Release 2.58 (#5952)

* bump version * fix formatting locale reset after embedded controller sub-requests (#5944) * fix GHSA-c6w6-57jj-62vh * fix GHSA-m492-gv72-xvxj * fix GHSA-jr9p-4h4j-6c58 * make sure to only use JS logic to call API endpoints * fixes GHSA-r8vr-m544-qh4h * make sure to only use JS logic to call API endpoints * fix GHSA-rw46-qg69-vg6h * fix GHSA-pj8j-p4g4-4vw8 - prevent kimai from rendering images via markdown * fix GHSA-pj8j-p4g4-4vw8 - use a safe network client to prevent SSRF via images * fix GHSA-xv4r-4885-gwpg * fix GHSA-pgcc-vfmc-7cw5 - move GET routes to API with POST method to prevent CSRF * fix tooltip survives page reload * updated wizard images * split wizard and password reset subscriber into two classes * relax upper php limit * added zizmor workflow scans and apply findings * user permissions <name>_other_profile now respect teams * move all linting steps to new job * updated docker image version names * use .env.local for storing APP_SECRET * improve build order and use given tag as ref for checkout, not default main branch * improved APP_SECRET handling, see entrypoint.sh * use local code for building the image for more flexibility, added dockerignore
2026-05-25 15:39:47 +02:00
parent 8d245ae223
commit 31a8f887a5
85 changed files with 2737 additions and 472 deletions
--- a/tests/EventSubscriber/UserEnvironmentSubscriberTest.php
+++ b/tests/EventSubscriber/UserEnvironmentSubscriberTest.php
@@ -0,0 +1,145 @@
+<?php
+
+/*
+ * This file is part of the Kimai time-tracking app.
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace App\Tests\EventSubscriber;
+
+use App\Configuration\LocaleService;
+use App\Entity\User;
+use App\EventSubscriber\UserEnvironmentSubscriber;
+use App\Twig\LocaleFormatExtensions;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\TestCase;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpKernel\Event\FinishRequestEvent;
+use Symfony\Component\HttpKernel\Event\RequestEvent;
+use Symfony\Component\HttpKernel\HttpKernelInterface;
+use Symfony\Component\HttpKernel\KernelEvents;
+use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
+use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
+use Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface;
+
+#[CoversClass(UserEnvironmentSubscriber::class)]
+class UserEnvironmentSubscriberTest extends TestCase
+{
+    private string $defaultLocale;
+    private string $defaultTimezone;
+
+    protected function setUp(): void
+    {
+        $this->defaultLocale = \Locale::getDefault();
+        $this->defaultTimezone = date_default_timezone_get();
+    }
+
+    protected function tearDown(): void
+    {
+        \Locale::setDefault($this->defaultLocale);
+        date_default_timezone_set($this->defaultTimezone);
+    }
+
+    public function testGetSubscribedEvents(): void
+    {
+        self::assertEquals([
+            KernelEvents::REQUEST => ['prepareEnvironment', -10],
+            KernelEvents::FINISH_REQUEST => ['restoreLocale', -20],
+        ], UserEnvironmentSubscriber::getSubscribedEvents());
+    }
+
+    public function testPrepareEnvironmentUsesRequestLocaleWithoutAuthenticatedUser(): void
+    {
+        $storage = $this->createMock(TokenStorageInterface::class);
+        $storage->expects($this->once())->method('getToken')->willReturn(null);
+
+        $auth = $this->createMock(AuthorizationCheckerInterface::class);
+        $auth->expects($this->never())->method('isGranted');
+
+        $localeExtension = $this->createLocaleFormatExtensions();
+        $sut = new UserEnvironmentSubscriber($storage, $auth, $localeExtension);
+
+        $sut->prepareEnvironment($this->createRequestEvent('fr', true));
+
+        self::assertSame('fr', \Locale::getDefault());
+        self::assertSame('fr', $localeExtension->getLocale());
+        self::assertSame($this->defaultTimezone, date_default_timezone_get());
+    }
+
+    public function testPrepareEnvironmentUsesUserLocaleTimezoneAndPermission(): void
+    {
+        $user = new User();
+        $user->setLocale('de');
+        $user->setTimezone('Europe/Berlin');
+
+        $token = $this->createMock(TokenInterface::class);
+        $token->expects($this->once())->method('getUser')->willReturn($user);
+
+        $storage = $this->createMock(TokenStorageInterface::class);
+        $storage->expects($this->once())->method('getToken')->willReturn($token);
+
+        $auth = $this->createMock(AuthorizationCheckerInterface::class);
+        $auth->expects($this->once())->method('isGranted')->with('view_all_data')->willReturn(true);
+
+        $localeExtension = $this->createLocaleFormatExtensions();
+        $sut = new UserEnvironmentSubscriber($storage, $auth, $localeExtension);
+
+        $sut->prepareEnvironment($this->createRequestEvent('en', true));
+
+        self::assertSame('de', \Locale::getDefault());
+        self::assertSame('de', $localeExtension->getLocale());
+        self::assertSame('Europe/Berlin', date_default_timezone_get());
+        self::assertTrue($user->canSeeAllData());
+    }
+
+    public function testRestoreLocaleAfterSubRequest(): void
+    {
+        $storage = $this->createMock(TokenStorageInterface::class);
+        $storage->expects($this->once())->method('getToken')->willReturn(null);
+
+        $auth = $this->createMock(AuthorizationCheckerInterface::class);
+        $auth->expects($this->never())->method('isGranted');
+
+        $localeExtension = $this->createLocaleFormatExtensions();
+        $sut = new UserEnvironmentSubscriber($storage, $auth, $localeExtension);
+
+        $sut->prepareEnvironment($this->createRequestEvent('de', true));
+
+        \Locale::setDefault('it');
+        $localeExtension->setLocale('it');
+
+        $sut->restoreLocale($this->createFinishRequestEvent(false));
+
+        self::assertSame('de', \Locale::getDefault());
+        self::assertSame('de', $localeExtension->getLocale());
+    }
+
+    private function createLocaleFormatExtensions(): LocaleFormatExtensions
+    {
+        return new LocaleFormatExtensions(new LocaleService([
+            'de' => LocaleService::DEFAULT_SETTINGS,
+            'en' => LocaleService::DEFAULT_SETTINGS,
+            'fr' => LocaleService::DEFAULT_SETTINGS,
+            'it' => LocaleService::DEFAULT_SETTINGS,
+        ]));
+    }
+
+    private function createRequestEvent(string $locale, bool $mainRequest): RequestEvent
+    {
+        $kernel = $this->createMock(HttpKernelInterface::class);
+        $request = new Request();
+        $request->setLocale($locale);
+
+        return new RequestEvent($kernel, $request, $mainRequest ? HttpKernelInterface::MAIN_REQUEST : HttpKernelInterface::SUB_REQUEST);
+    }
+
+    private function createFinishRequestEvent(bool $mainRequest): FinishRequestEvent
+    {
+        $kernel = $this->createMock(HttpKernelInterface::class);
+        $request = new Request();
+
+        return new FinishRequestEvent($kernel, $request, $mainRequest ? HttpKernelInterface::MAIN_REQUEST : HttpKernelInterface::SUB_REQUEST);
+    }
+}