Shortcodes

Version 5.19.0 and newer contain support for shortcodes to generate links to invoice and packing slip PDFs. This makes it possible to add a PDF download link to a WordPress page or to a WooCommerce email.

Publicly accessible URLs

If the public attribute of these shortcodes is set to “yes”, links generated by the shortcodes do not require user login, so anyone with access to the link can view the corresponding PDF file without user or session authentication. Shortcodes with public="yes" should therefore never be used on publicly accessible pages; they are meant to be used in emails. Omit the public attribute to generate URLs that require user login.

List of shortcodes

moneybird_invoice_pdf_link

Outputs a HTML <a> tag with a link to the invoice PDF for the specified order id if it exists, otherwise empty string. Usage:

[moneybird_invoice_pdf_link order_id="123" text="Download factuur"]
or
[moneybird_invoice_pdf_link text="Download factuur" public="yes"]123[/moneybird_invoice_pdf_link]
or 
[moneybird_invoice_pdf_link text="Download factuur" public="yes"] [order_id] [/moneybird_invoice_pdf_link]

In the last example, the nested shortcode [order_id] should output the desired order id. Example output in case public="yes":

<a class="wcmb-pdf-link" href="https://example.com/wcmb?doc=invoice&order=123&hash=e04c146af9c377c70706387f31d8c135">Download factuur</a>

moneybird_invoice_pdf_url

Outputs the PDF download URL of the invoice for the specified order id if it exists, otherwise empty string. Usage:

[moneybird_invoice_pdf_url order_id="123"]
or
[moneybird_invoice_pdf_url]123[/moneybird_invoice_pdf_url]
or 
[moneybird_invoice_pdf_url public="yes"] [order_id] [/moneybird_invoice_pdf_url]

Example output:

https://example.com/wcmb?doc=invoice&order=123&hash=e04c146af9c377c70706387f31d8c135

moneybird_packing_slip_pdf_link

Similar to moneybird_invoice_pdf_link, except for the packing slip instead of the invoice.

moneybird_packing_slip_pdf_url

Similar to moneybird_invoice_pdf_url, except for the packing slip instead of the invoice.

Security

If the public attribute is omitted or not set to “yes”, the generated URLs require user login. Admin users are able to access all invoice PDFs; regular users can only access PDFs linked to their own orders.

If the public attribute is set to “yes”, the generated URLs do not require user login. This means that anyone who obtains a valid download URL will be able to access the underlying PDF file. If this is unacceptable in your case, please do not use public="yes". Public URLs generated by the shortcodes contain a hash parameter to make it impossible to ‘guess’ correct URLs, for example:

https://example.com/wcmb?doc=invoice&order=123&hash=e04c146af9c377c70706387f31d8c135

The hash code is calculated by wp_hash based on the document type and order id. Since wp_hash uses site-specific secrets as salt, the hash codes will be different per site.

In short, this means public URLs:

Cannot be guessed, but
Anyone who obtains a correct URL will be able to access the resource behind it.