Changeset 3783117

Timestamp:

11/04/2026 05:26:12 AM (3 hours ago)

Author:

fast2smsdev

Message:

1.17.0: Admin alerts per form - send the form submission details to one or more admin numbers with your own WhatsApp/SMS template; Contact Form 7 short form IDs supported for OTP.

Location:

fast2sms

Files:

• tags/1.17.0 (added)
• tags/1.17.0/admin (added)
• tags/1.17.0/admin/index.php (added)
• tags/1.17.0/admin/views (added)
• tags/1.17.0/admin/views/app.php (added)
• tags/1.17.0/admin/views/index.php (added)
• tags/1.17.0/assets (added)
• tags/1.17.0/assets/css (added)
• tags/1.17.0/assets/css/admin.css (added)
• tags/1.17.0/assets/css/index.php (added)
• tags/1.17.0/assets/css/otp.css (added)
• tags/1.17.0/assets/images (added)
• tags/1.17.0/assets/images/icon.png (added)
• tags/1.17.0/assets/images/logo.png (added)
• tags/1.17.0/assets/index.php (added)
• tags/1.17.0/assets/js (added)
• tags/1.17.0/assets/js/admin.js (added)
• tags/1.17.0/assets/js/cart-capture.js (added)
• tags/1.17.0/assets/js/cod.js (added)
• tags/1.17.0/assets/js/index.php (added)
• tags/1.17.0/assets/js/notice.js (added)
• tags/1.17.0/assets/js/otp.js (added)
• tags/1.17.0/assets/js/stock-notify.js (added)
• tags/1.17.0/fast2sms.php (added)
• tags/1.17.0/includes (added)
• tags/1.17.0/includes/class-f2s-abandoned-cart.php (added)
• tags/1.17.0/includes/class-f2s-admin.php (added)
• tags/1.17.0/includes/class-f2s-api.php (added)
• tags/1.17.0/includes/class-f2s-backinstock.php (added)
• tags/1.17.0/includes/class-f2s-campaigns.php (added)
• tags/1.17.0/includes/class-f2s-checkout.php (added)
• tags/1.17.0/includes/class-f2s-cod.php (added)
• tags/1.17.0/includes/class-f2s-crypto.php (added)
• tags/1.17.0/includes/class-f2s-events.php (added)
• tags/1.17.0/includes/class-f2s-form-replies.php (added)
• tags/1.17.0/includes/class-f2s-forms.php (added)
• tags/1.17.0/includes/class-f2s-install.php (added)
• tags/1.17.0/includes/class-f2s-invoice.php (added)
• tags/1.17.0/includes/class-f2s-optout.php (added)
• tags/1.17.0/includes/class-f2s-otp-login.php (added)
• tags/1.17.0/includes/class-f2s-otp.php (added)
• tags/1.17.0/includes/class-f2s-phone.php (added)
• tags/1.17.0/includes/class-f2s-privacy.php (added)
• tags/1.17.0/includes/class-f2s-queue.php (added)
• tags/1.17.0/includes/class-f2s-settings.php (added)
• tags/1.17.0/includes/index.php (added)
• tags/1.17.0/languages (added)
• tags/1.17.0/languages/index.php (added)
• tags/1.17.0/logo.png (added)
• tags/1.17.0/readme.txt (added)
• tags/1.17.0/uninstall.php (added)
• trunk/assets/js/admin.js (modified) (16 diffs)
• trunk/fast2sms.php (modified) (2 diffs)
• trunk/includes/class-f2s-admin.php (modified) (3 diffs)
• trunk/includes/class-f2s-form-replies.php (modified) (15 diffs)
• trunk/includes/class-f2s-forms.php (modified) (5 diffs)
• trunk/includes/class-f2s-queue.php (modified) (1 diff)
• trunk/includes/class-f2s-settings.php (modified) (1 diff)
• trunk/readme.txt (modified) (3 diffs)

fast2sms/trunk/assets/js/admin.js

@@ -1375 +1375 @@
         }
 
+        function frTplText(channel, sms, wa) {
+                var parts = [];
+                if (channel !== 'sms' && channel !== 'none' && wa.message_id) { parts.push('WhatsApp: ' + (wa.name || '#' + wa.message_id)); }
+                if (channel !== 'whatsapp' && channel !== 'none' && sms.message_id) { parts.push('SMS: #' + sms.message_id); }
+                return parts.join(' + ');
+        }
+
         function frSummary(r) {
-                var parts = [];
-                if (r.channel !== 'sms' && r.whatsapp.message_id) { parts.push('WhatsApp: ' + (r.whatsapp.name || '#' + r.whatsapp.message_id)); }
-                if (r.channel !== 'whatsapp' && r.sms.message_id) { parts.push('SMS: #' + r.sms.message_id); }
-                return parts.join(' + ') || 'No template picked';
+                var out = r.channel === 'none' ? 'Customer: no message' : 'Customer → ' + (frTplText(r.channel, r.sms, r.whatsapp) || 'no template picked');
+                if (r.admin && Number(r.admin.enabled)) {
+                        out += ' · Admin alert → ' + (frTplText(r.admin.channel, r.admin.sms, r.admin.whatsapp) || 'no template picked');
+                }
+                return out;
         }
 
@@ -1392 +1400 @@
                                 toggleHtml('f2s-fr-on-' + i, Number(r.enabled)) +
                                 '<div class="f2s-fr-main"><strong>' + esc(formLabel) + '</strong> <span class="f2s-pill f2s-pill-gray">' + esc(frSourceLabel(r.source)) + '</span>' +
-                                        '<div class="f2s-muted" style="font-size:12px">→ ' + esc(frSummary(r)) + (Number(r.verified_only) ? ' · only OTP-verified numbers' : '') + '</div></div>' +
+                                        '<div class="f2s-muted" style="font-size:12px">' + esc(frSummary(r)) + (Number(r.verified_only) ? ' · only OTP-verified numbers' : '') + '</div></div>' +
                                 '<button type="button" class="f2s-btn f2s-btn-ghost f2s-btn-sm f2s-fr-edit">Edit</button>' +
                                 '<button type="button" class="f2s-btn f2s-btn-ghost f2s-btn-sm f2s-fr-del" title="Delete">🗑</button>' +
@@ -1402 +1410 @@
                 return '<div class="f2s-card" id="f2s-fr-card">' +
                         '<h2>💬 Auto-reply when someone submits a form</h2>' +
-                        '<p class="f2s-sub">Send your approved WhatsApp or SMS template to the person who filled the form — e.g. “Thank you for contacting us, {name}!”. Pick the form, the template, and which form field goes into each template variable.</p>' +
+                        '<p class="f2s-sub">Send your approved WhatsApp or SMS template to the person who filled the form — e.g. “Thank you for contacting us, {name}!” — and, if you like, alert your admin number with the submission details. Pick the form, the template, and which form field goes into each template variable.</p>' +
                         '<div id="f2s-fr-sources" class="f2s-muted" style="font-size:12px;margin-bottom:10px">Checking your form plugins…</div>' +
                         '<div id="f2s-fr-listbox">' + frListHtml() + '</div>' +
@@ -1439 +1447 @@
                         '<div class="f2s-field"><label>2. Which field has the customer’s mobile number?</label>' +
                                 '<select class="f2s-select" id="f2s-fr-phone" style="max-width:420px"></select></div>' +
-                        '<div class="f2s-field"><label>3. Send by</label>' + segHtml('fr-channel', [{ v: 'whatsapp', l: 'WhatsApp' }, { v: 'sms', l: 'SMS' }, { v: 'both', l: 'Both' }], r.channel || 'whatsapp') + '</div>' +
-                        '<div class="f2s-field"><label>4. Template — and what goes into each variable</label>' +
+                        '<div class="f2s-field"><label>3. Message to the customer</label>' + segHtml('fr-channel', [{ v: 'whatsapp', l: 'WhatsApp' }, { v: 'sms', l: 'SMS' }, { v: 'both', l: 'Both' }, { v: 'none', l: 'Don’t send' }], r.channel || 'whatsapp') + '</div>' +
+                        '<div class="f2s-field" id="f2s-fr-cust-tpl"><label>4. Customer template — and what goes into each variable</label>' +
                                 '<div id="f2s-fr-wa" class="f2s-subcard"><div class="f2s-subcard-head"><span class="ch-dot ch-wa"></span>WhatsApp template</div>' +
                                         '<div style="margin-bottom:10px">' + comboHtml('whatsapp') + '</div><div id="f2s-fr-wa-map"></div>' +
@@ -1451 +1459 @@
                                 '</div></div>' +
                         '<div class="f2s-field f2s-row"><span style="min-width:320px">5. Only send if the number was verified with OTP <span class="f2s-muted" style="font-size:11.5px;display:block">Needs the OTP box on this form (see “OTP verification on forms” below). Best protection against fake numbers.</span></span>' + toggleHtml('f2s-fr-verified', Number(r.verified_only)) + '</div>' +
+                        '<div class="f2s-field f2s-row"><span style="min-width:320px">6. Also alert the admin <span class="f2s-muted" style="font-size:11.5px;display:block">Sends the submission details to one or more admin numbers whenever someone fills this form.</span></span>' + toggleHtml('f2s-fr-admin-on', Number(r.admin.enabled)) + '</div>' +
+                        '<div id="f2s-fr-admin" class="f2s-subcard" style="' + (Number(r.admin.enabled) ? '' : 'display:none') + '">' +
+                                '<div class="f2s-subcard-head">🔔 Admin alert</div>' +
+                                '<div class="f2s-field"><label>Send to</label>' +
+                                        segHtml('fr-admin-to', [{ v: 'settings', l: 'Admin numbers in Settings (' + (FAST2SMS.adminPhones || []).length + ')' }, { v: 'custom', l: 'These numbers' }], r.admin.to === 'custom' ? 'custom' : 'settings') +
+                                        '<div id="f2s-fr-admin-nums" style="margin-top:8px;' + (r.admin.to === 'custom' ? '' : 'display:none') + '">' +
+                                                '<div id="f2s-fr-num-chips" class="f2s-row" style="gap:6px;flex-wrap:wrap;margin-bottom:6px"></div>' +
+                                                '<input class="f2s-input" id="f2s-fr-num-add" style="max-width:420px" placeholder="Add numbers — one or more, separated by commas (e.g. 9876543210, 9123456789)" />' +
+                                                '<p class="hint">Up to 10 numbers. Every number listed gets the alert.</p>' +
+                                        '</div>' +
+                                        '<p class="hint" id="f2s-fr-admin-settings-hint" style="' + (r.admin.to === 'custom' ? 'display:none' : '') + '">' +
+                                                ((FAST2SMS.adminPhones || []).length ? 'All ' + (FAST2SMS.adminPhones || []).length + ' admin number(s) from Settings get the alert.' : '⚠️ No admin number in Settings yet — add one there, or choose “These numbers”.') + '</p>' +
+                                '</div>' +
+                                '<div class="f2s-field"><label>Send by</label>' + segHtml('fr-admin-channel', [{ v: 'whatsapp', l: 'WhatsApp' }, { v: 'sms', l: 'SMS' }, { v: 'both', l: 'Both' }], r.admin.channel || 'whatsapp') + '</div>' +
+                                '<div id="f2s-fr-aw"><div class="f2s-muted" style="font-size:12px;margin-bottom:6px">WhatsApp template</div><div style="margin-bottom:10px">' + comboHtml('whatsapp') + '</div><div id="f2s-fr-aw-map"></div>' +
+                                        '<div class="f2s-wa-media" style="display:none"><div class="f2s-field"><label>Header media URL <span class="f2s-pill f2s-pill-blue f2s-wa-header-type" style="margin-left:6px"></span></label>' +
+                                                '<input class="f2s-input f2s-wa-media-url" placeholder="https://yoursite.com/logo.png" value="' + esc(r.admin.whatsapp.media_url || '') + '" /></div>' +
+                                                '<div class="f2s-field"><label>Document filename (optional)</label><input class="f2s-input f2s-wa-doc-name" style="max-width:300px" value="' + esc(r.admin.whatsapp.document_filename || '') + '" /></div></div>' +
+                                '</div>' +
+                                '<div id="f2s-fr-as"><div class="f2s-muted" style="font-size:12px;margin:6px 0">SMS template (DLT)</div><div style="margin-bottom:10px">' + comboHtml('sms') + '</div><div id="f2s-fr-as-map"></div></div>' +
+                                '<p class="hint">Tip: map the customer’s name, 📱 Mobile number, and any other field (e.g. website, message) into your admin template.</p>' +
+                        '</div>' +
                         '<div class="f2s-row" style="gap:8px;margin-top:6px"><button type="button" class="f2s-btn" id="f2s-fr-save">Save auto-reply</button>' +
                                 '<button type="button" class="f2s-btn f2s-btn-ghost" id="f2s-fr-cancel">Cancel</button></div>' +
-                        '</div>' + previewColHtml() + '</div></div>';
+                        '</div>' + previewColHtml().replace('<p class="f2s-preview-label">Live preview</p>',
+                                '<p class="f2s-preview-label">Live preview</p><div id="f2s-fr-prevsel" style="margin-bottom:8px;' + (Number(r.admin.enabled) ? '' : 'display:none') + '">' +
+                                segHtml('fr-prev', [{ v: 'customer', l: 'Customer' }, { v: 'admin', l: 'Admin alert' }], 'customer') + '</div>') + '</div></div>';
+        }
+
+        /* Same rule as the server (Fast2SMS_Phone::normalize): 10-digit Indian mobile, common prefixes allowed. */
+        function frIndianMobile(raw) {
+                var d = String(raw || '').replace(/\D/g, '');
+                if (d.length === 14 && d.indexOf('0091') === 0) { d = d.substring(4); }
+                else if (d.length === 13 && d.indexOf('910') === 0) { d = d.substring(3); }
+                if (d.length === 12 && d.indexOf('91') === 0) { d = d.substring(2); }
+                else if (d.length === 11 && d.charAt(0) === '0') { d = d.substring(1); }
+                return /^[6-9]\d{9}$/.test(d);
         }
 
@@ -1466 +1508 @@
                         id: '', enabled: 1, source: '', form: '*', form_title: '', phone_field: '', channel: 'whatsapp', verified_only: 0,
                         sms: { type: 'sms_quick', sender_id: '', message_id: '', var_map: '', preview: '' },
-                        whatsapp: { type: 'whatsapp', message_id: '', phone_number_id: '', name: '', var_map: '', button_var_count: 0, media_url: '', document_filename: '', preview: '', header: '', button_text: '', display_name: '' }
+                        whatsapp: { type: 'whatsapp', message_id: '', phone_number_id: '', name: '', var_map: '', button_var_count: 0, media_url: '', document_filename: '', preview: '', header: '', button_text: '', display_name: '' },
+                        admin: { enabled: 0, channel: 'whatsapp', to: 'settings', numbers: [],
+                                sms: { type: 'sms_quick', sender_id: '', message_id: '', var_map: '', preview: '' },
+                                whatsapp: { type: 'whatsapp', message_id: '', phone_number_id: '', name: '', var_map: '', button_var_count: 0, media_url: '', document_filename: '', preview: '', header: '', button_text: '', display_name: '' } }
                 };
+        }
+
+        /* Editor state for a saved template (no Fast2SMS round-trip needed for the preview). */
+        function frTplState(kind, cfg) {
+                if (!cfg || !cfg.message_id) { return null; }
+                var total = cfg.var_map ? cfg.var_map.split('|').length : 0;
+                if (kind === 'sms') {
+                        return { sender_id: cfg.sender_id, message_id: cfg.message_id, preview: cfg.preview, var_count: total };
+                }
+                return {
+                        message_id: cfg.message_id, phone_number_id: cfg.phone_number_id, name: cfg.name, preview: cfg.preview, header: cfg.header,
+                        button_text: cfg.button_text, display_name: cfg.display_name, button_var_count: cfg.button_var_count,
+                        var_count: total - (Number(cfg.button_var_count) || 0)
+                };
+        }
+
+        function frSmsCfg(t, map) {
+                return t ? { type: 'sms_quick', sender_id: t.sender_id, message_id: t.message_id, var_map: map, preview: t.preview || '' } : frBlank().sms;
+        }
+        function frWaCfg(t, map, media, doc) {
+                return t ? {
+                        type: 'whatsapp', message_id: t.message_id, phone_number_id: t.phone_number_id, name: t.name || '',
+                        var_map: map, button_var_count: Number(t.button_var_count) || 0, media_url: media || '', document_filename: doc || '',
+                        preview: t.preview || '', header: t.header || '', button_text: t.button_text || '', display_name: t.display_name || ''
+                } : frBlank().whatsapp;
         }
 
@@ -1488 +1558 @@
         function frOpenEditor(p, index) {
                 var editing = index >= 0 ? JSON.parse(JSON.stringify(FAST2SMS.formReplies[index])) : frBlank();
+                if (!editing.admin) { editing.admin = frBlank().admin; } // saved before admin alerts existed.
+                var numState = { list: (editing.admin.numbers || []).filter(function (n) { return n && n.id; }) };
+                numState.keep = numState.list.map(function (n) { return n.id; });
                 var box = $('#f2s-fr-editor', p);
                 box.innerHTML = frEditorHtml(editing);
@@ -1496 +1569 @@
 
                 var st = {
-                        smsTpl: editing.sms.message_id ? {
-                                sender_id: editing.sms.sender_id, message_id: editing.sms.message_id, preview: editing.sms.preview,
-                                var_count: editing.sms.var_map ? editing.sms.var_map.split('|').length : 0
-                        } : null,
-                        waTpl: editing.whatsapp.message_id ? {
-                                message_id: editing.whatsapp.message_id, phone_number_id: editing.whatsapp.phone_number_id, name: editing.whatsapp.name,
-                                preview: editing.whatsapp.preview, header: editing.whatsapp.header, button_text: editing.whatsapp.button_text,
-                                display_name: editing.whatsapp.display_name, button_var_count: editing.whatsapp.button_var_count,
-                                var_count: (editing.whatsapp.var_map ? editing.whatsapp.var_map.split('|').length : 0) - (Number(editing.whatsapp.button_var_count) || 0)
-                        } : null
+                        smsTpl: frTplState('sms', editing.sms),
+                        waTpl: frTplState('whatsapp', editing.whatsapp),
+                        aSmsTpl: frTplState('sms', editing.admin.sms),
+                        aWaTpl: frTplState('whatsapp', editing.admin.whatsapp)
                 };
 
@@ -1528 +1595 @@
                 }
 
+                function renderAdminMaps(waMap, smsMap) {
+                        var opts = frVarOptions(fields());
+                        $('#f2s-fr-aw-map', box).innerHTML = st.aWaTpl
+                                ? varMapRows(Math.max(0, Number(st.aWaTpl.var_count) || 0), opts, waMap, 'fraw', Number(st.aWaTpl.button_var_count) || 0) : '';
+                        $('#f2s-fr-as-map', box).innerHTML = st.aSmsTpl ? varMapRows(Number(st.aSmsTpl.var_count) || 0, opts, smsMap, 'fras') : '';
+                }
+
                 function renderMaps(waMap, smsMap) {
                         var opts = frVarOptions(fields());
@@ -1546 +1620 @@
                 function preview() {
                         var ch = segVal(box, 'fr-channel') || 'whatsapp';
+                        var adminOn = $('#f2s-fr-admin-on', box).checked;
+                        var ach = segVal(box, 'fr-admin-channel') || 'whatsapp';
+                        $('#f2s-fr-cust-tpl', box).style.display = ch === 'none' ? 'none' : '';
                         $('#f2s-fr-wa', box).style.display = ch === 'sms' ? 'none' : '';
                         $('#f2s-fr-sms', box).style.display = ch === 'whatsapp' ? 'none' : '';
+                        $('#f2s-fr-admin', box).style.display = adminOn ? '' : 'none';
+                        $('#f2s-fr-aw', box).style.display = ach === 'sms' ? 'none' : '';
+                        $('#f2s-fr-as', box).style.display = ach === 'whatsapp' ? 'none' : '';
+                        $('#f2s-fr-prevsel', box).style.display = adminOn ? '' : 'none';
+                        var custom = segVal(box, 'fr-admin-to') === 'custom';
+                        $('#f2s-fr-admin-nums', box).style.display = custom ? '' : 'none';
+                        $('#f2s-fr-admin-settings-hint', box).style.display = custom ? 'none' : '';
+                        var showAdmin = adminOn && (segVal(box, 'fr-prev') === 'admin' || ch === 'none');
+                        var sTpl = showAdmin ? st.aSmsTpl : st.smsTpl;
+                        var wTpl = showAdmin ? st.aWaTpl : st.waTpl;
                         paintPreview($('.f2s-split', box), {
-                                channel: ch,
+                                channel: showAdmin ? ach : (ch === 'none' ? 'whatsapp' : ch),
                                 route: 'quick',
-                                smsSender: st.smsTpl ? st.smsTpl.sender_id : '',
-                                smsPreview: st.smsTpl ? st.smsTpl.preview : '',
-                                smsTokens: labelTokens(varTokens(box, 'frsms')),
+                                smsSender: sTpl ? sTpl.sender_id : '',
+                                smsPreview: sTpl ? sTpl.preview : '',
+                                smsTokens: labelTokens(varTokens(box, showAdmin ? 'fras' : 'frsms')),
                                 manualText: '',
-                                waPreview: st.waTpl ? st.waTpl.preview : '',
-                                waHeader: st.waTpl ? (st.waTpl.header || '') : '',
-                                waName: st.waTpl ? (st.waTpl.display_name || '') : '',
-                                waBtnText: st.waTpl ? (st.waTpl.button_text || '') : '',
-                                waTokens: labelTokens(varTokens(box, 'frwa'))
+                                waPreview: wTpl ? wTpl.preview : '',
+                                waHeader: wTpl ? (wTpl.header || '') : '',
+                                waName: wTpl ? (wTpl.display_name || '') : '',
+                                waBtnText: wTpl ? (wTpl.button_text || '') : '',
+                                waTokens: labelTokens(varTokens(box, showAdmin ? 'fraw' : 'frwa'))
                         });
                 }
 
                 renderPhone(editing.phone_field);
+                function renderChips() {
+                        $('#f2s-fr-num-chips', box).innerHTML = numState.list.filter(function (n) { return numState.keep.indexOf(n.id) !== -1; }).map(function (n) {
+                                return '<span class="f2s-chip">' + esc(n.mask) + '<button type="button" data-id="' + esc(n.id) + '" title="Remove">✕</button></span>';
+                        }).join('');
+                }
+                $('#f2s-fr-num-chips', box).addEventListener('click', function (e) {
+                        var b = e.target.closest('button');
+                        if (!b) { return; }
+                        var id = b.dataset.id;
+                        numState.keep = numState.keep.filter(function (x) { return x !== id; });
+                        renderChips();
+                });
+                renderChips();
+
                 renderMaps(editing.whatsapp.var_map, editing.sms.var_map);
+                renderAdminMaps(editing.admin.whatsapp.var_map, editing.admin.sms.var_map);
                 if (st.waTpl && st.waTpl.header) { applyWaHeader($('#f2s-fr-wa', box), st.waTpl); }
                 preview();
@@ -1570 +1672 @@
                 formSel.addEventListener('change', function () {
                         var waMap = collectVarMap(box, 'frwa'), smsMap = collectVarMap(box, 'frsms');
+                        var aWaMap = collectVarMap(box, 'fraw'), aSmsMap = collectVarMap(box, 'fras');
                         renderPhone('');
                         renderMaps(waMap, smsMap);
+                        renderAdminMaps(aWaMap, aSmsMap);
                         preview();
                 });
@@ -1600 +1704 @@
                 });
                 if (st.waTpl) { $('#f2s-fr-wa .f2s-combo-btn', box).textContent = (st.waTpl.name || '#' + st.waTpl.message_id) + ' · saved template'; }
+
+                // Admin alert templates.
+                initCombo($('#f2s-fr-aw .f2s-combo', box), {
+                        kind: 'whatsapp',
+                        selectedId: function () { return st.aWaTpl ? st.aWaTpl.message_id : ''; },
+                        onPick: function (t) {
+                                st.aWaTpl = t;
+                                renderAdminMaps('', collectVarMap(box, 'fras'));
+                                applyWaHeader($('#f2s-fr-aw', box), t);
+                                preview();
+                        }
+                });
+                initCombo($('#f2s-fr-as .f2s-combo', box), {
+                        kind: 'sms',
+                        selectedId: function () { return st.aSmsTpl ? st.aSmsTpl.message_id : ''; },
+                        onPick: function (t) {
+                                st.aSmsTpl = t;
+                                renderAdminMaps(collectVarMap(box, 'fraw'), '');
+                                preview();
+                        }
+                });
+                if (st.aWaTpl) { $('#f2s-fr-aw .f2s-combo-btn', box).textContent = (st.aWaTpl.name || '#' + st.aWaTpl.message_id) + ' · saved template'; }
+                if (st.aWaTpl && st.aWaTpl.header) { applyWaHeader($('#f2s-fr-aw', box), st.aWaTpl); }
+                $('#f2s-fr-admin-on', box).addEventListener('change', function () {
+                        if (this.checked && $('#f2s-fr-prevsel', box)) { /* show the admin preview right away */
+                                var btn = $('#f2s-fr-prevsel [data-val="admin"]', box);
+                                if (btn) { btn.click(); }
+                        }
+                        preview();
+                });
 
                 function build() {
@@ -1616 +1750 @@
                                 channel: ch,
                                 verified_only: $('#f2s-fr-verified', box).checked ? 1 : 0,
-                                sms: st.smsTpl ? {
-                                        type: 'sms_quick', sender_id: st.smsTpl.sender_id, message_id: st.smsTpl.message_id,
-                                        var_map: collectVarMap(box, 'frsms'), preview: st.smsTpl.preview || ''
-                                } : frBlank().sms,
-                                whatsapp: st.waTpl ? {
-                                        type: 'whatsapp', message_id: st.waTpl.message_id, phone_number_id: st.waTpl.phone_number_id, name: st.waTpl.name || '',
-                                        var_map: collectVarMap(box, 'frwa'), button_var_count: Number(st.waTpl.button_var_count) || 0,
-                                        media_url: $('.f2s-wa-media-url', waBox).value, document_filename: $('.f2s-wa-doc-name', waBox).value,
-                                        preview: st.waTpl.preview || '', header: st.waTpl.header || '', button_text: st.waTpl.button_text || '', display_name: st.waTpl.display_name || ''
-                                } : frBlank().whatsapp
+                                sms: frSmsCfg(st.smsTpl, collectVarMap(box, 'frsms')),
+                                whatsapp: frWaCfg(st.waTpl, collectVarMap(box, 'frwa'), $('.f2s-wa-media-url', waBox).value, $('.f2s-wa-doc-name', waBox).value),
+                                admin: {
+                                        enabled: $('#f2s-fr-admin-on', box).checked ? 1 : 0,
+                                        channel: segVal(box, 'fr-admin-channel') || 'whatsapp',
+                                        to: segVal(box, 'fr-admin-to') === 'custom' ? 'custom' : 'settings',
+                                        keep: numState.keep.slice(),
+                                        add: ($('#f2s-fr-num-add', box).value || '').trim(),
+                                        sms: frSmsCfg(st.aSmsTpl, collectVarMap(box, 'fras')),
+                                        whatsapp: frWaCfg(st.aWaTpl, collectVarMap(box, 'fraw'), $('#f2s-fr-aw .f2s-wa-media-url', box).value, $('#f2s-fr-aw .f2s-wa-doc-name', box).value)
+                                }
                         };
                 }
@@ -1631 +1766 @@
                 function problems(r) {
                         if (!r.source) { return 'Choose a form first.'; }
-                        if (r.channel !== 'sms' && !r.whatsapp.message_id) { return 'Pick a WhatsApp template.'; }
-                        if (r.channel !== 'whatsapp' && !r.sms.message_id) { return 'Pick an SMS template.'; }
+                        if (r.channel === 'none' && !Number(r.admin.enabled)) { return 'Turn on the customer message or the admin alert.'; }
+                        if (r.channel !== 'none') {
+                                if (r.channel !== 'sms' && !r.whatsapp.message_id) { return 'Pick a WhatsApp template for the customer.'; }
+                                if (r.channel !== 'whatsapp' && !r.sms.message_id) { return 'Pick an SMS template for the customer.'; }
+                        }
+                        if (Number(r.admin.enabled)) {
+                                if (r.admin.to === 'custom') {
+                                        var typed = (r.admin.add || '').split(/[\s,;]+/).filter(function (x) { return x; });
+                                        var bad = typed.filter(function (x) { return !frIndianMobile(x); });
+                                        if (bad.length) { return 'Not a valid 10-digit Indian mobile number: ' + bad[0]; }
+                                        if (!r.admin.keep.length && !typed.length) { return 'Add at least one admin number for this alert.'; }
+                                        if (r.admin.keep.length + typed.length > 10) { return 'Up to 10 admin numbers per alert.'; }
+                                } else if (!(FAST2SMS.adminPhones || []).length) {
+                                        return 'Add an admin number in Settings first, or choose “These numbers”.';
+                                }
+                                if (r.admin.channel !== 'sms' && !r.admin.whatsapp.message_id) { return 'Pick a WhatsApp template for the admin alert.'; }
+                                if (r.admin.channel !== 'sms' && r.admin.whatsapp.header && !r.admin.whatsapp.media_url) { return 'The admin WhatsApp template has a ' + r.admin.whatsapp.header.toLowerCase() + ' header — add its media URL.'; }
+                                if (r.admin.channel !== 'whatsapp' && !r.admin.sms.message_id) { return 'Pick an SMS template for the admin alert.'; }
+                        }
                         return '';
                 }
@@ -1675 +1827 @@
                                 sample['f:' + fd.key] = /mail/i.test(hay) ? 'asha@example.com' : (/phone|mobile|whatsapp|tel/i.test(hay) ? '9876543210' : (/name/i.test(hay) ? 'Asha' : fd.label));
                         });
-                        runTest(box, this, r.channel, r.channel !== 'whatsapp' ? r.sms : {}, r.channel !== 'sms' ? r.whatsapp : {}, sample);
+                        var adminView = Number(r.admin.enabled) && (segVal(box, 'fr-prev') === 'admin' || r.channel === 'none');
+                        var ch = adminView ? r.admin.channel : r.channel;
+                        var smsCfg = adminView ? r.admin.sms : r.sms, waCfg = adminView ? r.admin.whatsapp : r.whatsapp;
+                        runTest(box, this, ch, ch !== 'whatsapp' ? smsCfg : {}, ch !== 'sms' ? waCfg : {}, sample);
                 });
         }
@@ -1765 +1920 @@
                                 '<p class="f2s-sub">Stop fake submissions — visitors must verify their mobile number with OTP before the form goes through.</p>' +
                                 '<div class="f2s-field"><label>Contact Form 7 ' + pill(FAST2SMS.forms.cf7) + '</label>' +
-                                        '<p class="hint">Add the <code>[fast2sms_otp]</code> tag inside your form — enforcement is automatic. Optionally also list form IDs here to enforce server-side: </p>' +
+                                        '<p class="hint">Add the <code>[fast2sms_otp]</code> tag inside your form — enforcement is automatic. Optionally also list form IDs here to enforce server-side (the number, or the short ID from the shortcode, e.g. <code>743d511</code>):</p>' +
                                         '<input class="f2s-input" id="f2s-forms-cf7" value="' + esc(s.otp_forms_cf7) + '" placeholder="e.g. 123, 456" /></div>' +
                                 '<div class="f2s-field"><label>WPForms ' + pill(FAST2SMS.forms.wpforms) + '</label>' +

fast2sms/trunk/fast2sms.php

@@ -4 +4 @@
  * Plugin URI:        https://www.fast2sms.com/help/fast2sms-wordpress-plugin-setup-guide/
  * Description:       Official Fast2SMS plugin. SMS & WhatsApp order notifications, OTP login/signup, COD order verification, abandoned cart recovery, bulk campaigns and form OTP for WordPress & WooCommerce.
- * Version:           1.16.0
+ * Version:           1.17.0
  * Requires at least: 5.8
  * Requires PHP:      7.4
@@ -21 +21 @@
 }
 
-define( 'FAST2SMS_VERSION', '1.16.0' );
+define( 'FAST2SMS_VERSION', '1.17.0' );
 define( 'FAST2SMS_PLUGIN_FILE', __FILE__ );
 define( 'FAST2SMS_PLUGIN_DIR', plugin_dir_path( __FILE__ ) );

fast2sms/trunk/includes/class-f2s-admin.php

@@ -228 +228 @@
                         wp_send_json_error( array( 'message' => __( 'Bad request.', 'fast2sms' ) ) );
                 }
-                wp_send_json_success( array( 'replies' => Fast2SMS_Form_Replies::save_all( $raw ) ) );
+                wp_send_json_success( array( 'replies' => Fast2SMS_Form_Replies::for_admin_ui( Fast2SMS_Form_Replies::save_all( $raw ) ) ) );
         }
 
@@ -276 +276 @@
                         'hasKey'       => Fast2SMS_Settings::has_key(),
                         'isAdmin'      => current_user_can( 'manage_options' ),
-                        'formReplies'  => Fast2SMS_Form_Replies::all(),
+                        'formReplies'  => Fast2SMS_Form_Replies::for_admin_ui(),
                         'keyLast4'     => (string) Fast2SMS_Settings::get( 'key_last4' ),
                         'wcActive'     => fast2sms_wc_active(),
@@ -737 +737 @@
                 $labels['campaign']   = __( 'Campaign', 'fast2sms' );
                 $labels['form_reply'] = __( 'Form auto-reply', 'fast2sms' );
+                $labels['form_admin'] = __( 'Form alert (admin)', 'fast2sms' );
 
                 $out = array();

fast2sms/trunk/includes/class-f2s-form-replies.php

@@ -25 +25 @@
         const SEEN_OPTION = 'fast2sms_form_fields_seen';
         const MAX_REPLIES = 50;
+
+        /** Admin alerts one form may send per hour (submissions, each to every admin number). */
+        const ADMIN_ALERTS_PER_HOUR = 30;
 
         /** Submissions already handled in this request (some plugins fire twice). */
@@ -100 +103 @@
          * @return array|null Clean reply, or null when unusable.
          */
-        public static function sanitize( $raw ) {
+        public static function sanitize( $raw, $prev = null ) {
                 if ( ! is_array( $raw ) ) {
                         return null;
@@ -109 +112 @@
                         return null;
                 }
-                $channel = in_array( $raw['channel'] ?? '', array( 'sms', 'whatsapp', 'both' ), true ) ? $raw['channel'] : 'whatsapp';
-                $sms     = is_array( $raw['sms'] ?? null ) ? $raw['sms'] : array();
-                $wa      = is_array( $raw['whatsapp'] ?? null ) ? $raw['whatsapp'] : array();
+                $channel = in_array( $raw['channel'] ?? '', array( 'sms', 'whatsapp', 'both', 'none' ), true ) ? $raw['channel'] : 'whatsapp';
+                $admin   = is_array( $raw['admin'] ?? null ) ? $raw['admin'] : array();
                 $id      = preg_replace( '/[^a-z0-9]/', '', strtolower( (string) ( $raw['id'] ?? '' ) ) );
 
@@ -121 +123 @@
                         'form_title'    => substr( sanitize_text_field( (string) ( $raw['form_title'] ?? '' ) ), 0, 150 ),
                         'phone_field'   => self::key( sanitize_text_field( (string) ( $raw['phone_field'] ?? '' ) ) ), // '' = detect automatically.
-                        'channel'       => $channel,
+                        'channel'       => $channel, // customer message: whatsapp | sms | both | none.
                         'verified_only' => empty( $raw['verified_only'] ) ? 0 : 1,
-                        'sms'           => array(
-                                'type'       => 'sms_quick',
-                                'sender_id'  => substr( sanitize_text_field( (string) ( $sms['sender_id'] ?? '' ) ), 0, 20 ),
-                                'message_id' => substr( preg_replace( '/[^0-9]/', '', (string) ( $sms['message_id'] ?? '' ) ), 0, 20 ),
-                                'var_map'    => self::clean_map( $sms['var_map'] ?? '' ),
-                                'preview'    => substr( sanitize_textarea_field( (string) ( $sms['preview'] ?? '' ) ), 0, 1000 ),
-                        ),
-                        'whatsapp'      => array(
-                                'type'              => 'whatsapp',
-                                'message_id'        => substr( preg_replace( '/[^0-9]/', '', (string) ( $wa['message_id'] ?? '' ) ), 0, 20 ),
-                                'phone_number_id'   => substr( preg_replace( '/[^0-9]/', '', (string) ( $wa['phone_number_id'] ?? '' ) ), 0, 30 ),
-                                'name'              => substr( sanitize_text_field( (string) ( $wa['name'] ?? '' ) ), 0, 120 ),
-                                'var_map'           => self::clean_map( $wa['var_map'] ?? '' ),
-                                'button_var_count'  => min( 2, max( 0, (int) ( $wa['button_var_count'] ?? 0 ) ) ),
-                                'media_url'         => esc_url_raw( (string) ( $wa['media_url'] ?? '' ) ),
-                                'document_filename' => substr( sanitize_file_name( (string) ( $wa['document_filename'] ?? '' ) ), 0, 100 ),
-                                'preview'           => substr( sanitize_textarea_field( (string) ( $wa['preview'] ?? '' ) ), 0, 2000 ),
-                                'header'            => in_array( $wa['header'] ?? '', array( 'IMAGE', 'DOCUMENT', 'VIDEO' ), true ) ? $wa['header'] : '',
-                                'button_text'       => substr( sanitize_text_field( (string) ( $wa['button_text'] ?? '' ) ), 0, 60 ),
-                                'display_name'      => substr( sanitize_text_field( (string) ( $wa['display_name'] ?? '' ) ), 0, 120 ),
+                        'sms'           => self::clean_sms( $raw['sms'] ?? array() ),
+                        'whatsapp'      => self::clean_wa( $raw['whatsapp'] ?? array() ),
+                        'admin'         => array( // alert to the store's admin numbers.
+                                'enabled'     => empty( $admin['enabled'] ) ? 0 : 1,
+                                'channel'     => in_array( $admin['channel'] ?? '', array( 'sms', 'whatsapp', 'both' ), true ) ? $admin['channel'] : 'whatsapp',
+                                'to'          => 'custom' === ( $admin['to'] ?? '' ) ? 'custom' : 'settings', // Settings numbers, or this form's own list.
+                                'numbers_enc' => self::clean_numbers( $admin, is_array( $prev ) ? ( $prev['admin']['numbers_enc'] ?? '' ) : '' ),
+                                'sms'         => self::clean_sms( $admin['sms'] ?? array() ),
+                                'whatsapp'    => self::clean_wa( $admin['whatsapp'] ?? array() ),
                         ),
                 );
+        }
+
+        /**
+         * This form's own admin numbers (encrypted, max 10). The browser never
+         * gets them back in full: it sends which saved ones to keep ("keep" =
+         * their positions) and any new ones ("add" = free text).
+         */
+        private static function clean_numbers( array $admin, $prev_enc ) {
+                $saved = self::decrypt_numbers( $prev_enc );
+                $list  = array();
+                if ( array_key_exists( 'keep', $admin ) ) {
+                        $keep = array_map( 'strval', (array) $admin['keep'] );
+                        foreach ( $saved as $phone ) {
+                                if ( in_array( self::number_id( $phone ), $keep, true ) ) {
+                                        $list[] = $phone;
+                                }
+                        }
+                } else {
+                        $list = $saved; // list unchanged (e.g. only switched on/off).
+                }
+                foreach ( preg_split( '/[\s,;]+/', (string) ( $admin['add'] ?? '' ) ) as $candidate ) {
+                        $phone = Fast2SMS_Phone::normalize( $candidate );
+                        if ( '' !== $phone ) {
+                                $list[] = $phone;
+                        }
+                }
+                $list = array_slice( array_values( array_unique( $list ) ), 0, 10 );
+                return $list ? Fast2SMS_Crypto::encrypt( implode( ',', $list ) ) : '';
+        }
+
+        /** Stable, non-reversible handle for a saved number (the screen never sees the number). */
+        private static function number_id( $phone ) {
+                return substr( Fast2SMS_Crypto::hash( 'admin-number:' . $phone ), 0, 12 );
+        }
+
+        private static function decrypt_numbers( $enc ) {
+                $plain = '' !== (string) $enc ? Fast2SMS_Crypto::decrypt( (string) $enc ) : '';
+                return array_values( array_filter( array_map( array( 'Fast2SMS_Phone', 'normalize' ), explode( ',', (string) $plain ) ) ) );
+        }
+
+        /** Numbers an admin alert goes to. */
+        public static function admin_numbers( array $reply ) {
+                if ( 'custom' === ( $reply['admin']['to'] ?? '' ) ) {
+                        return self::decrypt_numbers( $reply['admin']['numbers_enc'] ?? '' );
+                }
+                return Fast2SMS_Settings::admin_phones();
+        }
+
+        /** Replies as the admin screen sees them: numbers masked, never the encrypted blob. */
+        public static function for_admin_ui( ?array $list = null ) {
+                $out = array();
+                foreach ( null === $list ? self::all() : $list as $reply ) {
+                        if ( isset( $reply['admin'] ) ) {
+                                $reply['admin']['numbers'] = array_map( function ( $phone ) {
+                                        return array( 'id' => self::number_id( $phone ), 'mask' => Fast2SMS_Phone::mask( $phone ) );
+                                }, self::decrypt_numbers( $reply['admin']['numbers_enc'] ?? '' ) );
+                                unset( $reply['admin']['numbers_enc'] );
+                        }
+                        $out[] = $reply;
+                }
+                return $out;
+        }
+
+        private static function clean_sms( $sms ) {
+                $sms = is_array( $sms ) ? $sms : array();
+                return array(
+                        'type'       => 'sms_quick',
+                        'sender_id'  => substr( sanitize_text_field( (string) ( $sms['sender_id'] ?? '' ) ), 0, 20 ),
+                        'message_id' => substr( preg_replace( '/[^0-9]/', '', (string) ( $sms['message_id'] ?? '' ) ), 0, 20 ),
+                        'var_map'    => self::clean_map( $sms['var_map'] ?? '' ),
+                        'preview'    => substr( sanitize_textarea_field( (string) ( $sms['preview'] ?? '' ) ), 0, 1000 ),
+                );
+        }
+
+        private static function clean_wa( $wa ) {
+                $wa = is_array( $wa ) ? $wa : array();
+                return array(
+                        'type'              => 'whatsapp',
+                        'message_id'        => substr( preg_replace( '/[^0-9]/', '', (string) ( $wa['message_id'] ?? '' ) ), 0, 20 ),
+                        'phone_number_id'   => substr( preg_replace( '/[^0-9]/', '', (string) ( $wa['phone_number_id'] ?? '' ) ), 0, 30 ),
+                        'name'              => substr( sanitize_text_field( (string) ( $wa['name'] ?? '' ) ), 0, 120 ),
+                        'var_map'           => self::clean_map( $wa['var_map'] ?? '' ),
+                        'button_var_count'  => min( 2, max( 0, (int) ( $wa['button_var_count'] ?? 0 ) ) ),
+                        'media_url'         => esc_url_raw( (string) ( $wa['media_url'] ?? '' ) ),
+                        'document_filename' => substr( sanitize_file_name( (string) ( $wa['document_filename'] ?? '' ) ), 0, 100 ),
+                        'preview'           => substr( sanitize_textarea_field( (string) ( $wa['preview'] ?? '' ) ), 0, 2000 ),
+                        'header'            => in_array( $wa['header'] ?? '', array( 'IMAGE', 'DOCUMENT', 'VIDEO' ), true ) ? $wa['header'] : '',
+                        'button_text'       => substr( sanitize_text_field( (string) ( $wa['button_text'] ?? '' ) ), 0, 60 ),
+                        'display_name'      => substr( sanitize_text_field( (string) ( $wa['display_name'] ?? '' ) ), 0, 120 ),
+                );
+        }
+
+        /**
+         * Does a per-form admin alert cover this form? Then the older global
+         * "Form submitted (notify admin)" automation stays quiet for it.
+         */
+        public static function admin_alert_covers( $source, $form_id, array $aliases = array() ) {
+                $ids = array_filter( array_merge( array( (string) $form_id ), array_map( 'strval', $aliases ) ), 'strlen' );
+                foreach ( self::all() as $reply ) {
+                        if ( empty( $reply['enabled'] ) || empty( $reply['admin']['enabled'] ) || $reply['source'] !== $source
+                                || ! ( '*' === $reply['form'] || in_array( (string) $reply['form'], $ids, true ) ) ) {
+                                continue;
+                        }
+                        // Only when it can really send: a template picked and at least one number.
+                        if ( self::channels_for( $reply['admin']['channel'], $reply['admin']['sms'], $reply['admin']['whatsapp'] ) && self::admin_numbers( $reply ) ) {
+                                return true;
+                        }
+                }
+                return false;
         }
 
@@ -165 +265 @@
 
         public static function save_all( array $list ) {
+                $prev = array();
+                foreach ( self::all() as $old ) {
+                        $prev[ $old['id'] ] = $old;
+                }
                 $clean = array();
                 foreach ( $list as $raw ) {
-                        $reply = self::sanitize( $raw );
+                        $rid   = is_array( $raw ) ? preg_replace( '/[^a-z0-9]/', '', strtolower( (string) ( $raw['id'] ?? '' ) ) ) : '';
+                        $reply = self::sanitize( $raw, $prev[ $rid ] ?? null );
                         if ( $reply ) {
                                 $clean[] = $reply;
@@ -851 +956 @@
         }
 
+        /** Channels of a message config that actually have a template picked. */
+        private static function channels_for( $channel, array $sms, array $wa ) {
+                $out = array();
+                if ( 'none' === $channel ) {
+                        return $out;
+                }
+                foreach ( 'both' === $channel ? array( 'whatsapp', 'sms' ) : array( $channel ) as $ch ) {
+                        $cfg = 'whatsapp' === $ch ? $wa : $sms;
+                        if ( ! empty( $cfg['message_id'] ) ) {
+                                unset( $cfg['preview'], $cfg['name'], $cfg['header'], $cfg['button_text'], $cfg['display_name'] );
+                                $out[ $ch ] = $cfg;
+                        }
+                }
+                return $out;
+        }
+
+        /**
+         * Queue the customer auto-reply and/or the admin alert for one submission.
+         *
+         * @return int Messages queued.
+         */
         private static function send_reply( array $reply, $title, array $fields ) {
                 global $wpdb;
-                $phone = self::find_phone( $fields, self::key( $reply['phone_field'] ) );
-                if ( '' === $phone ) {
-                        return 0; // No usable Indian mobile number in the form.
+                $phone    = self::find_phone( $fields, self::key( $reply['phone_field'] ) );
+                $customer = '' !== $phone ? self::channels_for( $reply['channel'], $reply['sms'], $reply['whatsapp'] ) : array();
+                $admin    = isset( $reply['admin'] ) && ! empty( $reply['admin']['enabled'] ) ? self::channels_for( $reply['admin']['channel'], $reply['admin']['sms'], $reply['admin']['whatsapp'] ) : array();
+                $admins   = $admin ? self::admin_numbers( $reply ) : array();
+                if ( ! $admins ) {
+                        $admin = array();
+                }
+                if ( ! $customer && ! $admin ) {
+                        return 0; // nothing to send (no customer number, no admin alert).
                 }
                 $log_channel = 'whatsapp' === $reply['channel'] ? 'whatsapp' : 'sms';
@@ -861 +993 @@
                 $prefix      = 'form_' . $reply['id'] . '_' . $content . '_';
                 // Every submission is its own reply (counted against the limits);
-                // the SMS + WhatsApp rows of one reply share the key.
+                // the SMS + WhatsApp rows of one customer reply share the key.
                 $dedupe = $prefix . strtolower( wp_generate_password( 6, false, false ) );
 
-                if ( ! empty( $reply['verified_only'] ) && ! Fast2SMS_Forms::phone_verified( $phone ) ) {
-                        Fast2SMS_Queue::log_skip( 'form_reply', $log_channel, $phone, __( 'Not sent: the number was not verified with OTP on this form.', 'fast2sms' ), $dedupe );
+                // "Only OTP-verified numbers" covers the whole submission (customer + admin):
+                // unverified submissions are what bots send.
+                if ( ! empty( $reply['verified_only'] ) && ( '' === $phone || ! Fast2SMS_Forms::phone_verified( $phone ) ) ) {
+                        if ( '' !== $phone ) {
+                                Fast2SMS_Queue::log_skip( 'form_reply', $log_channel, $phone, __( 'Not sent: the number was not verified with OTP on this form.', 'fast2sms' ), $dedupe );
+                        }
                         return 0;
                 }
@@ -876 +1012 @@
                 $wpdb->suppress_errors( $suppressed );
                 if ( null !== $lock && '1' !== (string) $lock ) {
-                        Fast2SMS_Queue::log_skip( 'form_reply', $log_channel, $phone, __( 'Not sent: too many form submissions at the same moment — please check for a bot attack.', 'fast2sms' ), $dedupe );
+                        self::log_blocked( $customer, $admin, $admins, $phone, $log_channel, __( 'Not sent: too many form submissions at the same moment — please check for a bot attack.', 'fast2sms' ), $dedupe );
                         return 0;
                 }
                 try {
                         // The same submission sent again within 10 minutes (double click,
-                        // replayed request) gets no second message.
+                        // replayed request) gets no second message — customer or admin.
                         $recent = (int) $wpdb->get_var( $wpdb->prepare(
-                                "SELECT COUNT(*) FROM {$wpdb->prefix}f2s_queue WHERE event = 'form_reply' AND phone_hash = %s AND dedupe_key LIKE %s AND status <> 'skipped' AND created_at > %s",
-                                Fast2SMS_Crypto::hash( $phone ),
+                                "SELECT COUNT(*) FROM {$wpdb->prefix}f2s_queue WHERE dedupe_key LIKE %s AND event IN ('form_reply','form_admin') AND status <> 'skipped' AND created_at > %s",
                                 $wpdb->esc_like( $prefix ) . '%',
                                 gmdate( 'Y-m-d H:i:s', time() - 10 * MINUTE_IN_SECONDS )
@@ -891 +1026 @@
                                 return 0;
                         }
-                        $channels = array();
-                        foreach ( 'both' === $reply['channel'] ? array( 'whatsapp', 'sms' ) : array( $reply['channel'] ) as $channel ) {
-                                $cfg = 'whatsapp' === $channel ? $reply['whatsapp'] : $reply['sms'];
-                                if ( ! empty( $cfg['message_id'] ) ) {
-                                        $channels[ $channel ] = $cfg; // a channel with no template picked is skipped.
-                                }
-                        }
-                        if ( ! $channels ) {
+
+                        if ( $customer ) {
+                                $limit = self::phone_limit_error( $phone );
+                                if ( '' !== $limit ) {
+                                        Fast2SMS_Queue::log_skip( 'form_reply', $log_channel, $phone, $limit, $dedupe );
+                                        $customer = array(); // the admin is still told about the submission.
+                                }
+                        }
+                        // One form can't flood the admins: at most N alerts per form per hour.
+                        if ( $admin ) {
+                                $alerts = (int) $wpdb->get_var( $wpdb->prepare(
+                                        "SELECT COUNT(DISTINCT LEFT(dedupe_key, %d)) FROM {$wpdb->prefix}f2s_queue WHERE dedupe_key LIKE %s AND event = 'form_admin' AND status <> 'skipped' AND created_at > %s",
+                                        strlen( $dedupe ),
+                                        $wpdb->esc_like( 'form_' . $reply['id'] . '_' ) . '%',
+                                        gmdate( 'Y-m-d H:i:s', time() - HOUR_IN_SECONDS )
+                                ) );
+                                if ( $alerts >= self::ADMIN_ALERTS_PER_HOUR ) {
+                                        self::log_blocked( array(), $admin, $admins, '', $log_channel, __( 'Not sent: this form already sent its hourly maximum of admin alerts (possible bot attack).', 'fast2sms' ), $dedupe );
+                                        $admin = array();
+                                }
+                        }
+                        if ( ! $customer && ! $admin ) {
                                 return 0;
                         }
-                        $limit = self::limit_error( $phone, count( $channels ) );
-                        if ( '' !== $limit ) {
-                                Fast2SMS_Queue::log_skip( 'form_reply', $log_channel, $phone, $limit, $dedupe );
+                        // Site-wide hourly cap counts every message (customer + each admin number).
+                        $messages = count( $customer ) + count( $admin ) * count( $admins );
+                        $site     = self::site_limit_error( $messages );
+                        if ( '' !== $site ) {
+                                self::log_blocked( $customer, $admin, $admins, $phone, $log_channel, $site, $dedupe );
                                 return 0;
                         }
@@ -909 +1060 @@
                         $vars = self::vars( $title, $fields, $phone );
                         $sent = 0;
-                        foreach ( $channels as $channel => $cfg ) {
-                                unset( $cfg['preview'], $cfg['name'], $cfg['header'], $cfg['button_text'], $cfg['display_name'] );
+                        foreach ( $customer as $channel => $cfg ) {
                                 // Store only what this template uses (form values are personal data).
                                 $row         = self::used_vars( $vars, $cfg );
@@ -918 +1068 @@
                                 }
                         }
+                        foreach ( array_values( $admins ) as $i => $admin_phone ) {
+                                foreach ( $admin as $channel => $cfg ) {
+                                        $row         = self::used_vars( $vars, $cfg );
+                                        $row['_cfg'] = $cfg;
+                                        // Own key per admin number: queueing one must not replace another.
+                                        if ( Fast2SMS_Queue::enqueue( 'form_admin', $channel, $admin_phone, $row, array( 'dedupe_key' => $dedupe . '_a' . $i ) ) ) {
+                                                $sent++;
+                                        }
+                                }
+                        }
                         return $sent;
                 } finally {
@@ -923 +1083 @@
                                 $wpdb->query( $wpdb->prepare( 'SELECT RELEASE_LOCK(%s)', $lock_name ) );
                         }
+                }
+        }
+
+        /** Note a blocked submission in Logs (customer row and/or first admin number). */
+        private static function log_blocked( array $customer, array $admin, array $admins, $phone, $channel, $reason, $dedupe ) {
+                if ( $customer && '' !== $phone ) {
+                        Fast2SMS_Queue::log_skip( 'form_reply', $channel, $phone, $reason, $dedupe );
+                }
+                if ( $admin && $admins ) {
+                        Fast2SMS_Queue::log_skip( 'form_admin', (string) key( $admin ), reset( $admins ), $reason, $dedupe . '_a0' );
                 }
         }
@@ -984 +1154 @@
                 return $vars + array(
                         'name'      => '' !== $name ? $name : __( 'Customer', 'fast2sms' ),
-                        'phone'     => $phone,
+                        'phone'     => '' !== $phone ? $phone : self::raw_phone( $fields ),
                         'email'     => $email,
                         'form_name' => (string) $title,
@@ -994 +1164 @@
         }
 
-        /** Owner limits: replies per number per day, and per hour for the whole site. */
-        private static function limit_error( $phone, $messages = 1 ) {
+        /** The number as typed (for admin alerts when it isn't an Indian mobile). */
+        private static function raw_phone( array $fields ) {
+                foreach ( $fields as $key => $f ) {
+                        if ( preg_match( '/phone|mobile|whatsapp|tel/i', $key . ' ' . ( $f['label'] ?? '' ) . ' ' . ( $f['type'] ?? '' ) ) && '' !== $f['value'] ) {
+                                return mb_substr( preg_replace( '/[^0-9+ \-]/', '', $f['value'] ), 0, 20 );
+                        }
+                }
+                return '';
+        }
+
+        /** Customer replies to one number in 24 h (owner limit). */
+        private static function phone_limit_error( $phone ) {
                 global $wpdb;
                 $per_phone = min( 50, max( 1, (int) Fast2SMS_Settings::get( 'form_reply_max_phone_day', 3 ) ) );
-                $per_site  = min( 5000, max( 10, (int) Fast2SMS_Settings::get( 'form_reply_max_site_hour', 200 ) ) );
-
                 // One reply = one dedupe key (shared by its SMS and WhatsApp rows).
                 $replies_today = (int) $wpdb->get_var( $wpdb->prepare(
@@ -1006 +1184 @@
                         gmdate( 'Y-m-d H:i:s', time() - DAY_IN_SECONDS )
                 ) );
-                if ( $replies_today >= $per_phone ) {
-                        return __( 'Not sent: daily auto-reply limit reached for this number.', 'fast2sms' );
-                }
+                return $replies_today >= $per_phone ? __( 'Not sent: daily auto-reply limit reached for this number.', 'fast2sms' ) : '';
+        }
+
+        /** Messages (customer replies + admin alerts) per hour for the whole site. */
+        private static function site_limit_error( $messages ) {
+                global $wpdb;
+                $per_site   = min( 5000, max( 10, (int) Fast2SMS_Settings::get( 'form_reply_max_site_hour', 200 ) ) );
                 $site_count = (int) $wpdb->get_var( $wpdb->prepare(
-                        "SELECT COUNT(*) FROM {$wpdb->prefix}f2s_queue WHERE status IN ('pending','processing','sent','failed') AND send_after > %s AND event = 'form_reply'",
+                        "SELECT COUNT(*) FROM {$wpdb->prefix}f2s_queue WHERE status IN ('pending','processing','sent','failed') AND send_after > %s AND event IN ('form_reply','form_admin')",
                         gmdate( 'Y-m-d H:i:s', time() - HOUR_IN_SECONDS )
                 ) );
-                if ( $site_count + $messages > $per_site ) { // counts messages: "both" = 2.
-                        return __( 'Not sent: hourly auto-reply limit for the whole site reached (possible bot attack).', 'fast2sms' );
-                }
-                return '';
+                return $site_count + $messages > $per_site ? __( 'Not sent: hourly form message limit for the whole site reached (possible bot attack).', 'fast2sms' ) : '';
         }
 

fast2sms/trunk/includes/class-f2s-forms.php

@@ -111 +111 @@
 
         /** Queue the 'form_submission' admin notification. */
-        private static function notify_admin( $form_name, array $fields ) {
+        private static function notify_admin( $form_name, array $fields, $source = '', $form_id = '', array $aliases = array() ) {
                 $rule = Fast2SMS_Settings::rule( 'form_submission' );
                 if ( empty( $rule['enabled'] ) || ! Fast2SMS_Settings::has_key() ) {
+                        return;
+                }
+                // This form has its own admin alert (Forms tab) — don't alert twice.
+                if ( '' !== $source && Fast2SMS_Form_Replies::admin_alert_covers( $source, $form_id, $aliases ) ) {
                         return;
                 }
@@ -157 +161 @@
                 // error — enforce here for any form that contains the tag, too.
                 $has_tag = method_exists( $form, 'scan_form_tags' ) && ! empty( $form->scan_form_tags( array( 'type' => 'fast2sms_otp' ) ) );
-                if ( ( ! $has_tag && ! in_array( (string) $form->id(), $enforced, true ) ) || self::posted_token_valid() ) {
+                // Listed by post ID (215) or by the short ID newer CF7 shows in its shortcode (743d511).
+                $ids = array( (string) $form->id() );
+                if ( method_exists( $form, 'hash' ) ) {
+                        $ids[] = strtolower( substr( (string) $form->hash(), 0, 7 ) );
+                }
+                $listed = (bool) array_intersect( $ids, $enforced );
+                if ( ( ! $has_tag && ! $listed ) || self::posted_token_valid() ) {
                         return $result;
                 }
@@ -178 +188 @@
                 $submission = class_exists( 'WPCF7_Submission' ) ? WPCF7_Submission::get_instance() : null;
                 $data       = $submission ? $submission->get_posted_data() : array();
-                self::notify_admin( $form->title(), is_array( $data ) ? $data : array() );
+                self::notify_admin( $form->title(), is_array( $data ) ? $data : array(), 'cf7', (string) $form->id() );
         }
 
@@ -198 +208 @@
                         $flat[ $key ] = isset( $field['value'] ) ? $field['value'] : '';
                 }
-                self::notify_admin( isset( $form_data['settings']['form_title'] ) ? $form_data['settings']['form_title'] : 'WPForms', $flat );
+                self::notify_admin( isset( $form_data['settings']['form_title'] ) ? $form_data['settings']['form_title'] : 'WPForms', $flat, 'wpforms', (string) ( $form_data['id'] ?? '' ) );
         }
 
@@ -228 +238 @@
                         $fields[ $key ] = isset( $field['value'] ) ? $field['value'] : '';
                 }
-                self::notify_admin( (string) $record->get_form_settings( 'form_name' ), $fields );
+                $name = (string) $record->get_form_settings( 'form_name' );
+                self::notify_admin( $name, $fields, 'elementor', (string) $record->get_form_settings( 'id' ), array( $name ) );
         }
 

fast2sms/trunk/includes/class-f2s-queue.php

@@ -498 +498 @@
         private static function dispatch( $row, $phone, array $vars ) {
                 // Campaign and form auto-reply rows carry their own template config in vars['_cfg'].
-                if ( 'campaign' === $row->event || 'form_reply' === $row->event ) {
+                if ( in_array( $row->event, array( 'campaign', 'form_reply', 'form_admin' ), true ) ) {
                         $cfg = isset( $vars['_cfg'] ) && is_array( $vars['_cfg'] ) ? $vars['_cfg'] : array();
                         return self::send_with_config( $row->channel, $phone, $cfg, $vars );

fast2sms/trunk/includes/class-f2s-settings.php

@@ -369 +369 @@
                         'form_submission' => array(
                                 'label' => __( 'Form submitted (notify admin)', 'fast2sms' ),
-                                'desc'  => __( 'Notifies your admin number when Contact Form 7 / WPForms / Elementor forms are submitted. Set the admin number in Settings.', 'fast2sms' ),
+                                'desc'  => __( 'One alert for all Contact Form 7 / WPForms / Elementor forms. For a per-form alert with your own template and any form field — for all 10 supported form plugins — use Forms → Auto-reply → "Also alert the admin". Set the admin number in Settings.', 'fast2sms' ),
                                 'wc'    => false,
                                 'vars'  => array( 'form_name', 'name', 'phone', 'email', 'message', 'site_name', 'site_url', 'date', 'time' ),

fast2sms/trunk/readme.txt

@@ -5 +5 @@
 Tested up to: 7.1
 Requires PHP: 7.4
-Stable tag: 1.16.0
+Stable tag: 1.17.0
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -51 +51 @@
 * Works with Elementor Pro Forms, Contact Form 7, WPForms, Gravity Forms, Ninja Forms, Fluent Forms, Formidable Forms, Forminator, MetForm and Jetpack Forms (plus a developer hook for any other form)
 * Pick the form, the template, and which form field fills each template variable — with a live phone preview and a test send
+* Also alert the admin: a separate WhatsApp/SMS template with the submission details to your Settings admin numbers or this form's own list of one or more numbers
 * Bot protection: daily limit per number, hourly limit for the whole site, do-not-send list, and an "only OTP-verified numbers" option
 
@@ -148 +149 @@
 
 == Changelog ==
+
+= 1.17.0 =
+* New: admin alerts per form — in each form auto-reply, "Also alert the admin" sends its own WhatsApp/SMS template with any form fields (name, mobile, website, message…) to the admin numbers in Settings, or to this form's own list of one or more numbers. Every listed number gets the alert.
+* The customer message can now be switched off for a form, to send only the admin alert.
+* When a form has its own admin alert, the older "Form submitted (notify admin)" automation stays quiet for that form, so the admin is not alerted twice. Other forms are unchanged.
+* Fix: Contact Form 7 forms listed under "OTP verification on forms" by the short ID shown in newer CF7 shortcodes (e.g. 743d511) are now enforced, as well as by number.
 
 = 1.16.0 =