Tags

1.2.0

Minor release with consecutive multi-slot booking, server-authoritative PayPal, and a large set of correctness, security, and packaging fixes since 1.1.13.

Highlights
Consecutive multi-slot booking (#3436177): optional #max_consecutive_slots (default 1). Visitors pick a start time and how many wall-clock-adjacent slots to book. Stored as YYYY-MM-DD HH:MM|seats|count when count > 1; legacy slot|seats values stay valid. Price = unit × seats × count.
Server-authoritative PayPal: server creates/captures orders; amount comes from config + submission, not the browser. Verified payment required before a paying submit is accepted. Client secret only via settings.php override (never UI / exported config).
Upgrade notes (important)
PayPal sites must act before paying forms work again:

$config['webform_booking.settings']['paypal_client_secret'] = 'YOUR_SECRET';
Without a detected secret, paying webforms refuse bookings (status report error, form message, actions blocked). Free booking forms are unaffected. Sandbox/live must match credentials.

Multi-slot is opt-in: leave Maximum consecutive slots at 1 for unchanged behaviour.

Bug fixes
#3613057 / #3531803 — calendar month wrong for timezones behind UTC; date helpers extracted and timezone-tested
#3581037 — drop webform_ui dependency that blocked Composer install on Drupal 11
#3573651 — PHP 8.4 implicitly nullable prepare() deprecation
#3575361 — configured end date included in bookable days
#3509647 — editing a submission keeps and shows the existing booking
Cancelled bookings no longer treated as empty; legacy values without |seats cancel correctly
Cancellation links work after the webform closes
Booking window measured in whole days; request time from time service (testable, consistent bounds)
Availability queries scoped in SQL instead of loading every historical booking
Calendar: no longer publishes full submission data; tooltips limited to booking keys; non-booking keys rejected in block config
Calendar events end when the booked slot ends (including multi-slot duration)
PayPal element persisted on webform save, not on view; dead client-side booking rewrite removed
Reject availability requests with no open booking element; reject crafted dead runs / zero-seat new bookings
Security & hardening
Route-level access for calendar data and booking availability
SECURITY.md documents known weaknesses (query-string cancel tokens; open availability endpoints) and the planned cancel-token migration
PayPal order ledger + claim-on-validate (replay protection); paypal_transaction is server-owned #type => value
Developer / ops
GitLab CI, phpcs / cspell / stylelint / phpstan cleanup
declare(strict_types=1) across PHP; plugin attributes + service injection
Submission display moved to templates (translatable)
Shared BookingValue, SlotGrid, SlotAvailability, SlotDayFilter, BookingPrice
Kernel + JS unit tests for availability, PayPal, tokens, cancel, edit, calendar, multi-slot selection, timezone date helpers
ADRs: 0001 server-authoritative PayPal, 0002 multi-slot booking
Changes since 1.1.13
38 commits on 1.1.x after c8c47861 (~9.5k insertions). See git history 1.1.13..HEAD for full detail.

1.1.13

1.1.12

1.1.11

Support for latest Webform beta version

1.1.10

1.1.9

1.1.8

Consolidate requirements

1.1.7

1.1.6

1.1.5

1.1.4

- Tokens
- Webform Booking Calendar (Experimental)

1.1.3

1.1.2

1.1.1

1.1.0

Paypal integration

1.0.13

1.0.12

1.0.11

1.0.10

1.0.9