Release 2.58 (#5952)

* bump version * fix formatting locale reset after embedded controller sub-requests (#5944) * fix GHSA-c6w6-57jj-62vh * fix GHSA-m492-gv72-xvxj * fix GHSA-jr9p-4h4j-6c58 * make sure to only use JS logic to call API endpoints * fixes GHSA-r8vr-m544-qh4h * make sure to only use JS logic to call API endpoints * fix GHSA-rw46-qg69-vg6h * fix GHSA-pj8j-p4g4-4vw8 - prevent kimai from rendering images via markdown * fix GHSA-pj8j-p4g4-4vw8 - use a safe network client to prevent SSRF via images * fix GHSA-xv4r-4885-gwpg * fix GHSA-pgcc-vfmc-7cw5 - move GET routes to API with POST method to prevent CSRF * fix tooltip survives page reload * updated wizard images * split wizard and password reset subscriber into two classes * relax upper php limit * added zizmor workflow scans and apply findings * user permissions <name>_other_profile now respect teams * move all linting steps to new job * updated docker image version names * use .env.local for storing APP_SECRET * improve build order and use given tag as ref for checkout, not default main branch * improved APP_SECRET handling, see entrypoint.sh * use local code for building the image for more flexibility, added dockerignore
2026-05-25 15:39:47 +02:00
parent 8d245ae223
commit 31a8f887a5
85 changed files with 2737 additions and 472 deletions
--- a/tests/Security/LoginLinkTest.php
+++ b/tests/Security/LoginLinkTest.php
@@ -0,0 +1,81 @@
+<?php
+
+/*
+ * This file is part of the Kimai time-tracking app.
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace App\Tests\Security;
+
+use App\Entity\User;
+use App\Tests\KernelTestTrait;
+use PHPUnit\Framework\Attributes\Group;
+use Symfony\Bundle\FrameworkBundle\Test\KernelTestCase;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\RequestStack;
+use Symfony\Component\Security\Http\LoginLink\Exception\InvalidLoginLinkException;
+use Symfony\Component\Security\Http\LoginLink\LoginLinkHandlerInterface;
+
+/**
+ * Regression test for GHSA-m492-gv72-xvxj: a login link (used for password
+ * reset and admin on-demand login) must stop working once the user's password
+ * has been changed.
+ */
+#[Group('integration')]
+class LoginLinkTest extends KernelTestCase
+{
+    use KernelTestTrait;
+
+    private Request $request;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        self::bootKernel();
+
+        // the login link handler is firewall-aware and needs an active request
+        // on the stack to resolve the firewall it belongs to
+        $this->request = Request::create('http://localhost/');
+        $stack = self::getContainer()->get(RequestStack::class);
+        self::assertInstanceOf(RequestStack::class, $stack);
+        $stack->push($this->request);
+    }
+
+    private function getLoginLinkHandler(): LoginLinkHandlerInterface
+    {
+        /** @var LoginLinkHandlerInterface $handler */
+        $handler = self::getContainer()->get(LoginLinkHandlerInterface::class);
+
+        return $handler;
+    }
+
+    public function testLoginLinkIsValidBeforePasswordChange(): void
+    {
+        $user = $this->getUserByRole(User::ROLE_USER);
+        $handler = $this->getLoginLinkHandler();
+
+        $link = $handler->createLoginLink($user, $this->request);
+
+        $consumed = $handler->consumeLoginLink(Request::create($link->getUrl()));
+
+        self::assertSame($user->getUserIdentifier(), $consumed->getUserIdentifier());
+    }
+
+    public function testLoginLinkIsRejectedAfterPasswordChange(): void
+    {
+        $user = $this->getUserByRole(User::ROLE_USER);
+        $handler = $this->getLoginLinkHandler();
+
+        $link = $handler->createLoginLink($user, $this->request);
+
+        // simulate the user completing the password reset wizard: the password
+        // hash changes, which must invalidate the signature of the old link
+        $user->setPassword('$2y$13$changedchangedchangedchangedchangedchangedchangedchangedchg');
+        $this->getEntityManager()->flush();
+
+        $this->expectException(InvalidLoginLinkException::class);
+        $handler->consumeLoginLink(Request::create($link->getUrl()));
+    }
+}