WP Manifestindependent plugin directory
manifest / events / events-calendar-ical-feeds

iCalendar Feeds for The Events Calendar WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB

Extends The Events Calendar with iCal feeds that users can subscribe to in their favorite calendar application. By default, in The Events Calendar, users can export an iCalendar feed, but not subscribe to it.

★ 3stars
82release downloads
≈10active sites
7composer installs
1.2.6latest · 2 years ago

Install

Download events-calendar-ical-feeds.zip From the 1.2.6 release on GitHub, Mar 6, 2024

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/bernskiold/events-calendar-ical-feeds/releases/download/1.2.6/events-calendar-ical-feeds.zip

On Packagist as bernskioldmedia/events-calendar-ical-feeds:

composer require bernskioldmedia/events-calendar-ical-feeds
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.

Extends The Events Calendar with iCal feeds that users can subscribe to in their favorite calendar application. By default, in The Events Calendar, users can export an iCalendar feed, but not subscribe to it.

We believe the use for a calendar export is to subscribe so that updates properly reflect. Therefore, this plugin adds a subscribable, auto-updating feed.

Installation

You can install this package via composer.

composer require bernskioldmedia/events-calendar-ical-feeds

You can also install this package by grabbing the built ZIP file from the releases page and uploading it to your plugins folder.

The plugin will update through the core WordPress plugin updater.

Usage

The feed URL is based on the events slug in the settings of The Event Calendar.

For the default slug events, the feed URL will be: https://yourdomain.com/events/ical-feed

Please note that the default feed is /ical while this one is at /ical-feed.

Query Parameters

You can customize which events show up in a feed through the available query parameters.

Setting a start date.

Set a custom start date from when to start fetching events. By default, this is rolling 30 days before the current day.

from=2021-01-01

Setting an end date.

Set a custom end date until when to fetch events. By default, this is rolling six months after the current day.

to=2021-12-31

Showing events for a specific venue

You can create a venue-specific calendar feed by adding the venue parameter and passing the venue ID.

venue=3

Showing events for a specific organizer

You can create an organizer-specific calendar feed by adding the organizer parameter and passing the organizer ID.

organizer=3

Showing events for one or many event categories

You can create an event category-specific calendar feed by adding the category parameter and passing one or more event category IDs, comma-separated.

categories=28 or categories=25,28,93

Controlling how many events to include

You can customize the number of events to show in the calendar. By default, this is 100.

There is an upper limit for performance reasons and to stop anyone from abusing and sinking your server. By default, this is 500 but can be customized in a filter (see below).

amount=250

Filters & Actions

We make a few filters and actions available for customizing and extending.

Controlling the max amount of events in the feed

Define how many items can be at most be included in the feed. No more items will be allowed, even if set via the filters. Defaults to 500.

// Allow 1000 events to be loaded into the iCal feed.
add_filter( 'events_calendar_ical_feeds_max_amount', function(int $max_events, \BernskioldMedia\WP\EventsCalendarIcalFeeds\Calendar_Feed $feed) {
    return 1000;
} );

Customizing the default start date

Define how long before the current dates we should fetch events for the feeds. By default, this is -30 days and means that events in the past 30 days will show up in the calendar.

Be mindful of this, as a larger timespan will mean a bigger feed, which has performance implications.

Return any valuable compatible with DateTime.

// Including events starting 45 days from any given day.
add_filter( 'events_calendar_ical_feeds_default_start_date', function( string $start_date ) {
    return '-45 days';
});

Customizing the default end date

Define how long after the current dates we should fetch events for the feeds. By default, this is to +6 months and means that events in the next six months will appear in the calendar.

Be mindful of this, as a larger timespan will mean a bigger feed, which has performance implications.

Return any valuable compatible with DateTime.

// Including events rolling one year from today.
add_filter( 'events_calendar_ical_feeds_default_end_date', function( string $end_date ) {
    return '+1 year';
});

Customizing the default feed slug

If you don't like the /ical-feed suffix of the events slug, you can customize it through this filter. Return any one directory level string.

Please note that returning /ical here will clash with the built-in feed in The Events Calendar.

After changing, don't forget to refresh your permalinks.

// Making the URL /events/subscribe.
add_filter( 'events_calendar_ical_feeds_feed_slug', function() {
    return 'subscribe';
});

Customizing the calendar feed

You can customize the calendar feed before output if you want to add/change/remove anything that this plugin does by default. Please see spatie/icalendar-generator for how to interact with the calendar object.

// Customize the calendar feed.
add_action( 'events_calendar_ical_create_calendar', function( \Spatie\IcalendarGenerator\Components\Calendar $calendar ) {
    // $calendar->...
});

Customizing the event object

You can customize the event object before it is added to the calendar feed if you want to add/change/remove anything that this plugin does by default. Please see spatie/icalendar-generator for how to interact with the event object.

This can be used for example to customize the data or to add additional metadata based on the event ID.

// Customize the calendar feed.
add_action( 'events_calendar_ical_event_from_id', function( \Spatie\IcalendarGenerator\Components\Event $event, int $event_id ) {
    // $event->...
});

Preventing asset loading

If you don't want this plugin to load its own assets (see below), you can prevent it by returning false from this filter. It returns true by default.

// Prevent Events Calendar iCal Feeds from loading assets.
add_action( 'events_calendar_ical_load_assets', '__return_false' );

Assets

This plugin requires Alpine.js for a few frontend operations. Because Alpine.js is something that you might already be running, or have across many projects, we try to be nice when checking for it.

We load it by checking if the handle alpinejs is already registered. If it is, we won't touch it. Just enqueue it. If it isn't, we'll register and enqueue.

To completely disable loading of assets, see "Preventing asset loading" above.

Releases

15 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
1.2.6 latest
Mar 6, 2024 2 years ago
events-calendar-ical-feeds.zip
12
Feb 26, 2024 2 years ago
events-calendar-ical-feeds.zip
5
Aug 10, 2022 4 years ago
events-calendar-ical-feeds.zip
17
Jun 22, 2022 4 years ago
events-calendar-ical-feeds.zip
3
Jun 21, 2022 4 years ago
events-calendar-ical-feeds.zip
5
Jun 21, 2022 4 years ago
events-calendar-ical-feeds.zip
5
Apr 21, 2022 4 years ago
events-calendar-ical-feeds.zip
8
Apr 11, 2022 4 years ago
events-calendar-ical-feeds.zip
4
Nov 29, 2021 4 years ago
events-calendar-ical-feeds.zip
15
Nov 29, 2021 4 years ago
events-calendar-ical-feeds.zip
8
Nov 29, 2021 4 years ago
tag only
—
Nov 29, 2021 4 years ago
tag only
—
Nov 18, 2021 4 years ago
tag only
—
Nov 4, 2021 4 years ago
tag only
—
Nov 3, 2021 4 years ago
tag only
—

Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

B grade

Security

iCalendar Feeds for The Events Calendar 1.2.6 · audited by WP Registry

Medium-severity findings.

1 medium 1 low
Audited release
1.2.6
Findings
2
Worst severity
medium
Content hash
f26893d5b056f145fdd03d56…

Findings

  • medium Unauthenticated amount parameter bypasses the 500-event feed cap

    dos

    The public iCal endpoint (template_include when query var calendar_feed===true; pretty URL /{eventsSlug}/ical-feed or /?calendar_feed=true) is intentionally unauthenticated. views/ical-feed.php casts $_GET['amount'] to int and passes it to Calendar_Feed::amount(). That method exists specifically as an anti-abuse cap (const MAX_AMOUNT_OF_EVENTS=500, filter events_calendar_ical_feeds_max_amount; README: 'to stop anyone from abusing and sinking your server') but only clamps when $amount > $max_amount. Negative values are stored as-is and become tribe_get_events posts_per_page. WordPress core WP_Query::parse_query documents posts_per_page=-1 as 'request all posts' (nopaging=true) and, for values < -1, replaces them with abs($n), so amount=-1000 becomes 1000 — still above 500. Combined with attacker-controlled from/to (default window is only -30 days..+6 months), a guest can force generation of every matching tribe_events row: get_posts() then event_from_id() (tribe_get_event, venue, timezone DateTime, Spatie Calendar::get()) and echo the ICS. On a large catalog this is an unauthenticated CPU/memory/DB DoS; the 500 cap never applies. amount=0 is coerced by core to 1 and is not this bug.

    src/Calendar_Feed.php:124-159

    Recommendation

    Reject non-positive amounts (e.g. $amount = max(1, min($amount, $max_amount))) before assigning posts_per_page. Do not pass negative values through to WP_Query. Keep the existing upper bound.

  • low Unauthenticated venue ID puts arbitrary post titles in the iCal calendar name

    information_disclosure

    views/ical-feed.php accepts GET venue as an int with no post-type or capability check and calls Calendar_Feed::venue(). get_calendar_name() then interpolates get_the_title($this->venue_id) into the Spatie calendar NAME/X-WR-CALNAME whenever venue_id is truthy. get_the_title() does not call current_user_can('read_post') and works for any post ID (draft, private, pending, non-venue types). An unauthenticated client iterating ?calendar_feed=true&venue=1,2,… reads those titles in the ICS NAME line. Content is not leaked (events still come from tribe_get_events). Core REST hides private/draft titles from guests; this feed does not.

    src/Calendar_Feed.php:164-167

    Recommendation

    Resolve venue IDs with get_post() and require post_type tribe_venue (or tribe_get_venue) plus a publicly readable status before using the title. Skip the venue name (or 404) when the post is not a public venue.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.