' . esc_html( 'unpublish' === $_GET['saved_as'] ? __( 'Form unpublished. Visitors can no longer submit it.', 'killerconversions' ) : __( 'Draft saved. Any published version is unchanged.', 'killerconversions' ) ) . '
'; }
// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only screen() navigation/filter input; values are normalized or allowlisted and escaped at output. No state change occurs from this read; mutations use separate capability/nonce guards.
if ( '' !== $edit ) { self::editor( absint( $edit ) ); } elseif ( isset( $_GET['create'] ) ) { self::task_picker(); } else { self::library(); }
echo '
';
}
/** Optional next steps after a verified publish; viewing this panel performs no setup action. */
private static function publish_next( $id, $kind ) {
$shortcode = '[killerconversions id="' . $id . '"]';
echo '' . esc_html( 'new' === $kind ? __( 'Form published.', 'killerconversions' ) : __( 'Form updates published', 'killerconversions' ) ) . '' . esc_html( 'new' === $kind ? __( 'Add it to a page and check a real submission', 'killerconversions' ) : __( '· Review published settings', 'killerconversions' ) ) . '
' . esc_html__( 'Publishing makes the form ready to use. It does not add it to a WordPress page or verify delivery.', 'killerconversions' ) . '
';
self::published_setup( $id );
echo '
' . esc_html__( 'Add to a page', 'killerconversions' ) . '
' . esc_html__( 'In your page editor, add the KillerConversions Form block and choose this form, or paste its shortcode into a Shortcode block.', 'killerconversions' ) . '
' . esc_html__( 'Open your page', 'killerconversions' ) . '
' . esc_html__( 'Save or publish the page you chose, then use its View page link. Check the form there as a visitor.', 'killerconversions' ) . '
' . esc_html__( 'Send a real test', 'killerconversions' ) . '
' . esc_html__( 'Use details you control and clearly mark the message as a test. This creates a real entry and can send any enabled emails or integrations.', 'killerconversions' ) . '
' . esc_html__( 'These are the saved settings used by your published form. Edits below and saved drafts take effect only when you publish updates.', 'killerconversions' ) . '
' . esc_html( empty( $mail['recipient'] ) ? __( 'Routing rules choose the recipient from submitted answers. With no default recipient, unmatched notifications are not sent.', 'killerconversions' ) : __( 'Routing rules can choose another recipient from submitted answers.', 'killerconversions' ) ) . '
' . esc_html__( 'Turnstile needs attention. Submissions are blocked until its settings are corrected or protection is saved as disabled.', 'killerconversions' ) . '
' . esc_html__( 'Turnstile configured. Check the published page to verify it works for visitors.', 'killerconversions' ) . '
';
} else {
echo '
' . esc_html__( 'Optional Cloudflare Turnstile is off. Enabling it requires a Cloudflare site key and secret key. Included in Free.', 'killerconversions' ) . '
';
$days = (int) $form['settings']['retention_days'];
/* translators: %s: Number of days before new entries are scheduled for removal. */
echo '
' . esc_html( sprintf( _n( 'New entries scheduled for removal after %s day.', 'New entries scheduled for removal after %s days.', $days, 'killerconversions' ), number_format_i18n( $days ) ) ) . '
' . esc_html__( 'Cleanup depends on WordPress cron. Changing this period affects new entries; email copies and connected services are separate.', 'killerconversions' ) . '
';
}
private static function library() {
global $wpdb;
// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only library() navigation/filter input; values are normalized or allowlisted and escaped at output. No state change occurs from this read; mutations use separate capability/nonce guards.
$search = isset( $_GET['s'] ) && is_string( $_GET['s'] ) ? sanitize_text_field( wp_unslash( $_GET['s'] ) ) : '';
// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only library() navigation/filter input; values are normalized or allowlisted and escaped at output. No state change occurs from this read; mutations use separate capability/nonce guards.
$state = isset( $_GET['state'] ) && is_string( $_GET['state'] ) && in_array( $_GET['state'], array( 'draft', 'publish' ), true ) ? sanitize_key( wp_unslash( $_GET['state'] ) ) : '';
// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only library() navigation/filter input; values are normalized or allowlisted and escaped at output. No state change occurs from this read; mutations use separate capability/nonce guards.
$page = isset( $_GET['paged'] ) && is_scalar( $_GET['paged'] ) ? max( 1, absint( $_GET['paged'] ) ) : 1;
$query = new WP_Query( array( 'post_type' => 'kconv_form', 'post_parent' => 0, 'post_status' => $state ? $state : array( 'publish', 'draft' ), 'posts_per_page' => 12, 'paged' => $page, 's' => $search, 'orderby' => 'modified', 'order' => 'DESC' ) );
$counts = (object) array( 'publish' => 0, 'draft' => 0 );
// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- Administrator-only library counts and aggregates use the plugin form post type and private entries; paged IDs become absint values and one generated %d per ID.
foreach ( $wpdb->get_results( $wpdb->prepare( 'SELECT post_status,COUNT(*) AS total FROM %i WHERE post_type=%s AND post_parent=0 GROUP BY post_status', $wpdb->posts, 'kconv_form' ) ) as $count ) { $counts->{$count->post_status} = (int) $count->total; }
// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- Administrator-only library counts and aggregates use the plugin form post type and private entries; paged IDs become absint values and one generated %d per ID.
$entries = $wpdb->get_row( $wpdb->prepare( 'SELECT COUNT(*) AS total, SUM(CASE WHEN is_read=0 THEN 1 ELSE 0 END) AS unread FROM %i', KCONV_Core::table( 'entries' ) ), ARRAY_A );
echo '
';
$totals = array();
if ( $query->posts ) {
$ids = array_map( 'absint', wp_list_pluck( $query->posts, 'ID' ) );
$placeholders = implode( ',', array_fill( 0, count( $ids ), '%d' ) );
// phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- Administrator-only library counts and aggregates use the plugin form post type and private entries; paged IDs become absint values and one generated %d per ID. The immediately preceding statement assigns the result of prepare() to $sql.
$sql = $wpdb->prepare( "SELECT form_id, COUNT(*) AS total FROM %i WHERE form_id IN ($placeholders) GROUP BY form_id", array_merge( array( KCONV_Core::table( 'entries' ) ), $ids ) );
// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.PreparedSQL.NotPrepared -- Administrator-only library counts and aggregates use the plugin form post type and private entries; paged IDs become absint values and one generated %d per ID. Administrator-only library counts and aggregates use the plugin form post type and private entries; paged IDs become absint values and one generated %d per ID. The immediately preceding statement assigns the result of prepare() to $sql.
foreach ( $wpdb->get_results( $sql, ARRAY_A ) as $row ) { $totals[ $row['form_id'] ] = (int) $row['total']; }
}
foreach ( $query->posts as $post ) {
$form = KCONV_Core::get_form( $post->ID );
$url = admin_url( 'admin.php?page=killerconversions&edit=' . $post->ID );
/* translators: 1: Number of form fields, 2: localized last-modified date. */
echo '