Download
A new Easy!Appointments maintenance release is available for download, providing bug fixes and improvements to the previous release.
If you are already using a previous version, you just need to replace your existing files with the new ones (except from the root config.php), as no database migrations need to be executed.
Improvements
This release features many improvements and corrections to the 1.5 release, which was the biggest, Easy!Appointments release ever.
Changelog
Added
- A CalDAV section under Settings / Integrations, where the connection URLs that may point into the local network
are listed - The calendar page now explains why a CalDAV synchronization failed and what has to be corrected, instead of only
reporting that it did - Connecting to a CalDAV server on a local network now offers to allow its host right in the connection dialog,
instead of requiring a trip to the settings; the host is only remembered once the connection actually works
Changed
- Changing the password in the account settings page now requires the current password, so that a stolen session
alone cannot be used to take over the account - The CORS origins and the cookie SameSite policy are now set in application/config/routes.php and
application/config/config.php, instead of the root config.php, which keeps only the installation settings - The release build now falls back to running Composer inside the php-fpm container, so a Composer installation on
the host machine is no longer required - The release package no longer includes stylesheet sources, dependency development files and unused images, which
makes the download smaller
Fixed
- Removing every provider from a service on the services page is now saved, instead of silently keeping the previous
provider assignments (#1965) - The asset and release build no longer fails with permission errors on the files that the Docker containers create
in the project directory - A failing Google Calendar synchronization no longer removes the local appointments of the sync period, so an
expired token, a quota limit or an unreachable API only interrupts the sync - Appointment notes are no longer overwritten with the generated provider and customer details block on every
CalDAV synchronization - CalDAV events that are stored under an address that does not match their UID are now found, so events created in
a calendar client are no longer removed and imported again on every synchronization - Synchronizing one provider no longer removes the imported recurring CalDAV events of the other providers
- Moving an appointment to another provider now removes the event from the calendars of the previous provider
- The CalDAV synchronization period is now requested in UTC, so events at the edges of the period are no longer
left out on installations that do not run in UTC - Google Calendar and CalDAV are now synchronized independently, so a failure of one of them no longer skips the
other - The Google Calendar synchronization now fails with a clear error when the provider has no refresh token stored
- Security: The Google Calendar API requests now verify the TLS certificate of the remote endpoint
- Security: CalDAV connections no longer follow redirects or server links to other hosts, and no longer reach
private addresses through IPv6 transition addresses or a DNS answer that changes after the check - HTML texts, such as the privacy policy and the terms & conditions, are now purified with a cache directory
inside storage/cache, so installations with a read-only vendor directory no longer fail with a write error - The list of Google Calendars of a provider is no longer readable without permission, so only that provider or a
user who may edit providers can fetch it - Searching the LDAP directory now escapes the keyword, so a search term can no longer alter the LDAP filter
- Webhooks created or edited through the REST API can now set their secret header, so the secret token is sent
with the request as it already is for webhooks configured in the backend - Security: Updated the Guzzle HTTP client and the phpseclib library to their patched releases, fixing outbound
request and certificate handling advisories that affected the webhook, CalDAV and Google Calendar integrations - Editing a working plan exception now updates the existing entry, instead of adding a duplicate one next to it
(#1958) - Google Calendar events marked as “Free” no longer block booking, so all-day events and birthdays stay bookable (#1945)
- CalDAV Calendar events marked as free (TRANSP:TRANSPARENT) no longer block booking (#1945)
- Providers and secretaries can no longer overwrite or reassign the appointments and unavailabilities of other providers
- Requests with invalid parameters now respond with a “bad request” status instead of a server error
- Services can no longer be saved with a negative price or with a slot interval of zero
- The price, slot interval and attendants number of a service are now checked before the form is submitted
- Show a message with the affected days when the working plan of a provider has an invalid time range
- Ask for a confirmation when an unavailability is placed over an already booked appointment
- The appointment dialog now validates the phone number, just like the booking page does
- Timezone labels display the offset that is currently in effect, also during daylight saving time
- The timezone list no longer contains duplicate names, deprecated entries or malformed offsets
- When saving an appointment, the scheduling conflict is now confirmed before the notification question
- The scheduling conflict dialog of a new appointment is not titled “Appointment Update” anymore
- Show a message on the booking page when no service or provider has been selected yet
- The appointment dialog scrolls to its validation message and clears invalid fields while typing
- Fix the “Start date value is latter than end date.” and “The operation could not completed.” messages
- Security: The CalDAV and Google Calendar sync settings of a provider can no longer be reached without logging
in first - Security: CalDAV URLs that point into the local network are rejected again, unless the host is listed in the new
CalDAV integration settings - Security: The CAPTCHA can no longer be skipped by leaving the field out of the login, recovery or booking request
- Security: Login attempts are throttled again, so repeated wrong passwords are blocked as intended
- Security: Stop unauthorized users from taking over or changing other people’s appointments
- Security: Block unsafe links in the online meeting field so they cannot run code on the calendar
- Security: Stop the calendar from returning the Google Calendar tokens and CalDAV passwords of providers to
secretary accounts - Security: Stop the user management pages from returning the calendar sync tokens, CalDAV passwords and password
reset tokens of other accounts - When rescheduling an appointment, its date and time are selected again by default (#1940)
- Rescheduling an appointment can be saved again, instead of failing with an appointment hash error
- Show the cancel appointment text and button on a single line with even spacing
- Fix the automated test setup
- The provider and secretary “Mobile” number is now saved when you create or edit them
- Fix a booking error that appeared when the booking page was embedded on another website
- Fix a language switch error when the booking page was embedded on another website
- The booking page now works when embedded on other websites
- Show a clear message when the database needs to be updated, instead of a confusing error
- Fix the month switching on the booking calendar (#1862)
- Show appointment notes correctly in email notifications (#1881)
- Google Meet link is created but never stored in appointments.meeting_link (#1947)
- Security: Protected settings, such as the API token, can no longer be read or changed through the REST API by
writing their name in a different letter case - Security: An ID in the body of a REST API update request no longer redirects the update to another record, such
as an administrator account, than the one in the URL - Security: Saving or deleting a provider, secretary or admin now only affects users of that role, so an
administrator account can no longer be overwritten or deleted, or a role changed, through another user type - Security: A new booking can no longer be placed on an already booked time slot by sending the ID of the existing
appointment along with the booking request - Security: With limited customer access, providers and secretaries can no longer edit or book appointments for
customers they have no appointments with through the calendar page - Enabling ALTCHA without generating an HMAC key no longer rejects every login and booking, the key is now created
and stored on first use - The customer data retention cleanup now removes inactive customers again, instead of removing none of them
whenever an unavailability ends after the retention cutoff - Two short blocked periods on the same day no longer hide all the available hours of that day on the booking page
- Services with multiple attendants no longer offer a time slot that contains a shorter appointment of the same
provider, which led to double bookings - Security: A solved CAPTCHA image is now only valid for one attempt, so it can no longer be reused for repeated
login, password recovery or booking requests
Going Premium
Did you read this article, but you’re still not sure on how to proceed?
Reach out to info@easyappointments.org and have an expert take care of everything for you in zero time.
Get your free quote and get started now!
