Correção
- Replaced public quote PDFs with private temporary attachments and removed legacy Quotes.pdf files.
- Disabled remote resources, PHP execution, and JavaScript in PDF rendering; external/CDN images are omitted.
- Added permission checks to administrative AJAX actions and single/bulk PDF downloads; bulk downloads also require nonce validation.
- Enforced quote ownership, approved status, and enabled settings for customer conversions.
- Enforced ownership for current and legacy My Account quote details.
- Restricted quote, rule, and field administration to WooCommerce managers.
- Protected quote uploads with authorized downloads, signed guest links, and Apache/IIS access rules. Nginx requires equivalent rules.
- Validated cart conversion quote status and tokens, and corrected guest customer handling.