=== Bingo Car Rental ===
Contributors: bitsworld, freemius
Tags: car rental, booking, fleet management, reservations, vehicle rental
Requires at least: 6.0
Tested up to: 7.0
Stable tag: 1.0.59
Requires PHP: 8.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Car rental booking system for WordPress. Manage your fleet, reservations and pricing from your own WordPress admin.

== Description ==

Bingo Car Rental is a self-contained car rental management plugin for WordPress. Install it on any WordPress site and you immediately get:

* **Fleet management** — Add cars with photos (from the WP media library), specs, categories and daily pricing
* **Online booking widget** — Drop the `[bingocr_rental]` shortcode on any page; visitors search by date, browse available cars and book without leaving your site
* **Reservation dashboard** — View, confirm, update and manage all reservations from the WordPress admin
* **Locations** — Define pickup and drop-off locations with addresses
* **Seasonal pricing** — Adjust nightly rates by percentage for date ranges (high season, low season, etc.)
* **Duration pricing** — Set different nightly rates or fixed totals for short vs. long rentals
* **Pay-on-site methods** — Accept cash on pickup, card on pickup and bank transfer; configure which methods are active
* **Email notifications** — Automatic confirmation emails to customers and admins on booking and status change
* **Multilingual** — Built-in English and Romanian; add more languages via standard WordPress `.po/.mo` files

No booking fees. Reservation data stays in your own WordPress database.

**Pro version**

A separate Pro plugin (BingoCR Business) adds extras/add-ons at checkout, discount codes, online PayPal payments and out-of-hours fees. See [bingorentals.com](https://bingorentals.com) for details.

== Installation ==

1. Upload the `bingocar` folder to `/wp-content/plugins/`.
2. Activate the plugin through the **Plugins** menu in WordPress.
3. Go to **BingoCR → Settings** to configure your company name, currency and email options.
4. Go to **BingoCR → Fleet** to add your cars.
5. Add the shortcode `[bingocr_rental]` to any page where you want the booking widget to appear.

== Shortcode Options ==

`[bingocr_rental show_locations="true" show_categories="true" theme="light"]`

* `show_locations` — Show pickup/drop-off location dropdowns. Default: `true`
* `show_categories` — Show category filter tabs. Default: `true`
* `theme` — `light` or `dark`. Defaults to the value set in BingoCR → Settings.
* `primary_color` — Override the primary accent color, e.g. `#e63946`.

== External Services ==

This plugin can connect to the following third-party services. Each is optional and only active under the conditions described.

**1. ipapi.co — Visitor geolocation for automatic language detection**

Used *only* when **Auto-detect visitor language** is enabled in BingoCR → Settings → Display (disabled by default).

When enabled, the visitor's public IP address is sent to ipapi.co to detect their country and switch the booking widget language automatically.

* Data sent: visitor IP address
* When: on page load, only when auto-detect is enabled
* Service: [ipapi.co](https://ipapi.co)
* Terms of Service: https://ipapi.co/terms/
* Privacy Policy: https://ipapi.co/privacy/

**2. Freemius — Software updates and optional usage diagnostics**

This plugin uses the Freemius SDK for software update delivery and optional anonymous diagnostics. Freemius asks for explicit administrator opt-in before any non-essential data is collected; you can decline without affecting plugin functionality.

* Data sent: site URL, WordPress/PHP environment info and, after opt-in only, anonymous usage diagnostics
* When: on plugin activation (opt-in prompt) and during update checks
* Service: [Freemius](https://freemius.com)
* Terms of Service: https://freemius.com/terms/
* Privacy Policy: https://freemius.com/privacy/

== Frequently Asked Questions ==

= Does this plugin require an account or subscription? =

No. The free plugin has no account requirement. Freemius presents an opt-in prompt on activation for anonymous diagnostics — you can decline and the plugin works fully.

= What payment methods can customers use? =

The free plugin supports pay-on-site methods: cash on pickup, card on pickup and bank transfer. You choose which are active under BingoCR → Payment. Online payments (PayPal) are available in the Pro version.

= Can I use dark mode or a custom brand color? =

Yes, both are available in the free version. Set them under BingoCR → Settings → Display.

= How do I show a "Powered by BingoCR" credit? =

Go to **BingoCR → Settings → Display** and enable **Show attribution**. It is never shown without explicit opt-in.

= Is the booking form translated? =

The widget ships with English and Romanian. Add more languages via a standard `.po/.mo` file in the `languages` folder.

= What PHP version is required? =

PHP 8.1 or higher. The plugin uses named arguments and typed properties introduced in PHP 8.0/8.1.

== Screenshots ==

1. Frontend booking widget
2. Available cars grid
3. Booking form
4. Admin — Reservations list
5. Admin — Fleet management
6. Admin — Settings

== Changelog ==

= 1.0.59 =
* Compliance: extras and discount-code management (admin create/edit/delete, plus the customer-facing extras list and discount validation) are now physically excluded from the free plugin rather than present-but-license-gated. PayPal order create/capture/webhook moved the same way. All three remain available in the separate Pro plugin.
* Security: removed an unused, weakly-authenticated reservation lookup endpoint (email-match against a numeric ID) that had no frontend caller. A proper token-based self-service lookup is planned as part of a future customer account feature.
* Security: the PayPal order-create request now also verifies the submitted customer email matches the reservation before creating an order, closing a gap where a valid nonce alone was enough to act on an arbitrary reservation ID.

= 1.0.58 =
* Updated readme to accurately describe free plugin features; removed references to Pro-only functionality (extras, discount codes, PayPal) from the free plugin description.

= 1.0.57 =
* Compliance: removed all plan gates from features present in the free build. Dark theme, custom brand color and pay-on-site methods (cash, card, bank transfer) are now fully available without a Pro licence. Car and location counts are unlimited. Admin upsell panels for absent Pro features (out-of-hours fee, PayPal) now point to the separate Pro plugin rather than showing disabled controls.

= 1.0.56 =
* Fixed: PayPal card payment fields are now fully reachable. The PayPal buttons (including the inline card form) have been moved into the scrollable section of the booking modal so users can scroll to fill in card details without the form being cut off.

= 1.0.55 =
* Fixed: the pricing/calculate endpoint now validates the full date range (return after pickup, no past dates, min/max rental length) before computing a quote, matching the validation already enforced at reservation creation.

= 1.0.54 =
* Security: PayPal now verifies the captured amount and currency against the booking before marking it paid. Concurrent bookings of the same car fail closed with a brief retry message for stricter overbooking protection. Restored .distignore.

= 1.0.53 =
* Security hardening: the PayPal webhook always re-verifies the capture with PayPal and resolves the booking from authoritative PayPal data; reservation creation fully validates the date range; concurrent bookings are serialised with a per-car lock; security deposit is recomputed server-side; plugin degrades cleanly if the Freemius SDK folder is missing.

= 1.0.52 =
* Fixed: extras and discount are only recorded on a reservation when the Pro pricing code is present, keeping the stored record consistent with the server-calculated total.

= 1.0.51 =
* The Extras and Discount Codes admin sections now show a clear upgrade panel on the free plan instead of an editor that stored data which never took effect.

= 1.0.50 =
* Security: reservation totals are recomputed server-side at booking time instead of trusting the price submitted by the browser.

= 1.0.49 =
* Added PayPal webhook receiver so payments are reconciled even if the customer's browser drops the response after paying.

= 1.0.48 =
* Security: PayPal client secret is now encrypted at rest (AES-256-GCM).

= 1.0.47 =
* Fixed premium code stripping: renamed premium-only files with the Freemius `__premium_only` suffix so they are reliably excluded from the free build.

= 1.0.44 =
* WordPress.org review prep: documented external services in readme; uninstall now also drops the payments table.

= 1.0.43 =
* Security: removed license override shortcuts from is_pro(); plan status is now determined solely by Freemius.

= 1.0.38 =
* Attribution ("Powered by") is now strictly opt-in for everyone and is never forced on the free plan.

= 1.0.1 =
* Renamed plugin to comply with WordPress.org trademark guidelines; fixed coding standards; added languages directory.

= 1.0.0 =
* Initial release.
