Page Turn Feedback 1.8.1

Security and lightness review. A simulated attack on a real WordPress 7.1.4 (visitors, subscriber, contributor, author and editor accounts, forged requests without or with the wrong nonce, hostile text written straight into the database, hostile CSV files, hostile settings) found no vulnerability; the points below are hardening and weight.

• No work on pages without the card: ptfb_register_assets() used to ask the database for the feedback, read the style option and register the files on every front-end page (a query on the 404 page, on every post, in search…). It now checks first, with no query, whether the page can show the card (home page, or a post/page whose text contains the shortcode) and does nothing otherwise. The files are registered, and the colours and fonts added, the first time the card is really loaded (ptfb_enqueue_front()), also when the card is printed late by a widget or template.
• One query fewer on the home page: ptfb_get_items() no longer loads custom fields and terms it never uses (update_post_meta_cache, update_post_term_cache).
• Nothing extra on admin-ajax.php: the admin-only files are loaded with is_admin() && ! wp_doing_ajax(). admin-ajax.php also serves visitors for any plugin, and before this each of those requests parsed presets.php, ordering.php and tools.php for nothing.
• Block themes: the automatic placement uses the render_block_core/template-part filter instead of render_block, so the function no longer runs for every block of every page. The check on the block name became unnecessary and was removed.
• Fonts typed by hand: quotes are kept only when they come in pairs around each name ("Open Sans", Poppins); a quote that is never closed is removed (it used to swallow the CSS rules after it, such as the alignment). Same rule in PHP and in the live preview.
• Permissions of the single feedback: moving, resetting the order and importing a published feedback now also check edit_post / publish_posts (custom roles that can edit others' posts but not publish them leave the imported feedback pending). The list sent by the Order form is limited to the 300 rows the page shows.
• Tests: pages without the card (no query, no option read, nothing loaded), late printing, loading in dashboard / admin-ajax / front end (tests/load_test.php), permissions, font quotes (PHP and preview).
• No identifier was renamed, no option, string or markup changed: data saved by earlier versions is kept.

Page Turn Feedback 1.8.0

• Order by hand: new page Feedback → Order (includes/ordering.php). Drag and drop (jQuery UI Sortable, bundled with WordPress) and up/down buttons for keyboard and touch; the list is sent with a normal form to admin-post.php (nonce, edit_others_posts), no AJAX. Positions are stored in the standard menu_order field (1, 2, 3…); ptfb_get_items() now sorts by menu_order ASC, date DESC, so a site that never used the page sees exactly the same order as before (all positions are 0), and a new feedback (position 0) comes first until the order is saved again. "Back to automatic order" sets every position to 0. Rows beyond the ptfb_max_items limit are marked as not shown.
• CSV import and export: new page Feedback → Import and export (includes/tools.php). Columns name, comment, status, date, order (UTF-8 with BOM, CRLF). Import reads comma, semicolon or tab separated files, UTF-8 or Windows-1252, quoted fields with line breaks and doubled quotes (own small parser, no fgetcsv), header names in English or Italian, at most 500 rows and 1 MB, only the temporary upload is read. Comments go through wp_kses_post, names through sanitize_text_field; unknown statuses become drafts; invalid dates are ignored; rows already present (same name and comment) are skipped, so a file can be imported twice. Cells starting with =, +, -, @ get a leading apostrophe on export (and lose it on import) so spreadsheets do not run them as formulas. An example file can be downloaded. XML is left to WordPress's Tools → Export / Import (the post type is listed there and menu_order is exported).
• Ready-made styles: five presets (Paper, Night, Ocean, Sunset, Minimal; includes/presets.php) that fill in the colour, font and alignment fields of the settings form from a button row. Nothing is saved until Save Changes; nothing about presets is stored. Text contrast is at least 9:1 on the card and the title at least 5:1 on the band (checked by tests/admin_pages_test.php).
• Live preview: the settings page shows the real card (same markup from ptfb_output() in preview mode, same stylesheet and script) in a frame next to the form. Colours, fonts and alignment are applied without reloading, so the page keeps turning; title, sliding time and page-turn duration reload the frame. The CSS the script builds is checked against ptfb_inline_css() in tests/admin_features_test.py, which compares what the preview and the site draw for every ready-made style.
• ptfb_output() and ptfb_render() take optional $items and $preview arguments; the front-end output is unchanged.
• The admin-only files are loaded only in the dashboard. bin/i18n.py rebuilds .pot, .po and .mo from all PHP files.
• No identifier was renamed, no option was added or removed, front-end markup and CSS are unchanged: data saved by earlier versions is kept.

1.7.1

• Long words and web addresses now wrap inside the card instead of running past it.
• Block themes (e.g. Twenty Twenty-Five): the section is shown automatically before the footer.
• Own centered container on themes other than Fascinate; folded corner no longer painted by theme button styles.
• Translatable: English strings with Italian translation included.

Page Turn Feedback 1.5.0

First public release.

• Renamed from LSA Feedback Slider to Page Turn Feedback. The plugin author is now Velvet Leap.
• New technical identifiers: post type, options, shortcode [page_turn_feedback], filters and CSS prefix. Data saved by version 1.4.0 is not migrated.
• To install: download page-turn-feedback.zip below, then use Plugins > Add New > Upload Plugin in WordPress.

Full list of changes in CHANGELOG.md.