Sync master from upstream

README.md

@@ -2,9 +2,9 @@
 **Contributors:** [brainstormforce](https://profiles.wordpress.org/brainstormforce/)  
 **Tags:** forms, contact form, form builder, survey, payment form  
 **Requires at least:** 6.4  
-**Tested up to:** 7.0  
+**Tested up to:** 7.0.1  
 **Requires PHP:** 7.4  
-**Stable tag:** 2.12.1  
+**Stable tag:** 2.12.2  
 **License:** GPLv2 or later  
 **License URI:** http://www.gnu.org/licenses/gpl-2.0.html  
 
@@ -458,6 +458,9 @@ Yes. SureForms Business includes fully functional user registration forms and lo
 You can report security issues through our [Bug Bounty Program](https://brainstormforce.com/bug-bounty-program/). We collaborate with Patchstack to provide opportunities for researchers to report vulnerabilities. The Patchstack team will help validate, triage, and handle any reported security issues.
 
 ## Changelog ##
+### 2.12.2 - 20th July 2026 ###
+* New: Added a Payment History widget for Elementor and Bricks.
+* Fix: Custom CSS now applies correctly on the single form view.
 ### 2.12.1 - 8th July 2026 ###
 * New: Added an AI-powered quick draft flow on the dashboard to generate forms faster, with built-in usage tracking.
 * Improvement: Email fields now enforce standard RFC 5321 length limits (a 64-character local part and 255-character domain) to prevent oversized submissions, with a filter to customize the limits.
@@ -470,10 +473,6 @@ You can report security issues through our [Bug Bounty Program](https://brainsto
 * Fix: Forms with multiple Cloudflare Turnstile widgets now submit correctly instead of silently failing with a generic error.
 * Fix: Resolved an issue where the Stripe Payment Element failed to render on live accounts that have Bacs Direct Debit, Link, Cash App, or BNPL enabled.
 * Fix: Restored the form editor on WordPress 6.x sites running plugins that register older-style blocks such as ThirstyAffiliates, Ninja Forms, and Gravity Forms.
-### 2.11.1 - 16th June 2026 ###
-* Fix: Phone field auto country detection always resolved to the United States.
-* Fix: Corrected the Cloudflare Turnstile "Get Keys" link.
-* Fix: This update addressed a security bug. Props to Yaswanth Reddy Sunkara for reporting it responsibly to our team.
 The full changelog is available [here](https://sureforms.com/whats-new/?utm_source=wordpress.org&utm_medium=whats_new).
 
 ## Upgrade Notice ##

inc/abilities/ABILITIES.md

@@ -95,7 +95,9 @@ Complete reference for all 15 abilities registered with the WordPress Abilities
 - `emailConfirmation` — `{name, subject, emailBody}`
 - `compliance` — `{enableCompliance, neverStoreEntries, autoDeleteEntries, autoDeleteEntriesDays}`
 - `instantForm` — `{instantForm, showTitle, bannerColor, useBannerColorAsBackground, formBackgroundColor, formWidth, formSlug}`
-- `styling` — `{primaryColor, textColor, textColorOnPrimary, fieldSpacing, submitAlignment}`
+- `styling` — `{submitAlignment}`
+- `formStyling` — `{primaryColor, textColor, textColorOnPrimary, fieldSpacing, disableDefaultStyles}` (`disableDefaultStyles: true` disables SureForms' default frontend styles so the theme styling applies)
+  - Note on `disableDefaultStyles`: unstyled mode also drops SureForms' column/grid layout CSS (multi-column layouts collapse until the site's CSS re-provides them). The per-form Custom CSS on embedded views is scoped to the form container, so unscoped selectors like `body { … }` have no effect there. Custom CSS relies on native CSS nesting (2023+ browsers).
 
 **Output:**
 ```json

inc/abilities/forms/create-form.php

@@ -137,23 +137,27 @@ public function get_input_schema() {
 							'type'        => 'object',
 							'description' => __( 'Form styling settings including colors and spacing.', 'sureforms' ),
 							'properties'  => [
-								'primaryColor'       => [
+								'primaryColor'         => [
 									'type'        => 'string',
 									'description' => __( 'Primary/accent color as hex (e.g. #111C44).', 'sureforms' ),
 								],
-								'textColor'          => [
+								'textColor'            => [
 									'type'        => 'string',
 									'description' => __( 'Text color as hex (e.g. #1E1E1E).', 'sureforms' ),
 								],
-								'textColorOnPrimary' => [
+								'textColorOnPrimary'   => [
 									'type'        => 'string',
 									'description' => __( 'Text color on primary backgrounds as hex (e.g. #FFFFFF).', 'sureforms' ),
 								],
-								'fieldSpacing'       => [
+								'fieldSpacing'         => [
 									'type'        => 'string',
 									'description' => __( 'Spacing between fields.', 'sureforms' ),
 									'enum'        => [ 'small', 'medium', 'large' ],
 								],
+								'disableDefaultStyles' => [
+									'type'        => 'boolean',
+									'description' => __( 'When true, SureForms does not enqueue its default frontend styles for this form, so the active theme styling applies instead.', 'sureforms' ),
+								],
 							],
 						],
 						'emailNotification' => [

inc/abilities/forms/form-metadata.php

@@ -162,6 +162,9 @@ protected function apply_metadata_overrides( $post_metas, $meta_data ) {
 					$styling_data['field_spacing'] = $form_styling['fieldSpacing'];
 				}
 			}
+			if ( isset( $form_styling['disableDefaultStyles'] ) ) {
+				$styling_data['disable_default_styles'] = (bool) $form_styling['disableDefaultStyles'];
+			}
 
 			$post_metas['_srfm_forms_styling'] = $styling_data;
 		}

inc/abilities/forms/update-form.php

@@ -140,23 +140,27 @@ public function get_input_schema() {
 							'type'        => 'object',
 							'description' => __( 'Form styling settings including colors and spacing.', 'sureforms' ),
 							'properties'  => [
-								'primaryColor'       => [
+								'primaryColor'         => [
 									'type'        => 'string',
 									'description' => __( 'Primary/accent color as hex (e.g. #111C44).', 'sureforms' ),
 								],
-								'textColor'          => [
+								'textColor'            => [
 									'type'        => 'string',
 									'description' => __( 'Text color as hex (e.g. #1E1E1E).', 'sureforms' ),
 								],
-								'textColorOnPrimary' => [
+								'textColorOnPrimary'   => [
 									'type'        => 'string',
 									'description' => __( 'Text color on primary backgrounds as hex (e.g. #FFFFFF).', 'sureforms' ),
 								],
-								'fieldSpacing'       => [
+								'fieldSpacing'         => [
 									'type'        => 'string',
 									'description' => __( 'Spacing between fields.', 'sureforms' ),
 									'enum'        => [ 'small', 'medium', 'large' ],
 								],
+								'disableDefaultStyles' => [
+									'type'        => 'boolean',
+									'description' => __( 'When true, SureForms does not enqueue its default frontend styles for this form, so the active theme styling applies instead.', 'sureforms' ),
+								],
 							],
 						],
 						'emailNotification' => [

inc/form-styling.php

@@ -148,6 +148,146 @@ public static function has_custom_styling( $block_attrs ) {
 		return 'inherit' !== ( $block_attrs['formTheme'] ?? 'inherit' );
 	}
 
+	/**
+	 * Check if the form has default SureForms styling disabled.
+	 *
+	 * When enabled (via the `_srfm_forms_styling` meta set through REST/MCP, or
+	 * the `srfm_disable_default_styles` filter), the form is rendered without the
+	 * SureForms frontend stylesheets and inline CSS variables so the site's own
+	 * CSS fully controls the form's appearance.
+	 *
+	 * @param int|string $form_id Form post ID.
+	 * @return bool True when default styling is disabled for the form.
+	 * @since 2.12.2
+	 */
+	public static function is_default_styling_disabled( $form_id ) {
+		$form_id = absint( $form_id );
+		if ( ! $form_id ) {
+			return false;
+		}
+
+		$form_styling = get_post_meta( $form_id, '_srfm_forms_styling', true );
+		$disabled     = is_array( $form_styling ) && ! empty( $form_styling['disable_default_styles'] );
+
+		/**
+		 * Filters whether SureForms' default frontend styling is disabled for a form.
+		 *
+		 * Lets themes/plugins toggle the unstyled mode programmatically, overriding the
+		 * stored per-form meta. Return true to render the form without SureForms' default
+		 * stylesheets and inline CSS variables.
+		 *
+		 * @param bool $disabled Whether default styling is disabled (from meta).
+		 * @param int  $form_id  Form post ID.
+		 * @since 2.12.2
+		 */
+		return (bool) apply_filters( 'srfm_disable_default_styles', $disabled, $form_id );
+	}
+
+	/**
+	 * Check whether the SureForms frontend stylesheets can be skipped for a post.
+	 *
+	 * Returns true only when every SureForms form found on the post has default
+	 * styling disabled. When the forms on the post cannot be determined, the
+	 * stylesheets are kept as the safe default.
+	 *
+	 * @param \WP_Post $post Post being rendered.
+	 * @return bool True when the frontend stylesheets can be skipped.
+	 * @since 2.12.2
+	 */
+	public static function should_skip_frontend_styles( $post ) {
+		if ( SRFM_FORMS_POST_TYPE === $post->post_type ) {
+			$form_ids = [ $post->ID ];
+		} else {
+			$form_ids = self::get_form_ids_from_content( $post->post_content );
+		}
+
+		if ( empty( $form_ids ) ) {
+			return false;
+		}
+
+		foreach ( $form_ids as $form_id ) {
+			if ( ! self::is_default_styling_disabled( $form_id ) ) {
+				return false;
+			}
+		}
+
+		return true;
+	}
+
+	/**
+	 * Extract SureForms form IDs from post content.
+	 *
+	 * Looks for srfm/form blocks (including nested ones) and [sureforms]
+	 * shortcodes.
+	 *
+	 * @param string $content Post content.
+	 * @return array<int> Unique form IDs found in the content.
+	 * @since 2.12.2
+	 */
+	public static function get_form_ids_from_content( $content ) {
+		$form_ids = [];
+
+		// Also parse when the content embeds reusable/synced patterns (core/block
+		// refs) — a form inside a pattern appears as wp:block {"ref":N}, which
+		// has_block( 'srfm/form' ) alone would never see.
+		if ( has_block( 'srfm/form', $content ) || has_block( 'core/block', $content ) ) {
+			$visited_refs = [];
+			$form_ids     = self::collect_form_block_ids( parse_blocks( $content ), $visited_refs );
+		}
+
+		if ( has_shortcode( $content, 'sureforms' ) && preg_match_all( '/' . get_shortcode_regex( [ 'sureforms' ] ) . '/', $content, $matches ) ) {
+			foreach ( $matches[3] as $atts_string ) {
+				$atts = shortcode_parse_atts( $atts_string );
+				if ( is_array( $atts ) && ! empty( $atts['id'] ) ) {
+					$form_ids[] = absint( $atts['id'] );
+				}
+			}
+		}
+
+		return array_values( array_unique( array_filter( $form_ids ) ) );
+	}
+
+	/**
+	 * Recursively collect form IDs from parsed srfm/form blocks, following
+	 * reusable/synced pattern references (core/block) into their wp_block posts.
+	 *
+	 * @param array<mixed>     $blocks       Parsed blocks from parse_blocks().
+	 * @param array<int, true> $visited_refs Reusable-block post IDs already expanded,
+	 *                                       keyed by ID — guards against reference cycles.
+	 * @return array<int> Form IDs found in srfm/form blocks.
+	 * @since 2.12.2
+	 */
+	private static function collect_form_block_ids( $blocks, &$visited_refs = [] ) {
+		$form_ids = [];
+
+		foreach ( $blocks as $block ) {
+			if ( ! is_array( $block ) ) {
+				continue;
+			}
+			$attrs = isset( $block['attrs'] ) && is_array( $block['attrs'] ) ? $block['attrs'] : [];
+			if ( isset( $block['blockName'] ) && 'srfm/form' === $block['blockName'] && ! empty( $attrs['id'] ) && is_scalar( $attrs['id'] ) ) {
+				$form_ids[] = absint( $attrs['id'] );
+			}
+			// Reusable/synced pattern: expand the referenced wp_block post so a
+			// form living inside a pattern is detected like an inline block.
+			if ( isset( $block['blockName'] ) && 'core/block' === $block['blockName'] && ! empty( $attrs['ref'] ) && is_scalar( $attrs['ref'] ) ) {
+				$ref = absint( $attrs['ref'] );
+				if ( $ref && ! isset( $visited_refs[ $ref ] ) ) {
+					$visited_refs[ $ref ] = true;
+					$ref_post             = get_post( $ref );
+					if ( $ref_post instanceof \WP_Post && 'wp_block' === $ref_post->post_type && 'publish' === $ref_post->post_status && '' !== $ref_post->post_content ) {
+						$form_ids = array_merge( $form_ids, self::collect_form_block_ids( parse_blocks( $ref_post->post_content ), $visited_refs ) );
+					}
+				}
+			}
+			if ( ! empty( $block['innerBlocks'] ) && is_array( $block['innerBlocks'] ) ) {
+				$form_ids = array_merge( $form_ids, self::collect_form_block_ids( $block['innerBlocks'], $visited_refs ) );
+			}
+		}
+
+		return $form_ids;
+	}
+
 	/**
 	 * Map dimension block attributes (Top/Right/Bottom/Left/Unit) to form styling.
 	 *

inc/frontend-assets.php

@@ -161,27 +161,34 @@ public function register_scripts() {
 
 			if ( $load_assets ) {
 				// Load needed styles in head tag if current requested page has SureForms form.
-				self::enqueue_scripts_and_styles();
+				// Skip the SureForms stylesheets when every form on the page has default styling disabled.
+				self::enqueue_scripts_and_styles( Form_Styling::should_skip_frontend_styles( $current_post ) );
 			}
 		}
 	}
 
 	/**
 	 * Enqueue scripts and styles.
 	 *
+	 * @param bool $skip_form_styles When true, the SureForms stylesheets are not enqueued
+	 *                               (default styling disabled for the form). External library
+	 *                               styles and scripts are always loaded so advanced fields
+	 *                               like Dropdown and Phone keep working.
 	 * @return void
 	 * @since 0.0.11
 	 */
-	public static function enqueue_scripts_and_styles() {
+	public static function enqueue_scripts_and_styles( $skip_form_styles = false ) {
 		// Load the styles.
-		foreach ( self::$css_assets as $handle => $path ) {
+		if ( ! $skip_form_styles ) {
+			foreach ( self::$css_assets as $handle => $path ) {
 
-			// Skip single form styles if not on single form page.
-			if ( 'single' === $handle && ! is_singular( SRFM_FORMS_POST_TYPE ) ) {
-				continue;
-			}
+				// Skip single form styles if not on single form page.
+				if ( 'single' === $handle && ! is_singular( SRFM_FORMS_POST_TYPE ) ) {
+					continue;
+				}
 
-			wp_enqueue_style( SRFM_SLUG . '-' . $handle );
+				wp_enqueue_style( SRFM_SLUG . '-' . $handle );
+			}
 		}
 
 		// Load the external styles. Like Phone and Tom Select.