Categories: Security, Feature, Fix, Perf, Admin, Deps.

[1.3.6] - 2026-06-08

Fix

• Admin UI grids no longer break with Not registered handle <x>_data_source after setup:di:compile. The order-attributes grid's CollectionFactory collections binding moved from etc/adminhtml/di.xml to global etc/di.xml so it merges with the rest of the admin grids instead of replacing them.

[1.3.5] - 2026-06-08

Fix

• Guest checkout no longer fatals with a TypeError. The PaymentInformationManagementPlugin was split into two classes pointing at the right interfaces (logged-in vs guest), so Magento dispatches before<Method> to the correct subject signature.

[1.3.4] - 2026-06-05

Fix

• setup:upgrade no longer fails with "DDL statements are not allowed in transactions" when the default-attributes patch first applies. The patch now opts out of the wrapping transaction so the grid-sync DDL on sales_order_grid can run.

[1.3.3] - 2026-06-05

Fix

• Edit attribute form renders again. A bad dynamic-rows configuration on the Options fieldset was throwing a KO binding error at form init and leaving every section blank. Options are now entered as a JSON array of {value,label} pairs in a textarea.

[1.3.2] - 2026-06-05

Fix

• DI compile passes on PHP 8.4. The Grid Collection's setSearchCriteria() override used the wrong sub-namespaced interface and tripped the LSP check.

[1.3.1] - 2026-06-05

Deps

• Widen magento/module-sales to ^102.0 || ^103.0 so the module installs on both Magento 2.4.7 and 2.4.8+ without manual constraint edits.

[1.3.0] - 2026-06-05

Admin

• Full admin section under Wimakeit > Order Attributes: grid with filters, mass-actions and inline edit / delete, plus a form with collapsible fieldsets for general settings, scoping, display flags, hints, validation, options and file config. Attributes are created and edited from the back-office, no more code-only patches.
• New number input type alongside text, textarea, select, multiselect, date, file, checkbox and radio.

Feature

• Per-store-view and per-customer-group scoping for every attribute, via multiselects backed by junction tables. Empty selection (or the "All …" sentinel) means the attribute applies everywhere.

Perf

• Existing customer-group CSV scope is migrated automatically to the new junction at setup:upgrade time (idempotent, transactional, "all groups" sentinel preserved).

[1.2.0] - 2026-06-05

Feature

• Attribute values are now stored on a dedicated quote-side junction (wimakeit_quote_attribute_value) instead of one flat column per code on the quote table. Adding a new text- or file-typed attribute no longer requires a database column change.

Perf

• Plugin path on the payment-info save dropped a redundant cartRepository->save() round-trip thanks to the new repository writing directly to the junction.

[1.1.1] - 2026-06-05

Perf

• Active attribute configuration is now cached under the wmi_order_attribute cache tag (24 h TTL). Checkout, REST, PDF generation and admin order views no longer hit the DB on every request.

Fix

• Default attributes seeded at install correctly mirror into the flat sales_order_grid table (was silently ignored by plain EavSetup).

[1.1.0] - 2026-06-05

Security

• Uploaded files are now stored under var/wimakeit/order_attributes/ (outside the web root). They are streamed by a dedicated download controller — frontend requires a customer↔order ownership match, admin requires the standard sales-order ACL. The direct media URL is no longer exposed.
• A deny-PHP .htaccess is dropped into the upload tree on first write (Apache mitigation belt-and-braces).

Admin

• One-shot CLI command bin/magento wimakeit:order-attributes:migrate-uploads moves the bytes from the legacy pub/media/ location into var/ and rewrites the order column. Idempotent, supports --dry-run and --limit.

Feature

• Migration is intentionally breaking: existing deployments must run the CLI command. The download controller also serves files in the admin order view, so admins reach uploaded documents through the same path as customers.

[1.0.1] - 2026-06-05

Security

• Upload endpoint now requires an active cart session (rejects anonymous open-bucket uploads), runs a finfo magic-number check after save (rejects renamed shell.php and friends), and validates the form key on every request.
• Path-traversal hardening in the promote-to-order observer: strips ../, ..\\ and NUL characters before the prefix check.
• REST attribute values are length-limited per attribute type (file path 255, text 1000) before they land on the quote.

Fix

• Luma storefront uploads no longer fail silently with HTTP 400 — the JS now falls back to window.FORM_KEY and the form_key hidden input when Hyvä isn't present.
• Dropped the deprecated $order->save(), Magento\Framework\Registry and AbstractModel::load() calls flagged by Magento 2.4.

Deps

• All magento/ constraints pinned to versioned ranges (was ). PHP range widened to certify 8.4 support.

[1.0.0] - 2026-06-03

Feature

• Initial public release. Two seeded order attributes (wmi_ref_bon_commande text, wmi_file_bon_commande file) configured for the order-summary step. Values flow into the admin sales order grid, the order view, the PDF invoice and the confirmation email — each controlled per attribute. Per-store-view label / placeholder / help overrides via wimakeit_order_attribute_store. File-typed attributes upload through a dedicated storefront route with CSRF, extension allow-list and per-attribute size cap. Theme-agnostic core; Hyvä storefront via the companion wimakeit/module-order-attributes-hyva.