Magic Links Changelog

This update strengthens magic link security and resolves several issues with the {gv_magic_link} merge tag and email address matching; we recommend updating.

Note: Magic Links now requires WordPress 6.5 or newer.

✨ Improved

• Faster request form submissions, with magic links now created and emailed in the background (on some servers, the email may take a few minutes to arrive).

🔒 Security

• Magic links now work only for the entry, View, and action they were created for, and link details are kept out of logs and away from other sites.
• The request form now follows the View's email validation settings, so a View set to "Don't validate by email field" with an empty Allowed Emails list sends links only through notifications.

🐛 Fixed

• Issues with the {gv_magic_link} merge tag:
  • Tags inserted from the Gravity Forms merge tag menu produced no output;
  • Confirmations displayed the link's HTML as text, and plain-text notifications included link markup;
  • Delete links did not work when the tag output a plain URL;
  • Links were created for Views that were disabled, unpublished, or connected to a different form.
• Email addresses were not recognized as matching when their capitalization differed.
• Magic links did not work for some email addresses.
• An error occurred on PHP 8 when opening a malformed magic link URL.
• Each new entry stored its magic link twice.

💻 Developer Updates

• Added gk/gravityview/magic-links/query-param/token and gk/gravityview/magic-links/query-param/email filters to rename the gv_magic and gv_email URL parameters:
  • Names already used by WordPress or GravityView are ignored, with the reason written to the Magic Links log;
  • Links sent with the default names keep working after a rename, but links sent with a previous custom name do not.
• Fixed a PHP warning written to the debug log when a magic link opened Edit Entry for a View with an empty Edit Entry layout.

This update fixes the magic link request form on embedded Views.

🐛 Fixed

• Magic link request form not working when the View is embedded on a page or post.

This release introduces entry deletion via magic links and the ability to restrict link reuse with one-time access, and resolves multiple issues affecting magic link functionality.

🚀 Added

• Ability for users to delete entries via magic links. Requires GravityView 2.50.1 or newer.
• Support for the action parameter in the {gv_magic_link} merge tag to generate delete links (e.g., {gv_magic_link view_id="123" action="delete"}).
• One-Time Access View setting to invalidate magic links after a successful edit, requiring a new link for subsequent edits.

🐛 Fixed

• "You are not allowed to view this content" error when using magic links with a custom Entry Slug configured in View settings.
• Edit Entry fields not displaying when editing via magic links.
• Magic link access failing when the "Don't validate by email" option was selected in View settings.
• "Cancel" and "Request Control" links not working when entry locking is enabled. Requires GravityView 2.50.1 or newer.

This update makes Magic Links faster and more reliable, while enhancing security and improving log privacy for safer debugging.

✨ Improved

• Performance with caching to prevent redundant Magic Link validation checks.
• Error handling throughout the Magic Links system.
• Privacy by masking email addresses in debug logs (e.g., j@e.com).

This hotfix resolves an issue where users could not request edit access to entries when Views were embedded within pages or posts.

🐛 Fixed

• It was not possible to request edit access when Views are embedded in pages or posts.

• Liftoff! 🚀