Mytsys Travel Itinerary Planner

Changelog

1.9.5

• Fix: the Availability Manager calendar stayed on “Loading…”. Its request was refused because it carried the admin security token, which the calendar endpoint did not accept.
• Fix: the trip title was missing from trip pages on most themes. It is now shown, except on Avada, whose page title bar already prints it. The mtipl_show_trip_title filter still overrides this.
• Fix: with four photos, the gallery strip on the trip page left an empty gap.
• The review form on trip pages is now styled to match the trip page in light and dark schemes, with a clickable star rating.
• Admin dashboard cards use WordPress Dashicons instead of emoji, and dates without a set departure no longer read “- left” in the calendar.

1.9.4

• Trips with no price set keep the full Trip Cost Estimator. Visitors choose a date, length and travellers, then enter their details, as on a priced trip. Every amount reads “On request”, and the last step, “Send request”, sends a quote request instead of taking a payment.
• The quote request is stored as an enquiry with the date, travellers, length, contact details and notes already filled in, and the usual enquiry email goes to the site. No booking is created and nothing is charged.
• The spam trap and the one-request-per-minute limit are shared with the enquiry form. The new mtipl_quote_requested action fires after each request.
• The trip length in the booking summary now reads “1 day” / “7 days” correctly.
• A failed security check on the booking, enquiry or balance form now returns 403 Forbidden instead of 500.

1.9.3

• Fix: the vendor dashboard, booking confirmation, My Bookings, balance payment, reviews, wishlist, enquiry form and promo code field had no styling of their own and showed as plain text on many themes. They are now fully styled from the site’s design colours, in light and dark.
• Vendor dashboard redesigned: summary cards, tabbed navigation, trip cards with cover photos, bookings tables and a two-column profile form; revenue is shown in the trips’ own currency.
• Trips with no price set now show “Price on request” with the quote form open, instead of a 0.00 estimator. A booking at 0.00 is refused.

1.9.2

• New: Photos tab in the trip editor, second after General: choose the cover image and add, remove and drag to reorder gallery photos.
• Fix: trips always have a featured (cover) image box, even with themes that switch featured images on only for posts and pages.
• Fix: the trip page showed only the first gallery photo. It now shows the cover image and every gallery photo, in the order you set, and clicking a photo opens a full-screen viewer with arrow-key navigation.
• Trip cards use the first gallery photo when a trip has no cover image.
• Trips open in the classic editor so the whole Trip Data panel is in view. Return true from the mtipl_trip_block_editor filter to keep the block editor.

1.9.1

• The bundled FPDF library is renamed MTIPL_FPDF and declared only when absent, so it cannot clash with another plugin’s copy.
• Every posted array (itinerary days, pricing, departures, extras, FAQs, travellers) is sanitised where it is read; enquiry fields are read and sanitised one by one.
• Payment returns from Stripe and PayPal must carry a WordPress nonce and a signature bound to the booking before anything is read or changed.
• Stripe webhook events are verified against the Stripe-Signature header, then sanitised in full before any field is used.
• The vendor dashboard refuses submissions without a valid nonce or the vendor role with HTTP 403.
• Every review, signed in or not, must come from the site’s own form.
• Custom font families and colours are validated before they are printed in CSS.
• Trip lists are printed through wp_kses(); block-theme headers and footers through core’s block_template_part().
• Database queries name their tables directly instead of through an ignore annotation; the calendar feed is plain text escaped with esc_html().

1.9.0

• Renamed to Mytsys Travel Itinerary Planner (slug mytsys-travel-itinerary-planner). Every function, class, constant, option, hook, post type, taxonomy, table, shortcode, nonce and script handle now uses the mtipl_ / MTIPL_ prefix.
• All admin JavaScript is loaded through wp_enqueue_script(); no inline script tags or inline event handlers remain.
• Structured data is printed through wp_print_inline_script_tag() with tag-safe JSON encoding.
• Every registered setting has its own explicit sanitize callback.
• Stripe and PayPal responses are validated field by field before use.
• Page templates are rendered inside a method, so none of their variables are global.
• Translations load through WordPress.org language packs; load_plugin_textdomain() is no longer called.

1.8.3

• Fix: card and PayPal checkout sent customers to wp-admin instead of Stripe or PayPal. The payment hosts are now allowed redirect targets.
• Fix: the itinerary PDF download works (bundled FPDF 1.9, accented names, page numbers, site colours).
• Fix: fresh installs no longer return 404 on trip pages until permalinks are re-saved.
• Fix: updates take effect on the next request of any kind, not only after someone opens wp-admin.
• Fix: “Remove demo data” no longer deletes the Booking Confirmation and My Bookings pages or any page of your own; missing pages are recreated on update.
• Fix: trip pages keep the site header and footer on block themes.
• Fix: apostrophes are stored without added backslashes (itinerary, extras, vendor profiles, enquiries, bookings).
• Fix: the Bookings link in the trip list opens that trip’s bookings.
• Fix: reviews have a form again, with a nonce for logged-in reviewers.
• Fix: promo code dates are stored correctly, duplicates are reported, and negative values are refused.
• Security: payment return and cancel links are signed, so a cancel link cannot release another booking’s seats.
• Security: Stripe webhooks accept rotated secrets, reject replays, and record each payment once even under concurrent delivery.
• Security: promo code checks are rate limited; traveller rows are capped at the booking’s party size.
• Security: draft and private trips cannot be booked, reviewed or wishlisted by editing a form.
• Security: itinerary days and extras can only be edited on the trip they belong to.
• Security: every public AJAX endpoint answers only for published trips; email templates are rendered from a fixed list, without extract().
• Security: deleting the plugin always removes stored payment keys and secrets; everything else is removed only if you tick Trips → Booking & Tax → Delete all data.
• Fix: activation brings every table to the current structure; cancelling returns seats exactly once, atomically.
• Tested on WordPress 5.8 and 7.1 with PHP 8.4, on block and classic themes.

1.8.2

• Trip pages are prefetched on hover, so the flight transition lands on a page that is already loading.
• Boarding-pass overlay during the transition.

1.8.0

• Trips listing rebuilt: cards render on the server, with nine layouts (Grid, List, Timeline, Masonry, Magazine, Carousel, Compact, Postcard, Mosaic).
• Listing prices come from the quote engine, so category and sale pricing show correctly.

1.7.5

• Wine palette, and a Design screen that shows the colours actually reaching the front end.

1.7.3

• Trips without fixed departures can be booked on any date; travel dates are validated on the server.

1.7.0

• Departures with their own length and price; three-step booking form.

1.3.0

• Traveller categories, extras, deposits, enquiries, reviews, FAQ, iCal sync, webhooks, structured data.

1.0.0

• Initial release.