DPCalendar comes with some nice new features and enhancements. Articles can now be created when events are saved, a new task is available to send out reminders for unpaid offline bookings and tags are displayed in the list views. And yes, we fixed also some security issues in the release.
Following our established release strategy, we are excited to announce a new feature version of DPCalendar, as it is the fourth Thursday of the month. Today, we are releasing the following update:
The next chapters are highlighting some of the most important changes in this release window for DPCalendar 10.12.0.
Article plugin with update functionality
The DPCalendar Article Plugin integrates Joomla articles with DPCalendar, allowing events to be published as articles. With this release, the plugin can also automatically create or update articles when events are created or modified.This makes it easy to turn events into blog posts or other articles without manually copying and formatting content. The functionality is highly configurable: unlimited calendars can be assigned to specific article categories, while custom fields can be mapped between events and articles. Both the article intro text and full text can be configured to include the relevant event data, giving you full control over how event information is presented in the resulting articles.
More information can be found in the DPCalendar article plugin documentation.
Reminder task for unpaid bookings
The new task offers the possibility to send out reminders in an automated way with the core scheduler to attendees which didn't pay their offline booking for a certain timespan. Beside the timespan, it is possible to configure the mail subject and message, either directly inline or through mail templates. More information can be found in the DPCalendar article plugin documentation.
Tags in list views
The list, blog, and timeline views now display the tags associated with each event. This makes it easier for visitors to see at a glance which topics an event belongs to and to better understand the content without having to open the event details. The tags are displayed directly within the respective views, providing a clearer overview and making events easier to identify and browse. More information can be found in the DPCalendar list menu item documentation.
YOOtheme calendar element start date option
The YOOtheme calendar element for DPCalendar now includes a new start date option, giving you more flexibility over the period displayed in the calendar. This makes it possible to create calendar views covering a specific time range, for example, a complete view for an entire year or a calendar showing the next two months. This is especially useful when creating dedicated calendar sections on a website, as you can now control both when the calendar starts and how far into the future it displays events. More information can be found in the DPCalendar YOOtheme integration plugin documentation.
Security issues
Two new security issues have been reported to us, which we fixed in this release as well. Both issues need an authenticated user and can only be misused when the user has the update article permission or the create permission in DPCalendar. The website can't be compromised, files are safe and we have no information about stolen data as the finder contacted directly us! The fixes are also backportd to DPCalendar 8.19 which runs on Joomla 3.
- #12206 Saving an article can trigger a blind SQL injection with content plugin, needs update permission for articles [High]
- #12203 Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar [Medium]
Big shootout to from Toan Le which reported and provided tools to reproduce the issues.
Bugfixes
We are eager to improve our extensions on a regular basis. That's why every major/feature release does contain also bug fixes and small enhancements as well to improve the stability and performance.
A full changelog is added in the respective download release description on our download site.
Kind regards
Allon Moritz aka laoneo
Founder of Digital Peak