Changeset 3745447

Timestamp:

10/14/2026 06:15:46 AM (4 weeks ago)

Author:

tracksies

Message:

Tag 1.1.29

Location:

trustie/tags/1.1.29

Files:

• . (copied) (copied from trustie/trunk )
• assets/css/reviews.css (modified) (1 diff)
• assets/js/review-anchor.js (added)
• includes/class-trustie-display.php (modified) (2 diffs)
• includes/class-trustie-requests.php (modified) (2 diffs)
• includes/shared/assets/js/tracksies-nonce-refresh.js (modified) (1 diff)
• includes/shared/class-tracksies-nonce-refresh.php (modified) (4 diffs)
• includes/trustie-review-link.php (added)
• readme.txt (modified) (3 diffs)
• trustie.php (modified) (4 diffs)

trustie/tags/1.1.29/assets/css/reviews.css

@@ -719 +719 @@
         position: fixed;
         z-index: 99999;
-        font-family: var(--trustie-font-body, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif);
+        /* The page's own font when Brand Hub has none to give. A system-font
+           fallback here showed Noble Ink signed-in visitors the wrong font
+           whenever Brand Hub wrote --tracksies-font-body: inherit (14 Oct 2026). */
+        font-family: var(--trustie-font-body, inherit);
 }
 

trustie/tags/1.1.29/includes/class-trustie-display.php

@@ -354 +354 @@
 
                 $this->enqueue_styles();
+
+                // Email links and the stars point at #reviews, inside this tab.
+                if ( function_exists( 'trustie_free_enqueue_review_anchor_script' ) ) {
+                        trustie_free_enqueue_review_anchor_script();
+                }
 
                 $reviews = $this->get_product_reviews( $product->get_id(), array(
@@ -1703 +1708 @@
                 }
 
+                // Links to #reviews reach this form's section - see review-anchor.js.
+                if ( function_exists( 'trustie_free_enqueue_review_anchor_script' ) ) {
+                        trustie_free_enqueue_review_anchor_script();
+                }
+
                 // Allow Pro to provide a custom form (form builder, UGC uploads, etc.).
                 // Form HTML is built internally by render_frontend_form() with proper escaping.

trustie/tags/1.1.29/includes/class-trustie-requests.php

@@ -734 +734 @@
                 }
 
+                // Proof of purchase for the Verified badge: the link came from this
+                // order (trustie-review-link.php). Never a login.
+                if ( function_exists( 'trustie_free_set_review_link_cookie' ) ) {
+                        trustie_free_set_review_link_cookie( $order_id, $email );
+                }
+
                 // Get the product.
                 $product = wc_get_product( $product_id );
@@ -740 +746 @@
                 }
 
-                // Straight to the review form, for everyone. Never log anyone in from
+                // Straight to the reviews, for everyone. Never log anyone in from
                 // this link: it does not expire, can be used again, and reaches whoever
                 // holds the email, so signing in from it handed the account - a shop
                 // owner's included - to anyone the email was forwarded to. And guests
                 // are not sent away to log in, because the form takes guest reviews.
-                wp_safe_redirect( get_permalink( $product_id ) . '#respond' );
+                // #reviews, where the stars link too (Sarah, 14 Oct 2026: "just point it
+                // at #reviews"). review-anchor.js opens the tab it sits in.
+                wp_safe_redirect( get_permalink( $product_id ) . '#reviews' );
                 exit;
         }

trustie/tags/1.1.29/includes/shared/assets/js/tracksies-nonce-refresh.js

@@ -49 +49 @@
 
                 var url = cfg.endpoint + ( cfg.endpoint.indexOf( '?' ) === -1 ? '?' : '&' ) +
-                        'action=' + encodeURIComponent( action );
+                        'action=' + encodeURIComponent( action ) +
+                        // A URL no cache has seen. Page and REST caches (LiteSpeed's, at
+                        // least) key on the URL and ignore no-store, and a cached answer
+                        // hands everyone one stored nonce.
+                        '&_tn=' + Date.now().toString( 36 ) + Math.random().toString( 36 ).slice( 2, 8 );
+
+                var headers = { Accept: 'application/json' };
+                // Signed in: without this WordPress runs the request as a logged-out
+                // visitor and hands back a nonce that fails for this session (403).
+                if ( cfg.restNonce ) {
+                        headers[ 'X-WP-Nonce' ] = cfg.restNonce;
+                }
 
                 inflight[ action ] = fetch( url, {
                         credentials: 'same-origin',
-                        headers: { Accept: 'application/json' },
+                        headers: headers,
                         cache: 'no-store'
                 } )

trustie/tags/1.1.29/includes/shared/class-tracksies-nonce-refresh.php

@@ -30 +30 @@
         return;
 }
-define( 'TRACKSIES_NONCE_REFRESH_VERSION', '1.0.0' );
+define( 'TRACKSIES_NONCE_REFRESH_VERSION', '1.0.2' );
 
 /**
@@ -220 +220 @@
                 // visitor the same stale token the page already had.
                 nocache_headers();
+                // LiteSpeed's REST cache ignores the headers above (Noble Ink, 14 Oct
+                // 2026: X-LiteSpeed-Cache: hit on this URL) and handed every visitor,
+                // signed in or not, one stored logged-out nonce. Tell it directly.
+                do_action( 'litespeed_control_set_nocache', 'Tracksies nonce refresh' );
 
                 $response = rest_ensure_response(
@@ -227 +231 @@
                 );
                 $response->header( 'Cache-Control', 'no-store, no-cache, must-revalidate, max-age=0' );
+                $response->header( 'X-LiteSpeed-Cache-Control', 'no-cache' );
 
                 return $response;
@@ -252 +257 @@
                         'tracksiesNonceRefresh',
                         array(
-                                'endpoint' => rest_url( self::REST_NAMESPACE . '/nonce' ),
-                                'actions'  => $actions,
-                                'globals'  => (object) $this->get_refreshable_globals(),
+                                'endpoint'  => rest_url( self::REST_NAMESPACE . '/nonce' ),
+                                'actions'   => $actions,
+                                'globals'   => (object) $this->get_refreshable_globals(),
+                                // A REST request carrying the login cookie but no X-WP-Nonce
+                                // is run as a logged-OUT visitor (core rest_cookie_check_errors),
+                                // so without this the endpoint minted a logged-out nonce and the
+                                // script swapped it over the page's good one: every Trustie AJAX
+                                // call a signed-in customer made after their first click got 403
+                                // (found on a live store, 14 Oct 2026). Only signed-in pages need
+                                // it, and those are never served from a shared page cache.
+                                'restNonce' => is_user_logged_in() ? wp_create_nonce( 'wp_rest' ) : '',
                         )
                 );

trustie/tags/1.1.29/readme.txt

@@ -5 +5 @@
 Tested up to: 7.1
 Requires PHP: 7.4
-Stable tag: 1.1.28
+Stable tag: 1.1.29
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -280 +280 @@
 
 == Changelog ==
+
+= 1.1.29 =
+* Reviews page and testimonial form fixed for signed-in customers.
+* Floating reviews tab and panel font fixed.
+* Verified badge fixed. A new review is verified when the reviewer is signed in and bought the product, or came from that order's review request email.
+* Review email buttons, and the star rating on a product page, open the product's reviews, even when the Reviews tab starts closed.
 
 = 1.1.28 =
@@ -431 +437 @@
 == Upgrade Notice ==
 
+= 1.1.29 =
+Fixes for the reviews page, the testimonial form, review email links and the Verified badge.
+
 = 1.1.28 =
 A security fix for the links in review request emails. Please update.

trustie/tags/1.1.29/trustie.php

@@ -4 +4 @@
  * Plugin URI: https://docs.tracksies.com/docs/trustie-free/
  * Description: Reviews, testimonials, and Google reviews for WordPress. Display star ratings, collect testimonials, show Google Business reviews, and add a floating reviews widget, with or without WooCommerce.
- * Version: 1.1.28
+ * Version: 1.1.29
  * Author: Tracksies
  * Author URI: https://tracksies.com
@@ -40 +40 @@
  */
 if ( ! defined( 'TRUSTIE_VERSION' ) ) {
-        define( 'TRUSTIE_VERSION', '1.1.28' );
+        define( 'TRUSTIE_VERSION', '1.1.29' );
 }
 if ( ! defined( 'TRUSTIE_PLUGIN_FILE' ) ) {
@@ -94 +94 @@
 tracksies_register_shared( 'schema',          '1.0.0', TRUSTIE_PLUGIN_DIR . 'includes/shared/class-trustie-schema.php' );
 tracksies_register_shared( 'helpers',         '1.0.1', TRUSTIE_PLUGIN_DIR . 'includes/shared/class-tracksies-helpers.php' );
-tracksies_register_shared( 'nonce-refresh', '1.0.0', TRUSTIE_PLUGIN_DIR . 'includes/shared/class-tracksies-nonce-refresh.php' );
+tracksies_register_shared( 'nonce-refresh', '1.0.2', TRUSTIE_PLUGIN_DIR . 'includes/shared/class-tracksies-nonce-refresh.php' );
 
 // Nonces baked into cached HTML expire long before the cache does, so every
@@ -129 +129 @@
 // Loaded at file-load time so action hooks are registered before the features class fires them.
 require_once TRUSTIE_PLUGIN_DIR . 'includes/trustie-free-features.php';
+
+// Who gets the Verified badge, and where review email links land.
+require_once TRUSTIE_PLUGIN_DIR . 'includes/trustie-review-link.php';
 
 /**