Review Submission Flow

When a user submits a review, the following steps happen in order.

1. Form Display

The review form checks several conditions before rendering:

• If the Require Login Pro setting is enabled and the user is not logged in, a login prompt is shown instead of the form.
• If the user just submitted successfully (URL contains idver_submitted=1), a success message is shown.
• If the user has already submitted a review for this event (published or pending), a duplicate message is shown.
• Otherwise, the full review form is rendered. Guests see additional Name and Email fields; logged-in users are identified automatically.

2. Form Submission

The form posts to admin-post.php with the action idver_submit_review. The handler runs these checks:

1. Nonce verification — Validates the idver_nonce field to prevent CSRF attacks.
2. Honeypot check — If the hidden idver_website field is filled (bots), silently redirects back.
3. Event validation — Confirms the event ID is a valid, published idver_event post.
4. Guest identity — For non-logged-in users, validates the guest name and email address.
5. Rate limit — Checks for existing reviews from this user ID or IP for this event.
6. Rating validation — Requires an overall rating between 1 and 5.

3. Data Storage

If all checks pass, the handler creates a new idver_review post with status pending. Post meta saved includes the event ID, user ID (0 for guests), overall rating, IP address, guest name/email (if applicable), subcategory ratings, and numerical data fields.

4. Email & Redirect

If Pro email notifications are enabled and the “admin on submit” email is active, the admin is notified. The user is then redirected back with a success flag.