RestroPress — Online Food Ordering System

Changelog

Version 3.3 (2026-06-11)

RestroPress 3.3 is a major update: a guided setup wizard with AI menu import, a real time Live Orders board, a redesigned operations Dashboard, a cleaner Orders screen and order editor, dietary labels on your menu, faster Reports, and easier menu import and export.

• Guided setup wizard with AI menu import
  • New step by step setup (restaurant profile, menu, how you sell, payments, go live) with a live preview of your storefront as you build it.
  • AI menu import: upload a PDF, photo, or spreadsheet and AI reads it into items, prices, sizes, and add-ons for you to review before publishing. Works with built-in WordPress AI, OpenAI, or Google Gemini.
  • One-click sample menus (Cafe & Bakery, Pizzeria, Burger Diner, Healthy Kitchen) to get started instantly, plus a manual build option.
  • RestroPress now warns you when an uploaded file does not look like a menu, before it imports anything.
• Live Orders board (new)
  • A real time board of every active order across columns: New, Accepted, Preparing, Ready, and Out for Delivery.
  • New orders slide in with a sound alert and a flashing browser tab so busy staff never miss one.
  • Drag a card to another column to change its status, or use the single clear next-step button (Accept, Start, Ready, Dispatch, Complete).
  • Filter by Pickup, Delivery, or Dine-in. The board refreshes on its own, and an optional setting makes Live Orders the default Orders view.
• Redesigned Dashboard
  • The Dashboard is now an operations command center built for restaurant managers: store status, live order load, late orders, unpaid orders, and a priority queue of what needs attention right now.
  • Panels refresh automatically every 30 seconds.
• Redesigned Orders screen
  • Cleaner list with click-to-change status pills (no page reload), date shortcut chips, a «time since ordered» label, and a sticky header.
  • Switches automatically between a Today operations view and a Past Orders view with sales totals when you pick a date range.
  • Revenue now counts cash orders correctly, refunds show clearly in red, and customer phone numbers can be masked to the last 4 digits for screens in public view.
• Redesigned order details
  • A clearer single-order screen: summary cards, a fulfilment status track with a one-click next step, a notes timeline, and billing details.
  • Edit order items (sizes, add-ons, quantities) right on the page, with the total kept in sync automatically.
• Smarter menu item editor
  • A cleaner, section-based editor with separate short (menu card) and full (order popup) descriptions, combined Category, Tags & Dietary, and a redesigned add-ons area.
  • Built-in availability toggle: mark an item Sold Out from the editor or the list with no extra extension needed. Sold-out items show a clear badge on your storefront.
• Dietary labels and food type
  • New dietary labels (Vegetarian, Vegan, Gluten-free, Dairy-free, Nut-free, Halal, Kosher, Spicy) that you set per item and that now show as chips on your storefront menu.
  • Veg / Non-veg marks are now an optional setting, aimed at India and similar markets.
• Faster, clearer Reports
  • Reports rebuilt into focused views: Overview, Sales, Orders & Risk, Menu, Customers, Payments & Recovery, Taxes, and Export, each with a previous-period comparison.
  • Revenue and late-order numbers now agree across the Dashboard, Orders, and Reports.
  • Reports load much faster on large stores.
• Easier menu import and export
  • Menu import is now a permanent screen at Menu Items > Import (AI, spreadsheet, or sample menu), not just a one-time onboarding step.
  • Menu export lets you pick exactly which columns to include and produces a clean, readable CSV that imports straight back in.
  • Settings import and export moved to Settings > Misc, and Tools is now focused on maintenance only.
• Clearer new-order alerts
  • A loud built-in alert sound now ships by default, so new-order notifications are no longer silent until you upload your own.
  • Clearer guidance on how desktop alerts work, plus more reliable playback.
• Renamed for clarity
  • «Food Items» is now «Menu Items» throughout the admin. Your URLs, shortcodes, and data are unchanged.
  • «Add-on Category» is now «Add-on Group» (sometimes called a modifier group in POS systems). Only the labels changed.
• Fixes and improvements
  • Fixed: fixed-price items no longer switch themselves to variable pricing when saved.
  • Fixed: the setup wizard now saves your chosen service type (Pickup, Delivery, or both) instead of always storing «Pickup only».
  • Fixed: finishing setup no longer puts your store into payment test mode by mistake.
  • Fixed: a storefront and dashboard crash when a store’s opening and closing times were equal or inverted.
  • Fixed: menu item tags could show twice on a storefront card in one layout; they now show once.
  • Fixed: the print icon in the order quick-view is now aligned with its label.
  • Improved: Live Orders cards show the customer phone correctly, add-on and category names with apostrophes no longer break, and many smaller admin polish fixes.
• For developers
  • New food item editor section hooks and a Live Orders extension surface (columns, time window, query args) let add-ons plug into the redesigned screens.
  • Order count, late-order, and cash-gateway logic is now shared and filterable for consistency across screens.
  • Full REST API support continues for building custom apps and integrations.

Version 3.2.8.8.6(2026-06-09)

• Updated: Plugin version bump to 3.2.8.8.6
• Fixed: Email template order notes now strip encoded HTML tags before rendering so labels such as <strong> no longer show in {order_note}.
• Fixed: Special instruction labels in food item email lists now render bold markup without exposing raw <strong> tags.

Version 3.2.8.8.5(2026-06-03)

• Updated: Plugin version bump to 3.2.8.8.5
• Fixed: Core service date handling now follows the configured WordPress timezone and date format across order-online, checkout, order details, and receipts.
• Fixed: Closed-store order-online summaries now show the configured store closed message instead of being overwritten by a stale selected date.
• Fixed: Selected service date/time cookies now stay synchronized and no longer change the customer-selected schedule between listing, checkout, and confirmation views.
• Fixed: Service date/time selections are no longer cleared from cached old UI menu pages when a stale cart count is rendered.
• Fixed: Checkout now submits and saves the selected service date/time from the active checkout controls before falling back to cookies.
• Fixed: Cart-empty actions now clear the complete service selection cookie set to avoid stale confirmation data.
• Fixed: Old UI schedule popup now shows the resolved service date in core when no Store Timing date selector is injected.
• Fixed: Core service date and slot availability now use the WordPress timezone consistently
• Fixed: Future pre-order dates are no longer blocked by the current-day closed state when valid future slots exist.
• Fixed: Display-format service dates such as d/m/Y are parsed safely before slot and order validation.

Version 3.2.8.8.1(2026-05-13)

• Updated: Plugin version bump to 3.2.8.8.1
• Fixed: Delivery schedule now ignores stale/past service slots instead of falling back to unavailable times.
• Improved: Listing cart totals, submit button styles, plain-text button behavior, and checkout coupon field layout.
• Added: Cart sidebar fee render filter so extensions can own their own fee display rows.
• Fixed: Old UI modal enforcement now reopens service settings on add/checkout when delivery zip/address is invalid and blocks stale item-detail popup flow.
• Fixed: Cart summary change-link and helper tooltip now render only in Old RestroPress UI/UX mode and no longer leak into the default UI layout.
• Improved: Core frontend/admin API, export, tax, cart, and payment query handling touched in this patch for safer and more consistent request data processing.

Version 3.2.8.8(2026-05-12)

• Updated: Plugin version bump to 3.2.8.8
• Removed: Amazon Payments gateway and bundled Amazon payment libraries have been removed from core.
• Added: Core Stripe payment gateway with hosted Stripe Checkout, test/live API keys, webhook signing secret, and webhook endpoint instructions.
• Fixed: Core Stripe settings and gateway registration now show only when the separate RestroPress Stripe extension is inactive.
• Fixed: Core Stripe runtime payment handlers now disable when the RestroPress Stripe extension is active, preventing duplicate Stripe handling.
• Fixed: [customer_dashboard] login button now links to the RestroPress login shortcode page instead of the default WordPress login screen.
• Fixed: Old UI order-settings popup now keeps Store Timing extension date/time fields in the legacy stacked layout.
• Improved: Old UI order-settings date/time fields and Update action now follow the configured Default Button Style, including Plain Text behavior.
• Fixed: Mobile grid-view cart bar now stays sticky at the footer while scrolling instead of shifting to the top/right side.
• Code Cleanup

Version 3.2.8.7(2026-05-09)

• Updated: Plugin version bump to 3.2.8.7
• Fixed: Cart summary totals and fees now refresh reliably after AJAX cart, service, and gateway changes.
• Improved: Mobile cart, service modal, add-button, food-card, and customer-dashboard layouts across responsive breakpoints.
• Added: Frontend setting support to show or hide add buttons and trigger add flow from food-card clicks.
• Fixed: Food categories without tax_position metadata now stay visible in the admin category list.
• Added: Currency setting Currency Value Type with Round/Float options, defaulting to Float, and applied the selected value format across backend and frontend currency output.
• Added: Default Button Style now supports the new Border Radius option for frontend submit buttons.
• Fixed: Plain Text Default Button Style now makes frontend submit buttons behave like links with no background or border.
• Fixed: Frontend submit buttons now inherit the configured dynamic theme color and default button style, excluding food item Add buttons.
• Fixed: Checkout cart remove button now uses the configured dynamic color and displays a matching cross icon.
• Fixed: Checkout Place Order loader now centers inside the button while submitting.
• Improved: [order_history] shortcode output with a modernized order-history design, better load-more rows, and mobile responsive fixes.
• Improved: Customer dashboard profile, order list, saved-address, and account sections now stack and scale cleanly on mobile.
• Fixed: Confirmation page live order statuses now use the updated GIF set for accepted, pending, preparing food, delivered, delivery boy, cancelled, and ready statuses.
• Improved: Frontend section backgrounds, labels, links, dashboard controls, checkout panels, order-history cards, and receipt surfaces now inherit dynamic Theme Color tones.
• Fixed: Dynamic Theme Color CSS is now scoped to RestroPress frontend elements only, preventing WordPress theme, WordPress element, and third-party plugin color overrides.
• Code Cleanup

Version 3.2.8.6.3(2026-05-02)

• Updated: Plugin version bump to 3.2.8.6.3
• Added: Customer table now includes bulk actions to move customers to trash, restore trashed customers, or delete permanently.
• Added: Customer list now shows All and Trash views with status-aware row actions.
• Fixed: Deleting a customer now moves the customer to trash instead of permanently deleting by default.
• Improved: Customer notices now include move-to-trash and restore confirmations.
• Improved: Existing customer records with matching email are automatically restored when new orders are created for that email.
• Code Cleanup

Version 3.2.8.6.2(2026-04-24)

• Updated: Plugin version bump to 3.2.8.6.2
• Fixed: Food category drag-and-drop reordering now persists reliably on the admin categories list after refresh.
• Fixed: Prevented addon-category sorting scripts from attaching on food-category taxonomy screens and overriding reorder AJAX actions.
• Improved: Food-category admin ordering flow now consistently loads sortable assets, validates AJAX requests, and applies saved tax_position ordering.
• Updated: RestroPress docs links in admin/readme now point to the current docs URL.
• Code Cleanup

Version 3.2.8.6.1(2026-04-14)

• Updated: Plugin version bump to 3.2.8.6.1
• Security: Escaped rpress_receipt shortcode error output to prevent stored XSS payload execution.
• Security: Escaped Orders admin payment-history links generated from query arguments to prevent reflected admin XSS via crafted URLs.
• Code Cleanup

Version 3.2.8.6(2026-04-10)

• Updated: Plugin version bump to 3.2.8.6
• Fixed: Mobile/tablet order-online layout alignment for service buttons, search input, and summary row (date/time/Edit) rendering.
• Fixed: Checkout Place Order button now follows full input width for responsive views.
• Fixed: Checkout total row alignment to keep total label/amount consistent with form/button edges.
• Improved: Theme-color sync for service-type selected states and key checkout actions (including discount/apply and update actions).
• Improved: Quantity +/- controls in item popup now keep neutral background and hover behavior while using theme color on border/radius outline only.
• Fixed: Mobile list-view circle add button now keeps a perfect circular shape with centered icon rendering.
• Fixed: Checkout Delivery/Pickup tabs on mobile now maintain consistent tab height and full-width active background fill.
• Fixed: Sticky category overlap layering issue in list/grid navigation.
• Fixed: Admin orders list/count filters now stay synchronized (status, service type, and order status conditions).
• Fixed: Admin sidebar order badge and order counts now ignore deleted/trash records and count only valid rpress_payment posts.
• Fixed: Paid tab highlighting/count handling now correctly maps paid and publish states in order views.
• Fixed: List-view category navigation now lands on the correct selected category instead of showing previous-category items under the heading.
• Fixed: Mobile action-menu and horizontal category clicks now resolve to the correct section target and keep active-category states in sync.
• Improved: Category scrolling now uses dynamic sticky-header offsets for more reliable landing positions across desktop and mobile.
• Improved: Frontend rp-frontend.js enqueue version now includes filemtime to reduce stale browser-cache behavior during updates.
• Code Cleanup

Version 3.2.8.5(2026-04-07)

• Updated: Plugin version bump to 3.2.8.5
• Added: New admin setting Old RestroPress UI/UX to enable legacy service-selection modal flow before add-to-cart.
• Fixed: Service date/time updates now prioritize active modal/checkout selections before cookie fallbacks to prevent stale time overwrite.
• Fixed: Delivery/Pickup selection synchronization across modal and checkout refresh flows for both old and current UI paths.
• Added: New core helper rpress_get_enabled_service_types() and updated service enablement checks to honor configured service mode.
• Improved: REST services endpoint now returns only enabled service types.
• Fixed: Removed duplicate PayPal helper declarations in paypal-standard.php to prevent fatal redeclare errors.
• Fixed: Old UI service popup now guarantees a visible active tab/pane and no longer hides selected service label text behind legacy overlay pseudo-elements.
• Fixed: Checkout service selector now expands to full width when only one service type is enabled.
• Improved: Old UI service popup controls now use consistent rectangular styling with aligned full-width fields and buttons.
• Improved: Old UI popup service date/time labels now align left and date/time inputs show calendar/clock icons consistently.
• Improved: Old UI service-tab and popup action colors now follow the configured Theme Color dynamically.
• Improved: Old UI popup visual overrides are now strictly scoped to old UI mode and no longer impact the default popup UI.
• Improved: When Old UI/UX is disabled, the default datetime popup hides service-type tabs and keeps the primary Update action color synced with Theme Color.
• Code Cleanup

Version 3.2.8.4.1(2026-04-06)

• Fixed: PayPal checkout/connect redirects now allow PayPal hosts in WordPress safe redirects to prevent fallback redirect to wp-admin.

Version 3.2.8.4(2026-03-28)

• Updated: Plugin version bump to 3.2.8.4
• Fixed: Checkout gateway state now keeps hidden rpress-gateway synced with selected payment mode during gateway switch and final submit.
• Fixed: Hardened direct DB query paths with prepared/typed placeholders in customer, discount, session, payment, tax, and stats handlers.
• Fixed: Reworked dynamic IN (...) query construction to sanitized array + placeholder flow for scanner-safe SQL execution.
• Fixed: Removed unescaped payment_ids usage in customer-user disconnect flow and enforced integer-only payment IDs before update query.
• Fixed: Replaced transient/session batch delete raw SQL assembly with prepared option-name placeholder queries.
• Fixed: Updated legacy earnings/tax aggregation queries to prepared statements for safer post ID handling.
• Fixed: Updated discount status cleanup bulk updates to prepared integer placeholder queries for posts/postmeta.
• Fixed: Updated yearly tax/earnings aggregate query paths to prepared statements in tax and payment stats/functions.
• Security: Addressed latest PluginCheck DirectDB.UnescapedDBParameter findings reported in March 28 security scan.
• Security: Continued hardening for redirect and DB static-analysis warnings without changing frontend UX/UI behavior.
• Maintenance: Synced release notes with internal CHANGELOG_DEV.md tracked fixes for faster future follow-up.
• Fixed: Mobile and tablet food listing layout now keeps cart access visible and usable without scrolling to page bottom.
• Fixed: Sticky mobile cart summary now updates quantity/total reliably on add, update, remove, and clear-cart AJAX actions.
• Fixed: Checkout page responsive structure now stacks service/cart/form sections correctly across tablet and mobile widths.
• Fixed: Checkout mobile/tablet flow now keeps the cart/service panel above the form section for quicker cart visibility.
• Fixed: Category strip now renders in a stable single-row pattern with horizontal overflow handling in both list and grid modes.
• Fixed: Grid view category-strip wrappers now follow the same inline/scroll behavior as list view.
• Fixed: Category popup trigger layering conflict introduced by one-line strip styling, so menu popup opens reliably again.
• Fixed: Category strip now remains sticky while scrolling and respects WordPress admin-bar offsets.
• Improved: Mobile/tablet category and sticky-cart spacing/position tuning for cleaner ordering UX.
• Code Cleanup

Version 3.2.8.3(2026-03-26)

• Updated: Plugin version bump to 3.2.8.3
• Fixed: Delivery/Pickup summary date now always follows WordPress date format across listing, popup, and checkout.
• Fixed: Summary date/time now syncs immediately from modal selection and keeps formatted output after refresh.
• Fixed: Checkout and modal date/time/location fields now use full-width responsive controls.
• Fixed: Closed-state summary now hides invalid date/time and prevents stale Edit exposure for invalid schedule states.
• Fixed: Add-to-cart popup no longer opens when service is closed; close notice is shown instead.
• Improved: Open-store flow now always exposes Edit so customers can update schedule quickly.
• Improved: Summary location icon UI modernized with animated glow pulse for clearer branch indicator.
• Added: «Change location» quick link in closed branch state to reopen schedule popup and switch branch directly.
• Security: Hardened customer dashboard profile update with strict nonce presence and verification to mitigate CSRF account-update attempts.
• Security: Replaced inline dashboard post-submit JavaScript redirects with wp_safe_redirect to prevent reflected redirect/XSS injection vectors.
• Security: Sanitized REST order/cart text payloads and escaped admin delivery-address rendering to mitigate stored XSS vectors (CVE-2025-69017 path).
• Code Cleanup

Version 3.2.8.2(2026-03-25)

• Updated: Plugin version bump to 3.2.8.2
• Fixed: Grid view responsive layout issues for tablet widths (770px to 991px) to prevent half-width/broken food cards
• Fixed: Listing service summary row structure and icon hooks for cleaner location/date-time/Edit alignment
• Improved: Date-time edit popup heading/content structure for clearer schedule update flow
• Code Cleanup

Version 3.2.8.1(2026-03-23)

• Updated: Plugin version bump to 3.2.8.1
• Fixed: Add-to-cart address/zip validation now runs only for Delivery service, so Pickup with a selected branch no longer triggers unnecessary force-popup flow.
• Fixed: Core datetime popup now renders service date controls before service time controls for consistent ordering across service switches.
• Fixed: Food item popup now displays full item description content without 2-line truncation.
• Fixed: Service-switch modal refresh now updates only the listing service summary and no longer overwrites popup address controls.
• Improved: Delivery/Pickup service summary row keeps location, date/time, and Edit action aligned inline for consistent tab-row UI.
• Improved: Delivery schedule popup structure/copy refinement for clearer service-edit flow without UX regressions.
• Improved: Elementor builder shortcode detection for checkout and RestroPress page checks (supports _elementor_data)
• Fixed: Stale modal/overlay lock state that could block clicks on Order Online and Checkout pages
• Fixed: Datetime edit action now falls back to legacy service-options popup when datetime modal markup is unavailable
• Improved: Missing service-time flow opens service selection directly instead of showing empty closed-message error toast
• Fixed: Category scroll handler safety checks for invalid links/sections to avoid frontend JS interruptions
• Security: Hardened add-on license AJAX actions with capability checks and strict option-key validation
• Security: Restricted API token generation endpoint access to authenticated users with valid user-edit permissions
• Security: Replaced weak time-based API/cart token generation with cryptographically secure random tokens
• Security: Removed internal remote token-generation request path and now generates signed user API tokens locally
• Fixed: Default Services setting now applies correctly when Choose Services is set to Both Delivery and Pickup
• Fixed: Single-service mode (Delivery Only/Pickup Only) now always enforces the enabled service and ignores default-service fallback
• Improved: Elementor builder compatibility for checkout and RestroPress page detection by scanning saved _elementor_data shortcode content
• Fixed: Stale frontend modal/overlay lock state that could block clicks on Order Online and Checkout pages
• Fixed: Datetime edit flow now falls back to legacy service options popup when datetime modal markup is unavailable
• Improved: Missing service-time flow now opens service selection directly instead of showing blank/empty closed-message toast
• Fixed: Category scrolling handler now safely skips invalid links/sections to prevent frontend JS interruptions

Version 3.2.8(2026-03-13)

• Updated: Plugin version bump to 3.2.8
• Updated: Readme metadata and changelog synchronization
• Fixed: Service type, date, and time state now stay synchronized across order-online, popup, and checkout flows
• Fixed: Datetime edit popup now keeps the Update action available when service timing controls are editable
• Fixed: Shared service context now validates store-open state against the normalized service date to avoid mismatched closed messages
• Improved: Frontend service-state handling cleanup without UI or UX changes
• Fixed: Vulnerabilities issues
• Code Cleanup

Version 3.2.7(2026-03-09)

• Fixed: Protected add-on item setup and price mappings from being overwritten during legacy migration
• Fixed: Legacy add-on migration now runs only when true legacy data is detected
• Fixed: Migration guard added for modern versions (>= 2.6) to prevent unintended migration reruns
• Improved: Legacy migration now fills missing add-on meta safely without replacing existing term price/type values
• Code Cleanup

Version 3.2.6(2026-03-04)

• Fixed: Checkout service time restore now targets the active service tab and no longer overwrites both delivery and pickup selects with a single cookie value
• Fixed: Core slot-expiry validation now runs only when Order Time Intervals and Limits runtime is loaded, preventing false «Selected time slot is no longer available» errors when the addon is inactive
• Fixed: Store open/close validation now supports both 12-hour and 24-hour time formats and handles overnight windows reliably
• Fixed: «Enable Always Order Option» is now the only path that keeps the store open all day, and equal open/close values no longer behave like always-open
• Fixed: Frontend store status checks now match core validation to prevent false midnight «store open» behavior
• Fixed: Early translation loading notice issues
• Fixed: Gateway initialization flow for translation compatibility
• Fixed: PHP warning/deprecated compatibility issues
• Fixed: PayPal Connect OAuth redirect/auth flow for one-click account connection
• Fixed: PayPal account details sync and merchant account display in gateway settings
• Fixed: PayPal Standard checkout payload/merchant validation stability in sandbox mode
• Fixed: Sandbox PayPal checkout errors by adding safe test-mode currency fallback for unsupported INR flows
• Fixed: Add-to-cart button alignment at thumbnail bottom-center for all button shapes
• Fixed: Grid view card layout issues for food items without thumbnail images
• Fixed: Grid view spacing/alignment issues for food items without thumbnail and description
• Added: Modern ecommerce-style order confirmation page layout (without functional regressions)
• Added: Realtime order status updates on confirmation page (websocket-first with fallback support)
• Added: Status-specific animated GIF support for confirmation status block
• Added: Browser push notifications for order status changes (including cross-page watcher support)
• Added: Auto-clear order tracking for completed/cancelled/failed statuses with final notification
• Added: Guided Realtime Updates settings section under Misc for easier websocket setup
• Improved: Realtime configuration now supports admin settings with backward-compatible constant fallback
• Fixed: Service time is now hidden across frontend views when disabled from Order Time, Interval & Limits settings
• Fixed: Empty service-time rows are removed from receipt and order details templates when no service time is available
• Fixed: Order Online header now shows selected service time correctly when slots are enabled, while still respecting disabled-time settings
• Fixed: List view Order Online header now keeps service-time visible using selected-time fallback when cookie time is empty
• Improved: Service context now safely clears disabled service-time values before template rendering
• Code Cleanup

Version 3.2.5(2026-02-26)

• Added: Taxonomy sorting feature
• Fixed: Cart items count issue
• Fixed: Cart item quantity update issue
• Fixed: Service type switch issue
• Fixed: Blank cookies data validation
• Fixed: Ajax basis modal dom manipulation
• Code Cleanup