Original Semantic Author Center (OSAC)

Version: 9.14 Author: Umesh Kumar Sahai — DigiAsylum
License: GPL-2.0-or-later
Requires WordPress: 6.0+ / PHP: 7.4+ / Tested: WP 7.0, PHP 8.3

---

Description

OSAC transforms any WordPress site into a professional, Medium-style multi-author platform. Writers live entirely on the frontend. Administrators get a full backend suite to manage authors, review posts, assign plans, and handle upgrade requests.

---

Key Features

• True frontend experience — authors never see wp-admin
• Account Overview + Content Stats in dashboard sidebar
• Email & phone in profiles; admin sees full record with Export CSV
• Upgrade request AJAX inline confirmation
• Admin All Posts — merged filterable table (Title, Author, Category, Status, Notes, Date, Actions)
• Plans & Billing — Upgrade Requests + Plan Distribution + CSV Export
• Native FAQ accordion with Q. / A. layout, chevron icon
• Invoice system — HMAC-signed PDF-printable invoices for WooCommerce orders
• Elementor widgets + shortcodes
• Branded HTML emails — all colours configurable in Settings

---

Shortcodes

Shortcode	Page
[osac_login_form]	Login
[osac_register_form]	Register
[osac_dashboard]	Author dashboard
[osac_post_submission]	Submit article
[osac_profile]	Profile edit
[osac_password_reset_form]	Password reset

---

Invoice URLs

Invoice links are signed with HMAC-SHA256:

/osac-invoice/?order_id=123&token=<sha256_hmac>

Token = HMAC-SHA256( order_id | customer_user_id, AUTH_KEY ). Non-guessable without server access. No open ports. Validates user ownership before serving. Uses browser Print-to-PDF — no server-side PDF library required.

---

Changelog

9.14

• Feature: Secure Profile Picture Uploads. Author avatars are now stored in a private vault (/wp-content/uploads/osac-avatars/) to completely bypass the WordPress Media Library, ensuring other authors cannot see them.
• Tweak: Removed legacy "Export Profile" button from the backend author card.
• Tweak: Removed obsolete FAQ metabox from the backend post editor.
• Admin: Added a direct "Preview" URL button to the All Posts table for Draft and Pending articles.

9.13.3

• UI: Redesigned the Dashboard "Your Stories" section from a card list into a clean, modern Data Table layout.
• UI: Expanded the dashboard container to be ultra-wide on large monitors for a more productive layout.
• UI: Removed redundant filter tabs (All, Published, Pending, Drafts) from the dashboard as status is now clearly visible in the new table.
• Fix: Registration page layout cleaned up by removing the legacy left-side marketing panel and enforcing a clean, centered form.
• Fix: Resolved "Security Check Failed" error on login by removing conflicting nonce caching.
• Fix: Added a concurrency JavaScript lock to prevent the "Database is locked" critical error (and duplicate post creation) when clicking "Save as Draft" or "Send for Review" simultaneously with autosave.
• Fix: osac_page_url() falls back to native profile.php if no frontend profile page is selected, preventing dead links.

9.13.2

• Fix: osac_page_url() no longer fatals when called before rewrite is ready (e.g. early user_register).
• Fix: Duplicate welcome emails — registration now relies on a single user_register email path.
• Fix: Elementor widgets are actually registered with $manager->register().
• Fix: Nested note form removed from inside the editor form (invalid HTML).
• Fix: Duplicate WooCommerce return-URL filters consolidated to one redirect path.
• Fix: Autosave and cover upload verify post ownership; cover MIME validated via wp_check_filetype_and_ext().
• Fix: Registration Terms / Privacy links point at real pages.

9.9.0 — 2026-03-16

FAQ accordion — new Q/A layout

• Completely redesigned. Each FAQ item now shows Q. label prefix on the question row and A. label on the answer.
• Toggle row uses a top-border divider line + right-side chevron (> rotates to v when open).
• Still uses <div role="button"> — zero browser or theme button styling possible.
• Keyboard accessible (Enter / Space).

Editor Notes card — professional context

• Rewritten from a bare linked title to a structured notification:
  • "You received 2 notes on Article Title"
  • Preview of the last note text (12 words)
  • View & reply → CTA link going directly to the notes section of the editor
• CSS class osac-dash-note-* family added.

Invoice system (new)

• New core/invoice.php adds a /osac-invoice/ WordPress rewrite endpoint.
• Token-signed URLs: HMAC-SHA256(order_id|user_id, AUTH_KEY). Validated with hash_equals() to prevent timing attacks.
• Only the order's customer (or any admin) can access their invoice.
• Printable HTML invoice page: header uses admin-configured brand colours, shows order number, date, billing name/email, itemised plan table, subtotal, tax (if any), and total.
• "⬇ Download / Print PDF" button — browser Print-to-PDF, no server library needed.
• Invoice link (⬇ View Invoice) added to each row in the frontend Payment History card.
• Invoice links added to Admin → Manage Author → Payment History table.
• Rewrite rule registered on plugin activation so the endpoint is available immediately.

readme.md now inside the plugin

• readme.md is bundled inside the plugin zip and lives at the plugin root.

---

9.8.0

• Payment History: fixed HTML tags rendering as text (wc_price escaping bug).
• FAQ: changed <button> to <div role="button"> to eliminate all button styling.
• Your Plan card removed; Upgrade button moved into Account Overview.
• Cover image: wp_enqueue_media fires on shortcode pages too; thumbnail set on upload.

9.7.0

• Getting Started: auto-hides when all done, dismissible.
• Account Overview + Content Stats moved to dashboard.
• Notifications: plan events removed.
• Editor bar mobile: save/wordcount hidden.
• Email Template colour settings in admin Settings.
• All emails routed through osac_send_email().

9.6.0 — 9.4.0

See previous releases.

---

Requirements

• WordPress 6.0+
• PHP 7.4+
• Elementor (optional)
• WooCommerce (optional, for paid plans + invoices)