Bookingistic v2.5.1

Bookingistic v2.5.1

Bookingistic 2.5.1 is the WordPress.org review-hardening release. It removes the last gated feature, closes a set of security and privacy findings from the Plugin Check review, and points all plugin links at bookingistic.com. The attached zip is the exact package submitted to the WordPress.org directory (review in progress).

Highlights

• Everything is free, nothing is gated. The email footer branding and its license gate are gone — every shipped feature is enabled out of the box, per WordPress.org guidelines. bookingistic_can_remove_branding remains as a filter and now permits white-labeling for everyone.
• Security: staff email addresses are no longer exposed by the public REST endpoints. Client IP detection for rate limiting uses only the direct connection address unless the site explicitly opts in to trusted proxy headers, and all header input is sanitized. The legacy form nonce is sanitized before verification, and admin error notices sanitize input before escaping.
• Privacy: email .ics attachments are written to the system temp directory with random names and deleted after sending — no booking data lands in the public uploads folder.
• Fixed: appearance screen styles load through the standard enqueue system; the redundant translation loader is removed (WordPress.org loads translations automatically).
• Brand: plugin links now point to bookingistic.com.

Upgrade notes

• No database changes — a safe one-click update from 2.5.0.
• Compatibility: WordPress 6.4+, PHP 8.0+.
• The white-label filter bookingistic_can_remove_branding still works; it now returns permissive by default.

Release assets

File	What it is
bookingistic-2.5.1.zip	The WordPress plugin. Upload it under Plugins → Add New → Upload Plugin.
SHA256SUMS.txt	Checksums for every file.

Verify with sha256sum -c SHA256SUMS.txt after download.