fix(instanda): hygiene pass + v1.1.0 (uninstall, notices, cron, resubmit, theme)

- F-15: uninstall now removes ALL espinstanda_* options and transients (incl. the
  encrypted password and its self-provisioned key).
- F-16: register the "Gravity Forms required" admin notice unconditionally so it is
  reachable when GF is inactive (gform_loaded never fires then).
- F-22: self-heal the daily retention cron on admin_init (matches the schema self-heal).
- F-19: re-validate the stored payload via Field_Mapper::validate_payload() before a
  resubmit (DB-tamper trust boundary).
- F-20: increment the retry count on resubmit and dispatch the previously-dead
  espinstanda_resubmit_success notification event.
- F-23: emit the theme's Form-5 date-range JS only on pages that embed a Gravity Form
  and disconnect the MutationObserver (was observing the DOM subtree forever).
- F-24: bump plugin to 1.1.0; add readme.txt changelog documenting the audit fixes and
  the required ops actions.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
2026-07-02 16:20:10 -06:00
co-authored by Claude Fable 5
parent 0732dd662d
commit 5d2e9cb7e5
7 changed files with 175 additions and 18 deletions
@@ -20,10 +20,19 @@ try {
// Table name is a trusted internal constant, not user input.
$wpdb->query("DROP TABLE IF EXISTS {$table}");
delete_option('espinstanda_db_version');
delete_option('espinstanda_operating_mode_audit');
// Remove EVERY plugin option and transient - including the encrypted Test password
// and its self-provisioned key - so no recoverable secret survives uninstall.
$opt = $wpdb->esc_like('espinstanda_') . '%';
$tr = '_transient_' . $wpdb->esc_like('espinstanda_') . '%';
$trt = '_transient_timeout_' . $wpdb->esc_like('espinstanda_') . '%';
$wpdb->query($wpdb->prepare(
"DELETE FROM {$wpdb->options} WHERE option_name LIKE %s OR option_name LIKE %s OR option_name LIKE %s",
$opt,
$tr,
$trt
));
// Clear any scheduled cleanup that may still be queued.
// Clear any scheduled events that may still be queued.
wp_clear_scheduled_hook('esp_instanda_cleanup');
} catch (\Throwable $e) {
if (function_exists('error_log')) {