Changeset 3483127

Timestamp:

03/15/2026 01:59:45 PM (2 weeks ago)

Author:

shipdayinc

Message:

Update to version 2.3.0 - Wordpress feedback resolved

Location:

shipday-for-woocommerce/trunk

Files:

• admin/Shipday_Menu_Settings.php (modified) (9 diffs)
• admin/Shipday_Time_Slot_Util.php (modified) (3 diffs)
• admin/Shipday_WC_Settings_Tab.php (deleted)
• admin/partials/shipday-admin-display.php (modified) (6 diffs)
• admin/partials/shipday-admin-new.php (modified) (10 diffs)
• admin/partials/tab-delivery.php (modified) (21 diffs)
• admin/partials/tab-general.php (modified) (5 diffs)
• admin/partials/tab-order-sync.php (modified) (4 diffs)
• admin/partials/tab-overview.php (modified) (6 diffs)
• admin/partials/tab-pickup.php (modified) (21 diffs)
• admin/partials/tab-rest-api.php (modified) (4 diffs)
• admin/partials/tab-shipday-connect.php (modified) (7 diffs)
• date-modifiers/Coderocks_Woo_Delivery.php (modified) (1 diff)
• date-modifiers/Date_Picker_Object.php (modified) (1 diff)
• date-modifiers/Delivery_Area_Pro.php (modified) (1 diff)
• date-modifiers/Order_Delivery_Date_Shipday.php (modified) (1 diff)
• date-modifiers/order_delivery_date.php (modified) (1 diff)
• dispatch_post/payload_post.php (modified) (4 diffs)
• dispatch_post/post_fun.php (modified) (2 diffs)
• functions/common.php (modified) (2 diffs)
• functions/logger.php (modified) (1 diff)
• languages/shipday-for-woocommerce-es_ES.mo (added)
• languages/shipday-for-woocommerce-es_ES.po (added)
• languages/shipday-for-woocommerce-fr_FR.mo (added)
• languages/shipday-for-woocommerce-fr_FR.po (added)
• languages/shipday-for-woocommerce.pot (added)
• languages/shipday-woo-delivery-es_ES.mo (deleted)
• languages/shipday-woo-delivery-es_ES.po (deleted)
• languages/shipday-woo-delivery-fr_FR.mo (deleted)
• languages/shipday-woo-delivery-fr_FR.po (deleted)
• languages/shipday-woo-delivery.pot (deleted)
• order_data/Dokan_Order_Shipday.php (modified) (1 diff)
• order_data/FoodStore_Order_Shipday.php (modified) (1 diff)
• order_data/WCFM_Order_Shipday.php (modified) (3 diffs)
• order_data/Woo_Order_Shipday.php (modified) (2 diffs)
• order_data/Woocommerce_Core_Shipday.php (modified) (1 diff)
• payload/Core_Payload.php (modified) (1 diff)
• payload/Dokan_Payload.php (modified) (1 diff)
• payload/FoodStore_Payload.php (modified) (2 diffs)
• payload/WCFM_Payload.php (modified) (2 diffs)
• payload/Woo_Payload.php (modified) (2 diffs)
• readme.txt (modified) (2 diffs)
• rest_api/WooCommerce_REST_API.php (modified) (6 diffs)
• shipday-datetime/block-checkout/Shipday_Woo_DateTime_Util.php (modified) (7 diffs)
• shipday-datetime/block-checkout/Shipday_Woo_Delivery_Block.php (modified) (4 diffs)
• shipday-datetime/block-checkout/Shipday_Woo_Delivery_Block_Integration.php (modified) (2 diffs)
• shipday-datetime/block-checkout/Shipday_Woo_Delivery_Block_Storage.php (modified) (2 diffs)
• shipday-datetime/block-checkout/assets/js/frontend.js (modified) (4 diffs)
• shipday-datetime/classic-checkout/Classic_Datetime.php (modified) (21 diffs)
• shipday-for-woocommerce.php (added)
• shipday-integration-for-wooCommerce.php (deleted)
• shipday_order_management/Shipday_Order_Management.php (modified) (1 diff)
• shipday_order_management/Woo_Sync_Order.php (modified) (2 diffs)
• views/Dokan_vendor_settings_shipday.php (modified) (6 diffs)
• views/Notices.php (modified) (4 diffs)
• views/WCFM_vendor_settings_shipday.php (modified) (3 diffs)
• views/WC_Settings_Tab_Shipday.php (deleted)
• views/WC_Settings_Tab_Shipday_menus.php (modified) (18 diffs)

shipday-for-woocommerce/trunk/admin/Shipday_Menu_Settings.php

@@ -1 +1 @@
 <?php
+
+if ( ! defined( 'ABSPATH' ) ) {
+    exit;
+}
 require_once dirname(__FILE__). '/../rest_api/WooCommerce_REST_API.php';
 
 class Shipday_Menu_Settings {
+    private static $allowed_order_managers = array( 'admin_manage', 'vendor_manage' );
+    private static $allowed_week_days = array( '0', '1', '2', '3', '4', '5', '6' );
+    private static $allowed_slot_durations = array( '10', '15', '30', '45', '60', '90', '120', '150', '180', '240', '300', '360' );
+
     public static function initialize() {
         add_action( 'admin_enqueue_scripts',[ __CLASS__, 'enqueue_styles' ] );
@@ -46 +54 @@
 
         add_menu_page(
-            __('Shipday', 'shipday-delivery'),
-            __('Shipday', 'shipday-delivery'),
+            __('Shipday', 'shipday-for-woocommerce'),
+            __('Shipday', 'shipday-for-woocommerce'),
             'manage_options',
             'shipday-delivery-settings',
@@ -68 +76 @@
     }
 
+    private static function ensure_settings_access() {
+        if ( ! current_user_can( 'manage_options' ) ) {
+            wp_send_json_error( array( 'message' => 'Unauthorized' ), 403 );
+        }
+    }
+
+    private static function get_form_data_from_request() {
+        // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Nonce is verified in each AJAX handler before this helper runs.
+        if ( ! isset( $_POST['formData'] ) || ! is_string( $_POST['formData'] ) ) {
+            wp_send_json_error( array( 'message' => 'Invalid form data.' ), 400 );
+        }
+
+        $form_data = array();
+        // phpcs:ignore WordPress.Security.NonceVerification.Missing,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Serialized form payload is unslashed here and each parsed field is sanitized individually before use.
+        parse_str( wp_unslash( $_POST['formData'] ), $form_data );
+
+        return is_array( $form_data ) ? $form_data : array();
+    }
+
+    private static function sanitize_yes_no_flag( $is_enabled ) {
+        return $is_enabled ? 'yes' : 'no';
+    }
+
+    private static function sanitize_allowed_value( $value, $allowed_values, $default ) {
+        $value = sanitize_text_field( (string) $value );
+
+        return in_array( $value, $allowed_values, true ) ? $value : $default;
+    }
+
+    private static function sanitize_day_list( $days ) {
+        if ( ! is_array( $days ) ) {
+            return array();
+        }
+
+        $sanitized_days = array();
+        foreach ( $days as $day ) {
+            $day = sanitize_text_field( (string) $day );
+            if ( in_array( $day, self::$allowed_week_days, true ) ) {
+                $sanitized_days[] = $day;
+            }
+        }
+
+        return array_values( array_unique( $sanitized_days ) );
+    }
+
+    private static function sanitize_positive_int( $value, $default ) {
+        $value = absint( $value );
+
+        return $value > 0 ? $value : $default;
+    }
+
+    private static function sanitize_time_slot( $hour, $minute, $ampm ) {
+        $hour = max( 1, min( 12, absint( $hour ) ) );
+        $minute = max( 0, min( 59, absint( $minute ) ) );
+        $ampm = self::sanitize_allowed_value( $ampm, array( 'AM', 'PM' ), 'AM' );
+
+        return array(
+            'hh'   => str_pad( (string) $hour, 2, '0', STR_PAD_LEFT ),
+            'mm'   => str_pad( (string) $minute, 2, '0', STR_PAD_LEFT ),
+            'ampm' => $ampm,
+        );
+    }
 
     public static function save_connect_settings() {
         check_ajax_referer('shipday_nonce');
-
-        parse_str( $_POST[ 'formData' ], $form_data );
-        $api_key = sanitize_text_field($form_data['shipday_api_key']);
-        $enable_pickup = !isset($form_data['wc_settings_tab_shipday_enable_pickup']) ? "no" : "yes";
-        $enable_prev_order_sync = isset($form_data['wc_settings_tab_shipday_sync']) ? "yes" : "no";
-
-        $order_manage = !isset($form_data['wc_settings_tab_shipday_order_manage']) ? "admin_manage" : $form_data['wc_settings_tab_shipday_order_manage'];
+        self::ensure_settings_access();
+
+        $form_data = self::get_form_data_from_request();
+        $api_key = isset( $form_data['shipday_api_key'] ) ? sanitize_text_field( $form_data['shipday_api_key'] ) : '';
+        $enable_pickup = self::sanitize_yes_no_flag( isset( $form_data['wc_settings_tab_shipday_enable_pickup'] ) );
+        $enable_prev_order_sync = self::sanitize_yes_no_flag( isset( $form_data['wc_settings_tab_shipday_sync'] ) );
+        $order_manage = isset( $form_data['wc_settings_tab_shipday_order_manage'] )
+            ? self::sanitize_allowed_value( $form_data['wc_settings_tab_shipday_order_manage'], self::$allowed_order_managers, 'admin_manage' )
+            : 'admin_manage';
 
         update_option('wc_settings_tab_shipday_enable_pickup', $enable_pickup);
@@ -90 +162 @@
     public static function save_rest_api_settings() {
         check_ajax_referer('shipday_nonce');
-
-        parse_str( $_POST[ 'formData' ], $form_data );
-        $consumer_key = sanitize_text_field($form_data['shipday_consumer_key']);
-        $consumer_secret = sanitize_text_field($form_data['shipday_consumer_secret']);
+        self::ensure_settings_access();
+
+        $form_data = self::get_form_data_from_request();
+        $consumer_key = isset( $form_data['shipday_consumer_key'] ) ? sanitize_text_field( $form_data['shipday_consumer_key'] ) : '';
+        $consumer_secret = isset( $form_data['shipday_consumer_secret'] ) ? sanitize_text_field( $form_data['shipday_consumer_secret'] ) : '';
 
         update_option('wc_settings_tab_shipday_rest_api_consumer_key', $consumer_key);
@@ -107 +180 @@
     public static function save_general_settings() {
         check_ajax_referer('shipday_nonce');
-
-        parse_str( $_POST[ 'formData' ], $form_data );
-        $enable_datetime =  !isset($form_data['shipday_enable_datetime_plugin']) ? "no" : "yes";
-        $enable_order_type = !isset($form_data['shipday_enable_delivery_option']) ? "no" : "yes";
+        self::ensure_settings_access();
+
+        $form_data = self::get_form_data_from_request();
+        $enable_datetime = self::sanitize_yes_no_flag( isset( $form_data['shipday_enable_datetime_plugin'] ) );
+        $enable_order_type = self::sanitize_yes_no_flag( isset( $form_data['shipday_enable_delivery_option'] ) );
 
         update_option('shipday_enable_datetime_plugin', $enable_datetime);
         update_option('shipday_enable_delivery_option', $enable_order_type);
-        if(isset($form_data['shipday_delivery_pickup_label']))
-            update_option('shipday_delivery_pickup_label', $form_data['shipday_delivery_pickup_label']);
+        if ( isset( $form_data['shipday_delivery_pickup_label'] ) ) {
+            update_option( 'shipday_delivery_pickup_label', sanitize_text_field( $form_data['shipday_delivery_pickup_label'] ) );
+        }
 
         if($enable_datetime === "no"){
@@ -138 +213 @@
     public static function save_delivery_settings() {
         check_ajax_referer('shipday_nonce');
-
-        parse_str( $_POST[ 'formData' ], $form_data );
-
-        $enable_delivery_date =  !isset($form_data['shipday_enable_delivery_date']) ? "no" : "yes";
-        $delivery_date_mandatory = !isset($form_data['shipday_delivery_date_mandatory']) ? "no" : "yes";
-        $available_days_ = !isset($form_data['shipday_avaialble_delivery_days'])? [] : array_map('strval', $form_data['shipday_avaialble_delivery_days']);
-
-        $start_delivery_slot = [];
-        $start_delivery_slot['hh'] = $form_data['shipday_delivery_time_slot_start_hh'];
-        $start_delivery_slot['mm'] = $form_data['shipday_delivery_time_slot_start_mm'];
-        $start_delivery_slot['ampm'] = $form_data['shipday_delivery_time_slot_start_ampm'];
-
-        $enable_delivery_time =  !isset($form_data['shipday_enable_delivery_time']) ? "no" : "yes";
-        $delivery_time_mandatory = !isset($form_data['shipday_delivery_time_mandatory']) ? "no" : "yes";
-
-        $end_delivery_slot = [];
-        $end_delivery_slot['hh'] = $form_data['shipday_delivery_time_slot_end_hh'];
-        $end_delivery_slot['mm'] = $form_data['shipday_delivery_time_slot_end_mm'];
-        $end_delivery_slot['ampm'] = $form_data['shipday_delivery_time_slot_end_ampm'];
+        self::ensure_settings_access();
+
+        $form_data = self::get_form_data_from_request();
+
+        $enable_delivery_date = self::sanitize_yes_no_flag( isset( $form_data['shipday_enable_delivery_date'] ) );
+        $delivery_date_mandatory = self::sanitize_yes_no_flag( isset( $form_data['shipday_delivery_date_mandatory'] ) );
+        $available_days_ = isset( $form_data['shipday_avaialble_delivery_days'] )
+            ? self::sanitize_day_list( $form_data['shipday_avaialble_delivery_days'] )
+            : array();
+        $start_delivery_slot = self::sanitize_time_slot(
+            $form_data['shipday_delivery_time_slot_start_hh'] ?? 9,
+            $form_data['shipday_delivery_time_slot_start_mm'] ?? 0,
+            $form_data['shipday_delivery_time_slot_start_ampm'] ?? 'AM'
+        );
+        $enable_delivery_time = self::sanitize_yes_no_flag( isset( $form_data['shipday_enable_delivery_time'] ) );
+        $delivery_time_mandatory = self::sanitize_yes_no_flag( isset( $form_data['shipday_delivery_time_mandatory'] ) );
+        $end_delivery_slot = self::sanitize_time_slot(
+            $form_data['shipday_delivery_time_slot_end_hh'] ?? 9,
+            $form_data['shipday_delivery_time_slot_end_mm'] ?? 0,
+            $form_data['shipday_delivery_time_slot_end_ampm'] ?? 'AM'
+        );
+        $selectable_delivery_days = self::sanitize_positive_int( $form_data['shipday_selectable_delivery_days'] ?? 30, 30 );
+        $delivery_slot_duration = self::sanitize_allowed_value(
+            $form_data['shipday_delivery_time_slot_duration'] ?? '60',
+            self::$allowed_slot_durations,
+            '60'
+        );
 
         update_option('shipday_enable_delivery_date', $enable_delivery_date);
         update_option('shipday_delivery_date_mandatory', $delivery_date_mandatory);
         update_option('shipday_avaialble_delivery_days',  $available_days_);
-        update_option('shipday_selectable_delivery_days', $form_data['shipday_selectable_delivery_days']);
+        update_option('shipday_selectable_delivery_days', $selectable_delivery_days);
 
         update_option('shipday_enable_delivery_time', $enable_delivery_time);
@@ -169 +252 @@
         update_option('shipday_delivery_time_slot_start',  $start_delivery_slot);
         update_option('shipday_delivery_time_slot_end',  $end_delivery_slot);
-        update_option('shipday_delivery_time_slot_duration',  $form_data['shipday_delivery_time_slot_duration']);
+        update_option('shipday_delivery_time_slot_duration',  $delivery_slot_duration);
 
         wp_send_json_success();
@@ -177 +260 @@
     public static function save_pickup_settings() {
         check_ajax_referer('shipday_nonce');
-
-        parse_str( $_POST[ 'formData' ], $form_data );
-
-        $enable_pickup_date =  !isset($form_data['shipday_enable_pickup_date']) ? "no" : "yes";
-        $pickup_date_mandatory = !isset($form_data['shipday_pickup_date_mandatory']) ? "no" : "yes";
-        $available_days_ = !isset($form_data['shipday_avaialble_pickup_days'])? [] : array_map('strval', $form_data['shipday_avaialble_pickup_days']);
-
-        $start_pickup_slot = [];
-        $start_pickup_slot['hh'] = $form_data['shipday_pickup_time_slot_start_hh'];
-        $start_pickup_slot['mm'] = $form_data['shipday_pickup_time_slot_start_mm'];
-        $start_pickup_slot['ampm'] = $form_data['shipday_pickup_time_slot_start_ampm'];
-
-        $enable_pickup_time =  !isset($form_data['shipday_enable_pickup_time']) ? "no" : "yes";
-        $pickup_time_mandatory = !isset($form_data['shipday_pickup_time_mandatory']) ? "no" : "yes";
-
-        $end_pickup_slot = [];
-        $end_pickup_slot['hh'] = $form_data['shipday_pickup_time_slot_end_hh'];
-        $end_pickup_slot['mm'] = $form_data['shipday_pickup_time_slot_end_mm'];
-        $end_pickup_slot['ampm'] = $form_data['shipday_pickup_time_slot_end_ampm'];
+        self::ensure_settings_access();
+
+        $form_data = self::get_form_data_from_request();
+
+        $enable_pickup_date = self::sanitize_yes_no_flag( isset( $form_data['shipday_enable_pickup_date'] ) );
+        $pickup_date_mandatory = self::sanitize_yes_no_flag( isset( $form_data['shipday_pickup_date_mandatory'] ) );
+        $available_days_ = isset( $form_data['shipday_avaialble_pickup_days'] )
+            ? self::sanitize_day_list( $form_data['shipday_avaialble_pickup_days'] )
+            : array();
+        $start_pickup_slot = self::sanitize_time_slot(
+            $form_data['shipday_pickup_time_slot_start_hh'] ?? 9,
+            $form_data['shipday_pickup_time_slot_start_mm'] ?? 0,
+            $form_data['shipday_pickup_time_slot_start_ampm'] ?? 'AM'
+        );
+        $enable_pickup_time = self::sanitize_yes_no_flag( isset( $form_data['shipday_enable_pickup_time'] ) );
+        $pickup_time_mandatory = self::sanitize_yes_no_flag( isset( $form_data['shipday_pickup_time_mandatory'] ) );
+        $end_pickup_slot = self::sanitize_time_slot(
+            $form_data['shipday_pickup_time_slot_end_hh'] ?? 9,
+            $form_data['shipday_pickup_time_slot_end_mm'] ?? 0,
+            $form_data['shipday_pickup_time_slot_end_ampm'] ?? 'AM'
+        );
+        $selectable_pickup_days = self::sanitize_positive_int( $form_data['shipday_selectable_pickup_days'] ?? 30, 30 );
+        $pickup_slot_duration = self::sanitize_allowed_value(
+            $form_data['shipday_pickup_time_slot_duration'] ?? '60',
+            self::$allowed_slot_durations,
+            '60'
+        );
 
         update_option('shipday_enable_pickup_date', $enable_pickup_date);
         update_option('shipday_pickup_date_mandatory', $pickup_date_mandatory);
         update_option('shipday_avaialble_pickup_days',  $available_days_);
-        update_option('shipday_selectable_pickup_days', $form_data['shipday_selectable_pickup_days']);
+        update_option('shipday_selectable_pickup_days', $selectable_pickup_days);
 
         update_option('shipday_enable_pickup_time', $enable_pickup_time);
@@ -206 +297 @@
         update_option('shipday_pickup_time_slot_start',  $start_pickup_slot);
         update_option('shipday_pickup_time_slot_end',  $end_pickup_slot);
-        update_option('shipday_pickup_time_slot_duration',  $form_data['shipday_pickup_time_slot_duration']);
+        update_option('shipday_pickup_time_slot_duration',  $pickup_slot_duration);
 
         wp_send_json_success();

shipday-for-woocommerce/trunk/admin/Shipday_Time_Slot_Util.php

@@ -1 +1 @@
 <?php
+
+if ( ! defined( 'ABSPATH' ) ) {
+    exit;
+}
 
 class Shipday_Time_Slot_Util {
@@ -19 +23 @@
         // HH
         echo '<input type="text" id="' . esc_attr( $id ) . '_hh" name="' . esc_attr( $id ) . '[hh]" '
-            . 'value="' . $hh . '" size="2" maxlength="2" min="1" max="12" step="1" inputmode="numeric" pattern="\d{2}" '
+            . 'value="' . esc_attr( $hh ) . '" size="2" maxlength="2" min="1" max="12" step="1" inputmode="numeric" pattern="\d{2}" '
             . 'placeholder="HH" style="min-width:120px;text-align:center;" />';
 
@@ -26 +30 @@
         // MM
         echo '<input type="text" id="' . esc_attr( $id ) . '_mm" name="' . esc_attr( $id ) . '[mm]" '
-            . 'value="' . $mm . '" size="2" maxlength="2" inputmode="numeric" pattern="\d{2}" '
+            . 'value="' . esc_attr( $mm ) . '" size="2" maxlength="2" inputmode="numeric" pattern="\d{2}" '
             . 'placeholder="MM" style="min-width:120px;text-align:center;" />';
 

shipday-for-woocommerce/trunk/admin/partials/shipday-admin-display.php

@@ -1 +1 @@
 <?php
-$active_tab = isset($_GET['tab']) ? sanitize_text_field($_GET['tab']) : 'general';
+
+if ( ! defined( 'ABSPATH' ) ) {
+    exit;
+}
+// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Included admin partial uses file-scoped template variables.
+$shipday_active_tab = filter_input( INPUT_GET, 'tab', FILTER_SANITIZE_FULL_SPECIAL_CHARS );
+$shipday_active_tab = is_string( $shipday_active_tab ) && '' !== $shipday_active_tab ? $shipday_active_tab : 'general';
 ?>
 <div class="sd-root">
@@ -17 +23 @@
       <div class="sd-tab-list">
         <!-- GENERAL TAB BUTTON (active by default) -->
-        <button type="button" data-tab="general" class="sd-tab-button <?php echo $active_tab === 'general' ? 'sd-tab-button--active' : ''; ?>">
+        <button type="button" data-tab="general" class="sd-tab-button <?php echo esc_attr( $shipday_active_tab === 'general' ? 'sd-tab-button--active' : '' ); ?>">
           <span>General</span>
         </button>
@@ -23 +29 @@
         <!-- REST API TAB BUTTON -->
         <?php if ( !is_plugin_active( 'dokan-lite/dokan.php' ) && !is_plugin_active( 'wc-multivendor-marketplace/wc-multivendor-marketplace.php' )) {?>
-          <button type="button" data-tab="rest-api" class="sd-tab-button <?php echo $active_tab === 'rest-api' ? 'sd-tab-button--active' : ''; ?>">
+          <button type="button" data-tab="rest-api" class="sd-tab-button <?php echo esc_attr( $shipday_active_tab === 'rest-api' ? 'sd-tab-button--active' : '' ); ?>">
             <span>Rest API</span>
           </button>
@@ -48 +54 @@
 
     <!-- GENERAL TAB PANEL -->
-    <div data-tab-panel="general" class="sd-tab-panel <?php echo $active_tab === 'general' ? 'sd-tab-panel--active' : ''; ?>">
+    <div data-tab-panel="general" class="sd-tab-panel <?php echo esc_attr( $shipday_active_tab === 'general' ? 'sd-tab-panel--active' : '' ); ?>">
         <?php
           include plugin_dir_path(__FILE__) . 'tab-shipday-connect.php';
@@ -55 +61 @@
 
     <!-- REST API TAB PANEL -->
-    <div data-tab-panel="rest-api" class="sd-tab-panel <?php echo $active_tab === 'rest-api' ? 'sd-tab-panel--active' : ''; ?>">
+    <div data-tab-panel="rest-api" class="sd-tab-panel <?php echo esc_attr( $shipday_active_tab === 'rest-api' ? 'sd-tab-panel--active' : '' ); ?>">
         <?php
         include plugin_dir_path( __FILE__ ) . 'tab-rest-api.php';
@@ -123 +129 @@
   })();
 </script>
-

shipday-for-woocommerce/trunk/admin/partials/shipday-admin-new.php

@@ -1 +1 @@
 <?php
+
+if ( ! defined( 'ABSPATH' ) ) {
+    exit;
+}
+// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Included admin partial uses file-scoped template variables.
 // Default to the new Overview tab if none is provided
-$active_tab = isset($_GET['tab']) ? sanitize_text_field($_GET['tab']) : 'overview';
+$shipday_active_tab = filter_input( INPUT_GET, 'tab', FILTER_SANITIZE_FULL_SPECIAL_CHARS );
+$shipday_active_tab = is_string( $shipday_active_tab ) && '' !== $shipday_active_tab ? $shipday_active_tab : 'overview';
 ?>
 <div class="sd-root">
@@ -22 +28 @@
         <!-- Overview -->
         <button type="button" data-tab="overview"
-                class="sd-tab-button <?php echo $active_tab === 'overview' ? 'sd-tab-button--active' : ''; ?>"
-                id="tab-overview" role="tab" aria-selected="<?php echo $active_tab === 'overview' ? 'true' : 'false'; ?>">
+                class="sd-tab-button <?php echo esc_attr( $shipday_active_tab === 'overview' ? 'sd-tab-button--active' : '' ); ?>"
+                id="tab-overview" role="tab" aria-selected="<?php echo esc_attr( $shipday_active_tab === 'overview' ? 'true' : 'false' ); ?>">
           <span>Overview</span>
         </button>
@@ -32 +38 @@
         <!-- General-->
         <button type="button" data-tab="general"
-                class="sd-tab-button <?php echo $active_tab === 'general' ? 'sd-tab-button--active' : ''; ?>"
-                id="tab-general" role="tab" aria-selected="<?php echo $active_tab === 'general' ? 'true' : 'false'; ?>">
+                class="sd-tab-button <?php echo esc_attr( $shipday_active_tab === 'general' ? 'sd-tab-button--active' : '' ); ?>"
+                id="tab-general" role="tab" aria-selected="<?php echo esc_attr( $shipday_active_tab === 'general' ? 'true' : 'false' ); ?>">
           <span>General</span>
         </button>
@@ -39 +45 @@
         <!-- Delivery -->
         <button type="button" data-tab="delivery"
-                class="sd-tab-button <?php echo $active_tab === 'delivery' ? 'sd-tab-button--active' : ''; ?>"
-                id="tab-delivery" role="tab" aria-selected="<?php echo $active_tab === 'delivery' ? 'true' : 'false'; ?>">
+                class="sd-tab-button <?php echo esc_attr( $shipday_active_tab === 'delivery' ? 'sd-tab-button--active' : '' ); ?>"
+                id="tab-delivery" role="tab" aria-selected="<?php echo esc_attr( $shipday_active_tab === 'delivery' ? 'true' : 'false' ); ?>">
           <span>Delivery</span>
         </button>
@@ -46 +52 @@
         <!-- Pickup -->
         <button type="button" data-tab="pickup"
-                class="sd-tab-button <?php echo $active_tab === 'pickup' ? 'sd-tab-button--active' : ''; ?>"
-                id="tab-pickup" role="tab" aria-selected="<?php echo $active_tab === 'pickup' ? 'true' : 'false'; ?>">
+                class="sd-tab-button <?php echo esc_attr( $shipday_active_tab === 'pickup' ? 'sd-tab-button--active' : '' ); ?>"
+                id="tab-pickup" role="tab" aria-selected="<?php echo esc_attr( $shipday_active_tab === 'pickup' ? 'true' : 'false' ); ?>">
           <span>Pickup</span>
         </button>
@@ -56 +62 @@
         <!-- Shipday Connect -->
         <button type="button" data-tab="shipday-connect"
-                class="sd-tab-button <?php echo $active_tab === 'shipday-connect' ? 'sd-tab-button--active' : ''; ?>"
-                id="tab-shipday-connect" role="tab" aria-selected="<?php echo $active_tab === 'shipday-connect' ? 'true' : 'false'; ?>">
+                class="sd-tab-button <?php echo esc_attr( $shipday_active_tab === 'shipday-connect' ? 'sd-tab-button--active' : '' ); ?>"
+                id="tab-shipday-connect" role="tab" aria-selected="<?php echo esc_attr( $shipday_active_tab === 'shipday-connect' ? 'true' : 'false' ); ?>">
           <span>Connect Shipday Account</span>
         </button>
@@ -64 +70 @@
           <?php if ( !is_plugin_active( 'dokan-lite/dokan.php' ) && !is_plugin_active( 'wc-multivendor-marketplace/wc-multivendor-marketplace.php' )) { ?>
             <button type="button" data-tab="rest-api"
-                    class="sd-tab-button <?php echo $active_tab === 'rest-api' ? 'sd-tab-button--active' : ''; ?>"
-                    id="tab-rest-api" role="tab" aria-selected="<?php echo $active_tab === 'rest-api' ? 'true' : 'false'; ?>">
+                    class="sd-tab-button <?php echo esc_attr( $shipday_active_tab === 'rest-api' ? 'sd-tab-button--active' : '' ); ?>"
+                    id="tab-rest-api" role="tab" aria-selected="<?php echo esc_attr( $shipday_active_tab === 'rest-api' ? 'true' : 'false' ); ?>">
               <span>Rest API</span>
             </button>
@@ -78 +84 @@
 
     <!-- OVERVIEW -->
-    <div data-tab-panel="overview" class="sd-tab-panel <?php echo $active_tab === 'overview' ? 'sd-tab-panel--active' : ''; ?>">
+    <div data-tab-panel="overview" class="sd-tab-panel <?php echo esc_attr( $shipday_active_tab === 'overview' ? 'sd-tab-panel--active' : '' ); ?>">
         <?php
         include plugin_dir_path( __FILE__ ) . 'tab-overview.php';
@@ -85 +91 @@
 
     <!-- SHIPDAY CONNECT (old general) -->
-    <div data-tab-panel="shipday-connect" class="sd-tab-panel <?php echo $active_tab === 'shipday-connect' ? 'sd-tab-panel--active' : ''; ?>">
+    <div data-tab-panel="shipday-connect" class="sd-tab-panel <?php echo esc_attr( $shipday_active_tab === 'shipday-connect' ? 'sd-tab-panel--active' : '' ); ?>">
         <?php include plugin_dir_path( __FILE__ ) . 'tab-shipday-connect.php'; ?>
     </div>
 
     <!-- REST API (unchanged) -->
-    <div data-tab-panel="rest-api" class="sd-tab-panel <?php echo $active_tab === 'rest-api' ? 'sd-tab-panel--active' : ''; ?>">
+    <div data-tab-panel="rest-api" class="sd-tab-panel <?php echo esc_attr( $shipday_active_tab === 'rest-api' ? 'sd-tab-panel--active' : '' ); ?>">
         <?php include plugin_dir_path( __FILE__ ) . 'tab-rest-api.php'; ?>
     </div>
 
     <!-- DELIVERY (unchanged) -->
-    <div data-tab-panel="delivery" class="sd-tab-panel <?php echo $active_tab === 'delivery' ? 'sd-tab-panel--active' : ''; ?>">
+    <div data-tab-panel="delivery" class="sd-tab-panel <?php echo esc_attr( $shipday_active_tab === 'delivery' ? 'sd-tab-panel--active' : '' ); ?>">
         <?php include plugin_dir_path( __FILE__ ) . 'tab-delivery.php'; ?>
     </div>
 
     <!-- PICKUP (unchanged) -->
-    <div data-tab-panel="pickup" class="sd-tab-panel <?php echo $active_tab === 'pickup' ? 'sd-tab-panel--active' : ''; ?>">
+    <div data-tab-panel="pickup" class="sd-tab-panel <?php echo esc_attr( $shipday_active_tab === 'pickup' ? 'sd-tab-panel--active' : '' ); ?>">
         <?php include plugin_dir_path( __FILE__ ) . 'tab-pickup.php'; ?>
     </div>
 
     <!-- General Settings (new) -->
-    <div data-tab-panel="general" class="sd-tab-panel <?php echo $active_tab === 'general' ? 'sd-tab-panel--active' : ''; ?>">
+    <div data-tab-panel="general" class="sd-tab-panel <?php echo esc_attr( $shipday_active_tab === 'general' ? 'sd-tab-panel--active' : '' ); ?>">
         <?php include plugin_dir_path( __FILE__ ) . 'tab-general.php'; ?>
     </div>
@@ -155 +161 @@
   })();
 </script>
-

shipday-for-woocommerce/trunk/admin/partials/tab-delivery.php

@@ -1 +1 @@
 <?php
+
+if ( ! defined( 'ABSPATH' ) ) {
+    exit;
+}
+// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Included admin partial uses file-scoped template variables.
 $enable_delivery_date = get_option('shipday_enable_delivery_date', "no") === "yes";
 $delivery_date_mandatory = get_option('shipday_delivery_date_mandatory', "no") === "yes";
@@ -30 +35 @@
 <div class="sd-panel-body">
 
-  <fieldset class="sd-fieldset" <?php echo $datetime_enabled ? '' : 'disabled aria-disabled="true"'; ?> <?php echo $datetime_enabled ? '' : 'disabled'; ?>>
+  <fieldset class="sd-fieldset" <?php disabled( ! $datetime_enabled ); ?> aria-disabled="<?php echo esc_attr( $datetime_enabled ? 'false' : 'true' ); ?>">
   <p class="shipday-delivery-notice"><span
-        class="dashicons dashicons-yes"></span><?php _e(' Settings Changed Successfully', 'shipday-delivery'); ?>
+        class="dashicons dashicons-yes"></span><?php esc_html_e( ' Settings Changed Successfully', 'shipday-for-woocommerce' ); ?>
   </p>
 
@@ -54 +59 @@
                 name="shipday_enable_delivery_date"
                 class="shipday-switch__input"
-                <?php echo ($enable_delivery_date) ? "checked" : "" ?>
+                <?php checked( $enable_delivery_date ); ?>
             />
             <span class="shipday-switch__track">
@@ -74 +79 @@
             <input
                 type="checkbox" id="shipday_delivery_date_mandatory" name="shipday_delivery_date_mandatory" class="shipday-switch__input"
-                <?php echo ($delivery_date_mandatory) ? "checked" : "" ?>
+                <?php checked( $delivery_date_mandatory ); ?>
             />
             <span class="shipday-switch__track">
@@ -108 +113 @@
           <label class="shipday-day-chip">
             <input type="checkbox" class="shipday-day-chip__input" name="shipday_avaialble_delivery_days[]" value="0"
-                <?php echo (in_array("0", $available_delivery_days)) ? "checked" : "" ?>
+                <?php checked( in_array( '0', $available_delivery_days, true ) ); ?>
             />
             <span class="shipday-day-chip__pill">Sunday</span>
@@ -116 +121 @@
             <input
                 type="checkbox" class="shipday-day-chip__input" name="shipday_avaialble_delivery_days[]" value="1"
-                <?php echo (in_array("1", $available_delivery_days, true)) ? "checked" : "" ?>
+                <?php checked( in_array( '1', $available_delivery_days, true ) ); ?>
             />
             <span class="shipday-day-chip__pill">Monday</span>
@@ -124 +129 @@
             <input
                 type="checkbox" class="shipday-day-chip__input" name="shipday_avaialble_delivery_days[]" value="2"
-                <?php echo (in_array("2", $available_delivery_days, true)) ? "checked" : "" ?>
+                <?php checked( in_array( '2', $available_delivery_days, true ) ); ?>
             />
             <span class="shipday-day-chip__pill">Tuesday</span>
@@ -132 +137 @@
             <input
                 type="checkbox" class="shipday-day-chip__input" name="shipday_avaialble_delivery_days[]" value="3"
-                <?php echo (in_array("3", $available_delivery_days, true)) ? "checked" : "" ?>
+                <?php checked( in_array( '3', $available_delivery_days, true ) ); ?>
             />
             <span class="shipday-day-chip__pill">Wednesday</span>
@@ -140 +145 @@
             <input
                 type="checkbox" class="shipday-day-chip__input" name="shipday_avaialble_delivery_days[]" value="4"
-                <?php echo (in_array("4", $available_delivery_days, true)) ? "checked" : "" ?>
+                <?php checked( in_array( '4', $available_delivery_days, true ) ); ?>
             />
             <span class="shipday-day-chip__pill">Thursday</span>
@@ -148 +153 @@
             <input
                 type="checkbox" class="shipday-day-chip__input" name="shipday_avaialble_delivery_days[]" value="5"
-                <?php echo (in_array("5", $available_delivery_days, true)) ? "checked" : "" ?>
+                <?php checked( in_array( '5', $available_delivery_days, true ) ); ?>
             />
             <span class="shipday-day-chip__pill">Friday</span>
@@ -156 +161 @@
             <input
                 type="checkbox" class="shipday-day-chip__input" name="shipday_avaialble_delivery_days[]" value="6"
-                <?php echo (in_array("6", $available_delivery_days, true)) ? "checked" : "" ?>
+                <?php checked( in_array( '6', $available_delivery_days, true ) ); ?>
             />
             <span class="shipday-day-chip__pill">Saturday</span>
@@ -181 +186 @@
         <div class="sd-input-wrapper">
           <input type="text" placeholder="" class="sd-text-input" name="shipday_selectable_delivery_days"
-                 value="<?php echo $selectable_delivery_days ?>"
+                 value="<?php echo esc_attr( $selectable_delivery_days ); ?>"
           />
         </div>
@@ -204 +209 @@
             <input
                 type="checkbox" id="shipday_enable_delivery_time" name="shipday_enable_delivery_time" class="shipday-switch__input"
-                <?php echo ($enable_delivery_time) ? "checked" : "" ?>
+                <?php checked( $enable_delivery_time ); ?>
             />
             <span class="shipday-switch__track">
@@ -224 +229 @@
             <input
                 type="checkbox" id="shipday_delivery_time_mandatory" name="shipday_delivery_time_mandatory" class="shipday-switch__input"
-                <?php echo ($delivery_time_mandatory) ? "checked" : "" ?>
+                <?php checked( $delivery_time_mandatory ); ?>
             />
             <span class="shipday-switch__track">
@@ -252 +257 @@
                     type="number" min="1" max="12" id="shipday_delivery_time_slot_start_hh" name="shipday_delivery_time_slot_start_hh"
                     class="shipday-time-input__field"
-                    value="<?php echo $start_delivery_slot['hh'] ?>"
+                    value="<?php echo esc_attr( $start_delivery_slot['hh'] ); ?>"
                 />
               </div>
@@ -263 +268 @@
                     type="number" min="0" max="59" step="5" id="shipday_delivery_time_slot_start_mm" name="shipday_delivery_time_slot_start_mm"
                     class="shipday-time-input__field"
-                    value="<?php echo $start_delivery_slot['mm'] ?>"
+                    value="<?php echo esc_attr( $start_delivery_slot['mm'] ); ?>"
                 />
               </div>
@@ -274 +279 @@
                     class="shipday-ampm-select__field sd-text-input"
                 >
-                  <option value="AM" <?php echo ($start_delivery_slot["ampm"]==="AM") ? "selected" : "" ?> >AM</option>
-                  <option value="PM" <?php echo ($start_delivery_slot["ampm"]==="PM") ? "selected" : "" ?> >PM</option>
+                  <option value="AM" <?php selected( $start_delivery_slot['ampm'], 'AM' ); ?>>AM</option>
+                  <option value="PM" <?php selected( $start_delivery_slot['ampm'], 'PM' ); ?>>PM</option>
                 </select>
               </div>
@@ -293 +298 @@
                     type="number"  min="1"  max="12" step="1"  id="shipday_delivery_time_slot_end_hh" name="shipday_delivery_time_slot_end_hh"
                     class="shipday-time-input__field"
-                    value="<?php echo $end_delivery_slot['hh'] ?>"
+                    value="<?php echo esc_attr( $end_delivery_slot['hh'] ); ?>"
                 />
               </div>
@@ -304 +309 @@
                     type="number" min="0" max="59" step="5" id="shipday_delivery_time_slot_end_mm" name="shipday_delivery_time_slot_end_mm"
                     class="shipday-time-input__field"
-                    value="<?php echo $end_delivery_slot['mm'] ?>"
+                    value="<?php echo esc_attr( $end_delivery_slot['mm'] ); ?>"
                 />
               </div>
@@ -315 +320 @@
                     class="shipday-ampm-select__field sd-text-input"
                 >
-                  <option value="AM" <?php echo ($end_delivery_slot["ampm"]==="AM") ? "selected" : "" ?> >AM</option>
-                  <option value="PM" <?php echo ($end_delivery_slot["ampm"]==="PM") ? "selected" : "" ?> >PM</option>
+                  <option value="AM" <?php selected( $end_delivery_slot['ampm'], 'AM' ); ?>>AM</option>
+                  <option value="PM" <?php selected( $end_delivery_slot['ampm'], 'PM' ); ?>>PM</option>
                 </select>
               </div>
@@ -334 +339 @@
                   class="shipday-slot-duration-field__select sd-text-input"
               >
-                <option value="10" <?php echo ($delivery_slot_duration === "10") ? "selected" : ""?>>10</option>
-                <option value="15" <?php echo ($delivery_slot_duration === "15") ? "selected" : ""?>>15</option>
-                <option value="30" <?php echo ($delivery_slot_duration === "30") ? "selected" : ""?>>30</option>
-                <option value="45" <?php echo ($delivery_slot_duration === "45") ? "selected" : ""?>>45</option>
-                <option value="60" <?php echo ($delivery_slot_duration === "60") ? "selected" : ""?>>60</option>
-                <option value="90" <?php echo ($delivery_slot_duration === "90") ? "selected" : ""?>>90</option>
-                <option value="120" <?php echo ($delivery_slot_duration === "120") ? "selected" : ""?>>120</option>
-                <option value="150" <?php echo ($delivery_slot_duration === "150") ? "selected" : ""?>>150</option>
-                <option value="180" <?php echo ($delivery_slot_duration === "180") ? "selected" : ""?>>180</option>
-                <option value="240" <?php echo ($delivery_slot_duration === "240") ? "selected" : ""?>>240</option>
-                <option value="300" <?php echo ($delivery_slot_duration === "300") ? "selected" : ""?>>300</option>
-                <option value="360" <?php echo ($delivery_slot_duration === "360") ? "selected" : ""?>>360</option>
+                <option value="10" <?php selected( $delivery_slot_duration, '10' ); ?>>10</option>
+                <option value="15" <?php selected( $delivery_slot_duration, '15' ); ?>>15</option>
+                <option value="30" <?php selected( $delivery_slot_duration, '30' ); ?>>30</option>
+                <option value="45" <?php selected( $delivery_slot_duration, '45' ); ?>>45</option>
+                <option value="60" <?php selected( $delivery_slot_duration, '60' ); ?>>60</option>
+                <option value="90" <?php selected( $delivery_slot_duration, '90' ); ?>>90</option>
+                <option value="120" <?php selected( $delivery_slot_duration, '120' ); ?>>120</option>
+                <option value="150" <?php selected( $delivery_slot_duration, '150' ); ?>>150</option>
+                <option value="180" <?php selected( $delivery_slot_duration, '180' ); ?>>180</option>
+                <option value="240" <?php selected( $delivery_slot_duration, '240' ); ?>>240</option>
+                <option value="300" <?php selected( $delivery_slot_duration, '300' ); ?>>300</option>
+                <option value="360" <?php selected( $delivery_slot_duration, '360' ); ?>>360</option>
               </select>
             </div>

shipday-for-woocommerce/trunk/admin/partials/tab-general.php

@@ -1 +1 @@
 <?php
+
+if ( ! defined( 'ABSPATH' ) ) {
+    exit;
+}
+// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Included admin partial uses file-scoped template variables.
 $datetime_enabled = get_option('shipday_enable_datetime_plugin', "no") === "yes";
 $order_type_enabled = get_option('shipday_enable_delivery_option', "no") === "yes";
@@ -20 +25 @@
   <p class="shipday-general-notice">
     <span class="dashicons dashicons-yes"></span>
-      <?php _e(' Settings Changed Successfully', 'shipday-delivery'); ?>
+      <?php esc_html_e( ' Settings Changed Successfully', 'shipday-for-woocommerce' ); ?>
   </p>
   <form action="" method="post" id="shipday-general-settings-form">
@@ -36 +41 @@
               name="shipday_enable_datetime_plugin"
               class="shipday-switch__input"
-              <?php echo ($datetime_enabled) ? "checked" : "" ?>
+              <?php checked( $datetime_enabled ); ?>
           />
           <span class="shipday-switch__track">
@@ -64 +69 @@
               name="shipday_enable_delivery_option"
               class="shipday-switch__input"
-              <?php echo ($order_type_enabled) ? "checked" : "" ?>
+              <?php checked( $order_type_enabled ); ?>
           />
           <span class="shipday-switch__track">
@@ -107 +112 @@
       <div class="sd-input-wrapper sd-text-input">
         <input type="text" placeholder="" class="sd-text-input" name="shipday_delivery_pickup_label"
-               value="<?php echo $datetime_heading_label?>"
+               value="<?php echo esc_attr( $datetime_heading_label ); ?>"
         />
       </div>

shipday-for-woocommerce/trunk/admin/partials/tab-order-sync.php

@@ -1 +1 @@
 <?php
+
+if ( ! defined( 'ABSPATH' ) ) {
+    exit;
+}
+// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Included admin partial uses file-scoped template variables.
 $pickup_order_enabled = get_option('wc_settings_tab_shipday_enable_pickup', "no") === "yes";
 $delivery_order_enabled = get_option('wc_settings_tab_shipday_enable_delivery', "yes") === "yes";
@@ -22 +27 @@
   <p class="shipday-order-sync-notice">
     <span class="dashicons dashicons-yes"></span>
-      <?php _e(' Settings Changed Successfully', 'shipday-delivery'); ?>
+      <?php esc_html_e( ' Settings Changed Successfully', 'shipday-for-woocommerce' ); ?>
   </p>
   <form action="" method="post" id="shipday-order-sync-settings-form">
@@ -57 +62 @@
                     name="wc_settings_tab_shipday_order_manage"
                     value="admin_manage"
-                    <?php echo ($manage_order === 'admin_manage') ? 'checked' : ''; ?>
+                    <?php checked( $manage_order, 'admin_manage' ); ?>
                 />
                 <span class="sd-radio__mark" aria-hidden="true"></span>
@@ -69 +74 @@
                     name="wc_settings_tab_shipday_order_manage"
                     value="vendor_manage"
-                    <?php echo ($manage_order === 'vendor_manage') ? 'checked' : ''; ?>
+                    <?php checked( $manage_order, 'vendor_manage' ); ?>
                 />
                 <span class="sd-radio__mark" aria-hidden="true"></span>

shipday-for-woocommerce/trunk/admin/partials/tab-overview.php

@@ -1 +1 @@
 <?php
+
+if ( ! defined( 'ABSPATH' ) ) {
+    exit;
+}
 // Helper to build a same-page link to a specific tab
 function shipday_tab_link( $tab_slug ) {
@@ -29 +33 @@
       <div class="sd-link-row">
         <!-- General (blank page for now) -->
-        <a class="sd-link-tile" href="<?php echo shipday_tab_link('general'); ?>">
+        <a class="sd-link-tile" href="<?php echo esc_url( shipday_tab_link( 'general' ) ); ?>">
           <span class="sd-link-tile__icon" aria-hidden="true">
              <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none">
@@ -42 +46 @@
 
         <!-- Delivery -->
-        <a class="sd-link-tile" href="<?php echo shipday_tab_link('delivery'); ?>">
+        <a class="sd-link-tile" href="<?php echo esc_url( shipday_tab_link( 'delivery' ) ); ?>">
           <span class="sd-link-tile__icon" aria-hidden="true">
             <!-- Delivery icon (24x24) -->
@@ -57 +61 @@
 
         <!-- Pickup -->
-        <a class="sd-link-tile" href="<?php echo shipday_tab_link('pickup'); ?>">
+        <a class="sd-link-tile" href="<?php echo esc_url( shipday_tab_link( 'pickup' ) ); ?>">
           <span class="sd-link-tile__icon" aria-hidden="true">
            <svg  width="24" height="24" viewBox="0 0 24 24" fill="none" class="sd-link-tile__svg" xmlns="http://www.w3.org/2000/svg"><path d="M4.72745 17.2913C4.30662 17.2913 3.95037 17.1455 3.6587 16.8538C3.36704 16.5622 3.2212 16.2059 3.2212 15.7849V9.1278C2.88565 8.85224 2.63377 8.49461 2.46558 8.05488C2.29725 7.6153 2.29377 7.14072 2.45516 6.63113L3.29808 3.8778C3.40919 3.52738 3.59773 3.24481 3.8637 3.03009C4.12982 2.81537 4.44766 2.70801 4.81725 2.70801H16.1922C16.562 2.70801 16.8777 2.81058 17.1393 3.01572C17.4011 3.22086 17.5918 3.50294 17.7114 3.86197L18.5704 6.63113C18.7318 7.14072 18.7283 7.6137 18.56 8.05009C18.3918 8.48662 18.1399 8.8512 17.8043 9.14384V15.7849C17.8043 16.2059 17.6585 16.5622 17.3668 16.8538C17.0752 17.1455 16.7189 17.2913 16.2981 17.2913H4.72745ZM12.3462 8.54134C12.8013 8.54134 13.1435 8.40217 13.3727 8.12384C13.6018 7.84551 13.6956 7.54662 13.6539 7.22717L13.1475 3.95801H11.1377V7.24967C11.1377 7.60009 11.2563 7.90301 11.4935 8.15842C11.7307 8.4137 12.015 8.54134 12.3462 8.54134ZM8.5962 8.54134C8.97968 8.54134 9.29079 8.4137 9.52954 8.15842C9.76843 7.90301 9.88787 7.60009 9.88787 7.24967V3.95801H7.87808L7.37183 7.25926C7.32683 7.55523 7.41975 7.84294 7.65058 8.12238C7.88141 8.40169 8.19662 8.54134 8.5962 8.54134ZM4.88787 8.54134C5.19662 8.54134 5.46211 8.4337 5.68433 8.21842C5.90655 8.00315 6.04384 7.73259 6.0962 7.40676L6.58641 3.95801H4.81725C4.72641 3.95801 4.65433 3.97801 4.601 4.01801C4.54752 4.05815 4.50745 4.11829 4.48079 4.19842L3.67933 6.90988C3.56933 7.2678 3.6212 7.62919 3.83495 7.99405C4.04857 8.35891 4.39954 8.54134 4.88787 8.54134ZM16.1379 8.54134C16.5887 8.54134 16.9338 8.36426 17.1731 8.01009C17.4124 7.65592 17.4701 7.28919 17.3462 6.90988L16.5031 4.18238C16.4764 4.10224 16.4364 4.04481 16.3831 4.01009C16.3296 3.97537 16.2575 3.95801 16.1666 3.95801H14.4391L14.9293 7.40676C14.9817 7.73259 15.119 8.00315 15.3412 8.21842C15.5634 8.4337 15.829 8.54134 16.1379 8.54134ZM4.72745 16.0413H16.2981C16.3728 16.0413 16.4342 16.0173 16.4822 15.9693C16.5304 15.9212 16.5545 15.8597 16.5545 15.7849V9.71759C16.4637 9.75078 16.3878 9.77134 16.3268 9.77926C16.266 9.78731 16.203 9.79134 16.1379 9.79134C15.7629 9.79134 15.433 9.72349 15.1483 9.5878C14.8636 9.45211 14.5876 9.23467 14.3204 8.93551C14.0865 9.1962 13.8098 9.40405 13.4904 9.55905C13.1709 9.71391 12.8066 9.79134 12.3975 9.79134C12.0438 9.79134 11.7105 9.71787 11.3975 9.57092C11.0844 9.42412 10.7895 9.21231 10.5129 8.93551C10.2554 9.21231 9.9637 9.42412 9.63787 9.57092C9.3119 9.71787 8.98176 9.79134 8.64745 9.79134C8.27134 9.79134 7.91877 9.72322 7.58975 9.58697C7.26072 9.45072 6.9712 9.23356 6.7212 8.93551C6.37065 9.28592 6.04766 9.5162 5.75225 9.62634C5.45697 9.73634 5.16884 9.79134 4.88787 9.79134C4.82259 9.79134 4.75523 9.78731 4.68579 9.77926C4.61634 9.77134 4.54475 9.75078 4.471 9.71759V15.7849C4.471 15.8597 4.49509 15.9212 4.54329 15.9693C4.59134 16.0173 4.65273 16.0413 4.72745 16.0413Z" fill="#525252"></path></svg>
@@ -81 +85 @@
     <div class="shipday-delivery-card__content">
       <div class="sd-link-row">
-        <a class="sd-link-tile" href="<?php echo shipday_tab_link('shipday-connect'); ?>">
+        <a class="sd-link-tile" href="<?php echo esc_url( shipday_tab_link( 'shipday-connect' ) ); ?>">
           <span class="sd-link-tile__icon" aria-hidden="true">
              <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none">
@@ -95 +99 @@
         <!-- Rest API (honor your existing vendor check) -->
           <?php if ( !is_plugin_active( 'dokan-lite/dokan.php' ) && !is_plugin_active( 'wc-multivendor-marketplace/wc-multivendor-marketplace.php' ) ) { ?>
-            <a class="sd-link-tile" href="<?php echo shipday_tab_link('rest-api'); ?>">
+            <a class="sd-link-tile" href="<?php echo esc_url( shipday_tab_link( 'rest-api' ) ); ?>">
               <span class="sd-link-tile__icon" aria-hidden="true">
                  <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none">

shipday-for-woocommerce/trunk/admin/partials/tab-pickup.php

@@ -1 +1 @@
 <?php
+
+if ( ! defined( 'ABSPATH' ) ) {
+    exit;
+}
+// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Included admin partial uses file-scoped template variables.
 $enable_pickup_date = get_option('shipday_enable_pickup_date', "no") === "yes";
 $pickup_date_mandatory = get_option('shipday_pickup_date_mandatory', "no") === "yes";
@@ -29 +34 @@
 
 <div class="sd-panel-body">
-  <fieldset class="sd-fieldset" <?php echo $datetime_enabled ? '' : 'disabled aria-disabled="true"'; ?> <?php echo $datetime_enabled ? '' : 'disabled'; ?>>
+  <fieldset class="sd-fieldset" <?php disabled( ! $datetime_enabled ); ?> aria-disabled="<?php echo esc_attr( $datetime_enabled ? 'false' : 'true' ); ?>">
 
   <p class="shipday-pickup-notice"><span
-        class="dashicons dashicons-yes"></span><?php _e(' Settings Changed Successfully', 'shipday-delivery'); ?>
+        class="dashicons dashicons-yes"></span><?php esc_html_e( ' Settings Changed Successfully', 'shipday-for-woocommerce' ); ?>
   </p>
 
@@ -54 +59 @@
                 name="shipday_enable_pickup_date"
                 class="shipday-switch__input"
-                <?php echo ($enable_pickup_date) ? "checked" : "" ?>
+                <?php checked( $enable_pickup_date ); ?>
             />
             <span class="shipday-switch__track">
@@ -74 +79 @@
             <input
                 type="checkbox" id="shipday_pickup_date_mandatory" name="shipday_pickup_date_mandatory" class="shipday-switch__input"
-                <?php echo ($pickup_date_mandatory) ? "checked" : "" ?>
+                <?php checked( $pickup_date_mandatory ); ?>
             />
             <span class="shipday-switch__track">
@@ -108 +113 @@
             <label class="shipday-day-chip">
               <input type="checkbox" class="shipday-day-chip__input" name="shipday_avaialble_pickup_days[]" value="0"
-                  <?php echo (in_array("0", $available_pickup_days)) ? "checked" : "" ?>
+                  <?php checked( in_array( '0', $available_pickup_days, true ) ); ?>
               />
               <span class="shipday-day-chip__pill">Sunday</span>
@@ -116 +121 @@
               <input
                   type="checkbox" class="shipday-day-chip__input" name="shipday_avaialble_pickup_days[]" value="1"
-                  <?php echo (in_array("1", $available_pickup_days, true)) ? "checked" : "" ?>
+                  <?php checked( in_array( '1', $available_pickup_days, true ) ); ?>
               />
               <span class="shipday-day-chip__pill">Monday</span>
@@ -124 +129 @@
               <input
                   type="checkbox" class="shipday-day-chip__input" name="shipday_avaialble_pickup_days[]" value="2"
-                  <?php echo (in_array("2", $available_pickup_days, true)) ? "checked" : "" ?>
+                  <?php checked( in_array( '2', $available_pickup_days, true ) ); ?>
               />
               <span class="shipday-day-chip__pill">Tuesday</span>
@@ -132 +137 @@
               <input
                   type="checkbox" class="shipday-day-chip__input" name="shipday_avaialble_pickup_days[]" value="3"
-                  <?php echo (in_array("3", $available_pickup_days, true)) ? "checked" : "" ?>
+                  <?php checked( in_array( '3', $available_pickup_days, true ) ); ?>
               />
               <span class="shipday-day-chip__pill">Wednesday</span>
@@ -140 +145 @@
               <input
                   type="checkbox" class="shipday-day-chip__input" name="shipday_avaialble_pickup_days[]" value="4"
-                  <?php echo (in_array("4", $available_pickup_days, true)) ? "checked" : "" ?>
+                  <?php checked( in_array( '4', $available_pickup_days, true ) ); ?>
               />
               <span class="shipday-day-chip__pill">Thursday</span>
@@ -148 +153 @@
               <input
                   type="checkbox" class="shipday-day-chip__input" name="shipday_avaialble_pickup_days[]" value="5"
-                  <?php echo (in_array("5", $available_pickup_days, true)) ? "checked" : "" ?>
+                  <?php checked( in_array( '5', $available_pickup_days, true ) ); ?>
               />
               <span class="shipday-day-chip__pill">Friday</span>
@@ -156 +161 @@
               <input
                   type="checkbox" class="shipday-day-chip__input" name="shipday_avaialble_pickup_days[]" value="6"
-                  <?php echo (in_array("6", $available_pickup_days, true)) ? "checked" : "" ?>
+                  <?php checked( in_array( '6', $available_pickup_days, true ) ); ?>
               />
               <span class="shipday-day-chip__pill">Saturday</span>
@@ -181 +186 @@
           <div class="sd-input-wrapper">
             <input type="text" placeholder="" class="sd-text-input" name="shipday_selectable_pickup_days"
-                   value="<?php echo $selectable_pickup_days ?>"
+                   value="<?php echo esc_attr( $selectable_pickup_days ); ?>"
             />
           </div>
@@ -204 +209 @@
             <input
                 type="checkbox" id="shipday_enable_pickup_time" name="shipday_enable_pickup_time" class="shipday-switch__input"
-                <?php echo ($enable_pickup_time) ? "checked" : "" ?>
+                <?php checked( $enable_pickup_time ); ?>
             />
             <span class="shipday-switch__track">
@@ -224 +229 @@
             <input
                 type="checkbox" id="shipday_pickup_time_mandatory" name="shipday_pickup_time_mandatory" class="shipday-switch__input"
-                <?php echo ($pickup_time_mandatory) ? "checked" : "" ?>
+                <?php checked( $pickup_time_mandatory ); ?>
             />
             <span class="shipday-switch__track">
@@ -252 +257 @@
                        type="number" min="1" max="12" id="shipday_pickup_time_slot_start_hh" name="shipday_pickup_time_slot_start_hh"
                        class="shipday-time-input__field"
-                       value="<?php echo $start_pickup_slot['hh'] ?>"
+                       value="<?php echo esc_attr( $start_pickup_slot['hh'] ); ?>"
                 />
               </div>
@@ -263 +268 @@
                        type="number" min="0" max="59" step="5" id="shipday_pickup_time_slot_start_mm" name="shipday_pickup_time_slot_start_mm"
                        class="shipday-time-input__field"
-                       value="<?php echo $start_pickup_slot['mm'] ?>"
+                       value="<?php echo esc_attr( $start_pickup_slot['mm'] ); ?>"
                 />
               </div>
@@ -274 +279 @@
                     class="shipday-ampm-select__field sd-text-input"
                 >
-                  <option value="AM" <?php echo ($start_pickup_slot["ampm"]==="AM") ? "selected" : "" ?> >AM</option>
-                  <option value="PM" <?php echo ($start_pickup_slot["ampm"]==="PM") ? "selected" : "" ?> >PM</option>
+                  <option value="AM" <?php selected( $start_pickup_slot['ampm'], 'AM' ); ?>>AM</option>
+                  <option value="PM" <?php selected( $start_pickup_slot['ampm'], 'PM' ); ?>>PM</option>
                 </select>
               </div>
@@ -293 +298 @@
                        type="number"  min="1"  max="12" step="1"  id="shipday_pickup_time_slot_end_hh" name="shipday_pickup_time_slot_end_hh"
                        class="shipday-time-input__field"
-                       value="<?php echo $end_pickup_slot['hh'] ?>"
+                       value="<?php echo esc_attr( $end_pickup_slot['hh'] ); ?>"
                 />
               </div>
@@ -304 +309 @@
                        type="number" min="0" max="59" step="5" id="shipday_pickup_time_slot_end_mm" name="shipday_pickup_time_slot_end_mm"
                        class="shipday-time-input__field"
-                       value="<?php echo $end_pickup_slot['mm'] ?>"
+                       value="<?php echo esc_attr( $end_pickup_slot['mm'] ); ?>"
                 />
               </div>
@@ -315 +320 @@
                     class="shipday-ampm-select__field sd-text-input"
                 >
-                  <option value="AM" <?php echo ($end_pickup_slot["ampm"]==="AM") ? "selected" : "" ?> >AM</option>
-                  <option value="PM" <?php echo ($end_pickup_slot["ampm"]==="PM") ? "selected" : "" ?> >PM</option>
+                  <option value="AM" <?php selected( $end_pickup_slot['ampm'], 'AM' ); ?>>AM</option>
+                  <option value="PM" <?php selected( $end_pickup_slot['ampm'], 'PM' ); ?>>PM</option>
                 </select>
               </div>
@@ -334 +339 @@
                   class="shipday-slot-duration-field__select sd-text-input"
               >
-                <option value="10" <?php echo ($pickup_slot_duration === "10") ? "selected" : ""?>>10</option>
-                <option value="15" <?php echo ($pickup_slot_duration === "15") ? "selected" : ""?>>15</option>
-                <option value="30" <?php echo ($pickup_slot_duration === "30") ? "selected" : ""?>>30</option>
-                <option value="45" <?php echo ($pickup_slot_duration === "45") ? "selected" : ""?>>45</option>
-                <option value="60" <?php echo ($pickup_slot_duration === "60") ? "selected" : ""?>>60</option>
-                <option value="90" <?php echo ($pickup_slot_duration === "90") ? "selected" : ""?>>90</option>
-                <option value="120" <?php echo ($pickup_slot_duration === "120") ? "selected" : ""?>>120</option>
-                <option value="150" <?php echo ($pickup_slot_duration === "150") ? "selected" : ""?>>150</option>
-                <option value="180" <?php echo ($pickup_slot_duration === "180") ? "selected" : ""?>>180</option>
-                <option value="240" <?php echo ($pickup_slot_duration === "240") ? "selected" : ""?>>240</option>
-                <option value="300" <?php echo ($pickup_slot_duration === "300") ? "selected" : ""?>>300</option>
-                <option value="360" <?php echo ($pickup_slot_duration === "360") ? "selected" : ""?>>360</option>
+                <option value="10" <?php selected( $pickup_slot_duration, '10' ); ?>>10</option>
+                <option value="15" <?php selected( $pickup_slot_duration, '15' ); ?>>15</option>
+                <option value="30" <?php selected( $pickup_slot_duration, '30' ); ?>>30</option>
+                <option value="45" <?php selected( $pickup_slot_duration, '45' ); ?>>45</option>
+                <option value="60" <?php selected( $pickup_slot_duration, '60' ); ?>>60</option>
+                <option value="90" <?php selected( $pickup_slot_duration, '90' ); ?>>90</option>
+                <option value="120" <?php selected( $pickup_slot_duration, '120' ); ?>>120</option>
+                <option value="150" <?php selected( $pickup_slot_duration, '150' ); ?>>150</option>
+                <option value="180" <?php selected( $pickup_slot_duration, '180' ); ?>>180</option>
+                <option value="240" <?php selected( $pickup_slot_duration, '240' ); ?>>240</option>
+                <option value="300" <?php selected( $pickup_slot_duration, '300' ); ?>>300</option>
+                <option value="360" <?php selected( $pickup_slot_duration, '360' ); ?>>360</option>
               </select>
             </div>

shipday-for-woocommerce/trunk/admin/partials/tab-rest-api.php

@@ -1 +1 @@
 <?php
+
+if ( ! defined( 'ABSPATH' ) ) {
+    exit;
+}
+// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Included admin partial uses file-scoped template variables.
   $consumer_key = get_option('wc_settings_tab_shipday_rest_api_consumer_key');
   $consumer_secret = get_option('wc_settings_tab_shipday_rest_api_consumer_secret');
@@ -16 +21 @@
 
 <div class="sd-panel-body">
-  <p class="shipday-rest-api-notice"><span class="dashicons dashicons-yes"></span><?php _e(' Settings Changed Successfully', 'shipday-delivery'); ?></p>
+  <p class="shipday-rest-api-notice"><span class="dashicons dashicons-yes"></span><?php esc_html_e( ' Settings Changed Successfully', 'shipday-for-woocommerce' ); ?></p>
   <form action="" method="post" id ="shipday-rest-api-settings-form">
       <?php wp_nonce_field('shipday_nonce'); ?>
@@ -31 +36 @@
       <div class="sd-input-wrapper">
         <input type="text" placeholder="Enter consumer Key" class="sd-text-input" name="shipday_consumer_key"
-               value="<?php echo (isset($consumer_key) && !empty($consumer_key)) ? stripslashes($consumer_key) : '' ?>"
+               value="<?php echo esc_attr( ! empty( $consumer_key ) ? wp_unslash( $consumer_key ) : '' ); ?>"
         />
       </div>
@@ -41 +46 @@
       <div class="sd-input-wrapper">
         <input type="text" placeholder="Enter consumer secret" class="sd-text-input" name="shipday_consumer_secret"
-               value="<?php echo (isset($consumer_secret) && !empty($consumer_secret)) ? stripslashes($consumer_secret) : '' ?>"
+               value="<?php echo esc_attr( ! empty( $consumer_secret ) ? wp_unslash( $consumer_secret ) : '' ); ?>"
         />
       </div>

shipday-for-woocommerce/trunk/admin/partials/tab-shipday-connect.php

@@ -1 +1 @@
 <?php
+
+if ( ! defined( 'ABSPATH' ) ) {
+    exit;
+}
+// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Included admin partial uses file-scoped template variables.
 $api_key = get_option('wc_settings_tab_shipday_api_key');
 $pickup_order_enabled = get_option('wc_settings_tab_shipday_enable_pickup', "no") === "yes";
@@ -20 +25 @@
 
 <div class="sd-panel-body">
-  <p class="shipday-connect-notice"><span class="dashicons dashicons-yes"></span><?php _e(' Settings Changed Successfully', 'shipday-delivery'); ?></p>
+  <p class="shipday-connect-notice"><span class="dashicons dashicons-yes"></span><?php esc_html_e( ' Settings Changed Successfully', 'shipday-for-woocommerce' ); ?></p>
   <form action="" method="post" id ="shipday-connect-settings-form">
       <?php wp_nonce_field('shipday_nonce'); ?>
@@ -32 +37 @@
         <div class="sd-input-wrapper">
             <input type="text" placeholder="Enter API Key" class="sd-text-input" name="shipday_api_key"
-                   value="<?php echo (isset($api_key) && !empty($api_key)) ? stripslashes($api_key) : '' ?>"
+                   value="<?php echo esc_attr( ! empty( $api_key ) ? wp_unslash( $api_key ) : '' ); ?>"
             />
         </div>
@@ -48 +53 @@
               name="wc_settings_tab_shipday_enable_pickup"
               class="shipday-switch__input"
-              <?php echo ($pickup_order_enabled) ? "checked" : "" ?>
+              <?php checked( $pickup_order_enabled ); ?>
           />
           <span class="shipday-switch__track">
@@ -73 +78 @@
               name="wc_settings_tab_shipday_sync"
               class="shipday-switch__input"
-              <?php echo ($order_sync_enabled) ? "checked" : "" ?>
+              <?php checked( $order_sync_enabled ); ?>
           />
           <span class="shipday-switch__track">
@@ -115 +120 @@
                     name="wc_settings_tab_shipday_order_manage"
                     value="admin_manage"
-                    <?php echo ($manage_order === 'admin_manage') ? 'checked' : ''; ?>
+                    <?php checked( $manage_order, 'admin_manage' ); ?>
                 />
                 <span class="sd-radio__mark" aria-hidden="true"></span>
@@ -127 +132 @@
                     name="wc_settings_tab_shipday_order_manage"
                     value="vendor_manage"
-                    <?php echo ($manage_order === 'vendor_manage') ? 'checked' : ''; ?>
+                    <?php checked( $manage_order, 'vendor_manage' ); ?>
                 />
                 <span class="sd-radio__mark" aria-hidden="true"></span>

shipday-for-woocommerce/trunk/date-modifiers/Coderocks_Woo_Delivery.php

@@ -1 +1 @@
 <?php
+
+if ( ! defined( 'ABSPATH' ) ) {
+    exit;
+}
+// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound -- Compatibility class mirrors the third-party integration name.
 require_once dirname( __FILE__ ) . '/Date_Picker_Object.php';
 

shipday-for-woocommerce/trunk/date-modifiers/Date_Picker_Object.php

@@ -1 +1 @@
 <?php
+
+if ( ! defined( 'ABSPATH' ) ) {
+    exit;
+}
+// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound -- Compatibility class mirrors the third-party integration name.
 
 class Date_Picker_Object {

shipday-for-woocommerce/trunk/date-modifiers/Delivery_Area_Pro.php

@@ -1 +1 @@
 <?php
+
+if ( ! defined( 'ABSPATH' ) ) {
+    exit;
+}
+// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound -- Compatibility class mirrors the third-party integration name.
 
 require_once dirname( __FILE__ ) . '/Date_Picker_Object.php';

shipday-for-woocommerce/trunk/date-modifiers/Order_Delivery_Date_Shipday.php

@@ -1 +1 @@
 <?php
+
+if ( ! defined( 'ABSPATH' ) ) {
+    exit;
+}
+// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound -- Compatibility class mirrors the third-party integration name.
 require_once dirname( __FILE__ ) . '/Date_Picker_Object.php';
 

shipday-for-woocommerce/trunk/date-modifiers/order_delivery_date.php

@@ -1 +1 @@
 <?php
+
+if ( ! defined( 'ABSPATH' ) ) {
+    exit;
+}
+// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedFunctionFound -- Compatibility helpers keep their legacy public names.
 
 require_once dirname( __DIR__ ) . '/functions/common.php';

shipday-for-woocommerce/trunk/dispatch_post/payload_post.php

@@ -1 +1 @@
 <?php
+
+if ( ! defined( 'ABSPATH' ) ) {
+    exit;
+}
+// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound,WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedFunctionFound -- Legacy payload helpers are used across the plugin codebase.
 require_once dirname(__DIR__). '/functions/logger.php';
 require_once dirname(__DIR__). '/functions/common.php';
@@ -11 +16 @@
 {
     global $single_vendor_webhook_url;
-    $response = shipday_curl_post_payload($payload, $single_vendor_webhook_url);
+    $response = shipday_http_post_payload($payload, $single_vendor_webhook_url);
     if ($response['http_code'] != 200) {
-        shipday_logger('error', 'Curl(single-vendor) failed with code: '.$response['http_code'].' Response: '.json_encode($response));
-        $response = streams_post_payload($payload, $single_vendor_webhook_url);
-    }
-    if ($response['http_code'] != 200) {
-        shipday_logger('error', 'Stream(single-vendor) failed with code: '.$response['http_code'].' Response: '.json_encode($response));
+        shipday_logger('error', 'HTTP API(single-vendor) failed with code: '.$response['http_code'].' Response: '.json_encode($response));
     }
     return $response;
@@ -25 +26 @@
 {
     global $multi_vendor_webhook_url;
-    $response = shipday_curl_post_payload($payload, $multi_vendor_webhook_url);
+    $response = shipday_http_post_payload($payload, $multi_vendor_webhook_url);
     if ($response['http_code'] != 200) {
-        shipday_logger('error', 'Curl(multi-vendor) failed with code: '.$response['http_code'].' Response: '.json_encode($response));
-        $response = streams_post_payload($payload, $multi_vendor_webhook_url);
-    }
-    if ($response['http_code'] != 200) {
-        shipday_logger('error', 'Stream(multi-vendor) failed with code: '.$response['http_code'].' Response: '.json_encode($response));
+        shipday_logger('error', 'HTTP API(multi-vendor) failed with code: '.$response['http_code'].' Response: '.json_encode($response));
     }
     return $response;
@@ -39 +36 @@
 {
     global $cancel_webhook_url;
-    $response = shipday_curl_post_payload($payload, $cancel_webhook_url);
+    $response = shipday_http_post_payload($payload, $cancel_webhook_url);
     if ($response['http_code'] != 200) {
-        shipday_logger('error', 'Curl(cancel-order) failed with code: '.$response['http_code'].' Response: '.json_encode($response));
-        $response = streams_post_payload($payload, $cancel_webhook_url);
-    }
-    if ($response['http_code'] != 200) {
-        shipday_logger('error', 'Stream(cancel-order) failed with code: '.$response['http_code'].' Response: '.json_encode($response));
+        shipday_logger('error', 'HTTP API(cancel-order) failed with code: '.$response['http_code'].' Response: '.json_encode($response));
     }
     return $response;
 }
 
-function streams_post_payload(array $payload, $url) {
-    $opts = array(
-        'http' => array(
-            'method' => 'POST',
-            'header' => array(
-                'Content-Type: application/json'
+function shipday_http_post_payload(array $payload, $url) {
+    return shipday_remote_post(
+        $url,
+        array(
+            'headers' => array(
+                'Content-Type' => 'application/json',
             ),
-            'content' => json_encode($payload)
+            'body'    => remove_emoji( wp_json_encode( $payload ) ),
         )
     );
-    $context = stream_context_create($opts);
-    file_get_contents($url, false, $context);
-    return $http_response_header;
 }
-
-function shipday_curl_post_payload(array $payload, $url) {
-    $curl = curl_init();
-    curl_setopt_array(
-        $curl,
-        array(
-            CURLOPT_URL            => $url,
-            CURLOPT_RETURNTRANSFER => true,
-            CURLOPT_ENCODING       => '',
-            CURLOPT_MAXREDIRS      => 10,
-            CURLOPT_TIMEOUT        => 0,
-            CURLOPT_FOLLOWLOCATION => true,
-            CURLOPT_HTTP_VERSION   => CURL_HTTP_VERSION_1_1,
-            CURLOPT_CUSTOMREQUEST  => 'POST',
-            CURLOPT_POSTFIELDS     => remove_emoji(json_encode($payload)),
-            CURLOPT_HTTPHEADER     => array(
-                'Content-Type: application/json'
-            )
-        )
-    );
-    $response = curl_exec($curl);
-    return curl_getinfo($curl);
-}

shipday-for-woocommerce/trunk/dispatch_post/post_fun.php

@@ -1 +1 @@
 <?php
+
+if ( ! defined( 'ABSPATH' ) ) {
+    exit;
+}
 require_once dirname(__DIR__). '/functions/logger.php';
 require_once dirname(__DIR__). '/functions/common.php';
@@ -55 +59 @@
 function shipday_post_order(array $payload, string $api_key, $url) {
     if (strlen($api_key) < 3) return false;
-    $response = shipday_curl_post_order($payload, $api_key, $url);
+    $response = shipday_http_post_order($payload, $api_key, $url);
     if ($response['http_code'] != 200) {
-        shipday_logger('error', 'Curl failed with code: '.$response['http_code'].' Response: '.json_encode($response));
-        shipday_logger('info', 'Trying with stream post order');
-        $response = streams_post_order($payload, $api_key, $url);
-    }
-    if ($response['http_code'] != 200) {
-        shipday_logger('error', 'Stream failed with code: '.$response['http_code'].' Response: '.json_encode($response));
+        shipday_logger('error', 'HTTP API request failed with code: '.$response['http_code'].' Response: '.json_encode($response));
     }
     return $response;
 }
 
-function streams_post_order(array $payload, string $api_key, $url) {
-    $opts = array(
-        'http' => array(
-            'method' => 'POST',
-            'header' => array(
-                'Content-Type: application/json',
-                'Authorization: Basic '.$api_key,
+function shipday_http_post_order(array $payload, string $api_key, $url) {
+    return shipday_remote_post(
+        $url,
+        array(
+            'headers' => array(
+                'Authorization' => 'Basic ' . $api_key,
+                'Content-Type'  => 'application/json',
             ),
-            'content' => json_encode($payload)
+            'body'    => remove_emoji( wp_json_encode( $payload ) ),
         )
     );
-    $context = stream_context_create($opts);
-    file_get_contents($url, false, $context);
-    return $http_response_header;
 }
-
-function shipday_curl_post_order(array $payload, string $api_key, $url) {
-    $curl = curl_init();
-    curl_setopt_array(
-        $curl,
-        array(
-            CURLOPT_URL            => $url,
-            CURLOPT_RETURNTRANSFER => true,
-            CURLOPT_ENCODING       => '',
-            CURLOPT_MAXREDIRS      => 10,
-            CURLOPT_TIMEOUT        => 0,
-            CURLOPT_FOLLOWLOCATION => true,
-            CURLOPT_HTTP_VERSION   => CURL_HTTP_VERSION_1_1,
-            CURLOPT_CUSTOMREQUEST  => 'POST',
-            CURLOPT_POSTFIELDS     => remove_emoji(json_encode($payload)),
-            CURLOPT_HTTPHEADER     => array(
-                'Authorization: Basic '.$api_key,
-                'Content-Type: application/json'
-            )
-        )
-    );
-    $response = curl_exec($curl);
-    return curl_getinfo($curl);
-}

shipday-for-woocommerce/trunk/functions/common.php

@@ -1 +1 @@
 <?php
+
+if ( ! defined( 'ABSPATH' ) ) {
+    exit;
+}
+// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound,WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedFunctionFound -- Legacy helper API is used across the plugin codebase.
 
 /** Global Variables */
@@ -89 +94 @@
 }
 
+function shipday_remote_post( $url, array $args = array() ) {
+    $request_args = wp_parse_args(
+        $args,
+        array(
+            'method'      => 'POST',
+            'timeout'     => 20,
+            'redirection' => 5,
+            'httpversion' => '1.1',
+            'blocking'    => true,
+        )
+    );
+
+    $response = wp_safe_remote_post( esc_url_raw( $url ), $request_args );
+
+    if ( is_wp_error( $response ) ) {
+        return array(
+            'http_code' => 0,
+            'body'      => $response->get_error_message(),
+            'error'     => $response->get_error_code(),
+        );
+    }
+
+    return array(
+        'http_code' => (int) wp_remote_retrieve_response_code( $response ),
+        'body'      => wp_remote_retrieve_body( $response ),
+        'headers'   => wp_remote_retrieve_headers( $response ),
+    );
+}
+
 ?>

shipday-for-woocommerce/trunk/functions/logger.php

@@ -1 +1 @@
 <?php
+
+if ( ! defined( 'ABSPATH' ) ) {
+    exit;
+}
 /** Debug Functions */
 function shipday_logger(string $level, string $message) {

shipday-for-woocommerce/trunk/order_data/Dokan_Order_Shipday.php

@@ -1 +1 @@
 <?php
+
+if ( ! defined( 'ABSPATH' ) ) {
+    exit;
+}
 require_once dirname( __DIR__ ) . '/functions/common.php';
 require_once dirname( __DIR__ ) . '/date-modifiers/order_delivery_date.php';

shipday-for-woocommerce/trunk/order_data/FoodStore_Order_Shipday.php

@@ -1 +1 @@
 <?php
+
+if ( ! defined( 'ABSPATH' ) ) {
+    exit;
+}
 require_once dirname( __DIR__ ) . '/functions/common.php';
 require_once dirname(__DIR__). '/date-modifiers/order_delivery_date.php';
 require_once dirname( __FILE__ ) . '/Woo_Order_Shipday.php';
 
+// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound -- Legacy class name retained for backwards compatibility.
 class FoodStore_Order_Shipday extends Woo_Order_Shipday
 {

shipday-for-woocommerce/trunk/order_data/WCFM_Order_Shipday.php

@@ -1 +1 @@
 <?php
+
+if ( ! defined( 'ABSPATH' ) ) {
+    exit;
+}
 
 require_once dirname( __DIR__ ) . '/functions/common.php';
@@ -6 +10 @@
 require_once dirname(__DIR__). '/date-modifiers/order_delivery_date.php';
 
+// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound -- Legacy class name retained for backwards compatibility.
 class WCFM_Order_Shipday extends Woocommerce_Core_Shipday {
     protected $order;
@@ -253 +258 @@
         } elseif (isset($times['expectedPickupDate'])) {
             $result['expectedPickupDate'] = $times['expectedPickupDate'];
-        } else {
-            // Default to today if no date specified
-            $result['expectedPickupDate'] = date('Y-m-d');
-        }
-        
-        // If no time specified, set a default
-        if (!isset($result['expectedPickupTime'])) {
-            $result['expectedPickupTime'] = date('H:i:s', strtotime('+1 hour'));
-        }
+            } else {
+                // Default to today if no date specified
+                $result['expectedPickupDate'] = wp_date( 'Y-m-d' );
+            }
+            
+            // If no time specified, set a default
+            if (!isset($result['expectedPickupTime'])) {
+                $result['expectedPickupTime'] = wp_date( 'H:i:s', time() + HOUR_IN_SECONDS );
+            }
         
         return $result;

shipday-for-woocommerce/trunk/order_data/Woo_Order_Shipday.php

@@ -1 +1 @@
 <?php
+
+if ( ! defined( 'ABSPATH' ) ) {
+    exit;
+}
 require_once dirname( __DIR__ ) . '/functions/common.php';
 require_once dirname(__DIR__). '/date-modifiers/order_delivery_date.php';
 require_once dirname( __FILE__ ) . '/Woocommerce_Core_Shipday.php';
 
-
+// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound -- Legacy class name retained for backwards compatibility.
 class Woo_Order_Shipday extends Woocommerce_Core_Shipday {
     protected $order;
@@ -200 +204 @@
         } elseif (isset($times['expectedPickupDate'])) {
             $result['expectedPickupDate'] = $times['expectedPickupDate'];
-        } else {
-            // Default to today if no date specified
-            $result['expectedPickupDate'] = date('Y-m-d');
-        }
-        
-        // If no time specified, set a default
-        if (!isset($result['expectedPickupTime'])) {
-            $result['expectedPickupTime'] = date('H:i:s', strtotime('+1 hour'));
-        }
+            } else {
+                // Default to today if no date specified
+                $result['expectedPickupDate'] = wp_date( 'Y-m-d' );
+            }
+            
+            // If no time specified, set a default
+            if (!isset($result['expectedPickupTime'])) {
+                $result['expectedPickupTime'] = wp_date( 'H:i:s', time() + HOUR_IN_SECONDS );
+            }
         
         return $result;

shipday-for-woocommerce/trunk/order_data/Woocommerce_Core_Shipday.php

@@ -1 +1 @@
 <?php
+
+if ( ! defined( 'ABSPATH' ) ) {
+    exit;
+}
 require_once dirname( __DIR__ ) . '/functions/common.php';
 
+// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound -- Legacy class name retained for backwards compatibility.
 class Woocommerce_Core_Shipday {
     protected $order;

shipday-for-woocommerce/trunk/payload/Core_Payload.php

@@ -1 +1 @@
 <?php
+
+if ( ! defined( 'ABSPATH' ) ) {
+    exit;
+}
 
 require_once dirname(__DIR__) . '/functions/common.php';
 
+// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound -- Legacy class name retained for backwards compatibility.
 class _CorePayload
 {

shipday-for-woocommerce/trunk/payload/Dokan_Payload.php

@@ -1 +1 @@
 <?php
+
+if ( ! defined( 'ABSPATH' ) ) {
+    exit;
+}
 
 require_once dirname(__DIR__) . '/functions/common.php';

shipday-for-woocommerce/trunk/payload/FoodStore_Payload.php

@@ -1 +1 @@
 <?php
+
+if ( ! defined( 'ABSPATH' ) ) {
+    exit;
+}
 
 require_once dirname(__DIR__) . '/functions/common.php';
@@ -5 +9 @@
 require_once dirname(__FILE__) . '/Core_Payload.php';
 
-
+// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound -- Legacy class name retained for backwards compatibility.
 class FoodStore_Payload extends _CorePayload
 {

shipday-for-woocommerce/trunk/payload/WCFM_Payload.php

@@ -1 +1 @@
 <?php
+
+if ( ! defined( 'ABSPATH' ) ) {
+    exit;
+}
 
 require_once dirname(__DIR__) . '/functions/common.php';
@@ -5 +9 @@
 require_once dirname(__FILE__) . '/Core_Payload.php';
 
-
+// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound -- Legacy class name retained for backwards compatibility.
 class WCFM_Payload extends _CorePayload
 {

shipday-for-woocommerce/trunk/payload/Woo_Payload.php

@@ -1 +1 @@
 <?php
+
+if ( ! defined( 'ABSPATH' ) ) {
+    exit;
+}
 
 require_once dirname(__DIR__) . '/functions/common.php';
@@ -5 +9 @@
 require_once dirname(__FILE__) . '/Core_Payload.php';
 
-
+// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound -- Legacy class name retained for backwards compatibility.
 class Woo_Payload extends _CorePayload
 {

shipday-for-woocommerce/trunk/readme.txt

@@ -1 @@
-=== Local Delivery App for WordPress (WooCommerce) by Shipday ===
-Contributors: shipdayinc, shhrrtnvr
-Tags: delivery tracking, route-planning, delivery/pickup datetime, delivery dispatch, same day delivery, local pickup, local delivery,  driver app
+=== Shipday Local Delivery for WooCommerce ===
+Contributors: shipdayinc, shhrrtnvr, shammo, hadi
+Tags: local delivery, delivery tracking, woocommerce delivery, same day delivery, driver app
 Requires at least: 5.8
-Tested up to: 6.8
+Tested up to: 6.9
 WC requires at least: 7.0.0
 WC tested up to: 9.8.2
 Requires PHP: 7.4
-Stable tag: 2.2.0
+Stable tag: 2.3.0
 License: GPLv2 or later
+
+Shipday adds local delivery and pickup workflows, dispatch sync, and checkout date/time selection to WooCommerce.
 
 == Description ==
@@ -116 +118 @@
 * Datetime support in the order checkout
 * New admin configuration page
-
-

shipday-for-woocommerce/trunk/rest_api/WooCommerce_REST_API.php

@@ -1 +1 @@
 <?php
+
+if ( ! defined( 'ABSPATH' ) ) {
+    exit;
+}
 
 require_once dirname(__DIR__). '/functions/common.php';
 
+// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound -- Legacy class name retained for backwards compatibility.
 class WooCommerce_REST_API {
 
@@ -11 +16 @@
     public static function is_consumer_secret_valid($consumer_secret) {
         global $wpdb;
+        $cache_key = 'shipday_rest_api_secret_' . md5( $consumer_secret );
+        $rest_api_key = wp_cache_get( $cache_key, 'shipday' );
+        if ( false !== $rest_api_key ) {
+            return ! is_null( $rest_api_key );
+        }
+        // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- WooCommerce stores API keys in a custom table; result is cached immediately below.
         $rest_api_key = $wpdb->get_row(
             $wpdb->prepare(
@@ -23 +34 @@
             ARRAY_A
         );
+        wp_cache_set( $cache_key, $rest_api_key, 'shipday', MINUTE_IN_SECONDS * 5 );
         return !is_null($rest_api_key);
     }
@@ -36 +48 @@
     public static function is_consumer_keys_valid($consumer_key, $consumer_secret) {
         global $wpdb;
-        $rest_api_key = $wpdb->get_row(
-            $wpdb->prepare(
-                "
+        $cache_key = 'shipday_rest_api_keys_' . md5( $consumer_secret );
+        $rest_api_key = wp_cache_get( $cache_key, 'shipday' );
+        if ( false === $rest_api_key ) {
+            // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- WooCommerce stores API keys in a custom table; result is cached immediately below.
+            $rest_api_key = $wpdb->get_row(
+                $wpdb->prepare(
+                    "
                     SELECT consumer_key, consumer_secret, truncated_key, permissions
                     FROM {$wpdb->prefix}woocommerce_api_keys
@@ -44 +60 @@
                       and permissions = 'read_write'
                 ",
-                $consumer_secret
-            ),
-            ARRAY_A
-        );
+                    $consumer_secret
+                ),
+                ARRAY_A
+            );
+            wp_cache_set( $cache_key, $rest_api_key, 'shipday', MINUTE_IN_SECONDS * 5 );
+        }
         return !is_null($rest_api_key) && self::str_ends_with($consumer_key, $rest_api_key['truncated_key']);
     }
@@ -80 +98 @@
         $url              = get_rest_url();
 
-        $curl             = curl_init();
-        curl_setopt_array(
-            $curl,
+        $response = shipday_remote_post(
+            get_shipday_rest_key_install_url(),
             array(
-                CURLOPT_URL            => get_shipday_rest_key_install_url(),
-                CURLOPT_RETURNTRANSFER => true,
-                CURLOPT_ENCODING       => '',
-                CURLOPT_MAXREDIRS      => 10,
-                CURLOPT_TIMEOUT        => 0,
-                CURLOPT_FOLLOWLOCATION => true,
-                CURLOPT_HTTP_VERSION   => CURL_HTTP_VERSION_1_1,
-                CURLOPT_CUSTOMREQUEST  => 'POST',
-                CURLOPT_POSTFIELDS     => '{
-                        "url": "' . $url . '",
-                        "consumer_key": "' . $key . '",
-                        "consumer_secret": "' . $secret . '"
-                        }',
-                CURLOPT_HTTPHEADER     => array(
-                    'Authorization: Basic '. get_shipday_api_key(),
-                    'Content-Type: application/json',
+                'headers' => array(
+                    'Authorization' => 'Basic ' . get_shipday_api_key(),
+                    'Content-Type'  => 'application/json',
+                ),
+                'body'    => wp_json_encode(
+                    array(
+                        'url'             => $url,
+                        'consumer_key'    => $key,
+                        'consumer_secret' => $secret,
+                    )
                 ),
             )
         );
 
-        $response        = curl_exec($curl);
-        if (is_null($response)) return null;
-        $response_decoded = json_decode($response);
+        if ( empty( $response['body'] ) ) {
+            return null;
+        }
+
+        $response_decoded = json_decode( $response['body'] );
         if (!isset($response_decoded->success)) return null;
         $uuid            = $response_decoded->uuid;

shipday-for-woocommerce/trunk/shipday-datetime/block-checkout/Shipday_Woo_DateTime_Util.php

@@ -1 +1 @@
 <?php
+
+if ( ! defined( 'ABSPATH' ) ) {
+    exit;
+}
 
 
@@ -30 +34 @@
 
         // Other settings
-        $data['delivery_heading_checkout'] = get_option('shipday_delivery_pickup_label', __("Delivery/Pickup info", "shipday-woo-delivery"));
+        $data['delivery_heading_checkout'] = get_option('shipday_delivery_pickup_label', __("Delivery/Pickup info", "shipday-for-woocommerce"));
         $data['enable_delivery_option'] = get_option('shipday_enable_delivery_option', "no") === "yes";
-        $data['delivery_option_field_label'] = __("Order Option", "shipday-woo-delivery");
-        $data['delivery_options'] = ["Delivery" => __("Delivery", "shipday-woo-delivery"), "Pickup" => __("Pickup", "shipday-woo-delivery")];
+        $data['delivery_option_field_label'] = __("Order Option", "shipday-for-woocommerce");
+        $data['delivery_options'] = ["Delivery" => __("Delivery", "shipday-for-woocommerce"), "Pickup" => __("Pickup", "shipday-for-woocommerce")];
 
         // Delivery dates
@@ -39 +43 @@
         $data['delivery_date_selectable_days'] = get_option('shipday_selectable_delivery_days', 30);
         $data['delivery_disable_week_days'] = self::get_disable_week_days(get_option('shipday_avaialble_delivery_days', self::WEEK_DAYS));
-        $data['delivery_date_field_label'] = __("Delivery Date", "shipday-woo-delivery");
+        $data['delivery_date_field_label'] = __("Delivery Date", "shipday-for-woocommerce");
         $data['auto_select_first_date'] = true;
         $data['delivery_date_mandatory'] = get_option('shipday_delivery_date_mandatory', "no") === "yes";
@@ -47 +51 @@
         // Delivery times
         $data['enable_delivery_time'] = get_option('shipday_enable_delivery_time', "no") === "yes";
-        $data['delivery_time_field_label'] = __("Delivery Time", "shipday-woo-delivery");
+        $data['delivery_time_field_label'] = __("Delivery Time", "shipday-for-woocommerce");
         $data['delivery_time_mandatory'] = get_option('shipday_delivery_time_mandatory', "no") === "yes";;
         $data['auto_select_first_time'] = false;
@@ -60 +64 @@
         $data['pickup_date_selectable_days'] = get_option('shipday_selectable_pickup_days', 15);
         $data['pickup_disable_week_days'] = self::get_disable_week_days(get_option('shipday_avaialble_pickup_days', self::WEEK_DAYS));
-        $data['pickup_date_field_label'] = __("Pickup Date", "shipday-woo-delivery");
+        $data['pickup_date_field_label'] = __("Pickup Date", "shipday-for-woocommerce");
         $data['pickup_auto_select_first_date'] = true;
         $data['pickup_date_mandatory'] = get_option('shipday_pickup_date_mandatory', "no") === "yes";;
@@ -69 +73 @@
         // Pickup times
         $data['enable_pickup_time'] = get_option('shipday_enable_pickup_time', "no") === "yes";
-        $data['pickup_time_field_label'] = __("Pickup Time", "shipday-woo-delivery");
+        $data['pickup_time_field_label'] = __("Pickup Time", "shipday-for-woocommerce");
         $data['pickup_time_mandatory'] = get_option('shipday_pickup_time_mandatory', "no") === "yes";
         $data['pickup_auto_select_first_time'] = false;
@@ -87 +91 @@
 
         // Localization
-        $data['checkout_delivery_option_notice'] = __("Please select order type", "shipday-woo-delivery");
-        $data['checkout_date_notice'] = __("Please enter delivery date", "shipday-woo-delivery");
-        $data['checkout_pickup_date_notice'] = __("Please enter pickup date", "shipday-woo-delivery");
-        $data['checkout_time_notice'] = __("Please select delivery time", "shipday-woo-delivery");
-        $data['checkout_pickup_time_notice'] = __("Please select pickup time", "shipday-woo-delivery");
-        $data['select_order_type_text'] = __("Select order type", "shipday-woo-delivery");
-        $data['select_delivery_time_text'] = __("Select delivery time", "shipday-woo-delivery");
-        $data['select_pickup_time_text'] = __("Select pickup time", "shipday-woo-delivery");
+        $data['checkout_delivery_option_notice'] = __("Please select order type", "shipday-for-woocommerce");
+        $data['checkout_date_notice'] = __("Please enter delivery date", "shipday-for-woocommerce");
+        $data['checkout_pickup_date_notice'] = __("Please enter pickup date", "shipday-for-woocommerce");
+        $data['checkout_time_notice'] = __("Please select delivery time", "shipday-for-woocommerce");
+        $data['checkout_pickup_time_notice'] = __("Please select pickup time", "shipday-for-woocommerce");
+        $data['select_order_type_text'] = __("Select order type", "shipday-for-woocommerce");
+        $data['select_delivery_time_text'] = __("Select delivery time", "shipday-for-woocommerce");
+        $data['select_pickup_time_text'] = __("Select pickup time", "shipday-for-woocommerce");
 
         return $data;

shipday-for-woocommerce/trunk/shipday-datetime/block-checkout/Shipday_Woo_Delivery_Block.php

@@ -1 +1 @@
 <?php
+
+if ( ! defined( 'ABSPATH' ) ) {
+    exit;
+}
 
 use Automattic\WooCommerce\StoreApi\Schemas\V1\CartSchema;
@@ -7 +11 @@
     protected static $instance = null;
     static $IDENTIFIER = 'shipday_woo_delivery';
+    static $BLOCK_NAME = 'shipday-for-woocommerce/delivery-block';
 
     private function __clone() {}
@@ -38 +43 @@
 
     function register_woo_delivery_block() {
-        register_block_type( 'shipday-woo-delivery/delivery-block' );
+        register_block_type( self::$BLOCK_NAME );
     }
 
@@ -98 +103 @@
             'shipday_order_type'    => array(
                 'type'        => ['string', 'null'],
-                'description' => __( 'Type of order', 'shipday-delivery' ),
+                'description' => __( 'Type of order', 'shipday-for-woocommerce' ),
                 'enum'        => array_merge( array_keys( $settings['delivery_options'] ), ["", null] ),
             ),
             'shipday_delivery_date' => array(
                 'type'        => ['string', 'null'],
-                'description' => __( 'Delivery Date', 'shipday-delivery' ),
+                'description' => __( 'Delivery Date', 'shipday-for-woocommerce' ),
             ),
             'shipday_delivery_time' => array(
                 'type'        => ['string', 'null'],
-                'description' => __( 'Delivery Time', 'shipday-delivery' ),
+                'description' => __( 'Delivery Time', 'shipday-for-woocommerce' ),
             ),
             'shipday_pickup_date' => array(
                 'type'        => ['string', 'null'],
-                'description' => __( 'Pickup Date', 'shipday-delivery' ),
+                'description' => __( 'Pickup Date', 'shipday-for-woocommerce' ),
             ),
             'pickup_time' => array(
                 'type'        => ['string', 'null'],
-                'description' => __( 'Pickup Time', 'shipday-delivery' ),
+                'description' => __( 'Pickup Time', 'shipday-for-woocommerce' ),
             ),
         );

shipday-for-woocommerce/trunk/shipday-datetime/block-checkout/Shipday_Woo_Delivery_Block_Integration.php

@@ -1 +1 @@
 <?php
+
+if ( ! defined( 'ABSPATH' ) ) {
+    exit;
+}
 
 use Automattic\WooCommerce\Blocks\Integrations\IntegrationInterface;
@@ -65 +69 @@
         wp_register_script( $this->get_name(), plugin_dir_url( __FILE__ ) . 'assets/js/frontend.js', array( 'wp-plugins', 'wp-element', 'wp-components', 'wp-hooks', 'wp-i18n', 'wc-blocks-checkout', 'flatpickr_js' ), "2.0.1", true );
 
-        wp_enqueue_style( $this->get_name(), plugin_dir_url( __FILE__ ) . 'assets/css/frontend.css', "2.1.4" );
+        wp_enqueue_style( $this->get_name(), plugin_dir_url( __FILE__ ) . 'assets/css/frontend.css', array(), "2.1.4" );
     }
 

shipday-for-woocommerce/trunk/shipday-datetime/block-checkout/Shipday_Woo_Delivery_Block_Storage.php

@@ -1 +1 @@
 <?php
+
+if ( ! defined( 'ABSPATH' ) ) {
+    exit;
+}
 
 class Shipday_Woo_Delivery_Block_Storage {
@@ -36 +40 @@
         if ( $errors->has_errors() ) {
             $error_messages = $errors->get_error_messages();
-            $combined_error_message = implode( "<br>", $error_messages );
-            throw new \WC_Data_Exception( 'SHIPDAY_WOO_ERROR', $combined_error_message );
+            throw new \WC_Data_Exception(
+                'SHIPDAY_WOO_ERROR',
+                esc_html( implode( ' ', array_map( 'sanitize_text_field', $error_messages ) ) )
+            );
         }
 

shipday-for-woocommerce/trunk/shipday-datetime/block-checkout/assets/js/frontend.js

@@ -50 +50 @@
   const validateField = (value, fieldType) => {
     let errorKey = "shipday_woo_" + fieldType + "_error";
-    let errorMessage =  __('This field is mandatory', 'shipday-woo-delivery' );
+    let errorMessage =  __('This field is mandatory', 'shipday-for-woocommerce' );
     let isRequired = false;
 
     // Determine error message and required status based on field type
     if (fieldType === "shipday_order_type") {
-      errorMessage = __( 'Order type is required', 'shipday-woo-delivery' );
+      errorMessage = __( 'Order type is required', 'shipday-for-woocommerce' );
       isRequired = shipdaySettings.enable_delivery_option;
       errorKey = "shipday_woo_order_type_error";
     } else if (fieldType === "shipday_delivery_date") {
-      errorMessage = __( 'Delivery date is required', 'shipday-woo-delivery' );
+      errorMessage = __( 'Delivery date is required', 'shipday-for-woocommerce' );
       errorKey = "shipday_woo_delivery_date_error";
       isRequired = shipdaySettings.enable_delivery_date && shipdaySettings.delivery_date_mandatory;
     } else if (fieldType === "shipday_delivery_time") {
-      errorMessage =  __('Delivery time is mandatory', 'shipday-woo-delivery' );
+      errorMessage =  __('Delivery time is mandatory', 'shipday-for-woocommerce' );
       errorKey = "shipday_woo_delivery_time_error";
       isRequired = shipdaySettings.enable_delivery_time && shipdaySettings.delivery_time_mandatory;
     } else if (fieldType === "shipday_pickup_date") {
-      errorMessage = __('Pickup date is mandatory', 'shipday-woo-delivery' );
+      errorMessage = __('Pickup date is mandatory', 'shipday-for-woocommerce' );
       isRequired = shipdaySettings.enable_pickup_date && shipdaySettings.pickup_date_mandatory;
     }else if (fieldType === "pickup_time") {
-      errorMessage = __('Pickup time is mandatory', 'shipday-woo-delivery' );
+      errorMessage = __('Pickup time is mandatory', 'shipday-for-woocommerce' );
       isRequired = shipdaySettings.enable_pickup_time && shipdaySettings.pickup_time_mandatory;
     }
@@ -682 +682 @@
         });
 
-        let fieldLabel = __('Pickup time', 'shipday-woo-delivery');
+        let fieldLabel = __('Pickup time', 'shipday-for-woocommerce');
 
         // Generate options for the select dropdown
@@ -726 +726 @@
                 React.createElement("option", {
                   value: ""
-                }, __('Select pickup slot', 'shipday-woo-delivery')),
+                }, __('Select pickup slot', 'shipday-for-woocommerce')),
 
                 // Time options
@@ -891 +891 @@
   shipday_woo_delivery_metadata = {
     apiVersion: 3,
-    name: "shipday-woo-delivery",
+    name: "shipday-for-woocommerce/delivery-block",
     title: "Shipday Woocommerce",
     category: "woocommerce",

shipday-for-woocommerce/trunk/shipday-datetime/classic-checkout/Classic_Datetime.php

@@ -1 +1 @@
 <?php
+
+if ( ! defined( 'ABSPATH' ) ) {
+    exit;
+}
 /**
  * Plugin Name: Shipday Datetime
@@ -11 +15 @@
 require_once dirname(__FILE__) . '../../block-checkout/Shipday_Woo_DateTime_Util.php';
 
+// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound -- Legacy class name retained for backwards compatibility.
 class Classic_Datetime {
 
@@ -55 +60 @@
         // Delivery dates
         $enable_delivery_date = get_option('shipday_enable_delivery_date', "no") === "yes";
-        $delivery_date_field_label =  __('Delivery Date', 'shipday-woo-delivery' );
+        $delivery_date_field_label =  __('Delivery Date', 'shipday-for-woocommerce' );
         $delivery_date_mandatory = get_option('shipday_delivery_date_mandatory', "no") === "yes";
         $delivery_date_selectable_days = get_option('shipday_selectable_delivery_days', 30);
@@ -64 +69 @@
         // Pickup dates
         $enable_pickup_date = get_option('shipday_enable_pickup_date', "no") === "yes";
-        $pickup_date_field_label =  __('Pickup Date', 'shipday-woo-delivery' );
+        $pickup_date_field_label =  __('Pickup Date', 'shipday-for-woocommerce' );
         $pickup_date_mandatory = get_option('shipday_pickup_date_mandatory', "no") === "yes";
 
@@ -71 +76 @@
         $pickup_auto_select_first_date = true;
 
-        echo "<div data-today_date='" . $today . "'  id='shipday_woo_delivery_setting_wrapper'>";
-
-        $order_type_label = get_option('shipday_delivery_pickup_label', __('Delivery/Pickup info', 'shipday-woo-delivery'));
+        echo '<div data-today_date="' . esc_attr( $today ) . '" id="shipday_woo_delivery_setting_wrapper">';
+
+        $order_type_label = get_option('shipday_delivery_pickup_label', __('Delivery/Pickup info', 'shipday-for-woocommerce'));
 
         // delivery options
@@ -85 +90 @@
                     ],
                     'label'       => $order_type_label,
-                    'placeholder' => __('Choose Option', 'shipday-woo-delivery'),
+                    'placeholder' => __('Choose Option', 'shipday-for-woocommerce'),
                     'options'     => Classic_Datetime::getDeliveryoptions(),
                     'required'    => true,
@@ -103 +108 @@
                     'id' => "shipday_delivery_date_datepicker",
                     'label' => $delivery_date_field_label,
-                    'placeholder' => __('Choose Date', 'shipday-woo-delivery'),
+                    'placeholder' => __('Choose Date', 'shipday-for-woocommerce'),
                     'required' => $delivery_date_mandatory,
                     'custom_attributes' => [
@@ -118 +123 @@
         // Delivery Time --------------------------------------------------------------
         $enable_delivery_time = get_option('shipday_enable_delivery_time', "no") === "yes";
-        $delivery_time_field_label = __('Delivery Time', 'shipday-woo-delivery');
+        $delivery_time_field_label = __('Delivery Time', 'shipday-for-woocommerce');
         $delivery_time_mandatory = get_option('shipday_delivery_time_mandatory', "no") === "yes";
         $auto_select_first_time = false;
@@ -172 +177 @@
         // Pickup Time --------------------------------------------------------------
         $enable_pickup_time =  get_option('shipday_enable_pickup_time', "no") === "yes";
-        $pickup_time_field_label = __('Pickup time', 'shipday-woo-delivery');
+        $pickup_time_field_label = __('Pickup time', 'shipday-for-woocommerce');
         $pickup_time_mandatory = get_option('shipday_pickup_time_mandatory', "no") === "yes";
         $start_pickup_slot = get_option('shipday_pickup_time_slot_start', Shipday_Woo_DateTime_Util::DEFAULT_START_SLOT);
@@ -204 +209 @@
     }
 
+    private static function has_valid_checkout_nonce() {
+        // phpcs:ignore WordPress.Security.NonceVerification.Missing -- This helper performs the checkout nonce validation itself.
+        if ( ! isset( $_POST['woocommerce-process-checkout-nonce'] ) ) {
+            return false;
+        }
+
+        // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Nonce is being verified in this helper.
+        $nonce = sanitize_text_field( wp_unslash( $_POST['woocommerce-process-checkout-nonce'] ) );
+
+        return (bool) wp_verify_nonce( $nonce, 'woocommerce-process_checkout' );
+    }
+
+    private static function get_checkout_post_value( $key ) {
+        // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Callers gate access with self::has_valid_checkout_nonce().
+        if ( ! isset( $_POST[ $key ] ) ) {
+            return '';
+        }
+
+        // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Callers gate access with self::has_valid_checkout_nonce().
+        return sanitize_text_field( wp_unslash( $_POST[ $key ] ) );
+    }
+
     public static function validate_before_save() {
         /*
         if ( self::is_required() && empty( $_POST['shipday_delivery_datetime'] ) ) {
-            wc_add_notice( __( 'Please choose your preferred delivery date & time.', 'shipday-datetime' ), 'error' );
+            wc_add_notice( __( 'Please choose your preferred delivery date & time.', 'shipday-for-woocommerce' ), 'error' );
         }
         */
@@ -221 +248 @@
         $enable_pickup_time =  get_option('shipday_enable_pickup_time', "no") === "yes";
         $pickup_time_mandatory = get_option('shipday_pickup_time_mandatory', "no") === "yes";
+        if ( ! self::has_valid_checkout_nonce() ) {
+            return;
+        }
+
+        $order_type = self::get_checkout_post_value( 'shipday_order_type_field' );
+        $delivery_date = self::get_checkout_post_value( 'shipday_delivery_date_field' );
+        $pickup_date = self::get_checkout_post_value( 'shipday_pickup_date_field' );
+        $pickup_time = self::get_checkout_post_value( 'shipday_pickup_time_field' );
+        $delivery_time = self::get_checkout_post_value( 'shipday_delivery_time_field' );
 
 
 
         if ( $enable_datetime_plugin && $enable_delivery_option ) {
-            if (!isset( $_POST['shipday_order_type_field'] ) || $_POST['shipday_order_type_field'] === "" ||  $_POST['shipday_order_type_field'] === "Choose Option" ) {
-                wc_add_notice( __( "Please select order type", "shipday-woo-delivery" ), 'error' );
+            if ( '' === $order_type || 'Choose Option' === $order_type ) {
+                wc_add_notice( __( "Please select order type", "shipday-for-woocommerce" ), 'error' );
             }
 
         }
         if ( $enable_datetime_plugin  && $enable_delivery_date && $delivery_date_mandatory &&
-            (!$enable_delivery_option || $_POST['shipday_order_type_field'] === "Delivery")
+            (!$enable_delivery_option || 'Delivery' === $order_type)
         ) {
 
-            if (!isset($_POST['shipday_delivery_date_field']) || $_POST['shipday_delivery_date_field'] === "" ) {
-                wc_add_notice( __( "Please enter delivery date", "shipday-woo-delivery" ), 'error' );
+            if ( '' === $delivery_date ) {
+                wc_add_notice( __( "Please enter delivery date", "shipday-for-woocommerce" ), 'error' );
             }
 
         }
         if ( $enable_datetime_plugin  && $enable_pickup_date && $pickup_date_mandatory &&
-            (!$enable_delivery_option || $_POST['shipday_order_type_field'] === "Pickup")
+            (!$enable_delivery_option || 'Pickup' === $order_type)
         ) {
-            if (!isset($_POST['shipday_pickup_date_field']) || $_POST['shipday_pickup_date_field'] === "" || $_POST['shipday_pickup_date_field'] ==="Pickup Date" ) {
-                wc_add_notice( __( "Please enter pickup date", "shipday-woo-delivery" ), 'error' );
+            if ( '' === $pickup_date || 'Pickup Date' === $pickup_date ) {
+                wc_add_notice( __( "Please enter pickup date", "shipday-for-woocommerce" ), 'error' );
             }
 
         }
         if ( $enable_datetime_plugin  && $enable_pickup_time && $pickup_time_mandatory &&
-            (!$enable_delivery_option || $_POST['shipday_order_type_field'] === "Pickup")
+            (!$enable_delivery_option || 'Pickup' === $order_type)
         ) {
 
-            if (!isset($_POST['shipday_pickup_time_field']) || is_null($_POST['shipday_pickup_time_field']) || $_POST['shipday_pickup_time_field'] === "") {
-                wc_add_notice( __( "Please select pickup time", "shipday-woo-delivery" ), 'error' );
+            if ( '' === $pickup_time ) {
+                wc_add_notice( __( "Please select pickup time", "shipday-for-woocommerce" ), 'error' );
             }
 
         }
         if ( $enable_datetime_plugin  && $enable_delivery_time && $delivery_time_mandatory &&
-            (!$enable_delivery_option || $_POST['shipday_order_type_field'] === "Delivery")
+            (!$enable_delivery_option || 'Delivery' === $order_type)
         ) {
-            if (!isset($_POST['shipday_delivery_time_field']) || is_null($_POST['shipday_delivery_time_field']) || $_POST['shipday_delivery_time_field'] === "") {
-                wc_add_notice( __( "Please select delivery time", "shipday-woo-delivery" ), 'error' );
+            if ( '' === $delivery_time ) {
+                wc_add_notice( __( "Please select delivery time", "shipday-for-woocommerce" ), 'error' );
             }
 
@@ -270 +306 @@
 
     public static function getDeliveryoptions() {
-        $delivery_option['Delivery'] = __( "Delivery", "shipday-woo-delivery" );
-        $delivery_option['Pickup'] = __( "Pickup", "shipday-woo-delivery" );
+        $delivery_option['Delivery'] = __( "Delivery", "shipday-for-woocommerce" );
+        $delivery_option['Pickup'] = __( "Pickup", "shipday-for-woocommerce" );
         return $delivery_option;
     }
@@ -277 +313 @@
     public static function classic_save( $order_id) {
         if ( ! function_exists('is_checkout') || ! is_checkout() ) return;
+        if ( ! self::has_valid_checkout_nonce() ) {
+            return;
+        }
         $order = wc_get_order( $order_id );
 
@@ -286 +325 @@
         $enable_pickup_time =  get_option('shipday_enable_pickup_time', "no") === "yes";
 
-        $order_type = sanitize_text_field( wp_unslash( $_POST['shipday_order_type_field'] ) );
-        if ( $enable_datetime_plugin && $enable_order_type && isset( $_POST['shipday_order_type_field'] ) ) {
+        $order_type = self::get_checkout_post_value( 'shipday_order_type_field' );
+        if ( $enable_datetime_plugin && $enable_order_type && '' !== $order_type ) {
             if ( $order_type !== '' ) {
                 if ( self::$hpos === true ) {
@@ -296 +335 @@
             }
         }
-        if ( $enable_datetime_plugin && (!$enable_order_type || $order_type==='Delivery') && $enable_delivery_date && isset( $_POST['shipday_delivery_date_field'] ) ) {
-            $val = sanitize_text_field( wp_unslash( $_POST['shipday_delivery_date_field'] ) );
+        if ( $enable_datetime_plugin && (!$enable_order_type || $order_type==='Delivery') && $enable_delivery_date ) {
+            $val = self::get_checkout_post_value( 'shipday_delivery_date_field' );
             shipday_logger('error', 'datetime : '.$val);
             if ( $val !== '' ) {
@@ -307 +346 @@
             }
         }
-        if ( $enable_datetime_plugin && (!$enable_order_type || $order_type==='Delivery') && $enable_delivery_time && isset( $_POST['shipday_delivery_time_field'] ) ) {
-            $val_time = sanitize_text_field( $_POST['shipday_delivery_time_field'] );
+        if ( $enable_datetime_plugin && (!$enable_order_type || $order_type==='Delivery') && $enable_delivery_time ) {
+            $val_time = self::get_checkout_post_value( 'shipday_delivery_time_field' );
             if ( $val_time !== '' ) {
                 if ( self::$hpos === true ) {
@@ -318 +357 @@
         }
 
-        if ( $enable_datetime_plugin && (!$enable_order_type || $order_type==='Pickup') && $enable_pickup_date && isset( $_POST['shipday_pickup_date_field'] ) ) {
-            $val = sanitize_text_field( wp_unslash( $_POST['shipday_pickup_date_field'] ) );
+        if ( $enable_datetime_plugin && (!$enable_order_type || $order_type==='Pickup') && $enable_pickup_date ) {
+            $val = self::get_checkout_post_value( 'shipday_pickup_date_field' );
             shipday_logger('error', 'datetime : '.$val);
             if ( $val !== '' ) {
@@ -330 +369 @@
         }
 
-        if ( $enable_datetime_plugin && (!$enable_order_type || $order_type==='Pickup') &&  $enable_pickup_time && isset( $_POST['shipday_pickup_time_field'] ) ) {
-            $val_time = sanitize_text_field( $_POST['shipday_pickup_time_field'] );
+        if ( $enable_datetime_plugin && (!$enable_order_type || $order_type==='Pickup') &&  $enable_pickup_time ) {
+            $val_time = self::get_checkout_post_value( 'shipday_pickup_time_field' );
             if ( $val_time !== '' ) {
                 if ( self::$hpos === true ) {
@@ -359 +398 @@
 
             if ( self::$hpos === true ) {
-                $delivery_date = date($delivery_date_format, strtotime($order->get_meta( '_shipday_delivery_date', true )));
+                $delivery_date = wp_date( $delivery_date_format, strtotime($order->get_meta( '_shipday_delivery_date', true )) );
             } else {
-                $delivery_date = date($delivery_date_format, strtotime(get_post_meta( $order_id, '_shipday_delivery_date', true )));
-            }
-
-            echo '<p><strong>'.__($delivery_date_field_label, "shipday-woo-delivery").':</strong> ' . $delivery_date . '</p>';
+                $delivery_date = wp_date( $delivery_date_format, strtotime(get_post_meta( $order_id, '_shipday_delivery_date', true )) );
+            }
+
+            echo '<p><strong>' . esc_html__( 'Scheduled Date', 'shipday-for-woocommerce' ) . ':</strong> ' . esc_html( $delivery_date ) . '</p>';
 
         }
@@ -374 +413 @@
                 $time_slot = get_post_meta( $order_id, '_shipday_delivery_time', true );
             }
-            echo '<p><strong>'.__($delivery_time_field_label, "shipday-woo-delivery").':</strong> ' .$time_slot. '</p>';
+            echo '<p><strong>' . esc_html__( 'Time slot', 'shipday-for-woocommerce' ) . ':</strong> ' . esc_html( $time_slot ) . '</p>';
         }
     }
@@ -454 +493 @@
 
 }
-
-

shipday-for-woocommerce/trunk/shipday_order_management/Shipday_Order_Management.php

@@ -1 +1 @@
 <?php
+
+if ( ! defined( 'ABSPATH' ) ) {
+    exit;
+}
 
 require_once dirname(__DIR__). '/functions/logger.php';

shipday-for-woocommerce/trunk/shipday_order_management/Woo_Sync_Order.php

@@ -1 +1 @@
 <?php
+
+if ( ! defined( 'ABSPATH' ) ) {
+    exit;
+}
 
 require_once dirname(__DIR__). '/functions/common.php';
 require_once dirname(__FILE__). '/Shipday_Order_Management.php';
 
+// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound -- Legacy class name retained for backwards compatibility.
 class Woo_Sync_Order
 {
@@ -20 +25 @@
     }
 
-    public static function get_processing_orders_from_db() {
-        global $wpdb;
-        $orders = $wpdb->get_results(
-            "SELECT order_id FROM {$wpdb->prefix}wc_order_stats ".
-            "WHERE status='wc-processing'"
-        );
-        $ids = [];
-        foreach ($orders as $order) {
-            $ids[] = intval($order->order_id);
-        }
-        return $ids;
-    }
-
     public static function sync(){
-        $orders = self::get_processing_orders_from_db();
+        $orders = self::get_processing_orders();
         foreach ( $orders as $order_id) {
             Shipday_Order_Management::process_and_send($order_id);

shipday-for-woocommerce/trunk/views/Dokan_vendor_settings_shipday.php

@@ -1 +1 @@
 <?php
+
+if ( ! defined( 'ABSPATH' ) ) {
+    exit;
+}
 require_once dirname(__DIR__). '/functions/logger.php';
 
@@ -13 +17 @@
     public static function save_api_key() {
         // Only handle POST requests
-        if ( $_SERVER['REQUEST_METHOD'] !== 'POST' ) {
+        if (
+            ! isset( $_SERVER['REQUEST_METHOD'] )
+            || 'POST' !== strtoupper( sanitize_text_field( wp_unslash( $_SERVER['REQUEST_METHOD'] ) ) )
+        ) {
             return;
         }
@@ -22 +29 @@
         }
 
-        $post_data = wp_unslash($_POST);
-        if (!is_null($post_data) && !is_null($post_data['shipday_api_key']) && !empty(trim($post_data['shipday_api_key'])))
-            update_user_meta(wp_get_current_user()->ID, 'shipday_api_key', trim($post_data['shipday_api_key']));
+        if (
+            ! isset( $_POST['_wpnonce'] )
+            || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['_wpnonce'] ) ), 'dokan_delivery_settings_nonce' )
+        ) {
+            return;
+        }
+
+        if ( ! isset( $_POST['shipday_api_key'] ) ) {
+            return;
+        }
+
+        $api_key = sanitize_text_field( wp_unslash( $_POST['shipday_api_key'] ) );
+        if ( '' !== $api_key ) {
+            update_user_meta( wp_get_current_user()->ID, 'shipday_api_key', $api_key );
+        }
     }
 
@@ -39 +58 @@
     public static function dokan_add_help_menu( $urls ) {
         $urls['delivery'] = array(
-            'title' => __( 'Delivery', 'shipday'),
+            'title' => __( 'Delivery', 'shipday-for-woocommerce'),
             'icon'  => '<i class="fas fa-truck"></i>',
             'url'   => dokan_get_navigation_url( 'delivery' ),
@@ -68 +87 @@
 
                             <div class="dokan-form-group">
-                                <label class="dokan-w3 dokan-control-label" for="shipday_api_key"><?php esc_html_e( 'Shipday API key', 'shipday' ); ?></label>
+                                <label class="dokan-w3 dokan-control-label" for="shipday_api_key"><?php esc_html_e( 'Shipday API key', 'shipday-for-woocommerce' ); ?></label>
 
                                 <div class="dokan-w5 dokan-text-left">
-                                    <input id="shipday_api_key" required value="<?php echo esc_attr(self::get_api_key()); ?>" name="shipday_api_key" placeholder="<?php esc_attr_e( 'Enter shipday api key', 'shipday' ); ?>" class="dokan-form-control" type="text">
+                                    <input id="shipday_api_key" required value="<?php echo esc_attr(self::get_api_key()); ?>" name="shipday_api_key" placeholder="<?php esc_attr_e( 'Enter shipday api key', 'shipday-for-woocommerce' ); ?>" class="dokan-form-control" type="text">
                                 </div>
                             </div>
@@ -78 +97 @@
 
                                 <div class="dokan-w4 ajax_prev dokan-text-left" style="margin-left:24%;">
-                                    <input type="submit" name="shipday_vendor_settings" class="dokan-btn dokan-btn-danger dokan-btn-theme" value="<?php esc_attr_e( 'Update Settings', 'dokan-lite' ); ?>">
+                                    <input type="submit" name="shipday_vendor_settings" class="dokan-btn dokan-btn-danger dokan-btn-theme" value="<?php esc_attr_e( 'Update Settings', 'shipday-for-woocommerce' ); ?>">
                                 </div>
                             </div>

shipday-for-woocommerce/trunk/views/Notices.php

@@ -1 +1 @@
 <?php
+
+if ( ! defined( 'ABSPATH' ) ) {
+    exit;
+}
 
 require_once dirname(__DIR__). '/functions/common.php';
 
-
+// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound -- Legacy class name retained for backwards compatibility.
 class Notices {
     public static function init() {
@@ -17 +21 @@
             ?>
             <div class='notice notice-warning is-dismissible'>
-                <p>Your Shipday API Key Field is blank. To set up API Key, <a href="<?php echo $shipday_tab_url; ?>" target="_top">Click
+                <p>Your Shipday API Key Field is blank. To set up API Key, <a href="<?php echo esc_url( $shipday_tab_url ); ?>" target="_top">Click
                         Here</a>.</p>
             </div>
@@ -40 +44 @@
                 <div class='notice notice-warning is-dismissible'>
                     <p>REST API key is essential for order status update in WooCommerce dashboard. To add REST API Key,
-                        <a href="<?php echo $rest_api_section_url; ?>" style="color: red">Click here</a> and take note of consumer key and consumer secret.
-                        Then enter the keys in shipday settings tab <a href="<?php echo $shipday_tab_url; ?>"> here</a>.</p>
+                        <a href="<?php echo esc_url( $rest_api_section_url ); ?>" style="color: red">Click here</a> and take note of consumer key and consumer secret.
+                        Then enter the keys in shipday settings tab <a href="<?php echo esc_url( $shipday_tab_url ); ?>"> here</a>.</p>
                 </div>
             <?php
@@ -55 +59 @@
         ?>
         <div class='notice notice-warning is-dismissible'>
-            <p>You have set <?php echo $consumer_secret.'.'.$consumer_key; ?>.</p>
+            <p>You have set <?php echo esc_html( $consumer_secret . '.' . $consumer_key ); ?>.</p>
         </div>
         <?php

shipday-for-woocommerce/trunk/views/WCFM_vendor_settings_shipday.php

@@ -1 +1 @@
 <?php
 
+if ( ! defined( 'ABSPATH' ) ) {
+    exit;
+}
+
+// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound -- Legacy class name retained for backwards compatibility.
 class WCFM_vendor_settings_shipday {
     public static function init() {
@@ -15 +20 @@
 
         global $WCFM;
+        // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- This is an external WCFM hook name.
         $user_id = apply_filters( 'wcfm_current_vendor_id', get_current_user_id() );
         $vendor_data = get_user_meta( $user_id, 'wcfmmp_profile_settings', true );
@@ -20 +26 @@
         $api_key = isset( $vendor_data['shipday']['api_key'] ) ? $vendor_data['shipday']['api_key'] : '';
         $fields = array(
-            "api_key" => array("label" => __('Shipday API Key', 'wcfm-settings-tab-shipday'),
+            "api_key" => array("label" => __('Shipday API Key', 'shipday-for-woocommerce'),
                                       "name" => "shipday[api_key]",
                                       "type" => "text",

shipday-for-woocommerce/trunk/views/WC_Settings_Tab_Shipday_menus.php

@@ -1 +1 @@
 <?php
+
+if ( ! defined( 'ABSPATH' ) ) {
+    exit;
+}
+// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedFunctionFound,WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- Legacy settings/filter API is retained for backwards compatibility.
 
 function get_woocommerce_settings()
@@ -5 +10 @@
     $settings = array(
         array(
-            'name' => __('General Settings', 'woocommerce-settings-tab-shipday'),
+            'name' => __('General Settings', 'shipday-for-woocommerce'),
             'type' => 'title',
             'desc' => '',
@@ -11 +16 @@
         ),
         array(
-            'name' => __('Shipday API Key', 'woocommerce-settings-tab-shipday'),
+            'name' => __('Shipday API Key', 'shipday-for-woocommerce'),
             'type' => 'text',
             'desc' => 'To get API Key, Login to your Shipday account and go to My Account > Profile > Api key',
@@ -22 +27 @@
         ),
         array(
-            'name' => __('REST API Settings', 'woocommerce-settings-tab-shipday'),
+            'name' => __('REST API Settings', 'shipday-for-woocommerce'),
             'type' => 'title',
             'desc' => 'To get REST API Keys, go to WooCommerce > Settings > Advanced > API Key. Then generate a new API key with any description, '.
@@ -29 +34 @@
         ),
         array(
-            'name' => __('Consumer Key', 'woocommerce-settings-tab-shipday'),
+            'name' => __('Consumer Key', 'shipday-for-woocommerce'),
             'type' => 'text',
 //            'value' => "",
@@ -35 +40 @@
         ),
         array(
-            'name' => __('Consumer Secret', 'woocommerce-settings-tab-shipday'),
+            'name' => __('Consumer Secret', 'shipday-for-woocommerce'),
             'type' => 'text',
 //            'value' => "",
@@ -49 +54 @@
         ),
         array(
-            'name' => __('Orders Settings', 'woocommerce-settings-tab-shipday'),
+            'name' => __('Orders Settings', 'shipday-for-woocommerce'),
             'type' => 'title',
             'desc' => '',
@@ -55 +60 @@
         ),
         array(
-            'title'       => __( 'Sync previous orders', 'woocommerce-settings-tab-shipday' ),
-            'label'       => __( 'Sync previous orders', 'woocommerce-settings-tab-shipday'),
+            'title'       => __( 'Sync previous orders', 'shipday-for-woocommerce' ),
+            'label'       => __( 'Sync previous orders', 'shipday-for-woocommerce'),
             'type'        => 'checkbox',
             'description' => '',
@@ -63 +68 @@
         ),
         array(
-            'title'       => __( 'Enable pickup orders', 'woocommerce-settings-tab-shipday' ),
-            'label'       => __( 'Enable pickup orders', 'woocommerce-settings-tab-shipday'),
+            'title'       => __( 'Enable pickup orders', 'shipday-for-woocommerce' ),
+            'label'       => __( 'Enable pickup orders', 'shipday-for-woocommerce'),
             'type'        => 'checkbox',
             'description' => 'Allow orders with local pickup shipping method to be sent to Shipday',
@@ -72 +77 @@
 
         array(
-            'title'       => __( 'Enable new Shipday webhook', 'woocommerce-settings-tab-shipday' ),
-            'label'       => __( 'Enable new Shipday webhook', 'woocommerce-settings-tab-shipday'),
+            'title'       => __( 'Enable new Shipday webhook', 'shipday-for-woocommerce' ),
+            'label'       => __( 'Enable new Shipday webhook', 'shipday-for-woocommerce'),
             'type'        => 'checkbox',
             'description' => 'Enable this to send your orders to new Shipday Webhook',
@@ -94 +99 @@
     $settings = array(
         array(
-            'name' => __('General Settings', 'woocommerce-settings-tab-shipday'),
+            'name' => __('General Settings', 'shipday-for-woocommerce'),
             'type' => 'title',
             'desc' => '',
@@ -100 +105 @@
         ),
         array(
-            'name' => __('Order Management Settings for Dokan Multi-vendor', 'woocommerce-settings-tab-shipday'),
+            'name' => __('Order Management Settings for Dokan Multi-vendor', 'shipday-for-woocommerce'),
             'type' => 'radio',
             'std' => 'admin_manage',
             'default' => 'admin_manage',
             'options' => array(
-                'admin_manage' => __('Dokan Admin account manages deliveries for all vendors'),
-                'vendor_manage' => __('Vendors manage their orders in Shipday'),
+                'admin_manage' => __('Dokan Admin account manages deliveries for all vendors', 'shipday-for-woocommerce'),
+                'vendor_manage' => __('Vendors manage their orders in Shipday', 'shipday-for-woocommerce'),
             ),
             'id' => 'wc_settings_tab_shipday_order_manage',
         ),
         array(
-            'name' => __('Shipday API Key of Admin\'s Account', 'woocommerce-settings-tab-shipday'),
+            'name' => __('Shipday API Key of Admin\'s Account', 'shipday-for-woocommerce'),
             'type' => 'text',
             'desc' => 'To get API Key, Login to your Shipday account and go to My Account > Profile > Api key',
@@ -117 +122 @@
         ),
         array(
-            'title'       => __( 'Enable pickup orders', 'woocommerce-settings-tab-shipday' ),
-            'label'       => __( 'Enable pickup orders', 'woocommerce-settings-tab-shipday'),
+            'title'       => __( 'Enable pickup orders', 'shipday-for-woocommerce' ),
+            'label'       => __( 'Enable pickup orders', 'shipday-for-woocommerce'),
             'type'        => 'checkbox',
             'description' => 'Allow orders with local pickup shipping method to be sent to Shipday',
@@ -125 +130 @@
         ),
         array(
-            'title'       => __( 'Enable new Shipday webhook', 'woocommerce-settings-tab-shipday' ),
-            'label'       => __( 'Enable new Shipday webhook', 'woocommerce-settings-tab-shipday'),
+            'title'       => __( 'Enable new Shipday webhook', 'shipday-for-woocommerce' ),
+            'label'       => __( 'Enable new Shipday webhook', 'shipday-for-woocommerce'),
             'type'        => 'checkbox',
             'description' => 'Enable this to send your orders to new Shipday Webhook',
@@ -146 +151 @@
     $settings = array(
         array(
-            'name' => __('General Settings', 'woocommerce-settings-tab-shipday'),
+            'name' => __('General Settings', 'shipday-for-woocommerce'),
             'type' => 'title',
             'desc' => '',
@@ -152 +157 @@
         ),
         array(
-            'name' => __('Order Management Settings for WCFM Multi-vendor', 'woocommerce-settings-tab-shipday'),
+            'name' => __('Order Management Settings for WCFM Multi-vendor', 'shipday-for-woocommerce'),
             'type' => 'radio',
             'std' => 'admin_manage',
             'default' => 'admin_manage',
             'options' => array(
-                'admin_manage' => __('WCFM Admin account manages deliveries for all vendors'),
-                'vendor_manage' => __('Vendors manage their orders in Shipday'),
+                'admin_manage' => __('WCFM Admin account manages deliveries for all vendors', 'shipday-for-woocommerce'),
+                'vendor_manage' => __('Vendors manage their orders in Shipday', 'shipday-for-woocommerce'),
             ),
             'id' => 'wc_settings_tab_shipday_order_manage',
         ),
         array(
-            'name' => __('Shipday API Key of Admin\'s Account', 'woocommerce-settings-tab-shipday'),
+            'name' => __('Shipday API Key of Admin\'s Account', 'shipday-for-woocommerce'),
             'type' => 'text',
             'desc' => 'To get API Key, Login to your Shipday account and go to My Account > Profile > Api key',
@@ -169 +174 @@
         ),
         array(
-            'title'       => __( 'Enable pickup orders', 'woocommerce-settings-tab-shipday' ),
-            'label'       => __( 'Enable pickup orders', 'woocommerce-settings-tab-shipday'),
+            'title'       => __( 'Enable pickup orders', 'shipday-for-woocommerce' ),
+            'label'       => __( 'Enable pickup orders', 'shipday-for-woocommerce'),
             'type'        => 'checkbox',
             'description' => 'Allow orders with local pickup shipping method to be sent to Shipday',
@@ -177 +182 @@
         ),
         array(
-            'title'       => __( 'Enable new Shipday webhook', 'woocommerce-settings-tab-shipday' ),
-            'label'       => __( 'Enable new Shipday webhook', 'woocommerce-settings-tab-shipday'),
+            'title'       => __( 'Enable new Shipday webhook', 'shipday-for-woocommerce' ),
+            'label'       => __( 'Enable new Shipday webhook', 'shipday-for-woocommerce'),
             'type'        => 'checkbox',
             'description' => 'Enable this to send your orders to new Shipday Webhook',