| 开发者 | matureman |
|---|---|
| 更新时间 | 2026年10月29日 19:26 |
| PHP版本: | 8.0 及以上 |
| WordPress版本: | 7.0 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
[getsitecalendar] shortcode for the full calendar UI[getsitecalendar_list] shortcode for upcoming-events lists[getsitecalendar_search] shortcode for filter formsPCAL- order numbers for unified audit trailsite-calendar-lite to /wp-content/plugins/, or install via Plugins → Add New[getsitecalendar] shortcode to display the calendarYes — fully free, GPLv2, no hidden upsells, no telemetry. The free version is a complete usable calendar plugin in its own right. Site Calendar Pro is an optional upgrade for sites that need advanced views, paid ticketing, or door check-in.
Yes. The shortcodes work inside any Shortcode block, and the calendar renders cleanly inside is-layout-constrained parents.
The free version doesn't require WooCommerce. Site Calendar Pro can route paid ticket sales through your existing WooCommerce gateways if you have it active.
Site Calendar Pro hooks into Lite's existing data model — same custom post types, same meta keys, same database tables. Installing Pro alongside Lite preserves every event, venue, organizer, and attendee record.
No. Site Calendar Lite is under 110 KB total and loads its CSS / JS only on pages that contain the shortcode. There are no remote calls and no analytics.
Yes. Site Calendar → Settings → Appearance lets you pick a primary colour, accent colour, event-link colour, and Week view chip colour. Background, border and hover shades are derived automatically from each picked colour.
class-pcal-rsvp-form.php now loops over every ticket type in the submitted cart and registers an attendee for each one. Earlier Lite builds only registered the first ticket type (via array_key_first()) and silently discarded the rest, pushing users to upgrade for multi-ticket support. That behaviour violated WP.org guideline 5 (no functionality locked behind a paid upgrade) and has been removed entirely. Lite now supports as many ticket types per registration as the event admin has created.phpcs:ignore escape-output annotations in class-pcal-shortcodes.php with proper wp_kses() calls using a new pcal_calendar_kses_allowed() allowlist (in helpers.php). The allowlist covers the structural HTML the calendar emits — div, span, table, time, figure, picture, svg, etc. — plus data-* and aria-* attributes used by the front-end JS to hydrate templates. Output-side escaping is now compliant with WP.org's "escape late" rule, no exceptions remain.<style> block (mobile responsive overrides in class-pcal-archive-list.php) from a direct echo '<style>' call to wp_add_inline_style() attached to the front-end stylesheet, per WP.org's enqueue requirement.pcal_ticket and pcal_attendee are admin-visible under Site Calendar in wp-admin. Admins can create tickets for any event (one or more ticket types, each with label, price, capacity, max-per-order, sort order, and an optional description). The Attendees list shows every front-end RSVP registration with name, email, event, ticket type, quantity, status, and registration timestamp.edit_posts capability see the full record). Prevents unauthenticated scraping of contact data not otherwise published on the front-end. Affects /wp-json/pcal/v1/events, /events/<id>, /venues, /venues/<id>, /organizers, /organizers/<id>.[getsitecalendar] (replaces [pro_calendar])[getsitecalendar_list] (replaces [pro_calendar_list])[getsitecalendar_search] (replaces [pro_calendar_search])[getsitecalendar_rsvp] (replaces [pro_calendar_rsvp])
The previous shortcode names are kept registered as silent backward-compatibility aliases, so existing customer sites continue to render correctly without any action required. New documentation and the in-plugin Help tab now use the new names.load_plugin_textdomain() call from class-pcal-plugin.php. WordPress.org auto-loads translations for hosted plugins since WP 4.6, so the manual call is discouraged and unnecessary.uninstall.php ($post_types → $pcal_post_types, etc.).phpcs:ignore annotations with justifications for the legitimate uses of the WordPress core the_content filter in REST responses (processes shortcodes/oEmbeds, matching standard WP behaviour).phpcs:disable annotations with justifications for WordPress cache plugin standard constants (DONOTCACHEPAGE, DONOTCACHEOBJECT, DONOTCACHEDB) in class-pcal-archive-list.php to match what we already did in class-pcal-month-grid.php and class-pcal-rsvp-form.php.phpcs:ignore annotation with justification for the one direct database query in uninstall.php that finds and deletes every plugin record across the site (caching is meaningless for a one-shot uninstall operation).esc_url(), esc_attr(), esc_html(), wp_kses_post(), or cast to (int). URLs are built unescaped and escaped late at output site (best practice). Pre-built HTML fragments returned from internal renderers (PCAL_Filters, PCAL_Month_Grid, PCAL_Week_View, PCAL_Day_View, PCAL_Photo_View, PCAL_Archive_List, PCAL_Thumb) are documented with phpcs:ignore comments explaining why they are safe.date() call replaced with gmdate() for deterministic UTC behaviour, except date_i18n() calls which intentionally use site locale.$_GET / $_POST read now uses wp_unslash() followed by an appropriate sanitiser (sanitize_key, sanitize_text_field, sanitize_email, absint, etc.). Read-only navigation parameters (filter inputs, view switching) are documented as such with phpcs:ignore for the nonce sniff since no data is mutated.sprintf( __() ) / printf( esc_html__() ) call with placeholders now has a /* translators: */ comment directly above the gettext call for translator clarity.PCAL_. The three WordPress cache-plugin standard constants (DONOTCACHEPAGE, DONOTCACHEOBJECT, DONOTCACHEDB) are documented with phpcs:disable since these names are fixed by the WP cache plugin ecosystem (W3TC, WP Super Cache, etc.).wp_safe_redirect() with the gateway host explicitly added via allowed_redirect_hosts filter.@unlink() with wp_delete_file() (WP.org-recommended wrapper). The one remaining file_put_contents() call (used to write a temporary .ics attachment that is immediately consumed by wp_mail() then unlinked) is documented with a justification comment.<style> removed: The dynamic colour-variables <style> block in class-pcal-assets.php is now attached via wp_add_inline_style() instead of being echoed from a wp_head hook./wp-json/pcal/v1/events and /wp-json/pcal/v1/events/<id>) no longer return custom-field values that are marked as show_public=false. Internal-only custom fields are filtered out of the response. Authenticated integrations needing internal fields should register their own route with a proper permission_callback.sanitize_text_field() / sanitize_email() at the earliest possible point in the submission handler, before being passed to attendee registration or payment-gateway buyer data.pro-calendar to getsitecalendar-lite across all 388 gettext call sites, matching the WordPress.org plugin slug. Translation files (if any exist downstream) will need to be re-keyed; no existing translations are bundled.Tested up to to WordPress 7.0. Removed an internal-only MIGRATION.md development file that shouldn't have been included in the production build.wp_enqueue_script() inside a wp_footer priority 99 callback, which runs AFTER wp_print_footer_scripts (priority 20) has already emitted the script tags — so ical-injector.js was never actually loaded on the page. The <template> element was correctly emitted, but the injector that reads it never ran. 1.1.1.13 moves the enqueue to the wp_enqueue_scripts hook so the script tag is emitted at the correct point in the page lifecycle. The Add-to-calendar button (Google/Outlook/.ics) on single-event pages was affected by the same bug and is also fixed.<script> and <style> blocks into proper wp_enqueue_script / wp_enqueue_style / wp_add_inline_script / wp_add_inline_style calls. New asset files: assets/js/ical-injector.js, assets/js/recurrence-ui.js, assets/css/help-screen.css. Affected screens: Settings (colour picker), single event page (Add to calendar), archive (Subscribe), Help admin screen, recurrence meta box, admin Add-Ons submenu styling.wp_verify_nonce() reads with sanitize_text_field( wp_unslash( ... ) ) per WordPress.org guideline that nonce inputs should be sanitized even though wp_verify_nonce is pluggable. Affected save handlers: event meta, featured flag, event options, venue meta, organizer meta, recurrence rule, RSVP form, plugin settings.class-pcal-schema.php with explicit wp_json_encode() step and phpcs-ignore annotation justifying the deliberate non-escaping of the encoded payload.permission_callback => '__return_true' confirming that event, venue, and organizer GET endpoints are intentionally public read-only data, matching the visibility of the underlying posts.add_filter( 'pcal_show_credit', '__return_false' ); in their theme, and Site Calendar Pro 1.1.3+ adds a one-click hide toggle in Settings → Appearance.pcal_show_credit filter hook for full programmatic control of the credit.?pcal_view=list) now stacks vertically below 720px wide. Previously the 280×170 featured image had flex-shrink: 0 set inline, which on phone viewports starved the title column to ~11 pixels wide — causing event titles, dates and excerpts to wrap one letter per line. The fix emits scoped !important CSS rules (necessary because the layout uses inline styles, specificity 1000) that flip the row to vertical-stack: date on top, image full-width, title and excerpt below.[getsitecalendar_list] shortcode — the category attribute now accepts a comma-separated list of category slugs (e.g. category="1st-xv,2nd-xv,fixtures") with an OR-match. Works in both compact and classic layouts.pcal_hex_to_rgba() for tinting colours; pcal_sanitize_hex() now accepts a per-setting fallback default.--pcal-week-chip, --pcal-week-chip-bg, --pcal-week-chip-border, --pcal-week-chip-hover).rsvp-mount.js so the Register / RSVP form actually appears on event pages. Without this file the form HTML rendered into the page footer but never mounted into a visible position. Strongly recommended for any site using ticketing or free RSVP.PCAL_Thumb helper class with three fallback paths: WordPress featured image at thumbnail size, a category-coloured icon tile (13 categories), or two-letter title initials in a brand-blue circle._pcal_recurrence meta still renders correctly./events response includes both legacy organizer (single) and new organizers (array) fields.