XTX Integration for Netatmo

Changelog

1.9.7

• New: the order of the live cards and of the yearly comparison charts is a setting. Both lists on the Live-Dashboard screen are sortable by drag and drop, and the front end follows. A saved order decides position, never membership: an id left over from a renamed module is passed over, and a chart the order has never heard of takes its place at the end instead of disappearing.
• New: [naws_calc] — one shortcode for twenty-seven computed values in four kinds. Fourteen instant values (dew point, apparent temperature, wet-bulb temperature, heat index, thermal sensation, CO2 rating, wind compass, sunrise, sunset, day length, moon phase and illumination, next supermoon, next lunar eclipse), seven day classes with mode="count|streak|max_streak" (ice days, frost days, summer days, hot days, tropical nights, heating and cooling days), five sums (heating and cooling degree days, growing degree days, the grassland temperature sum and the date the growing season started) and the Standardized Precipitation Index.
• New: the admin shows the state of the encryption — a missing openssl extension, a missing aes-256-gcm, an AUTH_KEY still set to the sample value from wp-config-sample.php, and changed WordPress salts. A fingerprint of the key sits beside the ciphertext so a salt change is recognizable as one instead of looking like a broken plugin.
• New: the header bar and the font are settings now. The font list offers only fonts your page already serves — the plugin loads no font file of its own.
• New: three settings for the degree-day limits: heating limit, room temperature and cooling limit.
• Changed: breaking — the REST API accepts its key in the X-NAWS-Key header only. A secret in the address line is written down by access logs, the Referer header, the browser history and every cache in between. Calls of the form ?api_key=... now answer 401. If you use the API, switch before you update.
• Changed: the cron settings and the cron log now say what WP-Cron does not do. WP-Cron is triggered by page views, not by a clock, so on a quiet night no sync happens at all.
• Fix: a five-second hiccup at Netatmo cost a whole ten-minute polling cycle. Requests are retried now, and an error without an error code is no longer handed back as an empty result.
• Fix: a server without the openssl extension died on the first read of a token, and an unauthenticated REST request could turn a 401 into a fatal 500.
• Fix: the apparent temperature ignored wind chill, and the heat index was computed outside the range it is defined for.
• Fix: the next supermoon, the next lunar eclipse and the next full moon were dated in German whatever the site language was.
• Fix: an uppercase MAC address in [naws_value module="..."] matched nothing, and an emptied degree-day limit field silently stored 0 degrees.
• Fix: this readme advertised five shortcodes and documented six. Ten are registered; all ten are listed now.
• Security: the REST API key page created and revoked keys on POST with a nonce check but no capability check of its own. The page is reachable only with manage_options, so nothing stood open — it is the pattern the review team warned about, and the check now runs before the nonce is spent.

1.9.6.2

• Fix: the “Tested up to” header now names WordPress 7.1, in readme.txt and in the plugin header. No code changed from 1.9.6.1.

1.9.6.1

• Security: the OAuth return route verified the OAuth state but not the caller’s permission. NAWS_Admin::handle_oauth_callback() runs on admin_init, receives Netatmo’s redirect and exchanged the code for an access and a refresh token — for whoever happened to be logged in. The state proves that the request belongs to a flow started on this site; it says nothing about who follows the redirect, and Netatmo returns the code to one fixed URL. current_user_can( 'manage_options' ) now runs at the top of the method, before the state is read, so a request without the permission cannot consume the pending authorization either. Reported by the WordPress plugin review team.
• Security: removed a second acceptance path in the same check. A state that did not match was also accepted as wp_verify_nonce( $state, 'naws_oauth' ) — a nonce that no code in the plugin ever created. The check is a single condition now, and a state that does not match ends the request.

1.9.6

• Changed: the plugin no longer outputs any inline script. The boot code for the live dashboard and the history charts now ships as two ordinary JavaScript files that are enqueued the WordPress way. This also removes the reason the 1.9.3 workaround existed: an enqueued file cannot be silently dropped the way an inline fragment can. The JavaScript itself is unchanged, and several shortcodes on one page now share a single copy of it.

1.9.5

• Fix: the User-Agent sent to the Yr.no / MET Norway forecast API named a repository that does not exist, and three other outgoing requests named no contact at all. MET Norway’s terms require every client to identify itself with a reachable contact. All requests now send the plugin name, its version and your site address.
• Fix: the Netatmo privacy policy link in this readme was dead and has been replaced. The Netatmo entry also gained a terms of service link and now states that the Client ID and Client Secret are sent to the token endpoint.
• New: a Third-Party Libraries section documenting the two bundled JavaScript libraries (Chart.js and chartjs-adapter-date-fns), their MIT licenses and where to get their unminified source.
• New: the Open-Meteo geocoding service is now documented separately from the forecast service. It is a different host and had no entry of its own.
• Changed: the shipped LICENSE file is now GPL v2, matching the “GPLv2 or later” stated in the plugin header and this readme. The license itself is unchanged.
• Changed: removed a source map reference at the end of the bundled Chart.js file that pointed at a file the package never contained.

1.9.4

• Changed: the database migration that adds the v1.4 sensor columns no longer assembles its SQL from variables. The column names came from a hardcoded list and were never user input, but Plugin Check’s security scanner cannot verify that and flagged the query. Every ALTER TABLE statement is now written out in full, which leaves nothing to flag.
• Changed: that migration checked for each of its eight columns with a separate query. It reads the column list once now. The migration only runs on activation and upgrade, so this changes nothing you would notice.

1.9.3

• Fix: the history charts stayed empty on some setups. The chart data and the chart script were injected with wp_add_inline_script(), which is silently dropped on those installations, so nothing at all was rendered. Both now use the same reliable pattern the live dashboard already used: a plain JSON data element plus a footer script block.
• Changed: the year buttons in the history charts sit below their chart instead of beside the title. They now use the full chart width and wrap over as many rows as needed, so stations with ten or more years of records no longer push the buttons out to the right. The enlarged chart view follows the same layout.
• Fix: hiding a year from the enlarged chart view left the corresponding button in the small chart looking active, even though the chart below had already dropped that year. Both legends are refreshed together now.

1.9.2

• Fix: repeated API errors made the plugin poll harder rather than easing off. The interval is meant to double after three failures, but the ceiling on that calculation sat below the longest intervals the settings offer, so a 120-minute interval was halved and a 60-minute one never changed at all.
• Fix: a cron interval that is not one of the available schedules stopped polling completely. The field accepted any value from 5 to 1440 minutes while only seven of them exist as schedules, and an unlisted value such as 45 left the site with no fetch cron. The interval is a dropdown now, and stored values are snapped to the nearest schedule.
• Fix: night mode stopped reducing polling as soon as the API had trouble, because it measured from the last successful sync rather than the last attempt.
• Fix: the dashboard warned about a stale sync during normal night operation. The warning threshold now accounts for the doubled night interval.
• Changed: night mode, daily summaries and the history importer now use the timezone configured in WordPress instead of Europe/Berlin. On sites in other timezones the night window fell on the wrong hours and daily boundaries could be cut at the wrong midnight.
• Changed: the error backoff is described under the interval setting rather than on the night mode checkbox. It applies regardless of night mode.

1.9.1

• Changed: the settings screen has been reorganised. The connection card now spans the full width and the settings below sit in two balanced columns, so the forecast settings are visible near the top instead of at the bottom. The page is around 600 pixels shorter and no longer has a large empty area beside the connection card.
• Changed: one save button for all settings instead of three. The API credentials keep their own form and button.
• Fix: every save rewrote every setting. Each form carried hidden copies of the fields it did not own, a leftover from before the merge behaviour added in 1.7.0. Saving the units also rewrote the forecast settings and credentials from stale values, so edits made in a second browser tab could be lost. A save now only touches the fields shown in that form.
• Fix: the decrypted client secret was written into the page three times instead of once, and was submitted when saving unrelated settings.

1.9.0

• New: the sidebar widget’s width can be set between 250 and 500 pixels, in Appearance or per placement with [naws_weather_widget width="400"]. Icon, figures and spacing scale with it — at 500 pixels the weather icon is 96 pixels instead of 64. The width acts as a maximum, so the widget still shrinks to fit a narrower column.
• Fix: the weather icon at the head of the sidebar widget was frozen. It was rendered through the same call as the small forecast icons, which are deliberately still, and inherited their frozen state. It now animates, while the forecast icons stay still as intended.

1.8.3

• Fix: the Norwegian interface was only half translated. Norwegian arrived with 326 keys and the plugin has since grown to 612, so everything added later — the forecast, the REST API documentation, the shortcode reference and the live dashboard settings — stayed in English. All 272 missing strings are now translated into Bokmal.

1.8.2

• Fix: the shortcode reference in the backend showed the wrong descriptions. A leftover block of duplicate entries in the language files overrode the detailed ones, and the entry for [naws_history] actually described [naws_table].
• Security: input sanitization on the appearance settings form is now applied directly to the submitted data instead of through an intermediate variable, so automated review tools can see it. The data was sanitized before as well; only the form of the code changed.
• Changed: redirect URLs are built with RFC 3986 encoding.

1.8.1

• Fix: the weather icon showed “overcast” under a cloudless sky. The forecast provider’s weather code lumps all cloud layers together, so a thin veil of cirrus counted the same as a low, closed deck. Cloudiness is now read from the cover percentage per layer, with high cloud weighted down — a cirrus sky reads as fair, not overcast.
• Fix: the corrected cloud figures are also kept as the last known reading, so an outage of the forecast API no longer brings the old behaviour back.

1.8.0

• New: sidebar widget [naws_weather_widget] — weather icon, outdoor temperature, rain and wind, plus a three- or five-day forecast, built for narrow columns
• New: forecast length selectable in the backend, with a live preview at the real width
• Changed: the colourful weather icons introduced in 1.7.0 are now used everywhere, including the forecast shortcode and the dashboard forecast strip
• Fix: saving settings on the Appearance page no longer redirects to Settings — forms now return to the page they were submitted from

1.7.0

• New: animated weather icon with twelve states — shortcode [naws_weather_icon size="96"] and, switchable in the backend, above the live dashboard
• New: the icon combines station readings with the forecast — your own measurements win, the forecast only fills in what the station cannot measure (cloud cover, thunderstorms, and precipitation if you have no rain gauge)
• New: rain-versus-snow is decided by wet-bulb temperature rather than air temperature, so snow is still recognised at 3–4 °C in dry air
• New: six thresholds in the settings (heavy rain, snow, fog humidity and spread, storm wind, dashboard placement)
• New: current conditions are fetched separately from the daily forecast, on a 30-minute cache, so the icon reflects the weather now instead of a whole-day summary
• Fix: saving one settings form no longer resets the others — saving your Netatmo credentials used to silently reset language, units, sync interval and all forecast settings back to their defaults
• Fix: REST API routes were not running their authentication callback — with the REST API enabled the endpoints, including station coordinates, were reachable without an API key

1.6.5

• Compatibility: tested against WordPress 7.0
• Compatibility: minimum PHP requirement raised to 8.0 (Requires PHP: 8.0)
• Fix: history chart no longer emits a PHP 8.1 deprecation notice (substr(): Passing null) when the daily-summary table is still empty — the year range now falls back to the current year instead of year 0

1.6.4

• Fix: $file['size'] in import handler now wrapped in intval() for explicit sanitization (WordPress.org compliance)
• Fix: SHOW COLUMNS query in class-naws-astro.php now uses $wpdb->prepare() consistently with the rest of the codebase
• Fix: naws_svg_kses_args() helper properly available at plugin load time; resolves fatal error on admin dashboard when function was called before class-naws-helpers.php was loaded

1.6.3

• WordPress.org compliance: all file-scope ob_start() / ob_get_clean() patterns removed from admin views and frontend templates
• WordPress.org compliance: PHP values injected into inline scripts via wp_add_inline_script( $handle, $data, 'before' ) with wp_json_encode() instead of echoing PHP inside JS blocks
• WordPress.org compliance: all JS strings previously echoed from PHP now served via nawsAdmin.strings (localized with wp_localize_script) – eliminates PHP interpolation in JavaScript
• WordPress.org compliance: icon SVGs sanitized with wp_kses() before JSON-encoding; NAWS_Icons::get_js_object() (raw JS literal) replaced by wp_json_encode( NAWS_Icons::get_set() )
• Added ls_saving, ls_saved, ls_error strings to nawsAdmin localization (live-settings page)

1.6.2

• WordPress.org compliance: file upload sanitized with sanitize_file_name() and move_uploaded_file()
• WordPress.org compliance: all ob_start() blocks closed with ob_get_clean() in same scope
• WordPress.org compliance: all remaining inline <script>/<style> blocks converted to wp_add_inline_script() / wp_add_inline_style()
• WordPress.org compliance: dynamic SQL column names validated against explicit whitelist before query execution
• Fix: phpcs annotation for naws_appearance input sanitization made explicit (sanitized via NAWS_Colors::sanitize())

1.6.0

• WordPress.org compliance: all inline <script> blocks converted to wp_add_inline_script()
• WordPress.org compliance: all inline <style> blocks moved to enqueued stylesheet
• WordPress.org compliance: plugin renamed to “XTX Integration for Netatmo” (trademark)
• WordPress.org compliance: removed direct <script src> for Chart.js in frontend templates
• Updated Chart.js vendor from 4.4.0 to 4.5.1
• REST API docs: replaced Google Charts CDN example with bundled Chart.js example
• Fix: AJAX capability-check failures now return proper JSON 403 instead of plain wp_die()
• Fix: privacy policy URL in readme.txt corrected

1.5.7

• Removed GitHub Auto-Updater (WordPress.org compliance – hosted plugins must not include custom updaters)
• Fix: move_uploaded_file() replaced with copy() (WordPress Coding Standards)
• Fix: rand() replaced with wp_rand()
• Fix: SVG output escaping documented with phpcs:ignore
• Fix: 361 NonPrefixedVariableFound warnings resolved with scoped phpcs disable

1.5.6

• Security: Client ID and Client Secret now AES-256-GCM encrypted at rest (all 5 secrets fully encrypted)
• Migration updated to encrypt plaintext credentials instead of forcing plaintext
• Removed legacy plaintext-enforcement from init

1.5.5

• Fix: Escaping fixes for admin views (esc_attr() in modules.php, cron-log.php)
• Fix: readme.txt stable tag synchronized with plugin header version
• Fix: Option name inconsistency naws_token_expires unified to naws_token_expiry

1.5.4

• Fix: History chart year buttons now wrap on mobile instead of overflowing
• Fix: 24h chart modal overlay positioned correctly inside .naws-wx wrapper

1.5.3

• Fix: Auto-update toggle now visible in WordPress plugin list (registered in $transient->no_update)

1.5.2

• Fix: Plugin URI corrected to https://www.frank-neumann.de/netatmo-wetter-plugin/

1.5.1

• Fix: Dashboard SVG icons no longer rendered as raw source code

1.5.0

• New: GitHub Auto-Updater via NAWS_Updater class (later removed in 1.5.7 for WordPress.org compliance)

1.4.3

• Plugin renamed: “Netatmo Weather Station” to “XTX Netatmo”
• New: 4 frontend icon sets (Emoji, Outline, Filled, Minimal) selectable in Appearance
• New: Per-sensor icon colors with live preview (7 configurable colors)
• New: Dynamic icon rendering via NAWS_Icons class

1.4.2

• Fix: Forecast provider selection now works correctly (provider-aware cache keys)
• Fix: Forecast source label dynamically shows correct provider name
• New: History shortcode year parameter ([naws_history year="2025"])
• Improved: Appearance admin page streamlined, unused sections removed

1.4.1

• Fix: 24h chart gradient fill restored (hex-to-RGBA conversion with canvas gradient)
• Improved: Appearance page redesigned with live previews for all color groups

1.4.0

• New: Appearance page with 130+ configurable colors and WordPress Color Picker
• New: NAWS_Colors class with centralized color management and caching
• New: Theme colors, accent colors, sensor tile gradients, chart theming, year palette
• New: Reset-to-defaults functionality
• New: 60+ translation strings for color settings
• Improved: All frontend colors use CSS custom properties

1.3.0

• New: Export / Import feature with full backup and restore
• New: Weather data export as JSON, full backup export (data + modules + settings)
• New: File import with chunked AJAX processing and real-time progress
• Security: API tokens are never included in exports
• New: NAWS_Export class with streaming export for large datasets

1.2.1

• Fix: All json_encode() replaced with wp_json_encode() (Plugin Check compliance)
• Fix: SQL injection hardening with $wpdb->prepare() for DELETE queries
• Fix: TRUNCATE replaced with DELETE FROM for WordPress compatibility
• Fix: Deprecated date_i18n() replaced with wp_date()
• Fix: Debug endpoint sanitized (truncated responses, stripped tokens)

1.2.0

• New: Mobile-first responsive redesign with standardized breakpoints (480/600/768/1024px)
• New: Touch-friendly targets meeting WCAG 44x44px minimum
• New: Responsive wind compass with clamp() sizing
• New: Dynamic chart font sizing based on viewport
• Improved: ~400 lines of inline styles extracted to centralized frontend.css
• Improved: ID selectors replaced with reusable class selectors

1.1.0

• New: Central error logging (NAWS_Logger) with severity levels and sensitive data redaction
• New: Transient caching layer for database queries (modules, readings, daily summaries)
• New: Adaptive polling with error backoff (doubles interval after 3 failures)
• New: Night mode with reduced polling between 23:00–06:00
• New: Health status indicator in admin dashboard (green/yellow/red)
• New: Frontend error UI and AJAX retry logic with exponential backoff
• New: naws_data_synced action hook for extensibility
• Fix: N+1 query in history data replaced with single query
• Fix: Silent DB errors now logged
• Fix: Chart.js blank page prevented with try/catch

1.0.2

• Removed shortcodes: [naws_chart], [naws_gauge], [naws_dashboard], [naws_card] – use [naws_live] and [naws_history] instead
• Removed: gauge.min.js vendor library and unused templates
• Fix: Fatal error on activation (spawn_cron() called too early)

1.0.1

• New: Forecast provider selection (Open-Meteo + Yr.no / MET Norway)
• New: Norwegian (Bokmal) language with 326 translated keys
• New: File-based language system (one PHP file per language, auto-discovered)
• New: Configurable station name in Settings
• Fix: OAuth flow broken by encryption (auto-migration)
• Fix: OAuth state validation with hash_equals() and 10-min expiry
• Fix: Cron stops after plugin update (activation hook + watchdog fix)
• Fix: SVG weather icons stripped by wp_kses_post()
• Improved: Plugin Check compliance (126 errors to 0)
• Improved: Vendor JS files bundled in ZIP

1.0.0

• Initial public release
• Full Netatmo OAuth2 integration with all module types
• Live dashboard with animated sensor cards and 24h charts
• Astronomy: sunrise/sunset, moon phase, next full moon
• Derived weather: feels-like temperature, heat index, dew point
• Year-over-year history charts (temperature, pressure, monthly rainfall)
• 5-day weather forecast via Open-Meteo
• REST API with API key authentication and rate limiting
• AES-256-GCM encryption for all stored credentials
• Full German and English localization
• Configurable units (temperature, rain, wind, pressure)
• Cron watchdog with self-healing for stuck sync jobs
• Historical data importer with batch processing