Documentation

Usage

After installation the plugin registers the Form Builder backend menu with four items: Forms, Field types, Form submissions and Settings. Two example forms are installed: a simple contact form and a default form with the basic field types.

Place the renderForm component on a CMS page, inspect it and choose the form.

The form is submitted through the AJAX Framework, so the layout must load it next to the page styles:

<head>
    {% styles %}
</head>
<body>
    ...
    {% framework extras %}
    {% scripts %}
</body>

Example of placing form component on CMS page

/themes/demo/pages/contact.htm

url = "/contact"
layout = "default"

[renderForm contactForm]
formCode = "contact-form"
==
{% component 'contactForm' %}

Example of placing form component on CMS partial

/themes/demo/pages/contact.htm

url = "/contact"
layout = "default"

[renderForm contactForm]
formCode = "contact-form"
==
{% ajaxPartial "contact" %}

/themes/demo/partials/contact.htm

{% component 'contactForm' %}

Important note: The form handler works only inside {% ajaxPartial %}, not inside a plain {% partial %}.

Forms

E-mail

Choose a Mail Template in the Recipients tab to mail each submission; a form with a template needs at least one recipient. Without a template nothing is mailed and every submission is logged. Pick the reply-to and autoresponder fields in the E-mail tab once the form is saved with its fields.

Live preview

Press Preview at the top of a saved form to open it in a side panel over the editor, rendered by the theme in the locale of the site selected in the backend, at desktop or 390 px phone width. It reloads after the form is saved and after a field is added, edited, deleted, reordered or hidden, so only unsaved changes in the main form are missing.

Submitting from the preview runs the validation and shows the success message, but sends no e-mail, calls no webhook, writes no submission log and follows no redirect. The panel needs the Update forms permission.

The theme's default layout is used; when the theme has more layouts, pick another one, or none, in the panel's toolbar.

The preview is a close approximation, not the live page: it is served from the backend, so the cms.page.* events run but the frontend route middleware does not. In particular the Spam Protection checks (honeypot, timing, blocked submissions) are skipped there, so test them on a real page.

Spam Protection

Install the Spam Protection Plugin to protect every Form Builder form with a honeypot, content rules, a single-use form token and a per-visitor rate limit. It works out of the box.

A submission identical to one accepted within the last minute is answered with the success message but is neither logged nor mailed again, so a double click or a page refresh after sending does not produce duplicates.

Custom template

The plugin generates the form template while the Custom Template field is empty. To replace that markup, write your own template there and render each field with the form_field() function, which takes the field name. The tab appears once the form is saved.

A visible field the template leaves out is not validated, logged or mailed, and saving the form or a field lists such fields. A Logged in user field is always saved and a captcha always stays required. A field written as its own <input name="...">, or a template printing form.fields, keeps every field as before.

Example that will display two fields in one row:

<div class="row">
    <div class="col-6">{{ form_field('first_name') }}</div>
    <div class="col-6">{{ form_field('last_name') }}</div>
</div>

The names of the form's own fields are listed above the editor; clicking one inserts its form_field() call at the cursor. The list follows the Fields tab, so a field added, renamed or deleted there shows up at once. In the editor, type {{ or press Ctrl+Space for the same fields, the form object, Twig filters and tags.

Floating labels

Turn on Floating labels in the form's Options tab to render Bootstrap floating labels. The theme must use Bootstrap 5 and the field types the Bootstrap 5 markup preset; other presets ignore the option.

Prefill from query string

Turn on Prefill from query string in the form's Options tab to fill fields from URL parameters of the same name, for example a campaign link /contact?subject=Offer&email=jan@example.com. It is off by default.

A parameter that matches no field is ignored, values longer than 255 characters are cut, and checkbox, geolocation, repeater, file upload, signature, captcha, submit, section and page fields are never prefilled. Hidden fields are, so a link can carry UTM or campaign identifiers; treat them as visitor input, like any posted value. The fields set as the autoresponder or reply-to e-mail are never prefilled either, so a crafted link cannot redirect a copy of the submission. The value replaces the field's default value literally (it is not translated), and the markup escapes it like any other default. Country and state selects ignore it, because their markup renders the selected option itself.

Live validation

Turn on Live validation in the form's Options tab to check a field as soon as the visitor leaves it. The check runs on the server with the same rules and messages as the submission, so a field never passes here and fails there. Nothing is logged and no email is sent. A field the visitor has not filled in yet is left alone until it has a value or has already failed once, file, captcha and hidden fields are only checked on submission, and a field its conditions hide is not checked at all. An error stays until the server clears it, and fixing a field also rechecks the failed fields whose rules refer to it, such as same:email. The check sends only the form's own fields, so Spam Protection does not count it as a submission and the form's single-use token stays valid.

Webhooks

Add an address in the form's Webhooks tab to have every submission posted there as JSON, without writing a listener in PHP. The body is:

{
    "id": "9d3f6c1e-8b2a-4f57-a1c4-2e6b0d7f5a93",
    "form": {"code": "contact-form", "name": "Contact Form"},
    "data": {"email": "john@example.com", "email_raw": "john@example.com"},
    "submitted_at": "2026-09-13T09:41:02+00:00"
}

data holds the submitted values under the field names, each also as <name>_raw with the value as it was posted. File upload fields are not included. It is the same data the mail gets, after formBuilder.extendFormData, so a field a listener removes from the mail is not sent to a webhook either, and a submission formBuilder.beforeSendMessage cancels is neither mailed, logged nor sent to a webhook. Turn on Send the visitor's IP address to add an ip key; it is off by default, as the address is personal data.

id is unique to each call and is also sent in the X-Webhook-Id header. A queued call that is retried keeps its id, so the receiver can drop a delivery it has already processed.

With a Signing secret the body is signed with HMAC-SHA256 and the signature is sent in the X-Signature header, so the receiver can tell a genuine call from a forged one. The secret is stored encrypted with the application key:

hash_equals(
    hash_hmac('sha256', file_get_contents('php://input'), $secret),
    $_SERVER['HTTP_X_SIGNATURE'] ?? ''
);

The signature covers the body alone, so a captured call stays valid if it is replayed. Reject a call whose submitted_at is not recent when that matters to you.

The address must be https and public: private and reserved ranges (IPv4 and IPv6), localhost, *.local, *.internal, *.home.arpa, single-label names and shorthand IPv4 forms such as 127.1 are refused. The check runs again right before each call, and the call goes only to the addresses it approved, so a name repointed inside the network is not followed, and neither is a redirect.

A webhook that fails or does not answer within 5 seconds never changes what the visitor sees; the failure is logged under Settings → Logs with the scheme and host only, as the path often carries a token. Send through the queue is on by default and makes up to three attempts, 10 and 60 seconds apart, after a timeout, a lost connection, a 5xx, 408 or 429. Without a queue worker (sync driver) the calls run inline and in parallel, and a slow DNS server holds the submission, because PHP has no timeout for the lookup.

Return false from formBuilder.beforeSendWebhook to drop a call (see Events).

A form export carries its webhooks without the signing secret. Imported back into the same installation, a webhook keeps its secret; on another installation set it again, as the import report reminds you.

Fields

Custom HTML markup for fields

The default markup of every field type uses Bootstrap 5 form classes. For a Tailwind CSS theme, switch to the Tailwind preset (see below). On a theme with another CSS framework, or none, change the HTML markup of each field type under Form Builder → Field types. The recommended approach is to duplicate the field type and modify the copy.

Markup presets

A preset is a set of field type templates for one CSS framework. The plugin ships Bootstrap 5 (the default) and Tailwind CSS. To switch, open Form Builder → Field types, press Restore system fields and pick the preset. The markup of every system field type is replaced with the preset's; field types you created or duplicated are left alone. The Restore markup to default button of a single system field type offers the same choice.

The presets differ only in CSS classes. Field IDs, data-* attributes and ARIA attributes the plugin's JavaScript relies on are the same, and the Tailwind preset styles an invalid field through the aria-invalid: variant. Floating labels are a Bootstrap feature, so the Tailwind preset ignores that form option. The preset files hold markup only: the reCAPTCHA v3 and Turnstile scripts live in the plugin's form.js and find their fields by the data-recaptcha-sitekey attribute and the formbuilder-turnstile class, so keep those in markup you write yourself.

The preset of the last restore is remembered: the restore dialog offers it first, and field types added by later plugin updates are created with its markup.

Tailwind CSS generates only the classes it finds in files, and the markup of field types is stored in the database. Point Tailwind (v4) at the preset files in the theme's stylesheet:

@import "tailwindcss";
@source "../../plugins/renatio/formbuilder/presets/tailwind";

The path is relative to the stylesheet, so adjust the number of ../ to where it sits. Classes you add by hand in the backend — to a field type's markup or to a field's CSS classes and Wrapper CSS classes — are not in those files; list them with @source inline("...") or in a file under @source, or Tailwind will leave them out.

Field types carry no outer margin, so a new form's CSS classes (Options tab) start with the spacing of the preset last restored: row g-3 for Bootstrap 5, space-y-4 for Tailwind CSS.

The form's own wrappers still use Bootstrap classes where Bootstrap has them: the seeded demo forms set wrapper classes such as col-md-6, and the success and error messages of the component are Bootstrap alerts. Change the wrapper classes of the fields and override the component's message.htm partial in the theme when using Tailwind.

To add a preset of your own, create presets/<name>/ in the plugin with one <field_type_code>.htm file per field type, for example presets/bulma/text.htm. It appears in the restore dialog without any code change; a field type with no file in the preset keeps its markup. Files added inside the plugin directory are overwritten by plugin updates, so keep a copy.

Custom field types

Create a field type under Form Builder → Field types with the New field type button. For example, an Email field type is the markup of Text with the input type changed to email. Once saved, it can be used in any form.

The markup is Twig with the variables below. They are listed above the editor — click one to insert it — and suggested as you type {{ or press Ctrl+Space, together with Twig filters and tags.

Conditional fields

A field can show or hide itself depending on what the visitor answered in other fields — the classic case being an Other option in a dropdown that reveals a textarea. Open the field's Conditions tab and choose:

• Action — Show this field when or Hide this field when the conditions are met,
• Match — whether all conditions or any condition has to be met,
• the conditions themselves: another field, an operator (is equal to, is not equal to, contains, is empty, is not empty) and a value. For a dropdown or a list the value is the option key, not its label.

An empty, unchecked or missing field has no value at all, so test it with is empty / is not empty rather than is equal to an empty value. A field hidden by its conditions no longer counts as answered, so the fields that depend on it are evaluated as if it were empty.

Inputs of a hidden field are disabled in the browser, so their values are never submitted. The server evaluates the same conditions, drops whatever a hidden field still sent (including uploaded files) before validation, and skips its validation rules — a required rule on a field the visitor cannot see does not block the form, and its value never reaches the submission log, the e-mails or formBuilder.* listeners. reCAPTCHA and Turnstile fields ignore conditions and are always validated.

Conditions work with custom field types without editing their markup — the rendered field is wrapped in a <div data-field-conditions> with display: contents, so it does not affect a grid layout. Renaming a field updates the conditions that refer to it; a condition may only refer to a field of the same form.

Validation

Every field carries its own rules in the Validation tab, one per row, in the Laravel syntax — required, max:255, regex:/^\d+$/. The rule field suggests the rules the installation supports, including those other plugins register. Leave the message empty to use the built-in wording.

Saving a field is refused when a rule does not exist, misses its parameters, carries a broken regular expression or points exists/unique at another database connection, so those mistakes never reach the front end. Rules registered outside the backend request — a Validator::extend() call in CMS page code, for example — are unknown there, and a field using one cannot be saved.

A fresh install seeds the Contact Form and Default Form with the recommended set (an upgrade only adds the length limits to seeded fields whose rules were never changed):

A length limit on every text field is what keeps a form from accepting a megabyte of text, so add one even where the value is optional.

Accessibility

The default field types link labels, help text and validation errors to the field, mark fields with a required or accepted rule as required, and group checkbox and radio lists in a fieldset. Add autocomplete through Custom attributes on fields that collect personal data, for example autocomplete="email".

Available field types

Logged in user

The Logged in user field type saves an attribute of the signed-in visitor with the submission — their address, name or id — without showing an input. Pick the attribute in Logged in user attribute on the field's Attributes tab; it defaults to email. Only these attributes can be picked: id, email, username, login, first_name, last_name, full_name, company, phone and created_at (saved as Y-m-d H:i:s). Anything else on the user model - password, persist and activation codes, IP addresses, notes - is never read. company and phone stay empty unless a plugin adds those columns to the user.

The value is read from the session when the form is submitted and replaces whatever the request carried under the field's name, so it cannot be changed by whoever posts the form, and conditions, validation, the log, the mail and every formBuilder.formSubmitted listener reading post() see the same value. With nobody signed in, or without RainLab.User installed, it is empty.

Give the field a required validation rule to accept the form only from someone signed in: the rule is checked against the value the server resolved, so it fails exactly when nobody is. The field renders only the element that shows this validation message, so set a message that tells the visitor to sign in.

Leave Visible on. An invisible field is dropped from the form altogether and then records no value.

For the same reason the field ignores conditions, cannot be the field another field's conditions test, and is never prefilled from the query string.

Geolocation

Renders a read-only input with a button that asks the browser for the coordinates of the visitor. Nothing is read without the visitor pressing the button and allowing access in the browser prompt.

The submission and the mail carry the coordinates together with a link to the place on OpenStreetMap:

52.2297, 21.0122 (https://www.openstreetmap.org/?mlat=52.2297&mlon=21.0122)

The _raw value is the bare latitude,longitude pair, which is what you want when the mail template builds a link of its own. Form Builder checks the value on every submission and empties anything that is not a pair of coordinates on the globe, so the log, the mail, the webhooks and the validation rules all see the same checked value.

• The coordinates are shown in a read-only input next to the button, so the visitor sees what is being submitted.
• The browser is asked for a regular, not a high-accuracy position, and the coordinates are rounded to 4 decimal places, which is about 11 m - close enough for an address without pinpointing the visitor.
• The field is never prefilled, neither from its Default value nor from the query string, so only a location the visitor shared is ever submitted.
• Add required to the validation rules to insist on a location. A visitor who refuses the browser prompt can still submit the form as long as the field is not required.
• The button label and the status messages come from the plugin translations, so the markup stays the same in every language.

Note: Browsers only expose the location over HTTPS.

Signature

Renders a canvas the visitor signs with a mouse, a pen or a finger, plus a button clearing it. The drawing is saved as a PNG attached to the submission, exactly like an uploaded file: it shows under Attachments in the form submission and is attached to the mail unless Send uploaded files as mail attachments (Upload Options tab) is unchecked. Deleting the submission deletes the file.

The field carries no value in the mail template — {{ name }} is empty, because the signature is a file rather than text.

• Add required to the validation rules to insist on a signature. An untouched canvas, and a drawing the plugin refuses, both fail that rule rather than going through as an empty submission.
• Drawings over 256 KB and anything that is not a PNG are rejected, so a payload put into the hidden input by hand never reaches the disk.
• The file is stored as a protected attachment, unlike an uploaded file, so it is not served from a public URL.
• The height of the canvas is a style attribute in the field type markup; change it there for a taller signature box.

Accessibility: a signature needs a pointer — mouse, pen or finger — so the field cannot be completed with a keyboard alone. Do not make it the only way to finish a form that has to be usable without one; offer a second route (a typed name, a call back) alongside it.

Page break and Page progress

Two fields splitting a long form into pages the visitor moves through without the page reloading. Everything is still submitted in one request at the end, so nothing changes for the mail template or the submission log.

Put a Page break field wherever the form should be cut. It renders the Previous and Next buttons and hides the one that has nowhere to go, so two breaks give three pages. Set the field's Label for the text on the Next button and its Placeholder for Previous; left empty they use the plugin translations.

A Page progress field renders a progress bar with a Step 2 of 3 caption, announced to screen readers on every page change. It stays visible on every page wherever you place it, and it renders nothing at all on a form with a single page.

Next asks the server to validate the fields of the current page and moves on only once they pass, whether or not the form has live validation turned on; Enter in a field does the same. The submission still validates every field, and if one on an earlier page fails, the form jumps back to that page with the error shown.

Put the break where a page really ends: a break placed after the Submit field leaves a last page with no way to send the form, and two breaks in a row make an empty page.

Note: page breaks are found in the rendered form, so in a custom form template every {{ form_field() }} of a page and the breaks themselves have to sit at the same level. When the breaks do not share one parent element, the form is shown as a single page with the page buttons hidden, and the browser console carries a warning. A component template overriding default.htm has to keep the data-page-validation attribute of the form, or Next moves on without checking the page.

Repeater

A group of fields the visitor can add several times, such as the attendees of an event or several addresses. Save the repeater field first, then open it again: its Repeater tab lists the fields of each row, added and reordered like the fields of the form. Minimum rows makes the visitor fill in that many rows, Maximum rows caps them at up to 50; the form starts with as many rows as the minimum, so an optional repeater shows only its Add another button. Set the field's Placeholder to change the text of that button.

Every row posts its fields as attendees[0][name], attendees[1][name] and so on, and the validation rules of a row field apply to each row on its own, with the error shown next to the input of that row. A row whose fields are all left empty is ignored.

The mail and the submission log list every row. {{ attendees }} holds one line per row, Name: Ann; E-mail: ann@example.com, and {{ attendees_raw }} the rows themselves, for a custom mail template laying them out its own way:

{% for attendee in attendees_raw %}
    {{ loop.index }}. {{ attendee.name }} ({{ attendee.email }})
{% endfor %}

A repeater cannot hold another repeater, nor a field needing a file, a server value or a request of its own: File upload, Signature, Geolocation, Logged in user, reCaptcha, Turnstile, Submit, Page break, Page progress and State select. The fields of a row cannot have conditions, neither they nor the repeater can drive the conditions of other fields, and rows are checked when the form is submitted or a page left, not by live validation.

reCaptcha

Renders Google reCAPTCHA, either v2 (checkbox) or v3 (invisible and score-based, no user interaction).

Create the keys on the reCAPTCHA site — v2 and v3 keys are not interchangeable — and enter them under Settings → Form Builder, tab reCaptcha:

• Version — reCAPTCHA v2 (Checkbox) or reCAPTCHA v3 (Invisible).
• Site Key and Secret Key — must match the selected version.
• Score Threshold (v3 only) — minimum score from 0.0 (likely bot) to 1.0 (likely human) needed to pass. Default is 0.5.
• Language — language of the widget.
• Theme — light or dark v2 checkbox widget.

A fresh install is filled with Google's v2 test keys, which always pass and show a testing notice in the widget. Replace them before going live.

Important note: This field must have g-recaptcha-response as field name, and two rows in its validation section — required and recaptcha — to work properly. One rule per row; a rule written as required|recaptcha is rejected.

Turnstile

Renders a Cloudflare Turnstile widget — a captcha that sets no cookies, needs no Google account and is free at any volume. Use it instead of reCaptcha, not next to it.

Create a widget in the Cloudflare dashboard and enter the keys under Settings → Form Builder, tab Turnstile:

• Site Key and Secret Key — from the widget you created.
• Theme — auto follows the visitor's colour scheme, or force light / dark.
• Widget size — normal, flexible (fills the width of its container) or compact.

A fresh install is filled with Cloudflare's test keys, which always pass and show a testing notice in the widget. Replace them before going live.

Important note: The field name is up to you, but the field needs two rows in its validation section — required and turnstile. Without turnstile the token is never verified, and without required an empty token passes.

File upload

Renders a file input.

Filter files selected by a user

To limit the file picker, add an accept custom attribute, for example accept=".pdf,.doc" for PDF and Word files or accept="image/*" for images.

Validation

Add the rules in the field's validation section:

• required — a file must be chosen,
• max:512 — at most 512 KB,
• mimes:pdf — PDF files only,
• image — images only.

See the available validation rules for more.

Multiple files

To accept more than one file, check Allow multiple files in the Upload Options tab. Then check Nested array based form input next to each rule so it applies to every uploaded file, except the required rule.

Send uploaded files as mail attachments

Uploaded files are attached to the mail by default. Uncheck the option to send the mail without them.

Display mode

Tells the backend how to show the uploaded files in a form submission. Choose image when only images are allowed.

Country select

Renders a dropdown with country options.

Important note: You must install Location Plugin to use this field.

State select

Renders a dropdown with state options. This field depends on country select.

Important note: You must install Location Plugin to use this field.

Translations

Forms, fields and field types are translated with the model translations built into October CMS, one language per site, so no extra plugin is needed. Add a site for each language under Settings → Sites.

There are two ways to fill in a translation in the backend:

• switch the site with the site selector in the backend and edit the record as usual — every translated attribute is saved for the language of that site,
• click the globe icon next to a translated field to edit its value for another site in a popup.

Recipients, options and validation messages are repeaters, which the popup cannot edit, so translate them with the site selector. Each site keeps its own copy of the whole list, so after changing an option key or a validation rule on the default site, change it on the translated sites too.

An attribute left empty in a language falls back to the value of the default site, so a form translated only partially never renders blank labels or messages. Duplicating a form copies the translations of the form and of all its fields.

The Translations column of a form's field list shows a flag for each site with its own label; hover it for the text. It is hidden when there is only one site.

Using form data in mail templates

Every submitted field is available in the mail template under its name. For a field named name:

{{ name }}

The value is already processed by Form Builder: dropdowns and radio lists return the label of the selected option, checkbox lists the selected labels separated by commas, a checkbox Yes or No, and country and state selects the name. The value exactly as the browser sent it is available with the _raw suffix:

{{ name_raw }}

Form Submissions

Every submission is stored under Form Builder → Form submissions with the submitted values, the uploaded files, the sender IP address and a preview of the sent e-mail. The autoresponder is stored as a separate submission, marked with the Autoresponder column and filter. Turn logging off per form in the Options tab; a form without a mail template always logs, because the submission would otherwise be lost.

Submissions are pruned by a daily scheduled job after Prune period in days from Settings → Form Builder. It only runs if October's scheduler is running (php artisan schedule:run every minute). Leave the period empty to keep submissions forever.

The list can be filtered by form, autoresponder, send date and IP address.

Submissions can be exported to CSV or JSON from the toolbar. The export follows the filter panel, so filter first to export a subset. The search term and the row checkboxes are not applied to it.

Settings

Plugin settings are available at Settings → Form Builder.

• reCAPTCHA version, Site key, Secret key, Score threshold, Language, Theme — see the reCaptcha field type above. The pre-filled demo keys work with v2 only.
• Turnstile Site key, Secret key, Theme, Widget size — see the Turnstile field type above.
• Prune period in days — how long submissions are kept. Default: 30.

Permissions

Every backend action checks its permission on the server, so a user without it gets a 403 even when the button is reached by hand.

Events

Listen in your plugin's boot() method:

Event::listen('formBuilder.overrideForm', function ($form) {
    $form->css_class = 'form-horizontal';
});

Event::listen('formBuilder.overrideField', function ($field, $form) {
    if ($field->name === 'currency') {
        $field->default = 'USD';
    }
});

Event::listen('formBuilder.formSubmitted', function ($form) {
    Log::info("Form {$form->code} submitted", $form->getDataArray());
});

Event::listen('formBuilder.extendFormData', function ($data) {
    $data['foo'] = 'bar';

    return $data;
});

Event::listen('formBuilder.beforeSendMessage', function ($form, $data) {
    $form->from_email = 'john.doe@example.com';
    $form->from_name = 'John Doe';
});

Event::listen('formBuilder.beforeSendWebhook', function ($form, $webhook, $payload) {
    return $payload['data']['email'] !== 'spam@example.com';
});

Upgrade guide

Versions not listed here need no action. Back up the database before upgrading.

Upgrading To 2.0.1

Requires October CMS 2.x and PHP 7.3. Upgrading from 1.5.0 needs a reinstall or php artisan formbuilder:patch 2.0.

Upgrading To 3.0.0

Requires October CMS 3.0 and PHP 8.0.

Upgrading To 3.1.0

• Field types are rewritten for Bootstrap 5; forms rendered with an older framework need their markup adjusted.
• Permissions are now granular, so review the roles after the upgrade.
• Validation uses the AJAX Framework extras ({% framework extras %} in the layout).

Upgrading To 4.0.0

Upgrade to 3.1.3 first and back up the database.

• The responsiv/uploader-plugin integration is replaced by native AJAX file uploads: the migration adds the new upload field type and moves the old upload fields to it. Check the forms with uploads afterwards.

Upgrading To 5.0.1

Requires October CMS 4.x.

Upgrading To 5.1.0

Field IDs are now unique per form. Restore the field types to the default markup to pick this up; customised field types need the field_id variable added by hand.

Upgrading To 5.1.4

Forms and field types are duplicated with native duplicate() methods instead of bkwld/cloner, so the cloner::cloning and cloner::cloned events are no longer fired.

Upgrading To 5.1.5

Run php artisan october:migrate.

• Field type markup receives only settings.site_key, settings.version, settings.theme and settings.lang; customised reCAPTCHA markup must be restored to default or updated by hand to support v3.
• The autoresponder is saved as its own form submission, so a form with both switches on produces two entries per submission.

Upgrading To 5.2.0

Security release. Upgrade every installation running 5.1.x. Requires PHP 8.2. Run php artisan october:migrate.

• Submitted values are now escaped in the submission preview, and every backend AJAX handler checks its permission on the server.
• Users who duplicate forms or field types, toggle field visibility or restore the default markup now need the matching Create or Update permission; Clear form submissions needs Truncate form submissions. Review the roles under Settings → Administrators → Roles.
• Field names must be unique within the form and use only letters, digits, dashes and underscores; rename an older field that breaks this rule (and its variable in the mail template) when saving it fails.
• Field HTML is inserted after the form template is parsed, so Twig syntax typed into a label or a default value is rendered literally.
• Merge the changes into form.js if you ship a customised copy: validation errors now clear as the visitor corrects the field, and a second submit is blocked while the first is pending.

Upgrading To 5.3.0

Run php artisan october:migrate.

• Field types still on the default markup are refreshed automatically; restore customised ones under Form Builder → Field types or add the error and help ids, aria-* attributes and the new required variable by hand.
• Required fields now show an asterisk, checkbox and radio lists render as a fieldset with a legend and option ids {field_id}-option-{key}, and the Section heading is an h2 styled as h4, so check theme CSS and JS that target these elements.
• Merge the form.js changes if you ship a customised copy.

Upgrading To 6.0.0

Requires October CMS 4.4. Run php artisan october:migrate.

• The migration installs the new field types and adds length limits to unchanged fields of the seeded forms.
• It also copies the RainLab.Translate translations of forms, fields and field types into October's built-in translations, leaving the old rows untouched. Do not run php artisan translate:import-attributes without --model afterwards, as it overwrites those translations.
• Merge the form.js changes if you ship a customised copy.
• A customised default mail template prints a repeater as one line per row.
• A geolocation value reaches mail templates and formBuilder.* listeners as a Twig\Markup object; cast it with (string) before comparing.

Upgrading To 6.0.1

Validation rules and option keys of a field are shared by all sites; a translated site translates only the validation messages and option labels. A field that had different rules on a translated site now uses the rules of the default site.