WebCalendar v1.9.27

A patch release that restores the admin-configured site-wide external header,
stylesheet and trailer, which the v1.9.26 security hardening inadvertently
broke. No database schema changes.

Fixed

• Restore the admin-configured site-wide external header, stylesheet and
  trailer. The v1.9.26 LFI hardening confined external template files to
  templates/ and read them instead of including them, so an admin file at the
  webroot was not loaded and its path was printed on every page. Only the admin
  __system__ template may now name an external file; per-user templates stay
  literal content, so the underlying local-file-inclusion fix stays in force. (#807)

Added

• ALLOW_EXTERNAL_HEADER_PHP admin setting (default off): execute the external
  header/stylesheet/trailer file as PHP. External files are read by default;
  enable this only if the file needs to run PHP. (#807)

Upgrading

No database schema changes. After deploying, run wizard/index.php once to
advance the stored version (the wizard runs for every version bump, even with
no SQL). If your external header/trailer contains PHP, turn on the new
"Execute PHP in external header/script/trailer file" option in Admin > Settings.

Verifying this release

WebCalendar releases ship a signed manifest. See docs/release-signing.md for
verification instructions.