Merge fix

Author: AntonV1211

changelog.txt

@@ -1,5 +1,158 @@
 == Changelog ==
 
+
+= 6.78 29.04.2026 =
+* Removing the link to install "Gravity Forms to doBoard" (#784)
+* Mod. BloomForms. Editing the integration with BloomForms
+* Update inc/cleantalk-settings.php
+* Upd. Integrations. Improve Divi newsletters flow to attach meta data to request.
+* Add "Read more" link to cleantalk page (#782)
+* New. BaseCall. Default params class.
+* Fix. REST API. Updated 'email' argument type from 'email' to 'string' in callbacks.
+* Fix. GFA. Replaced email regex with isEmailLike method and added unit tests for validation.
+* Upd. Integrations. Improve Divi newsletters flow to attach meta data to request. (#786)
+* Ref. AntiCrawler. Module flow refactored. (#788)
+
+= 6.77 16.04.2026 =
+* Fix. AltSession. Correcting the issue of array conversion
+* New. BookingCalendar. New integration with BookingCalendar
+* Upd. Settings. Updated flow to check pingback. (#764) (#773) (#774)
+* Fix. CF7. Edit honeypot
+* Fix. Integration. EDD integration fixed. (#770)
+* Fix. Code. Editing the bot detector settings
+* Fix. Exclusion. Skip request from Metorik Helper
+* Fix. Common. Add bot detector state to ct_options. (#778)
+* Fix. WPMS. Errors output for WPMS mutual-mutual mode fixed. (#772)
+* Fix. WPMS. Settings for `mutual/mutual` fixed.
+* Fix. WPMS. Settings page error fixed.
+
+= 6.76 02.04.2026 =
+* Mod. ForceAltCookies. Removed the use of force alt cookies for integration with piotnet-addons-for-elementor
+* Upd. Integrations. Improve FluentBooking flow to attach meta data to request.
+* Upd. Settings. Updated flow to check pingback.
+* Upd. Settings. Bot Detector setting - bot-detector setting removed.
+* Fix. Code. Unit tests fixed: TestFluentForms, TestNinjaForms.
+* Fix. JS. Gathering. Passing js_on independent of gathering loaded.
+* Fix. Integrations. QuForm. Fixed js_on param gathering.
+
+= 6.75 19.03.2026 =
+* Upd. JS. catchJqueryAjax. Refactored to also use ajaxPrefilter. Bloomform now skip using force alt-sessions.
+* Upd. ContactEncoder. Improve aria labels protect.
+* Upd. Integration. HivePress forms protection improved.
+* Upd. Settings. SFW outdated message refactored.
+* Upd. Settings. Error. Fixed case when SFW outdated error is not removable.
+* Upd. TRP. TRP popup text and styles updated.
+* Fix. Integrations. Improve statement to protect memberpress.
+* Fix. Integrations. Improved membershippro processing statement.
+* Fix. Integration. Gravity forms integration fixed.
+* Add. Integrations. Added Elfsight compability.
+* Fix. RemoteCalls. Changes to the RC functionality
+* Upd. Settings. Improved copability.
+* Fix. Contacts Encoder. Shortcode for exclude encoding.
+* Upd. BotDetector. Update load strategy.
+* Upd. BotDetector. Update load strategy for fluent booking and fluent form.
+
+= 6.74 05.03.2026 =
+* Mod. SFW. Atomic approach to updating SFW
+* Upd. Exclusions. Ajax. Plugin "cart-recovery".
+* Fix. Code. JS loading by defer fixed.
+* Mod. OtterForms. Changing integration from a hook to a route
+* Mod. OtterForms. Changing the integration, renaming the request interception method
+* Upd. Connection reports. Email subject updated.
+* Fix. JS. catchFetchRequest. Origin fetch definitions.
+* Upd. Exclusions. Ajax. Plugin "invoicing".
+* Upd. Gravity Forms. Skipped request extended log.
+* Fix. Translate. Fixed msgids.
+* Upd. Connection reports. Email title edited.
+* Upd. Connection reports. Service id added.
+* Fix. SubmitTime. Calculation of the submit time when enabling the gathering script
+* Upd. SFW updates sentinel. Updated report.
+* Upd. Settings. Updated RC to init settings update.
+* Fix. SubmitTime. Editing the creation of a timestamp
+
+= 6.73.1 19.02.2026 =
+* Fix. Code. JS loading by `defer` fixed.
+
+= 6.73 19.02.2026 =
+* Upd. Code. SFW Update. HTTP multi request refactored.
+* New. ShadowrootProtection. Implementation of form protection in Shadowroot elements, integration with Mailchimp shadowroot
+* Mod. ShadowrootPrt. Architectural changes in logic, the addition of situational callbacks
+* Fix. CurlMulti. Editing implementation comments
+* Fix. Integration. Ninja forms. Filter NF common fields before processing.
+* Fix. Exclusions. "woocommerce-abandoned-cart"
+* Fix. Exclusions. "woo-abandoned-cart-recovery"
+* Fix. Exclusions. "abandoned-cart-capture"
+* Fix. Code. Returned the lost code during the merge
+* Fix. FluentForm. Vendor integration compliance fixed.
+* Upd. Integrations. Elementor UltimateAddons Register integration handler to use ajax middleware.
+* Fix. IntegMailChimp. Clearing all fields except for the field whose name contains message
+* Fix. Code. Edit Remote Calls
+* Fix. AdminActions. Checking permissions for Actions
+* Upd. Exclusions. Ajax. Plugin "wp-multi-step-checkout".
+* Fix. Exclusions. Ajax. Plugin "woo-abandoned-cart-recovery". Fixed condition.
+* Code. Unit tests for apbct_is_skip_request() refactored.
+* Fix. Code. Escaping woocommerce order data
+* Upd. Exclusions. Ajax. Plugin "woocommerce-sendinblue-newsletter-subscription"
+* Fix. Remote Calls. Skip check if no sign of RC action provided in Request.
+* Fix. Exclusion. Added path invoice4u/v1/callback.
+* Fix. Contact Encoder. Every hook that has actions BEFORE modify now have actions AFTER.
+* Fix. Enqueue. Script individual-disable-comments.js renamed to cleantalk-individual-disable-comments.js
+* Upd. CommentsCheck. Improve statement.
+* Upd. JS parameters. Gathering dynamic lod implemented.
+* Fix. Connection reports. Email for reports fixed.
+* Fix. Integration. SmartQuizBuilder integration fixed.
+* Fix. ContentEncoder. Editing the data type in the 3rd str_replace argument
+
+= 6.72 05.02.2026 =
+* Upd. WooCommSpamOrders. Added a hint for the disabled option to save spam orders.
+* Fix. Integrations. Fluent Forms. Visible fields collection fixed.
+* Fix. Integrations. Skip encoding for woo registration button. (#722)
+* Upd. Integration. Mailpoet. Visible fields gathering.
+* Upd. Visible fields extractor. Static method to get a new extractor.
+* Fix. Integration. Exclusions for WC requests fixed.
+* Fix. Integrations. GiveWP multi-page form. Exclude requests without email.
+* Fix. Integrations. GiveWP. Skip external forms check.
+* Fix. Integrations. GiveWP. Bot detector token. Intercept iframe fetch to add field if available.
+* Fix. Integrations. Fixed fetch request fields assignment (NoCookie|EventToken)
+* Fix. Woocommerce. Stored oreders. Fixed code error.
+* Mod. ContentEncoder. The ability to exclude the main page by hook
+* Fix. Code. Getting cleantalk addresses fixed.
+* Fix. Integrations. Add event token in jQuery catching for forms of "wpr_form_builder_email" action.
+* Upd. Footer. Footer promo link added. (#729)
+* Fix. Integrations. WooCommerce. Stripe express checkout address normalize excluded.
+* Fix. Integrations. Paid Membership Pro. Login form excluded.
+* Upd. Updater. Add index update mechanism. (#721)
+* Fix. Skip Elementor login widget request for WooCommerce checkout.
+* Fix. Integration. Mailpoet integration fixed.
+
+= 6.71.1 26.01.2026 =
+* Fix. Promotion. GF2DB promo setting and message reverted.
+
+= 6.71 22.01.2026 =
+* Fix. Integration. Woocommerce (checkout by REST) integration fixed.
+* Fix. Integration. Fluent forms integration fixed
+* Fix. Integration. Klaviyo (external forms) integration fixed.
+* Upd. PHPUnit. testIsAllowMessage/User refactored
+* Fix. Settings. Description for Send connection reports fixed.
+* Fix. Contacts Encoder. Exclusions fixed.
+* Fix. Contacts Encoder. Regex pattern for emails fixed.
+* Upd. Links. UTM preset for bbPress spam scanner added.
+* Fix. Fetch request catching. Fixed case with empty GET requests from pojo-accessebility plugin.
+* Fix. SFW pages. Fixed bundle name with resolver.
+* Fix. Common. Helper. PHP 8.4. Function str_getcsv() escape argument added
+* Fix. Workflow. Make the zip with subfolder instead of zip-root.
+* Fix. Exclusions by URL. Fixed validation and URL gain for ajax requests.
+* Upd. Requirements Checker. Modified curl_multi_exec to curl_multi array of functions.
+* Upd. SFW update. Do not start update if curl multi funcs are not available.
+* Fix. Integrations. Excluded recaptcha from cloning and ensured it is reinserted into the origin form during processing.
+* Fix. Integrations. Update condition to skip check of account update for logged in users.
+* New. Promotions. GF2DB.
+* New. Settings. Added RC to init settings update.
+* New. Integration. Bit Form integration implemented.
+* Upd. Code. PHP compatibility increased to 7.2.
+* New. Settings. Added project management menu item.
+* Fix. SFW. User agents priority fixed. (#874)
+
 = 6.70.1 19.12.2025 =
 * Fix. Integration. Fluent forms integration fixed (fix for commit ae74511a96417b607f2b79b83ef984de7eac0588).
 

cleantalk.php

@@ -4,7 +4,7 @@
   Plugin Name: Anti-Spam by CleanTalk
   Plugin URI: https://cleantalk.org
   Description: Max power, all-in-one, no Captcha, premium anti-spam plugin. No comment spam, no registration spam, no contact spam, protects any WordPress forms.
-  Version: 6.86.99-fix
+  Version: 6.87.99-fix
   Author: CleanTalk - Anti-Spam Protection <welcome@cleantalk.org>
   Author URI: https://cleantalk.org
   Text Domain: cleantalk-spam-protect
@@ -347,6 +347,7 @@ function apbct_register_my_rest_routes()
      && empty(Post::get('action')) //bbPress
      && ! \Cleantalk\Variables\Server::inUri('/favicon.ico') // /favicon request rewritten cookies fix
      && ! apbct__is_wp_rocket_preloader_request()
+     && ! apbct__is_wordpress_loopback_request()
 ) {
     if ( $apbct->data['cookies_type'] !== 'alternative' ) {
         if ( !$apbct->settings['forms__search_test'] && !Get::get('s') ) { //skip cookie set for search form redirect page
@@ -614,11 +615,11 @@ function apbct_write_js_errors($data)
 
 
 add_action('mec_booking_end_form_step_2', function () {
-    echo "<script>
-        if (typeof ctPublic.force_alt_cookies == 'undefined' || (ctPublic.force_alt_cookies !== 'undefined' && !ctPublic.force_alt_cookies)) {
+    echo apbct_get_inline_script_tag(
+        "if (typeof ctPublic.force_alt_cookies == 'undefined' || (ctPublic.force_alt_cookies !== 'undefined' && !ctPublic.force_alt_cookies)) {
 			ctNoCookieAttachHiddenFieldsToForms();
-		}
-    </script>";
+		}"
+    );
 });
 
 // Public actions

composer.json

@@ -18,7 +18,7 @@
         "wp-cli/wp-cli-bundle": "*",
         "mockery/mockery": "*",
         "cleantalk/apbct-installer": "*",
-        "cleantalk/contacts-encoder": "2.0.18",
+        "cleantalk/contacts-encoder": "2.0.18.7",
         "cleantalk/rate-limiter": "*"
     },
     "scripts": {

i18n/cleantalk-spam-protect.pot

@@ -1539,6 +1539,12 @@ msgstr ""
 msgid "Protect logged in Users"
 msgstr ""
 
+#. %s: HTML link to CleanTalk Anti-Spam
+#: inc/cleantalk-public.php:1337
+#, php-format
+msgid "Protected by %s"
+msgstr ""
+
 #: inc/cleantalk-settings.php:1817
 msgid "Protection is active"
 msgstr ""

inc/cleantalk-ajax.php

@@ -894,7 +894,6 @@ function ct_ajax_hook($message_obj = null)
                     'message' => $ct_result->comment
                 )
             );
-            die();
         }
 
         // Plugin Name: eForm - WordPress Form Builder; ajax action ipt_fsqm_save_form

inc/cleantalk-common.php

@@ -1630,7 +1630,7 @@ function apbct_validate_api_response__service_template_get($template_id, $templa
             $services_templates_get_error = 'Parse services_templates_get API error: template_id is empty';
             break;
         }
-        if ( $template['template_id'] === (int)$template_id ) {
+        if ( (int)$template['template_id'] === (int)$template_id ) {
             if ( empty($template['options_site']) ) {
                 $services_templates_get_error = 'Parse services_templates_get API error: options_site is empty';
                 break;

inc/cleantalk-pluggable.php

@@ -2235,6 +2235,58 @@ function apbct__is_wp_rocket_preloader_request()
     );
 }
 
+/**
+ * True for WordPress HTTP API loopback requests (Site Health, updates, cron).
+ * Default WP user-agent: "WordPress/{version}; {siteurl}"
+ *
+ * Requires both the WordPress UA prefix and that the URL in the UA belongs
+ * to this site. UA-only matching would skip Anti-Crawler for any spoofed
+ * WordPress client, including requests from other sites.
+ *
+ * Do not require REMOTE_ADDR === SERVER_ADDR: php-fpm loopbacks often arrive
+ * from the public origin IP while SERVER_ADDR is 127.0.0.1.
+ *
+ * @return bool
+ */
+function apbct__is_wordpress_loopback_request()
+{
+    if ( ! isset($_SERVER['HTTP_USER_AGENT']) ) {
+        return false;
+    }
+
+    if ( preg_match('#^WordPress/\d[\d.]*;\s+(\S+)#', $_SERVER['HTTP_USER_AGENT'], $matches) !== 1 ) {
+        return false;
+    }
+
+    $ua_url = isset($matches[1]) ? $matches[1] : '';
+    if ( $ua_url === '' ) {
+        return false;
+    }
+
+    $ua_host = wp_parse_url($ua_url, PHP_URL_HOST);
+    if ( ! is_string($ua_host) || $ua_host === '' ) {
+        return false;
+    }
+    $ua_host = strtolower($ua_host);
+
+    $site_hosts = array();
+    foreach ( array(home_url(), site_url()) as $url ) {
+        $host = wp_parse_url($url, PHP_URL_HOST);
+        if ( is_string($host) && $host !== '' ) {
+            $site_hosts[] = strtolower($host);
+        }
+    }
+
+    if ( isset($_SERVER['HTTP_HOST']) ) {
+        $host_header = preg_replace('/:\d+$/', '', $_SERVER['HTTP_HOST']);
+        if ( is_string($host_header) && $host_header !== '' ) {
+            $site_hosts[] = strtolower($host_header);
+        }
+    }
+
+    return in_array($ua_host, $site_hosts, true);
+}
+
 /**
  * Generates MD5 hash for email encoder pass key
  *
@@ -2246,3 +2298,67 @@ function apbct_get_email_encoder_pass_key()
 
     return md5(Helper::ipGet() . $apbct->api_key . 'email_encoder');
 }
+
+/**
+ * Returns CSP nonce for CleanTalk inline scripts.
+ *
+ * @return string
+ */
+function apbct_get_csp_nonce()
+{
+    /**
+     * Filter CSP nonce for CleanTalk inline scripts.
+     *
+     * @param string $nonce CSP nonce value for script tags.
+     */
+    return (string) apply_filters('apbct_csp_nonce', '');
+}
+
+/**
+ * Returns inline script tag with optional CSP nonce.
+ *
+ * @param string $javascript JavaScript code.
+ * @param array<string, string|bool> $attributes Script tag attributes.
+ *
+ * @return string
+ */
+function apbct_get_inline_script_tag($javascript, $attributes = array())
+{
+    $nonce = apbct_get_csp_nonce();
+    if ( $nonce !== '' ) {
+        $attributes['nonce'] = $nonce;
+    }
+
+    if ( function_exists('wp_get_inline_script_tag') ) {
+        return wp_get_inline_script_tag($javascript, $attributes);
+    }
+
+    $attr_string = '';
+    foreach ( $attributes as $name => $value ) {
+        if ( $value === true ) {
+            $attr_string .= ' ' . esc_attr($name);
+        } elseif ( $value !== false && $value !== null && $value !== '' ) {
+            $attr_string .= ' ' . esc_attr($name) . '="' . esc_attr((string) $value) . '"';
+        }
+    }
+
+    $javascript = preg_replace('#</script#i', '<\/script', $javascript);
+
+    return '<script' . $attr_string . '>' . $javascript . '</script>';
+}
+
+/**
+ * Returns allowed HTML tags for inline CleanTalk scripts passed through kses.
+ *
+ * @return array<string, array<string, bool>>
+ */
+function apbct_get_inline_script_kses()
+{
+    return array(
+        'script' => array(
+            'type' => true,
+            'data-cookieconsent' => true,
+            'nonce' => true,
+        ),
+    );
+}

inc/cleantalk-public-integrations.php

@@ -2448,9 +2448,6 @@ function apbct_form__the7_contact_form()
                 );
 
                 wp_send_json($response);
-
-                // IMPORTANT: don't forget to "exit" @todo AG: Why? Exit does not terminate connection, but I can't see how it is applicable
-                exit;
             }
         }
     }