Joolweb Sessions Pro

Coaches and wellness professionals need to manage clients, sessions and payments without juggling multiple tools. Many already use WordPress; Sessions Pro brings that workspace onto your site. Compatible with WordPress 5.8 through 7.1 (tested on WordPress 7.1). Ready for PHP 8.5 (tested on staging). Built for people you already work with Sessions Pro is a client and session manager for one-to-one coaches: sports, wellness, and similar professions. You keep client files, session history, bundles (packs of sessions), payment status, and emails on your WordPress site. The free version on WordPress.org is fully usable for that daily work, including CSV client import. It is not a public appointment-booking calendar. Visitors cannot pick a free slot, pay, and confirm without already being your client. If that is your main need, a dedicated booking plugin is a better fit. Sessions Pro starts from the relationship: you add the client, you plan the work, the client gets a private area. What you can manage

• Clients: create, edit, and import (CSV); each client gets a WordPress account for a private area
• Sessions: create, edit, cancel, statuses, location or video
• Bundles: reusable models (for example a 10-session pack) and per-client progress
• Payments: manual status on each session (paid / pending / refunded)
• Emails: confirmation, updates, cancellation, and automatic reminders (for example 24 hours before)
• Schedule: admin dashboard (today / this week), session list, and .ics files in client emails
• Settings: cancellation delay, email header, appearance

Coaches work primarily from the WordPress admin (Joolweb Sessions Pro dashboard). A mobile-friendly coach front (upcoming sessions, quick actions) complements the admin when you are on site. Clients get a dedicated area (sessions, payment status, history). Premium add-on (separate install): Stripe online payments, CSV client export, physical measurements, email/login branding, and optional slot requests from existing clients against a remaining bundle. See sessionspro-app.com. French (fr_FR) translations are included in the plugin package (languages/joolweb-sessions-pro-fr_FR.mo) for the admin and front-end UI when your site or user locale is French.

1.1.20

• Fix: is_coach_or_admin() now checks the given user (Google Calendar can fetch the Premium iCal feed for WordPress admins).
• Fix: forfait session confirmation emails send/resend from the bundle table; batch no longer dates unscheduled sessions.
• Fix: bundle installment (versement) save accepts European dates.
• Feature: completed bundles stay visible in the client area with a Terminé badge; remaining balance still shows in Payments.
• Feature: admin sessions list can be filtered by client.
• i18n: French overlay for recent settings and client-area strings.

1.1.19

• Plugin Check: Tested up to set to WordPress 7.1.
• Plugin Check: pagination links copy query args from the base URL (no raw $_GET scan).
• Plugin Check: CSV upload tmp_name sanitized before is_uploaded_file().
• Plugin Check: bundle session-date helper re-checks the AJAX nonce before reading $_POST.
• Security (WordPress.org review): session notes AJAX uses a single check_ajax_referer() (no $stop = false).
• Security: output buffering removed from client/notes modals; wp_editor() is echoed directly in the footer.
• Security: tighter sanitization for settings arrays, CSV uploads, session-date JSON, query args, and meta box fields.
• Security: public client registration handler no longer creates users (coach-created accounts only).

1.1.18

• Feature: client emails (confirmation, reminder, reschedule) now include an .ics calendar attachment and an "Add to Google Calendar" button so clients can save the session in their personal agenda.
• Removed: front-end calendar page ([joolwebsp_calendar] / FullCalendar) — planning is handled via admin (future) or iCal sync (Premium). ~285 KB of vendor JS removed from the package.
• Removed: Stats tab from the coach dashboard front (data available in admin dashboard only).
• Removed: "Add to my calendar" subscribe button from the coach dashboard (Premium iCal subscription available in Settings → Calendar).
• Fix (Premium): "sessions left to book" badge no longer clips the bottom border.

1.1.17

• Security (WordPress.org review): admin client form verifies nonce before reading POST; coach client ownership validated via assert_editable_client_target() before wp_update_user().
• Security: AJAX handlers call core check_ajax_referer() at the start of each method (before reading $_POST).

1.1.16

• Fix: load plugin bootstrap and role checks on init (WordPress 6.7+ _load_textdomain_just_in_time notice for domain joolweb-sessions-pro).
• Fix: role display names and activation page titles no longer call translation functions before init.

1.1.15

• Security (WordPress.org review): dashboard HTML output uses core wp_kses() with a documented allowlist (joolwebsp_get_dashboard_allowed_html()).
• Security: Select2 vendor assets updated to 4.1.0; pagination nonce fail-early; bundle/program email sends require edit_programs plus client ownership.
• UX: past-session pagination keeps the Past panel active; client email log layout clarified (type, session, meta, status).

1.1.14

• Security (WordPress.org review): AJAX handlers use explicit check_ajax_referer(); admin forms and CSV import verify nonces before processing.
• Security: client welcome email sends a password-set link instead of a plaintext password.
• Security: client session booking AJAX is registered only when the booking feature is enabled.
• Privacy: suggested privacy policy content registered via wp_add_privacy_policy_content().
• Data: user phone meta migrated to prefixed key joolwebsp_phone (legacy phone read on upgrade).
• i18n: French (fr_FR) .mo included in the distribution package.
• Packaging: development-only premium helpers and CLI tools excluded from the WordPress.org archive.
• Code quality: Plugin Check annotations for joolwebsp_esc_dashboard_html() output in admin list columns and client financial/overview sections.

1.1.13

• Security hardening: pagination links on coach client pages and coach clients list now include nonce verification.
• Security hardening: admin badges and email status labels wrapped with joolwebsp_esc_dashboard_html() at output.
• Security hardening: boolean HTML data attributes use esc_attr() (bundle recap, welcome email buttons).

1.1.12

• WordPress.org review compliance: fixed Author URI (sessionspro-app.com); wp-cron helper URL now uses site_url() instead of home_url().
• Security: explicit nonce verification on setup wizard settings save; capability checks on admin customer file (create/edit).
• Security: late output escaping on admin customer views, client page template, setup wizard, and session list modals (joolwebsp_esc_dashboard_html()).
• Fix: session notes modal output moved to wp_footer for wp_editor compatibility while keeping the client page buffer safely escaped.

1.1.11

• Optional anonymous usage telemetry (opt-in only): Settings → Privacy and setup wizard; weekly reports to sessionspro-app.com when enabled.
• Privacy section added to readme; no external calls unless the site administrator opts in.
• Fix: telemetry payload includes all required feature flags (csv_import_used); fixes HTTP 400 invalid_payload.
• Fix: plugin upgrade reports use heartbeat (not upgraded) to avoid HTTP 401; installation_id kept across updates (new id only after opt-out).

1.1.0

• Internal: rename legacy RGSM_* PHP classes to Joolwebsp_* (pre-release cleanup).
• Admin menu slug: joolwebsp (redirect from legacy wp-sport admin URLs).
• Internationalization: updated translation template; French (fr_FR) language files included in the plugin package.
• Admin: clearer test-email failure hints (SMTP / local mail); client welcome flow without displaying passwords in the UI.

1.0.12

• WordPress 7.0 and PHP 8.5 compatibility (tested).
• Setup wizard: dedicated timezone step; session and email log times use site timezone (wp_date).
• Admin: maintenance screen removed; legacy cleanup remains available via WP-CLI on staging.
• Admin menu icon: calendar (dashicons-calendar-alt).

1.0.10

• WordPress.org compliance update and release packaging refresh.
• Premium split: Stripe SDK dependency moved to the premium add-on package.
• Dependencies: Select2 switched from 4.1.0-rc.0 to stable 4.0.13.
• Internationalization: fixed translators: comments for placeholder strings (correct placement immediately above __() in sprintf() contexts).
• Translation loading: removed manual load_plugin_textdomain() call (WordPress.org language packs are loaded by core).
• Code quality: refined PHPCS annotations for AJAX nonce-validated $_POST reads and narrowed SlowDBQuery suppressions for program-linked session queries.
• Internal cleanup: renamed field map key from meta_key to post_meta_key to avoid false positives from meta query sniffs.

1.0.08

• Security hardening and review readiness improvements:
• Added and enforced nonce/capability checks on sensitive operations.
• Improved output escaping across admin and frontend rendered content.
• Updated packaging rules and distribution archive exclusions for WP.org compliance.
• Updated dependencies:
• Stripe PHP SDK updated to v20.0.0.
• Chart.js updated to v4.5.1.
• Frontend build dependencies updated (including webpack-cli, css-loader, style-loader).
• Session update notification improvements:
• Client email wording changed from "rescheduled" to "updated".
• Client email now includes location/link update context when session details change.