=== AffiliateBoxes.com Integration ===
Contributors: affiliateboxes, lapzor
Donate link: https://affiliateboxes.com/
Tags: affiliate, affiliate-marketing, product-box, gutenberg, shortcode
Requires at least: 5.9
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.1.1
License: GPLv3
License URI: https://www.gnu.org/licenses/gpl-3.0.html

Display AffiliateBoxes.com products with a block or shortcode. Box and table content is synced automatically and stored in your WordPress site.

== Description ==

AffiliateBoxes.com Integration lets you insert rich affiliate product "boxes" created in your AffiliateBoxes.com account into WordPress posts, pages, and custom post types. Changes to the products are automatically synced to your WordPress site.

Features:

- Auto-sync: products synchronize automatically after changes on AffiliateBoxes.com.
- Gutenberg block: pick a product from your synced list with instant preview.
- Shortcode: `[affiliateboxes_product slug="your-product-slug"]` for use anywhere.
- Manual refresh: force a sync from the plugin settings screen.

You'll need an AffiliateBoxes.com account (free plan available) to connect your site.

= How product content is handled =

A synced product is stored as two separate values: its markup and its stylesheet. The markup is passed through `wp_kses()` against an explicit allow list every time it is displayed, so no scripts, event handlers, or unrecognised elements can reach your pages. The stylesheet is loaded through WordPress's standard `wp_enqueue_style()`/`wp_add_inline_style()` APIs (rather than being printed as a raw `<style>` tag), after any sequence that could break out of it has been removed. All interactive behaviour — coupon panels, galleries, copy to clipboard — is driven by a script that ships with this plugin, registered through `wp_enqueue_script()` and triggered by data attributes.

The allow list can be extended from your own code with the `affiliateboxes_allowed_html` filter.

== External Service ==

This plugin connects to AffiliateBoxes.com to synchronize and display the products created in your AffiliateBoxes.com account. The service is operated by the makers of this plugin.

It makes remote requests to AffiliateBoxes.com endpoints over HTTPS for:

- Site connection and verification
- Listing and synchronizing your products
- Retrieving product display content: the markup and stylesheet for a box or table

When requests happen:

- When you connect your site from the plugin settings page
- When you manually synchronize products
- When AffiliateBoxes.com pushes product updates to your site
- During rendering if stored product content is missing or a refresh is explicitly requested

Data that may be sent includes:

- Site URL/domain
- Product identifiers/slugs
- Request authentication/signature data
- Plugin/version context needed for compatibility

Why this service is required:

- AffiliateBoxes.com generates and manages the box and table content based on your account and product settings. This plugin is the integration layer that syncs that content and displays it.

Service terms and policies:

- Terms of Service: https://affiliateboxes.com/terms/
- Privacy Policy: https://affiliateboxes.com/privacy/

== Third-Party Libraries ==

This plugin bundles the following libraries. All are GPL-compatible, and both minified and
unminified builds are included where the upstream project provides them.

- Action Scheduler 3.x — GPLv3 — https://github.com/woocommerce/action-scheduler
- Bootstrap 5.3 — MIT — https://github.com/twbs/bootstrap
- Bootstrap Icons 1.13 — MIT — https://github.com/twbs/icons
- Choices.js 11.1 — MIT — https://github.com/Choices-js/Choices
- Inter (webfont) — SIL Open Font License 1.1 — https://github.com/rsms/inter

Bootstrap, Bootstrap Icons, Choices.js, and Inter are loaded on this plugin's own admin screens only. The admin stylesheet is compiled from the SCSS sources in `admin/scss/` of the plugin's repository.

== Installation ==

1. Upload the plugin files to the `/wp-content/plugins/` directory or install via Plugins → Add New.
2. Activate the plugin through the 'Plugins' screen in WordPress.
3. Go to Affiliate Products in your WP Admin menu and click Connect to link your site with AffiliateBoxes.com.
4. Use the "Affiliate Product" block in the editor, or add the shortcode where needed.

== Frequently Asked Questions ==

= Do I need an AffiliateBoxes.com account? =
Yes. Create products on AffiliateBoxes.com, then connect your WordPress site from the plugin settings.

= How do I insert a product with a shortcode? =
Use: `[affiliateboxes_product slug="your-product-slug"]`
Shortcodes are shown underneath the product when editing on AffiliateBoxes.com and listed on WP Admin under the Affiliate Products menu once the site is connected.

= Can I refresh products manually if things are out of sync? =
Yes. Use the "Force Synchronize" button on the settings screen to refresh immediately.
There is also a refresh button on the Gutenberg block that will refresh that specific product.
However, normally you would never need to do this, changes are sent to your WordPress site immediately when you save changes on AffiliateBoxes.com.

= My boxes disappeared after updating to 1.1.0 =

They come back on their own. Version 1.1.0 changed the stored format, so a product synced by an
earlier version re-syncs the first time it is displayed. If a box stays empty, press "Force
Synchronize" on the settings screen, and check that your site is still connected.

= Connections to AffiliateBoxes.com fail with an SSL certificate error =

All requests to AffiliateBoxes.com verify the TLS certificate, as they should. A small number of
hosts ship an outdated or incomplete CA bundle, which can make verification fail even though the
certificate is valid. If your host is affected and cannot update its CA bundle, you can opt out of
verification for requests to AffiliateBoxes.com only, by adding this to your theme's functions.php
or a site-specific plugin:

`add_filter( 'http_request_args', function ( $args, $url ) {
	if ( false !== strpos( $url, 'affiliateboxes.com' ) ) {
		$args['sslverify'] = false;
	}
	return $args;
}, 10, 2 );`

This weakens the security of those requests, so treat it as a temporary workaround and ask your host
to fix their CA bundle. The plugin deliberately does not expose this as a setting.

== Screenshots ==
1. Settings screen with synchronization controls and available products list.
2. Inserting a product via Shortcode
3. Gutenberg editor block

== Changelog ==

= 1.1.1 =
* Breaking: the `[affprod]` and `[afftable]` shortcodes have been replaced by `[affiliateboxes_product]` and `[affiliateboxes_table]`. Update any posts, pages, or templates that use the old tags — they are no longer registered. The `[affiliateboxes]` shortcode is unaffected.
* Product stylesheets are now loaded through `wp_register_style()`/`wp_add_inline_style()` instead of being printed as a raw `<style>` tag on the page.
* Added `lapzor` to the Contributors list.

= 1.1.0 =
* Product content is now retrieved as separate markup and stylesheet, and the markup is sanitized with `wp_kses()` against an explicit allow list every time it is displayed. The previous format, which stored and printed a remote script, has been removed entirely.
* Box behaviour (coupon panels, galleries, copy to clipboard) now runs from a script bundled with the plugin, triggered by data attributes.
* Added the `affiliateboxes_allowed_html` filter for extending the sanitizer's allow list.
* Diagnostic messages now go to the standard WordPress debug log instead of a plugin-owned directory under `wp-content/`. The old directory is removed on uninstall.
* Uninstalling now removes everything the plugin created, including its options, transients, and queued background jobs.
* Activating the plugin no longer redirects you to the settings screen. It shows a dismissible notice on the Plugins screen instead, which survives bulk activation and does not fight other plugins for the redirect.
* Added a "Settings" link under the plugin name on the Plugins screen.
* Fixed: the first sync after connecting a site no longer asks you to confirm deleting synced products. That confirmation belongs to the Force Synchronize button, which does reset local data, and it had nothing to warn about on a fresh connection.
* Products synced by an earlier version re-sync automatically the first time they are displayed.

= 1.0.0 =
* Initial release: Connect, Synchronize, Gutenberg block, shortcode.

== Upgrade Notice ==

= 1.1.1 =
Breaking: [affprod] and [afftable] shortcodes are renamed to [affiliateboxes_product] and [affiliateboxes_table]. Update any content using the old tags.

= 1.1.0 =
Product content is now sanitized before display and no longer stored as a remote script. Existing products re-sync automatically on first view.

= 1.0.0 =
Initial release.