PHP-Calendar 2.0.14 is out. It’s mostly a security release, and everyone running 2.0 should upgrade. Several of the fixes are serious: an attacker could inject PHP code through the installer, log in as another user through the login cookie, or use SQL injection in the category and group forms.

Download it from the release page on GitHub, or try it first on the demo (log in as demo, password demo).

Upgrading

2.0.14 requires PHP 8.1 or later. Upload the new files over the old ones, open install.php, choose Upgrade to update the database, and then delete install.php. If you’re still on a version older than 2.0.0, upgrade to 2.0.13 first; 2.0.14 can’t upgrade from 1.x anymore.

Security fixes

  • PHP code injection in the installer
  • SQL injection in login cookie handling that allowed logging in as another user
  • SQL injection and missing permission checks in the category and group forms
  • Users with modify access on any calendar could edit events and dates in any other calendar
  • Cross-site scripting through event descriptions, author names, and form values
  • Every form that changes data now has CSRF protection, and deleting asks for confirmation
  • Passwords are hashed with bcrypt; existing passwords are upgraded the next time each user logs in
  • Login cookies use their own random tokens, and cookies are SameSite (and Secure over HTTPS)
  • The session is regenerated on login, and .htaccess rules block direct access to src/ and config.php
  • The installer no longer drops tables during an upgrade

Other changes

  • Previous and next month buttons in the month view (thanks bellalistair)
  • Times and colors use the browser’s built-in pickers
  • jQuery 4.0, jQuery UI 1.14 and updated Showdown and hoverIntent, loaded from cdnjs
  • Release packages include compiled translations, so there’s no need to run the translation step
  • Updated translations
  • Fixed links losing the port when the calendar runs on a non-standard port
  • Fixed a crash when editing an event with no dates
  • Fixed backslashes being removed from event titles

The full list of changes is in the changelog.

Work on 3.0 continues on the main branch. You can see where it’s at on the development demo, and help translate it on Weblate.