Release 2.1.0 (#4321)

* fix deprecations
* remove unused config
* replace invalid annotation type with attribute
* use AsDoctrineListener to fix deprecation
* new ModifiedSubscriber to support custom logic and fix deprecation
* removed inheritdoc comment
* new ModifiedSubscriber to support custom logic and fix deprecation
* cleanup event dispatcher interface
* re-order annotation params
* one more doctrine based deprecation
* fix query to count active timesheets
* link to "all times" to identify active timesheets
* link icon instead of text
* fix "skin" translation in wizard
* use duration filter to show duration
* added login link command and controller
* bump tabler theme to 1.0
* added wizard to force password reset by user
* allow to configure that new accounts need to reset their password
* prevent uploading twig templates by default
* bump composer packages
* enable sandbox and basic security measures for custom twig templates for invoice and export
* bump to symfony 6.3.5
* allow to export single user reports to excel
* removed broken method to reload twig cache
* added api parameter to fetch user collection fully serialized
* allow to replace or append description via timesheet batch update
* show api username above form

src/Twig/TwigRendererTrait.php

@@ -9,9 +9,11 @@
 
 namespace App\Twig;
 
+use App\Twig\SecurityPolicy\InvoicePolicy;
 use Symfony\Bridge\Twig\Extension\TranslationExtension;
 use Symfony\Contracts\Translation\LocaleAwareInterface;
 use Twig\Environment;
+use Twig\Extension\SandboxExtension;
 
 /**
  * @internal
@@ -30,6 +32,13 @@ trait TwigRendererTrait
             $previousFormatLocale = $this->switchFormatLocale($twig, $formatLocale);
         }
 
+        // enable basic security measures
+        if (!$twig->hasExtension(SandboxExtension::class)) {
+            $sandbox = new SandboxExtension(new InvoicePolicy());
+            $sandbox->enableSandbox();
+            $twig->addExtension($sandbox);
+        }
+
         $content = $twig->render($template, $options);
 
         if ($previousTranslation !== null) {