Modal Survey - WordPress Poll, Survey & Quiz Plugin 2.0.2.2.3

Security & Bug Fixes:
- Critical: Fixed logic bug where assignment operator was used instead of equality check for survey style detection, causing all surveys to incorrectly use the 'click' branch.
- Critical: Fixed path traversal vulnerability in campaign module loader; allowed module names are now strictly whitelisted.
- Critical: Sanitized cookie-sourced survey_viewed arrays with absint() before use in SQL IN clauses to prevent injection via crafted cookie values.
- Security: All plugin cookies (ms-uid, ms-session, modal_survey) now set secure=is_ssl() and httponly=true, including legacy fallback setcookie() calls.
- Security: Replaced insecure mt_rand()-based session ID generation with cryptographically secure bin2hex(random_bytes(16)).
- Security: Escaped featured image URL with esc_url() in Open Graph meta output.
- Security: Fixed unsanitized direct $_COOKIE['ms-uid'] access in ajax_survey_back; now uses sanitize_text_field/wp_unslash with isset guard.
- Security: Reduced export directory permissions from 0777 to 0755.
- Bug: Fixed incorrect number_format call in survey_answers average-score path; third argument was the decimal count instead of the decimal separator, producing garbled output.
- Bug: Fixed undefined variable warnings in survey_open_answers, survey_records, and survey_compare_chart shortcode handlers when results are absent or labels/sessions are not set.

Completion Flow & PDF Export Improvements:
- Refactored survey completion flow to separate lightweight answer saving from mail/PDF finalization, reducing timeout risk for large exports.
- Added client-side canvas snapshot capture: survey result charts are now captured as base64 PNG data before mail/PDF generation begins.
- Implemented new `finalize` AJAX endpoint in settings.php to trigger mail and PDF exports after charts have been fully rendered on the client.
- Enhanced front-end chart initialization with MutationObserver fallback to handle late-injected markup and delayed script loading gracefully.
- Updated modal_survey.js to track pending completion mail state and conditionally defer mail sending until after chart rendering completes.
- Improved modal_survey_answer.js with `window.ModalSurveyCaptureChartData()` helper to extract chart canvases as base64 payloads for PDF embedding.
- Result charts in generated PDFs now display the exact chart rendered to the user, eliminating missing or placeholder images.
Documentation & Compatibility:
- Split completion request into two lightweight phases, improving reliability on servers with stricter timeout limits.
- Chart images are now properly embedded in PDF exports by capturing rendered Chart.js canvases on the client side.
- Bootstrap logic for answer charts is now resilient to DOM delays and late script injection, common in page builders and AJAX-heavy themes.

Fix charts in PDF Export

- fixed session issue when all questions displayed and embed

- fixed Logged in only bug on saved survey screen
- minor bug fixes on PHP8

- fixed sample survey import issue
- added option to use decimal parameter with chart shortcodes as well
- added option to use alwaysdisplayed="true" to always display specified surveys regardless of the Display once Per User / Display once per Filled Out options
- added option to automatically show tooltips on the charts by adding legend="tooltip" parameter to the results shortcode
- fixed individual PDF export issue

- added filter parameter to the conditional shortcodes
- added option to include any custom fields in the Auto Response message using the ID in brackets, like [phone]
- changed radar chart to pie chart on admin dashboard Votes by Surveys for better display
- security improvements

- updated survey_calculation shortcodes, added categoryavg_categoryname option
- fixed numeric answer issue with categories and user defined score
- fixed tooltip bug
- added option to set decimals for plain text results by adding decimal="1" to the results shortcode
- fixed image align options issue on the survey edit screen

- fixed minor progress bar issue
- fixed minor JS issue with results

- fixed conditions with highest/lowest doesn't work in rare cases
- added option to get the user id to the survey_records shortcode
- fixed possible security vulnerability issue
- added option to enable/disable saving IP Address of the participants
- option to apply first true condition only or apply all (used mostly for message conditions)
- updated GDPR information