Release v5.4.3
BookingWP - #1 WordPress Appointment Booking Plugin v5.4.3
What's new in v5.4.3
BookingWP - #1 WordPress Appointment Booking Plugin v5.4.3 was released on . #1 WordPress Appointment Booking Plugin See the full changelog below and compare with the complete version history.
Release details
Released
2.9 MB
File unavailable
Changelog
Other
- Performance - Admin calendar preload: eligible-ID query plus batched postmeta hydration; batched order meta (no per-order WC_Order hydration). Recurring series package summary on bulk fetch (`get_panel_preload`, one load per series id); full appointment panel still loads on open.
- Dev - PHPCS: WPCS security ruleset (`phpcs.security.ruleset.xml`, `npm run lint:php:security`), shared path rulesets and request helpers; `lint:php` / build gate runs security scan + PHPStan; optional `lint:php:standards` / `lint:php:quality`; PHP-CS-Fixer via `format:php`.
- Dev - PHPStan raised to level 4 — dead-code cleanup across admin, slots, API, GCal, and core (clean baseline).
- Dev - Rate limiting: filterable `enabled`, `guest_only`, and `strict_max_requests`; named guest-read defaults on `WC_Appointments_Rate_Limiter`.
- Dev - Tests: `PublicAjaxSecurityLiveTest`, `PhpstanLevel4RegressionLiveTest`, `IcsExporterStaleEntryRegressionLiveTest`, `MyAccountRescheduleContractLiveTest`, `CalendarPreloadParityLiveTest` (calendar preload vs independent eligibility SQL; non-UTC and all-day; attribute term labels), `RequestBoundaryRegressionLiveTest`, `SanitizerBeforeParseGuardTest`, and `SseTopicContractVerificationTest` (request transport boundaries, PHP/JS SSE topic contract, FC week/day header zone).
- Breaking change - Availability: `decode_rules_from_post()` requires the unslashed POST array argument (no default); third-party save handlers must pass `wp_unslash( $_POST )`.
Removed
- `WC_Product_Appointment_Rule_Manager::get_minutes_from_rules()` remains as a compatibility shim; use `WC_Appointment_Slots_Rule_Resolver::build_minute_mask()` instead.
Improved
- Admin panel: remove Cancel from create/edit footer (close via X / backdrop).
- Admin calendar: Google-style grid (horizontal week lines only in month, stacked week/day headers, centered month dates); neutral toolbar chrome (admin body text/borders), segmented view switcher, primary + Add New beside Filters (icon-only; label on hover/aria).
- ICS export: log a warning when unloadable entries are skipped (WooCommerce → Status → Logs).
Fixed
- Admin calendar: toolbar spans full wrap width below Screen Options/Help; staff without WooCommerce header get Add New in the toolbar; staff/creator filter uses EXISTS (not INNER JOINs); Fake UTC civil preload range and `YmdHis` row parsing (not `strtotime`); shared excluded-status list (cancelled visible; holds/trash/drafts hidden) on SQL query, legacy API, and frontend; orphan/deleted `post_parent` order IDs pre-filtered before batch order load; availability rule background stripes reload when switching months.
- REST API: appointments `get_item_schema()` extends the parent schema instead of starting from null.
- Security: sanitize/unslash POST/GET at origin across storefront AJAX, data stores, cart, SSE, cron, widget, admin (AJAX, settings, calendar, list table, exporters, meta boxes, product edit), WPML, Google Calendar, and integrations; prepared SQL for lookups and migrations; escape output in admin views; guest-only rate limit preserved for cached pages with optional nonces.
- Storefront/admin AJAX: parse jQuery `.serialize()` form payloads before per-field sanitization (not `sanitize_text_field()` on the encoded string — destroys `%XX` sequences for timezones, times, and add-on text).
- SSE: preserve dotted event names (`appointment.created`) in the stream; `sanitize_key()` stripped dots and broke admin calendar live updates.
- Availability rules JSON: decode unslashed payloads first (callers pass `wp_unslash( $_POST )`); double-unslash broke rule titles containing quotes.
- Admin calendar: week/day column headers use browser-local date (not UTC parts); legacy week/day `data-time` and `calendar_day=` links use site timezone (not `gmdate`); batched order line item meta resolves global attribute term names (not raw slugs) in the appointment panel.
- Add Appointment and My Account series actions: read `REQUEST_METHOD` from `$_SERVER` (not `filter_input( INPUT_SERVER )`, unreliable under some SAPIs).
- Legacy install migration: delete product availability post meta by key after table migration (not a single rule value).
- ICS export: skip unloadable appointment entries so stale IDs do not fatal calendar generation.
Compatibility
- Requires WordPress
- 6.8
- Tested up to
- 7.1
- Requires PHP
- 7.4
Verified safe
BookingWP - #1 WordPress Appointment Booking Plugin v5.4.3 scanned clean with no security threats detected.
View full scan report