@prefix sioc: . @prefix dc: . @prefix dcterms: . @prefix xsd: . @prefix content: . @prefix rdf: . @prefix rdfs: . a sioc:Post ; dc:title "Changelog" ; dcterms:identifier 148831 ; dc:modified "2026-09-30T18:08:00Z"^^xsd:dateTime ; dc:created "2026-09-30T18:08:00Z"^^xsd:dateTime ; sioc:link ; sioc:has_creator ; sioc:has_container ; content:encoded "
  • 2.0.2: Internal restructure with no change in behaviour. The code is now one small class per job: looking up field groups, handling the form request, saving the values, rendering the form, and the block. The field group lookups that were spread across two classes now live in one place, and saving is separate from request handling. Filter names are unchanged. The unused languages folder and Domain Path header are removed, since translations are loaded by WordPress.
  • 2.0.1: Code quality release with no change in how forms look or behave. Form submissions now check the security nonce before reading anything else that was posted, and all posted values are read in that same step. The plugin no longer loads its own translation files, since WordPress loads them automatically for plugins hosted on wordpress.org. Also removes the file that held the old shortcode, which has not been loaded since 2.0.0, and tidies code formatting to the WordPress coding standards.
  • 2.0.0: Breaking change: the [lh_xprofile_form] shortcode has been removed. Forms are now added with the xProfile Form block only. Any page still using the shortcode will show it as plain text after updating. To convert one, open the page in the block editor, select the Shortcode block containing it and choose Transform to, xProfile Form; the field group and submit label carry over. A shortcode with a redirect_url is not offered the transform, so replace it with an xProfile Form block by hand and choose the page to go to after saving in the block settings. Update to 1.5.0 first and convert your pages if you want the shortcode to keep working while you do.
  • 1.5.0: The xProfile Form block now says when its field group is gone. If the chosen profile field group has been deleted or has no fields, visitors see nothing (as before), but anyone who can edit the page sees a notice in its place on the front end, and the block editor shows a warning with the field group picker instead of an empty preview. The editor's field group list also marks groups that have no fields.
  • 1.4.1: The xProfile Form block can now be created from the [lh_xprofile_form] shortcode in the block editor: converting classic content to blocks, or pasting the shortcode, turns it into the block, carrying over the field group and submit label. Shortcodes with a redirect_url are left as they are, because the block stores its redirect as a page ID and a URL cannot be turned into one in the editor; convert those by hand and pick the page in the block settings.
  • 1.4.0: New xProfile Form block. The form can now be added in the block editor as a dynamic block: choose the xProfile field group from a list, set the submit button label, pick a page to go to after saving (stored as a page ID, so it survives slug changes and can only point at this site), and optionally set the message logged-out visitors see. The editor shows a live preview of the form. The block and the [lh_xprofile_form] shortcode share one renderer and the same save handling, so the shortcode keeps working unchanged on existing pages.
  • 1.3.2: Internal restructure with no change in behaviour. The code is split into one class per concern under includes/: a renderer shared by the shortcode (and the block coming in 1.4.0), a processor for nonces and saving, and the shortcode wrapper. The main file keeps the header and the plugin class with its identity methods and bootstrap. Following LocalHero plugin conventions, the plugin class is no longer wrapped in a class_exists() guard, its constructor is private, plugin_name() is translatable, and translations are loaded from the languages directory. Hook and filter names, the shortcode and its attributes, and the form markup are all unchanged.
  • 1.3.1: Security and standards release. Fixed an open redirect: after saving, the form now only redirects to a URL on this site (wp_safe_redirect), and the redirect_url attribute is validated before it is output. Fixed the wrong user being reported after a save: old values, visibility and the xprofile_updated_profile action now use the logged-in member instead of the displayed user, which is 0 on an ordinary page, so listeners are told the right user was updated. A form can now only save fields that belong to its own field group: the group is part of the form and its nonce, and any other posted field IDs are ignored. Saving now also requires a logged-in member and an active xProfile component. Posted values are unslashed before saving. All output is escaped and extract() is gone. The plugin now boots on plugins_loaded behind a filterable init gate and does nothing without BuddyPress, reads its version from the header, and its logged-out message and group field list are filterable. Header now declares Requires at least, Requires Plugins (BuddyPress) and the licence. Also includes unreleased changes made to the main file since 1.03.
  • 1.03: Converted helper functions to static methods.
  • 1.02: Refactored the plugin into a singleton class.
  • 1.01: Minor improvements.
  • 1.00: Initial release.
"^^rdf:XMLLiteral ; sioc:content "Part of: LH Xprofile forms2.0.2: Internal restructure with no change in behaviour. The code is now one small class per job: looking up field groups, handling the form request, saving the values, rendering the form, and the block. The field group lookups that were spread across two classes now live in one place, and saving is separate from request handling. Filter names are unchanged. The unused languages folder and Domain Path header are removed, since translations are loaded by WordPress.2.0.1: Code quality release with no change in how forms look or behave. Form submissions now check the security nonce before reading anything else that was posted, and all posted values are read in that same step. The plugin no longer loads its own translation files, since WordPress loads them automatically for plugins hosted on wordpress.org. Also removes the file that held the old shortcode, which has not been loaded since 2.0.0, and tidies code formatting to the WordPress coding standards.2.0.0: Breaking change: the [lh_xprofile_form] shortcode has been removed. Forms are now added with the xProfile Form block only. Any page still using the shortcode will show it as plain text after updating. To convert one, open the page in the block editor, select the Shortcode block containing it and choose Transform to, xProfile Form; the field group and submit label carry over. A shortcode with a redirect_url is not offered the transform, so replace it with an xProfile Form block by hand and choose the page to go to after saving in the block settings. Update to 1.5.0 first and convert your pages if you want the shortcode to keep working while you do.1.5.0: The xProfile Form block now says when its field group is gone. If the chosen profile field group has been deleted or has no fields, visitors see nothing (as before), but anyone who can edit the page sees a notice in its place on the front end, and the block editor shows a warning with the field group picker instead of an empty preview. The editor's field group list also marks groups that have no fields.1.4.1: The xProfile Form block can now be created from the [lh_xprofile_form] shortcode in the block editor: converting classic content to blocks, or pasting the shortcode, turns it into the block, carrying over the field group and submit label. Shortcodes with a redirect_url are left as they are, because the block stores its redirect as a page ID and a URL cannot be turned into one in the editor; convert those by hand and pick the page in the block settings.1.4.0: New xProfile Form block. The form can now be added in the block editor as a dynamic block: choose the xProfile field group from a list, set the submit button label, pick a page to go to after saving (stored as a page ID, so it survives slug changes and can only point at this site), and optionally set the message logged-out visitors see. The editor shows a live preview of the form. The block and the [lh_xprofile_form] shortcode share one renderer and the same save handling, so the shortcode keeps working unchanged on existing pages.1.3.2: Internal restructure with no change in behaviour. The code is split into one class per concern under includes/: a renderer shared by the shortcode (and the block coming in 1.4.0), a processor for nonces and saving, and the shortcode wrapper. The main file keeps the header and the plugin class with its identity methods and bootstrap. Following LocalHero plugin conventions, the plugin class is no longer wrapped in a class_exists() guard, its constructor is private, plugin_name() is translatable, and translations are loaded from the languages directory. Hook and filter names, the shortcode and its attributes, and the form markup are all unchanged.1.3.1: Security and standards release. Fixed an open redirect: after saving, the form now only redirects to a URL on this site (wp_safe_redirect), and the redirect_url attribute is validated before it is output. Fixed the wrong user being reported after a save: old values, visibility and the xprofile_updated_profile action now use the logged-in member instead of the displayed user, which is 0 on an ordinary page, so listeners are told the right user was updated. A form can now only save fields that belong to its own field group: the group is part of the form and its nonce, and any other posted field IDs are ignored. Saving now also requires a logged-in member and an active xProfile component. Posted values are unslashed before saving. All output is escaped and extract() is gone. The plugin now boots on plugins_loaded behind a filterable init gate and does nothing without BuddyPress, reads its version from the header, and its logged-out message and group field list are filterable. Header now declares Requires at least, Requires Plugins (BuddyPress) and the licence. Also includes unreleased changes made to the main file since 1.03.1.03: Converted helper functions to static methods.1.02: Refactored the plugin into a singleton class.1.01: Minor improvements.1.00: Initial release." ; sioc:topic . rdfs:seeAlso . rdfs:seeAlso .