What you need

• Easy!Appointments 1.6.0 (the patches are made against the official release zip)
• PHP 8.1+ with mysqli (as required by Easy!Appointments), MySQL or MariaDB
• patch (GNU patch or BSD patch)
• Cron, for reminders, blackouts and the digest
• Optional: MaxMind GeoLite2 Country database and mmdblookup for country features
• Optional: outbound HTTPS to www.hebcal.com for the blackout refresh

Install

1. Install Easy!Appointments 1.6.0 from the official release and finish its web installer.

1. Apply the patches from the Easy!Appointments root (back up first):

sh cd /path/to/easyappointments for p in $(grep -v '^#' /path/to/consultation-booking/patches/series); do patch -p1 --dry-run < /path/to/consultation-booking/patches/$p && \ patch -p1 < /path/to/consultation-booking/patches/$p done

0001–0011 are required by the add-ons. With the default configuration they change only the bug fixes, slot snapping, the neutral theme, embed mode and timezone detection; every other feature stays off until you configure it. 0012–0014 are optional and independent; remove their lines from the loop to skip them.

1. Copy the add-ons into the Easy!Appointments root:

sh cp -R /path/to/consultation-booking/custom /path/to/easyappointments/custom cp custom/cb_config.sample.php custom/cb_config.php # then edit

custom/.htaccess (Apache 2.4) blocks web access to everything except static assets and appt-time.php. On nginx or other servers, add an equivalent deny rule for custom/ (at minimum *.php except appt-time.php, *.sql, *.md).

1. Create the extra tables (only needed for reminders, logging, quarantine):

sh mysql -u USER -p DATABASE < custom/sql/install.sql

1. Cron (adjust paths; use the PHP binary of your site):

cron */15 * * * * php /path/to/easyappointments/custom/reminder_cron.php 0 3 1 * * php /path/to/easyappointments/custom/refresh_blocks.php 0 8 * * 1 php /path/to/easyappointments/custom/quarantine_digest.php

With an hourly-only scheduler, set reminders.window_seconds to 2100 or more. Some shared hosts regenerate the user crontab from their control panel; if reminders stop, check that the lines are still there.

1. Embed (optional): paste embed/embed-snippet.html into a page on the same origin.

Configuration

All options live in custom/cb_config.php, deep-merged over custom/cb_defaults.php, which documents every key. The main groups:

• theme, embed, availability.snap_minutes, timezone_detect
• post_booking_redirect – url, hash_param, break_out_of_iframe
• mail – envelope_sender, logo_path, logo_max_width_px, logo_link
• confirmation_email – steps, steps_title, hide_rows, footer_html
• ics – summary, description_lines (placeholders {service}, {provider_name}, {customer_name}, {company_name}, {hash}, {meeting_link})
• google_calendar_event – summary, description_field
• reminders – enabled, offsets, window_seconds, subjects, leads, body_extra_html
• open_override – enabled, allow_backend_session, secret, cookie_path, ui_triggers
• origin_logging, geoip, spam, country_rules, digest – see the privacy notes below
• jewish_calendar – location (latitude, longitude, tzid, israel), schedule_timezone, candle_minutes, holidays, friday

Shabbat and Jewish-holiday blackouts

refresh_blocks.php asks Hebcal for candle-lighting and havdalah times at your location and writes Easy!Appointments blocked periods (in schedule_timezone, the provider's zone):

• Yom Tov (holidays): from candle lighting minus block_before_minutes until havdalah (plus block_after_minutes). A two-day Yom Tov, or Yom Tov next to Shabbat, is one block.
• Friday cutoff (friday): from candle lighting minus cutoff_before_minutes until havdalah, so Friday appointments must end before the cutoff.
• israel: true uses the Israeli one-day Yom Tov schedule. Location and schedule zones can differ: a practice can keep its calendar in one timezone while following Shabbat times at another location; a partial day in the calendar's zone then stays bookable.

There is no default location: the script refuses to run until the location is set. Try php custom/refresh_blocks.php --dry-run first. Only future rows whose notes start with auto:cb- are replaced, so blocked periods you create by hand are kept. Combine with slot snapping so the first slot after a block lands on :00 or :30. Ask your rabbi about the offsets; the times come from Hebcal (CC BY 4.0) and are your responsibility to check.

Unlock all times

For staff taking a booking by phone: with the override on, the wizard offers every free slot of the day, including today, ignoring the working plan, breaks, blocked periods, minimum notice and the future-booking limit. Existing appointments and unavailabilities are still respected and past times are hidden. Spam screening still applies.

Switch it with triple-click on the header banner or Ctrl+Alt+U on the booking page (a short message confirms the new state and repeats on each load while it is on), or with ?cb_open=1 / ?cb_open=0. It is honoured only for a browser logged in to the Easy!Appointments backend, or with &key=<secret> when open_override.secret (16+ characters) is set. The cookie holds an HMAC, so it cannot be set by hand.

Privacy and legal notes

The spam and origin features process personal data and can silently turn people away. They are off by default. Before enabling them:

• Disclose it. If you log IP addresses, user agents, referrers or derived country (origin_logging, geoip), say so in your privacy policy, with the purpose and retention period. Under the GDPR and similar laws these are personal data; you need a lawful basis (typically legitimate interest in fraud and spam prevention) and a retention limit. Purge old rows from ea_cb_booking_log and ea_cb_quarantine on a schedule.
• Silent quarantine has costs. With spam.mode = quarantine or a non-empty country_rules.blocked, a matching visitor sees a normal confirmation, but no appointment, email or calendar event is created. A false positive is a genuine client who believes they are booked and never hears from you. Blocking by country also treats everyone in that country alike, which may raise fairness or discrimination concerns in your jurisdiction and profession. Start with spam.mode = flag (score shown in internal emails only), keep the weekly digest on, use country_rules.trusted and allow_ips generously, and contact anyone in the digest who looks genuine.
• Tune the keywords. spam.legit_keywords ships with neutral examples. Replace them with words your real clients use (for example the services you offer, in the languages you serve). The topic field is spam.topic_field (default custom_field_1, which you enable in Easy!Appointments' booking settings).
• The internal origin block is added only to provider, admin and secretary emails and all values are HTML-escaped. The client never sees it.
• Behind a reverse proxy or CDN set origin_logging.ip_server_key to the header that proxy sets; otherwise leave REMOTE_ADDR, because forwarded headers are client-supplied.

Branding and the GPL

Patch 0012 removes "Powered by Easy!Appointments" from the booking page, message pages and emails. That credit line is not a license notice, and removing it is permitted by the GPL. What you must keep: the copyright and license headers in the source files, the LICENSE file, and the GPL's terms when you distribute the software (including your modifications). The backend keeps its Easy!Appointments credit. Consider linking to the source somewhere, even though the GPL does not require it for software you only run on your own server.

Security notes

• Keep custom/cb_config.php and Easy!Appointments' config.php unreadable from the web. Test with curl -I https://example.com/book/custom/cb_config.php (expect 403).
• Appointment hashes act as bearer tokens (they allow rescheduling). appt-time.php returns only times and a cancelled flag, and is disabled by default.
• The post-booking redirect accepts only http(s) URLs from your config.
• Every add-on hook fails open: an error in scoring, logging or geolocation never blocks a booking.
• Easy!Appointments serves minified JavaScript with a static cache token. Patch 0003 bumps it; if you apply 0012 or 0013 later, change cache_busting_token in application/config/app.php again so browsers fetch the new files.

Upgrading Easy!Appointments

The patches target 1.6.0 exactly. To upgrade: install the new release in a fresh directory, copy config.php, storage/ and custom/, then try the patches with --dry-run. Where a hunk no longer applies, re-apply that change by hand (each patch header explains what and why) and keep your copy of the file for the next upgrade. custom/ is never overwritten.

Tests

tests/run.sh                                  # php -l + unit tests (no database, no network)
tests/run.sh /path/to/pristine/easyappointments-1.6.0   # also verify every patch applies

The unit tests cover the spam scorer and screening decisions, IP ranges, output escaping, slot snapping, the override's slot generation and authorisation, the Shabbat/Yom Tov computation against a recorded-format Hebcal fixture, reminder timing and templates.