| @@ -3,9 +3,9 @@ | ||
| 3 | 3 | Tags: blocks, forms, form builder, contact form, gutenberg, gutenberg forms, multi step form. |
| 4 | 4 | Requires at least: 6.1 |
| 5 | 5 | Tested up to: 7.0 |
| 6 | 6 | Requires PHP: 7.0 |
| 7 | -Stable tag: 3.6.3 | |
| 7 | +Stable tag: 3.6.6 | |
| 8 | 8 | License: GPLv2 or later |
| 9 | 9 | License URI: http://www.gnu.org/licenses/gpl-2.0.html |
| 10 | 10 | |
| 11 | 11 | Advanced form builder plugin for Gutenberg. Create forms from the ground up, customize the existing ones, and style them up – all in one editor. |
| @@ -273,8 +273,80 @@ | ||
| 273 | 273 | = How can I report security bugs? = |
| 274 | 274 | You can report security bugs through the Patchstack Vulnerability Disclosure Program. The Patchstack team help validate, triage and handle any security vulnerabilities. [Report a security vulnerability.](https://patchstack.com/database/vdp/jetformbuilder) |
| 275 | 275 | |
| 276 | 276 | == Changelog == |
| 277 | + | |
| 278 | +**3.6.6** | |
| 279 | +- FIX: Limit AI form generation prompt length to prevent 403 | |
| 280 | +- FIX: Preserve JetEngine listing styles after dynamic option updates | |
| 281 | +- FIX: Support BOOKING_UNITS macro in calculated fields | |
| 282 | +- ADD: Additional Style Settings for Media Field in New Style Manager | |
| 283 | +- FIX: Phone field block rejects all landline (fixed-line) numbers as invalid | |
| 284 | +- FIX: Form style is not applied in the dynamic popup | |
| 285 | +- ADD: Add notice to Media field | |
| 286 | +- ADD: Form Preset using source that is JetformBuilder Record | |
| 287 | +- FIX: Checkbox custom options with zero or one predefined option | |
| 288 | +- FIX: Apply Twig listing styles to checkbox and radio templates | |
| 289 | +- FIX: Clear stale Calculated Field watchers on recalculation | |
| 290 | +- FIX: Restore Range field rendering in Chrome | |
| 291 | +- FIX: Unauthenticated arbitrary Media Library attachment deletion | |
| 292 | +- FIX: Prevent XSS in Select field | |
| 293 | + | |
| 294 | +**3.6.5.4** | |
| 295 | +- FIX: Prevent XSS in Calculated Field formulas | |
| 296 | + | |
| 297 | +**3.6.5.3** | |
| 298 | +- FIX: Secure SSR callbacks with admin-managed registry | |
| 299 | + | |
| 300 | +**3.6.5.2** | |
| 301 | +- FIX: Advanced Choices compatibility with WordPress 7.1 | |
| 302 | +- FIX: Harden preset access checks | |
| 303 | +- FIX: Shortcode injection in form status messages | |
| 304 | +- FIX: Secure Advanced Validation Server-Side Callbacks with per-form allowlists | |
| 305 | +- FIX: Escape Media field previews to prevent XSS | |
| 306 | +- FIX: Prevented unauthenticated email header injection in the Send Email action | |
| 307 | +- FIX: Prevented unauthenticated HTML injection into notification emails through the WYSIWYG field | |
| 308 | +- FIX: Prevented unauthenticated blind SQL injection when retrieving forms by payment token | |
| 309 | + | |
| 310 | +**3.6.5.1** | |
| 311 | +- ADD: Allow extending macro groups in Send Email fields | |
| 312 | +- FIX: Support Hierarchical Select in protected price calculations | |
| 313 | + | |
| 314 | +**3.6.5** | |
| 315 | +- ADD: Parent/child support for Post Submit Actions | |
| 316 | +- FIX: Default Reset Password email is now sent correctly when using Reset Password actions | |
| 317 | +- FIX: Prevent validation bypasses in core and SSR flows | |
| 318 | +- FIX: Harden request lifecycle, CSRF, and CAPTCHA validation | |
| 319 | +- FIX: Prevent Login Form submission when CAPTCHA validation fails | |
| 320 | +- FIX: Restore form submission after correcting CAPTCHA validation errors | |
| 321 | +- ADD: Support field macros in Action messages | |
| 322 | +- FIX: Prevent JavaScript console error when adding fields in the editor | |
| 323 | +- FIX: Correct WYSIWYG behavior when removing Repeater items out of order | |
| 324 | +- FIX: Restore the first Repeater image in Fields Preview | |
| 325 | +- ADD: Allow customization of the Image Upload directory via filter | |
| 326 | +- FIX: Prevent 404 error when Form Records filters match no records | |
| 327 | +- FIX: Late-registered form messages displayed status codes | |
| 328 | +- FIX: Prevent Insert/Update Post from clearing JetEngine meta for removed fields | |
| 329 | +- FIX: Correct Advanced Validation inheritance for form fields | |
| 330 | +- FIX: Prevent premature browser validation notices | |
| 331 | + | |
| 332 | +**3.6.4.2** | |
| 333 | +- FIX: Secure payment amount toggle behavior | |
| 334 | +- FIX: Safely enable payment amount protection for eligible existing forms | |
| 335 | + | |
| 336 | +**3.6.4.1** | |
| 337 | +- FIX: Broken Access Control vulnerability | |
| 338 | + | |
| 339 | +**3.6.4** | |
| 340 | +- ADD: Add Text Field variations for Email, Password, URL, First Name, Last Name | |
| 341 | +- ADD: Show field names in the List View | |
| 342 | +- FIX: Hide Honeypot protection fields in the editor after updating to 3.6.2 | |
| 343 | +- ADD: Add customizable autocomplete attribute for Text Fields | |
| 344 | +- FIX: JetFormBuilder forms in JetPopup AJAX popups not initializing correctly | |
| 345 | +- FIX: Respect Form Records access capability in REST endpoints | |
| 346 | + | |
| 347 | +**3.6.3.1** | |
| 348 | +- FIX: get_from_db, get_from_users options generators. Make sure the generator options is correctly santized to prevent context injecting. | |
| 277 | 349 | |
| 278 | 350 | **3.6.3** |
| 279 | 351 | - FIX: Restore repeater macro filter compatibility without breaking formatted output |
| 280 | 352 | - FIX: Calculated Field now correctly processes empty Multi Select values |
