1.6.1-beta.1

Easy!Appointments is a self-hosted, open source web scheduler application that is very easy to set up on your server.

This is a pre-release, please report any issues directly on GitHub so that they are solved before the final release.

https://easyappointments.org

Release Notes

Added

• A CalDAV section under Settings / Integrations, where the connection URLs that may point into the local network are listed
• The calendar page now explains why a CalDAV synchronization failed and what has to be corrected, instead of only reporting that it did
• Connecting to a CalDAV server on a local network now offers to allow its host right in the connection dialog, instead of requiring a trip to the settings

Changed

• The CORS origins and the cookie SameSite policy are now set in application/config/routes.php and application/config/config.php, instead of the root config.php, which keeps only the installation settings
• The release build now falls back to running Composer inside the php-fpm container, so a Composer installation on the host machine is no longer required
• The release package no longer includes stylesheet sources, dependency development files and unused images, which makes the download smaller

Fixed

• The asset and release build no longer fails with permission errors on the files that the Docker containers create in the project directory
• A failing Google Calendar synchronization no longer removes the local appointments of the sync period, so an expired token, a quota limit or an unreachable API only interrupts the sync
• Appointment notes are no longer overwritten with the generated provider and customer details block on every CalDAV synchronization
• CalDAV events that are stored under an address that does not match their UID are now found, so events created in a calendar client are no longer removed and imported again on every synchronization
• Synchronizing one provider no longer removes the imported recurring CalDAV events of the other providers
• Moving an appointment to another provider now removes the event from the calendars of the previous provider
• The CalDAV synchronization period is now requested in UTC, so events at the edges of the period are no longer left out on installations that do not run in UTC
• Google Calendar and CalDAV are now synchronized independently, so a failure of one of them no longer skips the other
• The Google Calendar synchronization now fails with a clear error when the provider has no refresh token stored
• Security: The Google Calendar API requests now verify the TLS certificate of the remote endpoint
• HTML texts, such as the privacy policy and the terms & conditions, are now purified with a cache directory inside storage/cache, so installations with a read-only vendor directory no longer fail with a write error
• The list of Google Calendars of a provider is no longer readable without permission, so only that provider or a user who may edit providers can fetch it
• Searching the LDAP directory now escapes the keyword, so a search term can no longer alter the LDAP filter
• Webhooks created or edited through the REST API can now set their secret header, so the secret token is sent with the request as it already is for webhooks configured in the backend
• Security: Updated the Guzzle HTTP client and the phpseclib library to their patched releases, fixing outbound request and certificate handling advisories that affected the webhook, CalDAV and Google Calendar integrations
• Editing a working plan exception now updates the existing entry, instead of adding a duplicate one next to it (#1958)
• Google Calendar events marked as "Free" no longer block booking, so all-day events and birthdays stay bookable (#1945)
• CalDAV Calendar events marked as free (TRANSP:TRANSPARENT) no longer block booking (#1945)
• Providers and secretaries can no longer overwrite or reassign the appointments and unavailabilities of other providers
• Requests with invalid parameters now respond with a "bad request" status instead of a server error
• Services can no longer be saved with a negative price or with a slot interval of zero
• The price, slot interval and attendants number of a service are now checked before the form is submitted
• Show a message with the affected days when the working plan of a provider has an invalid time range
• Ask for a confirmation when an unavailability is placed over an already booked appointment
• The appointment dialog now validates the phone number, just like the booking page does
• Timezone labels display the offset that is currently in effect, also during daylight saving time
• The timezone list no longer contains duplicate names, deprecated entries or malformed offsets
• When saving an appointment, the scheduling conflict is now confirmed before the notification question
• The scheduling conflict dialog of a new appointment is not titled "Appointment Update" anymore
• Show a message on the booking page when no service or provider has been selected yet
• The appointment dialog scrolls to its validation message and clears invalid fields while typing
• Fix the "Start date value is latter than end date." and "The operation could not completed." messages
• Security: The CalDAV and Google Calendar sync settings of a provider can no longer be reached without logging in first
• Security: CalDAV URLs that point into the local network are rejected again, unless the host is listed in the new CalDAV integration settings
• Security: The CAPTCHA can no longer be skipped by leaving the field out of the login, recovery or booking request
• Security: Login attempts are throttled again, so repeated wrong passwords are blocked as intended
• Security: Stop unauthorized users from taking over or changing other people's appointments
• Security: Block unsafe links in the online meeting field so they cannot run code on the calendar
• Security: Stop the calendar from returning the Google Calendar tokens and CalDAV passwords of providers to secretary accounts
• Security: Stop the user management pages from returning the calendar sync tokens, CalDAV passwords and password reset tokens of other accounts
• When rescheduling an appointment, its date and time are selected again by default (#1940)
• Rescheduling an appointment can be saved again, instead of failing with an appointment hash error
• Show the cancel appointment text and button on a single line with even spacing
• Fix the automated test setup
• The provider and secretary "Mobile" number is now saved when you create or edit them
• Fix a booking error that appeared when the booking page was embedded on another website
• Fix a language switch error when the booking page was embedded on another website
• The booking page now works when embedded on other websites
• Show a clear message when the database needs to be updated, instead of a confusing error
• Fix the month switching on the booking calendar (#1862)
• Show appointment notes correctly in email notifications (#1881)
• Google Meet link is created but never stored in appointments.meeting_link (#1947)