WordPress.org
Get WordPress

Plugin Directory

Changeset 3683149


Ignore:
Timestamp:
09/06/2026 08:25:32 AM (7 weeks ago)
Author:
sigilet
Message:

Sigilet 1.6.6

Location:
sigilet/trunk
Files:
4 edited

Legend:

Unmodified
Added
Removed

  • sigilet/trunk/changelog.txt

    r3678832 r3683149  
    33The full release history. readme.txt carries only the two most recent releases,
    44to stay under the wp.org readme size limit; everything else lives here.
     5
     6= 1.6.6 =
     7* The free plugin now shows where to buy Pro, and how to get back to a copy already paid for. A Sigilet Pro section on the Badges settings screen links to the pricing page and to your Sigilet account, and the Plugins list gains a Go Pro link on Sigilet's own row. Both appear only when Pro is not active, and only on Sigilet's own screens, so nothing is added to the WordPress dashboard at large. A license key does not upgrade the free plugin in place: Pro is a separate download, replacing the free copy.
     8* Pro only: WordPress can no longer be told the installed plugin is an older version than it is. When the licensing service's newest release is behind the installed build (a pulled release, or a pre-release tree), the version recorded for the plugin is now floored at the installed one. No site running a current release is affected.
    59
    610= 1.6.5 =

  • sigilet/trunk/includes/class-sglt-settings.php

    r3678829 r3683149  
    306306                                <?php
    307307                        endif;
     308                        if ( ! SGLT_Pro::is_active() ) :
     309                                ?>
     310                                <hr />
     311                                <h2><?php esc_html_e( 'Sigilet Pro', 'sigilet' ); ?></h2>
     312                                <p>
     313                                        <?php esc_html_e( 'Pro adds CSV bulk award and other advanced tools on top of everything here.', 'sigilet' ); ?>
     314                                </p>
     315                                <p class="description">
     316                                        <?php esc_html_e( 'Pro is a separate download, not something a license key unlocks in this plugin. Buying Pro gets you a second zip file: install it over this plugin (choose "Replace current with uploaded" when WordPress asks), then paste your license key on the License screen it adds.', 'sigilet' ); ?>
     317                                </p>
     318                                <p>
     319                                        <a href="<?php echo esc_url( sglt_upgrade_url() ); ?>" target="_blank" rel="noopener noreferrer"><?php esc_html_e( 'See Sigilet Pro', 'sigilet' ); ?></a>
     320                                </p>
     321                                <p>
     322                                        <a href="<?php echo esc_url( sglt_portal_url() ); ?>" target="_blank" rel="noopener noreferrer"><?php esc_html_e( 'Already bought Pro? Download it from your account', 'sigilet' ); ?></a>
     323                                </p>
     324                                <?php
     325                        endif;
    308326                        ?>
    309327                </div>

  • sigilet/trunk/readme.txt

    r3678832 r3683149  
    55Tested up to: 7.1
    66Requires PHP: 8.0
    7 Stable tag: 1.6.5
     7Stable tag: 1.6.6
    88License: GPLv2 or later
    99License URI: https://www.gnu.org/licenses/gpl-2.0.html
    … …  
    1313== Description ==
    1414
    15 Issue real, verifiable digital badges from the site you already run.
     15Issue digital badges from the WordPress site you already run. Your recipients get a credential they can add to LinkedIn, download, and show an employer, and anyone can check it on your domain.
    1616
    17 Sigilet turns WordPress into a badge issuer. Design a badge, award it by email, and your recipient gets a credential they can share on LinkedIn, download, and point any employer at - hosted on your domain, under your organization's name.
     17Sigilet suits training providers, membership associations, universities and employers who award certificates or recognition and need those awards to be verifiable. No badge platform sits in the middle, there is no fee per badge, and your recipients never create an account.
    1818
    19 No badge platform. No per-badge fees. No account for your recipients to create.
     19Badges follow Open Badges 2.0 (OB 2.0), so any conformant wallet or verifier can read them.
    2020
    2121= How it works =
    2222
    23 1. **Create a badge type.** Title, description, criteria, image - it's just a WordPress post type.
    24 2. **Award it.** Enter a recipient's email and issue it live, email the recipient, or hold it as a draft until launch day.
    25 3. **They share it.** Every award gets a clean public verification page, a LinkedIn share button, and a downloadable badge file that carries its own proof.
    26 
    27 = Why issuers pick Sigilet =
    28 
    29 * **It's your credential, on your domain.** Verification pages live on your site and carry your organization's name - recipients and employers never leave your domain to check a badge.
    30 * **Recipients never sign up for anything.** They click a link and see their badge. That's the whole experience.
    31 * **Built on an open standard, not a walled garden.** Badges are [Open Badges 2.0](https://www.imsglobal.org/spec/ob/v2p0/) credentials, readable by any conformant wallet, backpack, or verifier.
    32 * **Recipient privacy is the default.** Email addresses are never stored - only a salted, per-award hash. More on that below.
    33 * **Right-sized for small teams.** A handful of issuers, sensible volume, delivered over your site's existing `wp_mail`.
     231. Create a badge type: a title, what it is awarded for, and an image.
     242. Award it to an email address. Issue it now, email the recipient, or hold it as a draft until launch day.
     253. The recipient gets a public verification page on your domain, a LinkedIn share button, and a download.
    3426
    3527= What you get =
    3628
    37 * **Badge types** as a custom post type - title, description, criteria, tags, featured image.
    38 * **Award workflow** with three modes: draft/embargoed, live, or live + email the recipient.
    39 * **Hosted verification** - every assertion resolves at a stable public URL, on your domain, with a `"verification": { "type": "hosted" }` block.
    40 * **Revocation** - one-click revoke/un-revoke from the award history; revoked assertions report `"revoked": true` and show a watermark on the verification page.
    41 * **Expiry** - optional per-award expiry date, surfaced in JSON and on the verification page.
    42 * **Dedicated roles & capabilities** - grant `Badge Issuer` or `Badge Viewer` access without handing over WordPress post-editing rights.
    43 * **Recipient sharing hub** - a private-to-the-recipient panel on the verification page with a "Share to LinkedIn feed" button, badge download, copy-link and copy-embed buttons, plus Open Graph / Twitter Card tags so shared links unfurl with the badge image. An optional "Add to LinkedIn" (certifications) button can be enabled in settings.
    44 * **Badge baking** - the download button serves a *baked* PNG that carries its own assertion URL inside the file, so the badge is a self-describing, wallet-importable credential rather than just a picture.
     29Badge types and a three-mode award workflow, hosted verification on your own domain, one-click revoke and un-revoke, optional expiry dates, Badge Issuer and Badge Viewer roles so you can let someone award badges without handing over the rest of WordPress, and a private sharing panel for each recipient. Downloaded badges carry their own proof inside the image file, so they work in any OB 2.0 wallet rather than being just a picture.
    4530
    46 = Recipient privacy, in detail =
     31Sigilet never stores a recipient's email address. Each award keeps a one-way hash instead, so two badges held by the same person cannot be linked from the public record.
    4732
    48 Recipient email addresses are never stored. Each award saves only a per-assertion **salted SHA-256** identity hash (`sha256$…`), exactly as the Open Badges hashed `IdentityObject` allows. Identical emails produce different hashes across awards, so two badges held by the same person cannot be correlated from the public JSON. The plaintext address is used only to send the optional award notification, then discarded.
    49 
    50 = Under the hood =
    51 
    52 Sigilet publishes standards-compliant Issuer, BadgeClass, and Assertion JSON alongside a friendly, theme-independent verification page - no third-party badge service sits between you and your recipients. Baking follows the Open Badges PNG `iTXt` convention; PNG uploads are baked directly, and GIF/WebP/AVIF are converted first where the server's GD extension supports the source format.
     33Screenshots are below. The [Sigilet for WordPress page](https://sigilet.com/wordpress-plugin/) carries the technical detail: the OB 2.0 JSON Sigilet publishes, how badge baking works, how the privacy hashing works, and the server requirements.
    5334
    5435= Pro =
    5536
    56 The **CSV bulk award** feature - import a spreadsheet of recipients and dispatch awards through a paced background email queue - is a separate Sigilet Pro package and is **not part of this download**. Its code is not included here in any form: there is no locked screen, no disabled control, and no trial. Everything this plugin does - issuance, hosted verification, baking, roles, revocation, expiry, and sharing - is free, complete, and never expires.
     37CSV bulk award, which imports a spreadsheet of recipients and sends the awards through a paced background email queue, is a separate Sigilet Pro package and is not part of this download. None of its code ships here. There is no locked screen, no disabled control and no trial, and everything described above is free and does not expire.
    5738
    5839== External services ==
    5940
    60 The free WordPress.org build makes no licensing, analytics, or update request to a third party. Its updates come only from WordPress.org.
     41The WordPress.org build sends no licensing, analytics or update request to anyone. It takes updates only from WordPress.org.
    6142
    62 The **Pro build** connects to the **Sigilet licensing service** (licence.sigilet.com) for license activation, daily license validation, and authenticated Pro updates.
     43Sigilet Pro connects to the Sigilet licensing service at licence.sigilet.com to activate a licence, to check once a day that the licence is still current, and to fetch Pro updates. It sends the licence key, a one-way SHA-256 hash of this site's address, the site URL when a licence is activated, and the plugin version when WordPress checks for updates. It sends no site diagnostics, no administrator details, no list of installed themes or plugins and no badge recipient data, at any time. The licence key and a signed entitlement token are stored in this site's options table, and the token is checked on this site, so Pro keeps working through a service outage.
    6344
    64 * **Data sent:** the Pro license key, a one-way SHA-256 hash of this site's address, this site's URL (on activation only), and the installed plugin version (on update checks only).
    65 * **When it is sent:** when an administrator activates or deactivates a license; once a day when WordPress checks the license is still current; and when WordPress checks for Pro updates.
    66 * **No analytics:** no site diagnostics, administrator details, installed themes or plugins, and no badge-recipient data are sent, at any time.
    67 * **Local storage:** the license key and a signed entitlement token are stored in the site's WordPress options table. The token is verified on this site, offline, so Pro features keep working through a service outage.
     45Pro checkout runs on Polar, the merchant of record, reached from Sigilet's pricing page. The plugin does not embed Polar, receive payment details or call Polar's API. Polar handles the customer account, payment, tax, invoice, refund and subscription data.
    6846
    69 Pro checkout is provided by **Polar**, the merchant of record, through Sigilet's external pricing page. The plugin does not embed Polar, receive payment details, or call Polar's API. Polar processes the customer's account, payment, tax, invoice, refund, and subscription data during checkout and billing management.
    70 
    71 Badge recipients' personal data is never sent to the licensing service, Polar, or any other external service. Review [Sigilet's Privacy Policy](https://sigilet.com/privacy/) and [Polar's Privacy Policy](https://polar.sh/legal/privacy).
     47No badge recipient data reaches the licensing service, Polar or any other outside service. See [Sigilet's Privacy Policy](https://sigilet.com/privacy/) and [Polar's Privacy Policy](https://polar.sh/legal/privacy).
    7248
    7349== Installation ==
    … …  
    10581== Changelog ==
    10682
     83= 1.6.6 =
     84* The free plugin now shows where to buy Pro, and how to get back to a copy already paid for. A Sigilet Pro section on the Badges settings screen links to the pricing page and to your Sigilet account, and the Plugins list gains a Go Pro link on Sigilet's own row. Both appear only when Pro is not active, and only on Sigilet's own screens, so nothing is added to the WordPress dashboard at large. A license key does not upgrade the free plugin in place: Pro is a separate download, replacing the free copy.
     85* Pro only: WordPress can no longer be told the installed plugin is an older version than it is. When the licensing service's newest release is behind the installed build (a pulled release, or a pre-release tree), the version recorded for the plugin is now floored at the installed one. No site running a current release is affected.
     86
    10787= 1.6.5 =
    10888* Removed the one-time migrations that retired the licensing providers Sigilet no longer uses. Freemius (retired at 1.6.0) and Appsero (removed at 1.6.2) both left records behind on installs that ran them, and a premium-only migration cleaned those up on upgrade. No install that can still be reached needs it: Appsero was never configured in any shipped build, so no site could hold its records, and the remaining Freemius installs are being moved onto Sigilet's own licensing service directly rather than migrated. Sites installed from WordPress.org never carried either migration and are unaffected.
    109 
    110 = 1.6.4 =
    111 * Internal clarity only, no functional change: the base64 @font-face rule embedded in preset badge SVGs now lives in the SVG asset file assets/presets/inter-font-face.svg instead of a PHP string. It is SVG-document markup handed to the image rasterizer, never web-page output, so it has no enqueue path; keeping it in an asset file makes that visible at a glance.
    11289
    11390Earlier releases are listed in `changelog.txt`, bundled with the plugin.

  • sigilet/trunk/sigilet.php

    r3678832 r3683149  
    44 * Plugin URI:        https://sigilet.com/wordpress-plugin/
    55 * Description:        Mint and issue Open Badges 2.0 using hosted verification. Create badge types, award them to recipients by email (hashed + salted), and publish standards-compliant Issuer, BadgeClass, and Assertion JSON with a human-friendly verification page.
    6  * Version:           1.6.5
     6 * Version:           1.6.6
    77 * Requires at least: 6.4
    88 * Requires PHP:      8.0
    … …  
    1919}
    2020
    21 define( 'SGLT_VERSION', '1.6.5' );
     21define( 'SGLT_VERSION', '1.6.6' );
    2222define( 'SGLT_PLUGIN_FILE', __FILE__ );
    2323define( 'SGLT_PLUGIN_DIR', plugin_dir_path( __FILE__ ) );
    … …  
    7474function sglt_license_url() {
    7575        return admin_url( 'edit.php?post_type=' . SGLT_CPT_BADGE . '&page=sglt-license' );
     76}
     77
     78/**
     79 * Public Pro purchase page. Checkout is off-site.
     80 *
     81 * Not gated on sglt_has_licensing(): both builds link here (#11) - it is how a
     82 * free-build user finds Pro at all, since that build carries no licensing
     83 * client to check against.
     84 *
     85 * @return string
     86 */
     87function sglt_upgrade_url() {
     88        return 'https://sigilet.com/pro/';
     89}
     90
     91/**
     92 * Portal for a customer who has already bought Pro, to fetch the download.
     93 *
     94 * This is a redirect on sigilet.com, deliberately not the portal host itself.
     95 * The plugin bakes this URL into builds that sit on customer sites for years,
     96 * so an indirection Sigilet controls lets the real portal move without
     97 * orphaning every installed copy that shipped the old URL. That only works if
     98 * the redirect stays a 302: a 301 is cached by the browser, so the first
     99 * customer to follow one would keep resolving straight to today's portal host
     100 * forever, even after it moved - defeating the whole point of the indirection.
     101 *
     102 * It is also the only form that can appear in the free build at all:
     103 * build-free.sh fails the build on any literal `licence.sigilet.com`, so a
     104 * link to the portal's real host would never survive the strip.
     105 *
     106 * No trailing slash and no deeper path - '/portal/anything' 404s on purpose,
     107 * it is a door, not a prefix.
     108 *
     109 * @return string
     110 */
     111function sglt_portal_url() {
     112        return 'https://sigilet.com/portal';
    76113}
    77114
    … …  
    211248                if ( sglt_has_licensing() ) {
    212249                        $shortcuts[] = '<a href="' . esc_url( sglt_license_url() ) . '">' . esc_html__( 'License', 'sigilet' ) . '</a>';
     250                }
     251                // Shown in both builds (#11): this is the free-build user's route to
     252                // discovering Pro exists at all.
     253                if ( ! SGLT_Pro::is_active() ) {
     254                        $shortcuts[] = '<a href="' . esc_url( sglt_upgrade_url() ) . '" target="_blank" rel="noopener noreferrer">' . esc_html__( 'Go Pro', 'sigilet' ) . '</a>';
    213255                }
    214256                return array_merge( $shortcuts, $links );
Note: See TracChangeset for help on using the changeset viewer.