ConferenceManager

ცვლილებები

1.5.1

• Fixed: the notice listing events with a category that has no price set could not be dismissed. It had a button, but pressing it did nothing, so the notice stayed on every admin screen until every event was edited.
• Fixed: that notice missed events where a category was left in the table with both its prices cleared. Such a category cannot be registered under, exactly as if the row had been removed, but the notice only looked for missing rows.
• The notice now checks every published event instead of stopping partway, so an event further down the list is no longer missed and reported as nothing to fix. It is shown on this plugin’s screens only, rather than on every admin page.
• Fixed: staff could no longer be added to an existing group registration under a fee category that has no price set for it. The record kept for 1.5.0 covered individual registrations only, and group staff are held separately, so those combinations were missed. They are recorded when this version is activated, exactly as individual registrations were.

1.5.0

• Security: invoices and receipts are no longer written to a public folder. They were saved under wp-content/uploads with sequential file names such as INV-202608-00001.pdf, and My Page linked straight to them, so anyone who guessed a number could read a document carrying a participant’s name, organisation and the amount they paid. Documents are now drawn when they are asked for and delivered through a check that the person asking is the one they belong to. Files already written are removed when this version is activated; nothing is lost, as the documents are rebuilt from your records. Updating is recommended.
• Security: a shared internet connection no longer locks everyone out of self-registration. The limit on requesting a verification code counted every request from one address together and locked that address for an hour, so on an office or campus Wi-Fi the fourth person to sign up stopped everyone behind that connection. The limit is now far higher and any lock lasts ten minutes.
• Security: once a rate limit locked an address, the lock renewed itself every time anyone tried again, so the connection never recovered on its own. A lock now expires as intended.
• Security: entering the verification code for self-registration no longer shares its limit with WordPress sign-in. One person mistyping their WordPress password could stop self-registration for everyone on the same connection, and the other way round.
• Fixed: a member whose record was deleted, or an applicant who was rejected, could never register again with the same email address. Nothing on screen said why — the form simply reported that the member could not be created. The address and membership number are now released when the record is deleted, and addresses released by earlier deletions are recovered when this version is activated.
• Fixed: importing a CSV with “overwrite existing members” turned on cleared the phone number, address and membership number of anyone whose row left those columns blank. A blank cell now leaves the existing value alone. To clear a value, edit that member in Member Management.
• The CSV template now contains all eleven columns the importer accepts, in the same order as the member export, so a file exported from Member Management can be edited and imported straight back. The three columns that were described but missing (membership number, phone, address) are included.
• Added: invoices and receipts can now be issued from Payments and from Participants. Until now they could only be reached from the participant’s own My Page or from the payment confirmation email, so there was no way for an organiser to reissue one on request. Pressing the button twice does not create a second document under a new number.
• Added: the payment date can now be entered when confirming a payment, on both Payments and Participants. It was previously recorded as the moment you confirmed it, which is the date that appears on invoices and receipts. Enter the date the money reached your account.
• Fixed: searching members by keyword did not match the membership number, even though the field is described as searching it, so members could not be found by their number.
• Fixed: registering under a fee category or participation type with no fee set for it was accepted as free of charge and confirmed immediately, with no payment record created. Such a registration is now refused. Correcting a registration’s fee category already refused this; only new registrations let it through. A fee explicitly set to 0 is unaffected, as is an event with no fee table at all. Combinations that have actually been registered free of charge until now are recorded as an explicit 0 when this version is activated, so existing arrangements keep working.
• The fee table on the event screen now says what it means. Tick “Free” to charge nothing, instead of typing 0 — a blank cell no longer means free, it means that participation type is not offered. Rows can be removed with ×, which stops that category being offered at all; members in it are offered the categories that do have a price. A notice lists published events that still have a category with no price set.
• Added: fee categories can now be added to the on-site (day-rate) fee table, and their names edited there. Previously the table only allowed deleting, and the only way to put a category back was to copy every advance price over it.
• Verification code emails now say where to enter the code, with a link to My Page. They previously gave the code and asked you to enter it on the sign-in page without saying where that was.
• A phone number is now required when creating a member from the admin screen. Importing a CSV and editing an existing member are unaffected, so lists without phone numbers still import and members already saved without one can still be edited.
• Outgoing mail now gives up after 15 seconds instead of the five minutes the mail library allows by default, so a slow mail server no longer leaves the visitor’s screen waiting. Self-registration now reports a failure to send instead of saying the message was sent.
• The “Resend verification code” button now waits a minute between presses, and both screens say that mail can take a few minutes to arrive and to check the spam folder. Each press used part of the sending allowance, so repeated presses could stop the sender, and on a shared connection everyone else.

1.4.1

• Fixed the buttons on My Page (Invoice, Receipt, Edit addressee, Save, Cancel) losing their text colour to the theme. Some themes style links inside post content with a rule that outranks the plugin’s own, which left the button text in the theme’s link colour with an underline while the button’s background stayed as it was — so the text could end up unreadable against it. The button colours themselves are unchanged.

1.4.0

• Credit card payment (Stripe) is now a feature of the separately distributed Pro edition and has been removed from this plugin. If you were taking card payments here, you will need the Pro edition to continue; bank transfer is unaffected. Nothing else changes, and no data is removed: existing card payments stay in the payment list, in the totals and on invoices and receipts exactly as before.
• Refunding a card payment recorded before this release now records the refund only. The money is not returned automatically any more — refund it in your payment provider yourself. The screen says so before you confirm.
• If “Credit Card” was selected in Conference → Setup, it is no longer offered on the registration form, so nobody can choose a payment method that cannot be completed. Bank transfer is used instead.
• Removed the Stripe PHP library and the Stripe JavaScript packages from the plugin, which makes the download about 3.5 MB smaller.
• Conference → Setup no longer describes an automatically generated encryption key as needing nothing further. When the key is not defined in wp-config.php the plugin stores it in the database, next to the data it protects, so it offers limited protection if a database backup is leaked. The screen now says so, and shows how to move the key out of the database. Encryption itself is unchanged and still works either way; this is a correction to what the screen told you, not to how your data is stored.

1.3.0

• Security: removed the unused passkey (WebAuthn) sign-in endpoints. Signing in with a passkey was never available anywhere in this plugin’s interface and could not be used, but the endpoints themselves were reachable and did not check what they were given as thoroughly as they should have. Updating is recommended. Registering a passkey, which requires a logged-in WordPress user, is untouched, and signing in to My Page with a one-time code is unaffected.
• Removed a My Page code path that looked for a passkey session token where one was never stored, so it could never match anything. The “can edit” flag it fed was already always off, so nothing changes for anyone signing in with a one-time code.
• Corrected the feature list here and the What’s New screen in the admin, both of which described signing in to My Page with a passkey. That has never been available in this plugin; My Page sign-in uses a one-time code sent by email.
• Security: CONF_MANAGER_TRUSTED_PROXY no longer accepts a prefix length of 0. A range that wide covers every address on the internet, which is never what a proxy is, so it is now refused like any other invalid value. Sites that have not set this constant, and sites that have set it correctly, are unaffected.
• Fixed: the Participants screen showed the billed amount without tax, while the Payments screen, invoices, receipts and the settlement difference all include it. The same registration appeared to cost 10% less (8% for events on that rate) depending on which screen you looked at. The records themselves were always correct; only this column and the edit dialog were wrong.
• Fixed: payment dates were shown and exported in UTC. In Japan that put every payment confirmed between midnight and nine in the morning on the previous day. The Payments list, the payment detail dialog and the payments CSV now use the timezone set in Settings → General.
• Fixed: filtering payments by date compared local dates against those UTC values, so asking for a day’s payments left out anything received before nine that morning. The day is now converted before it is compared. (This filter is available through the REST API only; there is no field for it on the screen.)
• Fixed: when a request failed, some screens showed an empty red notice, or the words “API Error”, with nothing to say whether the problem was a permission, a server error or a dropped connection. Those messages now carry the reason and the status code.

1.2.5

• Fixed: marking a participant as paid from the Participants screen did not record the payment itself. The registration showed as paid while the payment stayed unreconciled, so it was missing from the Payments screen and from the amount received, and a receipt could not be issued for it at all. Marking a participant paid now reconciles their outstanding payment, at the billed amount. Payments reconciled from the Payments screen keep the amount actually received, as before.
• Security: forwarding headers such as X-Forwarded-For are no longer trusted unconditionally. Anyone could previously send one naming any address they liked, which meant they could get an innocent third party locked out of login or one-time codes, write that third party into the audit log in place of themselves, and leave no record of where the request actually came from. Headers are now used only when the connection arrives from a proxy the site trusts: one declared in wp-config.php, a private or reserved address (a reverse proxy on the same host), or a Cloudflare address range. Otherwise the connecting address is used and the header is discarded.
• Security: a mistyped trusted-proxy range such as 198.51.100.0/ or 198.51.100.0/abc was read as /0 and matched every address, which turned the protection above completely off without any sign that it had. The prefix length must now be digits.
• Sites behind a CDN or reverse proxy other than Cloudflare: if a forwarding header is ignored and doing so changes which address the plugin sees, an admin notice now says so and shows the exact define() line to add to wp-config.php, using the range the page was opened from. The notice can be dismissed if no proxy is in front of the site. Sites with no proxy, and sites behind Cloudflare, need to do nothing.
• Fixed: invoices and receipts printed “Consumption tax (10%)” whatever the event’s tax rate was, so a tax-exempt event produced a document reading “Consumption tax (10%): ¥0”. The printed rate is now the one that accounts for the printed amount, so the rate, the net amount and the tax on the document always agree.
• Privacy: uninstalling with data removal enabled now clears plugin options and transients by prefix rather than from a fixed list. A list misses whatever was added since it was written — in this case the bounced-email record, which is keyed by email address and was left behind in the database. My Page session and passkey tokens are also cleared, so a removed plugin cannot leave a usable way in. Uninstall still keeps your data by default; nothing is removed unless you opt in.
• Tested up to WordPress 7.1. The test suite now runs on WordPress 7.1 and on 6.9, the oldest version this plugin supports.

1.2.4

• Fixed: a shortcode naming a view that only exists in the Pro edition — for example [conf_manager view=”reviewer-apply”] or view=”sponsors” — quietly displayed the attendee registration form instead. Anyone opening what was meant to be a reviewer application or a sponsor listing could submit a registration, and it was recorded as a real one. Those views now stop instead of falling back, and a note explaining why is shown to users who can edit the page. A mistyped view name still falls back to the registration form, as before.
• Fixed: the one-time code for My Page was limited to 3 requests per hour per IP address, with a one hour lockout. At a university, a company or a conference venue, where many people share a single public IP address, the fourth person to request a code locked everyone out for an hour. Because the send itself was refused, no code arrived and the cause was invisible from the organiser’s side. The limit is now 50 per hour with a ten minute lockout, while the existing per-address limit of 5 per hour continues to stop abuse aimed at one mailbox.

1.2.3

• Fixed: exporting members to CSV returned at most 100 rows. The export asked for up to 10,000, but the underlying search caps a request at 100, so the file was silently short — it looked like a complete export. It now pages through every matching record. If an export ever reaches the 20,000 row safety limit, the file says so on its last line instead of ending quietly.
• Fixed: lists that page through records were ordered by a value that repeats — the date a record was created, or an event’s start date. Rows sharing that value have no guaranteed order between pages, so a record could appear twice or be passed over. Every paged list now falls back to the record id, which is unique.
• Fixed: after a successful encryption key rotation the plugin still warned that data could not be read, because it kept comparing against the previous key. The warning is now cleared when the rotation completes with no errors — and deliberately kept when any record failed, since that is exactly when the warning is worth seeing.

1.2.2

• Fixed: the encryption key warning told every site to restore the key in wp-config.php, even when the key was never kept there. Sites installed with the default settings keep an automatically generated key in the database instead, so that advice sent administrators looking for something that was not there. The warning now says where the key actually is.
• Fixed: in the most common way this warning appears — adding the CONF_MANAGER_ENCRYPTION_KEY constant to wp-config.php on a site that had been running on the automatically generated key — the previous key is still held in the database, and the warning now says so and how to put it back. That case is fully recoverable in one step; it previously read as though the data were lost.
• Security: dismissing the encryption key warning now requires submitting the form’s button. It was previously a link, and a link that changes state can be followed by a browser or extension prefetching it, which would have moved the reference point forward and removed the warning without anyone clicking it — erasing the only sign that the key had changed. Requests that are not form submissions are refused.
• Fixed: the key rotation routine paged through records by position rather than by record, while updating those same records as it went. Nothing guaranteed the order between pages, so a record could be passed over and left encrypted with the previous key. It now advances by record id, and stops if a page fails to advance.

1.2.1

• Security: the plugin now notices when the encryption key changes and says so in the admin area. Personal data encrypted with the previous key cannot be read until that key is restored — the data is intact, but nothing in the plugin can recover it on its own, so the warning appears while the mistake is still easy to undo. Only a hash of the key is stored; the key itself never is.
• Fixed: the key rotation routine skipped any table without a “status” column and still reported success, which would have left some records readable only with the old key.
• The Setup screen no longer claims that encrypted data is unreadable if the database is compromised, regardless of where the key is kept. That is true only when the key is defined in wp-config.php. With the default automatic key, the key lives in the same database as the data, and the screen now says so.
• The readme’s answer on personal data protection now states which key location is recommended and why, that a key shorter than 16 characters is ignored, and that adding or changing the key after data has been stored makes existing data permanently unreadable.
• Removed unused code that generated a fresh encryption key. It was never reachable, but wiring it up would have made existing encrypted data unrecoverable.

1.2.0

• New: a “What’s New” screen under the Conference menu, listing what this plugin can do — newest additions first, with the version each one arrived in — followed by what the separately distributed Pro edition adds. The screen is static: it renders no images, makes no external requests, and stores nothing.
• The readme now states plainly that a separate Pro edition exists. This plugin is unchanged in what it does: every feature it ships remains fully functional, and none of the Pro edition’s code is included in this package.

1.1.12

• Fix: sites that had already skipped a database upgrade are now repaired. Before 1.1.11, activating the plugin recorded the schema version without running the pending upgrades, which left the recorded version up to date while the data was not. Because the version already looked current, 1.1.11 alone could not detect or repair those sites. This release re-runs the 1.1.9 and 1.1.10 data upgrades once, so the amount actually received is filled in and refunds made before 1.1.9 are moved into the settlement ledger. Both steps only touch rows that were never migrated, so sites that are already correct are left untouched.
• Database schema auto-upgrades to v3.4.0.

1.1.11

• Fix: pending database migrations were skipped when the plugin was updated by deactivating it, replacing the folder and activating it again. Activation stamped the schema version without running the migrations, so the upgrade steps introduced in 1.1.9 and 1.1.10 never ran on those sites. Activation now runs them. This stops the problem from happening again, but it does not recover a site that had already skipped a migration — see 1.1.12, which does. Sites updated through the normal WordPress plugin updater were never affected.

1.1.10

• Fix: refunds issued before the settlement ledger was introduced in 1.1.9 were not counted, so the net amount received was overstated by the refunded amount and the payment could be shown as fully settled. Those refunds are migrated into the ledger on upgrade. A full refund is migrated using the amount actually received, because full refunds recorded before 1.1.9 stored only the tax-exclusive amount.
• Fix: a payment that has been refunded in full is no longer reported as needing a surcharge. A full refund cancels the registration, so the billed amount is no longer outstanding and the payment now counts as settled. Partial refunds are unchanged and are still settled against the difference.
• Fix: uploading or deleting an abstract template on the event screen did nothing because of a missing script import.
• Database schema auto-upgrades to v3.3.0.

1.1.9

• Payments: the billed amount and the amount actually received are now tracked separately. When confirming a payment you can record the real amount received (for example when a bank transfer fee was deducted) together with a handover note for the reception desk or accounting. The payment list gains Billed, Paid and Difference columns and highlights rows that still need attention.
• Payments: a single “Settle” dialog replaces the old refund dialog and covers all four cases — refunding the difference, collecting a surcharge, refunding in full and cancelling the registration, and correcting a mis-recorded paid amount. Refunds and surcharges are kept as a dated ledger with the method and the staff member who handled them, and are reflected in the event totals.
• Participants: a registration’s fee category can now be corrected after payment has been received. The billed amount is updated while the amount actually received is left untouched, so the resulting difference is surfaced as “Refund due” or “Surcharge due” instead of being silently lost. Receipts that were already issued are regenerated under the same receipt number.
• Participants: the list is now scoped to a single event (defaulting to the most recent one), shows status and settlement badges, and consolidates category correction and status changes into one “Edit / Payment” dialog.
• Fix: full refunds are now calculated on the tax-inclusive amount actually received. Previously a full refund recorded only the tax-exclusive amount, so a ¥8,800 payment was recorded as an ¥8,000 refund while Stripe refunded the full ¥8,800.
• Fix: payments reconciled before this release, which carry no recorded paid amount, have it backfilled from the billed amount on upgrade. Without this, correcting a fee category would move the substituted value along with the billed amount and a needed refund would never be detected.
• CSV export gains paid amount, refund, surcharge, net paid, difference and handover-note columns, and no longer quotes plain numbers so they open as numbers in Excel.
• Payment confirmation emails now show the billed amount and the amount received side by side.
• Database schema auto-upgrades to v3.2.0.
• Updated the bundled Japanese translation for the new strings.

1.1.8

• Improve: email verification (OTP) and My Page login-code emails now include the sender site name, purpose, and a contact footer (taken from your site settings) instead of a bare code. This reduces the chance of the message being flagged as phishing and rejected or spam-foldered by strict mail providers (e.g. Yahoo! Japan).

1.1.7

• Fix: editing and saving a member who has no member number no longer fails with “Failed to update member.” Previously, when two or more members had no member number, saving the second such member triggered a unique-key conflict on an empty member number. Empty member numbers are now stored as NULL (consistent with member creation), so any number of members can be saved without a member number.
• Members: added a little more spacing between each field label and the control above it in the New/Edit Member dialog for easier reading.

1.1.6

• Receipts: participants can now edit the addressee name and company/department of their receipt from My Page and have the PDF reissued under the same receipt number (so only one valid receipt ever exists). Useful when payment was made under a company, workplace or family name. Ownership is verified before editing, and the proviso text is unchanged.
• Registrations: added an optional bank-transfer name note field, so a participant paying by bank transfer under a different account name (for example a company or family member) can tell the organizer the name the transfer will arrive under. It is shown to administrators on the Participants and Payments screens and is never printed on the receipt.
• Updated the bundled Japanese translation for the new strings.

1.1.5

• Notifications: the recipient for the new-registration admin notice is now configurable on the Setup screen. You can enter one or more addresses (comma-separated); leaving it blank falls back to the WordPress admin email. The notice is enabled by default and includes a link to the admin dashboard while keeping personal contact details out of the email body.
• Participants: administrators can now correct a registration’s fee category and on-site/online participation type from the Participants screen. The fee, tax, label and status are recalculated automatically; a pending payment amount and any issued invoice are kept in sync. Editing is limited to unpaid (pending/confirmed) individual registrations.
• Fix: the admin screen no longer goes blank when publishing a newly created event (and similar actions). A display-error boundary now recovers gracefully with a reload prompt instead of a white screen.
• Updated the bundled Japanese translation for the new strings.

1.1.4

• Free events: registrations whose total is ¥0 are now confirmed automatically (no payment record is created, and the confirmation email omits the bank-transfer details). Applies to both individual and group registrations.
• Event editor: fee fields now accept and keep a value of 0 (previously 0 was cleared to blank), with a placeholder and a note clarifying that blank or 0 means free. Added a delete button for custom fee types in the on-site fee table.
• Safety: uninstall now keeps your data by default, and a duplicate-load guard prevents fatal errors when an older copy of the plugin remains installed in another folder.

Earlier versions

Entries for 1.0.3 to 1.1.3 are not listed here, so this section stays within the length the plugin directory displays. They are in the readme of those releases.