Home / Changelog

Changelog

Sunshine Photo Cart

Version: 3.7
Tested Up To: 7.1
Requires WP: 5.5
Requires PHP: 7.4

3.7 – August 27, 2026

  • ✨ NewBilling address is now its own step at checkout, so you can record the address of the person paying even when the order is being shipped somewhere else. Invoices need the buyer’s address, and the buyer is not always who the parcel goes to. On orders that ship, the customer gets a “use shipping address as billing address” box that is already ticked, so nothing extra to fill in unless the two differ
  • 🔨 ChangeThe “Always collect an address” setting is now “Always collect a billing address” and applies to every order, not only orders with nothing to ship
  • 🔨 ChangePayment methods that require a billing address, such as Square, now collect it at its own step rather than partway through the payment step
  • 🔨 ChangeTax is now worked out from where the order actually changes hands. Shipped orders use the shipping address, orders collected in person use your store’s address because the goods never move, and downloads use the customer’s billing address. Previously anything without a shipping address fell back to the store address whether that was right or not
  • 🔧 FixedTax shown on the first view of the cart or checkout could be based on a different address than the order total used, because items worked out their own tax before the delivery method was known
  • 🔧 FixedChoosing a pickup location and continuing no longer leaves the order thinking it still needs shipping. The pickup location was being saved in a form the checkout could not read back, so the order was treated as being shipped, which could apply the wrong tax and ask for a shipping address that was not needed
  • 🔧 FixedChanging the address at checkout to one that no tax rate covers now correctly removes the tax. Previously the rate found for the earlier address stayed applied, so a customer could be charged tax that does not apply where they are, at an amount that shrank each time the checkout refreshed
  • 🔧 FixedSquare was being sent the buyer’s name and country under field names it does not recognise, so it ignored them and verified cards without knowing where the buyer was. Card verification is required for European cards, and missing details there are a common cause of declines
  • 🔨 ChangeSquare card verification now happens as part of tokenizing the card, which is the method Square currently recommends. The older separate verification step has been deprecated by Square
  • 🔧 FixedSquare now receives the billing address the customer actually gave. It was read from the checkout form as the payment was taken, which no longer works now the billing address is collected at an earlier step, and the copied address was only being saved to the order rather than passed on. Both the card verification and the payment record now get the right address whether the buyer typed one or reused their shipping address
  • 🔧 FixedOrders no longer store a meaningless billing_method value alongside the real billing address
  • 🔧 FixedGallery, product and order names containing an ampersand could show as “&” in admin dropdowns, breadcrumbs, order screens and on the gallery page. The name was being escaped twice on sites where WordPress had already stored the ampersand encoded
  • 🔧 FixedThe parent gallery path in the orders list gallery filter now shows a real “>” between gallery names instead of the raw code for it
  • 🛠️ DevA payment method now asks for a billing address by setting $needs_billing_address on its own class, and the checkout works the rest out from there, so an add-on gateway declares it the same way the built in ones do. New filters sunshine_checkout_needs_billing_address and sunshine_checkout_section_billing. The checkout no longer uses the customer_ address prefix, which only ever existed to be renamed to billing_ when the order was saved; sunshine_checkout_section_address is gone with it
  • Performance: The session cookie is now only set once a visitor has something to remember (items in the cart, a favorite, a gallery password), instead of on every request. Pages with no Sunshine content no longer send a cookie, so hosts and caching plugins can serve them from cache again
  • Performance: Visitors who already have a session are no longer sent a replacement cookie on every page view, only when the existing one is close to expiring
  • Performance: The session cookie is now removed once there is nothing left to remember, such as after a cart is emptied, so returning visitors can be served cached pages again instead of waiting for the cookie to expire
  • Performance: With an empty cart, the shipping, delivery, payment, tax and checkout form setup no longer runs on every page load, cutting around 11 database queries from every request across the whole site
  • Performance: The galleries page now loads galleries a page at a time instead of all at once, significantly reducing memory usage on sites with a large number of galleries
  • 🔒 SecurityThe session cookie is now flagged HttpOnly, and Secure on sites served over HTTPS, so it can no longer be read by scripts in the browser
  • 🛠️ DevNew filters sunshine_session_lazy_cookie and sunshine_session_destroy_when_empty to restore the previous session cookie behavior
  • 🛠️ DevNew filter sunshine_email_headers to modify outgoing email headers
  • 🔧 FixedOrders can no longer be submitted with a required section left unfilled, which could produce an order with no address on it at all. Checkout now re-checks every required field before the order is created and sends the customer back to whatever still needs completing
  • 🔧 FixedThe Delivery Method step no longer appears or disappears partway through checkout, which could walk customers through the steps out of order (shipping address before delivery method). Whether an order can be shipped or picked up is now decided independently of the address, and shipping options that don’t cover the customer’s address are reported at the Shipping Method step instead
  • 🔧 FixedA customer can no longer skip ahead to a later checkout step, including payment, by way of the section links in the page URL
  • 🔧 FixedA checkout step that no longer applies after the customer changes their delivery method is no longer remembered as completed, which could let its address step be skipped
  • 🔧 FixedWhen no shipping option covers the address entered, the Shipping Method step can no longer be stepped past. Previously the customer could continue and only be stopped at payment, away from the message explaining the problem
  • 🔧 FixedA checkout step that fails validation on the server no longer leaves the page sitting on the loading spinner. The step now reloads and shows what needs fixing
  • 🔧 FixedRemoving the last product that requires shipping from the cart (leaving only digital products) now removes the shipping fee instead of leaving it applied at checkout
  • 🔧 FixedSelecting Apple Pay or Google Pay in the Stripe payment method settings no longer causes a checkout error, and payment methods your Stripe account can’t process are now greyed out so they can’t be enabled by mistake
  • 🛠️ DevNew filters sunshine_shipping_fields and sunshine_billing_fields for modifying the checkout address fields, such as offering a different country list for shipping than billing. The existing sunshine_shippingfields and sunshine_billingfields filters (double underscore) still work
  • 🔧 FixedA JavaScript error no longer appears in the browser console on admin pages outside of Sunshine. The admin script sets up tooltips that rely on a library only loaded on Sunshine’s own screens, and it now checks for that library first
  • ✨ NewWarning in the admin when the added fee is being charged but your license already includes the add-on that removes it
  • 🔨 ChangeThe added fee now shows with the order totals, not just in the payment method tab
  • 🔨 ChangeThe fee note on an order now links to the Add-ons page instead of telling you to upgrade when you already have
  • 🔧 FixedThe Add-ons page switch no longer flips back off without saying why
  • 🔧 FixedOrder profit now has the added fee and any discount codes taken off. Figures for past orders change to match
  • 🔧 FixedStripe’s hosted checkout charged the fee in India, Mexico and Malaysia, which are exempt
  • 🛠️ DevNew sunshine_plan_covers_addon(), get_effective_application_fee_percent(), get_order_application_fee(), get_application_fee()

3.6.12 – July 21, 2026

  • ✨ NewZip/postal code fields for tax rates and the Local Delivery method now accept wildcard prefixes (902* matches any code starting with 902) and numeric ranges (90210…99000), in addition to exact comma-separated codes
  • 🔒 SecurityComments on images in password-protected, private, or otherwise access-restricted galleries could be retrieved without passing the gallery’s access check; the comments endpoint now enforces the same access control as the rest of the gallery
  • 🔧 FixedPhotos imported with pre-processed thumbnails (including cloud imports) whose dimensions were unknown could render as an empty gallery in the justified layout; they now fall back to a default size so they always display
  • 🔧 FixedNotes entered on one order could prefill the Notes field on a customer’s later orders at checkout; order notes no longer carry over between orders
  • 🔧 FixedStripe webhook no longer reports a failure to Stripe when it receives a payment that wasn’t made through Sunshine (such as a Stripe Payment Link or another app on the same account); those events are now acknowledged and skipped instead of returning an error, which keeps Stripe from disabling the endpoint
  • 🔧 FixedFatal error on every page load when no payment methods are available (such as when an addon disables them all) and a visitor’s session had a previously selected payment method
  • 🔧 FixedCheckout now requires a valid shipping method before an order can be completed, and re-prompts when a cart change makes the selected method unavailable

3.6.11 – June 29, 2026

  • ✨ NewAs a safety net, Square re-checks recent pending orders in the background so a payment that completes after the customer closes their browser still finalizes on its own. Normal orders are unaffected (they finalize instantly at checkout), and this background check can be disabled with the sunshine_square_background_reconcile filter
  • ✨ NewReconcile Pending Square Orders tool under Sunshine → Tools to check any existing pending Square orders against Square’s API and finalize the ones Square reports as completed
  • ✨ New“Recheck payment status in Square” order action to verify a single pending Square order against Square and finalize it from the order screen
  • 🔒 SecurityRemoved three unused admin AJAX handlers that lacked capability and nonce checks, which could let a logged-in non-admin read or alter image metadata on photos in private galleries
  • ⚡️ ImprovedGalleries with large numbers of photos load with fewer database queries; the gallery no longer re-reads its full photo list from the database on every internal lookup
  • ⚡️ ImprovedOrders with many items load with far fewer database queries on the order, account order history, and receipt screens by loading all item details in a single query instead of one query per item
  • 🔧 FixedRe-submitting a Square payment (re-entering a card after a prior attempt) no longer shows a confusing “Different request parameters used for the same idempotency_key” error; the gateway now skips charging an already-paid order and recovers the original payment instead of charging again, including the case where the first charge succeeded but its response was lost before the order recorded it (the payment is located via the Square order and the order is finalized)
  • 🔧 FixedThe checkout button is now disabled and shows “Processing payment…” while a Square charge is in flight, so a slow charge no longer tempts buyers to click again or refresh (which was the main cause of the duplicate-submission error)
  • 🔧 FixedA failed Square refund now reports the actual reason in the admin notice and the log instead of failing silently, and refunds against an order whose Square mode has no connected credentials now show a clear message
  • 🔧 FixedQuick Edit checkbox fields (such as a product’s Taxable setting) did not save when checked, leaving the value empty
  • 🔧 FixedThe per-image Watermark checkbox on the attachment edit screen showed unchecked even when the image was set to be watermarked
  • 🔧 FixedPayPal rejecting tax-included orders with a discount due to a breakdown mismatch
  • 🔧 FixedPercentage payment fees charging more than the cart total when a discount was applied
  • 🔧 FixedAccount endpoints could return a 404 after their slug was changed because the rewrite rules were never refreshed; saving any account endpoint setting now flushes rewrite rules automatically, and rewrite rules are also refreshed when the plugin updates
  • 🔧 FixedThe Account Details and View Order account endpoints used a different default slug on the settings screen than the one actually registered, which could cause those pages to 404 after saving settings; the defaults now match
  • 🔧 FixedSquare orders could be left in pending status after the customer was charged at Square. The gateway now validates Square’s payment status before completing the order and recovers any stuck orders on the next checkout page load
  • 🔧 FixedSquare orders on stores with tax-inclusive pricing and a discount sent a total to Square that did not match Sunshine’s total, so the line-item breakdown did not appear in the Square dashboard; Square is now told the tax is included in the price so its computed total matches and the itemization shows
  • 🔧 FixedStripe orders could be left on “Pending Payment” after a successful charge when the payment was retried at checkout
  • 🔧 FixedStripe orders could be marked “Failed” even though the payment succeeded
  • 🔧 FixedViewing an order with no stored cart snapshot (such as an imported order) could cause an error on the order’s items screen

3.6.10.1 – May 28, 2026

  • 🔧 FixedGalleries returning 404 after upgrading to 3.6.10 caused by a change in how option defaults were resolved
  • 🔧 FixedSites that had favorites disabled before 3.6.0 had their setting silently re-enabled by the 3.6.0 migration; favorites are now restored to their original disabled state
  • ⚡️ ImprovedDashboard widget now reports net revenue (gross minus refunds) for this month, last month, and lifetime totals

3.6.10 – May 27, 2026

  • ✨ NewPickup is now a cloneable shipping method. Configure multiple pickup locations — each with its own price, taxability, and customer-facing details — and each appears as its own option at the delivery step on checkout
  • 🔧 FixedDisabling favorites in settings did not hide the favorite button in the image menu or the Favorites link in the main navigation
  • 🔧 FixedUpdate detection used a string comparison that failed for certain version transitions, so post-update routines did not run

3.6.9 – May 22, 2026

  • ✨ NewOrder admin “View packing list” bulk action redesigned as a print-ready fulfillment checklist with per-order customer/delivery/address header, checkbox column, and page break between orders
  • ✨ New“View packing list” link on the single order screen to open the fulfillment checklist for that order
  • ✨ NewFilter sunshine_admin_order_items_custom_rows lets add-ons replace the default row rendering in the fulfillment checklist for custom cart item types
  • ⚡️ ImprovedSquare payments – fixes stuck pending orders, duplicate charges, missing buyer info, and 3D Secure handling. Itemizes line items, tax, shipping, and discounts via Square’s Orders API. Passes the Sunshine order number to transactions, stores card brand/last 4/expiry on orders, and tracks Square processing fees (auto-refreshed daily) as a new column on the order export
  • ⚡️ ImprovedStripe Hosted Checkout – tax now passed via Stripe’s tax_rates so it appears in Stripe’s tax reports, shipping uses Stripe’s shipping_options for proper categorization, transaction descriptions match the inline checkout format, and Stripe processing fees appear in a new column on the order export
  • ⚡️ ImprovedDigital download line items skip the checkbox in the fulfillment checklist since they’re already delivered
  • ⚡️ ImprovedLicense settings now tell you how to fix activation when a license is still in use on a previous site URL, including a direct link to manage your sites on sunshinephotocart.com
  • 🔧 FixedProduct meta box field conditions from multiple add-ons stacked on the same field no longer contradict each other when toggling product type
  • 🔧 FixedOrder line item prices in the admin and on order receipts used the current tax display setting instead of the one saved when the order was placed
  • 🔧 FixedGalleries with a cleared expiration date could be permanently deleted by the daily privacy cleanup cron when expired-gallery deletion was enabled
  • 🔧 FixedCustomer email link in order receipt and status emails prepended http:// instead of using a mailto: link
  • 🔧 FixedDuplicate customer and admin receipt emails sent for Stripe hosted checkout orders when webhooks were enabled
  • 🔧 FixedCountry dropdown change at checkout saved to an incorrect session key
  • 🔧 FixedAn admin’s own customer profile page in admin view could show orders belonging to guests

3.6.8 – May 7, 2026

  • 🔒 SecurityHardened several admin and checkout endpoints with capability and nonce checks
  • ✨ NewQuick Edit support for galleries to inline-edit gallery type, password, allowed customers, access type, expiration, comments, sharing, products, and price level
  • ✨ NewQuick Edit support for products to inline-edit type, price, taxable, shipping, and quantity limits
  • ✨ NewBulk Edit support for galleries to update gallery type, allowed customers, access type, expiration, comments, sharing, products, and price level across many galleries at once
  • ✨ NewBulk Edit support for products to update type, taxable, shipping, and quantity limits across many products at once
  • ✨ Newquick_edit and bulk_edit field flags so add-ons can opt their meta box fields into the inline editors
  • ✨ NewCompatibility with Polylang and WPML so Sunshine pages (cart, checkout, account, etc.) resolve to the current-language translation
  • 🔧 FixedDiscount coupons and store credits ignored by Stripe Checkout (redirect) flow, causing the full pre-discount amount to be charged

3.6.7 – April 27, 2026

  • ✨ NewFilter sunshine_store_product_item_link to allow add-ons to replace the store product modal with a direct link
  • ✨ NewActions sunshine_gallery_password_before, sunshine_gallery_password_after, sunshine_gallery_email_before, and sunshine_gallery_email_after to add custom content around gallery password and email fields
  • 🔧 FixedGalleries requiring email entry now correctly block access until an email is provided
  • 🔧 FixedClassic/Cover theme menu CSS fixes
  • 🔧 FixedFlat rate shipping calculations to consider if line items need shipping when doing advanced shipping calculations

3.6.6 – April 20, 2026

  • 🔧 FixedAdmin email for customer signup missing template tags
  • 🔧 FixedTax calculations when price includes tax, discount used, and discounts applied before tax
  • ⚡️ ImprovedAllow more source options for filling multi-image/packages
  • ⚡️ Improved[sunshine_gallery] shortcode looks for current gallery ID as fallback
  • 🔨 ChangeMain menu CSS adjustments – selectors less strict

3.6.5 – March 30, 2026

  • 🔧 FixedRegenerated images not re-uploaded to cloud storage after watermark changes
  • 🔧 FixedProduct categories created via the block editor not appearing on the taxonomy management screen
  • 🔧 FixedSingle product mode not triggering multi-image product image selection UI
  • 🔧 FixedRedundant product database queries causing lock contention on high-traffic sites

3.6.4 – March 19, 2026

  • ✨ NewPrivacy setting to automatically delete galleries a specified number of days after they expire
  • 🔧 FixedGoogle address autocomplete not working for address fields at checkout
  • 🔧 FixedTax calculated on pre-discount subtotal when discounts are applied before tax
  • 🔧 FixedPackage image selection showing blank when switching source dropdown on second or later items

3.6.3 – March 13, 2026

  • ⚡️ ImprovedMigrated image keywords to dedicated meta key for significantly faster search performance on large sites
  • 🔧 FixedImage keyword search not returning results due to incorrect post status filter and metadata escaping
  • 🔧 FixedHow it checks for Imagick during watermarking process to really be sure it is available before trying to use it
  • 🔧 FixedOptimized private gallery lookup query that could cause slowdowns on sites with many images

3.6.2 – March 6, 2026

  • 🔒 SecurityAdded nonce verification and access control checks to multi-image select AJAX handlers
  • 🔧 Fixed“Always collect an address” fields not reloading state/province options when country changes
  • 🔧 FixedTax rates not applied when using customer address fields instead of shipping address
  • 🔧 FixedAutomatically show address fields at checkout when tax rates require a specific location
  • 🔧 FixedStripe hosted checkout not including gateway fees in line items
  • 🔧 FixedStripe hosted checkout creating unnecessary duplicate payment intent
  • 🔧 FixedStripe hosted checkout compatibility with Accounts v2 (pass customer ID)
  • 🔧 FixedStripe hosted checkout overriding order status set by other plugins (e.g. digital downloads auto-ship)
  • 🔧 FixedStripe statement descriptor suffix failing when order number contains only digits
  • 🔧 FixedStripe payment failures for zero-decimal currencies (HUF, ISK, etc.) on accounts with older Stripe API versions
  • 🔧 FixedFatal error when guest adds or removes favorites with Analytics addon active
  • 🔧 FixedEmpty autocomplete attribute rendered on form fields when no value is set
  • 🔧 FixedShare favorites not working for guests even when guest favorites are enabled
  • 🔧 FixedWatermarked images now respect EXIF orientation data, preventing incorrectly rotated output
  • 🔧 FixedGuest favorites not merging into account after logging in or registering

3.6.1 – March 3, 2026

  • ✨ NewSetting to enable or disable guest favorites
  • 🔧 FixedImage search query causing database lockups on sites with large posts/postmeta tables due to unconstrained joins
  • 🔧 FixedStripe inline checkout orders not updating to paid status when using webhooks

3.6 – March 2, 2026

  • ✨ NewCaption option added to Thumbnail Content setting (from EXIF metadata)
  • ✨ NewOption to show image caption under single image view
  • ✨ NewAdmin Gallery Navigator – Easier gallery management with lots of galleries and hierarchy
  • ✨ NewGuest Favorites – Users can add images to favorites for single session without account
  • ✨ NewSelection Tray – Show current favorites in a persisent floating section while viewing Sunshine galleries
  • ✨ NewQuickly add all favorites to cart
  • ✨ NewDelay gallery upload image processing so uploads can happen faster
  • ✨ NewStripe – Hosted Checkout
  • ✨ NewStripe – Additional customization options
  • ✨ NewGalleries pagination – paginate the main galleries list with numbered pages, load more button, or infinite scroll
  • ✨ NewSeparate display settings for galleries list (columns, pagination style, per page) and images (columns, pagination style, per page)
  • ✨ NewHoneypot spam protection on login, signup, and password reset forms
  • ✨ NewCompatibility with Imagify, ShortPixel, and Image Optimizer (Elementor) plugins to prevent gallery image optimization
  • ⚡️ ImprovedDirectly to single product details if only one product is available
  • ⚡️ ImprovedSettings now allow setup to set validation comparisons to other fields
  • 🔨 ChangeDisable image sharing also disables sharing in Favorites
  • 🔨 ChangeIf a gallery has both sub-galleries and images, it will show sub gallery list first and then images below
  • 🔧 FixedDo not rely on gallery/image, allow price level to be passed during add to cart from modal for General products
  • 🔧 FixedStripe properly handle zero-decimal currencies
  • 🔧 FixedFallback image dimensions for gallery images when they are not available as they should in rare situations
  • 🔧 FixedToggle email on/off and clicking save button reverted email status
  • 🔧 FixedOrder profit calculation was not taking into account line item discounts
  • 🔧 FixedInfinite scroll pagination now properly waits for DOM to load
  • ✨ NewPrivacy system – New Privacy settings tab with account erasure request handling, bulk personal data removal from orders, and configurable data retention periods for inactive accounts and orders
  • ✨ NewWordPress core “Erase Personal Data” and “Export Personal Data” integration for customer and order data
  • ✨ NewNew “duration” settings field type (number + time unit)
  • 🔧 FixedSearch input fields being stripped out when included in a gallery description
  • ✨ NewLog files now use randomized filenames for improved security
  • ✨ NewNew “Enable PHP error logging” option to capture PHP notices, warnings, and fatal errors to a separate log file
  • ✨ NewLog files are now downloaded through authenticated admin routes instead of direct file access
  • 🔒 SecurityBlock direct web access to log files via .htaccess
  • 🔧 FixedAutomatically prevent Yoast SEO and Rank Math from redirecting Sunshine gallery image pages when media pages are disabled

3.5.7.3

  • 🔒 SecurityAdd permission check on image data ajax request

3.5.7.2

  • 🔒 SecurityAdd capability check on upgrade functions

3.5.7.1

  • 🔒 SecurityAdd permission check/nonce on upgrade functions

3.5.7

  • ✨ NewWork with new text product option
  • ✨ NewNew email template tag to show galleries in the purchase for admin orders
  • ⚡️ ImprovedFTP upload errors will show which image had an error while uploading
  • ⚡️ ImprovedImage assigned to gallery later in upload process to better ensure no processing errors happened first
  • ⚡️ ImprovedRegenerating images now prompts user on how to handle image watermarks before processing
  • 🔧 FixedDashboard stats calculations
  • 🔧 FixedOption pricing added twice when showing order line items
  • 🔧 FixedPayPal Legacy not properly including line item discounts
  • 🔧 FixedPayPal Legacy not setting order status to new in webhook

3.5.6.2

  • 🔧 FixedOverzealous escaping caused issues in various places, take 2
Sunshine Photo Cart for WordPress