This is a minor release of MRBS.
Changes since MRBS 1.12.1:
- Fixed unauthenticated open redirect in kiosk mode. (CVE-2026-46688)
- Fixed potential Server Side Request Forgery in import functionality. (CVE-2026-46382)
- Fixed bug when using $prevent_simultaneous booking and editing
a series (#3965) - Add the ability to define a custom field in the entry table as
mandatory for specific areas - Fixed the ‘cookie’ session scheme (#3985)
- Fixed unnecessary call to setlocale() when the ‘intl’ extension is
available (#3984) - Add a proprietary username parameter to the ORGANIZER property in
iCalendar exports and recognize this on import - Allow periods to have times assigned to them and use these times in
iCalendar exports - Add a config variable, $auth["session_php"]["store_key_in_cookie"],
that allows a default key to be used for encrypting session data,
instead of a random key stored in a * cookie. Useful if for some
reason PHP does not have access to $_COOKIE. (#3983) - Add ability for bookings to open at a fixed time of day when
operating in times mode and the max create ahead value is a whole number of days. - Add support for exempt types for maximum duration.
- Add support for exempt types for maximum length and number of bookings.
- Add support for exempt types for max_create_ahead.
- Fixed bug preventing the add room form being shown when there are
no enabled rooms or areas. - Fixed bug causing periods to be stored incorrectly in the database
when using Times mode. (#3972) - Add the ability for themes to override the standard CSS, yet still
keep the ability to have custom CSS - Fixed TypeError resulting in JSON error in reports when the user table
has a row with a NULL username. (#3966) - Add the ability to prevent admin from skipping booking policies
- Fixed deprecated in PHP 8.5 use of DATE_RFC7231 constant
- Fixed PHP 8.5 deprecation message ("Case statements followed by a
semicolon (;) are deprecated, use a colon (:) instead") - Fixed bug in iCalendar generation when areas have different timezones.
- Prevent drag-select of slots if booking is not allowed. (#3958)
- Fixed TypeError when using an authentication scheme, eg SAML, that
pulls in a later version of Psr\Log\LoggerInterface. ( #3956) - Fixed bug in kiosk mode when in multisite mode. (#3944)
- Fixed bug when entering kiosk mode. (#3944)
- Many other minor bug fixes and improvements
See NEWS or ChangeLog in the release for more details.
Enjoy!
The MRBS Development Team