MYF Fleet Booking Widget
| 开发者 | myfleet |
|---|---|
| 更新时间 | 2026年7月21日 18:29 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.0 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
MYF Fleet Booking Widget adds a self-contained cab-booking widget to any page or post. Visitors search live fares and confirm bookings across four service types:
- Outstation — one-way or round trip, with per-km and daily-allowance breakdown
- Local — hourly/km packages
- One Way — point-to-point on-demand rides
- Airport — drop-to-airport or pickup-from-airport transfers, with a searchable airport/station picker
- Insert via the
[myfboen_booking]shortcode or the "MYF Fleet Booking Widget" Gutenberg block - Google Places autocomplete for pickup/drop addresses (requires your own Google Maps API key)
- Light/dark theme and accent colour, configurable from Settings → MYF Fleet Booking Widget
- All calls to the MYF Fleet API are proxied through WordPress — your API token and signing salt are stored server-side and are never sent to the browser
- No build step for the frontend or block editor scripts — pure JavaScript against WordPress core globals
安装:
- Upload the
myf-fleet-booking-widgetfolder to/wp-content/plugins/, or install the plugin ZIP through Plugins → Add New → Upload Plugin. - Activate the plugin through the Plugins screen.
- Go to Settings → MYF Fleet Booking Widget and enter your MYF API token and security salt (and, optionally, a Google Places API key).
- Add the widget to a page using the
[myfboen_booking]shortcode, or insert the "MYF Fleet Booking Widget" block from the block editor.
屏幕截图:
常见问题:
Do I need a MYF Fleet account to use this plugin?
Yes. The widget searches fares and creates bookings against the MYF Fleet API, which requires an account token and security salt.
Is my API token safe?
Yes. The token and salt are stored as WordPress options and are only ever used server-side, inside the REST proxy endpoints this plugin registers. They are never localized to JavaScript or otherwise sent to the browser.
Does this plugin work without a Google Maps API key?
The widget still functions, but address fields will not offer autocomplete suggestions — visitors must use the airport/station search (which does not require Google Maps) or type addresses manually where supported.
Can I change the widget's colours and copy?
Yes — headline, byline, customer care number, theme (light/dark) and accent colour are all configurable under Settings → MYF Fleet Booking Widget.
更新日志:
1.0.8
- Require a valid
wp_restnonce in thepermission_callbackof the/searchand/bookingproxy endpoints, so authorization is enforced at the permission layer rather than as an optional in-handler check. A missing or invalid nonce is now rejected with 403. - Add a public
GET /myfboen/v1/nonceendpoint that returns only a fresh nonce (no sensitive action) so full-page-cached pages can obtain a live nonce. The response is sent with no-store cache headers so proxies/CDNs never cache it. - Front-end now warms a fresh nonce on load and, on a 403, refreshes the nonce and retries the request once — keeping the widget working on aggressively cached sites. Requests send same-origin credentials so the nonce is always evaluated against the correct visitor.
- Declare the REST proxy endpoints (
/search,/booking) as intentionally public via__return_true, since the booking widget is used by anonymous visitors and has no user to authorize. - Move the
wp_restnonce verification into the request handlers as a best-effort CSRF check (a present-but-invalid nonce is rejected; an absent nonce is allowed so full-page-cached pages keep working).
- Centre the sheet close button icon regardless of theme button padding.
- Stop theme button hover/focus colours bleeding onto the service tabs; hover now tints the tab's own text.
- Preserve entered fields when switching Outstation One Way / Round Trip, and swap them by role when switching Airport Drop / Pickup.
- Anchor the field grid so another embed can't override the From/To column widths.
- Keep the results/booking sheet overlays edge-to-edge even when another embed on the page defines a generic
.myfbmax-width.
- Scope all front-end DOM lookups to the widget's own root so a duplicate widget or a same-id element elsewhere on the page can no longer hijack the results sheet.
- Enqueue the widget config and admin styles via WordPress functions instead of inline tags.
- Prefix all declarations, globals, options, and the REST namespace with
myfboen. - Add full-width support (block "Full width" alignment and
[myfboen_booking full_width="1"]). - Harden front-end CSS against theme/plugin interference.
- Initial release.