BitForgeNet Guest Tickets and Door Check-in

Changelog

1.2.1

Two security fixes, both reported responsibly by Alik, who tested 1.0.9 in
an isolated environment and sent a clear, accurate write-up of each. Both were
real. Thank you.

Bookings for one event now happen one at a time. Counting the free seats
and taking one were two separate steps, and between two steps another request
fits: two people clicking at the same instant could both be told there was one
seat left, and both take it. The capacity check was never wrong — it was just
on the wrong side of a gap. That gap is now closed with a lock held for the
length of a booking, per event, so a busy night with four events does not queue
into one line. Every capacity rule is now inside it: the event’s own capacity,
each price category, and each area of the room. (CWE-362.)

Forwarding headers are no longer believed by default. The plugin recognises
a visitor by their address in order to count how often they book. It used to
read CF-Connecting-IP, X-Real-IP or X-Forwarded-For if they were present —
but those are written by whoever is making the request, so anybody could invent
one and get a fresh allowance. Only the address the connection actually came
from is used now. If your site really is behind Cloudflare or a reverse proxy,
say so under Settings → Anti-abuse, and the panel shows you what your server is
actually sending so the choice is not a guess. Naming your proxies in
wp-config.php as BFNET_TRUSTED_PROXIES narrows it further. Where a list of
forwarded addresses is read, the plugin now takes the entry the nearest proxy
wrote rather than the one at the front, which is the one a visitor can invent.
(CWE-799.)

Also: a second booking limit counted per email address, so getting around
the per-connection one is no longer enough on its own.

1.2.0

Everything below arrived since 1.0.9. It was built and tested over several
internal builds; this is the first of them anyone is offered, because a version
that was superseded the same week is not a version worth installing.

Rooms and places. An event can now describe where people sit. Three levels,
and nobody is made to climb them: a plain capacity, named zones with a capacity
and a price each, or — with Pro — a drawn floor plan. Seats are worked out
from a rule rather than stored, so a four thousand seat auditorium is twenty
rows in your database and not four thousand. The numbering runs whichever way
your venue counts: left to right, right to left, odd and even out from the
centre, alternating by row. It can skip row I and O, skip 13, start anywhere,
and carry a prefix.

Card payment with Stripe. Set your own secret key and a guest can pay on
Stripe’s own page. No card number reaches your site. A payment is confirmed by
reading it back from Stripe and by a signed message Stripe sends your site —
never by the browser that came back. Your places are held for the length of the
payment session and released on their own if nobody finishes, so the same seat
cannot be sold twice. Card payment is optional, per event: an evening paid at
the door works exactly as it did before.

When the ticket goes out, per event. Acknowledge the booking now and send
the ticket once you have decided where somebody sits, or — when the event has
a room — send it straight away with the place printed on it.

The booking page no longer depends on a page. If a direct link to an event
has nowhere to open, the plugin renders the booking form itself inside your
theme. It also creates the booking page for you, once, rather than leaving a
link that opens nothing.

Fixed

• A booking link opened an empty page on sites that had never added the
  shortcode themselves.
• Guest rows two and after on the manual booking screen were greyed out instead
  of hidden, because the plugin’s own stylesheet beat the browser’s rule.
• The Reserve button was clipped by themes with their own line height.
• Sold-out categories were still offered for booking; a category is now closed
  by the room as well as by its own capacity, and the last place is re-counted
  at the moment the booking is written rather than only when the page was
  drawn.
• Reverting a booking to awaiting payment cleared the check-ins but kept them
  in the history, named.

Also added

• Add a guest by hand, for the bookings that arrive by phone.
• A live floor view of the evening — what is taken, what has arrived, and what
  is full — with the room drawn as the organizer drew it.
• The confirmation screen says which address the email went to, and to look in
  the spam folder.
• Keyboard in the plan editor: undo, redo, delete, escape, shift to select
  several, and a number beside every slider.

1.0.9

• The logo printed on the ticket, on the door’s code screen and beside an
  organizer with no artwork of its own is the anvil alone. It had been the full
  lockup, wordmark included, which the renderer fits inside its box: a wide
  image with words in it shrank to a smudge nobody could read
• The plugin’s page is rewritten. The feature list now says what this plugin
  actually does — the organizer and venue libraries, the export column picker,
  the system check and the archive were all shipped and none of them were
  mentioned, while three of them were wrongly described as belonging to Pro.
  The Pro section says what Pro adds instead of hinting at it, and the FAQ
  answers fifteen questions rather than five. No code changed for this

1.0.8

• Every template under admin/views/ and public/views/ states once, at the top of
  the file, that the PrefixAllGlobals naming rule does not apply to it. A
  template is included from a method, never at file scope, so its variables
  belong to that method’s scope rather than the global one, and PHPCS — reading
  each file on its own — has no way to see where the include happens. No
  variable was renamed and nothing behaves differently

1.0.7

• The plugin is renamed. It was submitted as “2KEvents”, and “2K” is a
  registered trademark of Take-Two Interactive that we have no right to lead a
  name with. The display name, the slug, the text domain, the shortcodes and
  every PHP prefix now read BitForgeNet — the name of the site that publishes
  it, bitforgenet.dev
• Every stylesheet and script the plugin prints goes out through the enqueue
  API. The door station and the two screens around it are their own HTML
  documents, served on their own endpoint before the theme runs, so they had
  carried their CSS and JS inside the page. They now register handles and print
  them by name, the two runtime values arriving through wp_add_inline_style()
  and wp_add_inline_script()
• The admin menu icon is assembled from the mark at runtime and has no file
  behind it, so it registers a style handle with no source rather than printing
  a style tag into the head, and moves to admin_enqueue_scripts
• The code prefix is five characters. It was three, which is under the four the
  directory asks for

1.0.6

• Finished the tidy-up the last two releases started: every code-quality
  suppression in the plugin is now either stated once for a whole file or
  written on the single line it covers, and none of them can change the
  meaning of another one elsewhere in the same file. No behaviour changes

1.0.5

• Fixed suppression comments that did not cover what they appeared to cover.
  One kind switched every code-quality rule back on rather than the one it had
  switched off, quietly undoing notes written elsewhere in the same file; the
  other sat above a nine-line statement instead of around it. No behaviour
  changes for anyone using the plugin

1.0.4

• Request input is now read the way it should be read: eight admin screens
  applied the integer cast to the whole expression rather than to the value,
  and the export column list is sanitised where it arrives rather than three
  calls later
• The design proof screen now checks its parameter exists before reading it
• Every file that queries the plugin’s own tables says so once, at the top,
  with the reason
• Dropped a call asking WordPress to load translations it already loads by
  itself, and closed a hatch that let the QR encoder run outside WordPress

1.0.3

• Fixed translatable strings that a translator could not have got right. The
  guest counter on an order wrote its two numbers as bare placeholders, which
  a language that reorders the words has no way to move, and several strings
  carrying a placeholder had no note saying what the placeholder holds.

1.0.2

• The plugin header pointed at a placeholder address. It now points at the
  plugin’s own page, and the author is named.
• The address authorised to reset the plugin’s data shipped with a developer’s
  own address already filled in. It now starts empty, and the tool refuses to
  run until an administrator sets one.
• Added the full text of the SIL Open Font License beside the bundled Poppins
  and Lora fonts, as that licence requires.

1.0.1

• Fixed the door station refusing every scan with “Station closed”. The page
  opened and showed the event, but each scan was posted to an address that no
  longer said which event the station was watching, so the server treated it as
  a station that had signed out. Nobody could be checked in

1.0.0

• First release.