| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| WebCalendar-1.9.27.zip.pem | 2026-10-23 | 3.3 kB | |
| WebCalendar-1.9.27.zip.sig | 2026-10-23 | 96 Bytes | |
| MANIFEST.sha256.sig | 2026-10-23 | 89 Bytes | |
| MANIFEST.sha256 | 2026-10-23 | 168.4 kB | |
| WebCalendar-1.9.27.zip | 2026-10-23 | 6.8 MB | |
| README.md | 2026-10-23 | 1.4 kB | |
| WebCalendar v1.9.27 source code.tar.gz | 2026-10-23 | 6.2 MB | |
| WebCalendar v1.9.27 source code.zip | 2026-10-23 | 7.4 MB | |
| Totals: 8 Items | 20.6 MB | 1 | |
WebCalendar v1.9.27
A patch release that restores the admin-configured site-wide external header, stylesheet and trailer, which the v1.9.26 security hardening inadvertently broke. No database schema changes.
Fixed
- Restore the admin-configured site-wide external header, stylesheet and
trailer. The v1.9.26 LFI hardening confined external template files to
templates/and read them instead of including them, so an admin file at the webroot was not loaded and its path was printed on every page. Only the admin__system__template may now name an external file; per-user templates stay literal content, so the underlying local-file-inclusion fix stays in force. (#807)
Added
ALLOW_EXTERNAL_HEADER_PHPadmin setting (default off): execute the external header/stylesheet/trailer file as PHP. External files are read by default; enable this only if the file needs to run PHP. (#807)
Upgrading
No database schema changes. After deploying, run wizard/index.php once to
advance the stored version (the wizard runs for every version bump, even with
no SQL). If your external header/trailer contains PHP, turn on the new
"Execute PHP in external header/script/trailer file" option in Admin > Settings.
Verifying this release
WebCalendar releases ship a signed manifest. See docs/release-signing.md for
verification instructions.
