Release 2.1.0 (#4321)

* fix deprecations * remove unused config * replace invalid annotation type with attribute * use AsDoctrineListener to fix deprecation * new ModifiedSubscriber to support custom logic and fix deprecation * removed inheritdoc comment * new ModifiedSubscriber to support custom logic and fix deprecation * cleanup event dispatcher interface * re-order annotation params * one more doctrine based deprecation * fix query to count active timesheets * link to "all times" to identify active timesheets * link icon instead of text * fix "skin" translation in wizard * use duration filter to show duration * added login link command and controller * bump tabler theme to 1.0 * added wizard to force password reset by user * allow to configure that new accounts need to reset their password * prevent uploading twig templates by default * bump composer packages * enable sandbox and basic security measures for custom twig templates for invoice and export * bump to symfony 6.3.5 * allow to export single user reports to excel * removed broken method to reload twig cache * added api parameter to fetch user collection fully serialized * allow to replace or append description via timesheet batch update * show api username above form
2023-10-19 11:21:50 +02:00
parent 7a5b12762a
commit 38e37f1c2e
210 changed files with 1784 additions and 1147 deletions
--- a/src/Twig/SecurityPolicy/InvoicePolicy.php
+++ b/src/Twig/SecurityPolicy/InvoicePolicy.php
@@ -0,0 +1,86 @@
+<?php
+
+/*
+ * This file is part of the Kimai time-tracking app.
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace App\Twig\SecurityPolicy;
+
+use App\Invoice\InvoiceModel;
+use App\Pdf\PdfContext;
+use Symfony\Component\String\UnicodeString;
+use Twig\Markup;
+use Twig\Sandbox\SecurityPolicy;
+use Twig\Sandbox\SecurityPolicyInterface;
+use Twig\Template;
+
+/**
+ * Represents the security policy for custom Twig invoice templates.
+ */
+final class InvoicePolicy implements SecurityPolicyInterface
+{
+    private ChainPolicy $policy;
+
+    public function __construct()
+    {
+        $this->policy = new ChainPolicy();
+        $this->policy->addPolicy(new DefaultPolicy());
+        $this->policy->addPolicy(new SecurityPolicy(
+            ['block', 'if', 'for', 'set', 'extends'],
+            [
+                // Twig core filters
+                'map', 'escape', 'trans', 'default', 'nl2br', 'trim', 'raw',
+                'join', 'u', 'slice', 'date', 'month_name', 'first', 'country_name',
+                'replace', 'length', 'number_format', 'split',
+
+                // Kimai filters
+                'md2html', 'desc2html', 'comment2html', 'comment1line', 'multiline_indent', 'nl2str',
+                'date_short', 'duration', 'amount', 'money', 'duration_decimal',
+            ],
+            [
+                PdfContext::class => ['setoption'],
+                InvoiceModel::class => ['toarray'],
+            ],
+            [], // properties
+            [
+                // Twig core functions
+                'cycle', 'asset', 'range',
+
+                // Kimai functions
+                'encore_entry_css_source', 'qr_code_data_uri', 'config',
+            ]
+        ));
+    }
+
+    public function checkSecurity($tags, $filters, $functions): void
+    {
+        $this->policy->checkSecurity($tags, $filters, $functions);
+    }
+
+    public function checkMethodAllowed($obj, $method): void
+    {
+        if ($obj instanceof Template || $obj instanceof Markup || $obj instanceof UnicodeString) {
+            return;
+        }
+
+        $lm = strtolower($method);
+
+        if (str_starts_with($lm, 'get') || str_starts_with($lm, 'is') || str_starts_with($lm, 'has')) {
+            return;
+        }
+
+        if ($lm === '__tostring') {
+            return;
+        }
+
+        $this->policy->checkMethodAllowed($obj, $method);
+    }
+
+    public function checkPropertyAllowed($obj, $property): void
+    {
+        $this->policy->checkPropertyAllowed($obj, $property);
+    }
+}