Universal Reviews – Ratings, Review Forms, Google Reviews, Social-Proof

Journal des modifications

1.1.4

16 Oct 2026
* Fixed: the review form could not be submitted. A script error stopped the form on the first field change and on submit; field errors, the star label, the photo picker and the status message work again.
* Security: the public reviews list no longer returns reviews of draft, private or trashed posts when no target is given.
* Security: guests are no longer marked as verified buyers from a typed email (logged-in buyers still are); the public vote endpoint accepts helpful votes only.
* Performance: admin lists are capped at 100 per page, bulk actions at 500 reviews, review history at 200 entries, and summaries without a stored row are cached.
* Uninstall now also removes the plugin’s cached transients.
* Performance: the reviews table gets two indexes for « top rated » and « most helpful » lists, history lists are limited to 200 entries and one request can no longer load an unbounded page of reviews.
* Database: adds two indexes to the reviews table. It updates automatically on first load.

1.1.3

14 Oct 2026
* Fixed: helpful votes and the fresh-token refresh on cached pages failed on any site whose address contains « reviews » (for example universal-reviews.local), so cached forms were rejected and votes did not count.
* Fixed: submitting a review or vote was blocked (« Invalid request origin ») when the visitor reached the site through the www / non-www variant of its address.
* Fixed: Elementor widgets (review form, reviews list, Google reviews) lost their styles and scripts, and served stale security tokens, when Elementor’s element cache was on. They now declare their assets and are never cached.
* Fixed: the Google reviews carousel works in right-to-left languages (scroll position, arrows, arrow keys); the page-dot labels are now translatable; filtering to zero reviews now shows a « No reviews match this filter. » message.
* Fixed: a photo field hidden by a smart-field rule no longer uploads files.
* Fixed: « Load more » keeps keyboard focus on the newly loaded reviews instead of dropping it.
* Fixed: a fatal error on PHP 8 when a stored settings section was not an array.
* Fixed: long Google reviewer names or IDs containing multibyte characters (CJK, emoji) could be cut mid-character and make the whole cache insert fail.
* Fixed: reviews list and avatar initials no longer fatal on servers without the mbstring extension.
* Fixed: deleting a review type that still has reviews is refused instead of orphaning them.
* Fixed: owner replies are limited to 10,000 characters, a failed save is reported, and the reviewer is emailed the sanitised text.
* Fixed: the average rating and structured data update immediately after an admin adds a review, even when WP-Cron is disabled.
* Fixed: deactivating or uninstalling now removes scheduled Google retry events.
* Security: rate limits, helpful-vote de-duplication and the one-review-per-person check treat an IPv6 visitor’s whole /64 network as one visitor, so rotating addresses can no longer bypass them.
* Fixed: behind a reverse proxy or CDN (Cloudflare, a load balancer) every visitor shared one rate-limit bucket. The visitor’s real address is now read from CF-Connecting-IP / X-Forwarded-For when the request comes from a private-network proxy, or from one listed with the new unirev_trusted_proxies filter.
* Fixed: a visitor could post a review with a form that belongs to a different review type; the form now decides the type.
* Fixed: exports of large sites ran into the admin request limit; export chunks are now 2,000 reviews each and skip the extra count query.
* Fixed: reviews of password-protected posts are no longer listed publicly.
* Fixed: when Google rejects the saved client (credentials replaced or removed), the connection now asks you to reconnect instead of showing a permanent error.
* Fixed: sites that existed before network activation get the default review type and form; the first request after an update takes a lock so concurrent visitors don’t all run the database upgrade.
* Fixed: deleting a multisite sub-site now removes its Universal Reviews tables.
* Fixed: the public submit response no longer returns the new review’s sequential ID, which revealed total volume including pending and spam reviews.
* Improved: the review form now explains each invalid field right next to it (« This field is required. » or the email message), linked to the field for screen readers, cleared as soon as the visitor fixes it; an optional email address that is filled in is also checked before sending.
* Fixed: a malformed background job no longer raises PHP notices; photo uploads are limited to 25 megapixels (was 40) to bound image-processing load; Google carousel autoplay stops on first touch; the reply box, required marker and rating counts use logical CSS properties so they mirror correctly in right-to-left languages; the honeypot field is inert for assistive tech and helpful-vote results are announced.
* Improved: translations load only on pages that show a review widget; Google Reviews styles load in the page head and in the block editor, and are registered up front for page builders.
* Improved: the public reviews list is cacheable by CDNs and browsers for visitors who are not logged in (60 seconds).
* Privacy: the personal-data export now includes the reviewer’s email and stored IP address; erasing a reviewer also removes the stored verification reference and unlinks their account from the audit history.
* Accessibility: visible focus outlines in high-contrast / forced-colors mode; « Verified » is announced to screen readers; helpful buttons name the review author; rating filters expose the active choice; the carousel list has an accessible name.

1.1.2

10 Oct 2026
* New: Use-Case Packs. Reviews → Use-Case Packs sets up a complete review workflow in one click: a review type, a form with smart follow-up questions, moderation and alert defaults and a saved display preset. Free includes Restaurants & cafés and WooCommerce stores; Pro adds Clinics & healthcare, Courses & training, Agencies & freelancers and Rental properties.
* New: packs are previewed before anything is saved, never overwrite what you already have, can be applied in parts and can be undone. A review type that already has reviews is kept when a pack is undone.
* New: smart fields. A form field can be shown only when an earlier answer matches (one condition on Free, several with all/any matching on Pro). The server enforces it, so a field hidden by its rule is never stored.
* New: low-rating alerts. A review type can email you when a review is rated at or below a threshold. It only notifies; nothing is hidden or delayed, and the email has no review text or reviewer details.
* New: optional WooCommerce « verified buyer » check per review type (off by default). Logged-in reviewers are checked by their own account. Publishing verified buyers without approval is a separate choice.
* New: per-review-type setting to override the site-wide « auto-approve verified reviewers » choice.
* New: display presets: [unirev_reviews preset="restaurant"] supplies saved list defaults; an explicit attribute still wins.
* New: forms can set their own button text and thank-you message.
* New: schema.org types MedicalBusiness, LodgingBusiness and ProfessionalService for review types.
* Improved: the form builder keeps a form’s settings and smart-field rules when you edit and save it, and supports them in template import and export.
* Database: adds a settings column to the review types table. It updates automatically on first load.

1.1.1

08 Oct 2026
* New: 5 design styles for Google Reviews: Classic (Free), plus Aurora (dark glass), Candy (playful pastel), Soft (neumorphic) and Editorial (serif, numbered, featured first review) for Pro. Each works in list, grid and carousel layouts.
* New: Free plan keeps the Classic list. Choose a style with the shortcode attribute card_style, the block « Design style » control, the Elementor widget or Reviews → Google Reviews → Display, which now has a visual style picker.
* New (Pro): carousel with arrow buttons, page dots, mouse drag, arrow-key navigation and optional autoplay (0–15 seconds, pauses on hover and for visitors who prefer reduced motion). Columns (2–4) now apply to the carousel as well as the grid.
* Improved: Google Reviews performance. Reviews are read from the object cache and refreshed whenever a sync changes them; expired reviews are never shown. The admin screen counts reviews with a lightweight query.
* Improved: Sync Now has a short cooldown so repeated clicks cannot use up your Google API quota.
* Fixed: the Google sign-in and API request addresses are now properly URL-encoded.

1.1.0

07 Oct 2026
* New: Google Reviews (optional). Connect your own Google Business Profile with OAuth (your own Google Cloud project; tokens and the client secret are encrypted) and show recent Google reviews from a temporary local copy. Free: one location, up to 50 reviews, daily sync plus Sync Now.
* New: [unirev_google_reviews] shortcode, Google Reviews block and Google Reviews Elementor widget.
* New: Google Reviews display options: layout, reviews per page, rating summary, reviewer name, date, text, Google attribution, rating filter, Load more, star style, size and colour, spacing, text size and button style.
* New (Pro): grid layout with 2–4 columns, carousel, card styles, star colour, rating filter, up to 500 reviews per location, and up to 25 locations with Add location and a location choice per block, shortcode or widget.
* New: Change Google account, Edit Client ID & Secret and Disconnect from the Google Reviews screen, a warning when the last successful sync is old, a Google Reviews card on the Dashboard, and a first-run Getting started checklist.
* Improved: translations. The language template now includes the admin app strings.

1.0.3

• Fixed : Improved and Bug Fixed
• Removed: the admin notice warning that an Nginx server needs manual config to protect the review-photos upload folder (the folder’s own protection still applies; this only removed the heads-up notice).

1.0.2

• New: Review Form block’s « Form » field is a dropdown of your saved forms, and adds full color/size style controls for the button, fields and star rating.
• New: Elementor widgets for Review Form and Reviews List.
• New: « Load more reviews » button on review lists (cursor pagination) and a « Helpful » vote button on each review.
• Added: an admin notice (with the exact config) when the server is Nginx, since the upload folder’s .htaccess protection doesn’t apply there.
• Improved: schema.org output uses the correct worst rating for half-star types, a stable @id, merges multiple reviewed items into one @graph, an allow-list of valid types (filter unirev_schema_types) and a unirev_schema_output filter to avoid duplicates with WooCommerce or SEO plugins.
• Improved: the duplicate-review guard also checks the reviewer’s IP via a privacy-safe one-way hash — works regardless of the « store IP » setting, so a different email no longer bypasses it.
• Improved: Reviews List and Review Form blocks use block API v3, add editor previews, colour and font-size controls, and a searchable picker (posts, products, terms and users) instead of a raw ID field.
• Improved: admin rating-distribution chart is cached in a transient, same as the status-count badge.
• Improved: the public reviews API is now rate-limited per IP, separate from the submission limit; it also no longer runs a total count or resolves target titles, and returns nothing for posts that are no longer public.
• Improved: front-end CSS/JS load in the page head when a post contains the shortcode or block (no layout shift), and rate-limit counters use the persistent object cache when one is available instead of writing database options on every hit.
• Improved: the time-trap token is bound to the visitor’s IP; helpful votes use their own rate-limit bucket instead of the submission quota.
• Improved: the submit error no longer reveals whether an item ID exists.
• Improved: admin menu badge counts are cached in a short-lived transient; identical pending background jobs are no longer queued twice.
• Improved: bulk moderation now uses one lookup and one update per status group instead of several queries per review.
• Fixed: Review Form and Reviews List block previews were unstyled in the editor; they now match the front-end.
• Fixed: titles, names, answers and avatar initials are now cut on character boundaries, so Hindi, Arabic, CJK and emoji text is no longer corrupted.
• Fixed: « Highest rated » pagination skipped half-star (4.5) reviews after the first page.
• Fixed: a new auto-approved review now updates the review count, average rating and schema.org data immediately instead of waiting for WP-Cron.
• Fixed: review forms and vote buttons on full-page-cached pages no longer fail with stale nonce or time-trap tokens; fresh tokens are fetched on interaction.
• Fixed: a rate-limit window of 0 no longer disables the limit; window, reviews-per-page and cron interval settings are now range-limited.
• Privacy: the personal-data eraser also removes log entries containing the reviewer’s email, and vote records older than one year are pruned.
• Security: photos that cannot be verified (unreadable image header, including AVIF) are rejected; photos are deleted when a review is rejected or marked spam.

1.0.1

• New: photo reviews (JPEG, PNG, WebP and AVIF uploads with size and count limits; SVG is never accepted) and optional half-star ratings per review type.
• Improved: spam-check filter, vote nonce, admin REST rate limit and settings/summary caching; fixed empty stars showing as filled in review lists.

1.0.0

• Initial release.
• Dedicated indexed review tables.
• [unirev_form], [unirev_reviews] and [unirev_summary] shortcodes.
• Reviews List and Review Form Gutenberg blocks.
• Drag-and-drop review form builder.
• Review types with configurable targets and schema.org types.
• Review moderation with bulk actions.
• Owner replies, helpful votes and verified reviews.
• Review history and form-answer inspection.
• Honeypot, signed time trap, rate limiting and duplicate-review protection.
• Streaming CSV/JSON export.
• Batched CSV import with row-level errors.
• Background jobs, logs and diagnostics.
• Precomputed rating summaries and distributions.
• Conditional CSS and JavaScript loading.
• AggregateRating JSON-LD for eligible visible review content.
• WordPress privacy exporter and eraser integration.
• No telemetry.