Sign-up Sheets

2.4.0 | 2026-09-16

• Added preview to the Gutenberg block with settings moved to the editor sidebar.
• Updated Gutenberg block to use block API version 3 (requires WordPress 6.0+).
• Updated Settings page to a redesigned layout with sidebar navigation and live search.
• Updated the default simple captcha to use a randomized answer instead of a fixed one.
• Added ability for sheet “Preview” to show preview of meta field values such as sheet date and tasks rather than just the sheet description WP offers natively.
• Added config to disable the default sheet “archive” page that lists all sheets the /sheet/ URL.
• Added setting to hide your theme’s default Previous/Next post navigation on sheet pages if theme implements it (hidden by default).
• Fixed an inverted honeypot anti-spam check that could allow spam submissions through.
• Fixed error when accessing Manage Sign-ups page with invalid post ID by adding validation check.
• Fixed cursor jumping to the end of task fields when clicking to edit them in the admin sheet editor.
• Fixed the confirmation email message field stripping the “<{removal_link}>” placeholder (and any other literal “<…>” text) on every settings save.
• Hardened nonce verification, capability checks, input sanitization, and output escaping across Settings, bulk edit, sheet preview, custom fields, and the Gutenberg block. [Security]
• Hardened an internal file-loading safeguard. [Security]
• Hardened access control for displaying full sign-up contact details on the front end. [Security]
• Hardened access control on sheet task save and the Manage Sign-ups deletion actions (single and bulk). [Security]
• Hardened debug logging to prevent unauthorized data exposure. [Security]
• Hardened access control on the Manage Sign-ups page and CSV export, and narrowed the Sign-up Sheet Viewer role to read-only capabilities. [Security]
• Hardened database migration state checks and re-run access control. [Security]
• Hardened signup meta field handling against tampering from submitted form data. [Security]
• Hardened role capability revocation on deactivation so previously granted capabilities, including Pro sheet-category taxonomy permissions, are fully removed. [Security]
• Hardened the Help page email test form with nonce verification, input sanitization, and output escaping. [Security]
• Hardened the public sign-up form against unpublished tasks and unauthorized field submissions. [Security]
• Hardened access control on the sign-up form and sheet shortcodes to enforce sheet visibility. [Security]
• Hardened output escaping for custom field metadata in the admin sheet editor. [Security]
• Hardened task capacity enforcement on the sign-up form submission handler. [Security]
• Hardened access control so individual tasks and sign-ups respect their parent sheet’s visibility. [Security]
• Hardened output escaping in the notice display system and signup form response template tag. [Security]
• Hardened reCAPTCHA verification against spoofing and bypass attempts. [Security]
• Hardened validation of the redirect destination after a successful sign-up. [Security]
• Hardened validation on the admin Edit Sign-up page. [Security]
• Fixed a PHP warning on the admin Add Sign-up page when neither a sign-up nor task parameter is present.

2.3.4 | 2026-03-14

• Added security checks to AJAX migration status endpoint.
• Fixed output escaping of admin notice CSS class names.
• Removed duplicate function definition fdsus_scode_user_sign_ups_actions().

For the changelog of earlier versions, please see changelog.txt.