پنل کاربری آبیس

English | فارسی

A standalone WordPress and WooCommerce plugin that provides a complete, responsive RTL customer account experience: OTP authentication, orders, addresses, support tickets, returns, wishlists, notifications, and partner pricing.

This repository is the reviewable portfolio edition of the plugin. It contains no API keys, SMS credentials, or real customer data.

Overview

Abis User Panel replaces the standard WooCommerce “My Account” experience with a unified Persian interface. It creates the required login and panel pages on activation and keeps the main customer workflows in one application-style dashboard.

• Version: 1.3.5
• WordPress: 6.4+
• PHP: 8.0+
• WooCommerce: 8.0+
• Interface: Persian (RTL)
• License: GPL-2.0-or-later

Features

Authentication and account security

• Sign-in and registration with a mobile number and one-time password
• Password sign-in using a mobile number or email address
• OTP and password modes can be enabled together
• OTP state survives page refresh until it expires
• OTP codes are stored as time-limited hashes
• Request and verification-attempt throttling by IP address and mobile number
• Recent login history with hashed IP addresses
• Password creation and changes from the customer panel

Dashboard and orders

• Active and completed order statistics
• Latest active order and progress timeline
• WooCommerce order list and details
• Shipping, payment, tracking, and line-item information
• Declared compatibility with WooCommerce HPOS

Wishlists and addresses

• Account-based wishlist storage and synchronized storefront hearts
• One-time migration of legacy localStorage data
• Multiple saved addresses and a default-address selector
• Location selection with Leaflet and OpenStreetMap
• Coordinates, building number, unit, and postal code storage
• Default-address synchronization with WooCommerce billing and shipping fields

Support and returns

• Create, reply to, and close support tickets
• Image and PDF attachments with server-side size and type validation
• Item-level return requests for eligible orders
• Up to four return images
• Status workflow from review through receipt and refund
• Staff notes and result notifications inside the panel

Partners and wholesale pricing

• Partner applications with supporting documents
• Protected document storage and authorized downloads
• Dedicated abis_partner role without removing existing roles
• Wholesale prices for simple products and individual variations
• Price application in the catalog, cart, checkout, and order

Administration

• Dedicated management dashboard
• Ticket, notification, return, and partner-application management
• Page, color, login-copy, and return-window settings
• Built-in Amoot SMS and Melipayamak integrations
• Custom HTTP SMS provider with form, JSON, or raw request bodies

Security design

• SMS credentials are entered only in WordPress settings and are not included in this repository.
• SMS configuration is restricted to users with manage_options.
• SMS endpoints require HTTPS and use the WordPress Safe HTTP API.
• OTP values are never stored as plaintext.
• State-changing operations enforce nonces and authentication or capability checks.
• New ticket and return attachments receive random names, are stored under a protected path, and are served through an access-controlled endpoint.
• Order, ticket, address, return, and partner-document ownership is checked before data is read or changed.
• File size and actual MIME type are validated on the server.

See SECURITY.md for vulnerability reporting and operational notes.

Installation

1. Copy abis-user-panel to wp-content/plugins/, or upload a ZIP from the WordPress Plugins screen.
2. Activate Abis User Panel.
3. The abis-login and abis-panel pages are created automatically.
4. Configure an SMS provider under Abis User Panel → SMS & OTP Login.
5. Send a test message, then verify the login page and customer workflows on a staging site.

Never place credentials in project files or commits. Enter them only through the WordPress administration settings.

Shortcodes

[abis_otp_login]
[abis_user_panel]
[abis_wishlist_button]

For a specific product:

[abis_wishlist_button product_id="123"]

SMS providers

• Amoot SMS: pattern, Quick OTP, and regular messages
• Melipayamak: pattern / BaseServiceNumber and regular messages
• Custom HTTPS: GET, POST, PUT, and PATCH with form, JSON, or raw bodies
• Custom headers, parameters, response validation, and template variables

For local development without TLS, the abisup_allow_insecure_sms_endpoint filter is available. Enabling it in production is not recommended.

Project structure

abis-user-panel.php              Plugin entry point and bootstrap
includes/                        Domain logic and modules
  class-auth.php                 OTP, registration, and sign-in
  class-panel.php                Customer UI and account actions
  class-tickets.php              Tickets and conversations
  class-returns.php              Return workflow
  class-partners.php             Partners and wholesale pricing
  class-private-attachments.php  Protected attachment storage and delivery
assets/css/                      Administration and customer styles
assets/js/                       AJAX and interface behavior
assets/icons/                    SVG icon set

Extension hooks

Notable filters:

• abisup_sms_providers
• abisup_active_order_statuses
• abisup_estimated_delivery
• abisup_user_questions_content
• abisup_allow_insecure_sms_endpoint

Notable actions:

• abisup_user_registered
• abisup_otp_send_failed
• abisup_sms_attempt
• abisup_ticket_created
• abisup_ticket_user_replied
• abisup_ticket_admin_replied

Development and verification

Lint all PHP files:

find . -type f -name '*.php' -print0 | xargs -0 -n1 php -l

GitHub Actions also checks PHP syntax and scans the repository for potential secrets.

Data and privacy

The plugin stores account, address, ticket, return, partner-application, and login-history data in WordPress. Site operators must define retention, privacy, backup, and administrator-access policies appropriate to their jurisdiction.

The map loads Leaflet 1.9.4 with Subresource Integrity from unpkg, retrieves map tiles from OpenStreetMap, and sends a selected search term or coordinates to Nominatim for geocoding. These data transfers should be disclosed in the site's privacy policy.

Changelog

See CHANGELOG.md.

License

Released under GPL-2.0-or-later.