Skip to content

Releases: Freemius/wordpress-sdk

Bug Fixes (Post GDPR)

01 Jun 07:05
292ddda
Compare
Choose a tag to compare

While this is a minor release, some of its bug fixes are essential, and you should update all your plugins and themes to this new version. We resolved several bug fixes that were introduced after the GDPR release, as well as other fixes that are resolving previously pending issues.

  • Fixed the generated link for downloading the latest version of a premium add-on.
  • Fixed the generated link for downloading the latest premium plugin/theme version, when executed from the free version of the product.
  • Fixed a bug that was causing a PHP error when a user was opting in (or activating a license) of an add-on, before opting-in (or skipping) with the parent plugin/theme.
  • Fixed a PHP warning that was shown once after network-activating a plugin.
  • Fixed a redirects loop issue that was happening when activating a child theme that is running the latest version of the Freemius SDK through the parent theme.
  • Fixed an issue that was showing the JSON response of a license activation error instead of showing a user-friendly error message.
  • Fixed the expiration label on the Account page to show Expired {{ period }} ago instead of Expires in {{ period }} for expired licenses.

GDPR Compliance, Demo Mode, Premium Updates Fix, and more!

25 May 18:27
937d96a
Compare
Choose a tag to compare

GDPR Compliance

To help you comply with the GDPR, this version incorporates key updates to the SDK helping you to collect a proper marketing consent from EU users. Please update your plugin/theme with the newest SDK version asap. Like always, make sure that you test it thoroughly before the release.

A New Opt-In Message for EU Users

The default opt-in message was adjusted for EU users, making it clearer that they are also opting-in to potential marketing and offers via email. Once you upgrade to the new SDK, the marketing flag will be automatically set to ‘yes’ for all new users that opt-in.

Here’s the phrasing we use for new EU users:

Never miss an important update - opt in to our security & feature updates notifications, educational content, offers, and non-sensitive diagnostic tracking with freemius.com.

IMPORTANT: If you’re overriding the default opt-in message with a custom one, please make sure to adjust it for EU users, making it clear that they are also opting-in to promotional emails. To help you identify EU users, we’ve introduced a helper method, which you can use in your opt-in message filter:

FS_GDPR_Manager::instance()->is_required()

Marketing Consent During License Activation

The license activation is now a 2-step mechanism. Once a user types in a license key, the 1st thing that will happen is an AJAX call that will ping our API to check if the marketing flag has already been set for the owner of that license. If not, an opt-in radio button will appear and the user will have to indicate if they wish to opt-in to marketing or not:
freemius-wordpress-sdk-license-activation-gdpr-opt-in

Marketing Consent Admin Notice for Opted-in EU Users

A new friendly admin notice will be shown to EU users that already opted-in before and their marketing flag is not set (or set to null), to encourage them to opt-in to marketing emails.
freemius-sdk-gdpr-opt-in-admin-notice

  • To avoid a flood of admin notices, if the logged in EU admin opted-in to multiple plugins and themes on the same WordPress install, the SDK will only show a single collective message for all the products and the decision taken by the user will affect their marketing flag for all those products.
  • If the admin chooses to dismiss the message it will reappear every 30-days until a decision is taken (yes or no), or if the marketing flag will be updated via one of the other mechanisms.

IMPORTANT: The admin notice consent collection is off by default since we didn’t want to force you to use it. To activate it, add the following filter handler right after your integration snippet:

    my_freemius()->add_filter( 'handle_gdpr_admin_notice', '__return_true');

We’ve created a gist to help you customize this GDPR message:

my_freemius()->override_i18n( array(
    // Single product GDPR opt-in.
    'thank-you-for-using-product-and-its-addons'  => 'Thank you so much for using %s and its add-ons!',
    'thank-you-for-using-product'                 => 'Thank you so much for using %s!',
    'already-opted-in-to-product-usage-tracking'  => "You've already opted-in to our usage-tracking, which helps us keep improving the %s.",
    // Multi-product GDPR opt-in.
    'thank-you-for-using-products'                => 'Thank you so much for using our products!',
    'already-opted-in-to-products-usage-tracking' => "You've already opted-in to our usage-tracking, which helps us keep improving them.",
    'product-and-its-addons'                      => '%s and its add-ons',
    // GDPR explanation.
    'due-to-gdpr-compliance-requirements'         => 'Due to the new %sEU General Data Protection Regulation (GDPR)%s compliance requirements it is required that you provide your explicit consent, again, confirming that you are onboard ',
    'contact-for-updates'                         => "Please let us know if you'd like us to contact you for security & feature updates, educational content, and occasional offers:",
    // Opt-in action.
    'yes'                                         => 'Yes',
    'send-updates'                                => 'send me security & feature updates, educational content and offers.',
    // Opt-out action.
    'no'                                          => 'No',
    'do-not-send-updates'                         => 'do %sNOT%s send me security & feature updates, educational content and offers.',
) );

Reference: https://gist.github.com/vovafeldman/54fbc08635f66fd09b7d530cb027cc87

Official GDPR announcement: https://freemius.com/blog/gdpr-wordpress-plugin-theme/

Demo Mode

We've incorporated a special Demo Mode for those of you who spin off WP environments with your product to demo its paid features. This mode will hide the following pages:

  • The debugging page
  • The Account page
  • The pricing/upgrade page

To activate the demo mode all you need to do is add the following flag to the wp-config.php file in the demo environment:

define( 'WP_FS__DEMO_MODE', true );

Premium Products Update Fix

We received a report from one of our sellers that it's possible to update a premium product version without a valid license. Moreover, the automatic update installs the free product version and deactivates the premium one, which can cause an unexpected behavior. After investigating the issue, we've found out that this issue was happening when users were updating a premium plugin/theme in the WordPress main Updates page in the WP Admin.
To avoid that issue, when a user tries to check the bulk update box of a premium product without having a valid, non-expired license for that product, they will be prompted with the following dialog box:
freemius-sdk-premium-update-no-license-dialog-box

Also, the checkbox will not be selected by default, so it's a good reminder to the customer that it's about time to renew their license if they want to get the update.

Localization / Translations

The SDK is now fully translated into English, Dutch, French, Italian, Spanish and Japanese. Special thanks to everyone who help us with the translation efforts! If you know any other languages besides English, please join our translation team:
https://www.transifex.com/freemius/wordpress-sdk/

Major: Multisite Network Integration, Add-Ons Enhancements, and Bug Fixes

04 Apr 06:33
7059f9e
Compare
Choose a tag to compare

Today we’re excited to release version 2.0.1. The reason for the major version bump is that we spend about 4 of the last months on integrating the SDK with WordPress multisite networks. We had to make major design changes of the storage model to offer a seamless experience in multi-site environments.

Multisite Network-Level Integration

Just to clarify, the WordPress SDK was working fine with multi-sites before, but the UX wasn’t optimized. Your users had to opt-in or skip the activation for each site, and your customers had to activate their license key for every sub-site in the network. For instance, when a super-admin with a 20 sites network purchased a 25-site license for your product, they had to activate the license 20 times. Not very user-friendly :) Even frustrating.

With the new integration, super-admins can now opt-in/skip/activate-license on the network level, making the UX way better. I can confidently say that this is the best multisite network-level integration on the market today! We made an elegant and seamless UX, while also very flexible when needed (keeping agencies in mind).

The special integration will only work for network activated plugins.

Network Level Opt-In

When a user activates your plugin on a multisite network they will see the following opt-in screen:

freemius-network-level-opt-in

There are 2 new elements:

  1. The “Apply on all sites in the network” checkbox.
  2. The “Delegate to Site Admins” action link.

You’re probably asking yourself “what is the site-admins delegation option?” So let’s start with that. One of the use-cases for running a multisite network is hosting (e.g. WordPress.com is actually the largest WordPress multisite network). Consider the following scenario where a hosting provider would like to activate an “essential” plugin across their entire network, but doesn’t want to make the decision regarding the usage-tracking or licensing for the hosted sites. Robert Abela, who is a new Freemius partner (plugin seller), started to sell WP Security Audit Log with Freemius and is an excellent example of that use-case. They offer a plugin for audit log tracking, which is quite an essential product for every website to have. So when a small hosting company wishes to offer Robert’s plugin to their entire network they can easily do that, while delegating the management of the plugin to the site admins, without taking any actions in their behalf.

Now that we’re clear on the delegation part, let’s explore the new checkbox. When the checkbox is selected, the action that the super-admin will take will affect all of the sites on the network (including new ones that will be created). In case the super-admin would like to take different actions for different subsites they can uncheck the box and easily choose which action to take, per site:

freemius-network-level-opt-in-sites-selection

Network-Level License Activation

In a very similar manner, super-admins can activate a license across their entire network, delegate the license activation to site admins, or handpick which subsites to activate the license for:

freemius-network-level-license-activation

Network-Level Management

Super admins that didn’t delegate the activation to the site admins will now have an Account page on the network Admin, allowing them to manage the plugin on the network-level without the need to open the Account for every subsite:

freemius-sdk-network-account-management

Additionally, the Account page will not be shown on the site level at all.

How to Activate The Multisite Network Integration?

To activate the network-level integration you’ll need to update to the new SDK, but also make a small adjustment to the integration code. Go to your SDK INTEGRATION page in the Freemius Dashboard, where you’ll notice a new checkbox which will activate the network integration:

freemius-dashboard-multisite-network-integration-activation

Add-Ons Enhancements

If you’re selling freemium add-ons with a WordPress.org free version, the add-ons information dialog box now shows a new button to install the free WordPress.org add-on version:

freemius-sdk-freemium-addon-dialog

A small but important addition is a new license activation button next to the installed add-ons on the Account page, allowing an easy way to activate a license:

add-on-license-activation

Bug Fixes

  • The new SDK comes with a bunch of fixes related to the “__clone exception” when cloning environments (staging/production). The SDK is now bulletproof against filesystem changes (changes in folder names) and symlink changes.
  • Also, we add a recovery mechanism for cases when the user’s data disappears from the local storage. This is a major enhancement that should eliminate data corruption edge-cases.
  • All paths are now stored as relative paths and not absolute, making sure migrations between environments work smoothly without triggering any “file not found” exceptions.
  • Since shifting to SSLv3 we noticed that some outdated environments with old cURL and/or OpenSSL versions fail to properly handshake with our API server. Since it will take a while until all hosting providers will be ready for SSLv3 we added a fallback mechanism to HTTP for those outdated environments.

Major Bug Fix

17 Jan 14:29
6864f0a
Compare
Choose a tag to compare

If you are only using Freemius for analytics via Freemius Insights, please ignore this version.

If you are monetizing with Freemius and have enabled the affiliation form in our latest WordPress SDK (v1.2.3), unfortunately, it comes with a significant bug that will trigger an API request almost every pageview, which will most likely slow down the site. This version fixes that bug so please make sure to update.

Localization Logic, Affiliation Form, Bug Fixes

19 Dec 08:43
5b420d7
Compare
Choose a tag to compare

Localization Logic

We are excited to share that we revamped our localization mechanism to avoid loading all SDK's translatable strings into the memory on every request. This will significantly reduce the memory consumption - only the used strings will be loaded into the memory. We kept the mechanism the enables overriding every single string in the SDK, making the text fully customizable.

IMPORTANT

Please notice that we're deprecating the localization method __fs() since PHP7 throws a warning if there are functions/methods starting with two underscores. Please check your plugin/theme's code, if you're using this function, please replace it with __() (your own translations).

Affiliation

Added a conditional affiliation program onboarding form:

image

image

If you already set up an affiliation program for your product on Freemius, simply go to the SDK INTEGRATION section, scroll to the submenu items selection option, and make sure that the Affiliation checkbox is checked:
image

Then, copy the new SDK snippet code and place it in your plugin/theme instead of the previous snippet. You'll notice a new parameter that will look like:
'has_affiliation' => '<moderation>', // <moderation> - selected, customers, or all.

You can learn more about affiliation here:
https://freemius.com/blog/affiliate-program-wordpress-plugins-themes/

Bug Fixes

  • The payments history and invoices download functionality was fixed.
  • Fixed the activation logic for plugins without any admin setting pages (nor menu items).
  • Fixed the opt-in auto installation logic for add-ons.
  • Fixed the download button on the Account page. Some PHP environments were generating invalidly escaped querystring when using http_build_query(). We replaced it with url_encode() which fixed the problem.
  • Improved the symlink-related logic for some edge cases.
  • All paths are now stored as relative. Even though we had a special logic to identify patch changes, some edge cases were breaking the logic.

Theme Check Compatibility

Stopped using @inet_pton() and @json_decode() since warnings silencing flagged as an error by the new Theme Check. Replaced inet_pton() with filter_var() and FILTER_VALIDATE_IP for the IP validation. Removed the @ from json_decode().

Reference: https://themes.trac.wordpress.org/ticket/46134#comment:14

Bug Fix (Theme Tabs)

31 Aug 07:38
Compare
Choose a tag to compare

Mistakenly added the tabs functionality for all themes instead of only to monetizing ones.

Major: Freemium Add-ons, Themes Monetization, Premium Version Updates, Bug Fixes

30 Aug 11:59
Compare
Choose a tag to compare

We released a new version of our WordPress SDK. You will notice a huge jump in the versioning from 1.2.1.7 to 1.2.2.8. The reason for that is because we finally merged the themes and plugins SDK together. This is a HUGE code update and while we are confident that it’s in a good shape after many days of testing, we still ask you to run a sanity check before you deploy it to production. Just to be clear, everything remains backward compatible, and in fact, the theme’s SDK was already running in production among dozens of themes and thousands of websites (we also released it for our plugins a week ago and didn’t get any tickets related to the SDK, so far). Bringing the SDK versions into a shape which we can merge them into, is something that we’ve been working on for about 6 months. The fundamental difference we had to incorporate in our design is rely on IDs instead of slugs since a plugin and a theme can have the exact same slug, which may cause conflicts. While the scenario of a plugin and a theme with the same slug, both using Freemius and installed on the same site has a very tiny probability of occurring, we are building a solution for the long term and it was important for us to avoid this possible conflict.

Themes Monetization

After six months of ongoing conversations with the WordPress.org themes review team, we’ve finally sealed all the details and the expected UX, to offer our monetization capabilities within the WP Admin for themes. Not going to dive into the technicalities, but we adjusted the SDK to seamlessly integrate with tabs (instead of menu items) and the customizer, so you can now upsell your premium theme version right from within the WP Admin, without even having a website.

Call for Freemium Theme Developers

If you are interested in giving it a spin, we’re currently gathering a closed group of development customers. The benefit of joining as an early adopter is that we’ll help you with the quick integration and make sure it's all working as expected, and you'll be able to give us your feedback, which will be taken into account as we finalize the beta version. To apply contact us via themes@freemius.com

License Update from GPLv2 to GPLv3

Josh Habdas started an issue on GitHub regarding our SDK’s GPLv2 license, raising the concern that our licensing isn’t compatible with GPLv3 and AGPL. After doing some research and advising with an attorney, we adjusted the SDK’s license to GPLv3 which actually gives more freedoms to developers.

Version Updates Population

After receiving a few complaints from developers saying that they have released a new version and their customers can’t see the update, we ran a thorough profiling of the premium updates mechanism. We found that due to a layer of caching on top of our API requests manager, together with WordPress core’s 12 hours updates cache, customers with a valid license had to wait up to 36 hours to see an update in their WP Admin dashboard. Not optimal at all.

Therefore, We reduced the cache expiration for that request to 1-hour, which will reduce the wait time to up to 13 hours. In addition, when forcing an updates check from the Updates page in the WP Admin, we immediately invalidate the relevant cache and pull a fresh result directly from the server. This means that the update will be available immediately after clicking the “Check Again” button:

image

UX

  • After several support tickets, we found a repetitive UX issue where customers do not notice the Billing tab when opening their Account page, which means that they don't know how to update their business information for invoicing. Thus, we moved the billing and invoices section right into the Account page.
  • After numerous internal discussions and advising with the WordPress.org Themes Review Team, we eventually decided to add the opt-out option from usage-tracking for themes, right in the theme’s details dialog box:
    image

Selling Add-Ons

  • We made a significant performance optimization to the Add-Ons marketplace when selling add-ons from the WP Admin.
  • The SDK now supports a proper upsell for freemium add-ons within the WP Admin. Before, this section only worked properly for free or premium only add-ons.
  • Activating a premium add-on that was purchased via Freemius Checkout from the developer’s site now auto redirects to the license activation form. In previous versions, if an add-on was purchased outside the WP Admin, we automatically deactivated a premium only add-on with a corresponding message that it requires a license. Simply because we never implemented that use-case and were relying on an in-dashboard upgrade which automatically fetches the license key via the API.

Bug Fixes

  • The auto-deactivation process of the free version upon activation of the premium one was only working for opted-in users. The problem is that if a user skipped the opt-in, and later purchased a premium version from the developer’s website using Freemius Checkout, when that user would try to activate the premium version, the free version remained activated. This caused unpredicted behavior.
  • In the last release, we mistakenly added a bug that caused the opt-in/out functionality in the plugins’ page to fail. This issue is now fixed.
  • Fixed a few bugs related to environments with Symlinks.

Official release notes: https://freemius.com/blog/cart-abandonment-recovery-themes-monetization/

Seamless Upgrade Process, Personalized Usage-Tracking Terms, and Bug Fixes

31 Aug 07:36
Compare
Choose a tag to compare

The Most Customer Friendly Upgrade Process for Freemium Plugins

If you have a plugin or a theme listed on WordPress.org and you follow the repo’s announcements on make.wordpress.org, you’ve probably already heard there was a clarification thread by Mika regarding guideline #8 concerning Jetpack’s recent announcement on installing non-wp.org themes via the plugin. Prior to that clarification, the consensus in the WordPress community was that developers are not allowed to list plugins or themes on WordPress.org if they programmatically install executables (e.g. plugins and themes) which are hosted outside the official repository. This means that freemium plugins/themes on WordPress.org had to ask their customers to do a LOT of work just to start using the premium version. Here’s how the process looked like for the customer, in the past:

  1. Complete the checkout
  2. Download the premium code version
  3. Upload the premium plugin/theme
  4. Deactivate the free version of the plugin/theme (in some cases this step isn’t required)
  5. Activate the premium version
  6. Activate the license key

Note: This process isn’t the case for Serviceware plugins, i.e., services which are basically wrapped into a plugin.

Moreover, some hosting companies require SSL or FTP authentication just to upload the premium version, which means that non tech-savvy customers had to contact the developer’s support just to have the product installed.

Isn’t that crazy? Are you familiar with any other paid product that requires so many steps just to get started?

But yes - that’s how it works, and the community had to learn to live with it.

Luckily, with the new clarification and some creative thinking, we managed to reinvent the whole upgrade mechanism for freemium WordPress.org products by building the BEST and most seamless upgrade process that WordPress had ever seen!

How does it work?

During the checkout process we’ve added a checkbox, right before the final upgrade button, where the user can choose to automatically install the product after the upgrade:
freemius-auto-install-opt-in

If the customer checks that box, all the steps mentioned above will occur automatically, in the following order:

  1. The premium version will automatically be uploaded to the site
  2. The free version will be deactivated
  3. The premium version will be activated
  4. The license key will be automatically applied
  5. Premium product ready for use!

It’s that easy!

And btw - if the file system permissions require FTP or SSL authentication, the new SDK version will prompt the user for those, integrating with WordPress core file system permissions request native mechanism.

Here’s a 50-sec recording showing the whole upgrade process for an opted-in user showcasing FooBox Image Lightbox, one of Freemius’ partners:
Auto-Installation Screencast
https://www.youtube.com/watch?v=7cMPJZisd7w

Yes, excluding the time it takes to type the credit card, the whole upgrade process takes 45-sec!

Why is it compliant with the WordPress.org guidelines?

  1. The premium version will only be installed upon explicit opt-in consent of the user, it will never happen automatically.
  2. The opt-in checkbox is running on our checkout as a service, not as part of the plugin code that is hosted on wp.org.
  3. Even if the user mistakenly checks the auto installation box, they still get a 30-sec “grace period”, during which the process can be canceled.
  4. All of the messaging is super-clear to the user, including the fact that the premium plugin version will be installed from the Freemius repo and not from WordPress.org repo. No hidden footprints, everything is straightforward.

Beautiful and User-Friendly Usage-Tracking Terms Page

If you've been using our default opt-in messaging you probably noticed that we mention that the usage-tracking is handled by freemius.com with a link to our insights marketing page. The link was an important temporary placeholder to show users what is Freemius all about and how it works. But, it was targeted at developers, not users. Our new WordPress SDK is now pointing to a new dynamic, auto generated, terms page that was build to explain the value of usage-tracking to the users, and to let them know what exact data is being collected. In other words, it's a user-friendly terms page.

Here's an example:
freemius-usage-tracking-terms
https://freemius.com/wordpress/usage-tracking/56/rating-widget/

As you can see, the page is personalized by pulling your product’s name and featured icon from WordPress.org.

If you've already customized or plan to customize the opt-in message, make sure you keep the default link for legal reasons.

Bug Fixes

  • Fixed the method that downloads the plugin's featured icon from WordPress.org when running on localhost (while the icon's URL is over HTTPS).
  • Fixed the "Upgrade" label arrow direction for RTL (Closed #155).
  • Apparently, some shared hosting providers are disabling get_current_user() which we were using for logging, so now, before calling the method we check if it’s not disabled (Close #158).
  • Added a missing email address sanitization when the user tries to recover their license key(s) (Closed #154).
  • Prior to version 1.2.1.6 we didn’t trigger the deactivation feedback form upon free product version deactivation if the user had an active license. That was assuming that the customer’s intent was to deactivate the free version before activating the premium product. In the previous release, we introduced a new mechanism that automatically deactivates the free version when activating the premium one. Thus, we modified the code to trigger the feedback form on every deactivation. While running tests for the new release, we noticed that we forgot to modify some of that logic, which caused the form not to show up in some use-cases.
  • There are more and more 1-click staging environment services out there. Usually, those services are cloning the whole WordPress environment, including the Database, and only making some small Database changes to update the domain references to the staging site. Due to the complexity of some of our newest SDK identification, we use the DB to store references to the plugins and theme paths that are running the Freemius SDK. After several bug reports, we managed to reproduce the problem and now the SDK will purge the cache for those cases in addition to FTP deletions and/or folder renaming.

Symlinks

After investigating a few bug reports, we found out that the SDK special logic that handles the automatic identification of the newest SDK was failing on some edge cases for test environments with symlinks, usually related to VVV (Varying Vagrant Vagrants). This version fixes those issues.

Optimization

  • We improved the logic that identifies the associated plugin's basename for edge cases when an add-on is including the parent plugin as part of the execution.
  • Optimized API connectivity error handling when specified cURL methods are disabled using the disable_functions directive in php.ini.
  • Optimized the Account page for premium only modules without a free version (e.g. showing "Cancel Subscription" instead of "Downgrade", hiding "Change Plan" button).

Development Mode / Debugging

We’ve added buttons to get and set DB options from the Freemius Debug page:
image

This is particularly useful for developers who migrated from EDD or WooCommerce and would like to investigate a failed license migration of a customer by first verifying that the customer really has a license key stored in the Database. You can do so by heading over to /wp-admin/admin.php?page=freemius, clicking on the Load DB Option button and entering the option name that should store the license key.

What's coming up?

Due to legacy reasons and a decision taken when we initially designed the WordPress SDK, all the SDK’s translatable strings are located in a single file (i18n.php) and one huge global array. While this design is pretty convenient and organized, it also means that all those strings are loaded into the memory every time the SDK is included. The whole file is 44Kb, but we received a few complaints from site owners on low-memory in shared hosting, that got a PHP memory exhausting exception after installing a Freemius powered plugin or theme. We decided to prioritize that issue and the next SDK release will incorporate a major change to our localization logic infrastructure, turning it to lazy load which will significantly reduce the SDKs memory consumption.

Official release notes: https://freemius.com/blog/mailchimp-and-seamless-freemium-checkout/

Replaced getmypid() with mt_rand(0, 32000) for logging

14 Mar 19:01
Compare
Choose a tag to compare

New In-Dashboard Checkout, Security Fixes, Better Logging.

10 Mar 22:46
Compare
Choose a tag to compare

New In-Dashboard Checkout

We have finally deprecated the current in-dashboard checkout and replaced it with the new checkout we use for Freemius Checkout. It will help us to be even agiler when it comes to changes and maintenance of the checkout form (only one code base). Plus, the new checkout is written in angular which makes it more sustainable for the long run.

image

This also means that the new in-dashboard checkout is now fully responsive! With an optimized mobile UX enabling easy purchase experience from any mobile device.
wp-admin-checkout-iphone6plus-with-frame

Some of you customized the checkout page with custom CSS stylesheet. Before you update to the latest SDK, make sure to adjust the CSS rules to work with the new checkout.

The "legacy" checkout will continue to be fully functional for backward compatibility. But, we won't be extending its functionality anymore nor fixing any future revealed bugs.

Security Fixes

  1. We discovered that many sites exposing their filesystem structure when typing a direct path to a folder without an index.php file. Besides the fact that it's insecure to expose your files/folders structure, search engine crawlers are indexing those pages. Therefore, we've added empty index.php files to all the SDK folders.

  2. XSS fix. We received a report from a fellow developer (Marcus Skies from Events Manager plugin) about unescaped string in the SDK. Indeed, we forgot to escape an optional error message on failed opt-in. The reason we didn't contact anyone is that the opt-in page is only available to users who have permissions to the WP Admin settings page. So if the user already had login access to that admin page, they can execute any JavaScript code anyway.

Translations

  1. The SDK is now almost fully localized to Japanese!!! Many thanks to Takayuki Miyauchi, @8bitOdyssey, Hidetaka Okamoto, Tomohyco Tsunoda. The SDK was actually fully localized, but we kept adding more features to the current version which came with additional strings.
    If you speak another language besides English, be awesome and help us translating the SDK to more languages:
    https://www.transifex.com/freemius/wordpress-sdk/dashboard/

  2. WP.org translations mechanism doesn't support more than one text-domain. I won't dive deep into the reason why we think it could be improved by supporting more than one, but what this means in practice is that even if you had only a few localized strings in your plugin or theme, by adding the Freemius SDK, the translations mechanism were automatically adding hundreds of strings to your product.
    Since the translation of strings is made per product, they all would have to be translated (even if they were already fully translated in a different plugin or theme, ignoring the translations that the SDK coming with).
    Joachim Jensen helped us solving that problem by wrapping all the methods in new ones and enriching the Gulp script that extracts the text domain related strings. So from now on the Freemius SDK strings won't be extracted by WordPress.org and won't affect your translations efforts. Thank you @intoxstudio!

Logging

Do to the complexity of the WordPress SDK that combines synchronous execution, WP-Cron, and AJAX calls. Inline logging is not enough to resolve edge cases. As we grow, the SDK is becoming more and more stable, having said that, we still see issues related to corruption in the Freemius data records. Those edge cases usually require production debugging from our end (WP Admin + FTP Access). We want to reduce that and investigate more issues on our end. Therefore, we enriched our logger for multi-session persistent DB logging with export capabilities. In plain words, when you turn on the debugging mode, the SDK will create a custom logging table and will start storing everything that happens with the SDK (whether it's synchronous or asynchronous requests). Then, you can download a CSV dump of that logs and send it to us for further investigation. Turning off the debug mode will drop the custom logging table (don't forget to turn it off!).

image

How to access the debug page?

To access Freemius debug page, go to https://path.to/site/wp-admin/admin.php?page=freemius.

How to turn the debug mode?

Click the Debugging switch:
image

Misc

  • We now fully support the use-case of plugins/themes without any setting page.
  • We've added a new Change License button to the Account page for changing the currently activated license:
    image
    This is helpful for developers who like to change the license key to the client's key before giving the site away to the client.
    Always show the deactivation feedback form since we added automatic free version deactivation upon premium code activation.
  • Serviceware mode: We've adjusted the SDK to work for Serviceware products without a premium code version. This unique mode hides all labels related to the plugin’s code type and the download instructions after upgrading. This mode was originally developed for Replyable which uses it a few months already, and we hope to see more services start using Freemius.
  • We improved the license key sender form to show the current's WP Admin email address.
    image
    The reasoning behind it is that when a customer upgrades from within the dashboard, if they opted-in before, we auto populate the email address to the checkout form, and sometimes customers ignore that filled and later forgot what was the email address they've used for the upgrade. This should solve that!
  • Better mechanism to test product updates: When running the SDK in dev mode with the secret key - deployed and unreleased versions are now will be available via the updates mechanism. That's another step for making testing easier, so you can test the version update mode of your version before releasing it to your users.
    Following this feature, we can relatively easily add a capability for beta testers. Users will be able to opt-in into becoming beta testers, and they will get the initial releases of your plugin (free or paid) before others. If that something that you'd want to see coming, let us know in the comments.

Version Contributors

Leo Fajardo
Vova Feldman
Joachim Jensen
Rami Yushuvaev

Official release notes: https://freemius.com/blog/dunning-in-dashboard-checkout-site-trials-march/