jasonjoh / php-calendar

A PHP sample using the Calendar API for Office 365.

PHP Calendar API Sample

日本 (日本語) (Japanese)

This sample shows how you can use the Calendar API from PHP. The sample app is an "upcoming shows" app for a fictional community theater's Shakespearean festival. Users can connect their Office 365 account and add events to their calendar for the show times they are attending. The user has the option of inviting friends, which will send a meeting request to each invited friend.

API features used

• Creating events on a user's default calendar
• Adding attachments to events
• Adding attendees to events
• Using a calendar view to expand recurring events and display all appointments for a single day.

Required software

• PHP 5.6
• A web server capable of serving PHP.

In my testing I used IIS 8 installed on a Windows 8.1 laptop. I installed PHP 5.6.0 using the Web Platform Installer (Windows/IIS only).

Running the sample

It's assumed that you have PHP installed before starting, and that your web server is configured to process and server PHP files.

1. Download or fork the sample project.

2. Create a new directory in your web root directory called php-calendar. Copy the files from the repository to this directory.

3. Register the app in Azure Active Directory. The app should be registered as a web app with a Sign-on URL of http://localhost/php-calendar, and should be given the permission to "Have full access to users' calendars", which is available in the "Delegated Permissions" dropdown.

4. Edit the .\o365\ClientReg.php file.

   1. Copy the client ID for your app obtained during app registration and paste it as the value for the $clientId variable.
   2. Copy the key you created during app registration and paste it as the value for the $clientSecret variable.
   3. Save the file.

5. If your PHP installation is not configured with updated CA certificates to verify SSL, requests will fail unless you run Fiddler on the server and set the $enableFiddler variable to true in Office365Service.php. Alternatively, you can insert the following line immediately before any call to curl_exec. However, it should be noted that doing so disables any SSL verification, which should NOT be done in production.

   curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, 0);

6. Open a web browser and browse to http://localhost/php-calendar/home.php.

7. You should see a list of upcoming show times for various Shakespearean plays. Click on any of the "Connect my Calendar" buttons to sign in to Office 365.

8. Once signed in you should be redirected back to the home page, and the buttons should now read "Add to Calendar." Click the button next to a specific show time to add it to your calendar. Events with a "Voucher Required" field of Yes will include the voucher as an attachment on the event.

Copyright

Copyright (c) Microsoft. All rights reserved.

---

Connect with me on Twitter @JasonJohMSFT

Follow the Exchange Dev Blog

php-calendar's Issues

Application with identifier was not found

I have followed steps mentioned in this, when i am trying to connect with microsoft account , it will give error as "Application with identifier was not found", please help me

futher tutorial (edit update delete an event in office 365 calendar )

hi jasonjoh,

will you please give me some ideas or extended tutorial links for this , to edit update , delete an event .

present i was implemented adding an event to calendar and reading the events ..

thanks,
rammohan.

php-calendar – Cross-Site Scripting (XSS)

Product: php-calendar
Download: https://github.com/jasonjoh/php-calendar
Vunlerable Version: latest version
Tested Version: latest version
Author: ADLab of Venustech

Advisory Details:
A Cross-Site Scripting (XSS) was discovered in“php-calendar latest version”, which can be exploited to execute arbitrary code.
The vulnerability exists due to insufficient filtration of user-supplied data in the “errorMsg” HTTP GET parameter passed to the “php-calendar-master/error.php” URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
The exploitation example below uses the "alert()" JavaScript function to see a pop-up messagebox:
Poc:
http://localhost/.../php-calendar-master/error.php?errorMsg=%22%3E%3Cscript%3Ealert(1);%3C/script%3E%3C%22

Fatal Error: Constant expression contains invalid operations

Constant expression contains invalid operations in /php-calendar/o365/ClientReg.php on line 7
running PHP 7.1

Redirecting to error.php with 400

Hi Jason,
I have copied all files and created new app on Azure. When clicking on "Connect My Calendar" link, it's redirecting to error page. See the screenshot:

I have granted all Office 365 permissions. Can you please look into the issue?

All day events start / end timestamps

Hey Jason,

I've come across something strange with the start and end timestamps for events which have been marked as "All day".

Whenever I add an "All day" meeting, the start and end timestamps are stored as the start and the end of the day in UTC, rather than the timezone of the user adding the event.

Here is an example of the start and end timestamps provided by the Outlook API for an "All day" meeting on 2018-03-05 in Australia.

["Start"]=> array(2) { ["DateTime"]=> string(27) "2018-03-05T00:00:00.0000000" ["TimeZone"]=> string(3) "UTC" }
["End"]=> array(2) { ["DateTime"]=> string(27) "2018-03-06T00:00:00.0000000"}

When you convert that into an Australian timezone it is between 11 AM on successive days.

Is this intentional? The only solution I can see is checking the IsAllDay property of each event and dealing with the times myself if it is True.

Is there something I am missing?

Sorry to be a pain, thanks in advance.

Error due to no consent

Hey Jason,

I have uploaded everything to my web server and managed to get it working up until getTokenFromAuthCode.

I am receiving a 400 error with the below message:
"error":"invalid_grant","error_description":"AADSTS65001: The user or administrator has not consented to use the application with ID...."

I have granted permission through the Azure AD panel, and I also granted permission on first login. I am not sure why it's still asking for consent?

I was also wondering, can I read a users calendar if their Office 365 is associated with another organisation? I am trying to make read staff calendars to use in an external website where people outside of the organisation can view calendars and request meetings. Whenever I try to login to the app I have created using a staff email, from another organisation, I get an error saying "The application could not be found under the organisation ...."
Edit; This works for apps made in Azure AD by switching Multi-Tenant on, but there is no option in Outlook Dev Portal.

Edit:
One other thing I noticed is that when I register an app using the Outlook Dev Portal and use the Password as the client secret, it returns and error stating the client secret is incorrect.

AADSTS70002: Error validating credentials. AADSTS50012: Invalid client secret is provided.

Is the password generated on the Outlook Dev Portal not the client secret?

Thanks in advance, sorry to bother you.

Closed:
Got the Javascript repo working

how to delete events

very interesting script. how to delete events? thanks

it stops working

I've used this library for more than 1 year, but monday it stops working
after I login, I return to my app and it gives me this error: "An error occurred: Error retrieving access token: Token request returned HTTP error 401"
here I found someone with similar problem, he says that in the url we need to add the Azure tenant id. Someone has the same problem? This trick works? Thanks

App Only

Hi Jason,

Can this be used for wep api apps for sending emails. I was using the ms graph api but it has limitations on attachments. can this be configured to authenticate without user interaction