Tutor LMS v4.2.0

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,18 @@
+**ClickUp ticket link:**
+
+## Description
+
+<!-- Describe what changed and why. -->
+
+## Testing
+
+* [ ] Tested
+* [ ] Not tested
+
+## Use of AI Tool
+
+**Used:** Yes / No
+
+**Used for:**
+
+<!-- Describe how AI tools were used, or write "N/A". -->

.github/workflows/pr-description.yml

@@ -0,0 +1,79 @@
+name: Validate PR Description
+
+on:
+pull_request:
+types: [opened, edited, synchronize, reopened]
+
+permissions:
+pull-requests: read
+
+jobs:
+validate:
+runs-on: ubuntu-latest
+steps:
+- name: Validate PR description
+env:
+PR_BODY: ${{ github.event.pull_request.body }}
+shell: bash
+run: |
+set -euo pipefail
+
+```
+      errors=0
+
+      # Check required sections and fields.
+      required_patterns=(
+        '^\*\*ClickUp ticket link:\*\*'
+        '^## Description'
+        '^## Testing'
+        '^- \[ \] Tested$'
+        '^- \[ \] Not tested$'
+        '^## Use of AI Tool'
+        '^\*\*Used:\*\* (Yes|No)$'
+        '^\*\*Used for:\*\*'
+      )
+
+      for pattern in "${required_patterns[@]}"; do
+        if ! grep -Eq "$pattern" <<< "$PR_BODY"; then
+          echo "::error::Missing or invalid PR description field: $pattern"
+          errors=1
+        fi
+      done
+
+      # Ensure exactly one testing option is selected.
+      tested_count=$(grep -Ec '^- \[[xX]\] Tested$' <<< "$PR_BODY" || true)
+      not_tested_count=$(grep -Ec '^- \[[xX]\] Not tested$' <<< "$PR_BODY" || true)
+
+      if (( tested_count + not_tested_count != 1 )); then
+        echo "::error::Select exactly one testing option: Tested or Not tested."
+        errors=1
+      fi
+
+      # Validate the ClickUp ticket link.
+      ticket_link=$(sed -n 's/^\*\*ClickUp ticket link:\*\*[[:space:]]*//p' <<< "$PR_BODY" | head -n 1)
+
+      if [[ ! "$ticket_link" =~ ^https://app\.clickup\.com/ ]]; then
+        echo "::error::Provide a valid ClickUp ticket URL starting with https://app.clickup.com/."
+        errors=1
+      fi
+
+      # Validate AI usage value.
+      if ! grep -Eq '^\*\*Used:\*\* (Yes|No)$' <<< "$PR_BODY"; then
+        echo "::error::Use of AI Tool must be Yes or No."
+        errors=1
+      fi
+
+      # Ensure the AI usage details are provided.
+      used_for=$(sed -n 's/^\*\*Used for:\*\*[[:space:]]*//p' <<< "$PR_BODY" | head -n 1)
+
+      if [[ -z "${used_for//[[:space:]]/}" ]]; then
+        echo "::error::Describe how AI was used, or provide N/A."
+        errors=1
+      fi
+
+      if (( errors != 0 )); then
+        exit 1
+      fi
+
+      echo "PR description validation passed."
+```

GDPR/Controllers/LegalConsent.php

@@ -12,7 +12,7 @@
 
 use Tutor\GDPR\Models\{LegalConsents, LegalConsentLogs};
 use Tutor\Helpers\ValidationHelper;
-use TUTOR\Input;
+use Tutor\Core\Input;
 use Tutor\Traits\JsonResponse;
 use WP_Error;
 
@@ -439,7 +439,7 @@ private function update_legal_consent( int $id, array $request ) {
 
 		$data = $this->prepare_legal_consent_data( $request, false );
 		if ( is_wp_error( $data ) ) {
-			$this->response_bad_request( __( 'Validation error', 'tutor' ), $data->errors, 400 );
+			$this->json_response( __( 'Validation error', 'tutor' ), $data->errors, 400 );
 		}
 
 		if ( isset( $data['consent_map'] ) && ! tutor_is_json( $data['consent_map'] ) ) {

GDPR/Controllers/UserConsent.php

@@ -12,7 +12,6 @@
 
 use Exception;
 use Tutor\GDPR\Models\UserConsents;
-use Tutor\Helpers\ValidationHelper;
 use TUTOR\Input;
 use Tutor\Traits\JsonResponse;
 use WP_User;
@@ -33,7 +32,7 @@ class UserConsent extends BaseController {
 	 *
 	 * @since 4.0.0
 	 *
-	 * @var UserContents
+	 * @var UserConsents
 	 */
 	private $model;
 
@@ -67,6 +66,7 @@ private function register_hooks() {
 		add_action( 'wp_ajax_tutor_user_consents', array( $this, 'handle_ajax_request' ) );
 		add_action( 'tutor_render_consent_logs_button', array( $this, 'render_consent_logs_button' ) );
 		add_action( 'tutor_render_consent_logs_modal', array( $this, 'render_consent_logs_modal' ) );
+		add_action( 'admin_footer-users.php', array( $this, 'render_consent_logs_modal' ) );
 		add_filter( 'manage_users_columns', array( $this, 'add_consent_logs_column' ) );
 		add_filter( 'manage_users_custom_column', array( $this, 'render_consent_logs_column' ), 10, 3 );
 	}
@@ -83,10 +83,6 @@ private function register_hooks() {
 	public function add_consent_logs_column( $columns ) {
 		$columns['consent_logs'] = __( 'Consent Logs', 'tutor' );
 
-		ob_start();
-		$this->render_consent_logs_modal();
-		$columns['consent_logs_modal'] = ob_get_clean();
-
 		return $columns;
 	}
 
@@ -110,7 +106,9 @@ public function render_consent_logs_column( $value, $column_name, $user_id ) {
 			return $value;
 		}
 
-		$value = '<button type="button" class="tutor-btn tutor-btn-outline-primary tutor-btn-sm" data-tutor-modal-target="tutor-consent-logs-modal" data-consent-logs-trigger data-user-id="' . esc_attr( $user_id ) . '" data-user-name="' . esc_attr( $user->display_name ) . '" data-user-joined="' . esc_attr( $user->user_registered ) . '" data-user-email="' . esc_attr( $user->user_email ) . '" data-user-login="' . esc_attr( $user->user_login ) . '" data-avatar-src="' . esc_url( tutor_utils()->get_user_avatar_url( $user_id ) ) . '"><i class="tutor-icon-eye-line tutor-mr-8" aria-hidden="true"></i>' . esc_html__( 'View Logs', 'tutor' ) . '</button>';
+		$value = '<button type="button" class="tutor-btn tutor-btn-outline-primary tutor-btn-sm" data-tutor-modal-target="tutor-consent-logs-modal" data-consent-logs-trigger data-user-id="'
+		. esc_attr( $user_id ) .
+		'"><i class="tutor-icon-eye-line tutor-mr-8" aria-hidden="true"></i>' . esc_html__( 'View Logs', 'tutor' ) . '</button>';
 
 		return $value;
 	}
@@ -186,21 +184,29 @@ public function handle_ajax_request(): void {
 		switch ( $user_action ) {
 			case 'all_consents_given_by_user':
 				$user_id = Input::post( 'user_id', 0, Input::TYPE_INT );
+				$user    = $user_id ? get_userdata( $user_id ) : false;
 
-				$validate_user = ValidationHelper::validate(
-					array( 'user_id' => 'required|is_exists' ),
-					array( 'user_id' => $user_id )
-				);
-
-				if ( ! $validate_user->success ) {
+				if ( ! $user ) {
 					$this->response_bad_request( __( 'Invalid user ID', 'tutor' ) );
 				}
 
 				$consents = $this->get_all_consents_given_by_user( $user_id );
+				$html     = $this->get_consent_logs_html( $user, $consents );
 
 				$this->json_response(
 					__( 'Consent fetched successfully', 'tutor' ),
-					$consents
+					array(
+						'html'     => $html,
+						'has_logs' => ! empty( $consents ),
+						'logs'     => $consents,
+						'user'     => array(
+							'id'     => $user->ID,
+							'name'   => $user->display_name,
+							'login'  => $user->user_login,
+							'email'  => $user->user_email,
+							'joined' => $user->user_registered,
+						),
+					)
 				);
 
 				break;
@@ -318,6 +324,7 @@ function ( $record ) {
 	 */
 	private function build_and_store( $consent, $user_data, $display_key ) {
 		$build_consent = LegalConsent::build_consent_snapshot( $consent );
+
 		if ( ! empty( $build_consent ) ) {
 			$build_consent['user_id']    = $user_data->ID;
 			$build_consent['user_email'] = $user_data->user_email;
@@ -351,28 +358,6 @@ private function create( array $data ) {
 		return $user_consent_id;
 	}
 
-	/**
-	 * Check if a user already gave consent for a display key and version.
-	 *
-	 * @since 4.0.0
-	 *
-	 * @param string $display_key Consent display key.
-	 * @param string $version     Consent version.
-	 * @param int    $user_id     User ID. Defaults to current user.
-	 *
-	 * @return bool
-	 */
-	private function is_consent_given_by_user( string $display_key, string $version, int $user_id ): bool {
-		$user_data = get_userdata( $user_id );
-		if ( ! $user_data ) {
-			return false;
-		}
-
-		$given_consent = $this->model->is_consent_given_by_user( $user_id, $display_key, $version );
-
-		return $given_consent;
-	}
-
 	/**
 	 * Render consent logs button.
 	 * Called via action hook.
@@ -386,12 +371,6 @@ public function render_consent_logs_button( $user_data ): void {
 		if ( ! $user_id ) {
 			return;
 		}
-
-		$user_name   = $user_data->display_name ?? '';
-		$user_joined = $user_data->user_registered ?? '';
-		$user_email  = $user_data->user_email ?? '';
-		$user_login  = $user_data->user_login ?? '';
-		$avatar_src  = get_avatar_url( $user_id, array( 'size' => 40 ) );
 		?>
 		<div class="tutor-dropdown-parent">
 			<button type="button" class="tutor-iconic-btn" action-tutor-dropdown="toggle">
@@ -404,11 +383,6 @@ class="tutor-dropdown-item"
 					data-tutor-modal-target="tutor-consent-logs-modal"
 					data-consent-logs-trigger
 					data-user-id="<?php echo esc_attr( $user_id ); ?>"
-					data-user-name="<?php echo esc_attr( $user_name ); ?>"
-					data-user-joined="<?php echo esc_attr( $user_joined ); ?>"
-					data-user-email="<?php echo esc_attr( $user_email ); ?>"
-					data-user-login="<?php echo esc_attr( $user_login ); ?>"
-					data-avatar-src="<?php echo esc_url( $avatar_src ); ?>"
 				>
 					<i class="tutor-icon-file-text tutor-mr-8" aria-hidden="true"></i>
 					<span><?php esc_html_e( 'Consent Logs', 'tutor' ); ?></span>
@@ -418,6 +392,22 @@ class="tutor-dropdown-item"
 		<?php
 	}
 
+	/**
+	 * Render consent logs content (timeline + user card).
+	 *
+	 * @since 4.1.3
+	 *
+	 * @param \WP_User $user User object.
+	 * @param array    $consents User consent records.
+	 *
+	 * @return string Rendered HTML.
+	 */
+	public function get_consent_logs_html( \WP_User $user, array $consents ): string {
+		ob_start();
+		include tutor()->path . 'views/templates/consent-logs-content.php';
+		return ob_get_clean();
+	}
+
 	/**
 	 * Render consent logs modal.
 	 * Called via action hook.

GDPR/GDPR.php

@@ -14,7 +14,7 @@
 use Tutor\GDPR\Controllers\LegalConsent;
 use Tutor\GDPR\Controllers\UserConsent;
 use Tutor\GDPR\DB\DB;
-use TUTOR\Singleton;
+use Tutor\Core\Singleton;
 
 defined( 'ABSPATH' ) || exit;
 

GDPR/Models/UserConsents.php

@@ -11,7 +11,7 @@
 namespace Tutor\GDPR\Models;
 
 use Tutor\GDPR\DB\UserConsents as Table;
-use TUTOR\Input;
+use Tutor\Core\Input;
 use Tutor\Models\BaseModel;
 
 defined( 'ABSPATH' ) || exit;

assets/core/scss/components/_feature-disabled.scss

@@ -0,0 +1,37 @@
+// Feature Disabled / Access Denied Component
+//
+// Ported from legacy assets/src/scss/front/_denied.scss into the v4 design system.
+// Used by templates/feature_disabled.php to render access-denied and feature-disabled
+// states (e.g. when user registration is disabled) with proper v4 tokens and typography.
+
+@use '../tokens' as *;
+@use '../mixins' as *;
+
+.tutor-disabled-wrapper {
+  max-width: 444px;
+  padding: $tutor-spacing-12 $tutor-spacing-none $tutor-spacing-8;
+  margin: auto;
+  @include tutor-flex(column, center, center);
+  text-align: center;
+
+  .tutor-disabled-content-wrapper {
+    @include tutor-flex(column, center, center);
+    text-align: center;
+
+    img {
+      margin-bottom: $tutor-spacing-6;
+    }
+
+    h3 {
+      @include tutor-typography('h4', 'medium', 'primary');
+      margin-top: $tutor-spacing-none;
+      margin-bottom: $tutor-spacing-3;
+    }
+
+    p {
+      @include tutor-typography('p2', 'regular', 'subdued');
+      margin-top: $tutor-spacing-none;
+      margin-bottom: $tutor-spacing-8;
+    }
+  }
+}

assets/core/scss/components/_index.scss

@@ -28,3 +28,4 @@
 @forward 'time-input';
 @forward 'status-select';
 @forward 'star-rating';
+@forward 'feature-disabled';

assets/core/ts/utils/endpoints.ts

@@ -65,6 +65,7 @@ const endpoints = {
   QUIZ_ABANDON: 'tutor_quiz_abandon',
   QUIZ_TIMEOUT: 'tutor_quiz_timeout',
   QUIZ_ATTEMPT_SUBMIT: 'tutor_answering_quiz_question',
+  QUIZ_CHECK_ANSWER: 'tutor_quiz_check_answer',
   REVIEW_QUIZ_ANSWERS: 'tutor_review_quiz_answers',
   INSTRUCTOR_FEEDBACK: 'tutor_instructor_feedback',
   SAVE_QUESTION_FEEDBACK: 'tutor_save_question_feedback',
@@ -168,6 +169,7 @@ const endpoints = {
   IMPORT_SETTINGS_FREE: 'tutor_import_settings',
   GET_IMPORT_EXPORT_HISTORY: 'tutor_pro_export_import_history',
   DELETE_IMPORT_EXPORT_HISTORY: 'tutor_pro_delete_export_import_history',
+  EXPORT_ANALYTICS: 'export_analytics',
 
   // CONTENT BANK
   GET_CONTENT_BANK_COLLECTIONS: 'tutor_content_bank_collections',

assets/core/ts/utils/security.ts

@@ -42,3 +42,35 @@ export function escapeAttr(str: string): string {
     .replace(/</g, '&lt;')
     .replace(/>/g, '&gt;');
 }
+
+/**
+ * Formula injection prevention prefixes (OWASP / CWE-1236)
+ */
+const FORMULA_INJECTION_PREFIXES = ['=', '+', '-', '@', '\t', '\r'] as const;
+
+/**
+ * Sanitizes a single cell value for CSV export to prevent formula injection (OWASP / CWE-1236)
+ * and properly escape commas, double quotes, and newlines.
+ *
+ * @param rawVal - The raw value to sanitize
+ * @returns The sanitized cell string
+ *
+ * @since 4.2.0
+ */
+export function sanitizeCsvCell(rawVal: unknown): string {
+  if (rawVal === null || rawVal === undefined) {
+    return '';
+  }
+
+  let str = String(rawVal);
+
+  if (FORMULA_INJECTION_PREFIXES.some((prefix) => str.startsWith(prefix))) {
+    str = `'${str}`;
+  }
+
+  if (str.includes(',') || str.includes('"') || str.includes('\n') || str.includes('\r')) {
+    return `"${str.replace(/"/g, '""')}"`;
+  }
+
+  return str;
+}