RKR EUDR Guard: Anti-deforestation Regulation (EU) 2023/1115, DDS and traceability for PrestaShop

v1.1.02026/11/05

Full review of the 1.0.0 received.

Fixed

• Application dates updated to Regulation (EU) 2025/2650: 12-30-2026 for large and medium-sized operators, 06-30-2027 for micro and small enterprises (the countdown, the alerts and the guide showed the old 2025/2026 dates). New "medium-sized enterprise" size.
• Detection: CN codes limited to Annex I of Regulation (EU) 2023/1115 (leather goods, synthetic rubber, tea, mate, extracts and other non-covered headings were flagged); CN prefixes written with dots now match; keywords match whole words only ("octopus", "yo soy", "coffee maker" are no longer flagged); "Category (including children)" rules now include the children; country of origin read from the country name instead of its first two letters.
• Country risk follows Implementing Regulation (EU) 2025/1093 (high risk: BY, MM, KP, RU) and the country risk prevails over the commodity risk.
• The manual classification of the merchant (affected, not affected, country, risk) is no longer overwritten by the next scan or product save.
• Import always run as a dry run; Spanish dates (dd/mm/yyyy) were read as mm/dd; imported statements without a validity date expired on the next scan; dry run created lots and suppliers.
• DDS references: no duplicates after deletions, numbering restarts every year.
• Invoice PDF block ignored "Show on invoice"; order lines were duplicated with two active statements; the block never showed in the order page of the back office ( 1.7.7 ). The statement of every order line is now frozen when the order is placed, so a reprint keeps the reference that covered the sale.
• Document title, note, product badge and footer texts were stored in English in every language at installation: until the merchant changes them they are now read in the language of each page or document. The country of production on documents comes from the statement (or its lot), and the invoice table is readable (header, padding, column widths).
• Only validated or submitted statements count: a rejected, expired or draft statement no longer appears on the product badge or the documents, nor leaves a product "partial". The image sticker ("EUDR compliant") only shows on compliant products and only over the product image (it was added to any block of other modules carrying a product id).
• Country of production read from the statements or lots when the product does not say it; every country is offered as country of production (the list only had the countries the shop ships to).
• Alerts, missing information, detection source and commodity names translated in every language; dashboard charts count only the affected products; wood-effect tiles and laminates are no longer detected as wood; own names for the JavaScript globals and CSS animations (other modules overwrote them).
• Public verification page: only validated or submitted statements are public; without the signed link of the documents it no longer shows plot geolocation, supplier or notes; internal risk mitigation texts are never public; the rate limit now really limits (it was kept in per-request memory).
• The scheduled task marked statements as "submitted to TRACES" without sending anything: now it only marks complete statements as validated. Its email notifications (missing data, expiring statements) were never sent. Several containers separated by commas now work.
• Scan history recorded the figures of the last chunk only; the scan without JavaScript restarted from the first product every time; "missing DDS" and "missing geolocation" alerts now close by themselves.
• Front office: no more stylesheet writes on every page; the image sticker landed on an accessory miniature in the Classic product page and was missing after AJAX filters; per-shop colors never reached the shop; labels with "&" were double escaped; the module no longer overwrites theme Smarty variables such as currency .
• Security: custom CSS and theme values sanitized against rule injection; module log moved out of the web-reachable module folder; destructive actions require the delete permission; rules of another shop can no longer be deleted.
• Addons validator: no Context::getContext(), hash_hmac, file_get_contents, $_POST / $_GET or nofilter on unsanitised values; version and description literal and identical to config.xml; templates under views/templates.

Added

• French, Italian, German and Portuguese translations.
• AFL-3.0 license.