Easy!Appointments 1.6.1 Release

Oct 19, 2026

Easy!Appointments 1.6.1 has reached the stable milestone. It is ready for production, and it is the recommended update for every 1.6.0 installation.

Download Easy!Appointments 1.6.1

Thank you to everyone who tested the alpha and beta packages and reported what they found. Several of the fixes below exist because of those reports.

What’s in 1.6.1

1.6.1 is a maintenance release: it adds no big new features, and instead makes everything 1.6.0 introduced dependable. Three areas received most of the work.

Calendar Sync You Can Rely On

Google Calendar and CalDAV now synchronize independently, so a problem on one side no longer stops the other. A failing Google sync no longer removes local appointments: an expired token, a quota limit or an unreachable API only pauses the sync. On the CalDAV side, notes are no longer overwritten, events created in a calendar client are no longer removed and imported again, and recurring events of other providers stay where they are.

Events marked as free in Google Calendar or CalDAV, such as all-day entries and birthdays, no longer block booking (#1945). When a sync does fail, the calendar page now explains why and what to correct.

Security Hardening

19 fixes in this release carry a security label. The highlights:

• The CAPTCHA can no longer be skipped or reused, and login attempts are throttled again
• Providers and secretaries can no longer change, reassign or read the appointments and accounts of other users
• The REST API no longer lets a request redirect an update to another record or read protected settings such as the API token
• Calendar tokens, CalDAV passwords and password reset tokens are no longer returned to other accounts
• CalDAV connections can no longer be pointed at your local network unless you allow the host
• Changing your password now requires the current one, so a stolen session alone cannot take over an account

A Steadier Booking Experience

A time slot that is already booked can no longer be booked twice, including for services with multiple attendants. Two short blocked periods on the same day no longer hide that day’s available hours. Embedding the booking page on another website works properly again, and the booking calendar switches months correctly (#1862).

Updating from 1.6.0

Follow the update guide and back up your files and database first, as with every update.

One change needs attention: the CORS origins and the cookie SameSite policy have moved out of the root config.php into application/config/routes.php and application/config/config.php. If you customized either value, carry it over after updating.

The full list of changes follows below.

Changelog

Added

• A CalDAV section under Settings / Integrations, where the connection URLs that may point into the local network are listed
• The calendar page now explains why a CalDAV synchronization failed and what has to be corrected, instead of only reporting that it did
• Connecting to a CalDAV server on a local network now offers to allow its host right in the connection dialog, instead of requiring a trip to the settings; the host is only remembered once the connection actually works

Changed

• Changing the password in the account settings page now requires the current password, so that a stolen session alone cannot be used to take over the account
• The CORS origins and the cookie SameSite policy are now set in application/config/routes.php and application/config/config.php, instead of the root config.php, which keeps only the installation settings
• The release build now falls back to running Composer inside the php-fpm container, so a Composer installation on the host machine is no longer required
• The release package no longer includes stylesheet sources, dependency development files and unused images, which makes the download smaller

Fixed

• Removing every provider from a service on the services page is now saved, instead of silently keeping the previous provider assignments (#1965)
• The asset and release build no longer fails with permission errors on the files that the Docker containers create in the project directory
• A failing Google Calendar synchronization no longer removes the local appointments of the sync period, so an expired token, a quota limit or an unreachable API only interrupts the sync
• Appointment notes are no longer overwritten with the generated provider and customer details block on every CalDAV synchronization
• CalDAV events that are stored under an address that does not match their UID are now found, so events created in a calendar client are no longer removed and imported again on every synchronization
• Synchronizing one provider no longer removes the imported recurring CalDAV events of the other providers
• Moving an appointment to another provider now removes the event from the calendars of the previous provider
• The CalDAV synchronization period is now requested in UTC, so events at the edges of the period are no longer left out on installations that do not run in UTC
• Google Calendar and CalDAV are now synchronized independently, so a failure of one of them no longer skips the other
• The Google Calendar synchronization now fails with a clear error when the provider has no refresh token stored
• Security: The Google Calendar API requests now verify the TLS certificate of the remote endpoint
• Security: CalDAV connections no longer follow redirects or server links to other hosts, and no longer reach private addresses through IPv6 transition addresses or a DNS answer that changes after the check
• HTML texts, such as the privacy policy and the terms & conditions, are now purified with a cache directory inside storage/cache, so installations with a read-only vendor directory no longer fail with a write error
• The list of Google Calendars of a provider is no longer readable without permission, so only that provider or a user who may edit providers can fetch it
• Searching the LDAP directory now escapes the keyword, so a search term can no longer alter the LDAP filter
• Webhooks created or edited through the REST API can now set their secret header, so the secret token is sent with the request as it already is for webhooks configured in the backend
• Security: Updated the Guzzle HTTP client and the phpseclib library to their patched releases, fixing outbound request and certificate handling advisories that affected the webhook, CalDAV and Google Calendar integrations
• Editing a working plan exception now updates the existing entry, instead of adding a duplicate one next to it (#1958)
• Google Calendar events marked as “Free” no longer block booking, so all-day events and birthdays stay bookable (#1945)
• CalDAV Calendar events marked as free (TRANSP:TRANSPARENT) no longer block booking (#1945)
• Providers and secretaries can no longer overwrite or reassign the appointments and unavailabilities of other providers
• Requests with invalid parameters now respond with a “bad request” status instead of a server error
• Services can no longer be saved with a negative price or with a slot interval of zero
• The price, slot interval and attendants number of a service are now checked before the form is submitted
• Show a message with the affected days when the working plan of a provider has an invalid time range
• Ask for a confirmation when an unavailability is placed over an already booked appointment
• The appointment dialog now validates the phone number, just like the booking page does
• Timezone labels display the offset that is currently in effect, also during daylight saving time
• The timezone list no longer contains duplicate names, deprecated entries or malformed offsets
• When saving an appointment, the scheduling conflict is now confirmed before the notification question
• The scheduling conflict dialog of a new appointment is not titled “Appointment Update” anymore
• Show a message on the booking page when no service or provider has been selected yet
• The appointment dialog scrolls to its validation message and clears invalid fields while typing
• Fix the “Start date value is latter than end date.” and “The operation could not completed.” messages
• Security: The CalDAV and Google Calendar sync settings of a provider can no longer be reached without logging in first
• Security: CalDAV URLs that point into the local network are rejected again, unless the host is listed in the new CalDAV integration settings
• Security: The CAPTCHA can no longer be skipped by leaving the field out of the login, recovery or booking request
• Security: Login attempts are throttled again, so repeated wrong passwords are blocked as intended
• Security: Stop unauthorized users from taking over or changing other people’s appointments
• Security: Block unsafe links in the online meeting field so they cannot run code on the calendar
• Security: Stop the calendar from returning the Google Calendar tokens and CalDAV passwords of providers to secretary accounts
• Security: Stop the user management pages from returning the calendar sync tokens, CalDAV passwords and password reset tokens of other accounts
• When rescheduling an appointment, its date and time are selected again by default (#1940)
• Rescheduling an appointment can be saved again, instead of failing with an appointment hash error
• Show the cancel appointment text and button on a single line with even spacing
• Fix the automated test setup
• The provider and secretary “Mobile” number is now saved when you create or edit them
• Fix a booking error that appeared when the booking page was embedded on another website
• Fix a language switch error when the booking page was embedded on another website
• The booking page now works when embedded on other websites
• Show a clear message when the database needs to be updated, instead of a confusing error
• Fix the month switching on the booking calendar (#1862)
• Show appointment notes correctly in email notifications (#1881)
• Google Meet link is created but never stored in appointments.meeting_link (#1947)
• Security: Protected settings, such as the API token, can no longer be read or changed through the REST API by writing their name in a different letter case
• Security: An ID in the body of a REST API update request no longer redirects the update to another record, such as an administrator account, than the one in the URL
• Security: Saving or deleting a provider, secretary or admin now only affects users of that role, so an administrator account can no longer be overwritten or deleted, or a role changed, through another user type
• Security: A new booking can no longer be placed on an already booked time slot by sending the ID of the existing appointment along with the booking request
• Security: With limited customer access, providers and secretaries can no longer edit or book appointments for customers they have no appointments with through the calendar page
• Enabling ALTCHA without generating an HMAC key no longer rejects every login and booking, the key is now created and stored on first use
• The customer data retention cleanup now removes inactive customers again, instead of removing none of them whenever an unavailability ends after the retention cutoff
• Two short blocked periods on the same day no longer hide all the available hours of that day on the booking page
• Services with multiple attendants no longer offer a time slot that contains a shorter appointment of the same provider, which led to double bookings
• Security: A solved CAPTCHA image is now only valid for one attempt, so it can no longer be reused for repeated login, password recovery or booking requests
• Security: Deleting or viewing a customer from the backend now only works for customer accounts, so a provider or secretary can no longer delete or read the account of an admin or another staff member
• Security: The appointment details on the booking confirmation step are now escaped, so HTML in a service or provider name can no longer run scripts in the customer’s browser
• Adding or editing an unavailability from the unavailabilities page no longer fails with a server error, and deleting one now also removes it from the synchronized Google Calendar or CalDAV calendar
• Dates that do not exist, such as February 30, are now rejected when saving appointments, unavailabilities and blocked periods, instead of being silently stored as a different date

Going Premium

Would you rather have the update done for you?

Our Technical Support session covers upgrades from start to finish, and Managed Hosting applies every release for you.

Explore Premium Services