1.1.9

• Payments: the billed amount and the amount actually received are now tracked separately. When confirming a payment you can record the real amount received (for example when a bank transfer fee was deducted) together with a handover note for the reception desk or accounting. The payment list gains Billed, Paid and Difference columns and highlights rows that still need attention.
• Payments: a single “Settle” dialog replaces the old refund dialog and covers all four cases — refunding the difference, collecting a surcharge, refunding in full and cancelling the registration, and correcting a mis-recorded paid amount. Refunds and surcharges are kept as a dated ledger with the method and the staff member who handled them, and are reflected in the event totals.
• Participants: a registration’s fee category can now be corrected after payment has been received. The billed amount is updated while the amount actually received is left untouched, so the resulting difference is surfaced as “Refund due” or “Surcharge due” instead of being silently lost. Receipts that were already issued are regenerated under the same receipt number.
• Participants: the list is now scoped to a single event (defaulting to the most recent one), shows status and settlement badges, and consolidates category correction and status changes into one “Edit / Payment” dialog.
• Fix: full refunds are now calculated on the tax-inclusive amount actually received. Previously a full refund recorded only the tax-exclusive amount, so a ¥8,800 payment was recorded as an ¥8,000 refund while Stripe refunded the full ¥8,800.
• Fix: payments reconciled before this release, which carry no recorded paid amount, have it backfilled from the billed amount on upgrade. Without this, correcting a fee category would move the substituted value along with the billed amount and a needed refund would never be detected.
• CSV export gains paid amount, refund, surcharge, net paid, difference and handover-note columns, and no longer quotes plain numbers so they open as numbers in Excel.
• Payment confirmation emails now show the billed amount and the amount received side by side.
• Database schema auto-upgrades to v3.2.0.
• Updated the bundled Japanese translation for the new strings.

1.1.8

• Improve: email verification (OTP) and My Page login-code emails now include the sender site name, purpose, and a contact footer (taken from your site settings) instead of a bare code. This reduces the chance of the message being flagged as phishing and rejected or spam-foldered by strict mail providers (e.g. Yahoo! Japan).

1.1.7

• Fix: editing and saving a member who has no member number no longer fails with “Failed to update member.” Previously, when two or more members had no member number, saving the second such member triggered a unique-key conflict on an empty member number. Empty member numbers are now stored as NULL (consistent with member creation), so any number of members can be saved without a member number.
• Members: added a little more spacing between each field label and the control above it in the New/Edit Member dialog for easier reading.

1.1.6

• Receipts: participants can now edit the addressee name and company/department of their receipt from My Page and have the PDF reissued under the same receipt number (so only one valid receipt ever exists). Useful when payment was made under a company, workplace or family name. Ownership is verified before editing, and the proviso text is unchanged.
• Registrations: added an optional bank-transfer name note field, so a participant paying by bank transfer under a different account name (for example a company or family member) can tell the organizer the name the transfer will arrive under. It is shown to administrators on the Participants and Payments screens and is never printed on the receipt.
• Updated the bundled Japanese translation for the new strings.

1.1.5

• Notifications: the recipient for the new-registration admin notice is now configurable on the Setup screen. You can enter one or more addresses (comma-separated); leaving it blank falls back to the WordPress admin email. The notice is enabled by default and includes a link to the admin dashboard while keeping personal contact details out of the email body.
• Participants: administrators can now correct a registration’s fee category and on-site/online participation type from the Participants screen. The fee, tax, label and status are recalculated automatically; a pending payment amount and any issued invoice are kept in sync. Editing is limited to unpaid (pending/confirmed) individual registrations.
• Fix: the admin screen no longer goes blank when publishing a newly created event (and similar actions). A display-error boundary now recovers gracefully with a reload prompt instead of a white screen.
• Updated the bundled Japanese translation for the new strings.

1.1.4

• Free events: registrations whose total is ¥0 are now confirmed automatically (no payment record is created, and the confirmation email omits the bank-transfer details). Applies to both individual and group registrations.
• Event editor: fee fields now accept and keep a value of 0 (previously 0 was cleared to blank), with a placeholder and a note clarifying that blank or 0 means free. Added a delete button for custom fee types in the on-site fee table.
• Safety: uninstall now keeps your data by default, and a duplicate-load guard prevents fatal errors when an older copy of the plugin remains installed in another folder.

1.1.3

• Internationalization: the plugin source language is now English. All user-facing strings in the PHP backend and the React admin/registration screens use English source text with __()/_e() and the conferencemanager text domain, so the plugin can be translated into any language via translate.wordpress.org. The bundled Japanese translation (languages/conferencemanager-ja.po/.mo and the React translation JSON) provides the complete Japanese UI as before.

1.1.2

• Plugin Review feedback response (from the v1.1.1 submission):
  • Trialware: removed all online-meeting (Zoom/Meet/Teams) and Peatix integration fields from the core plugin (database columns, admin UI, REST handling and documentation). These belong to separately distributed add-ons; the core plugin no longer ships any locked or skipped feature code. On-site/online participation fee tiers remain fully functional.
  • Third-party libraries: removed the unused chillerlan/php-qrcode and web-auth/webauthn-lib dependencies (passkey support is implemented with native PHP), updated stripe/stripe-php to 20.2.0, and updated the bundled setasign/fpdi to 2.6.7 (security advisory CVE-2026-45802).
  • Writable data location: downloaded/uploaded PDF fonts are now stored under wp-content/uploads/conf-manager/fonts/ instead of inside the plugin folder, so plugin updates and read-only installs are unaffected.
  • REST API: the public fee-calculation endpoint (/public/events/{id}/fee) now returns 404 for non-published events, matching the event-detail endpoint, so unpublished pricing is never exposed.

1.1.1

• Plugin Review feedback response (from the v1.1.0 submission):
  • Source code: the React/JSX source for the compiled build/admin-app.js and build/public-app.js bundles is now shipped inside the plugin (src/), together with the build configuration (webpack.config.js, package.json, package-lock.json). See the new “Development / Building from source” section.
  • Core files: moved require_once ABSPATH . 'wp-admin/includes/file.php' so it immediately precedes the download_url() / wp_handle_upload() call that needs it.
  • REST API: token-authenticated public endpoints (MyPage, my registrations, group staff, email preferences, logout) now validate the CSRF token and session token in their permission_callback.
  • Privacy: the public email-based member existence check no longer returns any personal data (name); it returns only an existence flag and non-identifying metadata, protected by combined IP + email rate limiting.
  • Removed HEREDOC syntax: the default Terms-of-Service content is now rendered from a template partial via output buffering (templates/default-terms-content.php).
• Fix: The “fonts not installed” admin notice linked to the wrong page slug, causing a “you do not have permission” error; it now opens the Dashboard correctly.
• Improvement: PDF fonts (IPAex Gothic / Mincho) are now downloaded from the plugin author’s own mirror (with automatic retry), and a manual .ttf upload option was added to the Dashboard for servers that cannot reach the download host. The download URL is filterable via conf_manager_font_source_url.

1.1.0

• Plugin Review feedback response (from the initial v1.0.3 submission):
  • Removed optional paid add-on gating; all features included in this plugin are fully functional and free.
  • Removed inline <style> tags from PDF templates; PDF stylesheets are now loaded from dedicated CSS files.
  • Added Stripe payment integration (requires the site administrator’s own Stripe API keys).
  • Documented all external services (Stripe, IPA fonts) in the External Services section below.
  • Audited every REST API route to ensure permission_callback is set appropriately for the route’s access requirements.
  • Removed load_plugin_textdomain() (translations are now loaded automatically by WordPress).
  • Added composer.json to the distribution package.
• New: Email opt-in/opt-out feature for compliance with the Japanese Anti-Spam Email Act.
• New: “Email Preferences” tab in the member’s MyPage.
• New: RFC 8058 compliant List-Unsubscribe header linking to MyPage.
• Fix: Unified text domain to conferencemanager; added translators comments and phpcs:ignore comments for safe dynamic SQL queries.
• Database: Schema upgraded to v3.0.0; unused add-on tables are no longer created.

1.0.3

• Initial submission to the WordPress.org plugin directory.