[kusalo]

Summary by CodeRabbit

• New Features
  • Added an Events Calendar listing for version 1.5, describing a week-wide calendar with single-day, multi-day, and recurring events. The listing includes event color selection, start and end dates, editing and deletion, drag-and-drop reordering, and shortcode-based placement on pages. The listing is available under an MIT license at no cost.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

• Last reviewed commit: b532842
• Latest commit, not reviewed: a01ea4f

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• Resume reviews
• Trigger review

No actionable comments were generated in the recent review.

Walkthrough

The pull request adds version 1.5 metadata for Events Calendar, including release and distribution details, feature descriptions, and blank localized metadata fields. It also adjusts the formatting of Horizontal Archive Menu feature entries and adds empty German, Spanish, and Russian description and feature fields.

Possibly related PRs

• bludit/plugins-repository#491: Fills the Russian description and feature fields that this pull request adds to Horizontal Archive Menu metadata.

Merge Risk: Minimal · previous review b5328

No actionable merge-blocking issue is established by the supplied metadata changes. Merge after normal checks.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly identifies the main change: adding a new events plugin. It is concise and specific.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 64755004-1af1-4151-be52-59fd4cb15755

Commits

Reviewing files that changed from the base of the PR and between 8c3e3da and b532842.

Files selected for processing: 1

• items/horizontal-archive-menu/metadata.json

Files skipped from review as they are similar to previous changes: 1

• items/horizontal-archive-menu/metadata.json

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

[dignajar]

Thanks for the plugin! A few things need to change before this can be merged.

In this PR

• Rename items/events-calendar/screenShot.png to screenshot.png (lowercase).
• Please drop the change to items/horizontal-archive-menu/metadata.json. It removes the Russian translation that Added Russian language to untranslated plugins #491 just added.
• authors/arfa.json has no github field, so the bot can't confirm who owns the arfa plugins. Please add your GitHub profile there.
• Kusalo patch 1 #488 adds the same plugin again as items/events-menu. Please keep only one of the two.

In the plugin (eventCalendar.zip)
These need fixing before we can list it, because they affect the security of sites that install it:

• php/save_event.php can be called directly, and it builds the path it writes to from path_plugins sent by the browser. Do the writes inside the plugin's adminController(), use a server-side path, and rely on Bludit's own login and CSRF checks instead of a separate session token.
• The shortcode [% evCal=X %] runs include PATH_PLUGINS.'eventCalendar/php/'.X.'.php' without checking X. Any user who can edit a page can make it include other PHP files. Only accept a fixed list of names.
• The event pop-up puts the title and description into the page with innerHTML. Use textContent instead.
• Check that year and week from the URL are whole numbers in range before using them in setISODate() and in file paths. Right now other values cause PHP errors.

Other bugs

• date_default_timezone_set('Pacific/Auckland') changes the timezone for the whole site. Use the site's timezone instead.
• Events are saved inside the plugin folder (data/), so updating the plugin deletes them. Store them in $this->workspace() instead.
• Using the shortcode twice on one page causes a fatal "cannot redeclare function" error, because evCal.php declares functions every time it's included.
• session_start() and session_name() are called after Bludit has already started the session, which causes PHP warnings.
• The zip contains a stray file, php/evCal - Copy.php.
• The plugin's own metadata.json says version 1.0, but the listing says 1.5.

[github-actions]

👍 Listing OK, waiting for a maintainer review

@kusalo, thanks for the PR! The files are correct and plugins.bludit.com can show this change (see the preview below). A maintainer still needs to check the points below before merging; you don't need to do anything unless they ask.

For the maintainer

• Adds a new plugin events-calendar. The bot does not read plugin code: download it and review the code before merging.
• Changes horizontal-archive-menu, which belongs to author arfa; authors/arfa.json has no valid GitHub profile.
• Removes translations from horizontal-archive-menu: description_ru.
• Changes the author arfa, which is linked to no valid GitHub profile.
• Changes the GitHub profile of arfa, which controls plugin ownership.

Suggestions (optional, they don't block the merge)

• ⚠️ items/horizontal-archive-menu: Removes the translation description_ru. If that was not on purpose, put it back.

Preview of events-calendar on plugins.bludit.com

Name	Events Calendar
Made by	arfa
Version	1.5
Last update	2026-10-15
Price	Free: Download button
Description	A week-wide calendar.
Features	6
Download (Bludit v3)	https://kusalo.net/extras/eventCalendar.zip
More information	—
Live demo	—
Languages	en (other languages show a not translated yet notice)
Screenshot	yes

Preview of horizontal-archive-menu on plugins.bludit.com

Name	Horizontal Archive Menu
Made by	arfa
Version	1.5
Last update	2026-06-02
Price	Free: Download button
Description	Direct links to all your posts in a horizontal menu format.
Features	4
Download (Bludit v3)	https://kusalo.net/temp/HorizontalArchiveMenu.zip
More information	—
Live demo	—
Languages	en (other languages show a not translated yet notice)
Screenshot	yes

_{Rules: see the README, section How to add a plugin. Run the same check locally with python3 .github/scripts/validate_pr.py --base origin/master --head HEAD --author <your-github-login>.}

[kusalo]

Rename items/events-calendar/screenShot.png to screenshot.png (lowercase).
Done
Please drop the change to items/horizontal-archive-menu/metadata.json
That seems to be OK now in bludit - items/horizontal-archive-menu/metadata.json
authors/arfa.json has no github field
Now set as "github": "https://github.com/kusalo",
#488 adds the same plugin again
I cancelled 488

In the plugin (eventCalendar.zip)
The key issue here is my use of ajax. I really tried to get guidance on this
https://forum.bludit.org/viewtopic.php?t=3077 – and more recently:
https://forum.bludit.org/viewtopic.php?p=14451
... path_plugins
It seems to me that it would require either a stupid or malicious admin to inject. However, point taken and I now change to:
$pluginPath = dirname(DIR);
$file = $pluginPath.'/data/'. $year.'.json';
I thought to reply to this much to make it clear that I am working on getting this suitably sorted. The other items will take a little longer as I am travelling for some time.

I very much appreciate the care give. Thank you.