=== Sign-up Sheets ===
Contributors: fetchdesigns
Tags: sign up, volunteer, non-profit, signup, sign-up
Tested up to: 7.1
Stable tag: 2.4.1
License: GPLv2 or later

Create online sign-up sheets for volunteers, events, and group scheduling.


== Description ==

Sign-up Sheets helps you organize sign-ups, events, shifts, and other scheduled tasks directly in WordPress. It offers a flexible way to coordinate people, time slots, and responsibilities without relying on a third-party service.

The free version of Sign-up Sheets includes core tools for building and managing sign-up sheets on your site:

* Add, edit, and clear sign-up spots as needed
* Copy a sheet or task to speed up setup
* Send confirmation emails after sign-up
* Let logged-in users view all of their sign-ups on one page with the [`[user_sign_ups]` shortcode](https://www.fetchdesigns.com/doc/user_sign_ups-shortcode/)
* Create an unlimited number of sign-up sheets and spots
* Enable optional reCAPTCHA protection
* Export sign-up data for one sheet or all sheets to CSV
* Support WordPress [GDPR privacy features for your sign-up sheets](https://www.fetchdesigns.com/doc/gdpr-sign-up-sheets-wordpress-plugin/)
* Built with accessibility in mind based on [WCAG Guidelines](https://www.w3.org/WAI/standards-guidelines/). If you run into any accessibility issues, [please report them](https://www.fetchdesigns.com/contact) to help make the plugin more inclusive for all users.
* See the [full list of Sign-up Sheets features](https://www.fetchdesigns.com/sign-up-sheets-wordpress-plugin/)

The Pro version of Sign-up Sheets adds advanced tools for more complex scheduling and form needs:

* Create [custom task fields and custom sign-up form fields](https://www.fetchdesigns.com/doc/custom-fields/)
* Send optional reminder emails before an event
* Customize confirmation and reminder emails per sheet
* Assign [categories to sign-up sheets](https://www.fetchdesigns.com/doc/sheet-categories/) and display current sheets for a specific category
* Let logged-in users edit their own sign-ups
* Enable Spot Locking to hold a spot for 3 minutes while a user completes the sign-up form
* Use [Compact and Semi-Compact display modes](https://www.fetchdesigns.com/doc/compact-semi-compact-standard-display-modes/) to condense tasks with many spots into a single line
* Set sign-up limits per task
* See the [full list of Sign-up Sheets features](https://www.fetchdesigns.com/sign-up-sheets-wordpress-plugin/)

Sign-up Sheets is used for church and nonprofit volunteer opportunities, school and PTO/PTA events, club sign-ups, meeting room reservations, photographer time slots, peronal gatherings, and more. It is a practical alternative to monthly paid services like SignUpGenius while keeping your sign-ups on your own WordPress site.


== Installation ==

1. Download the plugin
2. From your WordPress Admin panel, click the Plugins Menu
3. Deactivate and delete any previous versions of Sign-up Sheets including the free version.
4. Within the Plugins menu, click the "Add New" button
5. Click the "Upload Plugin" button from the menu at the top
6. Select the Sign-up Sheets zip file you downloaded and click the "Install Now" button
7. After installation is complete, click "Activate Plugin"

Manual Install - SFTP
1. Download the plugin and extract the files
2. Copy the `sign-up-sheets` directory and all its files to your `/wp-content/plugins/` directory
3. Activate the plugin through the 'Plugins' menu in WordPress
4. Create a new blank page and add the [`[sign_up_sheet]` shortcode](https://www.fetchdesigns.com/doc/sign-up-sheet-shortcode/) (optional)


== Frequently Asked Questions ==

= How do I create a Sign-up Sheet page on my site? =
First you add a sheet under Sign-up Sheets > Add Sign-up Sheet.  Then you can optionally create a Sheet listing page using the Gutenberg Block or the [`[sign_up_sheet]` shortcode](https://www.fetchdesigns.com/doc/sign-up-sheet-shortcode/).  To learn more, visit the [Creating a Sign-up Sheet doc](https://www.fetchdesigns.com/doc/creating-a-sign-up-sheet/).

= Is Sign-up Sheets GDPR-compliant? =
Please read our [GDPR and Sign-up Sheets](https://www.fetchdesigns.com/doc/gdpr-sign-up-sheets-wordpress-plugin/) article for how to configure your sign-ups to adhere to GDPR.

= If I update to the Pro version, will I lose my information from the free version? =
No, you will not lose any information and will retain all of your current sign-up sheets and sign-ups.

= Can I change the "from" address on the confirmation email? =
Yes, in `Settings > Sign-up Sheets` you can specify any email you want.  It defaults to the email address set in `Settings > General`.

= How can I suggest an idea for the plugin? =
Any and all feedback is greatly appreciated! [Post your idea on the Sign-up Sheets Suggestions Forum](https://www.fetchdesigns.com/forums/forum/sign-up-sheets-suggestions/) or [send an email through the website](https://www.fetchdesigns.com/contact/).

= What is the difference between "Custom Task Fields" and "Custom Sign-up Fields (pro version only) =
**Custom Task Fields:** (on the Sign-up Sheet) are fields that appear when you create or edit a sheet in the admin on each task that you create. They are for display purposes only on the front-end of the Sign-up Sheet.
**Custom Sign-up Fields:** (on the Sign-up Form) are fields that users fill out on the front-end on the form they use to sign-up for an open spot

= How do I display sheets from only 1 specific category (Pro version only) =
To filter by category, you can include the category id # in the [`[sign_up_sheet]` shortcode](https://www.fetchdesigns.com/doc/sign-up-sheet-shortcode/) to determine which category will display on that page.   As an example, the following shortcode would show all sheets associated with category #5... `[sign_up_sheet category_id="5"]`

= When are email reminders sent? (Pro version only) =
When you have the "reminder" setting turned on in `Settings > Sign-up Sheets`, a WordPress event will be triggered to check for reminders needing to be sent out.  This happens when someone visits your site, but no more than once per hour.  You can set how many days prior to the event you would like reminders to go out.

= How do I change the sheet list heading? =
The list title defaults to 'Current Sign-up Sheets'.  To customize this, you can add the option `list_title` to your [`[sign_up_sheet]` shortcode](https://www.fetchdesigns.com/doc/sign-up-sheet-shortcode/) (example: `[sign_up_sheet list_title=""]`).  If you are using the Pro version and filtering by a specific category, you can also have this default to the name of the category by adding the option `list_title_is_category` (example: `[sign_up_sheet category_id=4 list_title_is_category=true]`).

= How can I report security bugs? =
You can report security bugs through the Patchstack Vulnerability Disclosure Program. The Patchstack team help validate, triage and handle any security vulnerabilities. [Report a security vulnerability.](https://patchstack.com/database/vdp/sign-up-sheets)


== Screenshots ==

1. Frontend Sign-up Sheets Listing
2. Frontend Individual Sign-up Sheet
3. Frontend Sign-up Form
4. Admin Sign-up Sheets Listing
5. Admin Edit Sign-up Sheet Form
6. Admin Manage Sheet Screen with ability to add, edit and clear sign-ups
7. Admin Edit Sign-up Form


== Changelog ==

= 2.4.1 | 2026-10-31 =
* Fixed saving a sheet after adding a header row failing with a "You are not authorized to modify this task." notice.
* Fixed sheet save notices sometimes being shown to a different logged-in user instead of the user who saved the sheet. [Security]
* Fixed XSS issue in the "Sign up" link on public sheet pages. [Security]
* Hardened redirect URL validation. [Security]
* Hardened access controls to better protect sign-up data. [Security]
* Hardened task titles to remove disallowed markup when saved. [Security]
* Hardened output escaping on public sheet pages and in the admin. [Security]
* Removed the unused deprecated Data::get_tasks() and Data::get_signups() methods. Use the Sheet and Task models instead.
* Removed the unused email alert option from internal logging so log entries no longer collect the visitor IP address or browser user agent. [Security]
* Hardened access controls when copying sheets. [Security]
* Hardened access controls on the Manage Sign-ups page. [Security]
* Hardened access controls when adding sign-ups from the admin. [Security]
* Hardened access controls on the data migration re-run action. [Security]
* Fixed the data migration progress indicator on the Settings page, which never updated because its status check was always rejected.
* Hardened password-protected sheet handling in the [sign_up_sheet] shortcode. [Security]
* Updated copied sheets to be created as drafts and to skip the original's legacy v2.0 ID and editing meta, so a copy can no longer take over a legacy sheet shortcode.
* Fixed the Help page test email leaving its custom sender address applied to other emails sent later in the same request.
* Hardened access controls when updating or deleting sign-ups. [Security]
* Hardened sign-up form input validation. [Security]
* Updated the `Id::getClientIP()` helper to use the connecting address by default. Sites behind a reverse proxy can add trusted forwarding headers with the new `fdsus_client_ip_trusted_headers` filter. [Security]
* Hardened the class autoloader. [Security]
* Hardened the sign-up CSV export. [Security]
* Updated the sign-up CSV export to convert non-text values returned by export filters to text.
* Hardened the fdsus_current_url() and fdsus_back_to_sheet_url() template tags. Templates should still escape their output with esc_url(). [Security]
* Fixed an unrecognized sheet date being saved as January 1, 1970 and an unrecognized task date causing a PHP error. Both are now saved empty.
* Hardened the email typo suggestion on the sign-up form. [Security]
* Hardened the Help page test email form. [Security]
* Hardened the simple captcha. [Security]
* Added the `fdsus_simple_captcha_token_ttl` filter to set how long a simple captcha form stays valid (default 12 hours). Forms cached before the update keep working for 12 hours after it.
* Hardened sanitization of values saved from the sheet editor. [Security]
* Hardened the Site Health debug information export to better protect sensitive data. [Security]

= 2.4.0 | 2026-09-16 =
* Added preview to the Gutenberg block with settings moved to the editor sidebar.
* Updated Gutenberg block to use block API version 3 (requires WordPress 6.0+).
* Updated Settings page to a redesigned layout with sidebar navigation and live search.
* Updated the default simple captcha to use a randomized answer instead of a fixed one.
* Added ability for sheet "Preview" to show preview of meta field values such as sheet date and tasks rather than just the sheet description WP offers natively.
* Added config to disable the default sheet "archive" page that lists all sheets the /sheet/ URL.
* Added setting to hide your theme's default Previous/Next post navigation on sheet pages if theme implements it (hidden by default).
* Fixed an inverted honeypot anti-spam check that could allow spam submissions through.
* Fixed error when accessing Manage Sign-ups page with invalid post ID by adding validation check.
* Fixed cursor jumping to the end of task fields when clicking to edit them in the admin sheet editor.
* Fixed the confirmation email message field stripping the "<{removal_link}>" placeholder (and any other literal "<...>" text) on every settings save.
* Hardened nonce verification, capability checks, input sanitization, and output escaping across Settings, bulk edit, sheet preview, custom fields, and the Gutenberg block. [Security]
* Hardened an internal file-loading safeguard. [Security]
* Hardened access control for displaying full sign-up contact details on the front end. [Security]
* Hardened access control on sheet task save and the Manage Sign-ups deletion actions (single and bulk). [Security]
* Hardened debug logging to prevent unauthorized data exposure. [Security]
* Hardened access control on the Manage Sign-ups page and CSV export, and narrowed the Sign-up Sheet Viewer role to read-only capabilities. [Security]
* Hardened database migration state checks and re-run access control. [Security]
* Hardened signup meta field handling against tampering from submitted form data. [Security]
* Hardened role capability revocation on deactivation so previously granted capabilities, including Pro sheet-category taxonomy permissions, are fully removed. [Security]
* Hardened the Help page email test form with nonce verification, input sanitization, and output escaping. [Security]
* Hardened the public sign-up form against unpublished tasks and unauthorized field submissions. [Security]
* Hardened access control on the sign-up form and sheet shortcodes to enforce sheet visibility. [Security]
* Hardened output escaping for custom field metadata in the admin sheet editor. [Security]
* Hardened task capacity enforcement on the sign-up form submission handler. [Security]
* Hardened access control so individual tasks and sign-ups respect their parent sheet's visibility. [Security]
* Hardened output escaping in the notice display system and signup form response template tag. [Security]
* Hardened reCAPTCHA verification against spoofing and bypass attempts. [Security]
* Hardened validation of the redirect destination after a successful sign-up. [Security]
* Hardened validation on the admin Edit Sign-up page. [Security]
* Fixed a PHP warning on the admin Add Sign-up page when neither a sign-up nor task parameter is present.

= 2.3.4 | 2026-03-14 =
* Added security checks to AJAX migration status endpoint.
* Fixed output escaping of admin notice CSS class names.
* Removed duplicate function definition `fdsus_scode_user_sign_ups_actions()`.

For the changelog of earlier versions, please see `changelog.txt`.


== Upgrade Notice ==

= 2.4.0 =
Contains multiple security hardening fixes. Update is strongly recommended.

= 2.3.4 =
Adds a security check to the AJAX migration status endpoint. Update is recommended.

= 2.3.3.1 =
Adds CSRF protection to the legacy migration re-run feature. Update is recommended if you originally upgraded from a 1.x version.

= 2.3.3 =
Fixes a PHP object injection vulnerability. Update is strongly recommended.

= 2.3.1 =
Fixes a content injection vulnerability on the sign-up form. Update is strongly recommended.

= 2.3.0.1 =
Contains an important reliability fix for sites running the base plugin without Pro.