Correção
- Freemius addon licenses: compare a normalised site identity (lowercased host without www.; scheme, port and trailing slash ignored), so a move from HTTP to HTTPS keeps the license active.
- Freemius addon licenses: a license record copied from another site (for example a cloned database) is replaced on activation with a fresh install identity, so the copy never takes over or releases the original site's install. The install uid is bound to the site it was generated for and is regenerated on any other site; an existing uid beside this site's license record is kept on upgrade.
- Freemius addon licenses: only a 401, 403, 404 or 410 answer marks a license inactive. Other errors and network failures keep the last known state, and a later successful refresh turns the addon back on.
- Addons that were active before licensing applied to them (for example the Mono editor theme) stay enabled without a license; new activations require one.
- License page: the Bundle row reads its provider from a Bundle addon, so a Freemius Bundle license shows the right controls.
- License page: help text and revoke confirmations describe the one-domain-at-a-time rule for Lumise.com licenses.
- Session table upgrade: remove duplicate rows (newest row per name kept) before adding the unique index, check that the index exists afterwards, and log a failure instead of continuing silently.
Segurança
- Direct license service: always use the production HTTPS endpoint. The development host list is removed; the only override is the LUMISE_DIRECT_SERVICE_URL constant, which must be HTTPS (HTTP is accepted only when the WordPress environment type is local).
- Direct license service: the lumise_direct_license_api_base_url filter is removed. Use the LUMISE_DIRECT_SERVICE_URL constant to point at another service (HTTPS only; HTTP only when the environment type is local).
- Direct licenses: reject an empty or mismatched active_domain in the license service answer and in the stored record, so a license is never treated as active on a domain it is not bound to.
- Update feed: always contact the update service over HTTPS instead of following the scheme of the current admin request.
- Escape the core and Bundle license notices and the cart thumbnail background colour.
