Wonyx Form Builder 3.7.7
- Sanitized and validated decoded Test Email SMTP configuration before any value reaches PHPMailer, including strict host, port, username and encryption handling.
- Hardened saved SMTP settings and mail transport setup with the same context-specific validation as a defense-in-depth measure.
- Validated form schema JSON before context-specific sanitization and storage.
- Restricted form background images to HTTP(S) URLs and percent-encoded CSS string/url delimiters before generating background-image CSS.
- No database schema changes.

Wonyx Form Builder 3.7.6
- Restricted font-family styling to fixed, plugin-owned choices so saved schema values cannot inject CSS.
- Hardened privacy file erasure against duplicate field-label collisions before deleting local uploads.
- No database schema changes.

Wonyx Form Builder 3.7.5
- Removed the auxiliary SOURCE.md file from the production package; source/build documentation remains in readme.txt.

Wonyx Form Builder 3.7.4
- Removed arbitrary Custom CSS input/storage/output; supported styling remains available through structured builder controls.
- Removed the short afb_form shortcode alias to avoid namespace collisions.
- Documented that assets/admin.js and assets/front.js are directly maintained human-readable sources with no build process.
- Simplified JSON export encoding for review compatibility.

3.7.3
- Fixed the final Plugin Check output-escaping findings for internally escaped form/repeater markup.
- Sanitized dynamic submitted field values at the point of input for regular and partial submissions.

Wonyx Form Builder - Changelog

3.7.2
- Resolved Plugin Check output-escaping findings while preserving trusted form/PDF/download rendering.
- Reworked custom-table SQL to use WordPress 6.2+ %i identifier placeholders and prepared value placeholders.
- Replaced direct unlink calls with wp_delete_file() and removed unnecessary php://output fclose usage.
- Hardened frontend submission, OTP, tracking, partial-save, signature and upload input handling.
- Reworked bulk entry updates/deletes to use typed $wpdb helpers instead of dynamic IN() SQL.
- Added explicit nonce verification inside CAPTCHA/upload/signature helpers used by frontend AJAX submissions.
- Added explicit versions and documented Plugin Check exceptions for optional third-party CAPTCHA/Places service SDKs.
- Minimum supported WordPress version is now 6.2 because identifier placeholders are used for custom-table queries.
- No database schema changes.

3.7.1
- Fixed the automated DirectDB Plugin Check finding in the Entries screen with a fixed-shape prepared query.
- Hardened filtered CSV/Excel exports and REST entry queries with explicit prepared branches.
- Updated WordPress.org Tested up to metadata to 7.1.
- No database schema changes.

3.7.0
- WordPress.org publication hardening release.
- Canonical Wonyx package/slug/text-domain cleanup.
- Removed arbitrary Custom JavaScript execution.
- Added privacy exporter/eraser integration, secure exports, safer IP handling, CSV injection protection and enqueue-based external scripts.
- Added unique Wonyx storage/action prefixes with migration from legacy private builds.

== Version 3.0.0 ==
Major enterprise-core update:
* Global Settings for email branding, primary inbox defaults, spam protection, daily reports and REST API.
* Persistent failed-email queue with up to five delivery attempts.
* Primary + fallback SMTP support.
* Mail Queue and Activity Log admin screens.
* Manual Resend Email from Entries.
* Form clone, JSON import/export, CSV and Excel-compatible exports.
* New fields: radio, star rating, NPS, consent, colour, Australian ABN, image choice, dynamic/dependent dropdown, appointment.
* Australian ABN checksum and phone validation.
* Dynamic dependent dropdown mapping.
* Basic appointment availability/day restrictions.
* hCaptcha and Cloudflare Turnstile in addition to reCAPTCHA.
* Zapier / Make / Pabbly webhook integration.
* Per-form/global spam word and disposable-domain blocking.
* Minimum completion time, IP rate limiting and duplicate lead window.
* Authenticated REST endpoints for forms and entries.
* Daily scheduled submission reports.
* Existing drag/drop, multi-step, calculations, repeaters, signatures, uploads, address autocomplete, partial leads, CRM, PDF, webhooks, Google Sheets, popup/slide-in, analytics, revisions and templates retained.

External services require valid credentials and provider-side configuration. WordPress cron depends on site traffic unless a real server cron triggers wp-cron.php.


= 3.0.1 =
* Recovery release with collision-safe bootstrap.
* Defensive activation/database upgrade.
* Uses core cron schedules for maximum host compatibility.
* Existing forms and settings are preserved.


= 3.0.2 =
* Rewrote the v3 Global Settings admin block in parser-safe PHP.
* Added explicit WordPress/PHP compatibility headers.
* Fixed the parse-fatal path reported around the v3 admin methods.


= 3.1.0 =
* Added global and per-field label position controls: outside or inside the input.
* Added professional input styling controls for height, radius, border width/style/color, focus color, padding, font size, alignment and placeholder color.
* Added label typography controls for color, size, weight, alignment and spacing.
* Added responsive heading controls for color, desktop/tablet/mobile size, weight, alignment and spacing.
* Added complete submit/next button styling: background/hover/text/border, radius, height, font, transform, width, alignment and shadow.
* Added built-in no-dependency SVG icons for common input fields and submit buttons with left/right positioning.
* Added live builder preview support for the new appearance controls.
* Existing forms remain compatible; no database schema migration is required.


= 3.1.1 =
* Fixed frontend asset loading when forms are rendered after wp_head() by enqueueing the base bundle early.
* Added a scoped runtime style fallback so saved Styling settings always reach shortcode/dedicated form output.
* Hardened frontend input, label, heading and button styles against theme CSS overrides.
* Fixed input styling accidentally affecting checkbox, radio, range, file and colour controls.
* Added exact 12-column frontend layout spans for 25/33/50/66/75/100% widths across desktop/tablet/mobile.
* Made inside-label mode server-rendered as well as JavaScript-enhanced to prevent frontend mismatch/flicker.
* Fixed date/time/range field icon support parity with the builder.
* Applied brand/accent colours consistently to progress and choice controls and improved composite calculation styling.
* Improved submit auto-width alignment, button shadow colour, required-mark hiding and secondary action consistency.
* No database migration required; existing forms/settings remain compatible.


== Version 3.1.2 ==
* Fixed frontend input icons overlapping placeholder/text when runtime !important padding was applied.
* Inside-label required markers now respect Hide required * after frontend JavaScript enhancement.
* Hide all icons no longer leaves empty icon padding.
* Strengthened form max-width and theme-resistant frontend control resets.
* Rebuilt builder preview spacing/grid to track the real frontend.
* Builder preview now reflects responsive gap/font, input padding/alignment/focus, label gap, heading spacing, button width/alignment/icon gap/shadow, remove frame/borders, and progress colour.


== Version 3.2.0 ==
* Added native linear and radial gradient controls across the visual Styling panel.
* Form backgrounds can now use a custom two-colour gradient with adjustable angle.
* Input backgrounds can use solid or gradient fills while preserving border, radius and icon spacing controls.
* Heading text can use solid or gradient text with CSS background-clip rendering on the frontend and builder preview.
* Label text can also use solid or gradient text.
* Submit/Next buttons now support separate normal and hover gradients, including independent colours, type and angle.
* Progress/pagination bars can use solid or gradient fills.
* Gradient settings are sanitized and generated server-side rather than accepting arbitrary CSS values.
* Builder preview and frontend use the same gradient settings; no database migration is required.


== Version 3.3.0 ==
* Added optional email OTP verification to Email fields.
* Visitors receive a 6-digit code and must verify the exact address before continuing/submitting.
* Server-side verification tokens are bound to the form, field and email address and expire after 30 minutes.
* OTP codes expire after a configurable 2-30 minutes.
* Configurable resend cooldown from 30-300 seconds.
* Five-code-attempt limit plus per-email/IP request throttling to reduce abuse and mail bombing.
* Disposable/blocked email domains are rejected before an OTP is sent.
* OTP emails use the form's existing Email Delivery method, sender, SMTP/fallback SMTP and branding.
* Multi-step forms block Next until enabled email fields on that step are verified.
* Final Submit stays disabled while a required OTP-enabled email is unverified.
* Verified status is recorded with the submission and verification tokens are single-use after a successful submission.
* No database migration required.

= 3.3.3 =
* Rebuilt the Forms dashboard as a full-width responsive table.
* Fixed ID, metrics, last-edited and action-column alignment.
* Added consistent Preview, Clone and Delete action buttons.
* Added responsive mobile card layout and improved form search styling.


= 3.4.0 =
* Added separate Export JSON and Export TXT options in the form builder.
* TXT exports contain the same complete structured form configuration as JSON exports, saved as a portable plain-text file.
* Both JSON and TXT exports include fields, settings, email configuration, styling, tracking, addons, conditional logic and OTP settings.
* Import now explicitly accepts Wonyx Form Builder .json and .txt exports and handles UTF-8 BOM safely.
* Export filenames use the form name for easier backup management.


= 3.5.0 =
* Added a professional Import Form option beside New Form on the Forms dashboard.
* Import automatically detects Wonyx Form Builder JSON/TXT exports and supported legacy TXT exports.
* Added legacy TXT migration using the export's meta_builder data with raw-deflate builder fallback.
* Converts compatible legacy fields, field widths, multi-step pages, labels/placeholders, required states and common field icons.
* Converts notification recipients/sender/subject/body, autoresponder settings, redirect URL and webhook URL.
* Converts common legacy appearance settings including form width, label-inside mode, frame/border/asterisk/icon visibility, colours, font family, heading styles and common border-radius CSS.
* Imported legacy forms open directly in the visual builder with a migration notice for review.
* Import files are limited to JSON/TXT and 5 MB for safer admin uploads.
* Existing forms, entries and database structure are unchanged.


= 3.5.2 =
* Email OTP verification panel now spans the full form row while preserving the original email/adjacent field widths.
* Updated helper copy to: “Verify this mail address before submitting the form.”
* Builder preview mirrors the same full-width OTP row layout.

= 3.5.1 =
* Fixed legacy dropdown migration for optionsListShow/options_list_show/options_list.
* Preserves legacy blank dropdown placeholder labels without turning them into selectable values.
* Preserves legacy collect-IP, redirect delay and redirect-message behavior.
* Added imported minimum/maximum character validation and numbers-only validation.
* Relaxed generic phone validation to safe 8-15 digit international input instead of forcing Australian-only numbering.
* Added field-level server validation messages on the frontend.


= 3.5.4 =
* UX hardening audit: safer field delete with confirmation and conditional-logic cleanup.
* Prevent accidental duplicate/missing submit buttons in the builder.
* Drag existing fields only from the drag handle to avoid accidental reordering.
* Preserve native Ctrl/Cmd+Z and Ctrl/Cmd+Y while typing in editor controls.
* Escape closes field editor and Help/History overlays.
* On mobile, selecting a field scrolls its editor into view.
* Switching major builder tabs clears stale field selection.
* Save state no longer incorrectly reports Saved when edits happen during an in-flight save.
* Frontend submission re-applies OTP lock after AJAX completes and focuses the first server-invalid field.
* Popup/slide-in forms can be closed with Escape.


= 3.5.5 =
* Rebranded the plugin UI and product name to Wonyx Form Builder.
* New canonical shortcode is [wonyx_form id="FORM_ID"].
* Existing [ankush_form] and [afb_form] shortcodes remain supported as backward-compatible aliases so existing pages do not break.
* New exports identify the product as wonyx-form-builder; legacy JSON/TXT exports from earlier versions remain import-compatible.
* Added the Wonyx REST namespace while retaining the legacy REST namespace for compatibility.




= 3.6.1 =
* Set Wonyx IT Solutions as the company/author identity and Ankush as the developer.
* Added the official company website: https://www.mywonyx.com/.
* Plugin metadata now links the author/company name to the official website.
* No database migration required; existing forms, entries and settings remain compatible.

= 3.6.0 =
* Removed the plugin-specific PHP-version gate from package metadata for broader hosting compatibility.
* Reworked PHP 7 null-coalescing syntax to older-compatible isset/ternary syntax for broader hosting compatibility.
* Kept the WordPress minimum requirement unchanged; actual PHP compatibility remains bounded by the PHP versions supported by the installed WordPress core and required extensions.
* No database migration required; existing forms, entries and settings remain compatible.

= 3.5.9 =
* Removed all third-party product-name references from plugin headers, admin UI, help/import copy, comments, importer internals and documentation.
* Legacy TXT import remains available using format-based detection and generic migration wording.
* Existing Wonyx JSON/TXT imports, forms, entries and database data remain compatible.


= 3.5.8 =
* Fixed form container radius parity so the saved radius is applied directly on the rendered form and is no longer masked by the mobile base stylesheet.
* Added editable outer form border controls: on/off, width, style and colour.
* Builder preview now mirrors the saved form border and radius exactly.
* Existing forms keep the previous 1px solid #e5e7eb border by default; set Form border off or Border style to None to remove it.

= 3.5.7 =
* Inside-input display now prioritises the field Placeholder text and falls back to the Label only when Placeholder is blank.
* Keeps the Label unchanged for API/data mapping while allowing user-facing wording to be customised safely.
* Builder preview and frontend now use the same placeholder-first rule for text, textarea, select, address, ABN and dynamic select fields.

= 3.5.6 =
* Added adjustable form container corner radius.
* Added configurable form box shadow with on/off, X/Y offset, blur, spread, colour and opacity controls.
* Added separate input text font weight.
* Added dedicated Placeholder / Inside Label text size and font-weight controls.
* Existing outside Label size and weight controls remain under Labels & Headings.
* Builder preview and frontend runtime styling use the same new controls.
