WebCalendar v1.9.28

Security patch release. Fixes a reflected cross-site scripting (XSS)
vulnerability in the user preferences page.

Fixed

• Security — reflected XSS in pref.php: the user request parameter was
  reflected into the page without escaping and could execute script in an
  administrator's or nonuser-admin's browser via a crafted link. It is now
  escaped at every reflection point — the hidden form field, the "Reset
  Preferences" link and its confirm dialog, and the publish/RSS/FreeBusy
  subscription URLs. (#815, #816)

  Thanks to Peter Wilfahrt (@p-w) for the private
  report.

Verifying this release

WebCalendar releases ship a signed manifest. See docs/release-signing.md for
verification instructions.