MRBS 1.12.2 等保2.0二级整改完整提交

包含：登录失败锁定、90天密码有效期、30分钟会话超时、
强制改密、登录审计日志、屏幕水印、企业背景图、
备案信息固定底部、favicon、登录页JS修复等全部改动

web/upgrade/1/mysql.sql

@@ -0,0 +1,11 @@
+
+CREATE TABLE %DB_TBL_PREFIX%variables
+(
+  id               int NOT NULL auto_increment,
+  variable_name    varchar(80),
+  variable_content text,
+      
+  PRIMARY KEY (id)
+);
+INSERT INTO %DB_TBL_PREFIX%variables (variable_name, variable_content)
+  VALUES ( 'db_version', '1');

web/upgrade/1/pgsql.sql

@@ -0,0 +1,9 @@
+
+CREATE TABLE %DB_TBL_PREFIX%variables
+(
+  id               serial primary key,
+  variable_name    varchar(80),
+  variable_content text
+);
+INSERT INTO %DB_TBL_PREFIX%variables (variable_name, variable_content)
+  VALUES ('db_version', '1');

web/upgrade/10/mysql.sql

@@ -0,0 +1,11 @@
+#
+# Add column to record the last time a reminder was sent.
+# (Unfortunately, timestamps in PostgreSQL are not automatically
+# updated on UPDATE, so updating the reminders count does not have
+# the effect of changing the timestamp, as it does in MySQL).
+
+ALTER TABLE %DB_TBL_PREFIX%entry
+ADD COLUMN reminded            int;
+
+ALTER TABLE %DB_TBL_PREFIX%repeat
+ADD COLUMN reminded            int;

web/upgrade/10/pgsql.sql

@@ -0,0 +1,11 @@
+--
+-- Add column to record the last time a reminder was sent.
+-- (Unfortunately, timestamps in PostgreSQL are not automatically
+-- updated on UPDATE, so updating the reminders count does not have
+-- the effect of changing the timestamp, as it does in MySQL).
+
+ALTER TABLE %DB_TBL_PREFIX%entry
+ADD COLUMN reminded            int;
+
+ALTER TABLE %DB_TBL_PREFIX%repeat
+ADD COLUMN reminded            int;

web/upgrade/11/mysql.sql

@@ -0,0 +1,9 @@
+#
+# Add columns to record the minimum and maximum times in advance
+# that ordinary users may make bookings
+
+ALTER TABLE %DB_TBL_PREFIX%area
+ADD COLUMN min_book_ahead_enabled    tinyint,
+ADD COLUMN min_book_ahead_secs       int,
+ADD COLUMN max_book_ahead_enabled    tinyint,
+ADD COLUMN max_book_ahead_secs       int;

web/upgrade/11/pgsql.sql

@@ -0,0 +1,9 @@
+--
+-- Add columns to record the minimum and maximum times in advance
+-- that ordinary users may make bookings
+
+ALTER TABLE %DB_TBL_PREFIX%area
+ADD COLUMN min_book_ahead_enabled  smallint,
+ADD COLUMN min_book_ahead_secs     int,
+ADD COLUMN max_book_ahead_enabled  smallint,
+ADD COLUMN max_book_ahead_secs     int;

web/upgrade/12/mysql.sql

@@ -0,0 +1,10 @@
+#
+# Adds a 'custom_html' field to the area and room tables.   Designed for
+# allowing, for example, an embedded Google Maps link to be displayed, but
+# could also contain any custom HTML.
+
+ALTER TABLE %DB_TBL_PREFIX%area 
+ADD COLUMN custom_html            text;
+
+ALTER TABLE %DB_TBL_PREFIX%room 
+ADD COLUMN custom_html            text;

web/upgrade/12/pgsql.sql

@@ -0,0 +1,10 @@
+--
+-- Adds a 'custom_html' field to the area and room tables.   Designed for
+-- allowing, for example, an embedded Google Maps link to be displayed, but
+-- could also contain any custom HTML.
+
+ALTER TABLE %DB_TBL_PREFIX%area 
+ADD COLUMN custom_html            text;
+
+ALTER TABLE %DB_TBL_PREFIX%room 
+ADD COLUMN custom_html            text;

web/upgrade/13/mysql.sql

@@ -0,0 +1,3 @@
+ALTER TABLE %DB_TBL_PREFIX%area
+ADD COLUMN provisional_enabled   tinyint,
+ADD COLUMN reminders_enabled     tinyint;

web/upgrade/13/pgsql.sql

@@ -0,0 +1,4 @@
+
+ALTER TABLE %DB_TBL_PREFIX%area 
+ADD COLUMN provisional_enabled    smallint,
+ADD COLUMN reminders_enabled      smallint;

web/upgrade/13/post.inc

@@ -0,0 +1,16 @@
+<?php
+namespace MRBS;
+
+// Populate the new columns in the area table with the default values taken
+// from the config file.
+
+global $provisional_enabled, $reminders_enabled;
+
+$provisional_enabled = ($provisional_enabled) ? 1 : 0;
+$reminders_enabled = ($reminders_enabled) ? 1 : 0;
+
+$sql = "UPDATE " . _tbl('area') . " SET
+        provisional_enabled=$provisional_enabled,
+        reminders_enabled=$reminders_enabled";
+
+$upgrade_handle->command($sql);

web/upgrade/14/mysql.sql

@@ -0,0 +1,12 @@
+# Add columns so that details about the last request for More Info on
+# provisional bookings can be recorded.
+
+ALTER TABLE %DB_TBL_PREFIX%entry 
+ADD COLUMN info_time    int,
+ADD COLUMN info_user    varchar(80),
+ADD COLUMN info_text    text;
+
+ALTER TABLE %DB_TBL_PREFIX%repeat 
+ADD COLUMN info_time    int,
+ADD COLUMN info_user    varchar(80),
+ADD COLUMN info_text    text;

web/upgrade/14/pgsql.sql

@@ -0,0 +1,13 @@
+
+-- Add columns so that details about the last request for More Info on
+-- provisional bookings can be recorded.
+
+ALTER TABLE %DB_TBL_PREFIX%entry 
+ADD COLUMN info_time    int,
+ADD COLUMN info_user    varchar(80),
+ADD COLUMN info_text    text;
+
+ALTER TABLE %DB_TBL_PREFIX%repeat 
+ADD COLUMN info_time    int,
+ADD COLUMN info_user    varchar(80),
+ADD COLUMN info_text    text;

web/upgrade/15/mysql.sql

@@ -0,0 +1 @@
+# Nothing to do

web/upgrade/15/post.inc

@@ -0,0 +1,29 @@
+<?php
+namespace MRBS;
+
+// Go through the area table and if any of the per-area settings are NULL then
+// set them to the area defaults
+
+require_once "standard_vars.inc.php";  // won't have been included yet and we need it for $area_defaults
+
+global $area_defaults, $boolean_fields;
+
+$fields = $upgrade_handle->field_info(_tbl('area'));
+foreach ($fields as $field)
+{
+  $key = $field['name'];
+  if (array_key_exists($key, $area_defaults))
+  {
+    if (in_array($key, $boolean_fields['area']))
+    {
+      $sql_val = ($area_defaults[$key]) ? 1 : 0;
+    }
+    else
+    {
+      $sql_val = $area_defaults[$key];
+    }
+    $sql = "UPDATE " . _tbl('area') . " SET $key=? WHERE $key IS NULL";
+    $upgrade_handle->command($sql, array($sql_val));
+  }
+}
+

web/upgrade/16/mysql.sql

@@ -0,0 +1,5 @@
+#
+# Add a column for enable_periods
+
+ALTER TABLE %DB_TBL_PREFIX%area
+ADD COLUMN enable_periods    tinyint;

web/upgrade/16/pgsql.sql

@@ -0,0 +1,5 @@
+--
+-- Add a column for enable_periods
+
+ALTER TABLE %DB_TBL_PREFIX%area
+ADD COLUMN enable_periods  smallint;

web/upgrade/16/post.inc

@@ -0,0 +1,12 @@
+<?php
+namespace MRBS;
+
+// Update the area table getting rid of NULLs for enable_periods and replacing them
+// with the default setting.
+
+global $enable_periods;
+
+// Convert booleans to 1 or 0, as the fields are tinyints/smallints
+$value = ($enable_periods) ? 1 : 0;
+
+$upgrade_handle->command("UPDATE " . _tbl('area') . " SET enable_periods=$value WHERE enable_periods IS NULL");

web/upgrade/17/mysql.sql

@@ -0,0 +1,2 @@
+ALTER TABLE %DB_TBL_PREFIX%repeat
+ADD COLUMN status    tinyint NOT NULL DEFAULT 0;

web/upgrade/17/pgsql.sql

@@ -0,0 +1,3 @@
+
+ALTER TABLE %DB_TBL_PREFIX%repeat 
+ADD COLUMN status    smallint DEFAULT 0 NOT NULL;

web/upgrade/17/post.inc

@@ -0,0 +1,89 @@
+<?php
+namespace MRBS;
+
+// We are about to introduce a new status, the confirmation status, for bookings
+// that are not 100% certain to happen.   Instead of introducing yet another column
+// in the database, we will use the existing status column to record any status information
+// as follows:
+//
+// Bit 0:  Privacy status (set = private)
+// Bit 1:  Approval status (set = not yet approved)
+// Bit 2:  Confirmation status (set = not yet confirmed)
+//
+// Thus a booking with status 0x00 is a "standard" booking, ie confirmed, approved
+// and open for all to see.
+//
+// This means that the existing status field has to be inverted (previously 1 or TRUE
+// meant confirmed) and shifted one place to the left.
+
+// In these queries we set timestamp=timestamp to prevent it being automatically set
+// to the current time (only applies to MySQL - PostgreSQL timestamps don't update,
+// but we'll do it anyway)
+
+
+// First of all update the entry table
+
+// Acquire mutex to lock out others trying to update the entry table (unlikely because
+// the only other people able to update the database at this stage will be site admins
+// who know the database username and password, but just in case ...)
+use MRBS\Errors\Errors;
+
+if (!$upgrade_handle->mutex_lock(_tbl('entry')))
+{
+  Errors::fatalError(get_vocab("failed_to_acquire"));
+}
+
+$sql = "UPDATE " . _tbl('entry') . "
+           SET status=(((~status)&1)<<1)|(private&1),
+               timestamp=timestamp";
+$upgrade_handle->command($sql);
+
+$upgrade_handle->mutex_unlock(_tbl('entry'));
+
+
+
+// Then do the repeat table.   This is slightly different from the entry table because
+// it did not previously have a status column.    (This was a mistake which we are
+// going to correct in a momemt.)
+
+// Acquire mutex to lock out others trying to update the repeat table (unlikely because
+// the only other people able to update the database at this stage will be site admins
+// who know the database username and password, but just in case ...)
+if (!$upgrade_handle->mutex_lock(_tbl('repeat')))
+{
+  Errors::fatalError(get_vocab("failed_to_acquire"));
+}
+
+$sql = "UPDATE " . _tbl('repeat') . "
+           SET status=private&1,
+               timestamp=timestamp";
+$upgrade_handle->command($sql);
+
+// Now get the approval status for the repeat table.   A series is considered to be
+// awaiting approval if any one of its individual members is awaiting approval.
+
+// Find all the rows in the entry table that are members of a series and are awaiting approval
+$sql = "SELECT DISTINCT repeat_id
+          FROM " . _tbl('entry') . "
+         WHERE repeat_id!=0
+           AND (status&" . STATUS_AWAITING_APPROVAL . " != 0)";
+$res = $upgrade_handle->query($sql);
+
+while (false !== ($row = $res->next_row_keyed()))
+{
+  // Set the approval status for each one
+  $sql = "UPDATE " . _tbl('repeat') . "
+             SET status=status|" . STATUS_AWAITING_APPROVAL . ",
+                 timestamp=timestamp
+           WHERE id=" . $row['repeat_id'];
+  $result = $upgrade_handle->command($sql);
+
+  if ($result != 1)
+  {
+    // Something's gone wrong.  No rows have been affected, which should not be the case
+    Errors::fatalError("Failed to update status column in repeat table with approval status.");
+  }
+}
+
+$upgrade_handle->mutex_unlock(_tbl('repeat'));
+

web/upgrade/18/mysql.sql

@@ -0,0 +1,8 @@
+# Remove the private columns as they are no longer needed
+# (the privacy status is now held in the status column)
+
+ALTER TABLE %DB_TBL_PREFIX%entry 
+DROP COLUMN private;
+
+ALTER TABLE %DB_TBL_PREFIX%repeat 
+DROP COLUMN private;

web/upgrade/18/pgsql.sql

@@ -0,0 +1,8 @@
+-- Remove the private columns as they are no longer needed
+-- (the privacy status is now held in the status column)
+
+ALTER TABLE %DB_TBL_PREFIX%entry 
+DROP COLUMN private;
+
+ALTER TABLE %DB_TBL_PREFIX%repeat 
+DROP COLUMN private;

web/upgrade/19/mysql.sql

@@ -0,0 +1,4 @@
+# Rename provisional bookings
+
+ALTER TABLE %DB_TBL_PREFIX%area 
+CHANGE provisional_enabled approval_enabled tinyint;

web/upgrade/19/pgsql.sql

@@ -0,0 +1,4 @@
+-- Rename provisional bookings
+
+ALTER TABLE %DB_TBL_PREFIX%area 
+RENAME COLUMN provisional_enabled TO approval_enabled;

web/upgrade/2/mysql.sql

@@ -0,0 +1,7 @@
+ALTER TABLE %DB_TBL_PREFIX%area
+ADD COLUMN resolution            int,
+ADD COLUMN default_duration      int,
+ADD COLUMN morningstarts         int,
+ADD COLUMN morningstarts_minutes int,
+ADD COLUMN eveningends           int,
+ADD COLUMN eveningends_minutes   int;

web/upgrade/2/pgsql.sql

@@ -0,0 +1,8 @@
+ALTER TABLE %DB_TBL_PREFIX%area
+ADD COLUMN resolution            int,
+ADD COLUMN default_duration      int,
+ADD COLUMN morningstarts         int,
+ADD COLUMN morningstarts_minutes int,
+ADD COLUMN eveningends           int,
+ADD COLUMN eveningends_minutes   int;
+

web/upgrade/2/post.inc

@@ -0,0 +1,18 @@
+<?php
+namespace MRBS;
+
+// Populate the new columns in the area table with the default values taken
+// from the config file.
+
+global $resolution, $default_duration;
+global $morningstarts, $morningstarts_minutes, $eveningends, $eveningends_minutes;
+
+$sql = "UPDATE " . _tbl('area') . " SET
+        resolution = $resolution,
+        default_duration = $default_duration,
+        morningstarts = $morningstarts,
+        morningstarts_minutes = $morningstarts_minutes,
+        eveningends = $eveningends,
+        eveningends_minutes = $eveningends_minutes";
+
+$upgrade_handle->command($sql);

web/upgrade/20/mysql.sql

@@ -0,0 +1,22 @@
+# Change the status fields in the entry and repeat tables
+# to be unsigned rather than signed (they are used as bit fields)
+# Note:  PostgreSQL does not have unsigned, but as the status
+# fields there are smallints (there are no tinyints in PostgreSQL)
+# it does not matter.
+
+ALTER TABLE %DB_TBL_PREFIX%entry 
+CHANGE status status tinyint unsigned NOT NULL DEFAULT 0;
+
+ALTER TABLE %DB_TBL_PREFIX%repeat
+CHANGE status status tinyint unsigned NOT NULL DEFAULT 0;
+
+
+# Add two new settings to the area table.  (Note:  we could combine
+# all the various 'booleans' into a integer field, in the same
+# way as status is handled in the entry and repeat tables, but
+# as there are relatively few rows in the area table, this does
+# not seem worth doing).
+
+ALTER TABLE %DB_TBL_PREFIX%area 
+ADD COLUMN confirmation_enabled    tinyint,
+ADD COLUMN confirmed_default       tinyint;

web/upgrade/20/pgsql.sql

@@ -0,0 +1,10 @@
+
+-- Add two new settings to the area table.  (Note:  we could combine
+-- all the various 'booleans' into a integer field, in the same
+-- way as status is handled in the entry and repeat tables, but
+-- as there are relatively few rows in the area table, this does
+-- not seem worth doing).
+
+ALTER TABLE %DB_TBL_PREFIX%area 
+ADD COLUMN confirmation_enabled    smallint,
+ADD COLUMN confirmed_default       smallint;

web/upgrade/21/mysql.sql

@@ -0,0 +1 @@
+# Nothing to do

web/upgrade/21/post.inc

@@ -0,0 +1,29 @@
+<?php
+namespace MRBS;
+
+// Go through the area table and if any of the per-area settings are NULL then
+// set them to the area defaults
+
+global $area_defaults, $boolean_fields;
+
+$fields = $upgrade_handle->field_info(_tbl('area'));
+foreach ($fields as $field)
+{
+  $key = $field['name'];
+  if (array_key_exists($key, $area_defaults))
+  {
+    if (in_array($key, $boolean_fields['area']))
+    {
+      $sql_val = ($area_defaults[$key]) ? 1 : 0;
+    }
+    else
+    {
+      $sql_val = $area_defaults[$key];
+    }
+    $sql = "UPDATE " . _tbl('area') . "
+               SET $key=?
+             WHERE $key IS NULL";
+    $upgrade_handle->command($sql, array($sql_val));
+  }
+}
+

web/upgrade/22/mysql.sql

@@ -0,0 +1,7 @@
+# Add a column to record whether the area/room is enabled or disabled for use
+
+ALTER TABLE %DB_TBL_PREFIX%area 
+ADD COLUMN disabled tinyint DEFAULT 0 NOT NULL AFTER id;
+
+ALTER TABLE %DB_TBL_PREFIX%room 
+ADD COLUMN disabled tinyint DEFAULT 0 NOT NULL AFTER id;

web/upgrade/22/pgsql.sql

@@ -0,0 +1,7 @@
+-- Add a column to record whether the area/room is enabled or disabled for use
+
+ALTER TABLE %DB_TBL_PREFIX%area 
+ADD COLUMN disabled smallint DEFAULT 0 NOT NULL;
+
+ALTER TABLE %DB_TBL_PREFIX%room 
+ADD COLUMN disabled smallint DEFAULT 0 NOT NULL;

web/upgrade/23/mysql.sql

@@ -0,0 +1,9 @@
+# Add UID and SEQUENCE columns for use with iCalendar
+
+ALTER TABLE %DB_TBL_PREFIX%entry 
+ADD COLUMN ical_uid        varchar(255) DEFAULT '' NOT NULL,
+ADD COLUMN ical_sequence   smallint DEFAULT 0 NOT NULL;
+
+ALTER TABLE %DB_TBL_PREFIX%repeat
+ADD COLUMN ical_uid        varchar(255) DEFAULT '' NOT NULL,
+ADD COLUMN ical_sequence   smallint DEFAULT 0 NOT NULL;

web/upgrade/23/pgsql.sql

@@ -0,0 +1,9 @@
+-- Add UID and SEQUENCE columns for use with iCalendar
+
+ALTER TABLE %DB_TBL_PREFIX%entry 
+ADD COLUMN ical_uid        varchar(255) DEFAULT '' NOT NULL,
+ADD COLUMN ical_sequence   smallint DEFAULT 0 NOT NULL;
+
+ALTER TABLE %DB_TBL_PREFIX%repeat
+ADD COLUMN ical_uid        varchar(255) DEFAULT '' NOT NULL,
+ADD COLUMN ical_sequence   smallint DEFAULT 0 NOT NULL;

web/upgrade/24/mysql.sql

@@ -0,0 +1,4 @@
+# Add RECURRENCE-ID column for use with iCalendar
+
+ALTER TABLE %DB_TBL_PREFIX%entry 
+ADD COLUMN ical_recur_id     varchar(16) DEFAULT '' NOT NULL;

web/upgrade/24/pgsql.sql

@@ -0,0 +1,4 @@
+-- Add RECURRENCE-ID column for use with iCalendar
+
+ALTER TABLE %DB_TBL_PREFIX%entry 
+ADD COLUMN ical_recur_id        varchar(16) DEFAULT '' NOT NULL;

web/upgrade/24/post.inc

@@ -0,0 +1,141 @@
+<?php
+namespace MRBS;
+
+// This upgrade assigns a UID to all existing bookings and a RECURRENCE-ID to all
+// existing members of a series.   However the RECURRENCE-ID is not necessarily going
+// to be correct if the entry is a modified entry (ie entry_type=ENTRY_RPT_CHANGED).
+// That's because the RECURRENCE_ID is supposed to be the *original* start date and
+// time of that entry, and this is information that we no longer have.  (We do know
+// the time, as we have the start time in the repeat table, but it is not trivial to
+// take advantage of it as we'd have to account for DST changes and we still don't
+// have the date.   So I've taken the view here that it's not worth bothering about
+// as this upgrade procedure is only used once for existing entries).
+
+
+global $dbsys, $server;
+
+// There's the option here to display some timing information as this upgrade
+// could take a while
+$display_timing = FALSE;
+
+$n_entry = $upgrade_handle->query1("SELECT COUNT(*) FROM " . _tbl('entry'));
+$n_repeat = $upgrade_handle->query1("SELECT COUNT(*) FROM " . _tbl('repeat'));
+if ($display_timing)
+{
+ echo "Upgrade 24: $n_entry entry rows and $n_repeat repeat rows";
+}
+
+$start_clock = get_microtime();
+
+// In these queries we set timestamp=timestamp to prevent it being automatically set
+// to the current time (only applies to MySQL - PostgreSQL timestamps don't update)
+
+// MySQL (mysql and mysqli)
+// ------------------------
+if ($dbsys != "pgsql")
+{
+  // Give all the individual entries, that haven't already got one, an ical uid
+  $sql = "UPDATE " . _tbl('entry') . "
+             SET ical_uid=CONCAT(CAST(id AS char), '-', UUID()),
+                 timestamp=timestamp
+           WHERE ical_uid='' AND repeat_id=0";
+  $upgrade_handle->command($sql);
+
+  // Give everything in the repeat table, that doesn't already have one, an ical uid
+  $sql = "UPDATE " . _tbl('repeat') . "
+             SET ical_uid=CONCAT(CAST(id AS char), '-', UUID()),
+                 timestamp=timestamp
+           WHERE ical_uid=''";
+  $upgrade_handle->command($sql);
+
+  // Now go through the entry table and give all entries, that don't have an ical uid
+  // and are members of a series, the ical_uid from the corresponding uid from the
+  // repeat table
+  $sql = "UPDATE " . _tbl('entry') . " E, " . _tbl('repeat') . " R
+             SET E.ical_uid=R.ical_uid,
+                 E.timestamp=E.timestamp,
+                 R.timestamp=R.timestamp
+           WHERE E.ical_uid=''
+             AND E.repeat_id=R.id";
+  $upgrade_handle->command($sql);
+
+  // Finally give a recurrence id to any entry in the entry table that hasn't got one
+  // and should have one - ie if it is a member of a series
+  $sql = "UPDATE " . _tbl('entry') . "
+             SET ical_recur_id=DATE_FORMAT(CONVERT_TZ(FROM_UNIXTIME(start_time), @@session.time_zone, '+0:00'), '%Y%m%dT%H%i%sZ'),
+                 timestamp=timestamp
+           WHERE repeat_id!=0
+             AND ical_recur_id=''";
+  $upgrade_handle->command($sql);
+}
+
+// PostgreSQL
+// ----------
+else
+{
+  // PostgreSQL doesn't have a UUID() function as standard, so we have to construct
+  // our own UUID.
+  //
+  // We will generate a uid of the form "MRBS-uniqid-MD5hash@domain_name"
+  // where uniqid is time based and is generated by uniqid() and the
+  // MD5hash is the first 8 characters of the MD5 hash of $str concatenated
+  // with a random number.  [This is the same process used by the MRBS function
+  // generate_global_uid()]
+
+  if (empty($server['SERVER_NAME']))
+  {
+    $domain_name = 'MRBS';
+  }
+  elseif (mb_strpos($server['SERVER_NAME'], 'www.') === 0)
+  {
+    $domain_name = substr($server['SERVER_NAME'], 4);
+  }
+  else
+  {
+    $domain_name = $server['SERVER_NAME'];
+  }
+
+  // Give all the individual entries, that haven't already got one, an ical uid
+  $sql = "UPDATE " . _tbl('entry') . "
+             SET ical_uid='MRBS-' || CAST(id AS varchar(255)) || '-' || CURRENT_DATE || CURRENT_TIME || '-' || SUBSTRING((MD5(name || CAST(RANDOM() AS varchar(255)))) from 1 for 8) || '@$domain_name'
+           WHERE ical_uid=''
+             AND repeat_id=0";
+  $upgrade_handle->command($sql);
+
+  // Give everything in the repeat table, that doesn't already have one, an ical uid
+  $sql = "UPDATE " . _tbl('repeat') . "
+             SET ical_uid='MRBS-' || CAST(id AS varchar(255)) || '-' || CURRENT_DATE || CURRENT_TIME || '-' || SUBSTRING((MD5(name || CAST(RANDOM() AS varchar(255)))) from 1 for 8) || '@$domain_name'
+           WHERE ical_uid=''";
+  $upgrade_handle->command($sql);
+
+  // Now go through the entry table and give all entries, that don't have an ical uid
+  // and are members of a series, the ical_uid from the corresponding uid from the
+  // repeat table.   (The SQL is slightly different from the MySQL case)
+  $sql = "UPDATE " . _tbl('entry') . "
+             SET ical_uid=R.ical_uid
+            FROM " . _tbl('repeat') . " AS R
+           WHERE " . _tbl('entry') . ".ical_uid=''
+             AND " . _tbl('entry') . ".repeat_id=R.id";
+  $upgrade_handle->command($sql);
+
+  // Finally give a recurrence id to any entry in the entry table that hasn't got one
+  // and should have one - ie if it is a member of a series (The SQL is slightly
+  // different from the MySQL case)
+  $sql = "UPDATE " . _tbl('entry') . "
+             SET ical_recur_id=TO_CHAR(TIMESTAMP 'epoch' + start_time * INTERVAL '1 second', 'YYYYMMDD\"T\"HH24MISS\"Z\"')
+           WHERE repeat_id!=0
+             AND ical_recur_id=''";
+  $upgrade_handle->command($sql);
+}
+
+$stop_clock = get_microtime();
+$clock_diff = $stop_clock - $start_clock;
+if (is_float($start_clock))
+{
+  $clock_diff = sprintf('%.3f', $clock_diff);
+}
+if ($display_timing)
+{
+ echo " processed in $clock_diff seconds<br>\n";
+}
+

web/upgrade/25/mysql.sql

@@ -0,0 +1,10 @@
+# Fixes a mistake in the previous upgrade.  If we've got an individual member of a
+# series that has been modified, ie has entry_type=2, then the sequence number 
+# cannot be 0.   We will set it to 1.
+
+ALTER TABLE %DB_TBL_PREFIX%entry ADD COLUMN saved_ts DATETIME;
+UPDATE %DB_TBL_PREFIX%entry SET saved_ts=timestamp;
+UPDATE %DB_TBL_PREFIX%entry 
+  SET ical_sequence=1 WHERE ical_sequence=0 AND entry_type=2;
+UPDATE %DB_TBL_PREFIX%entry SET timestamp=saved_ts;
+ALTER TABLE %DB_TBL_PREFIX%entry DROP COLUMN saved_ts;

web/upgrade/25/pgsql.sql

@@ -0,0 +1,9 @@
+-- Fixes a mistake in the previous upgrade.  If we've got an individual member of a
+-- series that has been modified, ie has entry_type=2, then the sequence number 
+-- cannot be 0.   We will set it to 1.
+
+-- No need to save the timestamp as timestamps aren't updated in PostgreSQL
+
+
+UPDATE %DB_TBL_PREFIX%entry 
+  SET ical_sequence=1 WHERE ical_sequence=0 AND entry_type=2;

web/upgrade/26/mysql.sql

@@ -0,0 +1 @@
+# Nothing to do

web/upgrade/26/post.inc

@@ -0,0 +1,10 @@
+<?php
+namespace MRBS;
+
+?>
+
+<script>
+//<![CDATA[
+  alert('If you have just upgraded to MRBS 1.4.6 or later and had previously configured MRBS with $unicode_encoding = 0, you MUST read and follow the instructions in UPGRADE to convert your database to UTF-8');
+//]];
+</script>

web/upgrade/27/mysql.sql

@@ -0,0 +1,4 @@
+# Add a column to record whether the all day box should be checked by default
+
+ALTER TABLE %DB_TBL_PREFIX%area 
+ADD COLUMN default_duration_all_day tinyint DEFAULT 0 NOT NULL AFTER default_duration;

web/upgrade/27/pgsql.sql

@@ -0,0 +1,5 @@
+-- Add a column to record whether the all day box should be checked by default
+
+ALTER TABLE %DB_TBL_PREFIX%area 
+ADD COLUMN default_duration_all_day smallint DEFAULT 0 NOT NULL;
+

web/upgrade/28/mysql.sql

@@ -0,0 +1,10 @@
+CREATE TABLE %DB_TBL_PREFIX%zoneinfo
+(
+  id                 int NOT NULL auto_increment,
+  timezone           varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci DEFAULT '' NOT NULL,
+  outlook_compatible tinyint unsigned NOT NULL DEFAULT 0,
+  vtimezone          text CHARACTER SET utf8 COLLATE utf8_general_ci,
+  last_updated       int NOT NULL DEFAULT 0,
+      
+  PRIMARY KEY (id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;

web/upgrade/28/pgsql.sql

@@ -0,0 +1,8 @@
+CREATE TABLE %DB_TBL_PREFIX%zoneinfo
+(
+  id                 serial primary key,
+  timezone           varchar(255) DEFAULT '' NOT NULL,
+  outlook_compatible smallint NOT NULL DEFAULT 0,
+  vtimezone          text,
+  last_updated       int NOT NULL DEFAULT 0
+);

web/upgrade/29/mysql.sql

@@ -0,0 +1,4 @@
+# Add a column to record the area's timezone
+
+ALTER TABLE %DB_TBL_PREFIX%area 
+ADD COLUMN timezone varchar(50) CHARACTER SET utf8 COLLATE utf8_general_ci;

web/upgrade/29/pgsql.sql

@@ -0,0 +1,5 @@
+-- Add a column to record the area's timezone
+
+ALTER TABLE %DB_TBL_PREFIX%area 
+ADD COLUMN timezone varchar(50);
+

web/upgrade/3/mysql.sql

@@ -0,0 +1,9 @@
+-- Run this script to upgrade postgres or mysql mrbs database
+
+-- Add an extra column to the mrbs_entry and mrbs_repeat table 
+-- for private bookings handling
+
+ALTER TABLE %DB_TBL_PREFIX%repeat 
+ ADD private TINYINT NOT NULL DEFAULT 0;
+ALTER TABLE %DB_TBL_PREFIX%entry 
+ ADD private TINYINT NOT NULL DEFAULT 0;

web/upgrade/3/pgsql.sql

@@ -0,0 +1,9 @@
+-- Run this script to upgrade postgres or mysql mrbs database
+
+-- Add an extra column to the mrbs_entry and mrbs_repeat table 
+-- for private bookings handling
+
+ALTER TABLE %DB_TBL_PREFIX%repeat 
+ ADD private SMALLINT  DEFAULT 0 NOT NULL;
+ALTER TABLE %DB_TBL_PREFIX%entry 
+ ADD private SMALLINT  DEFAULT 0 NOT NULL;

web/upgrade/30/mysql.sql

@@ -0,0 +1,13 @@
+# Add the max number of bookings fields
+
+ALTER TABLE %DB_TBL_PREFIX%area 
+ADD COLUMN max_per_day_enabled       tinyint DEFAULT 0 NOT NULL,
+ADD COLUMN max_per_day               int DEFAULT 0 NOT NULL,
+ADD COLUMN max_per_week_enabled      tinyint DEFAULT 0 NOT NULL,
+ADD COLUMN max_per_week              int DEFAULT 0 NOT NULL,
+ADD COLUMN max_per_month_enabled     tinyint DEFAULT 0 NOT NULL,
+ADD COLUMN max_per_month             int DEFAULT 0 NOT NULL,
+ADD COLUMN max_per_year_enabled      tinyint DEFAULT 0 NOT NULL,
+ADD COLUMN max_per_year              int DEFAULT 0 NOT NULL,
+ADD COLUMN max_per_future_enabled    tinyint DEFAULT 0 NOT NULL,
+ADD COLUMN max_per_future            int DEFAULT 0 NOT NULL;

web/upgrade/30/pgsql.sql

@@ -0,0 +1,13 @@
+-- Add the max number of bookings fields
+
+ALTER TABLE %DB_TBL_PREFIX%area 
+ADD COLUMN max_per_day_enabled       smallint DEFAULT 0 NOT NULL,
+ADD COLUMN max_per_day               int DEFAULT 0 NOT NULL,
+ADD COLUMN max_per_week_enabled      smallint DEFAULT 0 NOT NULL,
+ADD COLUMN max_per_week              int DEFAULT 0 NOT NULL,
+ADD COLUMN max_per_month_enabled     smallint DEFAULT 0 NOT NULL,
+ADD COLUMN max_per_month             int DEFAULT 0 NOT NULL,
+ADD COLUMN max_per_year_enabled      smallint DEFAULT 0 NOT NULL,
+ADD COLUMN max_per_year              int DEFAULT 0 NOT NULL,
+ADD COLUMN max_per_future_enabled    smallint DEFAULT 0 NOT NULL,
+ADD COLUMN max_per_future            int DEFAULT 0 NOT NULL;

web/upgrade/31/mysql.sql

@@ -0,0 +1,17 @@
+# Get rid of n-weekly repeats and make all weekly and n-weekly repeats weekly
+
+# We save the current value of the timestamp before updating and restore it 
+# afterwards because we do not want the timestamp to be changed by this operation
+
+ALTER TABLE %DB_TBL_PREFIX%repeat
+ADD COLUMN saved_ts DATETIME;
+UPDATE %DB_TBL_PREFIX%repeat SET saved_ts=timestamp;
+
+# Now the meat.  First set the repeat frequency to 1 for all existing weekly
+# bookings.  Then turn all n-weekly bookings into weekly bookings
+UPDATE %DB_TBL_PREFIX%repeat SET rep_num_weeks=1 WHERE rep_type=2;
+UPDATE %DB_TBL_PREFIX%repeat SET rep_type=2 WHERE rep_type=6;
+
+UPDATE %DB_TBL_PREFIX%repeat SET timestamp=saved_ts;
+ALTER TABLE %DB_TBL_PREFIX%repeat
+DROP COLUMN saved_ts;

web/upgrade/31/pgsql.sql

@@ -0,0 +1,10 @@
+-- Get rid of n-weekly repeats and make all weekly and n-weekly repeats weekly
+
+-- No need to save the current timestamp because timestamps do not auto-update
+-- in PostgreSQL 
+
+-- First set the repeat frequency to 1 for all existing weekly
+-- bookings.  Then turn all n-weekly bookings into weekly bookings
+
+UPDATE %DB_TBL_PREFIX%repeat SET rep_num_weeks=1 WHERE rep_type=2;
+UPDATE %DB_TBL_PREFIX%repeat SET rep_type=2 WHERE rep_type=6;

web/upgrade/32/mysql.sql

@@ -0,0 +1,13 @@
+# Add a month_absolute column so that monthly repeats can be converted to the
+# new format.   The conversion itself is done in post.inc
+
+# We save the current value of the timestamp before updating and restore it 
+# afterwards because we do not want the timestamp to be changed by this operation.
+# The restoration is done in the next upgrade because we need to operate on the table
+# first using post.inc
+ALTER TABLE %DB_TBL_PREFIX%repeat
+ADD COLUMN saved_ts DATETIME;
+UPDATE %DB_TBL_PREFIX%repeat SET saved_ts=timestamp;
+
+ALTER TABLE %DB_TBL_PREFIX%repeat
+ADD COLUMN month_absolute smallint DEFAULT NULL;

web/upgrade/32/pgsql.sql

@@ -0,0 +1,5 @@
+-- Add a month_absolute column so that monthly repeats can be converted to the
+-- new format.   The conversion itself is done in post.inc
+
+ALTER TABLE %DB_TBL_PREFIX%repeat
+ADD COLUMN month_absolute smallint DEFAULT NULL;

web/upgrade/32/post.inc

@@ -0,0 +1,42 @@
+<?php
+namespace MRBS;
+
+require_once 'standard_vars.inc.php'; // to ensure the timezone is set
+
+// Get all the monthly repeats
+$sql = "SELECT T.id, T.start_time, A.timezone
+          FROM " . _tbl('repeat') . " T, " . _tbl('area') . " A, " . _tbl('room') . " M
+         WHERE T.rep_type=" . RepeatRule::MONTHLY . "
+           AND T.room_id=M.id
+           AND M.area_id=A.id";
+
+$res = $upgrade_handle->query($sql);
+
+// Save the current default timezone so that we can restore it at the end
+$old_tz = mrbs_default_timezone_get();
+
+$mods = array();
+
+while (false !== ($row = $res->next_row_keyed()))
+{
+  // We need to make sure that we have the correct timezone set when we work out
+  // the day of the month that this series repeats on
+  if (!empty($row['timezone']))
+  {
+    mrbs_default_timezone_set($row['timezone']);
+  }
+  $mods[$row['id']] = date('j', $row['start_time']);
+}
+
+foreach ($mods as $id => $month_absolute)
+{
+  $sql = "UPDATE " . _tbl('repeat') . "
+             SET month_absolute=$month_absolute
+           WHERE id=$id";
+
+  $upgrade_handle->command($sql);
+}
+
+// Restore the original timezone
+mrbs_default_timezone_set($old_tz);
+

web/upgrade/33/mysql.sql

@@ -0,0 +1,8 @@
+# Restore the original timestamp at the beginning of the previous upgrade
+
+# We save the current value of the timestamp before updating and restore it 
+# afterwards because we do not want the timestamp to be changed by this operation
+
+UPDATE %DB_TBL_PREFIX%repeat SET timestamp=saved_ts;
+ALTER TABLE %DB_TBL_PREFIX%repeat
+DROP COLUMN saved_ts;

web/upgrade/34/mysql.sql

@@ -0,0 +1,13 @@
+# Add a month_relative column so that monthly sameday repeats can be converted to the
+# new format.   The conversion itself is done in post.inc
+
+# We save the current value of the timestamp before updating and restore it 
+# afterwards because we do not want the timestamp to be changed by this operation.
+# The restoration is done in the next upgrade because we need to operate on the table
+# first using post.inc
+ALTER TABLE %DB_TBL_PREFIX%repeat
+ADD COLUMN saved_ts DATETIME;
+UPDATE %DB_TBL_PREFIX%repeat SET saved_ts=timestamp;
+
+ALTER TABLE %DB_TBL_PREFIX%repeat
+ADD COLUMN month_relative varchar(4) DEFAULT NULL;

web/upgrade/34/pgsql.sql

@@ -0,0 +1,5 @@
+-- Add a month_relative column so that monthly repeats can be converted to the
+-- new format.   The conversion itself is done in post.inc
+
+ALTER TABLE %DB_TBL_PREFIX%repeat
+ADD COLUMN month_relative varchar(4) DEFAULT NULL;

web/upgrade/34/post.inc

@@ -0,0 +1,43 @@
+<?php
+namespace MRBS;
+
+// Convert MONTHLY_SAMEDAY repeats into MONTHLY repeats with a specified month_relative (eg '2TU')
+
+require_once 'standard_vars.inc.php'; // to ensure the timezone is set
+
+// Get all the monthly sameday repeats.
+$sql = "SELECT T.id, T.start_time, A.timezone
+          FROM " . _tbl('repeat') . " T, " . _tbl('area') . " A, " . _tbl('room') . " M
+         WHERE T.rep_type=5
+           AND T.room_id=M.id
+           AND M.area_id=A.id";
+
+$res = $upgrade_handle->query($sql);
+
+// Save the current default timezone so that we can restore it at the end
+$old_tz = mrbs_default_timezone_get();
+
+$mods = array();
+
+while (false !== ($row = $res->next_row_keyed()))
+{
+  // We need to make sure that we have the correct timezone set when we work out
+  // the day of the month that this series repeats on
+  if (!empty($row['timezone']))
+  {
+    mrbs_default_timezone_set($row['timezone']);
+  }
+  $mods[$row['id']] = date_byday($row['start_time']);
+}
+
+foreach ($mods as $id => $month_relative)
+{
+  $sql = "UPDATE " . _tbl('repeat') . "
+             SET month_relative=?,
+                 rep_type=" . RepeatRule::MONTHLY . "
+           WHERE id=?";
+  $upgrade_handle->command($sql, array($month_relative, $id));
+}
+
+// Restore the original timezone
+mrbs_default_timezone_set($old_tz);

web/upgrade/35/mysql.sql

@@ -0,0 +1,8 @@
+# Restore the original timestamp at the beginning of the previous upgrade
+
+# We save the current value of the timestamp before updating and restore it 
+# afterwards because we do not want the timestamp to be changed by this operation
+
+UPDATE %DB_TBL_PREFIX%repeat SET timestamp=saved_ts;
+ALTER TABLE %DB_TBL_PREFIX%repeat
+DROP COLUMN saved_ts;

web/upgrade/36/mysql.sql

@@ -0,0 +1,7 @@
+# Add a modified_by column so that we can see who last edited a booking
+
+ALTER TABLE %DB_TBL_PREFIX%entry
+ADD COLUMN modified_by varchar(80) CHARACTER SET utf8 COLLATE utf8_general_ci DEFAULT '' NOT NULL AFTER create_by;
+
+ALTER TABLE %DB_TBL_PREFIX%repeat
+ADD COLUMN modified_by varchar(80) CHARACTER SET utf8 COLLATE utf8_general_ci DEFAULT '' NOT NULL AFTER create_by;

web/upgrade/36/pgsql.sql

@@ -0,0 +1,7 @@
+-- Add a modified_by column so that we can see who last edited a booking
+
+ALTER TABLE %DB_TBL_PREFIX%entry
+ADD COLUMN modified_by varchar(80) DEFAULT '' NOT NULL;
+
+ALTER TABLE %DB_TBL_PREFIX%repeat
+ADD COLUMN modified_by varchar(80) DEFAULT '' NOT NULL;

web/upgrade/37/mysql.sql

@@ -0,0 +1,7 @@
+# Make sure that the timestamps update automatically, just in case these are not the default settings
+
+ALTER TABLE %DB_TBL_PREFIX%entry
+MODIFY COLUMN timestamp TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP;
+
+ALTER TABLE %DB_TBL_PREFIX%repeat
+MODIFY COLUMN timestamp TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP;

web/upgrade/38/mysql.sql

@@ -0,0 +1,29 @@
+# Add finer grained policies, to distinguish between creation and deletion of
+# bookings.  Note that deletion of max_book_ahead bookings was always
+# allowed which is why max_delete_ahead_enabled is set to FALSE.
+
+ALTER TABLE %DB_TBL_PREFIX%area
+  ADD COLUMN min_create_ahead_enabled tinyint AFTER max_book_ahead_secs,
+  ADD COLUMN min_create_ahead_secs int AFTER min_create_ahead_enabled,
+  ADD COLUMN max_create_ahead_enabled tinyint AFTER min_create_ahead_secs,
+  ADD COLUMN max_create_ahead_secs int AFTER max_create_ahead_enabled,
+  ADD COLUMN min_delete_ahead_enabled tinyint AFTER max_create_ahead_secs,
+  ADD COLUMN min_delete_ahead_secs int AFTER min_delete_ahead_enabled,
+  ADD COLUMN max_delete_ahead_enabled tinyint AFTER min_delete_ahead_secs,
+  ADD COLUMN max_delete_ahead_secs int AFTER max_delete_ahead_enabled;
+
+UPDATE %DB_TBL_PREFIX%area SET
+  min_create_ahead_enabled = min_book_ahead_enabled,
+  min_create_ahead_secs = min_book_ahead_secs,
+  max_create_ahead_enabled = max_book_ahead_enabled,
+  max_create_ahead_secs = max_book_ahead_secs,
+  min_delete_ahead_enabled = min_book_ahead_enabled,
+  min_delete_ahead_secs = min_book_ahead_secs,
+  max_delete_ahead_enabled = 0,
+  max_delete_ahead_secs = max_book_ahead_secs;
+  
+ALTER TABLE %DB_TBL_PREFIX%area
+  DROP min_book_ahead_enabled,
+  DROP min_book_ahead_secs,
+  DROP max_book_ahead_enabled,
+  DROP max_book_ahead_secs;

web/upgrade/38/pgsql.sql

@@ -0,0 +1,29 @@
+-- Add finer grained policies, to distinguish between creation and deletion of
+-- bookings.  Note that deletion of max_book_ahead bookings was always
+-- allowed which is why max_delete_ahead_enabled is set to FALSE.
+
+ALTER TABLE %DB_TBL_PREFIX%area
+  ADD COLUMN min_create_ahead_enabled smallint,
+  ADD COLUMN min_create_ahead_secs int,
+  ADD COLUMN max_create_ahead_enabled smallint,
+  ADD COLUMN max_create_ahead_secs int,
+  ADD COLUMN min_delete_ahead_enabled smallint,
+  ADD COLUMN min_delete_ahead_secs int,
+  ADD COLUMN max_delete_ahead_enabled smallint,
+  ADD COLUMN max_delete_ahead_secs int;
+
+UPDATE %DB_TBL_PREFIX%area SET
+  min_create_ahead_enabled = min_book_ahead_enabled,
+  min_create_ahead_secs = min_book_ahead_secs,
+  max_create_ahead_enabled = max_book_ahead_enabled,
+  max_create_ahead_secs = max_book_ahead_secs,
+  min_delete_ahead_enabled = min_book_ahead_enabled,
+  min_delete_ahead_secs = min_book_ahead_secs,
+  max_delete_ahead_enabled = 0,
+  max_delete_ahead_secs = max_book_ahead_secs;
+  
+ALTER TABLE %DB_TBL_PREFIX%area
+  DROP min_book_ahead_enabled,
+  DROP min_book_ahead_secs,
+  DROP max_book_ahead_enabled,
+  DROP max_book_ahead_secs;

web/upgrade/39/mysql.sql

@@ -0,0 +1,10 @@
+# Convert all tables to InnoDB.   Although all new installations use InnoDB, some
+# older ones may still have tables using the MyISAM engine.
+
+ALTER TABLE %DB_TBL_PREFIX%area ENGINE=InnoDB;
+ALTER TABLE %DB_TBL_PREFIX%entry ENGINE=InnoDB;
+ALTER TABLE %DB_TBL_PREFIX%repeat ENGINE=InnoDB;
+ALTER TABLE %DB_TBL_PREFIX%room ENGINE=InnoDB;
+ALTER TABLE %DB_TBL_PREFIX%users ENGINE=InnoDB;
+ALTER TABLE %DB_TBL_PREFIX%variables ENGINE=InnoDB;
+ALTER TABLE %DB_TBL_PREFIX%zoneinfo ENGINE=InnoDB;

web/upgrade/4/mysql.sql

@@ -0,0 +1,5 @@
+ALTER TABLE %DB_TBL_PREFIX%area
+ADD COLUMN private_enabled       tinyint,
+ADD COLUMN private_default       tinyint,
+ADD COLUMN private_mandatory     tinyint,
+ADD COLUMN private_override      varchar(32);

web/upgrade/4/pgsql.sql

@@ -0,0 +1,6 @@
+ALTER TABLE %DB_TBL_PREFIX%area
+ADD COLUMN private_enabled       smallint,
+ADD COLUMN private_default       smallint,
+ADD COLUMN private_mandatory     smallint,
+ADD COLUMN private_override      varchar(32);
+

web/upgrade/4/post.inc

@@ -0,0 +1,19 @@
+<?php
+namespace MRBS;
+
+// Populate the new columns in the area table with the default values taken
+// from the config file.
+
+global $private_enabled, $private_default, $private_mandatory, $private_override;
+
+$private_enabled = ($private_enabled) ? 1 : 0;
+$private_default = ($private_default) ? 1 : 0;
+$private_mandatory = ($private_mandatory) ? 1 : 0;
+
+$sql = "UPDATE " . _tbl('area') . " SET
+        private_enabled = $private_enabled,
+        private_default = $private_default,
+        private_mandatory = $private_mandatory,
+        private_override = '$private_override'";
+
+$upgrade_handle->command($sql);

web/upgrade/40/mysql.sql

@@ -0,0 +1,30 @@
+# Add some foreign keys
+
+# First of all tidy up the database getting rid of any zombie rows which would prevent
+# the foreign keys being created.   Note that these rows will not be visible to users 
+# and admins through MRBS.   They have most likely been created when a row has been
+# deleted from a table using a database admin tool, rather than through MRBS.  Of course,
+# foreign keys will stop this happening in the future.
+
+DELETE FROM %DB_TBL_PREFIX%room WHERE area_id NOT IN (SELECT id FROM %DB_TBL_PREFIX%area);
+DELETE FROM %DB_TBL_PREFIX%repeat WHERE room_id NOT IN (SELECT id FROM %DB_TBL_PREFIX%room);
+DELETE FROM %DB_TBL_PREFIX%entry WHERE room_id NOT IN (SELECT id FROM %DB_TBL_PREFIX%room);
+
+
+ALTER TABLE %DB_TBL_PREFIX%room
+  ADD FOREIGN KEY (area_id) 
+    REFERENCES %DB_TBL_PREFIX%area(id)
+    ON UPDATE CASCADE
+    ON DELETE RESTRICT;
+
+ALTER TABLE %DB_TBL_PREFIX%repeat
+  ADD FOREIGN KEY (room_id) 
+    REFERENCES %DB_TBL_PREFIX%room(id)
+    ON UPDATE CASCADE
+    ON DELETE RESTRICT;
+    
+ALTER TABLE %DB_TBL_PREFIX%entry
+  ADD FOREIGN KEY (room_id) 
+    REFERENCES %DB_TBL_PREFIX%room(id)
+    ON UPDATE CASCADE
+    ON DELETE RESTRICT;

web/upgrade/40/pgsql.sql

@@ -0,0 +1,30 @@
+-- Add some foreign keys
+
+-- First of all tidy up the database getting rid of any zombie rows which would prevent
+-- the foreign keys being created.   Note that these rows will not be visible to users 
+-- and admins through MRBS.   They have most likely been created when a row has been
+-- deleted from a table using a database admin tool, rather than through MRBS.  Of course,
+-- foreign keys will stop this happening in the future.
+
+DELETE FROM %DB_TBL_PREFIX%room WHERE area_id NOT IN (SELECT id FROM %DB_TBL_PREFIX%area);
+DELETE FROM %DB_TBL_PREFIX%repeat WHERE room_id NOT IN (SELECT id FROM %DB_TBL_PREFIX%room);
+DELETE FROM %DB_TBL_PREFIX%entry WHERE room_id NOT IN (SELECT id FROM %DB_TBL_PREFIX%room);
+
+
+ALTER TABLE %DB_TBL_PREFIX%room
+  ADD FOREIGN KEY (area_id) 
+    REFERENCES %DB_TBL_PREFIX%area(id)
+    ON UPDATE CASCADE
+    ON DELETE RESTRICT;
+
+ALTER TABLE %DB_TBL_PREFIX%repeat
+  ADD FOREIGN KEY (room_id) 
+    REFERENCES %DB_TBL_PREFIX%room(id)
+    ON UPDATE CASCADE
+    ON DELETE RESTRICT;
+    
+ALTER TABLE %DB_TBL_PREFIX%entry
+  ADD FOREIGN KEY (room_id) 
+    REFERENCES %DB_TBL_PREFIX%room(id)
+    ON UPDATE CASCADE
+    ON DELETE RESTRICT;

web/upgrade/41/mysql.sql

@@ -0,0 +1,41 @@
+# Make mrbs_entry.repeat_id a foreign key
+
+# Previously repeat_id was set to zero if there was no repeat.
+# However this breaks our foreign key constraint so we have to modify
+# the repeat_id column before we can create the foreign key.
+
+/* Temporary copy of timestamp column */
+ALTER TABLE %DB_TBL_PREFIX%entry
+  ADD COLUMN saved_ts DATETIME;
+UPDATE %DB_TBL_PREFIX%entry SET saved_ts=timestamp;
+
+ALTER TABLE %DB_TBL_PREFIX%entry
+  MODIFY COLUMN repeat_id int DEFAULT NULL;
+  
+UPDATE %DB_TBL_PREFIX%entry
+  SET repeat_id=NULL WHERE repeat_id=0;
+
+# Tidy up the database getting rid of any zombie rows which would prevent
+# the foreign key being created.   Note that these rows will not be visible to users 
+# and admins through MRBS.   They have most likely been created when a row has been
+# deleted from a table using a database admin tool, rather than through MRBS.  Of course,
+# foreign keys will stop this happening in the future.
+
+DELETE FROM %DB_TBL_PREFIX%entry
+  WHERE repeat_id IS NOT NULL
+  AND repeat_id NOT IN (SELECT id FROM %DB_TBL_PREFIX%repeat);
+  
+DELETE FROM %DB_TBL_PREFIX%repeat
+  WHERE id NOT IN (SELECT repeat_id FROM %DB_TBL_PREFIX%entry WHERE repeat_id IS NOT NULL);
+
+
+ALTER TABLE %DB_TBL_PREFIX%entry
+  ADD FOREIGN KEY (repeat_id) 
+    REFERENCES %DB_TBL_PREFIX%repeat(id)
+    ON UPDATE CASCADE
+    ON DELETE CASCADE;
+
+/* Put the table back to how it was */
+UPDATE %DB_TBL_PREFIX%entry SET timestamp=saved_ts;
+ALTER TABLE %DB_TBL_PREFIX%entry
+  DROP COLUMN saved_ts;

web/upgrade/41/pgsql.sql

@@ -0,0 +1,35 @@
+-- Make mrbs_entry.repeat_id a foreign key
+-- Previously repeat_id was set to zero if there was no repeat.
+-- However this breaks our foreign key constraint so we have to modify
+-- the repeat_id column before we can create the foreign key.
+
+ALTER TABLE %DB_TBL_PREFIX%entry
+  ALTER COLUMN repeat_id DROP DEFAULT,
+  ALTER COLUMN repeat_id DROP NOT NULL,
+  ALTER COLUMN repeat_id SET DEFAULT NULL;
+  
+UPDATE %DB_TBL_PREFIX%entry
+  SET repeat_id=NULL WHERE repeat_id=0;
+  
+-- Tidy up the database getting rid of any zombie rows which would prevent
+-- the foreign key being created.   Note that these rows will not be visible to users 
+-- and admins through MRBS.   They have most likely been created when a row has been
+-- deleted from a table using a database admin tool, rather than through MRBS.  Of course,
+-- foreign keys will stop this happening in the future.
+
+DELETE FROM %DB_TBL_PREFIX%entry
+  WHERE repeat_id IS NOT NULL
+  AND repeat_id NOT IN (SELECT id FROM %DB_TBL_PREFIX%repeat);
+
+-- Also, while we're at it, get rid of any redundant entries in the repeat table, ie rows
+-- that are not referenced by a row in the entry table.
+DELETE FROM %DB_TBL_PREFIX%repeat
+  WHERE id NOT IN (SELECT repeat_id FROM %DB_TBL_PREFIX%entry WHERE repeat_id IS NOT NULL);
+  
+
+ALTER TABLE %DB_TBL_PREFIX%entry
+  ADD FOREIGN KEY (repeat_id) 
+    REFERENCES %DB_TBL_PREFIX%repeat(id)
+    ON UPDATE CASCADE
+    ON DELETE CASCADE;
+    

web/upgrade/42/mysql.sql

@@ -0,0 +1,6 @@
+# Make ical_recur_id nullable, so that we can give it a null value
+# when there is no recurrence
+
+ALTER TABLE %DB_TBL_PREFIX%entry
+  MODIFY COLUMN ical_recur_id  varchar(16) CHARACTER SET utf8 COLLATE utf8_general_ci DEFAULT NULL;
+    

web/upgrade/42/pgsql.sql

@@ -0,0 +1,8 @@
+-- Make ical_recur_id nullable, so that we can give it a null value
+-- when there is no recurrence
+
+ALTER TABLE %DB_TBL_PREFIX%entry
+  ALTER COLUMN ical_recur_id DROP DEFAULT,
+  ALTER COLUMN ical_recur_id DROP NOT NULL,
+  ALTER COLUMN ical_recur_id SET DEFAULT NULL;
+  

web/upgrade/43/mysql.sql

@@ -0,0 +1,6 @@
+-- Make max_duration a per-area setting
+
+ALTER TABLE %DB_TBL_PREFIX%area
+  ADD COLUMN max_duration_enabled tinyint DEFAULT 0 NOT NULL,
+  ADD COLUMN max_duration_secs int DEFAULT 0 NOT NULL,
+  ADD COLUMN max_duration_periods int DEFAULT 0 NOT NULL;

web/upgrade/43/pgsql.sql

@@ -0,0 +1,6 @@
+-- Make max_duration a per-area setting
+
+ALTER TABLE %DB_TBL_PREFIX%area
+  ADD COLUMN max_duration_enabled smallint DEFAULT 0 NOT NULL,
+  ADD COLUMN max_duration_secs int DEFAULT 0 NOT NULL,
+  ADD COLUMN max_duration_periods int DEFAULT 0 NOT NULL;

web/upgrade/43/post.inc

@@ -0,0 +1,14 @@
+<?php
+namespace MRBS;
+
+// Populate the new columns in the area table with the default values taken
+// from the config file.
+
+global $max_duration_enabled, $max_duration_secs, $max_duration_periods;
+
+$sql = "UPDATE " . _tbl('area') . "
+           SET max_duration_enabled = " . ((empty($max_duration_enabled)) ? 0 : 1) . ",
+               max_duration_secs = " . ((empty($max_duration_secs)) ? 0 : (int)$max_duration_secs) . ",
+               max_duration_periods = " . ((empty($max_duration_periods)) ? 0 : (int)$max_duration_periods);
+
+$upgrade_handle->command($sql);

web/upgrade/44/mysql.sql

@@ -0,0 +1,16 @@
+-- Add some UNIQUE constraints
+
+ALTER TABLE %DB_TBL_PREFIX%room
+  ADD UNIQUE INDEX uq_room_name (area_id, room_name);
+  
+ALTER TABLE %DB_TBL_PREFIX%area
+  ADD UNIQUE INDEX uq_area_name (area_name);
+
+ALTER TABLE %DB_TBL_PREFIX%users
+  ADD UNIQUE INDEX uq_name (name);
+  
+ALTER TABLE %DB_TBL_PREFIX%variables
+  ADD UNIQUE INDEX uq_variable_name (variable_name);
+  
+ALTER TABLE %DB_TBL_PREFIX%zoneinfo
+  ADD UNIQUE INDEX uq_timezone (timezone, outlook_compatible);

web/upgrade/44/pgsql.sql

@@ -0,0 +1,16 @@
+-- Add some UNIQUE constraints
+
+ALTER TABLE %DB_TBL_PREFIX%room
+  ADD CONSTRAINT "%DB_TBL_PREFIX_SHORT%uq_room_name" UNIQUE (area_id, room_name);
+  
+ALTER TABLE %DB_TBL_PREFIX%area
+  ADD CONSTRAINT "%DB_TBL_PREFIX_SHORT%uq_area_name" UNIQUE (area_name);
+
+ALTER TABLE %DB_TBL_PREFIX%users
+  ADD CONSTRAINT "%DB_TBL_PREFIX_SHORT%uq_name" UNIQUE (name);
+  
+ALTER TABLE %DB_TBL_PREFIX%variables
+  ADD CONSTRAINT "%DB_TBL_PREFIX_SHORT%uq_variable_name" UNIQUE (variable_name);
+  
+ALTER TABLE %DB_TBL_PREFIX%zoneinfo
+  ADD CONSTRAINT "%DB_TBL_PREFIX_SHORT%uq_timezone" UNIQUE (timezone, outlook_compatible);

web/upgrade/45/mysql.sql

@@ -0,0 +1,4 @@
+-- Rename and expand the password column in the users table
+
+ALTER TABLE %DB_TBL_PREFIX%users
+  CHANGE COLUMN `password` `password_hash` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci;

web/upgrade/45/pgsql.sql

@@ -0,0 +1,6 @@
+-- Rename and expand the password column in the users table
+
+ALTER TABLE %DB_TBL_PREFIX%users
+  RENAME COLUMN password TO password_hash;
+ALTER TABLE %DB_TBL_PREFIX%users
+  ALTER COLUMN password_hash TYPE varchar(255);

web/upgrade/46/mysql.sql

@@ -0,0 +1 @@
+#

web/upgrade/46/post.inc

@@ -0,0 +1,19 @@
+<?php
+namespace MRBS;
+
+global $auth;
+
+if ($auth["type"] == 'db')
+{
+
+?>
+
+<script>
+//<![CDATA[
+  alert('If you have just upgraded to MRBS 1.5.0 or later and had previously configured MRBS with the \'config\' authentication scheme, please be aware that the default authentication scheme has now changed to \'db\'. Put "$auth["type"] = \'config\';" in config.inc.php to go back to the \'config\' scheme.');
+//]];
+</script>
+
+<?php
+
+}

web/upgrade/47/mysql.sql

@@ -0,0 +1 @@
+#

web/upgrade/47/post.inc

@@ -0,0 +1,153 @@
+<?php
+namespace MRBS;
+
+// Assigns a UID to all existing bookings that don't already have one.   They should
+// do in theory, but a bug (https://sourceforge.net/p/mrbs/bugs/334/) resulted in some
+// not doing so.   The code is based on Upgrade 24.
+
+// This upgrade assigns a UID to all existing bookings and a RECURRENCE-ID to all
+// existing members of a series.   However the RECURRENCE-ID is not necessarily going
+// to be correct if the entry is a modified entry (ie entry_type=ENTRY_RPT_CHANGED).
+// That's because the RECURRENCE_ID is supposed to be the *original* start date and
+// time of that entry, and this is information that we no longer have.  (We do know
+// the time, as we have the start time in the repeat table, but it is not trivial to
+// take advantage of it as we'd have to account for DST changes and we still don't
+// have the date.   So I've taken the view here that it's not worth bothering about
+// as this upgrade procedure is only used once for existing entries).
+
+global $dbsys, $server;
+
+// There's the option here to display some timing information as this upgrade
+// could take a while
+$display_timing = FALSE;
+
+$n_entry = $upgrade_handle->query1("SELECT COUNT(*) FROM " . _tbl('entry'));
+$n_repeat = $upgrade_handle->query1("SELECT COUNT(*) FROM " . _tbl('repeat'));
+if ($display_timing)
+{
+ echo "Upgrade 47: $n_entry entry rows and $n_repeat repeat rows";
+}
+
+$start_clock = get_microtime();
+
+
+// In these queries we set timestamp=timestamp to prevent it being automatically set
+// to the current time (only applies to MySQL - PostgreSQL timestamps don't update)
+
+// MySQL (mysql and mysqli)
+// ------------------------
+if ($dbsys != "pgsql")
+{
+  // Give everything in the repeat table, that doesn't already have one, an ical uid
+  $sql = "UPDATE " . _tbl('repeat') . "
+             SET ical_uid=CONCAT(CAST(id AS char), '-', UUID()),
+                 timestamp=timestamp
+           WHERE ical_uid=''";
+  $upgrade_handle->command($sql);
+
+  // Now go through the entry table and give all entries, that don't have an ical uid
+  // and are members of a series, the ical_uid from the corresponding uid from the
+  // repeat table
+  $sql = "UPDATE " . _tbl('entry') . " E, " . _tbl('repeat') . " R
+             SET E.ical_uid=R.ical_uid,
+                 E.timestamp=E.timestamp,
+                 R.timestamp=R.timestamp
+           WHERE E.ical_uid=''
+             AND E.repeat_id=R.id";
+  $upgrade_handle->command($sql);
+
+  // Finally give a recurrence id to any entry in the entry table that hasn't got one
+  // and should have one - ie if it is a member of a series
+  $sql = "UPDATE " . _tbl('entry') . "
+             SET ical_recur_id=DATE_FORMAT(CONVERT_TZ(FROM_UNIXTIME(start_time), @@session.time_zone, '+0:00'), '%Y%m%dT%H%i%sZ'),
+                 timestamp=timestamp
+           WHERE repeat_id!=0
+             AND ical_recur_id=''";
+  $upgrade_handle->command($sql);
+
+  // Give all the individual entries, that haven't already got one, an ical uid
+  // (There shouldn't be any of these as the bug was only affecting repeats)
+  $sql = "UPDATE " . _tbl('entry') . "
+             SET ical_uid=CONCAT(CAST(id AS char), '-', UUID()),
+                 timestamp=timestamp
+           WHERE ical_uid='' AND repeat_id IS NULL";
+  $upgrade_handle->command($sql);
+
+  // Sequence numbers were being generated correctly under the bug, so we don't need to worry about them
+}
+
+// PostgreSQL
+// ----------
+else
+{
+  // PostgreSQL doesn't have a UUID() function as standard, so we have to construct
+  // our own UUID.
+  //
+  // We will generate a uid of the form "MRBS-uniqid-MD5hash@domain_name"
+  // where uniqid is time based and is generated by uniqid() and the
+  // MD5hash is the first 8 characters of the MD5 hash of $str concatenated
+  // with a random number.  [This is the same process used by the MRBS function
+  // generate_global_uid()]
+
+  if (empty($server['SERVER_NAME']))
+  {
+    $domain_name = 'MRBS';
+  }
+  elseif (mb_strpos($server['SERVER_NAME'], 'www.') === 0)
+  {
+    $domain_name = substr($server['SERVER_NAME'], 4);
+  }
+  else
+  {
+    $domain_name = $server['SERVER_NAME'];
+  }
+
+  // Give everything in the repeat table, that doesn't already have one, an ical uid
+  $sql = "UPDATE " . _tbl('repeat') . "
+             SET ical_uid='MRBS-' || CAST(id AS varchar(255)) || '-' || CURRENT_DATE || CURRENT_TIME || '-' || SUBSTRING((MD5(name || CAST(RANDOM() AS varchar(255)))) from 1 for 8) || '@$domain_name'
+           WHERE ical_uid=''";
+  $upgrade_handle->command($sql);
+
+  // Now go through the entry table and give all entries, that don't have an ical uid
+  // and are members of a series, the ical_uid from the corresponding uid from the
+  // repeat table.   (The SQL is slightly different from the MySQL case)
+  $sql = "UPDATE " . _tbl('entry') . " E
+             SET ical_uid=R.ical_uid
+            FROM " . _tbl('repeat') . " AS R
+           WHERE E.ical_uid=''
+             AND E.repeat_id=R.id";
+  $upgrade_handle->command($sql);
+
+  // Finally give a recurrence id to any entry in the entry table that hasn't got one
+  // and should have one - ie if it is a member of a series (The SQL is slightly
+  // different from the MySQL case)
+  $sql = "UPDATE " . _tbl('entry') . "
+             SET ical_recur_id=TO_CHAR(TIMESTAMP 'epoch' + start_time * INTERVAL '1 second', 'YYYYMMDD\"T\"HH24MISS\"Z\"')
+           WHERE repeat_id!=0
+             AND ical_recur_id=''";
+  $upgrade_handle->command($sql);
+
+  // Give all the individual entries, that haven't already got one, an ical uid
+  // (There shouldn't be any of these as the bug was only affecting repeats)
+  $sql = "UPDATE " . _tbl('entry') . "
+             SET ical_uid='MRBS-' || CAST(id AS varchar(255)) || '-' || CURRENT_DATE || CURRENT_TIME || '-' || SUBSTRING((MD5(name || CAST(RANDOM() AS varchar(255)))) from 1 for 8) || '@$domain_name'
+           WHERE ical_uid=''
+             AND repeat_id IS NULL";
+  $upgrade_handle->command($sql);
+
+  // Sequence numbers were being generated correctly under the bug, so we don't need to worry about them
+}
+
+
+
+$stop_clock = get_microtime();
+$clock_diff = $stop_clock - $start_clock;
+if (is_float($start_clock))
+{
+  $clock_diff = sprintf('%.3f', $clock_diff);
+}
+if ($display_timing)
+{
+ echo " processed in $clock_diff seconds<br>\n";
+}
+

web/upgrade/48/mysql.sql

@@ -0,0 +1 @@
+#