Home / Changelog

Changelog

Sunshine Photo Cart

Version: 3.7.5
Tested Up To: 7.1.3
Requires WP: 5.5
Requires PHP: 7.4

3.7.5 – October 13, 2026

  • 🔒 SecurityVisitors can no longer see photos from a gallery they don’t have access to, like a password-protected or private gallery, through the share, add to cart, or product options windows

3.7.4 – October 9, 2026

  • ✨ NewEach tax rate can have a name, like GST or VAT, that shows in place of “Tax” on the cart, checkout, order pages, emails and invoices. Picking a country on a tax rate fills in the usual name for that country, and rates without a name keep showing “Tax”
  • ✨ NewPackages can be added from “Add all to cart” on the Favorites page. One package goes in the cart, and the customer then picks a photo for each item in it, starting from their favorites
  • 🔧 FixedInvoices no longer list tax on its own line when prices are displayed with tax included, so the totals add up. The order total now says how much tax it includes, the same as the order page and emails
  • 🔒 SecurityVisitors can no longer use the favorites share link to send harmful data to the site
  • 🔒 SecurityVisitors can no longer post image comments in a gallery they don’t have access to, like a password-protected or private gallery. Thanks to Raphael P. Cigana for reporting this
  • 🔧 FixedDownloading a very large Sunshine log or PHP error log could crash the site with a memory error
  • 🔧 FixedGallery cover photos smaller than 1800px no longer cause PHP warnings in the Media Library list view
  • 🔧 FixedA free shipping method set to “Via Discount” now stays selected at checkout instead of the shipping step reopening with nothing chosen
  • 🔧 FixedStripe orders now move to New as soon as checkout confirms the payment, even with a webhook signing secret filled in. Before, they stayed on Pending until Stripe’s webhook arrived, and stayed there for good if it never did
  • 🔧 FixedAn order can no longer be completed twice when checkout and a payment webhook both finish it, which could send the receipt emails twice and count a discount code twice
  • 🔧 FixedCustomers who take more than 15 seconds to approve a Stripe payment with their bank no longer see an error while they’re still approving, and the order is no longer marked Failed in the meantime. Checkout now shows a note that it’s still waiting on the bank

3.7.3 – October 1, 2026

  • ✨ NewA “Refresh photo details” button on the gallery edit screen reads the keywords, title, caption and photo date from your original files for photos already in that gallery and its sub-galleries, so galleries imported before this update can be searched by keyword
  • 🔧 FixedViewing a gallery no longer gives a guest a session cookie, so galleries can be served from a page cache until the visitor adds to their cart, saves a favorite, or enters a gallery password. The cart’s “Return to gallery” link still points to the gallery the item came from
  • 🔧 FixedThe “Set your password” link in new account emails, including accounts created during bulk gallery creation, and password reset links showed the login/register screen instead of the new password form on sites where the account URL settings had never been saved
  • ✨ Newsunshine_cart_item_tax_rate filter to charge a different tax rate on individual cart items, such as a reduced VAT rate on some products
  • 🔨 ChangeRenamed the Privacy settings tab to Privacy & Data, and the Data tab to Usage Tracking
  • 🔧 FixedWhen the watermark image file is missing from the server (for example after it was moved to cloud storage), an admin notice now says new images aren’t being watermarked, and the Sunshine log records each image that was skipped. Before, images were processed without a watermark and nothing said so
  • 🔧 FixedA license check that got back a page that wasn’t license data, such as a firewall or maintenance page, no longer wipes the saved license status and expiration for every addon, and no longer logs PHP warnings
  • 🔧 FixedPickup no longer adds products’ Extra Shipping Cost to its price. Since 3.6.10, a Pickup set to 0 could charge the extra cost for each large item in the cart

3.7.2 – September 24, 2026

  • 🔧 FixedThe “Check your system information” link in the images-waiting warning opened a page that no longer exists. It now opens Tools > Site Health > Info, where the image queue details (images waiting, queue running, next run) have been added to the Sunshine section
  • 🔧 FixedA background image queue that lost its scheduled task is now rescheduled automatically on the next admin page load, instead of waiting for another upload. The warning now only shows when WordPress cron genuinely has not run, and says how long it has been
  • 🔨 ChangeThe old Sunshine System Info page, unreachable since its menu entry was removed, is now deleted. Site Health is the one place for system information
  • 🔧 FixedPhotos saved to favorites from a gallery that asks for an email address showed no add to cart option when the visitor came back in a new browser session
  • 🔒 SecurityStored meta and option values were unserialized a second time after WordPress had already done so. A user with permission to edit orders or galleries could store a specially crafted value that would then be turned into a PHP object when the order or gallery was viewed. Values are now read only once, so a stored string stays a string
  • 🔨 ChangeAn order now builds the customer it belongs to once instead of rebuilding it for every piece of customer information read from the order, which speeds up any screen or export that lists a lot of orders
  • 🔨 ChangeAdded sunshine_get_order_ids() for developers, which takes the same arguments as sunshine_get_orders() but returns only order IDs, for code that needs to count or list orders without loading each one
  • 🔧 FixedThe cart, checkout, account and favorites pages now send a header telling caches to skip them. Sunshine already set the flag that caching plugins look for, but a cache running on the server in front of WordPress never saw it, and could save one visitor’s checkout page and hand it to the next person. Galleries keep their caching benefit until a visitor has a cart, a favorite, or a gallery password they entered
  • 🔧 FixedChoosing a photo for a print or download from the store page could fail with an error on sites with a large number of galleries

3.7.1 – September 10, 2026

  • ✨ NewAutomated Emails can now be sent when a gallery is published. The email waits until the gallery has photos and they have all finished processing, so it never goes out on a half-built gallery. Also available to developers as the sunshine_gallery_ready action
  • ✨ NewWarning in the admin when images are waiting to be processed but nothing is scheduled to process them, which usually means WordPress cron has stopped running
  • ✨ NewSystem Information now reports how many images are waiting to be processed, whether the queue is running, and when it next runs
  • Performance: Background image processing now runs continuously instead of 20 seconds out of every minute. Large uploads finish in roughly a third of the time
  • Performance: Saving a visitor’s session no longer runs an extra database query on every request
  • Performance: Working out which galleries a discount or product source covers no longer refetches every gallery on the site once per selected gallery
  • 🔨 ChangeImages are no longer shown until they have finished processing. An image with no thumbnails yet used to fall back to the full-resolution original, so a customer opening a gallery mid-upload was served untouched, unwatermarked files. A placeholder is shown instead, and the gallery admin marks those images as processing
  • 🔨 ChangeExpired galleries are now listed in the customer’s account area instead of quietly disappearing, and opening one explains that the gallery expired and when
  • 🔨 ChangeEvery screen now records allowed customers on a gallery the same way. Galleries saved before this update keep working
  • 🔧 FixedImage processing no longer runs during a visitor’s page load, where it could add up to 20 seconds to an unrelated page view and, on a timeout, lose the rest of that request’s database writes including scheduled tasks
  • 🔧 FixedBackground image processing could stop partway through and never restart on its own. A recurring check now picks the queue back up
  • 🔧 FixedThumbnails no longer land in the wrong gallery’s folder when one background run handles images from more than one gallery
  • 🔧 FixedA gallery that has had every one of its images deleted no longer leaves a check running every minute for good
  • 🔧 FixedAn image whose processing failed now says so in the gallery admin instead of sitting there marked as still processing
  • 🔧 FixedRegenerating images now applies the new watermark and sends the rebuilt sizes to cloud storage when the rebuilt files end up named differently from the originals
  • 🔧 FixedRegenerating every image now works through them in a fixed order, so an image can no longer be done twice while another is never reached
  • 🔧 FixedRegenerating images no longer ends in a server error when the number of images changes mid-run. The missing position is reported and the run continues
  • 🔧 FixedPrivate galleries assigned to a customer through quick edit, bulk edit, bulk gallery creation or the API now appear in that customer’s account area
  • 🔧 FixedSessions were being deleted early on sites not set to UTC, by the site’s timezone offset, clearing carts, favorites and gallery passwords too soon
  • 🔧 FixedOrder pages no longer log a warning when opened without an order key, and an order with no key stored can no longer be opened by anyone
  • 🔧 FixedGallery, product and customer selection boxes no longer show a blank entry when something that was selected has since been deleted
  • 🔧 FixedPayment methods your Stripe account cannot process can no longer be switched on, and card can no longer be switched off. Those toggles were meant to be locked and were not
  • 🔧 FixedThe fee warning in the admin can now be dismissed

3.7 – August 27, 2026

  • ✨ NewBilling address is now its own step at checkout, so you can record the address of the person paying even when the order is being shipped somewhere else. Invoices need the buyer’s address, and the buyer is not always who the parcel goes to. On orders that ship, the customer gets a “use shipping address as billing address” box that is already ticked, so nothing extra to fill in unless the two differ
  • ✨ NewWarning in the admin when the added fee is being charged but your license already includes the add-on that removes it
  • 🔒 SecurityThe session cookie is now flagged HttpOnly, and Secure on sites served over HTTPS, so it can no longer be read by scripts in the browser
  • Performance: The session cookie is now only set once a visitor has something to remember (items in the cart, a favorite, a gallery password), instead of on every request. Pages with no Sunshine content no longer send a cookie, so hosts and caching plugins can serve them from cache again
  • Performance: Visitors who already have a session are no longer sent a replacement cookie on every page view, only when the existing one is close to expiring
  • Performance: The session cookie is now removed once there is nothing left to remember, such as after a cart is emptied, so returning visitors can be served cached pages again instead of waiting for the cookie to expire
  • Performance: With an empty cart, the shipping, delivery, payment, tax and checkout form setup no longer runs on every page load, cutting around 11 database queries from every request across the whole site
  • Performance: Gallery listings, in-gallery search, and anywhere Sunshine needs a gallery’s sub-galleries now use a single database query instead of one per gallery. On a site with 14,000 galleries this replaces thousands of queries per page load with one
  • Performance: The galleries page now loads galleries a page at a time instead of all at once, significantly reducing memory usage on sites with a large number of galleries
  • 🔨 ChangeThe “Always collect an address” setting is now “Always collect a billing address” and applies to every order, not only orders with nothing to ship
  • 🔨 ChangePayment methods that require a billing address, such as Square, now collect it at its own step rather than partway through the payment step
  • 🔨 ChangeTax is now worked out from where the order actually changes hands. Shipped orders use the shipping address, orders collected in person use your store’s address because the goods never move, and downloads use the customer’s billing address. Previously anything without a shipping address fell back to the store address whether that was right or not
  • 🔨 ChangeSquare card verification now happens as part of tokenizing the card, which is the method Square currently recommends. The older separate verification step has been deprecated by Square
  • 🔨 ChangeThe added fee now shows with the order totals, not just in the payment method tab
  • 🔨 ChangeThe fee note on an order now links to the Add-ons page instead of telling you to upgrade when you already have
  • 🔧 FixedTax shown on the first view of the cart or checkout could be based on a different address than the order total used, because items worked out their own tax before the delivery method was known
  • 🔧 FixedChoosing a pickup location and continuing no longer leaves the order thinking it still needs shipping. The pickup location was being saved in a form the checkout could not read back, so the order was treated as being shipped, which could apply the wrong tax and ask for a shipping address that was not needed
  • 🔧 FixedChanging the address at checkout to one that no tax rate covers now correctly removes the tax. Previously the rate found for the earlier address stayed applied, so a customer could be charged tax that does not apply where they are, at an amount that shrank each time the checkout refreshed
  • 🔧 FixedSquare was being sent the buyer’s name and country under field names it does not recognise, so it ignored them and verified cards without knowing where the buyer was. Card verification is required for European cards, and missing details there are a common cause of declines
  • 🔧 FixedSquare now receives the billing address the customer actually gave. It was read from the checkout form as the payment was taken, which no longer works now the billing address is collected at an earlier step, and the copied address was only being saved to the order rather than passed on. Both the card verification and the payment record now get the right address whether the buyer typed one or reused their shipping address
  • 🔧 FixedOrders no longer store a meaningless billing_method value alongside the real billing address
  • 🔧 FixedGallery, product and order names containing an ampersand could show as “&” in admin dropdowns, breadcrumbs, order screens and on the gallery page. The name was being escaped twice on sites where WordPress had already stored the ampersand encoded
  • 🔧 FixedThe parent gallery path in the orders list gallery filter now shows a real “>” between gallery names instead of the raw code for it
  • 🔧 FixedOrders can no longer be submitted with a required section left unfilled, which could produce an order with no address on it at all. Checkout now re-checks every required field before the order is created and sends the customer back to whatever still needs completing
  • 🔧 FixedThe Delivery Method step no longer appears or disappears partway through checkout, which could walk customers through the steps out of order (shipping address before delivery method). Whether an order can be shipped or picked up is now decided independently of the address, and shipping options that don’t cover the customer’s address are reported at the Shipping Method step instead
  • 🔧 FixedA customer can no longer skip ahead to a later checkout step, including payment, by way of the section links in the page URL
  • 🔧 FixedA checkout step that no longer applies after the customer changes their delivery method is no longer remembered as completed, which could let its address step be skipped
  • 🔧 FixedWhen no shipping option covers the address entered, the Shipping Method step can no longer be stepped past. Previously the customer could continue and only be stopped at payment, away from the message explaining the problem
  • 🔧 FixedA checkout step that fails validation on the server no longer leaves the page sitting on the loading spinner. The step now reloads and shows what needs fixing
  • 🔧 FixedRemoving the last product that requires shipping from the cart (leaving only digital products) now removes the shipping fee instead of leaving it applied at checkout
  • 🔧 FixedSelecting Apple Pay or Google Pay in the Stripe payment method settings no longer causes a checkout error, and payment methods your Stripe account can’t process are now greyed out so they can’t be enabled by mistake
  • 🔧 FixedA JavaScript error no longer appears in the browser console on admin pages outside of Sunshine. The admin script sets up tooltips that rely on a library only loaded on Sunshine’s own screens, and it now checks for that library first
  • 🔧 FixedThe Add-ons page switch no longer flips back off without saying why
  • 🔧 FixedOrder profit now has the added fee and any discount codes taken off. Figures for past orders change to match
  • 🔧 FixedStripe’s hosted checkout charged the fee in India, Mexico and Malaysia, which are exempt
  • 🛠️ DevA payment method now asks for a billing address by setting $needs_billing_address on its own class, and the checkout works the rest out from there, so an add-on gateway declares it the same way the built in ones do. New filters sunshine_checkout_needs_billing_address and sunshine_checkout_section_billing. The checkout no longer uses the customer_ address prefix, which only ever existed to be renamed to billing_ when the order was saved; sunshine_checkout_section_address is gone with it
  • 🛠️ DevNew filters sunshine_session_lazy_cookie and sunshine_session_destroy_when_empty to restore the previous session cookie behavior
  • 🛠️ DevNew filter sunshine_email_headers to modify outgoing email headers
  • 🛠️ DevNew filters sunshine_shipping_fields and sunshine_billing_fields for modifying the checkout address fields, such as offering a different country list for shipping than billing. The existing sunshine_shippingfields and sunshine_billingfields filters (double underscore) still work
  • 🛠️ DevNew sunshine_plan_covers_addon(), get_effective_application_fee_percent(), get_order_application_fee(), get_application_fee()
Sunshine Photo Cart for WordPress