cal.diy

Files

T

Pranjul Chaurasiya 038381aeca fix: trim whitespace in parseIpFromHeaders to prevent IP banlist bypass (#29857 )

* fix: trim whitespace in parseIpFromHeaders to prevent IP banlist bypass

Fixes #29851

parseIpFromHeaders did not trim whitespace after splitting on comma
(or from array elements), so a padded x-forwarded-for header like
' 1.2.3.4 , 5.6.7.8' would fail an exact-match lookup against
IP_BANLIST, allowing a banned IP to bypass the check.

Added regression tests covering padded string, array, and an
end-to-end isIpInBanlist test reproducing the reported bypass.

* fix: address CodeRabbit review feedback

- Guard against undefined rawIp when parsing an empty header array
- Delete IP_BANLIST env var in test cleanup instead of assigning undefined
- Add regression test for empty array input to parseIpFromHeaders

* test: add regression test for tab/whitespace trimming in parseIpFromHeaders

2026-07-31 20:49:53 +00:00

__mocks__

refactor: Cal.diy (#28903 )

2026-04-15 09:52:36 -03:00

__tests__

refactor: extract dedicated @calcom/i18n package (#28141 )

2026-02-23 13:30:12 +00:00

apps

refactor: apply biome formatting to packages/sms, prisma, emails, lib (#27880 )

2026-02-13 07:39:01 -03:00

auth

refactor: remove @calcom/features dependency from @calcom/prisma (#23820 )

2025-09-18 16:40:39 +00:00

bookings

refactor: calEventParser CalendarEvent ISP (#25890 )

2026-01-17 10:40:01 +05:30

browser

fix: Scrolling to timeslot issue on Safari with inline-embeds (#22547 )

2025-07-23 04:26:08 -03:00

builders/CalendarEvent

refactor: extract dedicated @calcom/i18n package (#28141 )

2026-02-23 13:30:12 +00:00

components

fix: resolve noNonNullAssertion and noImplicitAnyLet lint issues (#27021 )

2026-01-19 20:07:18 -03:00

crmManager

refactor: Remove circular deps between @calcom/lib and @calcom/features [1] (#24399 )

2025-10-13 12:01:02 -03:00

crypto

feat: add encryptedKey column to Credential table for calendar integrations (#27154 )

2026-01-30 09:15:13 -03:00

cva

fix: typos in several package/ directories (#19495 )

2025-02-24 14:44:08 +00:00

dayjs

fix: display phone numbers and localized timezone in BookingDetailsSheet (#27909 )

2026-02-13 10:27:01 +00:00

domainManager

refactor: Cal.diy (#28903 )

2026-04-15 09:52:36 -03:00

dto

feat(flags): add @Memoize and @Unmemoize decorators for declarative caching (#27063 )

2026-01-22 16:26:27 +01:00

holidays

refactor: apply biome formatting to packages/sms, prisma, emails, lib (#27880 )

2026-02-13 07:39:01 -03:00

hooks

feat: add upgrade banners for teams and organizations (#27650 )

2026-03-05 18:19:01 +09:00

idempotencyKey

fix: Generate new idempotency key when round robin reassigning (#22065 )

2025-06-26 17:43:31 +00:00

intervalLimits

feat: make source required on EventBusyDetails for Troubleshooter display (#27088 )

2026-03-06 14:53:14 -03:00

payment

refactor: circular deps between app store and lib [3] (#23742 )

2025-09-14 11:24:16 -03:00

schedules/transformers

refactor: apply biome formatting to packages/sms, prisma, emails, lib (#27880 )

2026-02-13 07:39:01 -03:00

server

fix: zero-pad username suggestion suffix consistently (#29571 )

2026-06-19 05:37:42 +00:00

service

refactor: Cal.diy (#28903 )

2026-04-15 09:52:36 -03:00

sync

refactor: Cal.diy (#28903 )

2026-04-15 09:52:36 -03:00

tasker

refactor: apply biome formatting to packages/sms, prisma, emails, lib (#27880 )

2026-02-13 07:39:01 -03:00

test

refactor: Cal.diy (#28903 )

2026-04-15 09:52:36 -03:00

tracing

refactor: apply biome formatting to packages/sms, prisma, emails, lib (#27880 )

2026-02-13 07:39:01 -03:00

tracking

refactor: apply biome formatting to packages/sms, prisma, emails, lib (#27880 )

2026-02-13 07:39:01 -03:00

unstable_cache

perf: server-fetch data for all pages in /settings/my-account (#20712 )

2025-07-24 22:36:40 +01:00

zod

refactor: apply biome formatting to packages/sms, prisma, emails, lib (#27880 )

2026-02-13 07:39:01 -03:00

array.test.ts

feat: Support event level conflict checking (#18052 )

2024-12-19 19:34:24 +00:00

array.ts

feat: Support event level conflict checking (#18052 )

2024-12-19 19:34:24 +00:00

availability.ts

refactor: apply biome formatting to packages/sms, prisma, emails, lib (#27880 )

2026-02-13 07:39:01 -03:00

buildCalEventFromBooking.ts

refactor: Cal.diy (#28903 )

2026-04-15 09:52:36 -03:00

CalendarAppError.ts

chore: rename DWD to DelegationCredential (#19744 )

2025-03-05 10:42:20 -03:00

CalendarService.test.ts

refactor: Cal.diy (#28903 )

2026-04-15 09:52:36 -03:00

CalendarService.ts

refactor: Cal.diy (#28903 )

2026-04-15 09:52:36 -03:00

CalEventParser.test.ts

fix(CalEventParser): skip null/undefined values in getUserFieldsResponses (#29703 )

2026-07-08 18:01:41 +00:00

CalEventParser.ts

fix(CalEventParser): skip null/undefined values in getUserFieldsResponses (#29703 )

2026-07-08 18:01:41 +00:00

checkIfItFallbackImage.ts

fix avatar remove button (#12249 )

2023-11-15 15:23:33 +05:30

checkRateLimitAndThrowError.test.ts

fix: prevent negative wait time in rate limit error message (#28765 )

2026-04-07 18:27:44 +00:00

checkRateLimitAndThrowError.ts

fix: prevent negative wait time in rate limit error message (#28765 )

2026-04-07 18:27:44 +00:00

CloseCom.ts

fix: resolve noNonNullAssertion and noImplicitAnyLet lint issues (#27021 )

2026-01-19 20:07:18 -03:00

CloseComeUtils.ts

refactor: Cal.diy (#28903 )

2026-04-15 09:52:36 -03:00

connectedCalendar.ts

feat: Support event level conflict checking (#18052 )

2024-12-19 19:34:24 +00:00

constants.ts

refactor: Cal.diy (#28903 )

2026-04-15 09:52:36 -03:00

contructEmailFromPhoneNumber.ts

feat: booking with phone number (#14461 )

2024-09-11 17:56:04 -07:00

convertToNewDurationType.ts

fix: Correct hours-to-days conversion in convertToNewDurationType (#27964 )

2026-02-15 21:01:00 +05:30

cookie.ts

feat: google ads conversion tracking (#25198 )

2025-11-25 12:58:10 +00:00

crypto.test.ts

fix: handle non-deterministic AES-256-CBC decryption in crypto test (#26383 )

2026-01-01 23:18:35 -03:00

crypto.ts

Prefix node protocol (#26391 )

2026-01-02 12:47:00 +00:00

csvUtils.ts

refactor: apply biome formatting to packages/sms, prisma, emails, lib (#27880 )

2026-02-13 07:39:01 -03:00

currencyConversions.ts

refactor: circular deps between app store and lib [5] (#23936 )

2025-09-19 10:16:56 -03:00

dateTimeFormatter.test.ts

fix: add Icelandic, Lithuanian, and Norwegian locale support for Booker (#25519 )

2026-01-13 08:47:39 -03:00

dateTimeFormatter.ts

fix: add Icelandic, Lithuanian, and Norwegian locale support for Booker (#25519 )

2026-01-13 08:47:39 -03:00

dbReadResponseSchema.ts

refactor: Remove circular deps between @calcom/lib and @calcom/features [2] (#24438 )

2025-10-17 06:48:08 -03:00

default-cookies.ts

refactor: cookie domain logic in defaultCookies (#22168 )

2025-06-30 20:21:16 +00:00

defaultAvatarImage.ts

fix: #14769 (#14777 )

2024-04-27 18:14:37 +02:00

delegationCredential.ts

refactor: Cal.diy (#28903 )

2026-04-15 09:52:36 -03:00

deriveAppDictKeyFromType.ts

chore: removed last web3 references (#12540 )

2023-11-29 11:57:50 +00:00

emailSchema.ts

fix: Hotfix in change from @spammer.com to spammer.com (#24479 )

2025-10-15 15:38:14 +01:00

entityPermissionUtils.shared.ts

refactor: prevents mixed server/clients imports (#21499 )

2025-05-25 09:07:49 +00:00

env.ts

Feature: Verify login on signup with magic link. (#2122 )

2022-04-21 14:32:25 -06:00

errorCodes.ts

fix: Improve the error handling in Stripe collectCard method (#27249 )

2026-01-27 06:47:11 +00:00

errors.ts

refactor: apply biome formatting to packages/sms, prisma, emails, lib (#27880 )

2026-02-13 07:39:01 -03:00

extract-base-email.ts

chore: Add guest email blacklist (#15255 )

2024-05-30 17:13:34 +00:00

fetch-wrapper.ts

feat: Allow reschedule when max booker bookings have been reached (#21778 )

2025-06-13 23:54:33 +00:00

fetchUsername.ts

fix: Correctly prefill username in case of non-org email invite in an org (#12854 )

2023-12-19 02:44:48 +00:00

fetchWithTimeout.ts

fix: refactor i18n loadTranslations and set timeout to 3s (#22878 )

2025-08-04 10:30:18 +01:00

findDurationType.ts

Enforces explicit type imports (#7158 )

2023-02-16 15:39:57 -07:00

formatCalendarEvent.ts

refactor: Cal.diy (#28903 )

2026-04-15 09:52:36 -03:00

formatPhoneNumber.ts

refactor: small improvements for cal ai (#23444 )

2025-08-29 17:42:15 +05:30

formbricks.ts

feat: custom feedback dialog for feature opt-in (#27578 )

2026-02-05 11:01:14 +00:00

fromEntriesWithDuplicateKeys.ts

fix: replace @ts-ignore with @ts-expect-error to fix biome lint errors (#26849 )

2026-01-14 19:05:57 -03:00

generateHashedLink.ts

feat: Multiple Private links per Event Type (#15896 )

2024-10-03 00:58:54 +05:30

getAdditionalEmailHeaders.ts

fix: add sendgrid-specific header only for SendGrid smtp server (#11932 )

2023-11-16 13:51:30 -03:00

getAvatarUrl.ts

fix: avatar URL breaking for team/orgs in BookerEmbed atom (#27424 )

2026-02-03 17:19:48 +00:00

getBooking.tsx

refactor: apply biome formatting to packages/sms, prisma, emails, lib (#27880 )

2026-02-13 07:39:01 -03:00

getBrandColours.test.ts

refactor: Moving from jest to vitest (#9035 )

2023-05-24 23:35:44 +00:00

getBrandColours.tsx

fix: Use constants.ts for brand colours > db DEFAULT (#13167 )

2024-01-11 20:22:35 +00:00

getCalcomUrl.ts

fix: Add cal.eu to IS_CALCOM (#23111 )

2025-08-18 16:04:48 +05:30

getClientErrorFromUnknown.ts

refactor: remove tRPC references from packages/lib (#24553 )

2025-10-27 18:13:25 +00:00

getIP.test.ts

fix: trim whitespace in parseIpFromHeaders to prevent IP banlist bypass (#29857 )

2026-07-31 20:49:53 +00:00

getIP.ts

fix: trim whitespace in parseIpFromHeaders to prevent IP banlist bypass (#29857 )

2026-07-31 20:49:53 +00:00

getMetadataHelpers.ts

feat: admin org list now shows all, dns check added (#10875 )

2023-08-23 21:01:12 +00:00

getOrgIdFromMemberOrTeamId.ts

fix: cal ai webhook (#24368 )

2025-11-05 13:31:55 +04:00

getReplyToEmail.test.ts

feat: custom reply To Email (#20771 )

2025-04-23 06:44:44 -07:00

getReplyToEmail.ts

fix: replyTo includes the correct email (#21843 )

2025-06-17 10:45:44 +00:00

getReplyToHeader.test.ts

fix: join Reply-To addresses as string for SMTP compatibility (#28611 )

2026-03-28 13:08:52 +00:00

getReplyToHeader.ts

refactor: Cal.diy (#28903 )

2026-04-15 09:52:36 -03:00

getSafe.ts

feat: Upgrade to Next 15 (#18834 )

2025-03-20 21:30:51 -03:00

getSafeRedirectUrl.test.ts

Prevent xss in preview aand load resources from known URL (#18978 )

2025-02-05 12:17:56 +05:30

getSafeRedirectUrl.ts

refactor: apply biome formatting to packages/sms, prisma, emails, lib (#27880 )

2026-02-13 07:39:01 -03:00

getTeamIdFromEventType.ts

feat: optimize Prisma queries by replacing findFirst with findUnique where applicable (#21826 )

2025-06-17 09:52:02 +03:00

getTldPlus1.ts

fix: correct bookingUrl for EU instance in API responses (#27046 )

2026-01-20 12:48:30 +00:00

getValidRhfFieldName.test.ts

feat: normalize routing form identifier field with URL-safe format (#25128 )

2025-11-18 11:24:33 +05:30

getValidRhfFieldName.ts

feat: normalize routing form identifier field with URL-safe format (#25128 )

2025-11-18 11:24:33 +05:30

gtm.ts

feat: gtm push signup event (#14031 )

2024-03-08 15:13:29 +00:00

hasEditPermissionForUser.ts

refactor: remove tRPC references from packages/lib (#24553 )

2025-10-27 18:13:25 +00:00

hashedLinksUtils.ts

refactor: apply biome formatting to packages/sms, prisma, emails, lib (#27880 )

2026-02-13 07:39:01 -03:00

hasKeyInMetadata.ts

feature/settings-username-update (#2306 )

2022-07-06 13:31:07 -06:00

http-error.ts

fix: replace @ts-ignore with @ts-expect-error to fix biome lint errors (#26849 )

2026-01-14 19:05:57 -03:00

i18n.ts

refactor: extract dedicated @calcom/i18n package (#28141 )

2026-02-23 13:30:12 +00:00

intervalTree.ts

perf: optimize filterRedundantDateRanges from O(n²) to O(n log n) (#22093 )

2025-07-03 10:59:33 +01:00

invertLogoOnDark.ts

fix: logo lack of contrast (#12401 )

2023-11-17 14:10:58 +00:00

isEqual.ts

feat: Attribute filter/Segment for Round Robin hosts (#17361 )

2024-11-20 10:22:53 +05:30

isEventTypeColor.ts

feat: Assign colors to events (#15298 )

2024-08-14 15:10:40 +02:00

isKeyInObject.ts

Adds basic global feature flags (#7459 )

2023-03-24 17:59:04 -07:00

isMac.ts

Adds a fully extensible command(ctrl)+k interface for Cal (#3346 )

2022-07-14 06:45:07 +00:00

isOutOfBounds.timezone.test.ts

fix: Stores the DateRange in UTC instead of user machine that caused the bug (#26900 )

2026-01-19 10:41:53 +02:00

isOutOfBounds.tsx

fix: resolve noNonNullAssertion and noImplicitAnyLet lint issues (#27021 )

2026-01-19 20:07:18 -03:00

isPrismaObj.ts

chore: Upgrade prisma to 6.7.0 (#21264 )

2025-09-11 15:27:50 +01:00

isProblematicTimezone.ts

Fix: Filter Timezones by cities (#7540 )

2023-03-06 17:52:20 +00:00

isRecurringEvent.ts

feat(lib): add more tests to lib package (#7210 )

2023-03-10 22:10:56 +00:00

isSmsCalEmail.ts

feat: booking with phone number (#14461 )

2024-09-11 17:56:04 -07:00

jest.config.json

refactor: v2 event-types (#15457 )

2024-06-21 10:49:12 +00:00

jsonUtils.ts

App Store (#1869 )

2022-03-23 15:00:30 -07:00

LinkBuilder.ts

feat: add platform URL support for reschedule and cancel links in workflow emails (#27132 )

2026-03-13 15:48:51 +04:00

logger.server.ts

refactor: apply biome formatting to packages/sms, prisma, emails, lib (#27880 )

2026-02-13 07:39:01 -03:00

logger.ts

Add DI for BookingAudit (#25123 )

2025-11-28 09:14:48 +00:00

markdownIt.ts

Fixes formatted description in email + sanitize html everywhere (#7928 )

2023-03-28 09:40:13 +00:00

markdownToSafeHTML.ts

fix(ui): render markdown headings properly in event descriptions (#29648 )

2026-07-03 11:52:08 +05:30

markdownToSafeHTMLClient.ts

fix(ui): render markdown headings properly in event descriptions (#29648 )

2026-07-03 11:52:08 +05:30

navigateInTopWindow.ts

fix: Broken navigation after booking creation in some cases (#15664 )

2024-07-08 13:56:58 +00:00

next-seo.config.ts

chore: Adds deprecated-imports-next-router (#14486 )

2024-04-16 11:46:45 +01:00

notEmpty.ts

App Store (#1869 )

2022-03-23 15:00:30 -07:00

objectKeys.ts

Enables strict mode in nextjs apps (#2354 )

2022-04-04 20:26:14 +00:00

OgImages.test.ts

refactor: apply biome formatting to packages/sms, prisma, emails, lib (#27880 )

2026-02-13 07:39:01 -03:00

OgImages.tsx

refactor: apply biome formatting to packages/sms, prisma, emails, lib (#27880 )

2026-02-13 07:39:01 -03:00

package.json

refactor: extract dedicated @calcom/i18n package (#28141 )

2026-02-23 13:30:12 +00:00

parse-dates.ts

fix: recurring events with calendar connections (#12250 )

2023-11-07 12:09:56 -03:00

parse-zone.ts

New Booker Component (preparations for booker atom) (#6792 )

2023-04-24 16:32:30 +02:00

perf.ts

fix: replace console logging with logger across services and features (#26127 )

2025-12-23 08:24:23 +00:00

piiFreeData.ts

chore: Upgrade prisma to 6.7.0 (#21264 )

2025-09-11 15:27:50 +01:00

pkce.test.ts

feat: OAuth PKCE (#25313 )

2025-11-26 17:02:42 +01:00

pkce.ts

Prefix node protocol (#26391 )

2026-01-02 12:47:00 +00:00

random.test.ts

refactor: Moving from jest to vitest (#9035 )

2023-05-24 23:35:44 +00:00

random.ts

feat(lib): add more tests to lib package (#7210 )

2023-03-10 22:10:56 +00:00

rateLimit.ts

refactor: apply biome formatting to packages/sms, prisma, emails, lib (#27880 )

2026-02-13 07:39:01 -03:00

recentImpersonations.ts

feat: implement recent impersonations list with localStorage storage (#23610 )

2025-09-06 19:56:08 +05:30

recurringStrings.ts

fix: Recurring events set to "yearly" don't recur (#24361 )

2025-11-03 16:20:15 +00:00

redactError.ts

Avoid using prisma types on client (#23566 )

2025-09-04 00:58:13 +00:00

redactSensitiveData.test.ts

feat: add missing sensitive fields to redactSensitiveData (#24121 )

2025-10-01 20:26:58 -03:00

redactSensitiveData.ts

feat: add missing sensitive fields to redactSensitiveData (#24121 )

2025-10-01 20:26:58 -03:00

redirect.ts

refactor: Billing service (#15366 )

2024-10-04 13:44:50 -07:00

retellAIFetcher.ts

feat: retell AI webhook url (#14430 )

2024-04-05 22:44:57 +05:30

safeStringify.ts

fix: Show error log (#14960 )

2024-05-10 08:47:57 +01:00

sanitizeCalendarObject.ts

Caldav/refactor: Mutiple Fixes and General code improvement (#8031 )

2023-04-12 14:30:39 -03:00

sdk-event.ts

feat: Add framework to send all events fired for embed to Analytics Apps (#15173 )

2024-05-31 16:07:09 +00:00

Sendgrid.ts

chore: update tslog from 3.2.1 to 4.9.2 (#11717 )

2023-10-17 19:00:48 +00:00

sentryWrapper.ts

refactor: apply biome formatting to packages/sms, prisma, emails, lib (#27880 )

2026-02-13 07:39:01 -03:00

serverConfig.ts

feat: add resend email transport (#12645 )

2023-12-04 15:31:55 -08:00

slugify-lenient.ts

slugify lenient (#25923 )

2025-12-16 14:01:54 +00:00

slugify.test.ts

fix: typos in several package/ directories (#19495 )

2025-02-24 14:44:08 +00:00

slugify.ts

fix: replace @ts-ignore with @ts-expect-error to fix biome lint errors (#26849 )

2026-01-14 19:05:57 -03:00

smsLockState.ts

fix: resolve noNonNullAssertion and noImplicitAnyLet lint issues (#27021 )

2026-01-19 20:07:18 -03:00

ssrfProtection.test.ts

refactor: Cal.diy (#28903 )

2026-04-15 09:52:36 -03:00

ssrfProtection.ts

refactor: Cal.diy (#28903 )

2026-04-15 09:52:36 -03:00

stripe-error.ts

refactor: Error code - remove circular dep between app store <-> lib (#23669 )

2025-09-08 07:31:28 -03:00

stripMarkdown.ts

fix: strip markdown from meta description tag in users page (#8769 )

2023-05-15 07:44:23 +00:00

telemetry.ts

refactor: Cal.diy (#28903 )

2026-04-15 09:52:36 -03:00

testEmails.ts

test: testing workflow triggers (#12823 )

2023-12-21 18:57:06 +05:30

testSMS.ts

test: add unit tests for sms sending (#14737 )

2024-05-02 10:42:38 -04:00

text.test.ts

refactor: Cal.diy (#28903 )

2026-04-15 09:52:36 -03:00

text.ts

refactor: Cal.diy (#28903 )

2026-04-15 09:52:36 -03:00

timeFormat.ts

refactor: event type builder (#19459 )

2025-03-20 07:49:14 -07:00

timeShift.ts

feat: add time shift badge for recurring events with shifted local times (#25568 )

2025-12-11 20:18:00 +00:00

timezone.ts

fix: timezone-dropdown (#23469 )

2025-08-31 08:20:19 +00:00

timezoneConstants.ts

perf: Remove dayjs import from main constants.ts file (#19644 )

2025-03-11 10:37:51 +00:00

timeZones.ts

chore: remove companion app (moved to calcom/companion) (#27957 )

2026-02-16 10:08:24 -03:00

totp.ts

fix: add 2fa and email verification grace period (#10771 )

2023-08-17 16:13:04 +02:00

translationConstants.ts

feat: workflow auto translation (#27087 )

2026-02-25 01:03:55 +05:30

triggerDevLogger.ts

feat: Booking EmailAndSms Notifications Tasker (#24944 )

2025-11-28 14:00:04 +00:00

tsconfig.json

perf: Remove tRPC types from @calcom/lib (#24551 )

2025-10-19 13:14:25 +00:00

tsconfig.test.json

feat(lib): add more tests to lib package (#7210 )

2023-03-10 22:10:56 +00:00

turndownService.ts

chore: plain text plugin for Editor (#17134 )

2024-11-11 20:23:12 +05:30

validateBookerLayouts.ts

feat: event settings booker layout toggle (#9082 )

2023-06-06 15:31:43 +00:00

videoTokens.ts

refactor: apply biome formatting to packages/sms, prisma, emails, lib (#27880 )

2026-02-13 07:39:01 -03:00

WebAppURL.ts

chore: Introduce a new class WebAppURL that extends URL (#14982 )

2024-07-18 07:27:34 +00:00

webstorage.ts

refactor: Use sessionStorage instead of localStorage for decoy booking data (#24450 )

2025-12-12 07:42:44 -03:00

weekday.test.ts

fix: add Icelandic, Lithuanian, and Norwegian locale support for Booker (#25519 )

2026-01-13 08:47:39 -03:00

weekday.ts

fix: add Icelandic, Lithuanian, and Norwegian locale support for Booker (#25519 )

2026-01-13 08:47:39 -03:00

weekstart.test.ts

fix: #15749 Display availability page as per weekstart setting (#15753 )

2024-07-16 11:31:02 +02:00

weekstart.ts

fix: #15749 Display availability page as per weekstart setting (#15753 )

2024-07-16 11:31:02 +02:00