內容簡介
Waiver Engine 是一款強大的 WordPress 外掛，讓使用者能夠在控制台中建立豁免和合約表單，並將表單欄位對應到上傳的 PDF 模板，提交後自動生成填寫好的 PDF 文件。
【主要功能】
• 建立多區段的豁免/合約表單
• 將表單欄位對應到 PDF 的精確坐標
• 提交後自動生成填寫好的 PDF
• 管理員條目列表具分頁、過濾、排序及 PDF 下載功能
• 匯入/匯出模板欄位與 PDF 對應設定
• 多層安全保護措施
外掛標籤
開發者團隊
原文外掛簡介
Waiver Engine lets you build waiver and contract forms in the WordPress
admin, map form fields to coordinate positions on an uploaded PDF template,
and automatically generate filled PDFs when visitors submit the form.
Key features:
Build multi-section waiver/contract forms
Map form fields to exact coordinate positions on a PDF
Auto-generate filled PDFs on each submission
Admin entry list with pagination, filtering, sorting, and PDF download
Import / export template field-to-PDF mappings for easy site migration
Security protections (nonce, honeypot, timing checks, rate limiting, optional CAPTCHA)
WordPress.org (free) package:
The version distributed on WordPress.org is fully functional and includes:
Unlimited waiver templates
PDF field mapping and PDF generation
Waiver submission capture and admin entry management
Import/export of template field mappings
Security settings (rate limiting, optional CAPTCHA, PDF cleanup)
Pro add-on (separate download):
A premium package is available separately (not from WordPress.org) with
additional features:
Repeating rows in form sections (per-row PDF output mode)
Admin notification emails with PDF attachments
Submitter email copies with PDF attachments
Amelia Booking integration and booking-linked waiver flows
Integration architecture:
The plugin follows an integration-manager pattern (the same approach used
by WooCommerce add-ons, WPForms, RankMath, and ACF). Each third-party
integration lives in includes/integrations/ and is loaded only when its
host plugin is active. The core plugin has zero knowledge of Amelia tables
when Amelia is not installed.
Supported PDF formats
This plugin only supports PDF 1.4 or PDF/A-1b files with:
Object streams disabled
Compressed cross-reference streams disabled
No password protection or encryption
Valid, readable pages with fonts embedded where required
If the file cannot be processed, export or print a new PDF using PDF 1.4 or
PDF/A-1b settings and select the converted file instead.
Known issues and improvements
There is currently no validation when a PDF is uploaded to ensure that its
format is supported. UI validation is planned for a future release.
External services
This plugin can connect to third-party services when you enable optional
features. No data is sent unless you configure the feature.
Google reCAPTCHA v3 (optional CAPTCHA)
Used only when you select Google reCAPTCHA v3 under Waivers > Settings
and enable CAPTCHA on a template.
What it is: Google’s invisible bot-detection service.
What is sent: When a visitor submits a waiver form with CAPTCHA enabled,
the browser loads Google’s reCAPTCHA script and obtains a token. On
submission, the plugin sends that token, your secret key, and the
visitor’s IP address to Google’s verification endpoint to validate the
request.
When: Only during form submission when CAPTCHA is enabled for that template.
Terms of service: https://policies.google.com/terms
Privacy policy: https://policies.google.com/privacy
hCaptcha (optional CAPTCHA)
Used only when you select hCaptcha under Waivers > Settings and enable
CAPTCHA on a template.
What it is: hCaptcha’s invisible bot-detection service.
What is sent: When a visitor submits a waiver form with CAPTCHA enabled,
the browser loads hCaptcha’s script and obtains a token. On submission,
the plugin sends that token, your secret key, and the visitor’s IP
address to hCaptcha’s verification endpoint to validate the request.
When: Only during form submission when CAPTCHA is enabled for that template.
Terms of service: https://hcaptcha.com/terms
Privacy policy: https://hcaptcha.com/privacy
Security
Waiver Engine implements multiple layers of protection against automated
abuse and bot submissions:
1. WordPress Nonce (CSRF protection)
Every form submission is validated against a standard WordPress nonce
(wp_verify_nonce). Requests without a valid nonce are rejected with HTTP 403.
2. Honeypot Field
A hidden text input is rendered off-screen (CSS position:absolute; left:-9999px)
and labelled with aria-hidden="true". The field must exist and be completely
empty. Bots that auto-fill all inputs will be silently rejected.
3. Timing Check
On page load, the form records a HMAC-SHA256-signed timestamp (using WordPress’s
wp_salt(‘nonce’) as the key). On submission the signature is verified and the
elapsed time is checked: submissions faster than 3 seconds or older than 2 hours
are rejected with HTTP 429. This prevents replay attacks and trivially fast bot
submissions.
4. IP Rate Limiting
A sliding-window rate limiter (implemented using WordPress transients) limits how
many waivers a single IP address can submit within a configurable time window.
Defaults to 5 submissions per 15 minutes. Configurable in Waivers > Settings.
Can be disabled independently if another rate-limiting layer exists.
5. CAPTCHA (optional)
An invisible CAPTCHA challenge can be added to waiver forms for additional
protection. Supported providers:
Google reCAPTCHA v3 – invisible scoring model. A score of >= 0.5 is
required. Register your keys at https://www.google.com/recaptcha/admin.
hCaptcha (invisible) – privacy-respecting alternative. Register at
https://www.hcaptcha.com/signup-interstitial.
Configuration steps:
Go to Waivers > Settings and choose a CAPTCHA provider.
Enter the Site Key (public) and Secret Key (private) from your
provider’s dashboard.
Open any template in Waivers > Templates > Edit and check Require
CAPTCHA verification on this form.
The CAPTCHA toggle defaults to OFF globally. Individual templates also default
to OFF even when a provider is configured, so you can roll out selectively.
Token verification happens entirely server-side via wp_remote_post() to the
provider’s verify endpoint. The secret key is never exposed in browser output.
6. PDF File Cleanup
The PDF File Cleanup tool in Settings lets you permanently delete generated
PDFs older than a chosen number of days. PDFs older than the threshold are
removed from disk; database entry records are preserved. This reduces disk
footprint and limits the blast radius of any hypothetical file-disclosure issue.
License
Waiver Engine is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by the
Free Software Foundation, either version 2 of the License, or any later
version.
Waiver Engine is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
for more details.
