Returino – Formular de retur for WooCommerce

Changelog

1.1.1

• Fixed the order-lookup rate limiter to key off a validated IP address
  instead of trusting REMOTE_ADDR blindly — sites behind a reverse
  proxy/CDN (e.g. Cloudflare) could otherwise have every visitor share
  one throttling bucket, turning the anti-enumeration protection into an
  accidental site-wide lockout. Added a returino_rate_limit_ip filter
  for sites that need to supply the real visitor IP (see FAQ). A
  successful lookup now also clears that visitor’s failed-attempt count.
• Renamed the wp_ajax_oug18_* AJAX action/nonce names to
  wp_ajax_returino_* (code only, no stored data affected — the
  oug18* post meta keys are unchanged).

1.1.0

• Renamed the plugin to “Returino – Formular de retur for WooCommerce”
  (previously “Returino for WooCommerce”) for better discoverability
  when searching in wp-admin.
• The “Powered by Returino” credit on the public form is now opt-in and
  disabled by default (Returino → Settings) — previously it showed
  automatically. Existing installs will stop showing it until enabled.
• Added per-IP throttling on order lookup (max 10 failed attempts / 15
  minutes) against order-number enumeration.
• Unified the order-lookup error message so it no longer reveals whether
  the order number or the email was the wrong part.
• Renamed the internal “oug18-” prefix (markup/CSS/JS) to “returino-“.

1.0.10

• Added a server-side guard (wp_insert_post_data) so a return request can
  never be saved with a status other than our own four, regardless of
  which admin UI path is used (Quick Edit, bulk edit, REST API, etc.) —
  the previous fix only covered the classic per-post editor.

1.0.9

• Fixed a bug where opening/saving a return request in wp-admin silently
  reset its status to “Published” (the classic edit screen didn’t
  recognize our custom statuses), making it disappear from the order
  screen and the customer’s My Account tab. The custom statuses are now
  registered in that screen’s status dropdown.

1.0.8

• Small performance improvements.
• Added subtle Returino branding to the email footer and the form.

1.0.7

• IBAN is now only required for payment methods that can’t be refunded
  automatically (cash on delivery, bank transfer). Card/wallet payments
  skip the IBAN field entirely, both in the form and in validation.

1.0.5

• Track each confirmation email’s delivery status (sent/failed), captured
  via wp_mail_failed, and show it on every return request in admin.
• “Resend confirmation” button — resends the exact original content, not
  a rebuilt one.
• “Send test email” tool on the settings screen.
• Confirmation content is now saved in the database independent of email
  delivery, and shown to the logged-in customer under My Account →
  “Cererile mele de retur” — a durable-medium safety net that doesn’t
  depend on the email actually arriving.
• Dashboard/list notice and an admin-menu count bubble for failed
  confirmation emails, so failures surface without relying on email.

1.0.4

• Renamed to Returino for WooCommerce to avoid confusion with an
  unrelated, unaffiliated existing company of the previous name.
• Replaced generic “woo”/”wc” prefixes (namespace, constants, CPT slug,
  statuses, shortcode tag) with a distinct “returino” prefix.

1.0.2

• Removed the GitHub-based update checker in favor of native
  wordpress.org updates.
• Text domain aligned with the plugin slug.

1.0.1

• Meta box on the WooCommerce order screen showing linked return requests.
• Automatic order note whenever a request’s status changes.
• Explicit HPOS compatibility declaration.

1.0.0

• Initial release: custom post type + statuses, 2-step front-end form,
  AJAX validation, confirmation email, admin meta box, Returino menu.