Twig config improvements (#5923)

* deprecate direct kimai_config access, which was only used internally
* prevent access to system configs
* prevent access to most configs in sandbox environments

src/Twig/Configuration.php

@@ -11,23 +11,26 @@ namespace App\Twig;
 
 use App\Configuration\SystemConfiguration;
 use App\Constants;
+use Twig\Environment;
 use Twig\Extension\AbstractExtension;
+use Twig\Extension\SandboxExtension;
+use Twig\Sandbox\SecurityError;
 use Twig\TwigFunction;
 
 final class Configuration extends AbstractExtension
 {
-    public function __construct(private SystemConfiguration $configuration)
+    public function __construct(private readonly SystemConfiguration $configuration)
     {
     }
 
     public function getFunctions(): array
     {
         return [
-            new TwigFunction('config', [$this, 'get']),
+            new TwigFunction('config', $this->get(...), ['needs_environment' => true]),
         ];
     }
 
-    public function get(string $name)
+    public function get(Environment $environment, string $name)
     {
         switch ($name) {
             case 'chart-class':
@@ -42,6 +45,31 @@ final class Configuration extends AbstractExtension
                 return '300';
             case 'theme.calendar.background_color':
                 return Constants::DEFAULT_COLOR;
+            case 'themeAllowAvatarUrls':
+                return $this->configuration->isThemeAllowAvatarUrls();
+                // whitelisted configs that can be read even in invoice environments
+            case 'theme.branding.logo':
+            case 'theme.branding.company':
+                return $this->configuration->find($name);
+        }
+
+        if (str_starts_with($name, 'saml.') || str_starts_with($name, 'ldap.')) {
+            throw new SecurityError(\sprintf('Templates cannot access security configuration %s.', $name));
+        }
+
+        if ($environment->hasExtension(SandboxExtension::class)) {
+            $sandbox = $environment->getExtension(SandboxExtension::class);
+            if ($sandbox->isSandboxed()) {
+                throw new SecurityError('Sandboxed template tried to access configuration key: ' . $name);
+            }
+        }
+
+        $checks = ['is' . $name, 'get' . $name, 'has' . $name, $name];
+
+        foreach ($checks as $methodName) {
+            if (method_exists($this->configuration, $methodName)) {
+                return \call_user_func($this->configuration->$methodName(...));
+            }
         }
 
         return $this->configuration->find($name);
@@ -49,14 +77,8 @@ final class Configuration extends AbstractExtension
 
     public function __call($name, $arguments)
     {
-        $checks = ['is' . $name, 'get' . $name, 'has' . $name, $name];
+        @trigger_error('Accessing "kimai_config" is deprecated and always return null, use config() instead', E_USER_DEPRECATED);
 
-        foreach ($checks as $methodName) {
-            if (method_exists($this->configuration, $methodName)) {
-                return \call_user_func([$this->configuration, $methodName], $arguments);
-            }
-        }
-
-        return $this->configuration->find($name);
+        return null;
     }
 }

src/Twig/Context.php

@@ -9,12 +9,11 @@
 
 namespace App\Twig;
 
-use App\Configuration\SystemConfiguration;
 use Symfony\Component\HttpFoundation\RequestStack;
 
 final class Context
 {
-    public function __construct(private SystemConfiguration $systemConfiguration, private RequestStack $requestStack)
+    public function __construct(private readonly RequestStack $requestStack)
     {
     }
 
@@ -58,8 +57,8 @@ final class Context
 
     public function getBranding(string $config): mixed
     {
-        @trigger_error('Use "kimai_config" instead of "kimai_context" to access system configurations', E_USER_DEPRECATED);
+        @trigger_error('Use config() instead of "kimai_context" to access system configurations', E_USER_DEPRECATED);
 
-        return $this->systemConfiguration->find('theme.branding.' . $config);
+        return null;
     }
 }