manifest / ecommerce / hdwebmobile-delivery-zones

HDWebmobile Local Pickup & Delivery Zones

Postcode-based delivery zone fees, resolved server-side from the shopper's own address -- never accepted from the request.

by htrxuan - Han Tran · github.com/htrxuan/hdwebmobile-delivery-zones · website

★ 0stars

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/htrxuan/hdwebmobile-delivery-zones/archive/refs/heads/master.zip

No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Readme github.com/htrxuan/hdwebmobile-delivery-zones ↗

Postcode-based delivery zone fees, resolved server-side from the shopper's own address -- never accepted from the request.

WordPress.org: https://wordpress.org/plugins/hdwebmobile-delivery-zones/
Requires: WordPress 6.9+, WooCommerce, PHP 7.4+
License: GPLv2 or later

Description

Adds a fee (or a free local-pickup note) for orders shipping to postcodes you choose. There is nothing for a shopper to select at checkout -- the matching zone, and its fee, are resolved automatically from their own shipping address.

Why this plugin exists

Several competing delivery-zone and local-pickup plugins computed the matching zone and its fee in client-side JavaScript from a zone list already embedded in the page, then trusted a hidden checkout field carrying either the chosen zone id or the fee amount when the order was placed (CWE-602, Client-Side Enforcement of Server-Side Security). Editing that field let a shopper claim a zone their address didn't belong to, or submit a lower fee outright.

This plugin has no such field to tamper with in the first place:

There is no zone-selection field on the checkout form at all. The applicable zone is always looked up from the shipping postcode WooCommerce's own customer object is currently tracking -- never a value read from the request.
The fee actually charged is always re-read fresh from the matched zone's own saved configuration by its id, right before it's applied -- never a number supplied by anything else.

Features

Any number of zones, each matched by exact postcodes or a wildcard prefix (e.g. "9021*")
An optional fee per zone, and an optional note shown at checkout (e.g. pickup instructions)
Works identically on classic and block-based checkout

Limitations

Postcode-based matching only -- no city/state or radius-based zones in this version
One fee per matched zone; the first matching zone wins if postcode patterns overlap

Installation

Upload to /wp-content/plugins/hdwebmobile-delivery-zones, or install through the WordPress plugins screen.
Activate. WooCommerce must already be installed and active.
Go to WooCommerce > HDWebmobile > Delivery Zones to add your zones.

Development

includes/
  class-hdlpz-activator.php   activation check
  class-hdlpz-core.php        bootstraps admin + frontend
  class-hdlpz-repository.php  zone config + postcode matching -- see its docblock for the security design
  class-hdlpz-admin.php       hub tab, zone table, admin-post save handler
  class-hdlpz-frontend.php    fee/note applied from the customer's own shipping postcode
  class-hdlpz-hub.php         shared HDWebmobile admin hub (see the suite's other plugins)

License

GPLv2 or later — https://www.gnu.org/licenses/gpl-2.0.html