Chauffeur Booking System 7.1 - Local Security Hardening Patch
Created from the plugin ZIP supplied for review.

IMPORTANT
---------
This is a local remediation of the supplied 7.1 codebase, not an official
QuanticaLabs release. Keep a backup and test the booking form/file attachment
flow on staging before production deployment.

SECURITY CHANGES
----------------
1. Hardened unauthenticated booking-form file uploads:
   - fail-closed extension allow-list (safe default used if DB setting is empty)
   - dangerous executable/config extensions are always denied
   - WordPress wp_check_filetype_and_ext() validation before temporary storage
   - PHP upload error, is_uploaded_file(), size and filename validation
   - server-derived MIME type; request-provided MIME type is not trusted
   - dedicated private temporary upload directory

2. Removed trust in client-supplied temporary filenames:
   - temp file identifiers, original names and MIME types are carried in an
     HMAC-signed opaque token
   - tokens expire after 24 hours
   - realpath boundary checking prevents path traversal
   - file is validated again before final attachment creation
   - wp_handle_sideload() performs the final WordPress upload operation

3. Hardened administrative AJAX actions:
   - Plugin Options save/import/demo/coupon/exchange actions now require
     edit_theme_options plus a valid nonce
   - Test Email requires edit permission for the Email Account post plus a nonce

4. Removed a custom debug write to wp-content/my-debug.log.

5. Removed unused web-accessible backup/debug artifacts from the rebuilt ZIP:
   - class/CHBS.BookingForm.class.php-backup
   - class/chbs_BookingForm.class.php-backup
   - class/CHBS.Vehicle.class.php-backup
   - class/CHBS.PriceRule.class.phpBAK
   - class/CHBS.PriceRule.class.phpBAK2
   - class/debug-chbs-output.log
   - class/booking_debug.log
   - class/111

MODIFIED ACTIVE FILES
---------------------
class/CHBS.File.class.php
class/CHBS.BookingForm.class.php
class/CHBS.BookingFormElement.class.php
class/CHBS.Plugin.class.php
class/CHBS.Coupon.class.php
class/CHBS.ExchangeRateProvider.class.php
class/CHBS.EmailAccount.class.php
class/CHBS.PriceRule.class.php
template/admin/option.php
template/admin/meta_box_email_account.php

VALIDATION PERFORMED
--------------------
- PHP syntax lint completed on the modified PHP files.
- Upload allow-list tests reject php/phtml/double-extension executable names.
- Signed upload token validates correctly and rejects a modified signature.

DEPLOYMENT
----------
Preferred: install/copy the full hardened plugin after backing up the current
plugin and database, then test:
  1. normal quote/booking flow
  2. allowed customer file attachment (e.g. PDF/JPG)
  3. blocked executable upload (e.g. .php)
  4. Plugin Options save
  5. coupon/exchange-rate admin actions if used
  6. Email Account test-email action if used

The plugin version remains 7.1 so existing custom behaviour/version-dependent
logic is not changed. An official vendor upgrade to a current supported release
is still recommended when your customisations can be migrated safely.