=== PressPilot Frontend Editor for Avada ===
Contributors: cardeetech, neriomolina
Donate link: https://cardee.tech/pagos/donaciones/
Tags: frontend editor, avada, post editor, frontend publishing, user generated content
Requires at least: 6.4
Tested up to: 7.1
Requires PHP: 8.0
Stable tag: 1.5.8
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Let authenticated users create and edit posts from the frontend — no wp-admin needed. Built for Avada, works with any theme.

== Description ==

PressPilot Frontend Editor for Avada lets authenticated users create and edit standard WordPress posts directly from the frontend, without accessing wp-admin.

Designed for editorial workflows where non-admin users need a clean writing experience while administrators keep full control over permissions, status transitions, authorship, and media uploads.

Developed and maintained by [CardeeTech.](https://cardee.tech/)

**Key capabilities:**

* Frontend create/edit form for standard posts
* Frontend listing of posts with direct edit links
* TinyMCE editor, excerpt, categories, tags, post status, and scheduled date
* Featured image upload or external URL (with SSRF protections)
* Avada Builder native elements for the two core shortcodes
* Internationalization-ready (fully translatable)

**Security highlights:**

* Nonce validation on all form submissions (`_ppfenonce`)
* Capability-gated operations (`edit_posts`, `edit_post`, `edit_others_posts`, `publish_posts`, `upload_files`)
* Strict sanitization and escaping throughout
* External image URL hardening: HTTPS-only, blocks localhost/private/link-local/metadata endpoints

**Avada integration:**

When Avada Builder is active, the plugin registers native Avada Builder elements for both shortcodes, so editors can add the frontend form and posts list using the visual drag-and-drop builder without writing shortcode syntax.

== Installation ==

1. Upload the plugin folder to `/wp-content/plugins/`.
2. Activate **PressPilot Frontend Editor for Avada** from **Plugins**.
3. Create a page for the editor and insert the shortcode `[ppfe_edit_post]`.
4. Create a page for the post list and insert `[ppfe_my_posts edit_page="/your-editor-page/"]`.
5. Go to **PressPilot FEE > Style** to align colors and spacing with your theme.

== Shortcodes ==

* `[ppfe_edit_post]` — Main create/edit form.
* `[ppfe_my_posts]` — Current user's post list with edit links.
* `[ppfe_form]` — Alias of `[ppfe_edit_post]`.

**Attributes for `[ppfe_my_posts]`:**

* `edit_page` — URL of the editor page (e.g. `edit_page="/write/"`)

== Frequently Asked Questions ==

= Does this plugin allow guest submissions? =

No. All users must be logged in and pass WordPress capability checks before any action is taken.

= Can contributors publish directly? =

Only users with the `publish_posts` capability can publish. Contributors are automatically limited to draft/pending workflows.

= Is Avada required? =

No. The plugin works with any WordPress theme. When Avada Builder is active, native builder elements become available as an added convenience.

= What post types are supported? =

The plugin targets standard WordPress posts (`post`) for predictable and controlled editorial behavior.

= Can I control who can see other users' posts in the list? =

Yes. Administrators and editors see all posts automatically. Other users with `edit_others_posts` capability can also see all posts when `show_others="1"` is added to the shortcode. Without that attribute, every user sees only their own posts.

== Screenshots ==

1. Plugin backend dashboard — quick-start checklist, shortcode reference, and plugin status overview.
2. Settings tab — access by role and category, email notifications and SMTP delivery.
3. Style tab — color, dimensions, border radius, font size, and shadow controls with live preview.
4. Shortcodes tab — full parameter reference for `[ppfe_edit_post]` and `[ppfe_my_posts]`.
5. Quick-start guide tab — step-by-step installation and configuration walkthrough.
6. Frontend new post form — create and publish posts directly from the frontend.
7. My Posts management and editing — post list with Avada Builder editor.
8. Post management and editing — post list with Classic Editor.

== Changelog ==

= 1.5.8 =
* Authors can upload images from the Media Library again. The upload was refused with "not allowed to attach files to this post".
* An image over the size limit is caught before the form is sent, and if one still reaches the server, the editor says it was not saved instead of dropping it silently. The limit shown is the lower of 8 MB and what the server accepts.
* When someone closes a post, the "is editing this post" warning disappears for the others at the next check, instead of lingering for up to two and a half minutes.
* The access settings no longer claim that contributors always have full access: only administrators and editors do.
* Saving a new post twice without leaving the page no longer creates a second copy of it.

= 1.5.7 =
The first release on WordPress.org of everything in 1.5.6, which was not published here.

* Shorter upgrade notice for 1.5.5, within the WordPress.org limit.

= 1.5.6 =
Everything in the plugin is free, with no limits, and stays that way.

* Removed the "Pro" badges, the "Pro features" and "What comes next" panels, and the "LITE" edition label.
* Removed the welcome notice about a 10-post allowance. There is no allowance: publish as many posts as you like.
* Tested with WordPress 7.1.

= 1.5.5 =
Everything below arrived since 1.2.6. The versions in between were never released, so this is one jump rather than twenty.

**New**

* Saving no longer reloads the page, and the editor tells you how it went where you are looking.
* Drafts autosave while you write, kept as WordPress revisions, so published content is never touched.
* The My Posts listing is paginated instead of stopping at one screen.
* Everyone with the same post open is warned about the others, and the warning clears itself when they leave. Someone editing in wp-admin shows up too.
* Authors hear back: an email when a post is published, and another when it is sent back for changes.
* Moderators are told whenever someone who cannot publish saves a post — every time, not only the first, since a rewrite of something already awaiting review is exactly what needs another look.
* The Settings tab can check whether mail can leave the site at all, separately from sending a test message. It names what is wrong and what fixes it, including the cases WordPress reports as success.

**Fixed**

* Uninstalling now removes every option the plugin ever created, including the stored SMTP password, which previous versions left behind in the database.
* The "Go to my posts" and "Edit" buttons appeared only on sites whose pages the plugin had created. They now find those pages by the shortcode they contain.
* The Avada Builder elements register reliably, and their dropdowns are no longer empty.
* The sender address configured for SMTP is applied even when SMTP itself is not in use.
* Spanish is complete again — 365 strings — and the notification emails no longer print an escape sequence where their line breaks belong.

**Under the hood**

* The text domain is now the plugin slug, as WordPress.org requires. Translations submitted on translate.wordpress.org can load for the first time.
* PSR-4 autoloading, and the admin split from one 1658-line file into focused classes.

= 1.2.6 =
* Fix: after saving a pending post, non-admin users now see a success notice instead of a permissions error.
* UX: added centered moderation notice — "Your post has been submitted for review".
* i18n: new Spanish translation strings for the pending-save success screen.

= 1.2.5 =
* Fix: language files renamed to match text domain (presspilot-frontend-editor) — Spanish translation now loads correctly.
* Fix: added ~35 missing Spanish translation strings for access settings, SMTP, moderation emails (v1.2.x features).

= 1.2.4 =
* Fix: featured image now shows existing thumbnail when editing a post.
* Fix: selecting from Media Library sets attachment by ID (no URL sideload — works on HTTP staging).
* Fix: "Remove image" button now deletes the post thumbnail on save.
* Fix: PPFE-granted roles without native upload_files capability can now upload featured images.

= 1.2.3 =
* Fix: Settings role list layout — 4-column grid (switch, name, categories, permissions).
* Fix: "Puede editar" / "Puede publicar" per-role checkboxes now save and apply correctly.

= 1.2.2 =
* Fix: category restriction now applies to both "Most used" and "All" tabs in the frontend form.

= 1.2.1 =
* Fix: categories now configured per role in Settings (not per user in profile).
* Fix: Contributor added to always-on roles.
* UI: role list redesigned with on/off switches and tag-input category selector.

= 1.2.0 =
* Feature: configurable role-based access — select which WP/UltimateMember roles can use the frontend editor (PressPilot FEE > Settings).
* Feature: per-user category restrictions — assign allowed categories per user from WP Admin > Users > edit user.
* Feature: non-admin/editor posts always go to pending for moderation regardless of selected status.
* Feature: email notification to configurable addresses when a post is submitted for moderation.
* Feature: published posts are read-only in [ppfe_my_posts] for non-admin/editor users.

= 1.1.0 =
* Compatibility: raised minimum PHP requirement to 8.0 (PHP 7.4 is EOL).
* Compatibility: raised minimum WordPress requirement to 6.4.
* Security: tightened frontend form display — requires edit_posts capability in addition to post authorship.
* Feature: administrators and editors now automatically see all posts in [ppfe_my_posts] without needing show_others='1'.
* Feature: author name displayed per post card when viewing all posts (admin/editor view).

= 1.0.0 =
* Initial release on WordPress.org.
* Frontend create/edit form with TinyMCE, featured image, categories, tags, status and scheduled date.
* My Posts listing shortcode with capability-aware visibility.
* Avada Builder native elements for both shortcodes.
* Full nonce and capability security on all form submissions.
* Admin style panel to customise colors and spacing.
* Spanish (es_ES) translation included.

== Upgrade Notice ==

= 1.5.8 =
Fixes Media Library uploads for authors, reports images that are too large instead of dropping them, and clears the editing warning as soon as someone leaves.

= 1.5.7 =
No more "Pro" labels or post allowance: every feature is free, with no limits. Tested with WordPress 7.1.

= 1.5.5 =
A large update: background saving, autosave, pagination, concurrent-edit warnings and email notifications. Uninstall now clears the stored SMTP password. The text domain now matches the plugin slug: rename any custom .mo in wp-content/languages/plugins/.

= 1.0.0 =
Initial release.
