Release 2.17 (#4836)

see https://github.com/kimai/kimai/pull/4836

src/User/UserService.php

@@ -60,6 +60,7 @@ class UserService
     {
         $user = new User();
         $user->setEnabled(true);
+        $user->setRoles([User::DEFAULT_ROLE]);
         $user->setTimezone($this->configuration->getUserDefaultTimezone());
         $user->setLanguage($this->configuration->getUserDefaultLanguage());
         $user->setPreferenceValue(UserPreference::SKIN, $this->configuration->getUserDefaultTheme());
@@ -92,6 +93,7 @@ class UserService
 
         $this->hashPassword($user);
         $this->hashApiToken($user);
+        $user->eraseCredentials();
 
         $this->dispatcher->dispatch(new UserCreatePreEvent($user)); // @CloudRequired
         $this->repository->saveUser($user);
@@ -120,6 +122,7 @@ class UserService
 
         $this->hashPassword($user);
         $this->hashApiToken($user);
+        $user->eraseCredentials();
 
         $this->dispatcher->dispatch(new UserUpdatePreEvent($user));
         $this->repository->saveUser($user);
@@ -179,7 +182,6 @@ class UserService
 
         $password = $this->passwordHasher->hashPassword($user, $plain);
         $user->setPassword($password);
-        $user->eraseCredentials();
     }
 
     private function hashApiToken(User $user): void
@@ -192,7 +194,6 @@ class UserService
 
         $password = $this->passwordHasher->hashPassword($user, $plain);
         $user->setApiToken($password);
-        $user->eraseCredentials();
     }
 
     public function deleteUser(User $delete, ?User $replace = null): void