Changeset 3708267

Timestamp:

09/22/2026 11:55:32 PM (5 weeks ago)

Author:

dimafreund

Message:

Release version 2.1.5

Location:

rentsyst/trunk

Files:

• README.txt (modified) (2 diffs)
• admin/Rentsyst_Admin.php (modified) (1 diff)
• admin/components/Rentsyst_FormSearch_Widget.php (modified) (1 diff)
• admin/components/Rentsyst_Widget.php (modified) (1 diff)
• admin/js/block-booking.js (modified) (1 diff)
• includes/Rentsyst.php (modified) (4 diffs)
• includes/elementor (added)
• includes/elementor/Rentsyst_Elementor.php (added)
• includes/elementor/widgets (added)
• includes/elementor/widgets/Rentsyst_Elementor_Booking.php (added)
• includes/elementor/widgets/Rentsyst_Elementor_SearchForm.php (added)
• includes/elementor/widgets/Rentsyst_Elementor_Vehicles.php (added)
• includes/shortcodes/booking.php (modified) (2 diffs)
• rentsyst.php (modified) (2 diffs)
• site/Rentsyst_ResourceLoader.php (modified) (2 diffs)
• site/js/rentsyst-elementor-preview.js (added)
• site/partials/booking-v2.php (modified) (1 diff)
• site/partials/booking.php (modified) (1 diff)

rentsyst/trunk/README.txt

@@ -4 +4 @@
 Requires at least: 6.0
 Tested up to: 7.0.0
-Stable tag: 2.1.3
+Stable tag: 2.1.5
 Requires PHP: 7.0
 License: GPLv2 or later
@@ -126 +126 @@
 
 == Changelog ==
+Version 2.1.4 – September 22, 2026
+Fix: Design v2 bundles no longer override the global `_` (Underscore.js), which broke the Elementor editor and the WordPress media library in wp-admin.
+Fix: The frontend assets are no longer loaded on wp-admin screens that only render post content, such as SEO analysers and page builders.
+Fix: The booking and search form blocks show the widget again in the block editor instead of "Security error: invalid security token".
+New: Native Elementor widgets — RentSyst Booking, RentSyst Search Form and RentSyst Vehicles — that render and update live inside the Elementor editor.
+
 Version 2.0.123 – February 5, 2026
 Security Fix: Fixed a Broken Access Control vulnerability in the REST API endpoint (rentsyst/v1/access-token). Added origin validation to restrict access to same-site requests only, preventing unauthorized external access to the API token.

rentsyst/trunk/admin/Rentsyst_Admin.php

@@ -209 +209 @@
                         // Design v2 loads the Google Maps SDK itself with the key from the settings, or falls back to OpenStreetMap.
                         wp_enqueue_script( $this->plugin_name . '_bundle', dirname( plugin_dir_url( __FILE__ ) ) . '/resources-v2/static/js/bundle_admin_.js', [], $this->version, ['in_footer' => true] );
+                        Rentsyst_ResourceLoader::restoreUnderscore( $this->plugin_name . '_bundle' );
                 }
         }

rentsyst/trunk/admin/components/Rentsyst_FormSearch_Widget.php

@@ -209 +209 @@
                 $marginTop = $attributes['marginTop'] ?? 0;
 
+                // The iframe lands on the admin screen that checks this nonce before rendering.
                 $params = http_build_query([
-                        'params' => $settingsDynamic
+                        'params'   => $settingsDynamic,
+                        '_wpnonce' => wp_create_nonce( 'rentsyst_iframe_nonce' ),
                 ]);
 

rentsyst/trunk/admin/components/Rentsyst_Widget.php

@@ -233 +233 @@
                 $settingsDynamic = static::generateSetting($attributes);
 
+                // The iframe lands on the admin screen that checks this nonce before rendering.
                 $params = http_build_query([
-                        'params' => $settingsDynamic
+                        'params'   => $settingsDynamic,
+                        '_wpnonce' => wp_create_nonce( 'rentsyst_iframe_nonce' ),
                 ]);
 

rentsyst/trunk/admin/js/block-booking.js

@@ -12 +12 @@
                 wp.element.createElement( 'path',
                         {
-                                class: 'st0',
+                                className: 'st0',
                                 d: "M17.9,1.7c0.2,0,0.4,0.2,0.4,0.4v4.1c-1.4,0.7-2.4,2.1-2.4,3.8c0,1.7,1,3.1,2.4,3.8V18c0,0.2-0.2,0.4-0.4,0.4\n" +
                                         "                H2.1c-0.2,0-0.4-0.2-0.4-0.4v-4c1.6-0.6,2.8-2.2,2.8-4c0-1.8-1.2-3.4-2.8-4V2.1c0-0.2,0.2-0.4,0.4-0.4H17.9 M17.9,0.1H2.1\n" +

rentsyst/trunk/includes/Rentsyst.php

@@ -5 +5 @@
 use rentsyst\admin\Rentsyst_Admin;
 use rentsyst\includes\cli\Rentsyst_CLI_Command;
+use rentsyst\includes\elementor\Rentsyst_Elementor;
 use rentsyst\site\Rentsyst_Site;
 use function add_action;
@@ -80 +81 @@
                 $this->define_admin_hooks();
                 $this->load_site_components();
+                $this->load_elementor_support();
                 $this->includes();
                 $this->register_cli_commands();
@@ -148 +150 @@
                                 'methods' => 'POST',
                                 'callback' => [$plugin_admin, 'wp_rest_handler'],
+                                // The route saves the plugin settings, and the nonce the handler checks is
+                                // handed to every logged in user, so the capability has to be checked too.
+                                'permission_callback' => function () {
+                                        return current_user_can( 'manage_options' );
+                                },
                         ) );
                 } );
@@ -168 +175 @@
 
                 add_action('init', [$plugin_public, 'init']);
+
+        }
+
+        /**
+         * Native Elementor widgets and the editor glue around them.
+         * The hooks stay dormant until Elementor itself loads.
+         */
+        private function load_elementor_support() {
+
+                Rentsyst_Elementor::init();
 
         }

rentsyst/trunk/includes/shortcodes/booking.php

@@ -4 +4 @@
 use rentsyst\includes\Rentsyst_PluginSettings;
 use rentsyst\site\Rentsyst_BookingWidget;
+use rentsyst\includes\elementor\Rentsyst_Elementor;
 use rentsyst\site\Rentsyst_ResourceLoader;
 
@@ -34 +35 @@
         }
 
-        if ((!is_main_query() || !in_the_loop()) && !isset($params['force_output'])) {
+        // Elementor renders the page outside the main loop, both in the editor and when it
+        // re-renders a single widget over AJAX, so the widget itself has to stand in for the loop.
+        if ((!is_main_query() || !in_the_loop()) && !isset($params['force_output']) && !Rentsyst_Elementor::isRendering()) {
                 return 'Booking page';
         }
+
+        unset($params['force_output']);
 
         $widgetOutput = Rentsyst_BookingWidget::widget($params);

rentsyst/trunk/rentsyst.php

@@ -17 +17 @@
  * Plugin URI:        https://rentsyst.com/wp/
  * Description:       Fleet management software for car rental business.
- * Version:           2.1.3
+ * Version:           2.1.5
  * Author:            Rentsyst
  * Author URI:        https://rentsyst.com/
@@ -39 +39 @@
  */
 
-define( 'RENTSYST_VERSION', '2.1.3' );
+define( 'RENTSYST_VERSION', '2.1.5' );
 define( 'RENTSYST_PLUGIN_NAME', 'rentsyst' );
 define( 'RENTSYST_MOD', 'prod');

rentsyst/trunk/site/Rentsyst_ResourceLoader.php

@@ -26 +26 @@
         public static function registerAll()
         {
+                if(!self::isFrontendRequest()) {
+                        return false;
+                }
                 if(Rentsyst_PaymentStatusWidget::$is_display) {
                         return false;
@@ -66 +69 @@
                 if($this->isV2()) {
                         wp_enqueue_script( self::PREFIX .'bundle_front', WP_RENTSYST_PLUGIN_URL . '/resources-v2/static/js/bundle_front.js', [], $this->version, true );
+                        self::restoreUnderscore( self::PREFIX . 'bundle_front' );
                 } else {
                         wp_enqueue_script( self::PREFIX .'bundle_front', WP_RENTSYST_PLUGIN_URL . '/resources-v1/static/js/bundle_front.js', array( 'jquery' ), $this->version, true );
                 }
+        }
+
+        /**
+         * The frontend set weighs about 2 MB and has nothing to do on a wp-admin screen.
+         * Third party plugins (SEO analysers, page builders) render post content in the admin,
+         * which used to drag the whole set into wp-admin and break the Elementor editor there.
+         * The own admin screens of the plugin render the booking widget on purpose, and so does
+         * every AJAX request that returns widget markup, so both keep the assets.
+         */
+        private static function isFrontendRequest()
+        {
+                if ( ! is_admin() || wp_doing_ajax() ) {
+                        return true;
+                }
+
+                if ( isset( $_GET['rentsyst-iframe'] ) || isset( $_GET['rentsyst-iframe-v2'] ) ) {
+                        return true;
+                }
+
+                return isset( $_GET['page'] ) && strpos( sanitize_text_field( $_GET['page'] ), 'rentsyst' ) === 0;
+        }
+
+        /**
+         * Design v2 bundles embed lodash, whose UMD tail assigns window._ unconditionally
+         * (webpack exposes define.amd, so lodash takes the AMD branch). That replaces
+         * Underscore.js expected by WP core (wp-backbone, media-views) and Elementor.
+         * Put the previous _ back right after the bundle. Lodash stays in place when it
+         * took over nothing, so a page that has no Underscore keeps the global it had.
+         */
+        public static function restoreUnderscore( $handle )
+        {
+                $shim = 'if(window._&&typeof window._.noConflict==="function"&&typeof window._.pluck!=="function"){'
+                        . 'var rsLodash=window._.noConflict();'
+                        . 'if(!window._||typeof window._.pluck!=="function"){window._=rsLodash;}'
+                        . '}';
+
+                wp_add_inline_script( $handle, $shim, 'after' );
         }
 

rentsyst/trunk/site/partials/booking-v2.php

@@ -10 +10 @@
 
         window.addEventListener( "load", ( function() {
-                RentSystFrame.init( { 
-                container: document.getElementById("rentsyst_frame"),
+                var container = document.getElementById("rentsyst_frame");
+                // The Elementor editor mounts the app itself as soon as it re-renders the
+                // widget, so skip a container that already carries the app.
+                if ( ! container || container.dataset.rentsystMounted ) {
+                        return;
+                }
+                container.dataset.rentsystMounted = "1";
+                RentSystFrame.init( {
+                container: container,
                 containerClassName: "wp-rentsyst-constructor"
                 } )

rentsyst/trunk/site/partials/booking.php

@@ -6 +6 @@
 <?php
 $script = <<<JS
+window.rentsyst_settings = JSON.parse('$settings');
+(function () {
+var container = document.getElementById("rentsyst_frame");
+// The Elementor editor mounts the app itself as soon as it re-renders the
+// widget, so skip a container that already carries the app.
+if ( ! container || container.dataset.rentsystMounted ) {
+        return;
+}
+container.dataset.rentsystMounted = "1";
 RentsystFrame.init({
-container: document.getElementById("rentsyst_frame"), 
-settings: JSON.parse('$settings'),
+container: container,
+settings: window.rentsyst_settings,
 onResize: function (width, height) {},
 onAutoScroll: function (scrollVal) {}
 });
+})();
 JS;