=== Palette Form Builder ===
Contributors: paletteagencyy
Tags: form, form builder, multi-step, rtl, persian
Requires at least: 5.6
Tested up to: 7.0
Requires PHP: 7.2
Stable tag: 1.4.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

A modern, multi-step form builder with drag & drop, live preview, RTL support, email & SMS notifications, and a fully localized admin interface.

== Description ==

**Palette Form Builder** is a lightweight yet powerful WordPress plugin for creating beautiful multi-step (wizard-style) forms and questionnaires. Built with an object-oriented architecture and following WordPress.org Plugin Guidelines, it ships with a modern admin UI featuring drag & drop reordering, live preview, a visual type selector, and a color palette picker.

= Key Features =

* **Multi-Step Forms** — Break long forms into digestible steps with a progress bar and smooth transitions.
* **Drag & Drop Builder** — Reorder questions instantly with SortableJS. No page reloads required.
* **Live Preview** — See exactly how your form will look before publishing.
* **Visual Type Selector** — Choose between text, radio, and checkbox question types with clear visual buttons.
* **Color Customization** — Per-form primary color with a WordPress color picker and preset palette.
* **Icon Picker** — Search and select from 2,000+ Bootstrap Icons for the welcome screen.
* **Email Notifications** — Receive an email with full submission details. Customizable subject and body templates.
* **SMS Notifications** — Optional SMS alerts via MeliPayamak (REST API) when a new entry is submitted.
* **Entries Management** — View, filter, paginate, delete, and export submissions to CSV.
* **Login Required** — Optionally restrict form submission to logged-in users.
* **RTL & Persian** — Full RTL support with the Vazirmatn font and complete Persian (fa_IR) translation.
* **100% Local Assets** — All CSS, JS, and fonts are bundled locally. No external CDN dependencies.
* **Secure** — Nonce-based CSRF protection, input sanitization, output escaping, and SSL-verified HTTP requests.

= Question Types =

1. **Text (Descriptive)** — Single-line or multi-line text input.
2. **Radio (Single Choice)** — Select one option from a list.
3. **Checkbox (Multiple Choice)** — Select one or more options, with optional maximum selection limit.

= Privacy =

This plugin stores form submissions (entries) in the WordPress database as custom post types. Each entry may include:

* The answers provided by the user.
* The submitter's IP address (`REMOTE_ADDR`).
* The submitter's User-Agent string.
* The submission timestamp.

If the "Login Required" option is enabled, the submitter's WordPress user ID is associated with the entry via the logged-in session.

No data is sent to external services except:

* **Email** — via `wp_mail()` to the configured recipient (default: site admin).
* **SMS** — only if you explicitly enable and configure the MeliPayamak SMS integration in Settings.

== External services ==

This plugin optionally connects to the **MeliPayamak** SMS gateway API to send SMS notifications to the site administrator when a new form submission is received.

* **What the service is and what it is used for:** MeliPayamak (melipayamak.com) is an Iranian SMS service provider. The plugin uses its REST API to deliver a short text notification (the configured SMS template) to the admin's phone number after each new entry, so the admin is instantly aware of new submissions.
* **What data is sent and when:** The request is sent **only** when SMS notifications are explicitly enabled in **Palette Form Builder → Settings → Notifications** and a new form entry is submitted. The data sent to `https://api.melipayamak.com/post/send.asmx/SendSms` includes: your MeliPayamak account username, your MeliPayamak account password, your sender number, the admin recipient phone number, and the SMS text (which may contain the site name, form title, entry ID, and a short summary of the submitted answers). No visitor data (such as IP address or User-Agent) is transmitted to MeliPayamak. The plugin also optionally calls `https://api.melipayamak.com/post/credit.asmx/GetCredit` to check your account balance, sending only your username and password.
* **Service terms and privacy policy:**
	* MeliPayamak Terms of Service: https://melipayamak.com
	* MeliPayamak Privacy Policy: https://melipayamak.com

By enabling SMS notifications you acknowledge that the submitted form answers (as configured in your SMS template) will be transmitted to MeliPayamak's servers.

= Data Removal =

When the plugin is deleted via the WordPress admin, `uninstall.php` removes:

* All `palette_form` posts and their meta.
* All `palette_entry` posts and their meta.
* The `palette_form_builder_settings` option.
* Cached transients.

== Installation ==

1. Upload the `palette-form-builder` folder to `/wp-content/plugins/`.
2. Activate the plugin through the **Plugins** menu in WordPress.
3. Go to **Palette Form Builder** in the admin sidebar to create your first form.
4. Add questions using the drag & drop builder, then publish.
5. Use the shortcode `[palette_form id="123"]` on any page or post (or use the "Place on Page" action).
6. Configure email/SMS notifications under **Palette Form Builder → Settings**.

== Frequently Asked Questions ==

= Does this plugin use any external CDN? =

No. All assets (Bootstrap, Bootstrap Icons, Vazirmatn font, SortableJS) are bundled locally inside the plugin's `assets/vendor/` directory. This complies with WordPress.org Plugin Guidelines and ensures your forms work even if external services are down.

= Is the plugin RTL-compatible? =

Yes. The plugin is fully RTL-aware and ships with the Vazirmatn Persian font. The admin interface and all strings are translated into Persian (fa_IR).

= How do I enable SMS notifications? =

1. Go to **Palette Form Builder → Settings → Notifications**.
2. Check "Enable SMS notifications".
3. Enter your MeliPayamak username, password, sender number, and recipient number.
4. Save settings. SMS will be sent via the MeliPayamak REST API using `wp_remote_post()`.

= Can I require users to log in before submitting? =

Yes. Each form has a "Login Required" checkbox in the Access Settings metabox. You can also set a global default in Settings → General.

= How are submissions exported? =

Go to **Palette Form Builder → Inbox**, optionally filter by form, then click "Export CSV". The file includes entry ID, date, form name, and all answers in UTF-8 (with BOM for Excel compatibility).

= Is my data removed when I uninstall the plugin? =

Yes. Deleting the plugin triggers `uninstall.php`, which removes all forms, entries, settings, and cached transients from your database.

== Screenshots ==

1. The form builder interface with drag & drop, collapsible cards, and visual type selector.
2. Live preview modal showing the form as users will see it.
3. The icon picker with searchable grid of 2,000+ Bootstrap Icons.
4. Entries inbox with pagination, filtering, and CSV export.
5. Single entry detail view with all submitted answers.
6. Settings page with General, Footer, and Notifications tabs.

== Changelog ==

= 1.4.1 =
* SECURITY: Fixed an XSS vulnerability in the client-side `escapeHtml()` helper where HTML entities were stripped during development, leaving title/description/options unescaped when rendered into the DOM.
* SECURITY: Sanitized the dynamic inline CSS output (`wp_add_inline_style`) with `sanitize_hex_color()` and `safecss_filter_attr()` so the per-form primary color meta value can no longer inject malicious CSS rules.
* SECURITY: Escaped the intro/outro text in the frontend JavaScript output with the new `escapeHtmlMultiline()` helper (late escaping at the point of output).
* SECURITY: Applied "escape late" to all dynamic output — IDs are cast with `absint()`, colors validated as hex, icon classes sanitized with `sanitize_html_class()`, and the settings tab state no longer echoes a variable.
* SECURITY: Hardened the CSV export filename against header injection by whitelist-filtering the date value.

= 1.4.0 =
* NEW: Documented the MeliPayamak external SMS service in the readme (External services section).
* UPDATE: Upgraded bundled SortableJS from 1.15.2 to 1.15.6.
* FIX: Removed leftover template content ("Arbitrary section" / "A Brief Markdown Example") from the readme.
* FIX: Moved inline `<style>` output to `wp_add_inline_style()` per WordPress.org guidelines.
* FIX: Lengthened all plugin prefixes from `pf`/`PF` to the 4+ character `palefobu`/`PALEFOBU` prefix to avoid naming collisions.
* FIX: Corrected the Contributors list to match the WordPress.org account username.

= 1.3.0 =
* NEW: Drag & drop question reordering (SortableJS 1.15.2, bundled locally).
* NEW: Live preview modal for forms.
* NEW: Visual type selector replacing dropdown.
* NEW: Color palette presets in the color picker.
* NEW: Collapsible question cards with type badges.
* NEW: Sticky toolbar and empty state.
* NEW: Keyboard shortcuts (Ctrl+Enter to add question).
* FIX: Question type not changing when switching between text/radio/checkbox.
* SECURITY: WordPress.org Plugin Guidelines audit — removed all CDN dependencies, replaced SoapClient with wp_remote_post, removed SSL verification bypass, added per-field sanitization of form data, added dismissible admin notices.

= 1.2.0 =
* NEW: Email notification system with customizable subject/body templates.
* NEW: SMS notification via MeliPayamak.
* NEW: CSV export of entries.
* NEW: Entry filtering by form and pagination.
* NEW: Login-required option per form.
* NEW: Footer customization in settings.
* FIX: Improved nonce verification and output escaping.

= 1.1.0 =
* NEW: Multi-step form wizard with progress bar.
* NEW: Toast notifications and double-submit prevention.
* NEW: Autosave answers to localStorage.
* NEW: Required field validation.
* NEW: Accessibility improvements (ARIA, focus management, keyboard nav).
* FIX: Mobile responsiveness and RTL layout fixes.

= 1.0.0 =
* Initial release.
* Form builder with text, radio, and checkbox question types.
* Shortcode rendering with Bootstrap 5 RTL.
* Entries storage as custom post type.
* Settings page with general, footer, and notification tabs.

== Upgrade Notice ==

= 1.4.0 =
Maintenance release addressing WordPress.org Plugin Review feedback: documented the MeliPayamak external service, upgraded SortableJS, and lengthened all prefixes to 4+ characters. Recommended for all users.

= 1.3.0 =
Major update: drag & drop builder, live preview, visual type selector, and full WordPress.org Plugin Guidelines compliance (all CDN dependencies removed, HTTP API used for SMS). Recommended for all users.

== Credits ==

This plugin bundles the following open-source libraries (all MIT licensed):

* [Bootstrap 5.3.3](https://getbootstrap.com/) — CSS framework.
* [Bootstrap Icons 1.11.3](https://icons.getbootstrap.com/) — Icon set.
* [Vazirmatn](https://github.com/rastikerdar/vazirmatn) — Persian font.
* [SortableJS 1.15.6](https://sortablejs.github.io/Sortable/) — Drag & drop library.
