Surf7 Simple Catalog

Changelog

1.64.1

Follow-up to the WordPress.org review. One fix.

• The “Load more” button and the enquiry form no longer fall back to a guessed address when the plugin’s own script data is missing. Both endpoints were already resolved properly in PHP and passed to the script, but each carried a hardcoded fallback path that would have been wrong on a site installed in a subdirectory, on multisite, with a relocated admin directory, or using plain permalinks. The fallbacks are gone; the resolved values are the only source.

1.64.0

Addresses the WordPress.org plugin review. Mostly hardening; one setting has been removed.

Removed

• The Custom CSS box under Catalog → Settings → Developer is gone. Plugins in the directory may not accept arbitrary CSS, JavaScript or PHP — WordPress has its own error-checking CSS editor in the Customizer and the Site Editor, and that is where site-wide styling belongs. Any CSS you had saved there is discarded on update; move it to Appearance → Customise → Additional CSS before updating if you still need it.

Security

• The single-product REST endpoint no longer serves unpublished products. wp-json/simple-catalog/v1/products/{id} returned drafts, pending, private and password-protected products in full to anyone who guessed an ID, while the collection endpoint alongside it correctly showed only published ones. Reading a product that is not published now requires permission to edit it.
• The JSON import-from-URL endpoint now uses WordPress’s safe HTTP client, so it can no longer be pointed at addresses on the site’s own network.
• Options selected on the enquiry form are sanitised before they reach the enquiry email, the enquiry log and the CSV export.
• The duplicate-handling and import-mode values on the Import screen are checked against the list the form actually offers instead of being stored as sent.
• Nonces are sanitised before verification, and the browser and IP values read from the request are sanitised on the way in.

Import / Export

• CSV import can now update your products instead of duplicating them. The exported file has always started with an ID column, but the importer never read it — it matched only on sku/code. So exporting your catalogue, changing a price and importing it back created a second copy of every product that had no product code. Rows are now matched on ID first, then on sku/code, and only then created. An ID that does not belong to a product on this site is ignored rather than trusted, so a file from another site cannot overwrite the wrong product.
• “Duplicate handling” on the Import screen now does something. Skip, Update and Always create new previously all behaved the same way, because the setting was never passed to the importer. The default is now Update, and the option that claimed to match “by slug / title” has been reworded to describe what actually happens.
• Import results now appear on the Import tab. Uploading a file returned you to the Import / Export screen with the Export tab showing, so the preview — and the completion report, and the WooCommerce migration report — were all rendered onto a panel you could not see until you clicked Import.
• wp simple-catalog import-csv-products accepts --duplicate=update|skip|create.

Under the hood

• Uploaded import files now go through WordPress’s own upload handler rather than being moved by hand, so host filesystem policies and security filters apply to them.
• Exports written by WP-CLI, and the guard files in the plugin’s uploads folder, go through the WordPress filesystem API.
• The plugin’s theme colours and the two admin fallbacks for the brand metabox are enqueued rather than printed as literal <style> and <script> tags, so they can be dequeued, reordered and minified like any other asset.
• Video thumbnails fall back to the provider’s lower-resolution image through the plugin’s own script instead of an inline onerror attribute, and every URL in the gallery is escaped for the context it is printed into.
• The enquiry form records the page it was submitted from using WordPress’s resolved address rather than request headers.
• Coding-standards config now matches the plugin’s text domain, so translator-facing checks actually run.

No action is required after updating unless you were using the Custom CSS box.

1.63.1

A housekeeping release. No functional changes to the catalogue itself.

• The plugin’s text domain and folder now match its WordPress.org slug, so translations are loaded rather than silently ignored.
• First-run setup wizard: the welcome text no longer prints a raw escape code where an apostrophe belongs, and the four step markers are no longer numbered twice.

1.63.0

A security and correctness release. Updating is recommended.

Catalogue display

• Sold products now move to the back of the catalogue. Products are always grouped Available, then Coming Soon, then Reserved, then Sold, no matter which sort you or your visitor chooses — the chosen sort still applies within each group. This covers the main catalogue, category, label and brand archives, search results, and grids placed with the Catalog Grid block or the [catalog_grid] shortcode. Sold items stay visible and linkable; if you would rather hide them completely, the existing “Hide sold products” setting is unchanged.
• The Catalog Grid block’s Sort setting, and the orderby attribute of the [catalog_grid] shortcode, now actually work. Both were being ignored, so every grid came out newest-first whatever you chose.
• Product and archive pages now carry a proper meta description if you have no SEO plugin installed. It is built from the product’s excerpt or description with all HTML, shortcodes and entities stripped out, so a catalogue imported from a marketplace no longer risks showing raw list markup in search results. If you do run Yoast, Rank Math or SEOPress, nothing changes — the plugin leaves the description to them.
• Brand archives now appear in structured data. They were producing none at all, unlike category and label archives.
• Brand archives now behave like the rest of the catalogue. Pages such as /brand/your-brand/ were skipping the plugin’s own settings entirely — products per page, the sort order, and the filters all had no effect there.

Security

• Fixed an SQL injection on the Enquiries screen. The sort order taken from the URL was written into the query without being restricted to real column names, and the screen is available to editors as well as administrators. Only sites with enquiry logging switched on were affected.
• Hardened the import upload. The file was saved using the extension supplied by whoever uploaded it, into a folder with no access protection. The extension is now decided by the plugin, and the folder is protected on creation.
• Fixed the product structured data (JSON-LD) so a product title or specification containing HTML can no longer break out of the script block.
• The hourly enquiry rate limit can no longer be bypassed by forging an X-Forwarded-For header, which previously handed the sender a fresh allowance on every request.
• The anti-spam timestamp is now signed, and a submission that omits it is rejected rather than skipping the check entirely.

Privacy

• Registered with WordPress’s own privacy tools. Tools → Export Personal Data now returns a visitor’s enquiries, and Tools → Erase Personal Data anonymises them — clearing name, email, phone, message, originating page, browser and IP hash, and keeping only the date and the product. Both work even if logging has since been switched off, because turning it off never deleted what was already stored.
• Suggested privacy-policy wording is offered under Settings → Privacy, and it states your configured retention period.

Import / Export

• The CSV import now shows you what happened. Counts, any file-level problems, and a table of the rows that need attention with the reason for each. Previously the import ran and returned you to a blank upload form, so per-row reasons were recorded and then discarded.
• A dry run now offers an Import for real button, so you can check the file and then commit it without uploading twice.
• Fixed dry-run counts. A preview of new products reported them as updates rather than as creations.

Fixes

• Ticked availability filters now show as ticked. The filter always applied correctly; only the chips failed to reflect it.
• The category and label filters now read the whole term ID rather than its first digit, so any ID of 10 or above selects the right term in the dropdown.
• The Delete confirmation on Option Sets now appears. It was silently broken, so an option set was deleted on a single click with no prompt.
• Removed a JavaScript error thrown on every product edit screen.
• When an enquiry email cannot be sent, the enquiry is saved first and flagged with the mail server’s actual reason, so nothing is lost and the cause is visible.

Under the hood

• Confirmed compatible with PHP 8.1 through 8.4.
• Removed unused code, including a helper class that nothing referenced.
• Added a development toolchain — coding standards, static analysis and tests — with the results recorded in docs/hardening-audit.md.
• No database changes. Nothing to do after updating.

1.62.3

• Fixed: the availability filter ignored the badge wording, so renaming a status under Settings → Display left the badge and the filter calling the same status different things. Both now read the same setting.
• Known issue: a ticked availability filter applies correctly but does not render as ticked.

1.62.2

• Fixed: a category image or brand logo could not be removed once set. Both term forms now carry a Remove control, shown only when there is something to remove.

1.62.0

• Added: a shortcode generator tab under Catalog → Settings. One card per shortcode, with real controls, a self-updating shortcode string and a Copy button. Attributes left at their default are omitted.

1.61.0

• Fixed: catalog pages rendered with no site header or footer on block themes. Both are now drawn through the core/template-part block, in the same position the theme’s own templates use.

Earlier releases are documented in CHANGELOG.md.