Sync master from upstream

.github/workflows/code-analysis.yml

@@ -112,3 +112,9 @@ jobs:
 
             - name: Lint CSS
               run: npm run lint-css
+
+            # No other job runs the JS unit tests. Without this step the entry
+            # sanitizer policy has no gate: widening it back to DOMPurify's
+            # defaults would break tests that never execute in CI.
+            - name: JS unit tests
+              run: npm run test:unit

Gruntfile.js

@@ -274,9 +274,25 @@ module.exports = function ( grunt ) {
 				],
 			},
 			plugin_function_comment: {
+				// JS is swept as well as PHP. The sweep used to glob PHP only, so
+				// `@since` version placeholders in JS survived every release.
+				// (Do not write the literal placeholder in these comments — this task
+				// rewrites its own file, and it would be substituted on the next bump.)
+				//
+				// `src` is the source of truth, but it is NOT sufficient on its own —
+				// two placeholders currently ship from trees `src/**/*.js` cannot reach:
+				//   inc/page-builders/elementor/assets/elementor-preview-styling.js:8
+				//   assets/js/payment-history.js:8
+				// `inc/` is not in .distignore at all, and .distignore excludes only
+				// `assets/js/unminified`, so `assets/js/*.js` goes to wordpress.org.
+				// Both are therefore in scope deliberately; narrowing to `src` would
+				// leave placeholders in the shipped ZIP.
 				src: [
 					'*.php',
 					'**/*.php',
+					'src/**/*.js',
+					'inc/**/*.js',
+					'assets/js/**/*.js',
 					'!node_modules/**',
 					'!php-tests/**',
 					'!bin/**',
@@ -285,7 +301,10 @@ module.exports = function ( grunt ) {
 				overwrite: true,
 				replacements: [
 					{
-						from: /x.x.x/ig,
+						// Dots escaped: unescaped they match any character, so the
+						// pattern would also rewrite incidental strings such as
+						// "x1x2x" — a real risk now that minified JS is in scope.
+						from: /x\.x\.x/gi,
 						to: '<%=pkg.version %>',
 					},
 				],

assets/js/payment-history.js

@@ -5,7 +5,7 @@
  * and multi-step subscription cancellation flow.
  *
  * @package
- * @since x.x.x
+ * @since 2.8.0
  */
 
 ( function () {

assets/js/unminified/blocks/textarea.js

@@ -223,7 +223,7 @@ function handleQuillEditorA11Y( areaField ) {
  * Localizes the Quill editor toolbar labels using WordPress translations.
  *
  * @param {HTMLElement} areaField - The textarea element enhanced by Quill editor.
- * @since x.x.x
+ * @since 2.8.0
  */
 function localizeQuillToolbar( areaField ) {
 	if ( typeof srfm_quill_i18n === 'undefined' ) {

assets/js/unminified/frontend.js

@@ -491,6 +491,22 @@ function onHCaptchaError() {
 			element.classList.add( 'srfm-has-dark-bg' );
 		}
 
+		/**
+		 * Skip the CSS variable adjustment for de-skinned forms. When default styling
+		 * is disabled ( the `srfm-styling-none` marker class ), the default stylesheet
+		 * that consumes `--srfm-expandable-menu-background` is not enqueued, the
+		 * derived variables ( e.g. `--srfm-color-input-text` ) are not printed — so
+		 * the luminance check below degenerates and this branch would run for every
+		 * form — and the container may have no inline <style> tag at all, which
+		 * previously caused an unguarded `querySelector( 'style' ).innerHTML` crash
+		 * that also broke initialization of every later form on the page.
+		 * The `srfm-has-dark-bg` class above is still applied — it works without the
+		 * default stylesheet and is documented as a hook for custom styling.
+		 */
+		if ( element.classList.contains( 'srfm-styling-none' ) ) {
+			return;
+		}
+
 		/**
 		 * Lets calculate the form's text color.
 		 */
@@ -517,7 +533,17 @@ function onHCaptchaError() {
 				'form-id'
 			) } { ${ cssElements.join( ' ' ) } }`;
 
-			element.querySelector( 'style' ).innerHTML += styles;
+			// The container's inline <style> block is conditional ( it is omitted when
+			// default styling is disabled and no custom CSS exists ) — create it when
+			// missing instead of dereferencing null.
+			let styleTag = element.querySelector( 'style' );
+
+			if ( ! styleTag ) {
+				styleTag = document.createElement( 'style' );
+				element.appendChild( styleTag );
+			}
+
+			styleTag.innerHTML += styles;
 		}
 	}
 

assets/js/unminified/preview-styling.js

@@ -11,7 +11,7 @@
  * properties are defined in a <style> tag nested inside the container.
  *
  * @package
- * @since x.x.x
+ * @since 2.7.0
  */
 ( function () {
 	'use strict';
@@ -41,7 +41,7 @@
 	 * Build CSS text for all variable overrides and apply via the dynamic <style> tag.
 	 *
 	 * @param {Object} cssVars Key-value pairs of CSS variable names to values.
-	 * @since x.x.x
+	 * @since 2.7.0
 	 */
 	function applyCssVarOverrides( cssVars ) {
 		let cssText = '.' + containerId + ' {\n';

inc/abilities/ABILITIES.md

@@ -321,7 +321,7 @@ Complete reference for all 15 abilities registered with the WordPress Abilities
 
 ### 10. `sureforms/get-entry`
 
-**Get Entry Details** — Retrieve detailed entry information including submitted field data with decrypted labels.
+**Get Entry Details** — Retrieve detailed entry information including submitted field data with decoded labels.
 
 **File:** `inc/abilities/entries/get-entry.php`
 

inc/abilities/entries/bulk-get-entries.php

@@ -20,7 +20,7 @@
  * Bulk_Get_Entries ability class.
  *
  * Retrieves detailed information about multiple form submission entries
- * in a single call, including parsed form data with decrypted labels.
+ * in a single call, including parsed form data with decoded labels.
  *
  * @since 2.5.2
  */

inc/abilities/entries/entry-parser.php

@@ -29,15 +29,15 @@ trait Entry_Parser {
 	/**
 	 * Parse a raw entry array into the standard response shape.
 	 *
-	 * Handles form data decryption, form title lookup,
+	 * Handles form data decoding, form title lookup,
 	 * submission info building (with IP masking), and user info.
 	 *
 	 * @param array<string,mixed> $entry Raw entry from the database.
 	 * @since 2.5.2
 	 * @return array<string,mixed> Parsed entry data (without entry_id — caller prepends it).
 	 */
 	protected function parse_entry( array $entry ) {
-		// Parse form data with decrypted labels.
+		// Parse form data with decoded labels (submitter-controlled; escape at the sink).
 		$form_data       = [];
 		$excluded_fields = Helper::get_excluded_fields();
 		$entry_form_data = $entry['form_data'] ?? [];
@@ -53,7 +53,7 @@ protected function parse_entry( array $entry ) {
 
 				$label_parts      = explode( '-lbl-', $field_name );
 				$label            = isset( $label_parts[1] ) ? explode( '-', $label_parts[1] )[0] : '';
-				$label            = $label ? Helper::decrypt( $label ) : '';
+				$label            = $label ? Helper::decode( $label ) : '';
 				$field_block_name = Helper::get_block_name_from_field( $field_name );
 
 				$form_data[] = [

inc/abilities/entries/get-entry.php

@@ -20,7 +20,7 @@
  * Get_Entry ability class.
  *
  * Retrieves detailed information about a specific form submission entry,
- * including parsed form data with decrypted labels.
+ * including parsed form data with decoded labels.
  *
  * @since 2.5.2
  */

inc/abilities/entries/list-entries.php

@@ -74,7 +74,7 @@ public function get_input_schema() {
 				],
 				'search'    => [
 					'type'        => 'string',
-					'description' => __( 'Search entries by entry ID.', 'sureforms' ),
+					'description' => __( 'Search entries by entry ID, form title, or submitted form data. Text search requires at least 3 characters; numeric terms match the entry ID exactly.', 'sureforms' ),
 				],
 				'date_from' => [
 					'type'        => 'string',
@@ -97,7 +97,7 @@ public function get_input_schema() {
 				'orderby'   => [
 					'type'        => 'string',
 					'description' => __( 'Column to order results by.', 'sureforms' ),
-					'enum'        => [ 'created_at', 'ID', 'form_id', 'status', 'language' ],
+					'enum'        => [ 'created_at', 'ID', 'id', 'form_id', 'status' ],
 					'default'     => 'created_at',
 				],
 				'order'     => [
@@ -128,7 +128,6 @@ public function get_output_schema() {
 							'form_id'    => [ 'type' => 'integer' ],
 							'form_title' => [ 'type' => 'string' ],
 							'status'     => [ 'type' => 'string' ],
-							'language'   => [ 'type' => 'string' ],
 							'created_at' => [ 'type' => 'string' ],
 						],
 					],
@@ -155,7 +154,9 @@ public function execute( $input ) {
 		$args = [
 			'form_id'   => Helper::get_integer_value( $input['form_id'] ?? 0 ),
 			'status'    => ! empty( $input['status'] ) ? sanitize_text_field( Helper::get_string_value( $input['status'] ) ) : 'all',
-			'search'    => ! empty( $input['search'] ) ? sanitize_text_field( Helper::get_string_value( $input['search'] ) ) : '',
+			// isset(), not ! empty(): a literal "0" search is a valid term and must not be
+			// dropped (which would return every entry). Mirrors the REST path.
+			'search'    => isset( $input['search'] ) ? sanitize_text_field( Helper::get_string_value( $input['search'] ) ) : '',
 			'date_from' => ! empty( $input['date_from'] ) ? sanitize_text_field( Helper::get_string_value( $input['date_from'] ) ) : '',
 			'date_to'   => ! empty( $input['date_to'] ) ? sanitize_text_field( Helper::get_string_value( $input['date_to'] ) ) : '',
 			'per_page'  => $per_page,
@@ -182,7 +183,6 @@ public function execute( $input ) {
 					'form_id'    => $form_id,
 					'form_title' => $form_title,
 					'status'     => $entry['status'] ?? '',
-					'language'   => Helper::get_string_value( $entry['language'] ?? '' ),
 					'created_at' => $entry['created_at'] ?? '',
 				];
 			}

inc/compatibility/multilingual/providers/null-provider.php

@@ -174,4 +174,15 @@ public function translate_package_string( array $package, string $name, string $
 		unset( $package, $name );
 		return $value;
 	}
+
+	/**
+	 * Delete a string package. No-op for the Null provider.
+	 *
+	 * @param array<string,string> $package Package descriptor.
+	 * @since 2.12.3
+	 * @return void
+	 */
+	public function delete_package( array $package ): void {
+		unset( $package );
+	}
 }

inc/compatibility/multilingual/providers/provider.php

@@ -157,4 +157,20 @@ public function register_package_string( array $package, string $name, string $v
 	 * @return string Translated value, or the original when no translation exists.
 	 */
 	public function translate_package_string( array $package, string $name, string $value ): string;
+
+	/*
+	 * NOTE: delete_package( array $package ): void is deliberately NOT declared here.
+	 *
+	 * This interface is a public extension point — Multilingual_Manager::resolve_provider()
+	 * accepts any object via the `srfm_multilingual_provider` filter (@since 2.11.0) and
+	 * instanceof-checks it. Adding a bodyless method to a shipped interface is a
+	 * fatal-error BC break: a third-party provider written against 2.11.0-2.12.2 would
+	 * fail at class-declaration time on update, producing a white screen rather than a
+	 * degraded feature. Guarding the call site does not help, because the fatal happens
+	 * when the implementor's class is declared, not when the method is called.
+	 *
+	 * Both first-party providers implement delete_package(), and String_Collector
+	 * feature-detects it before calling. If it is ever promoted into this contract, that
+	 * must be a major release with a migration note for custom providers.
+	 */
 }

inc/compatibility/multilingual/providers/wpml-provider.php

@@ -310,6 +310,31 @@ public function translate_package_string( array $package, string $name, string $
 		return is_string( $translated ) ? $translated : $value;
 	}
 
+	/**
+	 * {@inheritDoc}
+	 *
+	 * Removes the package and its translations from WPML via the
+	 * `wpml_delete_package` action, keyed by the package name + kind.
+	 *
+	 * @param array<string,string> $package Package descriptor.
+	 * @since 2.12.3
+	 * @return void
+	 */
+	public function delete_package( array $package ): void {
+		if ( ! $this->supports_packages() ) {
+			return;
+		}
+
+		$name = $package['name'] ?? '';
+		$kind = $package['kind'] ?? '';
+
+		if ( '' === $name || '' === $kind ) {
+			return;
+		}
+
+		do_action( 'wpml_delete_package', $name, $kind );
+	}
+
 	/**
 	 * Build the active-language list from the most reliable WPML surface available.
 	 *