=== PressPilot Frontend Editor for Avada ===
Contributors: cardeetech, neriomolina
Donate link: https://cardee.tech/pagos/donaciones/
Tags: frontend editor, avada, post editor, frontend publishing, user generated content
Requires at least: 6.4
Tested up to: 7.0
Requires PHP: 8.0
Stable tag: 1.2.6
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Let authenticated users create and edit posts from the frontend — no wp-admin needed. Built for Avada, works with any theme.

== Description ==

PressPilot Frontend Editor for Avada lets authenticated users create and edit standard WordPress posts directly from the frontend, without accessing wp-admin.

Designed for editorial workflows where non-admin users need a clean writing experience while administrators keep full control over permissions, status transitions, authorship, and media uploads.

Developed and maintained by [CardeeTech](https://cardee.tech/).

**Key capabilities:**

* Frontend create/edit form for standard posts
* Frontend listing of posts with direct edit links
* TinyMCE editor, excerpt, categories, tags, post status, and scheduled date
* Featured image upload or external URL (with SSRF protections)
* Avada Builder native elements for the two core shortcodes
* Internationalization-ready (fully translatable)

**Security highlights:**

* Nonce validation on all form submissions (`_ppfenonce`)
* Capability-gated operations (`edit_posts`, `edit_post`, `edit_others_posts`, `publish_posts`, `upload_files`)
* Strict sanitization and escaping throughout
* External image URL hardening: HTTPS-only, blocks localhost/private/link-local/metadata endpoints

**Avada integration:**

When Avada Builder is active, the plugin registers native Avada Builder elements for both shortcodes, so editors can add the frontend form and posts list using the visual drag-and-drop builder without writing shortcode syntax.

== Installation ==

1. Upload the plugin folder to `/wp-content/plugins/`.
2. Activate **PressPilot Frontend Editor for Avada** from **Plugins**.
3. Create a page for the editor and insert the shortcode `[ppfe_edit_post]`.
4. Create a page for the post list and insert `[ppfe_my_posts edit_page="/your-editor-page/"]`.
5. Go to **PressPilot FEE > Style** to align colors and spacing with your theme.

== Shortcodes ==

* `[ppfe_edit_post]` — Main create/edit form.
* `[ppfe_my_posts]` — Current user's post list with edit links.
* `[ppfe_form]` — Alias of `[ppfe_edit_post]`.

**Attributes for `[ppfe_my_posts]`:**

* `edit_page` — URL of the editor page (e.g. `edit_page="/write/"`)

== Frequently Asked Questions ==

= Does this plugin allow guest submissions? =

No. All users must be logged in and pass WordPress capability checks before any action is taken.

= Can contributors publish directly? =

Only users with the `publish_posts` capability can publish. Contributors are automatically limited to draft/pending workflows.

= Is Avada required? =

No. The plugin works with any WordPress theme. When Avada Builder is active, native builder elements become available as an added convenience.

= What post types are supported? =

The plugin targets standard WordPress posts (`post`) for predictable and controlled editorial behavior.

= Can I control who can see other users' posts in the list? =

Yes. Administrators and editors see all posts automatically. Other users with `edit_others_posts` capability can also see all posts when `show_others="1"` is added to the shortcode. Without that attribute, every user sees only their own posts.

== Screenshots ==

1. Plugin backend dashboard — quick-start checklist, shortcode reference, and plugin status overview.
2. Settings tab — plugin version, edition, and upcoming features.
3. Style tab — color, dimensions, border radius, font size, and shadow controls with live preview.
4. Shortcodes tab — full parameter reference for `[ppfe_edit_post]` and `[ppfe_my_posts]`.
5. Quick-start guide tab — step-by-step installation and configuration walkthrough.
6. Frontend new post form — create and publish posts directly from the frontend.
7. My Posts management and editing — post list with Avada Builder editor.
8. Post management and editing — post list with Classic Editor.

== Changelog ==

= 1.2.6 =
* Fix: after saving a pending post, non-admin users now see a success notice instead of a permissions error.
* UX: added centered moderation notice — "Your post has been submitted for review".
* i18n: new Spanish translation strings for the pending-save success screen.

= 1.2.5 =
* Fix: language files renamed to match text domain (presspilot-frontend-editor) — Spanish translation now loads correctly.
* Fix: added ~35 missing Spanish translation strings for access settings, SMTP, moderation emails (v1.2.x features).

= 1.2.4 =
* Fix: featured image now shows existing thumbnail when editing a post.
* Fix: selecting from Media Library sets attachment by ID (no URL sideload — works on HTTP staging).
* Fix: "Remove image" button now deletes the post thumbnail on save.
* Fix: PPFE-granted roles without native upload_files capability can now upload featured images.

= 1.2.3 =
* Fix: Settings role list layout — 4-column grid (switch, name, categories, permissions).
* Fix: "Puede editar" / "Puede publicar" per-role checkboxes now save and apply correctly.

= 1.2.2 =
* Fix: category restriction now applies to both "Most used" and "All" tabs in the frontend form.

= 1.2.1 =
* Fix: categories now configured per role in Settings (not per user in profile).
* Fix: Contributor added to always-on roles.
* UI: role list redesigned with on/off switches and tag-input category selector.

= 1.2.0 =
* Feature: configurable role-based access — select which WP/UltimateMember roles can use the frontend editor (PressPilot FEE > Settings).
* Feature: per-user category restrictions — assign allowed categories per user from WP Admin > Users > edit user.
* Feature: non-admin/editor posts always go to pending for moderation regardless of selected status.
* Feature: email notification to configurable addresses when a post is submitted for moderation.
* Feature: published posts are read-only in [ppfe_my_posts] for non-admin/editor users.

= 1.1.0 =
* Compatibility: raised minimum PHP requirement to 8.0 (PHP 7.4 is EOL).
* Compatibility: raised minimum WordPress requirement to 6.4.
* Security: tightened frontend form display — requires edit_posts capability in addition to post authorship.
* Feature: administrators and editors now automatically see all posts in [ppfe_my_posts] without needing show_others='1'.
* Feature: author name displayed per post card when viewing all posts (admin/editor view).

= 1.0.0 =
* Initial release on WordPress.org.
* Frontend create/edit form with TinyMCE, featured image, categories, tags, status and scheduled date.
* My Posts listing shortcode with capability-aware visibility.
* Avada Builder native elements for both shortcodes.
* Full nonce and capability security on all form submissions.
* Admin style panel to customise colors and spacing.
* Spanish (es_ES) translation included.

== Upgrade Notice ==

= 1.0.0 =
Initial release.