Bookingistic v2.5.4

Bookingistic v2.5.4

Bookingistic 2.5.4 resolves every remaining finding from the stricter WordPress Coding Standards ruleset used by the WordPress.org review Playground. Plugin Check: 0 errors, 0 warnings (verified against the structured result payload). The attached zip is the exact package submitted back to the WordPress.org review team.

Highlights

• Numeric superglobal reads now use sanitizer functions — absint(), floatval() and sanitize_key() applied through wp_unslash() — instead of raw (int)/(float)/(string) casts, which the newest WPCS rulesets reject. Booking ids, staff ids, service ids, automation ids, pagination, quantities and prices are covered.
• Complete nonce-verification annotations on every read-only display filter, using the scoped phpcs:disable/enable pattern that the PHPCS tokenizer reliably honors.
• All 43 Playground-reported findings from the previous export are individually addressed.

Verification performed

• Fresh-install activation on a clean WordPress: no "unexpected output" warning; the bookingistic_gcal_sync cron event schedules correctly with the 15-minute recurrence (verified via WP Crontrol).
• Official Plugin Check (PCP): 0 errors, 0 warnings, confirmed by independent parsing of the structured result payload.
• All 16 admin screens render clean; settings save end-to-end; standalone test suite 32 assertions pass; PHP 8.0–8.3 lint clean.

Upgrade notes

• No database changes — a safe one-click update from 2.5.x.
• Compatibility: WordPress 6.4+, PHP 8.0+.

Release assets

File	What it is
bookingistic-2.5.4.zip	The WordPress plugin. Upload it under Plugins → Add New → Upload Plugin.
SHA256SUMS.txt	Checksums for every file.

Verify with sha256sum -c SHA256SUMS.txt after download.

Bookingistic v2.5.3

Bookingistic v2.5.3

Bookingistic 2.5.3 clears the entire Plugin Check static-analysis report — 0 errors, 0 warnings — while keeping every feature identical. The attached zip is the exact package submitted back to the WordPress.org review team.

Highlights

• Every superglobal read is now unslashed and sanitized (or explicitly cast): admin save/action handlers, list filters, and the public cancel / reschedule / pay signed-token links.
• All templates use plugin-prefixed variable names ($bookingistic_*), so no template can leak or collide with globals.
• Dispatcher-safe nonce ordering: every admin handler bails early on action mismatch before any nonce or capability check — a POST for one screen can never be tripped by another screen's handler (re-verified end-to-end on a fresh install).
• Justified annotations for the custom-table repositories: the plugin's own tables are queried intentionally (identifiers from class constants, values always prepared), so DirectQuery / NoCaching / SchemaChange are disabled per-file with rationale; read-only $_GET display filters carry inline justifications.
• Fixed: removed a leftover duplicate "Footer text" field on Settings that still referenced the branding gate removed in 2.5.1.

Verification performed

• Fresh-install activation on a clean WordPress 7.1: no "unexpected output" warning; the bookingistic_gcal_sync cron event schedules correctly with the 15-minute recurrence (verified via WP Crontrol).
• Official Plugin Check (PCP): 0 errors, 0 warnings.
• All 16 admin screens render clean; settings save end-to-end through the capability + nonce guards; every booking/service/staff/automation workflow intact.
• Standalone test suite: 32 assertions, all passing; PHP 8.0–8.3 lint clean.

Upgrade notes

• No database changes — a safe one-click update from 2.5.x.
• Compatibility: WordPress 6.4+, PHP 8.0+.

Release assets

File	What it is
bookingistic-2.5.3.zip	The WordPress plugin. Upload it under Plugins → Add New → Upload Plugin.
SHA256SUMS.txt	Checksums for every file.

Verify with sha256sum -c SHA256SUMS.txt after download.

Bookingistic v2.5.2

Bookingistic v2.5.2

Bookingistic 2.5.2 addresses the second WordPress.org review round: a cron-scheduling bug on fresh activations and missing capability checks on the admin action handlers. The attached zip is the exact package submitted back to the WordPress.org review team.

Highlights

• Fixed: Google Calendar sync cron event now schedules on a fresh activation. The custom "every 15 minutes" recurrence is registered before wp_schedule_event() runs during activation — previously Plugin::boot() only registered the interval after the activation hook had fired, so the event was silently skipped on new installs and Google Calendar sync never started on its own.
• Security: capability checks on every admin save/action handler. In addition to the existing nonce checks, settings, services, staff, bookings (create/status/cancel/reschedule/notes), email automations, integrations and appearance now require the matching Bookingistic capability (manage_bookingistic_settings, manage_bookingistic_services, manage_bookingistic_staff, bookingistic edit/create caps, manage_bookingistic_email_automations, manage_bookingistic) — verified before any input processing, failing closed with a 403. Payments and the staff Google Calendar actions already had capability checks and are unchanged.
• Tests: new cron regression test in the standalone suite (php tests/run-all.php, now 32 assertions) covering recurrence registration.

Verification performed

• Fresh-install activation on a clean WordPress 7.1 with a full headless pass: activation completes with no "unexpected output" warning, and the bookingistic_gcal_sync event is present in the cron list with the 15-minute recurrence immediately after activation (verified via WP Crontrol).
• Official Plugin Check (PCP) on the installed plugin: 0 errors, 0 warnings.
• Standalone test suite: 32 assertions, all passing. PHP 8.0–8.3 syntax lint clean.

Upgrade notes

• No database changes — a safe one-click update from 2.5.x.
• Compatibility: WordPress 6.4+, PHP 8.0+.

Release assets

File	What it is
bookingistic-2.5.2.zip	The WordPress plugin. Upload it under Plugins → Add New → Upload Plugin.
SHA256SUMS.txt	Checksums for every file.

Verify with sha256sum -c SHA256SUMS.txt after download.

Bookingistic v2.5.1

Bookingistic v2.5.1

Bookingistic 2.5.1 is the WordPress.org review-hardening release. It removes the last gated feature, closes a set of security and privacy findings from the Plugin Check review, and points all plugin links at bookingistic.com. The attached zip is the exact package submitted to the WordPress.org directory (review in progress).

Highlights

• Everything is free, nothing is gated. The email footer branding and its license gate are gone — every shipped feature is enabled out of the box, per WordPress.org guidelines. bookingistic_can_remove_branding remains as a filter and now permits white-labeling for everyone.
• Security: staff email addresses are no longer exposed by the public REST endpoints. Client IP detection for rate limiting uses only the direct connection address unless the site explicitly opts in to trusted proxy headers, and all header input is sanitized. The legacy form nonce is sanitized before verification, and admin error notices sanitize input before escaping.
• Privacy: email .ics attachments are written to the system temp directory with random names and deleted after sending — no booking data lands in the public uploads folder.
• Fixed: appearance screen styles load through the standard enqueue system; the redundant translation loader is removed (WordPress.org loads translations automatically).
• Brand: plugin links now point to bookingistic.com.

Upgrade notes

• No database changes — a safe one-click update from 2.5.0.
• Compatibility: WordPress 6.4+, PHP 8.0+.
• The white-label filter bookingistic_can_remove_branding still works; it now returns permissive by default.

Release assets

File	What it is
bookingistic-2.5.1.zip	The WordPress plugin. Upload it under Plugins → Add New → Upload Plugin.
SHA256SUMS.txt	Checksums for every file.

Verify with sha256sum -c SHA256SUMS.txt after download.

Bookingistic v2.5.0

Bookingistic v2.5.0

Bookingistic 2.5.0 makes booking race-safe, hardens the payment and calendar token flows, and fixes the payments status endpoint.

Highlights

• Race-safe booking. Concurrent submissions for the same staff member are serialized with a row lock, and the availability re-check runs inside the transaction — preventing double-booking under simultaneous submits (InnoDB; silently degrades to check-then-insert on MyISAM).
• Fixed: /payments/status now accepts the signed link's t parameter (previously it only read token, so plugin-issued links always returned 410 Gone).
• Security: pay-now links expire after 90 days. The token embeds its expiry under an HMAC; previously a leaked pay link stayed valid forever.
• Security: Google Calendar OAuth tokens are encrypted at rest (authenticated secretbox keyed from the site salt). Existing tokens migrate transparently on the next save.
• Dev: standalone test suite under tests/ — run php tests/run-all.php, no WordPress install required. Covers payment token expiry, crypto round-trip and deposit math.

Upgrade notes

• No manual migration is required; existing OAuth tokens re-encrypt transparently.
• Compatibility: WordPress 6.4+, PHP 8.0+.

Release assets

File	What it is
bookingistic-2.5.0.zip	The WordPress plugin. Upload it under Plugins → Add New → Upload Plugin.
SHA256SUMS.txt	Checksums for every file.

Verify with sha256sum -c SHA256SUMS.txt after download.

Bookingistic v2.4.0

Bookingistic v2.4.0

Bookingistic 2.4.0 is the premium admin-UI release: every Bookingistic screen is restyled on a consistent design system, with live stats and a rebuilt Integrations page.

Highlights

• Premium admin UI. Every screen restyled with page headers and taglines, card-based panels, refined tables, status pills and a sticky save bar — built on CSS variables matching the WordPress admin palette, with no external fonts or CDNs.
• Integrations page rebuilt as an animated card grid — icon, description, Connected/Not connected pill, hover lift and staggered fade-in (pure CSS, respects prefers-reduced-motion).
• Live stat cards on dashboard, bookings, services, staff, customers and customer profiles — real counts from your data.
• New Reports screen with bookings-by-status summary and top services.
• Legacy "Bookings (v1)" menu removed from the sidebar. Data and the legacy REST endpoint are untouched; developers can restore the UI with the bookingistic_legacy_bookings_show_ui filter.

Upgrade notes

• No database changes in this release.
• Compatibility: WordPress 6.4+, PHP 8.0+.

Release assets

File	What it is
bookingistic-2.4.0.zip	The WordPress plugin. Upload it under Plugins → Add New → Upload Plugin.
SHA256SUMS.txt	Checksums for every file.

Verify with sha256sum -c SHA256SUMS.txt after download.