| @@ -4,9 +4,9 @@ | ||
| 4 | 4 | Tags: contact form 7, double opt-in, gdpr, email verification |
| 5 | 5 | Requires at least: 6.0 |
| 6 | 6 | Tested up to: 7.0 |
| 7 | 7 | Requires PHP: 7.4 |
| 8 | -Stable tag: 5.5.0 | |
| 8 | +Stable tag: 5.6.2 | |
| 9 | 9 | License: GPLv3 |
| 10 | 10 | License URI: http://www.gnu.org/licenses/gpl-3.0.html |
| 11 | 11 | |
| 12 | 12 | **Protect your Contact Form 7 forms with GDPR-compliant Double Opt-In.** |
| @@ -63,9 +63,9 @@ | ||
| 63 | 63 | * **Category System** -- organize opt-ins into categories for better management |
| 64 | 64 | * **Pagination & Search** -- search and filter opt-in records in the admin dashboard |
| 65 | 65 | * **Admin Tooltips** -- contextual help tooltips throughout the admin interface |
| 66 | 66 | * **WordPress Multisite** -- network-wide activation creates tables on all sites automatically |
| 67 | -* **Developer Hooks** -- 43 action hooks, 71 filters, and 11 typed events for full extensibility | |
| 67 | +* **Developer Hooks** -- 44 action hooks, 72 filters, and 11 typed events for full extensibility | |
| 68 | 68 | |
| 69 | 69 | = Pro Features = |
| 70 | 70 | |
| 71 | 71 | Unlock the full potential of Double Opt-In with the [Pro version](https://www.forge12.com): |
| @@ -193,9 +193,9 @@ | ||
| 193 | 193 | The free version requires at least one supported form plugin. However, developers can register custom form integrations using the `f12_cf7_doubleoptin_register_integrations` action hook. See the developer documentation for details. |
| 194 | 194 | |
| 195 | 195 | = Where can I find the developer documentation? = |
| 196 | 196 | |
| 197 | -A hook, filter, and event reference with code examples ships at `docs/hooks-and-events.md` inside the plugin directory. It documents 26 of the 43 action hooks, 20 of the 71 filters, and all 11 typed events — the ones extensions actually reach for. The rest are discoverable in the source; if you need one documented, ask and we will add it. | |
| 197 | +A hook, filter, and event reference with code examples ships at `docs/hooks-and-events.md` inside the plugin directory. It documents 27 of the 44 action hooks, 22 of the 72 filters, and all 11 typed events — the ones extensions actually reach for. The rest are discoverable in the source; if you need one documented, ask and we will add it. | |
| 198 | 198 | |
| 199 | 199 | = How do I report a bug or request a feature? = |
| 200 | 200 | |
| 201 | 201 | Please visit [forge12.com](https://www.forge12.com) or contact us via the WordPress support forum. |
| @@ -239,8 +239,17 @@ | ||
| 239 | 239 | licensed under the SIL Open Font License 1.1 (see licenses/inter-OFL-1.1.txt). |
| 240 | 240 | |
| 241 | 241 | == Upgrade Notice == |
| 242 | 242 | |
| 243 | += 5.6.2 = | |
| 244 | +Visitors who forget the consent checkbox now see why their sign-up was not accepted, instead of a success message. No settings or data change. | |
| 245 | + | |
| 246 | += 5.6.1 = | |
| 247 | +Fixes a blank or partly loaded Double Opt-In admin on sites with Avada and other themes or plugins that use the Underscore/Lodash library. No settings or data change. | |
| 248 | + | |
| 249 | += 5.6.0 = | |
| 250 | +Security release — update recommended. Also records every action that runs after the confirmation click, retries temporary failures automatically and shows the result on each opt-in. Adds one database table, created automatically on update. If you use the Elementor, Avada, WPForms or Gravity Forms add-ons, update them after this release. | |
| 251 | + | |
| 243 | 252 | = 5.5.0 = |
| 244 | 253 | Recommended if you ever ran a Double Opt-In Pro older than 4.0. Such a plugin, left installed next to the current modules, made WordPress fail with a critical error that also locked you out of the admin. This release keeps the site reachable in that situation and adds two Site Health checks that name the problem and repair it in one click. Nothing is deleted from your server, and no schema changes. |
| 245 | 254 | |
| 246 | 255 | = 5.4.0 = |
| @@ -323,8 +332,37 @@ | ||
| 323 | 332 | = 3.1.0 = |
| 324 | 333 | Adds optional anonymous telemetry (opt-out). No breaking changes. |
| 325 | 334 | |
| 326 | 335 | == Changelog == |
| 336 | + | |
| 337 | += 5.6.2 = | |
| 338 | + | |
| 339 | +**A refused consent no longer looks like a successful sign-up** | |
| 340 | + | |
| 341 | +* Fix: when a visitor left the consent checkbox unticked, Contact Form 7 still showed "Thank you for your message. It has been sent." and emptied the form. The actual reason appeared only in a small notice that disappeared after ten seconds — so the visitor believed they were subscribed and waited for a confirmation mail that never came. The form now stops with "You must agree to the consent statement to continue." and keeps everything the visitor typed; they only have to tick the box. | |
| 342 | +* Fix: the same on Elementor, WPForms and Gravity Forms forms — the consent checkbox is now marked the way a missed required field is, and the form stays on the page with the visitor's input. This needs the Elementor add-on 1.2.1, the WPForms add-on 1.1.1 and the Gravity Forms add-on 1.1.1. With older add-ons the success message is at least hidden and the notice stays until the visitor closes it. | |
| 343 | +* Developer: new `AbstractFormIntegration::refusedConsentBeforeSubmit()` for integrations whose submit hook runs after the form plugin has accepted the submission (Core API 4.5.0, additive). | |
| 344 | +* Note: this applies to the consent checkbox only. Other refusals (rate limits, blocked domains, …) keep their current behaviour and can be shown in the form with the filter `f12_cf7_doubleoptin_show_validation_error`, which now also receives the error and the form ID. | |
| 345 | + | |
| 346 | += 5.6.1 = | |
| 347 | + | |
| 348 | +**The admin no longer stays blank next to Avada and similar plugins** | |
| 349 | + | |
| 350 | +* Fix: on some sites the Double Opt-In admin stayed blank or loaded only partly after 5.6.0, depending on the browser, with "clearTimeout is not a function" in the browser console. The admin script accidentally registered an internal helper under the global name `_`, which WordPress and many themes and plugins (Avada among them) use for the Underscore/Lodash library. Whichever loaded last won. The admin script now keeps all of its names to itself, and it no longer replaces WordPress' own `_` either. | |
| 351 | + | |
| 352 | += 5.6.0 = | |
| 353 | + | |
| 354 | +**What happens after the confirmation click is now recorded, retried and visible** | |
| 355 | + | |
| 356 | +* Security: a crafted request could switch off the double opt-in for a single submission, so the form's follow-up actions ran without a confirmed address. This is closed for all form systems. Update recommended. | |
| 357 | +* New: every action that runs after a subscriber confirms — the form's notification mail, the stored entry, and for Elementor each "Actions After Submit" step — is now recorded individually with its outcome. The opt-in detail page shows them in a new "Follow-up actions" panel. | |
| 358 | +* New: an action that fails for a temporary reason (mail server unreachable, timeout) is retried automatically after 1, 5 and 30 minutes. Actions that already succeeded are never run again, so a retry does not send a second mail or write a second entry. An action whose outcome is unclear (the connection broke after the request was sent) is not retried automatically; the panel says so and asks before you retry it by hand. | |
| 359 | +* New: a "Retry failed actions" button on the opt-in detail page, and a "Follow-ups need attention" filter in the opt-in list. A manual retry starts a fresh set of automatic attempts. | |
| 360 | +* New: a Site Health check when follow-up actions keep failing, and entries in the audit log for every attempt. | |
| 361 | +* Fix: on Elementor forms the actions after the confirmation could be cut short by a CAPTCHA or honeypot field that was checked a second time, long after the visitor had passed it. | |
| 362 | +* Fix: a second click on the confirmation link no longer runs the follow-up actions again. | |
| 363 | +* Fix: with debug logging switched on, the log files could be downloaded from the uploads folder. The folder is now protected and the files carry names that cannot be guessed; existing log files are renamed on the next request. | |
| 364 | +* Developer: new filter `f12_doi_follow_up_backoff` and adapter interface for form integrations; Core API 4.4.0 (additive, no breaking change). | |
| 327 | 365 | |
| 328 | 366 | = 5.5.0 = |
| 329 | 367 | |
| 330 | 368 | **An old Pro plugin no longer takes the site down with it** |
