2.26.0
Latest4 improvements36 changes
Improved
- Enhanced conditional logic
- Changes to calendars with "Enable security for this calendar" turned on
- Improved the security of showing events from another calendar feed
- Improved the security of event links and of HTML in events
Changes
- This release lets AI assistants manage calendars, updates a calendar as soon as its form is submitted on the same page, and improves conditional logic. It also strengthens security and fixes many issues with event links, dragging events, and the Calendar widget.
- Note: Clear your site's page cache after updating so secured calendars show events from other calendar feeds.
- AI assistants connected through the [GravityKit MCP]
- β¨ Improved
- Calendars on the same page as their form now show a new entry as soon as the form is submitted with AJAX, without reloading the page or leaving the month being viewed (entries the calendar would not otherwise show, such as those awaiting approval, stay hidden).
- Condition dropdowns that search users, entries, or posts now load their choices as soon as they are opened
- Conditions using the `{get}` merge tag found no entries or the wrong ones when the value in the page address contained `&`, `+`, or `%` (such as "Research & Development"), and changed other `{get}` merge tags on the page
- Conditions on GP Nested Forms fields and other fields that store several users, posts, or entries (such as Dynamic Lookup and Populate Anything fields) were slow on forms with a few hundred entries
- "Has any of", "has all of", and "has none of" conditions on Multi Select fields checked only the first selected value
- Condition dropdowns could open behind the WordPress admin bar, pressing Enter on a selected choice cleared it, and pressing Enter on the clear button did nothing
- When WordPress was set to a language other than English, date conditions showed month names, weekdays, and labels in English, and labels with an apostrophe showed `'` (such as "n'est pas" in French)
- Once a date was picked, the weekday names in a date condition's calendar were off by one day in time zones west of UTC (such as the US), and screen readers announced that calendar as "Event".
- π Security
- Each site now uses its own unique secret, and existing shortcodes and blocks keep working with the old one
- Posts created or changed after this update by users who cannot edit calendars need the new secret, so insert the calendar again or have a user who can edit calendars re-save the post
- ACF fields on options pages, users, and terms accept only the new secret
- The Calendar block shows a secured calendar's secret and preview only to users who can edit calendars
- The Elementor widget shows a secured calendar only on pages last saved by a user who can edit calendars or, for calendars secured before this update, on pages unchanged since.
- Feed events of secured or turned-off calendars are now available only on pages that show the calendar
- Feed addresses on a local or private network are refused when saving the calendar's settings, and are not fetched
- Previously saved feeds that are now refused, such as those on port 8443 or with a username and password in the address, are listed in a notice on the calendar's settings screen and recorded in the log.
- Event links now open only web addresses, or email, phone, and text message links whose `mailto:`, `tel:`, or `sms:` is typed into the Event URL setting (such as `mailto:{Email:3}`)
- With "Allow HTML Content" on, event titles, descriptions, and locations keep links and formatting such as bold text, but drop anything that could run a script and embedded content such as iframes
- Turning on "Allow HTML Content" now requires a user who can post unfiltered HTML, such as an administrator on a single site.
- Calendars whose events link to a Single Entry page caused a fatal error when that View had been permanently deleted.
- The Calendar widget showed an empty calendar on Views that join forms with [Multiple Forms]
- With Dynamically Load Events turned on, the Calendar widget showed no events after a search that sent more than one value for a field, such as two ticked checkboxes or a date range.
- Calendars added to a View's Single Entry layout with the `[gravitycalendar]` shortcode did not appear when the entry was opened in a lightbox, and the `[gravitycalendar_copy_button]` button there did not copy the calendar's link.
- Issues with event links
- On sites with permalinks set to "Plain", event links to an entry on another page opened the calendar's own page or a "Page not found" page
- Event links built with merge tags lost every query parameter after the first
- Custom event links entered without ` such as `example.org/page`, opened a missing page on your own site (links without ` or a leading `/` are now treated as web addresses, so start links to your own site with `/`, such as `/page/{entry_id}`).
- Issues with dragging events
- Times were saved in the wrong format for the form's Time field, such as 2:00 pm instead of 14:00 in a 24-hour field
- On calendars that date events by when entries were created or last updated, dragging an event appeared to move it without saving anything, instead of returning it to its original date (those dates can't be changed).
- On sites that display PHP warnings, calendars showed no events from feeds on other websites added with "Display Events from Another Calendar Feed".