=== MapArc LMS ===
Contributors: bobstanleygardner
Tags: lms, education, courses, quizzes, certificates
Requires at least: 6.4
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 0.9.64
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

A lightweight WordPress LMS for courses, assessments, progress, scheduling, multilingual learning, and certificates.

== Description ==

MapArc LMS is a lightweight WordPress learning management system originally created by **Bob Stanley Gardner** in 2026.

It provides a focused course-delivery experience without requiring an external LMS service. Site owners can use their own institutional branding across the learner experience.

Current functionality includes:

* Courses, modules, lessons, and assessments
* Dedicated course builder
* YouTube lesson delivery
* Student registration and login
* Course enrollment and learner management
* Lesson and assessment progress tracking
* Certificate completion rules
* Configurable certificate signatories
* Public certificate verification
* Self-paced courses, scheduled cohorts, and enrollment-relative drip
* Multilingual course/lesson/assessment variants with shared progress
* Public enrollment and completion statistics
* CSV learner export
* White-label institution branding
* WordPress personal-data export/erasure integration and configurable certificate retention


== Installation ==

1. Upload the `maparc-lms` folder to `/wp-content/plugins/`, or install the plugin ZIP through **Plugins → Add New → Upload Plugin**.
2. Activate **MapArc LMS**.
3. Follow the MapArc LMS setup screen.
4. Create a course from **MapArc LMS → Add Course**.
5. Configure learner registration, branding, scheduling, certificate requirements, and signatories as needed.

MapArc LMS creates and manages its learner-facing system routes automatically.

== Frequently Asked Questions ==

= Who created MapArc LMS? =

MapArc LMS was originally created by Bob Stanley Gardner in 2026.


= Does MapArc LMS require an external LMS service? =

No. MapArc LMS runs inside WordPress.

= Can I use my own institution logo and colors? =

Yes. Learner-facing branding can follow the WordPress Site Identity or custom LMS branding settings.

= Can certificates have physical signatures? =

Yes. Certificate signatories can be configured with Name, Position, Affiliation, and an optional signature image. Leaving the signature image blank supports physical signing workflows.

= Is MapArc LMS open source? =

Yes. MapArc LMS is licensed under GPL-2.0-or-later.

== External Services ==

MapArc LMS itself does not require an external LMS service. Optional course content can, however, connect a visitor's browser to third-party services when a course author deliberately configures that content.

= YouTube =

When a course author adds a YouTube video URL, MapArc LMS may request a video thumbnail from `i.ytimg.com` and may load an embedded YouTube player from YouTube or `youtube-nocookie.com` when the visitor chooses to play the video. In those circumstances the visitor's browser communicates directly with Google/YouTube and data such as the visitor's IP address and browser/device information may be processed by that service according to its policies. MapArc LMS does not send learner enrollment, assessment, certificate, or profile records to YouTube.

YouTube Terms of Service: https://www.youtube.com/t/terms
Google Privacy Policy: https://policies.google.com/privacy

YouTube integration is optional and is used only when a site/course author supplies YouTube-hosted content.

== Source Code and Build Process ==

MapArc LMS ships its human-readable source code directly in the plugin package. No JavaScript or CSS build/minification step is required to recreate the distributed assets.

* `assets/js/admin.js` is the editable administrator JavaScript source.
* `assets/js/maparc-lms.js` is the editable learner-facing JavaScript source.
* Files in `assets/css/` are the editable stylesheet sources used directly by WordPress.
* The plugin does not bundle third-party JavaScript or CSS libraries. It uses WordPress-provided dependencies such as jQuery and the WordPress media library where needed.
* No npm, webpack, Vite, Rollup, Gulp, Grunt, Composer, or other asset compilation process is required for the distributed plugin.

The JavaScript and CSS files shipped with MapArc LMS are the human-readable editable source. No separate compilation or minification step is required, and the plugin does not bundle third-party JavaScript or CSS libraries.

== Screenshots ==

1. MapArc LMS course builder.
2. Learner registration screen.
3. Course player and curriculum sidebar.
4. Student dashboard and progress.
5. Certificate and public verification.

== Credits ==

* Bob Stanley Gardner — Original Creator and Lead Developer.
* Shalomin Gardner — Contributor.

== Changelog ==

= 0.9.64 =
* Reviewer-hardening pass: normalized remaining scalar request inputs with wp_unslash() plus context-appropriate sanitization/validation.
* Tightened read-only query flags and numeric request handling without changing plugin behavior or persisted data.
* Preserved nonce/capability boundaries, MapArc Core integration, and multi-role-safe authorization.

= 0.9.60 =
* Reviewer-compliance release: tightened late output escaping for generated branding, educator, admin, certificate, progress, thumbnail, and shortcode HTML.
* Applied explicit KSES allow-list sanitization at remaining generated HTML output boundaries.
* No schema, account architecture, enrollment, progress, or MapArc Core API changes.

= 0.9.59 =

* Hardened reviewer-identified nested POST arrays with immediate type-appropriate sanitization.
* Validated assessment JSON decoding before sanitizing and storing each supported question field.
* Tightened course translation, module translation, signatory, language and quiz-answer input boundaries.
* No database schema, MapArc Core API, enrollment, progress or multi-role authorization changes.

= 0.9.58 =

* Moved public account creation, login and password recovery to WordPress or optional MapArc Core account flows.
* Changed educator onboarding to an application-only flow for an existing authenticated account; administrator approval is always required before LMS educator capabilities are granted.
* Preserved multi-role-safe LMS authorization, existing user IDs, courses, enrollments, progress, certificates and standalone operation.
* Tightened reviewer-requested input validation, nested-array sanitization and late output escaping.

= 0.9.56 =
* Scoped the one-time legacy identifier migration database exceptions so Plugin Check does not report expected non-cacheable schema/content migration writes.
* No functional, authorization, course, enrollment, or branding behavior changes.

= 0.9.55 =
* Standardized internal plugin identifiers on the `maparc_` / `MAPARC_` prefix, including classes, hooks, shortcodes, roles, capabilities, post types, metadata, options, assets and custom database tables.
* Added a one-time compatibility migration for existing pre-MapArc test/install data so courses, users, settings, educator authorization, enrollment, progress, quiz attempts and certificates are preserved.
* Preserved multi-role-safe educator authorization and the WordPress.org reviewer compliance/security fixes.

= 0.9.54 =

* Replaced the previous honeycomb/book product mark with the new MapArc connected-arcs-and-nodes identity.
* Updated the administrator/menu and in-product MapArc marks consistently.
* Confirmed the package declares Bob Stanley Gardner with https://mappingaround.in/ as Author URI and does not declare a Plugin URI or any legacy ownership URLs.
* No database schema, stored LMS data, authorization, course, enrollment, progress, or certificate behavior changes.

= 0.9.53 =

* Renamed the plugin and public ecosystem branding to MapArc LMS.
* Updated the WordPress.org-facing slug/text-domain identity to `maparc-lms`.
* Confirmed Bob Stanley Gardner as author with https://mappingaround.in/ as the Author URI; no Plugin URI is declared.
* Preserved the established `maparc_*` persisted data model and reviewer-driven security/compliance fixes.

= 0.9.51 =

* Made educator approval, rejection, suspension, restoration, and access removal multi-role safe.
* MapArc LMS now changes only its own `maparc_educator*` roles/state and preserves unrelated WordPress/product roles and capabilities.
* Active educator authorization is capability- and MapArc-state-based.
* Educator suspension/pending/rejection no longer blocks the user's global WordPress authentication.
* Standardized live ecosystem/service/export identifiers on MapArc naming while preserving the established `maparc_*` persisted data model.
* Preserved all reviewer-driven nonce, capability, escaping, sanitization, prepared-SQL, source-code, and Plugin Check compliance work.
* No database schema, course, enrollment, progress, certificate, setting, post/meta key, or stored ID migration is performed.

= 0.9.50 =

* Completed the MapArc brand-namespace migration without renaming the established `maparc_*` data model.
* New access-provider resources, privacy groups, asset handles, export formats, and export filenames now use MapArc LMS identifiers.
* Existing courses, lessons, assessments, users, enrollments, progress, certificates, settings, post/meta keys, custom tables, and IDs are not copied or renamed.
* Cleaned stale branding references from the readme and interface text.

= 0.9.49 =

* Corrected the final dashboard PHPCS database-scope directives so they are parsed inside PHP rather than emitted as template text.
* Targeted the last two Plugin Check direct-query/no-cache warning locations without changing dashboard behavior.
* No database schema or stored LMS data was changed.

= 0.9.48 =

* Completed the final Plugin Check warning-cleanup pass.
* Replaced scattered per-line database annotations with narrow file-scoped PHPCS controls for only the two justified custom-table sniffs: direct-query and no-cache.
* Kept all SQL preparation, nonce, capability, escaping, and other WordPress security checks fully enabled.
* No database schema, stored LMS data, or user-facing LMS behavior was changed.

= 0.9.47 =

* Fixed Plugin Check placeholder-count warnings by passing each enrollment-query replacement explicitly to `$wpdb->prepare()`.
* Repositioned remaining justified direct-database/no-cache annotations to the exact custom-table call sites reported by Plugin Check.
* No database schema or stored LMS data was changed.

= 0.9.46 =

* Aligned the MapArc LMS WordPress admin-menu icon using the same fixed 20×20 visual box and centered menu-image container used by standard admin icons.
* Replaced dynamic enrollment WHERE/ORDER SQL fragments with fixed prepared queries and explicit optional-filter placeholders.
* Removed the three remaining Plugin Check SQL-construction ERROR patterns from the enrollment list/count paths.
* No database schema or stored LMS data was changed.

= 0.9.45 =

* Added a dedicated, better-proportioned MapArc LMS admin-menu icon with extra internal padding.
* Reworked the two remaining dynamic enrollment SQL reads so `$wpdb->prepare()` is directly visible to Plugin Check.
* Corrected placement of narrowly scoped direct-database/no-cache annotations at the actual MapArc custom-table call sites.
* No database schema or stored LMS data was changed.

= 0.9.44 =

* Updated the WordPress admin-menu icon for the MapArc LMS product identity.
* Completed the remaining Plugin Check database cleanup with narrowly scoped documentation for justified MapArc custom-table operations.
* Documented the two dynamic enrollment queries whose identifiers and runtime values are prepared safely but cannot be fully inferred by static analysis.
* No database schema or stored LMS data was changed.

= 0.9.43 =

* Hardened custom-table SELECT queries using WordPress `%i` identifier placeholders and `$wpdb->prepare()`.
* Prepared certificate, quiz-attempt, enrollment, progress, privacy, portability, and reporting queries without concatenating table identifiers into SQL.
* Hardened dynamic enrollment list/count queries so identifiers, values, and limits are prepared together.
* No database schema or stored LMS data was changed.

= 0.9.42 =

* Completed the Plugin Check database-warning classification pass.
* Documented intentional direct database access used by MapArc LMS custom tables instead of replacing valid LMS-table operations with unrelated WordPress APIs.
* Documented intentional WordPress metadata relationship/status queries flagged as potential slow-query patterns.
* No database schema or stored LMS data was changed in this release.

= 0.9.41 =

* Completed the Plugin Check nonce-warning cleanup pass.
* Documented read-only GET/query parameters used for routing, filters, notices, language selection, and public lookup forms so they are not mistaken for unprotected state-changing requests.
* Retained existing nonce and capability verification on state-changing admin, account, enrollment, course, quiz, progress, import/export, and settings actions.

= 0.9.40 =

* Removed unexpected SOURCE.md and CONTRIBUTORS.md files from the production package for WordPress.org Plugin Check compliance.
* Preserved source/build compliance information in readme.txt.
* Preserved Shalomin Gardner contributor credit in readme.txt and the in-plugin About/Credits screen.

= 0.9.39 =
* Documented the human-readable JavaScript and CSS source shipped with the plugin.
* Added `SOURCE.md` with source locations, dependency notes, and build/reproduction information.
* Verified the package contains no minified asset variants, source maps, bundled third-party JavaScript/CSS libraries, or required external build process.

= 0.9.38 =
* Completed an output-escaping hardening pass across frontend templates and administrator screens.
* Added context-appropriate escaping for dynamic classes, numeric values, option values, generated media markup, and profile/avatar output.
* Corrected the internal MAPARC_VERSION constant to match the published plugin version.


= 0.9.37 =
* Completed a nonce/capability audit across request handlers.
* Hardened course-builder authorization ordering and quiz duplication with target-specific edit permissions.
* Verify enrollment nonces before both authenticated enrollment and guest registration redirects.
* Normalized enrollment-status request sanitization.

= 0.9.36 =
* Removed direct inline JavaScript redirect fallbacks from educator authentication flows. Redirects now use WordPress safe redirects with an HTML meta-refresh and explicit continuation link only when headers have already been sent.

= 0.9.35 =
* Credits Shalomin Gardner as a project contributor.
* No database schema or stored LMS data changes.


= 0.9.33 =
* Rebrands the plugin as MapArc LMS while preserving legacy MAPARC data identifiers for upgrade compatibility.
* Removes automatic deactivation of duplicate/legacy LMS plugins; plugin state remains under explicit administrator control.
* Keeps the existing database schema and stored LMS data unchanged.


= 0.9.32 =
* Stop MapArc LMS from globally replacing WordPress registration when LMS is active.
* Keep LMS-owned course/enrollment registration routed through the LMS registration resolver.
* Generic WordPress, Library, and Quiz registration can now remain owned by WordPress/Core rather than LMS.
* No database schema changes.


= 0.9.31 =
* Legacy learner registration routes redirect to Core Create Account when the experimental Core account helper is available.
* Shared WordPress login is used when Core account UX is available; no second credential system is introduced.
* Existing LMS users, enrollments, progress, profile metadata, and certificate-name fallback remain unchanged.
* Preserves course enrollment intent when a new Core account is created from an LMS course.
* No database schema changes.


= 0.9.30 =
* Registers a Courses section when the experimental Core account-section API is available.
* Courses remain fully owned and rendered by MapArc LMS using the current learner and existing LMS access/progress APIs.
* No database schema changes.

= 0.9.29 =
* No database schema changes.


= 0.9.28 =
* Updated WordPress compatibility metadata to Tested up to 7.1 for Plugin Directory submission.


= 0.9.27 =
* Fixes a developer translator comment that could appear visibly in the Educator Workspace.
* No functional or database schema changes.

= 0.9.26 =
* WordPress.org submission header correction.
* No functional or database schema changes.

= 0.9.25 =
* WordPress.org submission build.
* Removes forced public-facing “Powered by MapArc LMS” attribution.
* Keeps institutional white-label branding without requiring public credits.
* Trims historical release notes from the directory readme.
* No database schema changes.

= 0.9.24 =
* WordPress.org submission candidate based on Plugin Check compliance work.
* Preserves working authentication and LMS behavior while retaining justified database/performance recommendations for review.
