=== FrontGlut - Manage Posts, Products, Files, Vendor and Much more from Frontend ===
Contributors: appglut
Tags: frontend dashboard, frontend posting, woocommerce, multivendor, file manager
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.1.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

One frontend dashboard for members, authors, shop managers and vendors: posts, products, orders, files and accounts — without wp-admin.

== Description ==

FrontGlut gives every kind of user a fast, responsive dashboard on your site.

* **Dashboard** – app shell, role-aware menu, widgets, dark mode, brand colours, canvas / full-width / contained layouts, Gutenberg block.
* **Accounts** – login, registration, lost password, profile, avatar, email verification, admin approval, captcha (reCAPTCHA, hCaptcha, Turnstile), social login (Google, Facebook), lockout, wp-admin restriction, custom roles, GDPR export/erase.
* **Shortcode forms** – post, page and custom-post-type submission, registration and profile forms are described by shortcode attributes (fields, labels, required, status, redirect…). Contact, survey and payment forms come from the free FormGlut plugin, shown with `[frontglut_form id=""]`.
* **Posting** – guest and member submissions, moderation queue with reasons, per-role status, my posts, categories/tags manager, custom post types and taxonomies.
* **WooCommerce** – products (simple, variable, grouped, external, downloadable), variations, CSV import/export, quick edit, storefront flyout editor, orders, coupons, reports, customers, reviews.
* **Marketplace (optional)** – vendor applications, storefronts, per-vendor shipping, sub-orders, commissions, withdrawals.
* **Communication** – notifications, messages, tickets, product enquiries, announcements, knowledge base, followers.
* **Files** – a private drive for every user (with quota), a shared file manager, grid/list views with previews, colour labels, tags, notes and stars, share links with expiry, a restorable trash, and a "My files" Media Library grid (edit title, alt text, caption; "Add Media" in the frontend editor).
* **System** – status report, activity log, tools, REST API.

== Shortcodes ==
`[frontglut_dashboard]`, `[frontglut_login]`, `[frontglut_register]`, `[frontglut_lost_password]`, `[frontglut_profile]`, `[frontglut_post_form type="" fields="" status="" …]`, `[frontglut_post_list]`, `[frontglut_form id=""]` (FormGlut), `[frontglut_stores]`, `[frontglut_vendor_register]`, `[frontglut_uploader]`, `[frontglut_file_explorer folder="" scope="shared|private" view="list|grid"]`, `[frontglut_my_shares]`, `[frontglut_kb]`, `[frontglut_follow id="" type="author|store"]`, `[frontglut_enquiry]`, `[frontglut_member id=""]`.

= Shortcode reference =
FrontGlut → Shortcodes in wp-admin lists every shortcode with each attribute, its default, allowed values and examples. Example:
`[frontglut_post_form type="page" fields="title,content,featured_image,category,meta:price:number:Price" required="title" labels="title:Headline" status="pending" guest="no" editor="lite" heading="Submit" button="Send" redirect="/thanks/"]`
Attributes that give more power than a visitor normally has (publishing without review, guest posting, other post types, extra user fields, review stages, webhooks) only work on pages written by an editor or administrator.

= FormGlut =
Install the free FormGlut plugin to build contact forms, surveys, bookings and payment forms. `[frontglut_form id="5"]` shows one, and members see their own entries under "My form entries" in the dashboard.

= Section shortcodes =
Every dashboard section can go on its own page. Put its shortcode on any page and that section appears there with all its options (list, add, edit, filters):
`[frontglut_section id="products"]`, or the short form `[frontglut_products]`, `[frontglut_posts]`, `[frontglut_orders]`, `[frontglut_drive]`, `[frontglut_files]`, `[frontglut_shares]`, `[frontglut_cpt_<type>]` and so on. Settings → Dashboard menu lists the shortcode for every section. Optional attributes: `title="Heading"`, `nav="yes"` (link back to the dashboard). Capability and role rules are the same as in the dashboard; guests see a login form. Links and post-save redirects stay on the page. Turn the short forms off with the `frontglut_section_aliases` filter.

== Installation ==
1. Upload the plugin and activate it. Pages are created automatically.
2. Visit FrontGlut → Setup and follow the checklist.
3. Optional modules (Marketplace) are enabled under FrontGlut → Modules.

== External services ==

FrontGlut works fully without any external service. The services below are **off by default** and are only contacted after a site administrator turns them on and enters their own API keys under FrontGlut → Settings. Only one captcha provider can be active at a time.

= Google reCAPTCHA (v2 or v3) – spam protection =
Used to protect the login, registration, lost-password, post submission and product enquiry forms that the administrator selects under Spam protection.
* When a protected form is shown, the visitor's browser loads the reCAPTCHA script from https://www.google.com/recaptcha/api.js. Google receives the data its script collects (such as the visitor's IP address, browser information and interaction with the page).
* When a protected form is submitted, the site sends the captcha response token and the site's secret key to https://www.google.com/recaptcha/api/siteverify to check it.
* Provided by Google LLC: [Terms of Service](https://policies.google.com/terms), [Privacy Policy](https://policies.google.com/privacy).

= hCaptcha – spam protection =
Used in the same way and on the same forms as above, when hCaptcha is the selected provider.
* The visitor's browser loads https://js.hcaptcha.com/1/api.js when a protected form is shown; hCaptcha receives the data its script collects.
* On submit, the response token and secret key are sent to https://hcaptcha.com/siteverify.
* Provided by Intuition Machines, Inc.: [Terms of Service](https://www.hcaptcha.com/terms), [Privacy Policy](https://www.hcaptcha.com/privacy).

= Cloudflare Turnstile – spam protection =
Used in the same way and on the same forms as above, when Turnstile is the selected provider.
* The visitor's browser loads https://challenges.cloudflare.com/turnstile/v0/api.js when a protected form is shown; Cloudflare receives the data its script collects.
* On submit, the response token and secret key are sent to https://challenges.cloudflare.com/turnstile/v0/siteverify.
* Provided by Cloudflare, Inc.: [Terms of Service](https://www.cloudflare.com/website-terms/), [Privacy Policy](https://www.cloudflare.com/privacypolicy/), [Turnstile Privacy Addendum](https://www.cloudflare.com/turnstile-privacy-policy/).

= Google Sign-In – social login =
Lets visitors log in or register with their Google account, only when the administrator enables it and enters a Google OAuth client ID and secret.
* When a visitor clicks "Continue with Google", they are sent to https://accounts.google.com/o/oauth2/v2/auth to sign in and approve access.
* After they approve, the site exchanges the returned code (with the client ID and secret) at https://oauth2.googleapis.com/token and reads the visitor's name and email address from https://openidconnect.googleapis.com/v1/userinfo to find or create their account.
* Provided by Google LLC: [Terms of Service](https://policies.google.com/terms), [Privacy Policy](https://policies.google.com/privacy).

= Facebook Login – social login =
Lets visitors log in or register with their Facebook account, only when the administrator enables it and enters a Facebook app ID and secret.
* When a visitor clicks "Continue with Facebook", they are sent to https://www.facebook.com/v19.0/dialog/oauth to sign in and approve access.
* After they approve, the site exchanges the returned code at https://graph.facebook.com/v19.0/oauth/access_token and reads the visitor's ID, name and email address from https://graph.facebook.com/me to find or create their account.
* Provided by Meta Platforms, Inc.: [Terms of Service](https://www.facebook.com/terms.php), [Privacy Policy](https://www.facebook.com/privacy/policy/).

== Privacy ==

* FrontGlut does not track visitors and sends no data anywhere unless you enable one of the external services listed above.
* The activity log (logins, failed logins, settings changes and similar admin events) stores IP addresses anonymised (last part removed) by default. Full addresses are stored only if the administrator turns on "Store full IP addresses in the activity log". Entries are deleted automatically after the retention period (90 days by default).
* Guest post submissions store the submitter's anonymised IP address (same setting) to help moderators fight spam.
* Share links are public to anyone who has the link (unless an add-on restricts them); every link can be revoked at any time under My shares, and can be set to expire. Share pages are marked noindex.
* Guests who use the uploader get a functional cookie (`frontglut_gt`, 24 hours) so they can remove their own temporary uploads.
* Social login (when enabled) sets a functional cookie (`frontglut_oauth`, 10 minutes) that ties the sign-in to the visitor's browser; it is removed when sign-in completes.
* Frontend registration and vendor applications are off until the administrator enables them.
* Personal data stored by the plugin is covered by WordPress' export and erase personal data tools.

== Changelog ==
= 1.1.0 =
* New: Files module – a private drive for every user (with quota), shared file manager, grid and list views with previews, colour labels, tags, notes and stars, starred and tag views, share links with expiry and revoke ("My shares"), restorable trash, and a "My files" Media Library grid with title / alt text / caption editing and "Add Media" in the frontend editor.
* New: FormGlut bridge – show FormGlut forms with `[frontglut_form id=""]`; members see their own entries under "My form entries".
* New: Section shortcodes – `[frontglut_section id=""]` and short aliases such as `[frontglut_products]` and `[frontglut_orders]` put any dashboard section on its own page.
* New: Shortcodes reference screen (FrontGlut → Shortcodes) listing every attribute, default and example.
* New: Setup checklist on the dashboard shows what is left to configure.
* Changed: Forms are now set up with shortcode attributes; the built-in form builder and Forms tab were removed. For custom forms use FormGlut.
* Changed: refreshed admin and frontend design – dark header, pink accent, bolder navigation and buttons, consistent typography. New default brand colour (existing saved colours are kept).
* Security: SVG, JS and other script-capable file types are always refused for uploads.
* Fix: settings read during a plugin upgrade could miss module defaults for that request.
* Fix: database query and escaping notices reported by Plugin Check.

= 1.0.0 =
* Initial release.

== Upgrade Notice ==
= 1.1.0 =
Adds the Files module, FormGlut bridge, section shortcodes and a refreshed design. The built-in form builder was removed; use shortcode attributes or FormGlut.
