=== Cambia Utente ===
Contributors: DevFabio
Tags: woocommerce, login, users, administrator, customer
Requires at least: 6.5
Tested up to: 7.0
Stable tag: 1.5
Requires PHP: 7.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Log in as another user (e.g. a WooCommerce customer) to verify their access, orders and downloads.

== Description ==

Cambia Utente adds an admin screen that lists the site users and lets an
administrator log in as any of them with one click. It is handy for support and
debugging: you can check what a WooCommerce customer actually sees — active
orders, available downloads, account pages — without asking for their password.

How it works:

* A top-level **Cambia Utente** menu (icon: people) is added to wp-admin.
* The screen lists users with name and email and an **Log in** button each.
* Clicking a button replaces your session with that user's session and sends you
  to the site front page as that user.
* To go back to your account, log out and log in again as administrator.

Security:

* The screen and the switch action are restricted to users with the `edit_users`
  capability (administrators), customisable via the `cambia_utente_capability` filter.
* Every switch is protected by a WordPress nonce.
* The plugin stores no options, creates no tables and sends no data to external services.

== Installation ==

1. Upload the `cambia-utente` folder to `/wp-content/plugins/`, or install the
   plugin from the Plugins screen in WordPress.
2. Activate the plugin through the "Plugins" menu in WordPress.
3. Open the **Cambia Utente** menu in wp-admin and click **Log in** next to a user.

== Frequently Asked Questions ==

= Who can switch user? =

Only logged-in administrators (users with the `edit_users` capability). You can
change the required capability with the `cambia_utente_capability` filter.

= How do I switch back to my administrator account? =

Log out and log back in as administrator. The plugin performs a one-way switch by
design and keeps no impersonation state.

= Does it require WooCommerce? =

No. It works with any WordPress users. It is especially useful together with
WooCommerce to inspect a customer's orders and downloads.

= Does the plugin send any data to external services? =

No. Everything happens on your own site; no third party is contacted.

== Changelog ==

= 1.5 =
* Security: capability check moved to `edit_users`, all input is unslashed and
  sanitised, and the nonce is verified before any action.
* The user switch now runs on `admin_init`, clears the previous auth cookie and
  redirects after switching.
* Output is fully escaped; the inline `<style>` block was moved to an enqueued
  stylesheet loaded only on the plugin page.
* Added a guard against direct file access (ABSPATH check) and the
  `cambia_utente_capability` filter.
* Fixed the user display name (was reading a non-existent property).
* Completed the plugin header and rewrote the readme in English with a Stable tag
  and License URI (the previous readme had no Stable tag).

= 1.4 =
* Previous public release.

== Upgrade Notice ==

= 1.5 =
Recommended security and reliability update: stricter capability and nonce checks,
fully escaped output, and a proper Stable tag.