⚡STM Smart One Page Checkout Extension für Magento 2, schneller Checkout, Hyvä, Luma kompatibel – Mollie, Ayden, Klarna, Paypal u.m.⚡

Version 1.4.0 — 2026-03-09

• STM License Integration — license validation via stm/module-license module
• di.xml — Extension registration with STM\License\Model\ExtensionRegistry (key: ia24_onepagecheckout)

• composer.json — Added dependency stm/module-license: ^1.0
• module.xml — Added STM_License to module sequence

Version 1.3.1 — 2026-03-05

• Adobe Commerce Marketplace PHPCS Compliance: 0 ERRORS, 0 WARNINGS across all PHP/PHTML files
• Composer version constraints hardened (>= to ^ for all Magento dependencies)
• Header logo repositioned to the left with centered title and back-link
• Server-based changelog sync via sync-changelog.sh — automatic WooCommerce update on every Satis build
• Updated build-zip.ps1 with changelog sync integration

• PHTML line-length and indentation warnings (checkout.phtml, method-customizer.phtml)
• Empty catch blocks, missing DocBlocks, and inline control structures across all PHP files
• PHPCS rule conflict for multi-line function calls resolved by variable extraction

Version 1.3.0 — 2026-02-27

• Restored CSRF protection — removed global CSRF bypass plugin (CsrfValidatorSkip.php), Magento's form_key validation now active on all AJAX endpoints
• Added brute-force protection via Magento's AccountManagement lockout (UserLockedException)
• Fixed XSS vulnerabilities — all innerHTML injections now use escapeHtml() for server-supplied data
• Removed debug data (exception class names, stack traces) from all API responses — generic user messages only
• Added CSS color sanitization via sanitizeColor() for admin-configured theme colors
• Hardened CheckEmail endpoint — removed email from response, removed info-level logging of email addresses
• Hardened Login endpoint — removed email logging, added generic error messages for LocalizedException
• PII logging protection — 40+ log statements masked in PlaceOrder.php (email: first 3 chars, name: first 2, phone/street: fully masked, VAT-ID: last 4 only)
• SaveAddress.php logs only field names (array_keys()), not values
• All user inputs type-cast to (string) across all controllers — prevents PHP 8.1+ TypeError attacks
• Payment method regex validation (preg_match('/^[a-z0-9_]+$/i')) before setMethod()
• Shipping method validation with type casting and regex in SaveShipping.php
• Order comment sanitization: trim() + length limit 5000 chars via mb_substr()
• Custom icon path traversal protection: basename($filename) + check against . and ..
• Font-scale range validation (10-24) prevents CSS injection via oversized/zero scale values
• Coupon action whitelist: only apply and remove allowed, fallback to apply
• Double-submit protection: isPlacingOrder flag prevents duplicate order placement
• Fetch timeouts with AbortController on all 5 fetch calls (10s email/PLZ, 15s shipping/payment/login, 30s order)
• XHR postcode-lookup timeout: xhr.timeout = 10000 with onerror/ontimeout handlers
• Sensible POST-body logging removed from PlaceOrder.php (DSGVO/PCI compliance)
• Coupon code reflection sanitized — generic error messages instead of user-input echo
• showCouponMsg() type validation: whitelist check (success/error only)

• Virtual/downloadable products support (6 files): conditional shipping section, 2-step vs 3-step progress bar, auto-flow SaveAddress -> SaveShipping -> PaymentMethods, is_virtual flag in API responses
• Newsletter subscription functional: checkbox value sent in order payload, PlaceOrder.php subscribes customer via SubscriberFactory after successful order
• Newsletter hint text with privacy policy link: "(Jederzeit abstellbar, die Datenschutzerklarung habe ich gelesen.)"
• Separate agreement system: individual checkboxes for Terms, Privacy Policy, and Cancellation Policy with 9 config fields, required/optional toggle per agreement, bidirectional sync between sidebar and sticky bar
• Ultra-compact layout (4th layout variant): float-based 3-column architecture with address left, shipping+payment right-stacked, sidebar below — hides progress bar, header icons, sidebar logo, trust badges (~250 lines CSS)
• Header logo for ultra-compact layout: visible only in ultra-compact, uses backend settings via getLogoStyle()
• Numbered section headings (1-4): CSS counter with white digit in primary-color circle, accent-colored heading text
• Configurable header icon bar: 46 payment + 36 shipping icons, 3 custom upload slots, ICON_FILE_MAP with 80+ mappings, multiselect backend fields, grayscale filter with hover effects, 3 responsive breakpoints
• Typography backend fields: font family dropdown (13 options incl. Google Fonts), font size dropdown (7 options), font color picker
• Google Fonts loading: getGoogleFontUrl() with tags (only when Google Font selected)
• Font-size scaling system: CSS variable --ia24-font-scale with calc(Xpx * var(--ia24-font-scale, 1)) on all ~55 hardcoded font-sizes
• Font-color cascading: 7x heading color, 4x section text, 4x label color made dynamic via --ia24-font-color
• 33 SVG method icons created in view/base/web/images/method-icons/ (accessible in frontend and admin)
• Admin "Uber dieses Modul" section: version from ComponentRegistrar (reads composer.json), features grid, AJAX contact form via TransportBuilder
• Admin email template for support requests (etc/email_templates.xml)
• Admin route (etc/adminhtml/routes.xml, frontName: ia24checkout)
• Admin payment/shipping icon preview: live preview with background-image rendering in MethodCustomizer
• Only active payment/shipping methods shown in MethodCustomizer (changed from all installed)
• RequireJS stub for Hyva compatibility: minimal require/define stubs to prevent ReferenceError from Magento core scripts
• prefers-reduced-motion media query: disables all animations/transitions for motion-sensitive users
• Print stylesheet: hides progress bar, sticky bar, security hints, header icons; sidebar non-sticky
• Focus-visible styling on all interactive elements: place order button, back-link, coupon toggle/button, progress steps, login button, form inputs, selects, textarea, AGB links (WCAG 2.1 compliance)
• Checkbox touch targets: min-height: 44px (WCAG)
• IntersectionObserver for sticky order bar: smart detection of original button visibility
• :has() CSS fallback: updateMethodSelectedClass() JS function with .ia24-checkout__method--selected class toggle
• Sidebar scrollbar styling: scrollbar-width: thin + ::-webkit-scrollbar custom styling
• PLZ autofill CSS class: .ia24-checkout__input--autofilled with dynamic primary-color background
• Coupon toggle keyboard accessibility: tabindex="0", role="button", aria-expanded, Enter/Space handlers
• Coupon button touch-target: min-height: 44px
• IA24_DEBUG flag: externally activatable via window.IA24_DEBUG_ENABLED, protects all console output
• Billing form: 5 input fields given required attribute (firstname, lastname, street, postcode, city)
• Missing config.xml defaults: all 7 footer_links fields and 4 trust-badge custom fields
• chain for sticky bar AGB: show_sticky_order_bar added as dependency
• "Coming Soon" hint for method_customization backend group
• composer.json for Composer-based installation via Satis repository
• LICENSE file with proprietary license terms
• CHANGELOG.md with full version history
• i18n/de_DE.csv with 155+ translation strings from all module files
• Block/Checkout::getTaxRateLabel() for dynamic tax rate display
• Block/Checkout::sanitizeColor() for CSS injection prevention
• Distribution setup: build-zip.sh, Satis server at packages.storetown-media.de

• Moved CSS from inline styles to checkout-layout.css (1377 lines extracted)
• Deleted obsolete checkout.css (replaced by checkout-layout.css)
• Hardcoded "zzgl. MwSt. (19%)" label now shows dynamic tax rate from Magento Tax configuration
• Hardcoded 0.19 tax rate fallback replaced with 0.0 in all controllers (was incorrect for AT/CH stores)
• Removed 111 console.log/error/warn statements from production JavaScript code
• Updated README.md with complete feature list, requirements, and PSP documentation
• Backend admin panel restructured to 10 logical groups (from 11 unorganized): Allgemein, Design & Layout, Checkout-Formular, PLZ-Autofill, Zahlungs-/Versandmethoden, Bestelloptionen, Gutscheincode, Vertrauen & Sicherheit, Footer & Rechtliches, Uber dieses Modul
• Template restructuring: progress bar, messages, and login section moved above grid container — forms and sidebar now start at exactly the same height
• Sidebar restructured as single card with sticky action zone: cart items/coupon/comment in scrollable area, totals/agreements/place-order button always visible
• Order comment moved to sidebar (from left form area)
• Logo moved from header to sidebar
• Header made compact: single row (title left, "Back to cart" right), padding reduced
• Unified color system with dynamic CSS variables from backend: --ia24-primary-rgb, --ia24-accent-rgb for transparency support
• 20+ hardcoded color values replaced with dynamic CSS variables (focus glow, validated fields, progress steps, customer account box)
• Validation colors (~30 places) changed from hardcoded red to var(--ia24-accent) with RGB transparency
• 29x var(--ia24-primary) fallbacks unified from mixed values to #0078b3
• Accent fallback values standardized: #ff8000 to #e85e0c, #d96b00 to #c44d0a
• Footer inline styles moved to CSS classes: .ia24-checkout__footer-inner, .ia24-checkout__footer-separator, .ia24-checkout__footer-links
• AGB link in sidebar uses $block->getTermsUrl() (configured URL) instead of $block->getUrl('agb')
• Agreement label fallbacks use own translated defaults instead of footer-link labels
• Agreement text joining uses proper German grammar (und, und die) instead of comma separation
• Sidebar totals moved from scrollable area to always-visible action zone
• escapeHtml() enhanced with quote escaping (" to ", ' to ')
• All inline scripts wrapped in IIFE, const/arrow functions converted to var/function() (ES5 compatibility)
• checkout-core.js init(): each init step wrapped in try/catch (one error no longer blocks others)
• PLZ autofill: XHR replaced with fetchWithTimeout() (10s timeout)
• Hardcoded German strings replaced with translation keys (gateway_redirect, gateway_fallback, order_success, account_created_suffix)
• SaveAddress.php: RegionResource DI injected, deprecated load() replaced
• PlaceOrder.php: setCustomerDataAsLoggedIn() instead of deprecated Model::load()
• ApplyCoupon.php: CouponResource DI injected, deprecated load() replaced
• Config.php: DEFAULT_PRIMARY_COLOR + DEFAULT_ACCENT_COLOR constants added
• PayPal logging reduced: ~40 info calls changed to 16 debug calls, logRequestSummary() removed from NvpPlugin
• system.xml sortOrder fix: newsletter_checkbox 20 changed to 25 (collision resolved)
• ConfigPlugin.php: mixed return type removed (PHP 7.4 compatibility)
• Admin CSS: save-button style scoped to OPC page only
• checkout-core.js handleLogin(): null-checks added
• requirejs-config.js cleaned: all IIFE mappings removed
• setup_version attribute removed from etc/module.xml (deprecated since Magento 2.3)
• 3 dead Block methods marked as @deprecated: getCartItemCount(), getTrustBadgesStyle(), getFooterLinks()
• Border colors unified: #e0e0e0 changed to #e5e7eb, footer separator #ccc to #e5e7eb
• Progress bar accent shimmer: static white/gray changed to dynamic accent gradient
• Method text overflow: text-overflow: ellipsis with min-width: 0 on method content (all layouts)
• Array.isArray() guards on all API response arrays (payment_methods, shipping_methods)
• Two-column-reverse mobile: flex-direction: column !important at <=900px
• Coupon button: btn.disabled = true/false during AJAX requests
• overflow-wrap: break-word added to sidebar text elements

• SaveShipping.php line 245: $paymentHelper corrected to $this->paymentHelper (DI migration bug causing payment methods to fail)
• PlaceOrder.php: 3x $orderRepository corrected to $this->orderRepository (DI migration bug)
• Sticky bar AGB config: showAgreements() corrected to showAgreementsStickyBar()
• Logo debug leftover: $block->hasLogo() || true changed to $block->hasLogo()
• Duplicate event observer: PrepareQuoteForOrder removed from global events.xml, kept in frontend/events.xml
• Duplicate window.ia24ReloadShipping assignment removed from checkout-core.js
• Duplicate window.IA24Progress assignment removed from sticky-progress.js
• Duplicate blur-listener on email field removed
• Duplicate sticky-bar visibility CSS rule removed
• Duplicate border-top on .ia24-checkout__totals removed
• 4 orphaned/misassigned PHPDoc comments fixed in Checkout.php
• Virtual products: null-safe container access in loadShippingMethods(), 4 additional null-safety fixes in checkAndLoadShipping() and initIA24Checkout()
• Initial payment message for virtual products: "Bitte Adresse ausfullen" instead of "Versandart wahlen"
• Ultra-compact logo: CSS wildcard selector exception via :not() prevents height: auto !important override
• :has() CSS fallback: selectors wrapped in @supports selector(:has(*)) for older browsers
• Footer/header wildcard CSS selectors: :not([class*="ia24"]) guards added (Porto/Ultimo theme compatibility)
• system.xml XSD error: hyphen in path violated Magento XSD pattern
• system.xml: header-icons path changed to headericons (XSD compliance)

• Plugin/CsrfValidatorSkip.php — CSRF bypass plugin (security fix)
• CsrfAwareActionInterface from Login.php (redundant with global CSRF)
• Debug data fields (debug_error, debug_class) from SaveAddress API response
• All console.log() statements from checkout.js and checkout.phtml
• Controller/Router/CustomUrl.php — dead code, not registered in any XML
• etc/events.xml — empty after observer move to frontend/events.xml
• view/frontend/templates/js/button-fix-loader.phtml — orphaned, not in layout XML
• view/frontend/web/js/checkout-button-fix.js — RequireJS dead code
• view/frontend/web/js/checkout-json-fix.js — RequireJS dead code
• view/frontend/web/js/checkout.js — RequireJS/jQuery legacy, duplicated checkout-core.js
• Block/Adminhtml/System/Config/BrandingHeader.php — replaced by AboutInfo.php
• view/adminhtml/templates/system/config/branding-header.phtml — replaced by about-info.phtml
• Trust-badge dead code from Block/Checkout.php: TRUST_BADGE_ICONS constant, getTrustBadges(), getTrustBadgeIcon(), getTrustBadgeContainerClasses() (~50 lines)
• Internal FEATURE_ROADMAP.md from distribution
• Accordion layout option (no working JS existed, CSS stubs deleted)

Version 1.2.0 — 2026-01

• Sticky sidebar button (desktop): sidebar restructured into scrollable summary zone and sticky action zone with place order button, terms, trust badges
• Dynamic color system: CSS variables --ia24-primary-rgb and --ia24-accent-rgb for rgba() transparency support
• Configurable header icon bar: 46 payment icons, 36 shipping icons, 3 custom upload slots with grayscale filter and hover effects
• Backend admin panel restructured to 10 logical groups with clear separation of concerns
• Typography backend fields: font family (13 options), font size (7 options), font color picker with Google Fonts support
• CSS variable --ia24-font-scale for proportional font-size scaling across all ~55 hardcoded sizes
• ARIA accessibility attributes: role="alert", aria-live, role="button", tabindex, aria-expanded, aria-controls, aria-busy, role="radiogroup", aria-label, aria-hidden
• Block/Checkout.php: getJsTranslations() with 22 translation keys, getHeaderIcons() with deduplication
• ObjectManager to DI migration (35 calls reduced to 8, remaining are PSP-specific)
• German text internationalization — 40+ strings wrapped in __()/$t()

• 246 logger->info() calls changed to logger->debug() across 4 controllers
• Sticky bar PHP conditional removed (always visible now, matching HTML/CSS)
• Order comment moved from left form area to right sidebar
• Logo moved from header to sidebar with compact header design
• Sidebar merged into single card with sticky bottom action area
• Validation colors (~30 places) changed from hardcoded red to dynamic accent color
• 20+ hardcoded color values replaced with dynamic CSS variables
• Place order button accent color changed from --ia24-primary to --ia24-accent
• Layout CSS rules added for one-column and two-column-reverse
• Deprecated isPayPalRedirectMethod() removed (replaced by GatewayHandler)

• Placeholder '-' replaced with empty string '' across 7 files (~40 places)
• beforeValidate() changed to no-op in AddressValidationPlugin.php and AddressPlugin.php
• !important reduction: 63 to 60 (3 removed from sticky-bar-btn + footer padding)

Version 1.1.0 — 2025-12

• JavaScript extraction from checkout.phtml: created checkout-core.js (~1050 lines) as standalone IIFE module
• sticky-order-bar.js (~85 lines) extracted from inline script block
• sticky-progress.js extended with payment observation features
• Hyva theme compatibility: all JS files converted from RequireJS define() to IIFE pattern
• Inline coupon JS in checkout.phtml (replaces jQuery/RequireJS dependency)
• window.ia24ReloadShipping global function for manual shipping reload trigger
• 2-second retry mechanism for shipping method loading
• Debug logging in isAddressCompleteForLoading() showing which field is missing
• checkout-core.js init(): each initialization step wrapped in try/catch

• checkout.phtml reduced from 3154 to 919 lines (4 inline script blocks extracted)
• All JS modules converted from RequireJS define([], function() {...}) to (function() {...})()
• requirejs-config.js: deps array removed (no RequireJS on Hyva)
• json-fix-loader.phtml and button-fix-loader.phtml: text/x-magento-init converted to inline IIFE
• Script loading changed from RequireJS to tags
• Coupon code changed to jQuery event delegation (no re-binding after replaceWith)

• PayPal Express Checkout: shipping method no longer lost during redirect
• Billing address handling for separate billing addresses
• Missing EAV form attributes for adminhtml_customer_address
• SaveShipping.php: $paymentHelper corrected to $this->paymentHelper (DI migration bug)
• PlaceOrder.php: 3x $orderRepository corrected to $this->orderRepository (DI migration bug)
• Sticky bar AGB config: showAgreements() corrected to showAgreementsStickyBar()
• :has() CSS fallback: selectors wrapped in @supports selector(:has(*))
• Footer/header wildcard selectors: :not([class*="ia24"]) guards added

• Inline script Block 2 (coupon JS) deleted from checkout.phtml (was duplicating checkout.js, causing double AJAX calls)
• text/x-magento-init blocks removed from checkout.phtml

Version 1.0.0 — 2025-11

• Initial release
• Complete One Page Checkout with server-rendered PHP/PHTML architecture (no Knockout.js)
• AJAX validation for all form fields with real-time error feedback
• Admin configuration for design, form fields, and checkout behavior
• 4 layout variants: two-column (default), two-column-reverse, one-column, ultra-compact
• Responsive design for desktop, tablet, and mobile with sticky order bar
• Payment gateway handler with PSP auto-detection (PayPal, Stripe, Mollie, Adyen, Braintree, Unzer, Amazon Pay, Klarna, and more)
• Method icon customization system with 80+ icon mappings
• Trust badge system with configurable position and style
• PLZ autofill for DE/AT/CH (postcode database lookup)
• Guest checkout with optional customer registration
• Order comment field
• Coupon code application with AJAX
• Sticky progress bar with step indicators
• PHP-to-JS data bridge via window.ia24CheckoutConfig
• CSS variable color system: --ia24-primary, --ia24-accent with dark/light/RGB variants
• Compatible with Luma, Blank, and Hyva themes
• 11 language translations (DE, EN, FR, IT, ES, NL, PL, PT, SV, DA, NO)