Rentiva v5.2.0 / Pro v5.2.0 — Seventeen security switches that did nothing, and the ones that now do

The largest release in the 5.x line so far. Permission checks now test the specific record a request names instead of a general capability, the admin markup is filtered as it is printed, the Dashboard and Vehicle Settings screens are redesigned — and a long list of controls that claimed to do something, but were connected to nothing, has been removed.

The uncomfortable part first

Settings → Security had seventeen controls: "Brute Force Protection", "SQL Injection Protection", "XSS Protection", "CSRF Protection", "Enable Rate Limiting", IP allow and block lists. None of them were wired to anything. Switching one on changed no behaviour whatsoever.

They are gone. So is the "Secure API Access Tokens" section, which issued keys labelled READ, WRITE and ADMIN that no part of the plugin ever checked — a key created there opened nothing. So are the Integration settings for token duration, token refresh, API caching, debug output and "Allow Global CORS". So is a "Scheduled Notifications" background job that ran every hour against a queue nothing ever added to, while the Cron Monitor cheerfully reported it as healthy. And so is the "Add Vehicle" button in the vehicle comparison: no handler, unregistered endpoints, and an Elementor switch to toggle a thing that did not exist.

A control that says a protection is active while nothing enforces it is worse than no control at all, because it gets relied on. Saved values for the removed settings are cleaned up automatically when you update.

Rate limiting, which does work, stays. The REST API is unchanged and still authenticates normally.

Permissions now check the record, not just the role

Booking, deposit, vehicle-gallery and blocked-date handlers used to check a general "can edit content" capability. They now check the caller against the specific record the request names. On multi-author sites this closes paths where one contributor could act on another contributor's bookings, galleries or availability.

Saving a booking from the editor now always requires a valid security token; the presence of a form field is no longer accepted in its place. The database backup screen exports, restores and deletes only backup tables this plugin created — other tables can no longer be named in those requests. And markup the plugin generates is filtered through an explicit allowlist as it is printed, replacing places that trusted the output to have been escaped earlier.

Fixes worth naming

• Uninstall used to stop partway through. With "delete all data on uninstall" switched on, removing the plugin still left tables, scheduled jobs and taxonomy terms behind.
• The backups screen could go blank. Any .sql file in the backup folder without a matching database record caused a fatal error while the list was being built. Backups are now written under your uploads folder instead of directly into wp-content; backups taken by earlier versions stay listed, restorable and deletable — nothing is moved or lost.
• Vehicle quick edit accepted values the full editor rejects. A daily price could be saved as a negative number, which then multiplied into rental totals; the seat count could be zero or above the configured maximum.
• Log retention settings were ignored. "Auto Cleanup Logs" and "Log Retention (Days)" had no effect: the daily purge always deleted entries older than thirty days, permanently, even with cleanup switched off or retention set higher.
• Saving the Vehicle settings tab silently reset two Frontend fields — "Vehicles per page" and "Default sort order" — that the Vehicle tab does not even display.
• The dashboard's recent-bookings panel could sit up to twelve hours out of date, because its cache was cleared under a name the cache no longer used. The customers screen re-ran its full query set on every load for the mirror-image reason: it requested a cache type that had never been registered, so nothing was stored or read.
• Search could be asked to render the whole fleet. Vehicle search accepted any page size; search and testimonials now cap it at the limit their own settings advertise.
• The translation catalogue now compiles without errors — strings containing placeholders like %days% were being mis-flagged as printf formats.

New: redesigned Dashboard and Vehicle Settings

Both screens have been rebuilt. Vehicle Settings opens in the new layout by default; adding ?ui=legacy to the page URL brings back the previous one for this release.

Internal

Temporary cache entries, the last-login record, background job names and the JavaScript objects the admin screens read now all carry the plugin's own prefix, so they cannot collide with another plugin storing something under the same name. Every script and stylesheet is registered under its full prefix too — WordPress keeps whichever was registered first under a shared short name and discards the other without warning.

Around 2,000 lines of code that nothing referenced were removed, including a file registering database-maintenance commands and one that would have exposed protected vehicle and booking fields over the REST API had it ever been switched on.

Upgrading

No action required. Administrators are unaffected by the permission changes; on sites with editor or author roles, those users can now only act on records they are entitled to. Settings belonging to the removed controls are cleaned up for you.