Mobimint Mobile App Builder for WooCommerce -- WordPress 插件

开发者	pawank1
更新时间	2026年6月30日 18:50

Mobimint Mobile App Builder for WooCommerce is a WordPress plugin that allows store owners to convert their WooCommerce website into a fully functional Android and iOS mobile app without writing any code. The plugin syncs WooCommerce products, categories, cart, checkout, and orders with a connected mobile application. Merchants can customize the app design, manage banners, and engage customers using push notifications — all from a single dashboard. This plugin is designed exclusively for WordPress + WooCommerce based ecommerce stores.

Upload the plugin files to the /wp-content/plugins/mobimint-mobile-app-builder/ directory.
Activate the plugin through the Plugins screen in WordPress.
Go to Mobile App Builder ‑ Mobimint → Settings in the WordPress admin panel.
Configure the required app and WooCommerce settings.
Save settings.

1.8.4

Rebuilt mobile checkout UI — fully redesigned CSS with improved layout, spacing, and visual feedback for cart, address, shipping, and payment steps
Mobile checkout: added qty-stepper click handlers and auto-accept-terms helper for seamless checkout flow
Mobile checkout: accent colour now sanitized via preg_replace + sanitize_text_field before use in inline CSS
Added account deletion REST endpoint (DELETE /mobimintmab/v1/delete-account) for mobile app
HyperPay callback detection: expanded to handle &-encoded parameter variants, sanitized all $_GET reads, added phpcs:ignore NonceVerification annotations
Mobile order-pay template: improved failed-callback state detection covering resourcePath, transaction-key, and callback variants
Mobile thank-you page: improved colour sanitization and output escaping
Mobile wrapper: updated default accent colour to #2563EB

1.6.3

Fixed Apple and Facebook social login — both providers were blocked by a server-side allowlist that only permitted Google
Added Apple sign-in token verification: Apple identityToken (JWT) is now verified against Apple's JWKS endpoint (appleid.apple.com/auth/keys) using RSA-SHA256 signature check
Added Facebook sign-in token verification: Firebase ID token (JWT) sent from the Facebook+Firebase Auth flow is now verified against Firebase's public X.509 certificates (googleapis.com) using RSA-SHA256 signature check
Added Apple ID (appleid.apple.com) and Google Firebase (googleapis.com) to readme External Services section

1.6.2

Loyalty: added normalize_domain() helper — shop domain is always stored and compared as a bare hostname (strips https://, trailing slashes, lowercases) regardless of how it was entered
Loyalty: ping_api() now uses dedicated /api/loyalty/health endpoint for more reliable connection checks

1.6.1

Loyalty admin dashboard now detects first-time setup — shows a "Setup Required" badge and welcome card with a direct link to Settings when no configuration has been saved yet
API ping is skipped until settings are saved, avoiding false "API Disconnected" warnings on fresh installs
Added phpcs:ignore annotations for tab/saved GET params in render_admin_page (display-only, no security impact)

1.6.0

Added Loyalty & Rewards module: admin settings page, VIP tiers, points balance, rewards redemption (virtual LYL* coupons), transaction history, referral links, storefront widget, WooCommerce My Account tab, and mobile REST API proxy endpoints
All loyalty outbound calls (order/customer webhooks, widget settings sync, storefront widget JS) are gated behind the existing admin data-sync consent option — no data is sent without explicit opt-in
Loyalty module and widget default to disabled; admin must explicitly enable each feature
Fixed unescaped class-attribute output in admin loyalty template (esc_attr added)
Prefixed template helper functions with mobimintmab_ to satisfy PrefixAllGlobals rule
Used wp_kses_post() for wc_price() HTML output in account loyalty template
Applied sanitize_text_field/wp_unslash to widget_position POST field
Updated External Services section in readme to document loyalty data flows and widget JS source

1.5.26

/send-notification endpoint now accepts optional from_name and from_email fields in the JSON payload; values are sanitized (sanitize_text_field / sanitize_email + is_email validation) and fall back to WooCommerce email settings when not supplied

1.5.25

Added consent gate to send_keys_to_external() calls in generate_api_keys_if_needed() — WooCommerce API keys are only sent to api.mobimint.co after admin opts in
Added consent gate to mobimint_send_notification_event() — push notification events (order status, abandoned cart, etc.) are only sent to api.mobimint.co after admin opts in
All external calls to api.mobimint.co are now blocked until the admin explicitly grants consent via the plugin settings page

1.5.24

Added consent form to the active root plugin file's render_admin_page() — the consent opt-in was only present in a dead includes file that WordPress never loads
Dashboard container now only renders after admin grants consent; without consent, only the opt-in form is shown

1.5.23

Switched admin dashboard fetch from REST API to wp_ajax (admin-ajax.php) — eliminates rest_cookie_invalid_nonce and rest_forbidden errors caused by the REST API cookie authentication middleware on certain hosts
New auto_login_ajax_handler() uses check_ajax_referer() + current_user_can('manage_options') for secure, standard WordPress authentication
Added ajaxUrl and dashboardNonce to wp_localize_script in the active root plugin file (fixes prior nonce key missing from MobimintMabVars)

1.5.22

Replaced X-WP-Nonce header authentication with a custom body nonce (_mobimintmab_nonce) to avoid triggering WordPress REST cookie middleware (rest_cookie_check_errors) — eliminates the rest_cookie_invalid_nonce 403 on certain hosts
/auto-login permission_callback now verifies wp_verify_nonce() on the body nonce plus current_user_can('manage_options'); no X-WP-Nonce header is sent from validate.js

1.5.21

Moved /auto-login and /update-store-details REST endpoints out of public routes — now require current_user_can('manage_options')
Added consent check inside auto_login_proxy() — no store data is sent to api.mobimint.co until admin opts in
Removed checkout_nonce WebView login block — WordPress nonces are CSRF tokens, not authentication credentials; cart_token (cryptographic, one-time-use) is the only WebView login mechanism
Added X-WP-Nonce header to admin dashboard fetch call (validate.js) for proper REST API authentication

1.5.20

Consent form now blocks the React dashboard from loading until admin explicitly opts in — dashboard only renders after consent is saved
Improved consent UI: full-page card with bullet list of data sent, Privacy Policy and Terms links, and a clear checkbox before the Enable button

1.5.19

Fixed missing phpcs:ignore on checkout_nonce login block do_action('wp_login') in both plugin files

1.5.18

Added phpcs:ignore for do_action('user_register') — user_register is a WordPress core hook, not a plugin-defined hook name

1.5.17

Added phpcs:ignore for do_action('wp_login') calls — wp_login is a WordPress core hook, not a plugin-defined hook name

1.5.16

Added explicit data-sync consent checkbox on the admin page — data is only sent to api.mobimint.co after admin opt-in
All sync hooks (product, category, order, migration) are gated behind the stored consent option
Added do_action('user_register') after wp_create_user in social login flow so security plugins are notified
Added do_action('wp_login') after wp_set_auth_cookie in all mobile webview login flows so security plugins can intercept

1.5.15

Fixed phpcs NonceVerification warnings on $_GET reads inside cart_token and checkout_nonce auth blocks
Normalized line endings in mobile-thankyou.php (mixed CRLF/LF → LF)

1.5.14

Removed all error_log() debug calls from API class (Plugin Check compliance)
Fixed text domain: replaced hardcoded 'woocommerce' with 'mobimint-mobile-app-builder' in translation calls
Renamed template variables to use mobimintmab_ prefix to avoid global namespace conflicts
Replaced wp_redirect() with wp_safe_redirect() in mobile-order-pay template
Added phpcs:ignore annotations for WPML hooks, mobile REST context nonce exemptions, and schema-change queries

1.5.13

Restricted social login to Google only (server-side token verification via oauth2.googleapis.com)
Removed CSRF-vulnerable user meta writes from woocommerce_load_cart_from_session and standalone init hooks
Currency preference now only saved to user meta inside the authenticated cart_token validation block

1.5.12

Removed uninstall ping to external server (phoning home on plugin deletion)
Added proper permission_callback to all REST API routes (public vs authenticated)
Cart token is now consumed on first use to prevent replay attacks
Removed CSRF-vulnerable user meta update from unauthenticated GET currency hook
Added comments to clarify third-party plugin global variable references

1.5.11

Automatically register WooCommerce tax names and shipping method titles with Polylang
Tax and shipping labels now appear in Polylang String Translations screen for translation

1.5.10

Fixed cart API tax and shipping labels not translating for multilingual stores (Polylang)
Added pll__() lookup for tax labels and shipping method labels

1.5.9

Fixed cart API returning shipping and tax labels in wrong language for multilingual stores
Added language switching support via ?lang= query parameter (Polylang and WPML compatible)

1.5.8

Removed WP_DEBUG / WP_DEBUG_LOG constants from plugin code (must be set in wp-config.php only)
Moved admin menu position from 6 to 80 to respect WordPress core menu hierarchy
Replaced all inline and tags in templates with wp_add_inline_style() and wp_add_inline_script()
Removed debug-only logging hooks that passed unsanitized $_GET/$_POST values to error_log
Removed automatic deactivation/uninstall ping to external server (phoning home)
Renamed JavaScript variable McoVars to MobimintmabCheckoutVars for unique prefixing
Added Google OAuth (oauth2.googleapis.com) documentation to readme External Services section
Bumped plugin version to 1.5.8

1.5.7

Checkout webview improvements

1.5.6

Social Login Implementation fixing

1.5.5

Fixed Polylang Multilanauge pro issues
Social Login Implementation

1.5.4

Polylang Multilanauge implemented
Social Login Implementation

1.5.3

Removed obfuscated JavaScript
Included fully human-readable source code
Code compliance improvements for WordPress.org guidelines

1.5.2

Minor bug fixes
Stability improvements
Compatibility improvements

1.5.1

Removed obfuscated JavaScript
Included fully human-readable source code
Code compliance improvements for WordPress.org guidelines

1.5.0

UI improvements
Performance optimizations
Bug fixes

1.0.0

Initial release with WooCommerce mobile app integration

Mobimint Mobile App Builder for WooCommerce

标签

下载

详情介绍:

安装:

常见问题:

更新日志: