Meeting Room Booking System Files

This is a minor release of MRBS.

Changes since MRBS 1.12.1:

* Fixed unauthenticated open redirect in kiosk mode. (CVE-2026-46688)
* Fixed potential Server Side Request Forgery in import functionality. (CVE-2026-46382)
* Fixed bug when using $prevent_simultaneous booking and editing
 a series (#3965)
* Add the ability to define a custom field in the entry table as
 mandatory for specific areas
* Fixed the ‘cookie’ session scheme (#3985)
* Fixed unnecessary call to setlocale() when the ‘intl’ extension is
 available (#3984)
* Add a proprietary username parameter to the ORGANIZER property in
 iCalendar exports and recognize this on import
* Allow periods to have times assigned to them and use these times in
 iCalendar exports
* Add a config variable, $auth["session_php"]["store_key_in_cookie"],
 that allows a default key to be used for encrypting session data,
  instead of a random key stored in a * cookie.  Useful if for some
  reason PHP does not have access to $_COOKIE.  (#3983)
* Add ability for bookings to open at a fixed time of day when
 operating in times mode and the max create ahead value is a whole number of days.
* Add support for exempt types for maximum duration.
* Add support for exempt types for maximum length and number of bookings.
* Add support for exempt types for max_create_ahead.
* Fixed bug preventing the add room form being shown when there are
 no enabled rooms or areas.
* Fixed bug causing periods to be stored incorrectly in the database
 when using Times mode.  (#3972)
* Add the ability for themes to override the standard CSS, yet still
 keep the ability to have custom CSS
* Fixed TypeError resulting in JSON error in reports when the user table
 has a row with a NULL username.  (#3966)
* Add the ability to prevent admin from skipping booking policies
* Fixed deprecated in PHP 8.5 use of DATE_RFC7231 constant
* Fixed PHP 8.5 deprecation message ("Case statements followed by a
 semicolon (;) are deprecated, use a colon (:) instead")
* Fixed bug in iCalendar generation when areas have different timezones.
* Prevent drag-select of slots if booking is not allowed.  (#3958)
* Fixed TypeError when using an authentication scheme, eg SAML, that
 pulls in a later version of Psr\Log\LoggerInterface.  ( #3956)
* Fixed bug in kiosk mode when in multisite mode.  (#3944)
* Fixed bug when entering kiosk mode.  (#3944)
* Many other minor bug fixes and improvements

See NEWS or ChangeLog in the release for more details.

Enjoy!

The MRBS Development Team