Freefactu - Toolkit para Verifactu
| 开发者 | aleixpellicer |
|---|---|
| 更新时间 | 2026年10月10日 00:38 |
| PHP版本: | 8.2 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
Freefactu is a free, open-source helper plugin for WooCommerce that provides technical tools to assist with invoicing workflows related to Spain’s AEAT VeriFactu framework.
The plugin offers functionality to generate digitally signed electronic invoice data, manage invoice records, and interact with AEAT environments based on publicly available technical specifications.
Freefactu is not certified, not approved, and not endorsed by the Agencia Tributaria (AEAT). The use of this plugin does not guarantee compliance with any legal, tax, or regulatory obligations. Users are solely responsible for ensuring that their invoicing practices comply with applicable laws and regulations.
This plugin does not constitute legal, tax, or accounting advice.
安装:
- Upload the
freefactufolder to/wp-content/plugins/ - Activate the plugin via the WordPress Plugins menu
- Access the plugin via WooCommerce settings
- Configure required technical and business parameters
- Test configuration in AEAT test environment before any production use
屏幕截图:
常见问题:
Is this plugin certified by AEAT?
No. This plugin is not certified, approved, or endorsed by AEAT.
Does this plugin guarantee legal or tax compliance?
No. Compliance depends entirely on correct configuration, usage, and legal interpretation by the user.
Is this plugin a replacement for professional tax advice?
No. This plugin is a technical tool only.
Who is responsible if AEAT rejects my submission?
The user is solely responsible for submitted data and resulting consequences.
更新日志:
1.1.2
- Correct the remaining duplicate AEAT legal and privacy links beneath the API endpoint documentation.
- Enable saving and selecting the AEAT production environment.
- Fix sanitization for both settings groups and preserve certificate passwords exactly before encryption.
- Remove the zero-date database default and verify invoice table existence after activation.
- Update Dompdf to 3.1.6 and retain Endroid QR Code 6.0.9 for PHP 8.2 compatibility (6.1.3 requires PHP 8.4).
- Correct AEAT legal and privacy links.
- Update bundled Guzzle dependencies to releases without known security advisories.
- Check PHP extension requirements before loading dependencies and retain library license files in release builds.
www3.agenciatributaria.gob.com.es) to the official AEAT production domain (www1.agenciatributaria.gob.es). Updated readme documentation to reflect the correct endpoints. Updated compatibility to WordPress 7.1.
1.0.0
- First stable release
- Update: Minor bump for automated SVN publishing
- Security: Added explicit nonce verification and capability check at the top of sanitize_settings()
- Security: Added sanitize_text_field() to $_FILES tmp_name fields in both certificate upload paths
- Security: Added sanitize_text_field() and wp_unslash() to $_POST['option_page'] access
- Documentation: Updated External Services section with exact endpoint URLs matching source code
- Documentation: Listed all four AEAT domains (prewww1, prewww2, www3, www2) with explicit Terms/Privacy links
- Documentation: Added phpcs:ignore comments to DOMPDF PDF templates explaining inline CSS requirement
- Code Quality: Removed redundant nonce check in certificate upload block (now validated at function entry)
- Security: Added esc_attr() escaping to all boolean ternaries in HTML class/style attributes
- Security: Added explicit nonce and capability checks to settings certificate upload
- Security: Added sanitize_file_name() and is_uploaded_file() to certificate uploads
- Updated: endroid/qr-code from v5.1.0 to v6.0.9 (major version migration)
- Updated: dompdf/dompdf from 3.1.4 to 3.1.5
- Updated: josemmo/verifactu-php from 0.3.3 to 0.3.4
- Code Quality: Renamed 8 generic Aeat_ classes to Freefactu_Aeat_ prefix
- Code Quality: Comprehensive output escaping audit across all templates
- Dependency structure: Moved scoped dependencies from deps/ to vendor/ per WordPress.org reviewer guidelines
- Distribution: composer.json now included in plugin submission
- Build: Updated PHP-Scoper output to target vendor/ directory
- (changelog pending)
- Security: Replaced direct active_plugins manipulation with WordPress activate_plugin/deactivate_plugins API
- Security: Added nonce verification to ajax_get_declaration handler
- Documentation: Enhanced External Services section with complete AEAT endpoint documentation
- Documentation: Added Terms of Service and Privacy Policy links for AEAT
- Documentation: Improved PHPCS ignore comments with security explanations
- Code Quality: Enhanced docblocks for output escaping safety documentation
- Security: Improved input sanitization and output escaping
- Security: Replaced move_uploaded_file() with wp_handle_upload()
- Security: Secured uninstall.php with proper capability checks
- Improvement: Converted inline scripts/styles to wp_enqueue functions
- Improvement: Added direct file access protection
- Documentation: Added external services disclosure in readme.txt
- Updated: DOMPDF library to latest stable version
- Initial public release
- Technical invoicing tools related to VeriFactu specifications
- Digital signature support
- Invoice data export
- AEAT test and production environment configuration
- Snapshot-based invoice storage
- Error reporting workflows