# QuickCal — Changelog

`meteorgpl-plugin/quickcal` · 22 releases, newest first, as published by the vendor.

## 1.0.24

- Moved missing WooCommerce order checks to a bounded background job instead of loading orders during booking page rendering
- Paginated Frontend Agents history, upcoming, and pending lists in the database at 50 appointments per page
- Added the saved `every2hours` cleanup schedule and made invalid cleanup intervals safe
- Processed abandoned unpaid appointments in bounded cron batches
- Added WordPress regression coverage for the reported WorkSpa failures

## 1.0.23

- Restricted customer appointment changes, cancellations, and payment actions to the signed-in appointment owner
- Restricted Booking Agent actions and exports to assigned calendars
- Added nonce and capability checks to Front-End Agents, CSV exports, WooCommerce actions, and dismissible notices
- Disabled legacy demo appointment tools by default and protected opt-in use with administrator permissions and nonces
- Validated booking dates and time slots on the server and stopped trusting client-supplied appointment timestamps and user IDs
- Neutralized spreadsheet formulas in exported CSV cells
- Strengthened calendar feed tokens for new installations and escaped iCalendar text values against property injection
- Validated and safely rendered nested public appointment-form titles and related calendar/date/time values
- Hardened public calendar AJAX loaders against reflected attribute injection and malformed request values
- Closed remaining Booking Agent calendar boundaries in legacy picker and custom-timeslot AJAX routes
- Prevented Booking Agents from changing linked customer WordPress profiles without permission to edit that user
- Restricted failed-login redirects to validated same-site destinations
- Added regression coverage for appointment ownership, calendar authorization, booking input validation, and CSV safety
- Added end-to-end regression coverage for public appointment-form markup and nonce-without-authorization attempts

## 1.0.22

- Fixed an unauthenticated stored cross-site scripting vulnerability in appointment custom fields
- Sanitized submitted custom-field values before storage and escaped stored custom-field markup at every appointment display boundary
- Enforced the configured guest-booking and user-registration settings on unauthenticated appointment requests

## 1.0.21

- Added an opt-in email setting to copy the site administrator on customer-initiated appointment cancellations
- Preserved the existing assigned Booking Agent or default notification recipient behavior when the new setting is disabled
- Prevented duplicate cancellation emails when the assigned recipient and site administrator use the same email address
- Fixed custom calendar assignment lookup during front-end cancellations
- Added regression coverage for cancellation notification recipients

## 1.0.20

- Fixed fresh QuickCal activations so the bundled Font Awesome loader creates both valid default options and release metadata before Font Awesome initializes.
- Removed a PHP 8.2+ dynamic-property deprecation from the bundled Font Awesome release provider.

## 1.0.19

- Fixed fresh QuickCal activations so the bundled Font Awesome loader creates valid default options before Font Awesome initializes.

## 1.0.18

- Fixed disabled booking slots so they cannot be booked from the admin calendar after the date view reloads
- Added server-side availability enforcement for disabled booking slots
- Added a focused regression test for disabled booking slot behavior

## 1.0.17

- Added a structured local development and smoke-test workflow for QuickCal
- Added release tooling for GitHub Releases and hosted zip publishing
- Fixed a profile update notice caused by missing `_wpnonce`
- Fixed several PHP notices, warnings, and deprecations in request handling and rendering paths
- Improved admin booking stability for existing users, new users, and unpaid bookings
- Added safer WooCommerce order creation for admin-created paid appointments
- Fixed admin guest bookings so paid appointments can create linked WooCommerce orders
- Fixed translation loading timing issues on newer WordPress versions
- Fixed a PHP 8.4 deprecation in the bundled Font Awesome library

## 1.0.16

- FIXED: Sensitive Data Exposure vulnerability
- FIXED: Cross Site Request Forgery (CSRF) vulnerability
- FIXED: Issue where appointment details did not sync to related WooCommerce order
- FIXED: Minor translation warnings

## 1.0.15

- **IMPROVED:** - Appearance of variations to use title instead of slug where possible and make them more readable
- **IMPROVED:** - Support for WooCommerce High Performance Order Storage (HPOS)
- **FIXED:** - Issue where in some instances appointments were not properly cleared and dates became unviewable in backend calendar view
- **FIXED:** - Multiple instances of deprecated code

## 1.0.14

- **FIXED:** - Error related to Stripe add-on for WooCommerce which impacted WP admin
- **FIXED:** - Issue where Add to Calendar button was not showing correctly for all users

## 1.0.13

- **FIXED:** - Arrows misaligned on appointment calendar inside WP admin mobile
- **FIXED:** - Upcoming appointments widget on WP Dashboard
- **FIXED:** - WooCommerce order validation error
- **FIXED:** - Edit button css

## 1.0.12

- **FIXED:** - FIXED: Change date button fix (nonce)
- **FIXED:** - Issue where time slot title does not appear on "small" calendar view for certain screen sizes

## 1.0.11

- **ENHANCED:** - Increase export to 2500 entires
- **FIXED:** - Captured missing string translations

## 1.0.10

- **FIXED:** Issue where time slot title incorrectly shows in button on some screen sizes
- **FIXED:** Issue with vertical space between appointment buttons on small screens
- **FIXED:** Issue where Profile page tabs may appear out of alignment on small screens

## 1.0.9

- **FIXED:** Cancel appointment email not going out to the assigned agent
- **FIXED:** Forgot password not working
- **FIXED:** Trashed/non existent products crash the product selector in the custom fields

## 1.0.8

- **FIXED:** Translation migration improvements from Booked to QuickCal

## 1.0.7

- **FIXED:** Timeslots missing on calendar reload after booking.

## 1.0.6

- **ENHANCEMENT:** Adding new styling options to calendar.
- **FIXED:** Updated documentation links

## 1.0.5

- **FIXED:** (Security Update) Patch for sensitive data exposure vulnerability. All calendar feeds have expired. Use new calendar feeds under Settings / Calendar Feeds.
- **FIXED:** (Security Update) Patch for vulnerable plugin update connection.
- **FIXED:** Booked user login issue
- **FIXED:** Required nonce issue
- **FIXED:** Compatibility Update for PHP 8+

## 1.0.1

- **FIXED:** Security Update: Patch for sensitive data exposure vulnerability. All calendar feeds have expired. Use new calendar feeds under Settings / Calendar Feeds.
- **FIXED:** Security Update: Patch for vulnerable plugin update connection.
- **FIXED:** Bug Fix: Booked user login issue
- **FIXED:** Bug Fix: Required nonce issue
- **FIXED:** Compatibility Update: PHP 8+
- **INFO:** https://quickcal.co/changelog/

## 1.0.0

- Initial Release!