=== Simple Login Custom ===
Contributors: tlloancy
Stable tag: 1.8.0
Requires at least: 4.0
Tested up to: 7.1
Requires PHP: 7.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

An easy plugin to customize login and registration forms via shortcodes in WordPress.

== Credits ==

Maintained by [Thomas Lloancy](https://profiles.wordpress.org/tlloancy/) (WordPress.org: `tlloancy`).

== Description ==

**Simple Login Custom** lets you drop a custom login and registration form on any page with shortcodes, then style it from **Settings → Custom Login Settings**. No page builder required.

**Key Features:**

- **Custom Login Form:** Display a login form with `[customlogin_form]` and match it to your site colors, width, and border.
- **Live preview (1.8.0):** The Style tab shows the form and the login link as you type. Nothing is saved until you click the matching Save button. The preview never submits a real login.
- **Custom Login Link:** `[customlogin_link]` prints a sentence with a styled link that can scroll to the form.
- **Style Customization:** Colors use the native WordPress color picker. Width, padding, and border values accept CSS lengths only (for example `400px` or `1em`).
- **Recent Login Tracking:** From version 1.5.0, administrators can review the ten most recent successful logins (user, time, IP, user agent).
- **Built-in Registration:** Optional registration on the same shortcode, with a client-side password strength meter (1.7.0).
- **SIRET/DUNS Verification:** Optional company checks during registration. SIRET uses the INSEE Sirene API key (from 1.6.7). DUNS is a local match against the number you stored in settings.
- **Welcome Banner and Email:** After a successful registration, a banner is shown and a plain-text welcome email is sent.
- **Anti-Viral Mode (WP 7.0):** From version 1.7.0, optional self-deprecating reminders in the admin for whoever installed the plugin — not shown to visitors.

**How It Works:**

- Go to **Settings → Custom Login Settings** to style the form, edit the login-link sentence, enable registration, and configure SIRET/DUNS.
- Place `[customlogin_form]` on any page or post.
- Place `[customlogin_link]` where you want a “please log in” sentence.

**Installation:**

1. Install from Plugins → Add New, or copy the plugin folder to `/wp-content/plugins/`.
2. Activate **Simple Login Custom**.
3. Open **Settings → Custom Login Settings**. Adjust the live preview, then save.

== Screenshots ==

1. **Custom Login Form:** Preview of the modified login form.
2. **Customization Settings:** Settings interface for customizing login and registration options.
3. **Recent Login Tracking:** Interface showing the ten most recent recorded logins.
4. **Welcome Banner:** Preview of the welcome banner displayed after a successful registration.
5. **SIRET/DUNS Verification:** Interface for testing SIRET/DUNS numbers and token generation.

== Changelog ==

= 1.8.0 (August 25, 2026) =
* **WordPress 7.1**: Declared compatibility (`Tested up to: 7.1`).
* **Added**: Live preview on the Style tab — form colors, width, border, and the login link update as you type (admin JavaScript only, no page builder, no real login).
* **Security**: Colors, CSS lengths, border styles, and link URLs on the public form are sanitized before output (`sanitize_hex_color`, length whitelist, `esc_url`, `esc_attr`, `esc_html`, `wp_kses` on server-side preview HTML).
* **Security**: Recent-login AJAX is limited to administrators with a nonce. Unauthenticated access to that endpoint is removed.
* **Fixed**: SIRET registration no longer calls the OAuth2 helper removed in 1.6.7; it uses the INSEE API key flow already used by the SIRET test button.
* **Design**: Settings screen uses native WordPress admin patterns (`.form-table`, `.nav-tab-wrapper`, `.button`, `.notice`, color picker, striped log table). Removed the neon “matrix” login log and the iOS-style toggle.
* **Docs**: `readme.txt` plus `docs/USER-GUIDE.md` (English) and `docs/MODE-DEMPLOI.md` (French).

= 1.7.0 (May 26, 2026) =
* **WordPress 7.0**: Declared compatibility with WordPress 7.0.
* **Added**: Anti-Viral Mode — self-deprecating adoption humor for site owners in the WordPress admin (not shown to visitors).
* **Added**: Anti-Viral settings panel under **Settings > Custom Login Settings > Simple Login Control**.
* **Easter egg**: Anti-Viral Mode auto-enables when upgrading to 1.7.0 on sites already running WordPress 7.0+.
* **Added**: Password strength meter on the registration form (client-side only, no data collected).
* **Added**: French translations updated for new strings (compile `languages/simple-login-custom-fr_FR.mo` on French sites).

= 1.6.7 (May 6, 2026) =
* **Major Update**: Complete migration to the new INSEE Sirene API authentication system (API Key).
* Removed old OAuth2 system (Consumer Key + Consumer Secret + Bearer Token).
* Added single **"INSEE API Key"** field in settings (much simpler).
* Updated API endpoints to `/api-sirene/3.11/`.
* Full code cleanup: removed token generation, cron jobs, and old token test button.
* Fixed JavaScript errors in admin settings page.
* Improved overall stability and maintainability.
* Translation base switched to English (better practice).

= 1.6.6 =
- **Added**: Company name field added and editable in the user profile page.
- **Improved**: SIRET is now directly matched against the company name for verification.

= 1.6.5 =
- **Added**: Editable SIRET/DUNS field in the user profile page.

= 1.6.4 =
- **Added:** Validation of non-empty Consumer Key and Secret fields for SIRET verification.
- **Added:** Automatic OAuth2 token generation via the INSEE API when saving settings.
- **Added:** "Test Token" button to verify token generation.
- **Added:** Display of raw cURL errors from the INSEE API on failure.
- **Added:** Cron job to automatically renew the SIRET token every 6 days.
- **Fixed:** Resolved invalid nonce issues in preview AJAX calls.

= 1.6.3 =
- **Added:** CSS class custom-login-link on the login link generated by the [customlogin_link] shortcode to facilitate custom CSS transformations.

= 1.6.2 =
- **Added:** Display of a styled welcome banner (using the "Inria Sans" font) after a successful registration, with a close button.
- **Added:** Custom welcome email sent to new registrants.
- **Added:** "Last Name" and "First Name" fields in the registration form if the SIRET option is chosen. These fields are required only if SIRET is filled in.
- **Improved:** Styling of the "You are already logged in" message with a modern design and an improved logout link.
- **Fixed:** Adjusted close button position to prevent overlap with text.
- **Optimized:** Added logs for debugging options and registration data.

= 1.6.1 =
- **Added:** Option to choose between SIRET, DUNS, or no verification during registration, with dynamic fields for the SIRET API key or DUNS number.
- **Added:** The verification type field (SIRET/DUNS/None) only appears if registration is enabled.
- **Fixed:** Resolved blank page issue when saving settings.

= 1.6.0 =
- **Added:** Registration management integrated into the login form.
- **Improved:** Improved user interface for a better experience.

= 1.5.0 =
- **New Feature:** Added a tracking system for the ten most recent logins, improving user activity monitoring and security.
- **Simplified:** Improved style interface for easier customization of the login form appearance.

= 1.0.1 =
- **Multilingual Support:** Added translation files for increased accessibility.

== FAQ ==

= How can I customize the login form style? =

Open **Settings → Custom Login Settings**. The Style tab has a live preview on the right: change a color or width and the mock form updates immediately. Click **Save form style** (and **Save link style** / **Save registration setting** if you changed those forms) so the public shortcode picks up the values.

= Does the live preview log anyone in? =

No. It is a static mock in the admin. Inputs are disabled. Saving is what writes options to the database.

= What is the ten last logins tracking? =

Since version 1.5.0, the plugin stores the ten most recent successful WordPress logins (username, time, IP, user agent) for administrators on the **Simple Login Control** tab. This is not a full audit log.

= Can I use this plugin with other security plugins? =

Yes. Simple Login Custom styles a shortcode form and optional registration. It does not replace WordPress authentication. Avoid two plugins fighting over the same login markup on the same page.

= How do I insert the login form into a page? =

Use the `[customlogin_form]` shortcode in the page or post editor.

= Does customization affect the security of the login form? =

Visual options do not change how WordPress checks passwords. From 1.8.0, stored colors and CSS lengths are sanitized so they cannot break out of the inline `style` attribute.

= Can I change the login link text? =

Yes. On the Style tab, edit the sentence prefix and the linked words, then save the link form. `[customlogin_link]` outputs that sentence (hidden when the visitor is already logged in).

= How do I configure SIRET verification? =

Enable registration, choose **SIRET**, paste your INSEE API key from [portail-api.insee.fr](https://portail-api.insee.fr/), and save the form style. Use **Test** with a 14-digit SIRET to check the key. Company name is required on the public form only when the SIRET field is filled.

= How can I report a bug or suggest a new feature? =

Use the plugin support forum on WordPress.org or open a ticket on the project you maintain for this plugin.

= When are company fields required in the registration form? =

If SIRET verification is enabled, the company name field is required only when the visitor fills in a SIRET. An empty SIRET skips the INSEE lookup.

== Recommended Plugins ==

To improve user experience and the ergonomics of your site, here are plugins we recommend for their synergy with **Simple Login Custom**:

- **Page Scroll to ID**: This plugin is perfect for creating smooth and intuitive navigation on your site. It allows users to click links to scroll the page to a specific element, which is ideal for content-heavy pages or single-page sites. Compatibility with **Simple Login Custom** ensures that even after a login or redirect, users can still navigate effectively.

- **LoginWP (Formerly Peter's Login Redirect)**: Designed to manage redirects after login or logout, **LoginWP** is essential for customizing the login experience. You can redirect users to different pages based on their roles, capabilities, or even specific rules. This strengthens security by preventing unauthorized access to sections of the site and integrates perfectly with **Simple Login Custom** for a smooth and secure login experience.

**Why these plugins?**

- **Ease of Use:** Both plugins are known for their intuitive interface and ease of integration with WordPress, making customization accessible even to users without in-depth development knowledge.
- **Improved User Experience:** **Page Scroll to ID** improves navigation on your site and ensures an optimal user experience.
