| 开发者 | maxhandmade |
|---|---|
| 更新时间 | 2026年10月25日 03:42 |
| PHP版本: | 8.1 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
mhm-rentiva/v1 for availability checks, customer records and admin dashboard data.wp-content/uploads/mhm-rentiva-private/contact/) under a random name with no file extension. They are not encrypted. On Apache the folder ships with an .htaccess that denies direct access; on nginx you must add a location ^~ /wp-content/uploads/mhm-rentiva-private/ { deny all; } rule yourself, otherwise the only protection is the unguessable name and the folder's empty index page. If you use a plugin that copies every upload to external storage (a CDN or cloud offload plugin), exclude the mhm-rentiva-private folder in its settings, or it may copy these files as well — or, if it moves files away from your server, contact attachments may fail to upload. The file is deleted when the message is permanently deleted, and when the plugin is deleted with its "Wipe all data on uninstall" setting turned on. On a multisite network that wipe covers the main site only: delete the other sites' mhm-rentiva-private/contact/ folders by hand. A copy is also sent as an attachment of the notification e-mail, which this plugin does not control once sent. Attachments saved by earlier versions were public files in the normal uploads folder; updating moves those it can positively identify into the private folder and lists the rest in an admin notice.
If you publish the plugin's rating form, each review is stored as an ordinary WordPress comment, so WordPress itself records the reviewer's IP address and browser user-agent alongside it, exactly as it does for any comment — and for a review left by someone who is not logged in, the name and e-mail address they typed. Those guest reviews are reachable through Tools → Export/Erase Personal Data, which matches comments by e-mail address. From version 6.0.1, a review left by a logged-in customer is saved the same way WordPress saves any comment from a signed-in visitor: against their user ID, and with the display name, e-mail address and website address from their profile written onto the comment. Those reviews are matched by the same Export/Erase tools, on the account's e-mail address. Reviews that logged-in customers left in earlier versions carry no name and no e-mail address on the comment, and updating does not fill them in, so the Export/Erase tools — which look comments up by e-mail address — do not return those older ones; remove them from the Comments screen instead.
The activity log records, for each entry, the IP address and browser user-agent of the request that produced it, along with the WordPress user ID where there is one. Unlike contact messages, log entries are deleted automatically after a retention period you set in the plugin's settings (30 days by default).
The e-mail log records, for each message sent through the plugin's notification system, the recipient address, the subject, whether delivery succeeded, and the booking details the message was built from — which for a booking e-mail means the customer's name, contact details and rental dates. The assembled message body itself is not stored. This log has its own retention setting on the same terms (also 30 days by default).
Booking records themselves do not store an IP address: no code path in this version writes one, whether the booking comes through WooCommerce checkout or an administrator enters it by hand. Records created by older versions may still carry an IP address and user-agent; where they exist they have no expiry and go only when the booking is permanently deleted.
If you keep a privacy policy, these are the parts of the plugin it should describe.
The plugin registers no personal-data exporter or eraser. Contact-form submissions are not covered by Tools → Export/Erase Personal Data: search for them by e-mail address under MHM Rentiva → Contact Messages and delete them there.
A paid version exists
A separate paid Rentiva plugin adds a multi-vendor marketplace, VIP transfers with location-based routes, customer messaging, advanced reports and vendor payouts. It is a separate add-on plugin. Nothing described on this page is withheld or limited to promote it, and this plugin never advertises it to you in the admin.
/wp-content/plugins/mhm-rentiva directory, or install the plugin through the WordPress plugins screen directly.It requires it. WooCommerce handles frontend checkout and payment, so your existing payment gateways work as they are, and the plugin will not activate without it. Bookings an administrator creates by hand can still be settled offline, without going through checkout.
Absolutely. You can add, rename, or remove custom features and equipment via the Vehicle Settings page.
No. There are no caps of any kind.
No. It makes no third-party requests at all — see the "External services" section above.
Yes, all frontend components and admin settings are fully responsive.
Yes, and it can be network-activated. One limit is worth knowing before you plan around it: the parts that manage WordPress user accounts -- the Customers screens and creating a customer account from a booking -- require a Super Admin. WordPress itself reserves user management for the network level on multisite, so a site administrator will not see those screens even though they can use everything else. Vehicles, bookings, add-ons, payments and all frontend features work normally for a site administrator.
Gutenberg and Elementor, plus plain shortcodes for any other theme or builder. All three render identical output.
By default the plugin routes wp-login.php to your WooCommerce My Account page, so customers meet one
login form styled like the rest of your site rather than the plain WordPress one. It deliberately steps
aside where the real form is needed: submitting the login form itself, logging out, password reset and
lost-password links, e-mail confirmation links, anyone who can manage plugins, and any site where
WooCommerce is inactive.
If you would rather keep the standard WordPress login page, add this to your theme's functions.php or a
small plugin of your own:
add_filter( 'mhmrentiva_takeover_login', '__return_false' );
The default is true. The filter is read while the plugin sets up its hooks, on the init action at
priority 2, so add it somewhere that runs before then — a theme's functions.php or an ordinary plugin
file is early enough.
By default, no — and this is worth fixing. The plugin's anonymous rate limits (contact form submissions,
price and availability lookups on the booking form, and others) are counted per visitor IP address, read
from the server's REMOTE_ADDR. Behind Cloudflare or any reverse proxy, REMOTE_ADDR is the proxy's own
edge IP, the same for every visitor — so instead of limiting each visitor separately, the plugin
effectively limits your whole site to one shared bucket (for example, the contact form's default of 5
submissions per 5 minutes becomes 5 submissions per 5 minutes for every visitor combined).
This default is intentional, not an oversight: trusting a header like X-Forwarded-For automatically
would let anyone bypass rate limiting outright, since that header can be set by any visitor unless your
proxy is configured to overwrite it. If you know your proxy overwrites it — which Cloudflare does — you
can opt the specific header back in:
add_filter( 'mhmrentiva_trusted_proxy_ip_headers', function () { return array( 'HTTP_CF_CONNECTING_IP' ); // Cloudflare } );
Add this to your theme's functions.php or a small plugin of your own. List headers in priority order —
the plugin uses the first one present that holds a valid public IP address, falling back to REMOTE_ADDR
if none match. Only add a header your proxy is actually configured to set and protect; adding one that
ordinary visitors can also send re-opens the bypass this default closes.