Librebooking

Warning

Security: upgrade to LibreBooking 7.2.0 or later immediately.

All versions before 7.2.0 contain a high-severity stored cross-site scripting (XSS) vulnerability that lets any signed-in user take over an administrator account. The user stores a script in their own profile, through the REST API or the profile page, and it runs when an administrator views a page that shows it. Security fixes are not backported, so no fix will be released for 7.1.x or earlier.

There is no complete workaround. Disabling the API (api.enabled set to false, the default) blocks the attack described in the advisory, but related issues fixed in 7.2.0 can be exploited without the API. See the security advisory for details, and get the latest release.

If you have questions, join the Discord channel.

Previous security update

Warning

Security: upgrade to LibreBooking 7.1.0 or later immediately.

All versions before 7.1.0 contain a critical vulnerability that lets an unauthenticated attacker sign in as another user, including an administrator, by forging the "Remember Me" login cookie. Security fixes are not backported, so no fix will be released for 7.0.x or earlier.

LibreBooking 7.1.0 removes the "Remember Me" option. Users sign in again once their session ends.

If you cannot upgrade right away, configure your web server or reverse proxy to remove the persist_login cookie from incoming requests. See the security advisory for details and for how to check whether an installation was compromised, and get the latest release.

If you have questions, join the Discord channel or comment on the related issue.

⭐ Star us on GitHub — it motivates us a lot!

🔥 Join the community: Discord discussion channel .

Table of Contents

• About
• Features
• Demo
• Screenshots
• Installation & Deployment
• Developer Documentation
• Configuration & Theming
• ReCaptcha
• Community & Support
• Contributing
• Roadmap
• License

🚀 About

LibreBooking is an open-source resource scheduling solution. It provides a flexible, mobile-friendly, and extensible interface for organizations to manage resource reservations.

The repository for LibreBooking is hosted on GitHub at https://github.com/LibreBooking/librebooking; the develop branch contains the latest code.

LibreBooking is a fork of Booked Scheduler, based on Booked Scheduler's last open-source version released in 2020. Since then, LibreBooking has evolved significantly and diverged from the original project.

✨ Features

• Multi-resource booking & waitlists
• DataTables for advanced listings
• Role-based access control
• Quotas and credits for reservations
• Granular usage reporting
• Responsive Bootstrap 5 interface
• Custom themes and color schemes
• Plugin-ready architecture
• Outlook/Thunderbird integration through ics

🧪 Demo

A live demo instance of LibreBooking is available for testing:

Try the demo

Role	Username	Password
Admin	admin	demoadmin
User	user	demouser

Note: This instance is public and resets every 20 minutes to ensure a clean environment. Startup might take a few seconds, so please be patient.

📸 Screenshots

🔧 Installation & Deployment

Manual Installation

To run LibreBooking from a prebuilt release, your server needs:

• PHP >= 8.2 with the extensions: ctype, curl, fileinfo, intl, json, mbstring, mysqli, openssl, pdo, pdo_mysql, tokenizer, xml
• Optional PHP extensions: bcmath (needed for Active Directory authentication), gd (image processing), ldap (LDAP authentication)
• Apache >= 2.4. Other web servers, including Nginx, may work when configured with equivalent routing and access-control rules, but are not currently supported or tested by the LibreBooking project.
• MySQL >= 8.0 (2018) or MariaDB >= 10.6 (2021)
• Composer (for managing PHP dependencies)
• Git (optional, useful for cloning the repository or managing updates)

For full setup instructions, see INSTALLATION

Docker Deployment

LibreBooking is available as a Docker container. See LibreBooking Docker README for complete setup.

git clone https://github.com/LibreBooking/docker.git
cd docker
docker-compose up -d

💻 Developer Documentation

• See docs/source/README.md for developer notes.
• See docs/source/API.rst for API notes.
• See docs/source/Oauth2-Configuration.rst for Oauth2 configuration.
• See docs/source/SAML-Configuration.rst for SAML configuration.
• Codebase follows PSR-12 standards and GitHub Flow.

🎨 Configuration & Theming

For configuration options, see the Configuration Guide.

Recent configuration highlights:

• Change theme via config.php:

  'css.theme' = 'default';

• Theme options: 'default', 'dimgray', 'dark_red', 'dark_green', 'french_blue', 'orange'

• Customize Web/css/librebooking.css

🔒 ReCaptcha

As of 09-Mar-2023, ReCaptcha integration updated to v3. Generate new keys for your domain if using ReCaptcha.

💬 Community & Support

• Discord
• Docs
• Issues
• Discussions

🤝 Contributing

• Fork, file issues, suggest improvements.
• Even non-coders can help by reporting bugs, testing, updating issues.
• PRs welcome (docs, features, refactoring, fixes).
• See CONTRIBUTING.md

💡 Roadmap

Work in progress – roadmap to be defined. Want to suggest a feature? Open an issue or join the Discord discussion channel.

📜 License

This project is licensed under GPL-3.0.

🙏 Acknowledgments

Forked from Booked Scheduler. Thanks to all contributors and the community.

Back to top