Librebooking v4 bookings and resource calendar menu options

[Liam-2025-EE]

Hello all,

I'm having an issue with Librebooking v4 where the "bookings" and "resource calendar" options under the Schedules menu don't work. The redirected URL comes up as https://schedule.php and https://calendar.php respectively. I've set the script.url option in the config.php file to the correct URL but it still not working. would anyone have the same issue?

Thanks,

Liam

[marbuka]

It's an occurence of #758, the workaround is setting the base directory of the website (in Apache, nginx or whatever) to the root of your LibreBooking installation, not the /Web subfolder.

[Liam-2025-EE]

Hi Marek, I've tried this but it's still not working. I've tried with /Web in and out in config.php and still the same thing. I don't understand ho it's able to find all of the other scripts ok but not these two (schedule.php and calendar.php). I read that with V4 the config settings are stored in the config table of the database and not in config.php. Would you know anything about this? Any help much appreciated. Thank you, Liam

…

____________________________________________________________ # Liam Meany S130, School of Electronic Engineering, # Dublin City University, Dublin 9, IRELAND. # email: ***@***.*** # Ph: 00-353-1-7008150 Fax: 00-353-1-7005122

____________________________________________________________

On Wed, 22 Oct 2025 at 11:40, Marek Bukała-Karbownik < ***@***.***> wrote: It's an occurence of #758 <#758>, the workaround is setting the base directory of the website (in Apache, nginx or whatever) to the root of your LibreBooking installation, not the /Web subfolder. — Reply to this email directly, view it on GitHub <#874 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BYZYU7342QTX6ZW3GMGKEXT3Y5NJ5AVCNFSM6AAAAACJZBQHQ6VHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTINZUHE3TSOI> . You are receiving this because you authored the thread.Message ID: ***@***.***>

-- Séanadh Ríomhphoist / Email Disclaimer Tá an ríomhphost seo agus aon chomhad a sheoltar leis faoi rún agus is lena úsáid ag an seolaí agus sin amháin é. Tá cosc iomlán ar scaipeadh, dháileadh nó chóipeáil neamhúdaraithe ar an teachtaireacht seo agus ar aon cheangaltán atá ag dul leis. Má tá an ríomhphost seo faighte agat trí dhearmad cuir sin in iúl le do thoil don seoltóir agus scrios an teachtaireacht. D’fhéadfadh sé gurb iad tuairimí an údair agus sin amháin atá in aon tuairimí nó dearcthaí atá curtha i láthair sa ríomhphost seo agus níor chóir glacadh leo mar thuairimí nó dhearcthaí Ollscoil Chathair Bhaile Átha Cliath. Ní ghlactar leis go bhfuil cumarsáid ríomhphoist den sórt seo saor ó víreas, in am, slán, nó saor ó earráid agus ní ghlacann Ollscoil Chathair Bhaile Átha Cliath le dliteanas in aon chás den sórt sin ná as aon iarmhairt a d’eascródh astu. This e-mail and any files transmitted with it are confidential and are intended solely for use by the addressee. Any unauthorised dissemination, distribution or copying of this message and any attachments is strictly prohibited. If you have received this e-mail in error, please notify the sender and delete the message. Any views or opinions presented in this e-mail may solely be the views of the author and cannot be relied upon as being those of Dublin City University. E-mail communications such as this cannot be guaranteed to be virus-free, timely, secure or error-free and Dublin City University does not accept liability for any such matters or their consequences.

-- <https://www.facebook.com/DCU/> <https://twitter.com/DCU> <https://www.linkedin.com/company/dublin-city-university> <https://www.instagram.com/dublincityuniversity/?hl=en> <https://www.youtube.com/user/DublinCityUniversity> 

[marbuka]

You need to make the change in the configuration file of your Web server (for Apache it's /etc/apache2/sites-available/yoursite.conf). Edit the DocumentRoot value to point to your Librebooking files (i.e. /var/www/librebooking).

The actual problem lies in the validation method in the URIScriptValidator.php file. the isSafePath($path) function explicitly looks for the /Web substring of the requested URI before making other anti-XSS validations (if I read it correctly).

Could anyone look it up and tell if the Web directory is necessary from the security standpoint?

[Liam-2025-EE]

Hi Marek, That was a great help! I changed /Web to just / in URIScriptValidator.php and it's fine now. Not sure about the security position of this. Many thanks, Liam

…

____________________________________________________________ # Liam Meany S130, School of Electronic Engineering, # Dublin City University, Dublin 9, IRELAND. # email: ***@***.*** # Ph: 00-353-1-7008150 Fax: 00-353-1-7005122

____________________________________________________________

On Wed, 22 Oct 2025 at 14:34, Marek Bukała-Karbownik < ***@***.***> wrote: You need to make the change in the configuration file of your Web server (for Apache it's /etc/apache2/sites-available/yoursite.conf). Edit the DocumentRoot value to point to your Librebooking files (i.e. /var/www/librebooking). The actual problem lies in the validation method in the URIScriptValidator.php file. the isSafePath($path) function explicitly looks for the /Web substring of the requested URI before making other anti-XSS validations (if I read it correctly). Could anyone look it up and tell if the Web directory is necessary from the security standpoint? — Reply to this email directly, view it on GitHub <#874 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BYZYU74SPLHXHY4RHJBYOUL3Y6BVVAVCNFSM6AAAAACJZBQHQ6VHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTINZVGE2DKMA> . You are receiving this because you authored the thread.Message ID: ***@***.***>

-- Séanadh Ríomhphoist / Email Disclaimer Tá an ríomhphost seo agus aon chomhad a sheoltar leis faoi rún agus is lena úsáid ag an seolaí agus sin amháin é. Tá cosc iomlán ar scaipeadh, dháileadh nó chóipeáil neamhúdaraithe ar an teachtaireacht seo agus ar aon cheangaltán atá ag dul leis. Má tá an ríomhphost seo faighte agat trí dhearmad cuir sin in iúl le do thoil don seoltóir agus scrios an teachtaireacht. D’fhéadfadh sé gurb iad tuairimí an údair agus sin amháin atá in aon tuairimí nó dearcthaí atá curtha i láthair sa ríomhphost seo agus níor chóir glacadh leo mar thuairimí nó dhearcthaí Ollscoil Chathair Bhaile Átha Cliath. Ní ghlactar leis go bhfuil cumarsáid ríomhphoist den sórt seo saor ó víreas, in am, slán, nó saor ó earráid agus ní ghlacann Ollscoil Chathair Bhaile Átha Cliath le dliteanas in aon chás den sórt sin ná as aon iarmhairt a d’eascródh astu. This e-mail and any files transmitted with it are confidential and are intended solely for use by the addressee. Any unauthorised dissemination, distribution or copying of this message and any attachments is strictly prohibited. If you have received this e-mail in error, please notify the sender and delete the message. Any views or opinions presented in this e-mail may solely be the views of the author and cannot be relied upon as being those of Dublin City University. E-mail communications such as this cannot be guaranteed to be virus-free, timely, secure or error-free and Dublin City University does not accept liability for any such matters or their consequences.

-- <https://www.facebook.com/DCU/> <https://twitter.com/DCU> <https://www.linkedin.com/company/dublin-city-university> <https://www.instagram.com/dublincityuniversity/?hl=en> <https://www.youtube.com/user/DublinCityUniversity> 

[marbuka]

Yeah, I'm not sure either, that's why I didn't PR this modification 😉

[Liam-2025-EE]

Many thanks for your assistance Marek. Liam

…

____________________________________________________________ # Liam Meany S130, School of Electronic Engineering, # Dublin City University, Dublin 9, IRELAND. # email: ***@***.*** # Ph: 00-353-1-7008150 Fax: 00-353-1-7005122

____________________________________________________________

On Wed, 22 Oct 2025 at 14:51, Marek Bukała-Karbownik < ***@***.***> wrote: Yeah, I'm not sure either, that's why I didn't PR this modification 😉 — Reply to this email directly, view it on GitHub <#874 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BYZYU7ZIFBI3VGHQGQQ6LRL3Y6DUPAVCNFSM6AAAAACJZBQHQ6VHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTINZVGE3DIOA> . You are receiving this because you authored the thread.Message ID: ***@***.***>

-- Séanadh Ríomhphoist / Email Disclaimer Tá an ríomhphost seo agus aon chomhad a sheoltar leis faoi rún agus is lena úsáid ag an seolaí agus sin amháin é. Tá cosc iomlán ar scaipeadh, dháileadh nó chóipeáil neamhúdaraithe ar an teachtaireacht seo agus ar aon cheangaltán atá ag dul leis. Má tá an ríomhphost seo faighte agat trí dhearmad cuir sin in iúl le do thoil don seoltóir agus scrios an teachtaireacht. D’fhéadfadh sé gurb iad tuairimí an údair agus sin amháin atá in aon tuairimí nó dearcthaí atá curtha i láthair sa ríomhphost seo agus níor chóir glacadh leo mar thuairimí nó dhearcthaí Ollscoil Chathair Bhaile Átha Cliath. Ní ghlactar leis go bhfuil cumarsáid ríomhphoist den sórt seo saor ó víreas, in am, slán, nó saor ó earráid agus ní ghlacann Ollscoil Chathair Bhaile Átha Cliath le dliteanas in aon chás den sórt sin ná as aon iarmhairt a d’eascródh astu. This e-mail and any files transmitted with it are confidential and are intended solely for use by the addressee. Any unauthorised dissemination, distribution or copying of this message and any attachments is strictly prohibited. If you have received this e-mail in error, please notify the sender and delete the message. Any views or opinions presented in this e-mail may solely be the views of the author and cannot be relied upon as being those of Dublin City University. E-mail communications such as this cannot be guaranteed to be virus-free, timely, secure or error-free and Dublin City University does not accept liability for any such matters or their consequences.

-- <https://www.facebook.com/DCU/> <https://twitter.com/DCU> <https://www.linkedin.com/company/dublin-city-university> <https://www.instagram.com/dublincityuniversity/?hl=en> <https://www.youtube.com/user/DublinCityUniversity>