Hardening from the wordpress.org review: the General settings option now stores only the keys\nit knows. No visible change. Recommended for everyone.<\/p>","1.6.1":"
Security and performance. Closes a case where an outside caller could reach check-in with the\nAPI switched off, requires an Application Password over HTTPS for third-party scanner apps, and\nmakes the check-in block in order emails far lighter on a busy day. Recommended for everyone.<\/p>","1.6.0":"
A month calendar for Booking times, a new Settings > Appearance tab so the booking interface\nfollows your theme, and a round of security hardening from the wordpress.org review.\nRecommended for everyone.<\/p>","1.5.1":"
Security hardening for every request handler and the cart, plus a round of fixes to the floor\nplan editor and order lifecycle from the wordpress.org review. Recommended for everyone.<\/p>","1.5.0":"
Fixes check-in times being shown shifted by the site's UTC offset on the Bookings screen, and\nmakes that screen substantially faster on venues with many units.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3700601,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3700601,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256},"icon.svg":{"filename":"icon.svg","revision":3700601,"resolution":false,"location":"assets","locale":false}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3700601,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3700601,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.6.2"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[164435,127709,126872,34016,51225],"plugin_category":[],"plugin_contributors":[277115],"plugin_business_model":[],"class_list":["post-364319","plugin","type-plugin","status-publish","hentry","plugin_tags-floor-plan","plugin_tags-restaurant-reservations","plugin_tags-seating-chart","plugin_tags-table-booking","plugin_tags-woocommerce-booking","plugin_contributors-macvej","plugin_committers-macvej"],"banners":{"banner":"https:\/\/ps.w.org\/seat-table-booking-for-woocommerce\/assets\/banner-772x250.png?rev=3700601","banner_2x":"https:\/\/ps.w.org\/seat-table-booking-for-woocommerce\/assets\/banner-1544x500.png?rev=3700601","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":"https:\/\/ps.w.org\/seat-table-booking-for-woocommerce\/assets\/icon.svg?rev=3700601","icon":"https:\/\/ps.w.org\/seat-table-booking-for-woocommerce\/assets\/icon.svg?rev=3700601","icon_2x":false,"generated":false},"screenshots":[],"raw_content":"\n
Seat & Table Booking for WooCommerce<\/strong> is a table reservation and seat booking plugin that\nturns any WooCommerce shop into a booking system for a room with a layout: a restaurant's\ntables, a cinema's seats, a theatre's rows, a co-working space's desks, a wedding hall's\nseating plan. It adds a Booking venue<\/strong> product type to WooCommerce, and one product is one\nfloor plan.<\/p>\n\n Upload a photo or a drawing of the room, drag the tables to where they really are, give each\none a price and a capacity, and set the timeslots it can be booked in. Customers then pick a\ndate, a timeslot and a table straight off the seating chart, and the table goes into the cart\nlike any other WooCommerce product. WooCommerce handles the payment, the order and the emails -\nthere is no second checkout, no second dashboard, no subscription and no external service.<\/p>\n\n Every paid reservation gets a QR check-in code, and door staff scan it from a full-screen\nscanner page built into the plugin.<\/p>\n\n For the shop owner<\/strong><\/p>\n\n For the customer<\/strong><\/p>\n\n Adding a table to the cart creates a short-lived hold on that exact unit, date and timeslot.\nThe hold is enforced by a database uniqueness constraint, so two customers racing for the last\ntable cannot both win - the second is told the table has just gone. Holds that are never paid\nfor expire on their own and the table returns to the floor plan.<\/p>\n\n Every paid reservation gets a QR check-in code, shown on the confirmation email, the thank-you\npage and My Account. Staff scan it at The same check-in also works over a REST API, so a third-party scanner app - a phone app, a\nhandheld reader, whatever the door already uses - can call it too. The API is off by default;\na shop owner turns it on under Seats & Tables > Settings > Scanner \/ API, and a scanner app\nauthenticates with a WordPress Application Password over HTTPS, the same mechanism WordPress\nships for any external app that needs to act as a user.<\/p>\n\n Bundles Fabric.js 7.4.0 (MIT) for the admin floor plan editor, in\n inc\/product-type\/js\/lib\/, as published on npm ( Also bundles endroid\/qr-code 5.1.0 (MIT) for generating check-in QR codes, together with its\ndependencies bacon\/bacon-qr-code 3.0.1 (https:\/\/github.com\/Bacon\/BaconQrCode) and dasprid\/enum\n1.0.6 (https:\/\/github.com\/DASPRiD\/Enum), both BSD-2-Clause, installed with Composer,\nunmodified, in And jsQR 1.4.0 (Apache-2.0) for decoding QR codes in the check-in scanner, in\n inc\/scanner\/js\/jsqr.js. Source: https:\/\/github.com\/cozmo\/jsQR<\/p>\n\n No other minified or compiled code is shipped, and no assets are loaded from a CDN.<\/p>\n\n None. This plugin makes no outbound requests, sends no analytics or telemetry, and needs no\naccount anywhere. QR codes are generated on your own server by the bundled library, and every\nscript and stylesheet is served from your own site.<\/p>\n\n\n Deleting the plugin removes its settings and the Scanner role. Bookings, floor plans and QR\ncheck-in data are kept, so reinstalling the plugin picks up exactly where you left off -\nunless Yes. The plugin declares HPOS compatibility and reads and writes orders only through the\nWooCommerce order API, so it works with both order storage modes.<\/p><\/dd>\n Yes, and with the classic shortcode cart and checkout.<\/p><\/dd>\n Yes. Every Booking venue product is its own floor plan with its own timeslots, prices and\nsettings, and one order can hold tables at several venues.<\/p><\/dd>\n The site's timezone, as set under Settings > General. Timeslots, booking dates, the \"booking\nnotice\" cut-off and the check-in window all use it.<\/p><\/dd>\n The hold expires after the configured number of minutes (15 by default) and the table becomes\nbookable again. If the customer returns to a cart with an expired hold, the line is removed and\nthey are told why. Removing a line and pressing \"Undo\" takes the hold again if the table is\nstill free.<\/p><\/dd>\n The booking is released, its QR code is cancelled and the table is immediately bookable again.\nTrashing or deleting an order does the same.<\/p><\/dd>\n Its tables are released after the window set in Seats & Tables > Settings (60 minutes by\ndefault), the order is cancelled and a note is added to it. Orders on hold awaiting a bank\ntransfer are never released automatically.<\/p><\/dd>\n No. A unique index on unit, date and timeslot makes that impossible at the database level.<\/p><\/dd>\n No. Expired holds are treated as free the moment they expire; a five-minute WP-Cron event only\ntidies the rows up. The unpaid-order release also runs on that event, so on a site where\nWP-Cron is disabled it runs whenever the system cron calls Yes. Seats & Tables > Bookings, pick the venue and the date, then press \"+ Block\" in the empty\ncell for that sitting. The table disappears from the floor plan for that sitting until the block\nis released.<\/p><\/dd>\n Open Check guests in and nothing else. A Scanner user cannot see orders, products or the dashboard.\nShop managers and administrators can scan as well.<\/p><\/dd>\n Yes, once a shop owner turns on \"Enable API\" under Seats & Tables > Settings > Scanner \/ API -\nit is off by default. The app authenticates with a WordPress Application Password and calls\n stbk\/v1\/scanner\/checkin\/{id} the same way the built-in scanner page does. The settings page\ndocuments every response.<\/p>\n\n An Application Password is required; a real account password is not accepted, and the site must\nbe on HTTPS, because that is what WordPress itself requires before it will accept one. The\nbuilt-in scanner page is unaffected either way - it uses the staff member's own login session.<\/p><\/dd>\n Staff can resend it from the Bookings screen. The code is also shown on the WooCommerce\nthank-you page and in the order details under My Account, so a signed-in customer can pull it\nup there without waiting on an email at all.<\/p><\/dd>\n Its settings, the Scanner role and its scheduled event. Bookings, floor plans and QR data stay\nunless Booking times<\/strong><\/p>\n\n Appearance<\/strong><\/p>\n\n Storefront<\/strong><\/p>\n\n Performance and isolation<\/strong><\/p>\n\n Review round<\/strong><\/p>\n\nKey features<\/h4>\n\n
\n
\n
Who it is for<\/h4>\n\n
\n
How it works<\/h4>\n\n
\n
How double bookings are prevented<\/h4>\n\n
Check-in at the door<\/h4>\n\n
\/table-check-in\/<\/code>, a full-screen scanner page built into\nthe plugin, restricted to a \"Scanner\" role that can check guests in and nothing else. The\nscanner has a flashlight toggle and a type-in field for a desk without a camera.<\/p>\n\nCompatibility<\/h4>\n\n
\n
.pot<\/code> file.<\/li>\n<\/ul>\n\nThird-party code<\/h4>\n\n
fabric\/dist\/index.min.js<\/code>,\nhttps:\/\/www.npmjs.com\/package\/fabric\/v\/7.4.0). Unminified source (the project tags this\nrelease v740<\/code>): https:\/\/github.com\/fabricjs\/fabric.js\/tree\/v740<\/p>\n\ninc\/qr\/lib\/qrcodegen\/<\/code>. The MIT licence applies to endroid\/qr-code itself only.\nSource: https:\/\/github.com\/endroid\/qr-code<\/p>\n\nExternal services<\/h4>\n\n
\n
\/wp-content\/plugins\/<\/code> and activate it, or install it from\nPlugins > Add New.<\/li>\nSTBK_REMOVE_ALL_DATA<\/code> is defined as true<\/code> in wp-config.php<\/code> before deleting, which\nalso drops the database tables and the generated QR images. Deactivating it removes nothing.<\/p>\n\n\n\n
Does it work with High-Performance Order Storage (HPOS)?<\/h3><\/dt>\n
Does it work with the Cart and Checkout blocks?<\/h3><\/dt>\n
Can I run more than one venue?<\/h3><\/dt>\n
Which timezone are bookings in?<\/h3><\/dt>\n
What happens if a customer abandons the cart?<\/h3><\/dt>\n
What happens if an order is cancelled, refunded or deleted?<\/h3><\/dt>\n
What happens to an order that is never paid for?<\/h3><\/dt>\n
Can one table be booked twice in the same timeslot?<\/h3><\/dt>\n
Does it depend on WP-Cron?<\/h3><\/dt>\n
wp-cron.php<\/code>.<\/p><\/dd>\nCan staff hold a table back for a walk-in?<\/h3><\/dt>\n
How do staff scan tickets at the door?<\/h3><\/dt>\n
\/table-check-in\/<\/code> on a phone or tablet logged in as a user with the \"Scanner\" role and\npoint the camera at the guest's QR code. A valid, unused code within its check-in window is\nadmitted and marked used; a cancelled, already-used or out-of-window code is refused, with the\nreason shown on screen.<\/p><\/dd>\nWhat can the Scanner role do?<\/h3><\/dt>\n
Can a third-party scanner app call the API?<\/h3><\/dt>\n
What if a guest loses the email with the QR code?<\/h3><\/dt>\n
What is removed when I delete the plugin?<\/h3><\/dt>\n
STBK_REMOVE_ALL_DATA<\/code> is defined as true<\/code> in wp-config.php<\/code> first.<\/p><\/dd>\n\n<\/dl>\n\n\n1.6.2<\/h4>\n\n
\n
sanitize_hex_color()<\/code>; everything else is dropped.\nThe tab's own save path stores through the same callback.<\/li>\n<\/ul>\n\n1.6.1<\/h4>\n\n
\n
absint()<\/code> and (int)<\/code> answer 1 for an\narray instead of refusing it, so a crafted request could turn a product id, a guest count, an\nattachment id or a hold duration into a valid 1. The previous round fixed this inside the floor\nplan payload; it now covers every request handler in the plugin.<\/li>\n\n
esc_url()<\/code> rather than\n esc_url_raw(), which is a sanitizer for storage and redirects rather than an escaper for\noutput. The link that reaches the inbox is byte for byte the same.<\/li>\n1.6.0<\/h4>\n\n
\n
\n
\n
\n
\n
absint()<\/code>\nanswers 1 for one of those rather than refusing it - which on the id field pointed a row at\nwhichever unit happened to be id 1.<\/li>\n1.5.1<\/h4>\n\n
\n
stbk<\/code> literally, as the wordpress.org prefix scanner requires.<\/li>\n1.5.0<\/h4>\n\n
\n
<div><\/code> more than they\nopened, which could push the admin footer out of place.<\/li>\n#abc<\/code>) silently produced no\nQR image at all.<\/li>\n1.4.0<\/h4>\n\n
\n
1.3.0<\/h4>\n\n
\n
1.2.0<\/h4>\n\n
\n
\/table-check-in\/<\/code> scanner page and a \"Scanner\" role for door staff.<\/li>\nSTBK_REMOVE_ALL_DATA<\/code> is defined as true<\/code> before deleting.<\/li>\n<\/ul>\n\n1.1.0<\/h4>\n\n
\n
1.0.0<\/h4>\n\n
\n