beta 3 (#3780)

* merge master - allow to upload twig invoice templates via UI
* support adding existing teams with same name
* permissions cannot be set right after role was created - fixes #3777
* allow to deactivate unique customer number validation - fixes #3762 
* invalid message when trying to edit locked or exported timesheets in calendar - fixes #3766
* updated icons and manifest - fixes #3761

src/Controller/ActivityController.php

@@ -56,7 +56,7 @@ final class ActivityController extends AbstractController
 
     #[Route(path: '/', defaults: ['page' => 1], name: 'admin_activity', methods: ['GET'])]
     #[Route(path: '/page/{page}', requirements: ['page' => '[1-9]\d*'], name: 'admin_activity_paginated', methods: ['GET'])]
-    public function indexAction($page, Request $request)
+    public function indexAction(int $page, Request $request): Response
     {
         $query = new ActivityQuery();
         $query->setCurrentUser($this->getUser());
@@ -124,7 +124,7 @@ final class ActivityController extends AbstractController
 
     #[Route(path: '/{id}/details', name: 'activity_details', methods: ['GET', 'POST'])]
     #[IsGranted('view', 'activity')]
-    public function detailsAction(Activity $activity, TeamRepository $teamRepository, ActivityRateRepository $rateRepository, ActivityStatisticService $statisticService)
+    public function detailsAction(Activity $activity, TeamRepository $teamRepository, ActivityRateRepository $rateRepository, ActivityStatisticService $statisticService): Response
     {
         $event = new ActivityMetaDefinitionEvent($activity);
         $this->dispatcher->dispatch($event);
@@ -297,13 +297,11 @@ final class ActivityController extends AbstractController
     public function createDefaultTeamAction(Activity $activity, TeamRepository $teamRepository): Response
     {
         $defaultTeam = $teamRepository->findOneBy(['name' => $activity->getName()]);
-        if (null !== $defaultTeam) {
-            $this->flashError('action.update.error', 'Team already existing');
 
-            return $this->redirectToRoute('activity_details', ['id' => $activity->getId()]);
+        if (null === $defaultTeam) {
+            $defaultTeam = new Team($activity->getName());
         }
 
-        $defaultTeam = new Team($activity->getName());
         $defaultTeam->addTeamlead($this->getUser());
         $defaultTeam->addActivity($activity);
 

src/Controller/CustomerController.php

@@ -63,7 +63,7 @@ final class CustomerController extends AbstractController
 
     #[Route(path: '/', defaults: ['page' => 1], name: 'admin_customer', methods: ['GET'])]
     #[Route(path: '/page/{page}', requirements: ['page' => '[1-9]\d*'], name: 'admin_customer_paginated', methods: ['GET'])]
-    public function indexAction($page, Request $request)
+    public function indexAction(int $page, Request $request): Response
     {
         $query = new CustomerQuery();
         $query->setCurrentUser($this->getUser());
@@ -141,7 +141,7 @@ final class CustomerController extends AbstractController
 
     #[Route(path: '/create', name: 'admin_customer_create', methods: ['GET', 'POST'])]
     #[IsGranted('create_customer')]
-    public function createAction(Request $request, CustomerService $customerService)
+    public function createAction(Request $request, CustomerService $customerService): Response
     {
         $customer = $customerService->createNewCustomer('');
 
@@ -150,7 +150,7 @@ final class CustomerController extends AbstractController
 
     #[Route(path: '/{id}/permissions', name: 'admin_customer_permissions', methods: ['GET', 'POST'])]
     #[IsGranted('permissions', 'customer')]
-    public function teamPermissionsAction(Customer $customer, Request $request)
+    public function teamPermissionsAction(Customer $customer, Request $request): Response
     {
         $form = $this->createForm(CustomerTeamPermissionForm::class, $customer, [
             'action' => $this->generateUrl('admin_customer_permissions', ['id' => $customer->getId()]),
@@ -183,7 +183,7 @@ final class CustomerController extends AbstractController
 
     #[Route(path: '/{id}/comment_delete/{token}', name: 'customer_comment_delete', methods: ['GET'])]
     #[IsGranted(new Expression("is_granted('edit', subject.getCustomer()) and is_granted('comments', subject.getCustomer())"), 'comment')]
-    public function deleteCommentAction(CustomerComment $comment, string $token, CsrfTokenManagerInterface $csrfTokenManager)
+    public function deleteCommentAction(CustomerComment $comment, string $token, CsrfTokenManagerInterface $csrfTokenManager): Response
     {
         $customerId = $comment->getCustomer()->getId();
 
@@ -206,7 +206,7 @@ final class CustomerController extends AbstractController
 
     #[Route(path: '/{id}/comment_add', name: 'customer_comment_add', methods: ['POST'])]
     #[IsGranted('comments', 'customer')]
-    public function addCommentAction(Customer $customer, Request $request)
+    public function addCommentAction(Customer $customer, Request $request): Response
     {
         $comment = new CustomerComment($customer);
         $form = $this->getCommentForm($comment);
@@ -226,7 +226,7 @@ final class CustomerController extends AbstractController
 
     #[Route(path: '/{id}/comment_pin/{token}', name: 'customer_comment_pin', methods: ['GET'])]
     #[IsGranted(new Expression("is_granted('edit', subject.getCustomer()) and is_granted('comments', subject.getCustomer())"), 'comment')]
-    public function pinCommentAction(CustomerComment $comment, string $token, CsrfTokenManagerInterface $csrfTokenManager)
+    public function pinCommentAction(CustomerComment $comment, string $token, CsrfTokenManagerInterface $csrfTokenManager): Response
     {
         $customerId = $comment->getCustomer()->getId();
 
@@ -251,16 +251,14 @@ final class CustomerController extends AbstractController
     #[Route(path: '/{id}/create_team', name: 'customer_team_create', methods: ['GET'])]
     #[IsGranted('create_team')]
     #[IsGranted('permissions', 'customer')]
-    public function createDefaultTeamAction(Customer $customer, TeamRepository $teamRepository)
+    public function createDefaultTeamAction(Customer $customer, TeamRepository $teamRepository): Response
     {
         $defaultTeam = $teamRepository->findOneBy(['name' => $customer->getName()]);
-        if (null !== $defaultTeam) {
-            $this->flashError('action.update.error', 'Team already existing');
 
-            return $this->redirectToRoute('customer_details', ['id' => $customer->getId()]);
+        if (null === $defaultTeam) {
+            $defaultTeam = new Team($customer->getName());
         }
 
-        $defaultTeam = new Team($customer->getName());
         $defaultTeam->addTeamlead($this->getUser());
         $defaultTeam->addCustomer($customer);
 
@@ -275,7 +273,7 @@ final class CustomerController extends AbstractController
 
     #[Route(path: '/{id}/projects/{page}', defaults: ['page' => 1], name: 'customer_projects', methods: ['GET', 'POST'])]
     #[IsGranted('view', 'customer')]
-    public function projectsAction(Customer $customer, int $page, ProjectRepository $projectRepository)
+    public function projectsAction(Customer $customer, int $page, ProjectRepository $projectRepository): Response
     {
         $query = new ProjectQuery();
         $query->setCurrentUser($this->getUser());
@@ -298,7 +296,7 @@ final class CustomerController extends AbstractController
 
     #[Route(path: '/{id}/details', name: 'customer_details', methods: ['GET', 'POST'])]
     #[IsGranted('view', 'customer')]
-    public function detailsAction(Customer $customer, TeamRepository $teamRepository, CustomerRateRepository $rateRepository, CustomerStatisticService $statisticService)
+    public function detailsAction(Customer $customer, TeamRepository $teamRepository, CustomerRateRepository $rateRepository, CustomerStatisticService $statisticService): Response
     {
         $event = new CustomerMetaDefinitionEvent($customer);
         $this->dispatcher->dispatch($event);
@@ -462,14 +460,14 @@ final class CustomerController extends AbstractController
 
     #[Route(path: '/{id}/edit', name: 'admin_customer_edit', methods: ['GET', 'POST'])]
     #[IsGranted('edit', 'customer')]
-    public function editAction(Customer $customer, Request $request)
+    public function editAction(Customer $customer, Request $request): Response
     {
         return $this->renderCustomerForm($customer, $request);
     }
 
     #[Route(path: '/{id}/delete', name: 'admin_customer_delete', methods: ['GET', 'POST'])]
     #[IsGranted('delete', 'customer')]
-    public function deleteAction(Customer $customer, Request $request, CustomerStatisticService $statisticService)
+    public function deleteAction(Customer $customer, Request $request, CustomerStatisticService $statisticService): Response
     {
         $stats = $statisticService->getCustomerStatistics($customer);
 
@@ -511,7 +509,7 @@ final class CustomerController extends AbstractController
     }
 
     #[Route(path: '/export', name: 'customer_export', methods: ['GET'])]
-    public function exportAction(Request $request, EntityWithMetaFieldsExporter $exporter)
+    public function exportAction(Request $request, EntityWithMetaFieldsExporter $exporter): Response
     {
         $query = new CustomerQuery();
         $query->setCurrentUser($this->getUser());

src/Controller/InvoiceController.php

@@ -9,6 +9,7 @@
 
 namespace App\Controller;
 
+use App\Configuration\SystemConfiguration;
 use App\Entity\Customer;
 use App\Entity\Invoice;
 use App\Entity\InvoiceTemplate;
@@ -48,6 +49,7 @@ use Symfony\Component\Security\Csrf\CsrfToken;
 use Symfony\Component\Security\Csrf\CsrfTokenManagerInterface;
 use Symfony\Component\Security\Http\Attribute\IsGranted;
 use Symfony\Contracts\EventDispatcher\EventDispatcherInterface;
+use Twig\Environment;
 
 /**
  * Controller used to create invoices and manage invoice templates.
@@ -447,7 +449,7 @@ final class InvoiceController extends AbstractController
 
     #[Route(path: '/document_upload', name: 'admin_invoice_document_upload', methods: ['GET', 'POST'])]
     #[IsGranted('upload_invoice_template')]
-    public function uploadDocumentAction(Request $request, string $projectDirectory, InvoiceDocumentRepository $documentRepository)
+    public function uploadDocumentAction(Request $request, string $projectDirectory, InvoiceDocumentRepository $documentRepository, Environment $twig, SystemConfiguration $systemConfiguration): Response
     {
         $dir = $documentRepository->getUploadDirectory();
         $invoiceDir = $dir;
@@ -456,6 +458,7 @@ final class InvoiceController extends AbstractController
         if ($invoiceDir[0] !== '/') {
             $invoiceDir = $projectDirectory . DIRECTORY_SEPARATOR . $dir;
         }
+        $invoiceDir = rtrim($invoiceDir, DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR;
 
         $used = [];
         foreach ($this->templateRepository->findAll() as $template) {
@@ -511,23 +514,56 @@ final class InvoiceController extends AbstractController
                 /** @var UploadedFile $uploadedFile */
                 $uploadedFile = $form->get('document')->getData();
 
-                $originalFilename = pathinfo($uploadedFile->getClientOriginalName(), PATHINFO_FILENAME);
-                $safeFilename = transliterator_transliterate(
-                    'Any-Latin; Latin-ASCII; [^A-Za-z0-9_] remove; Lower()',
-                    $originalFilename
-                );
+                $originalName = $uploadedFile->getClientOriginalName();
+                $safeFilename = null;
+                $extension = null;
+                $success = true;
 
-                $extension = $uploadedFile->guessExtension();
+                $allowed = InvoiceDocumentUploadForm::EXTENSIONS_NO_TWIG;
+                if ((bool) $systemConfiguration->find('invoice.upload_twig') === true) {
+                    $allowed = InvoiceDocumentUploadForm::EXTENSIONS;
+                }
 
-                $newFilename = substr($safeFilename, 0, 20) . '.' . $extension;
+                foreach ($allowed as $ext) {
+                    $len = \strlen($ext);
+                    if (substr_compare($originalName, $ext, -$len) === 0) {
+                        $extension = $ext;
+                        $withoutExtension = str_replace($ext, '', $originalName);
+                        $safeFilename = transliterator_transliterate(InvoiceDocumentUploadForm::FILENAME_RULE, $withoutExtension);
+                        break;
+                    }
+                }
 
-                try {
-                    $uploadedFile->move($invoiceDir, $newFilename);
+                if ($safeFilename === null || $extension === null) {
+                    $success = false;
+                    $this->flashError('Invalid file given');
+                } else {
+                    $newFilename = substr($safeFilename, 0, 20) . $extension;
+
+                    try {
+                        $uploadedFile->move($invoiceDir, $newFilename);
+
+                        // if this is a twig file, we directly try to compile the template
+                        if (stripos($newFilename, '.twig') !== false) {
+                            try {
+                                $twig->enableAutoReload();
+                                $twig->load('@invoice/' . $newFilename);
+                                $twig->disableAutoReload();
+                            } catch (Exception $ex) {
+                                unlink($invoiceDir . $newFilename);
+                                $success = false;
+                                $this->flashException($ex, 'File was deleted, as Twig template is broken: ' . $ex->getMessage());
+                            }
+                        }
+                    } catch (Exception $ex) {
+                        $this->flashException($ex, 'action.upload.error');
+                    }
+                }
+
+                if ($success) {
                     $this->flashSuccess('action.update.success');
 
                     return $this->redirectToRoute('admin_invoice_document_upload');
-                } catch (Exception $ex) {
-                    $this->flashException($ex, 'action.upload.error');
                 }
             }
         }

src/Controller/ProjectController.php

@@ -63,7 +63,7 @@ final class ProjectController extends AbstractController
 
     #[Route(path: '/', defaults: ['page' => 1], name: 'admin_project', methods: ['GET'])]
     #[Route(path: '/page/{page}', requirements: ['page' => '[1-9]\d*'], name: 'admin_project_paginated', methods: ['GET'])]
-    public function indexAction($page, Request $request)
+    public function indexAction(int $page, Request $request): Response
     {
         $query = new ProjectQuery();
         $query->setCurrentUser($this->getUser());
@@ -134,7 +134,7 @@ final class ProjectController extends AbstractController
 
     #[Route(path: '/{id}/permissions', name: 'admin_project_permissions', methods: ['GET', 'POST'])]
     #[IsGranted('permissions', 'project')]
-    public function teamPermissions(Project $project, Request $request)
+    public function teamPermissions(Project $project, Request $request): Response
     {
         $form = $this->createForm(ProjectTeamPermissionForm::class, $project, [
             'action' => $this->generateUrl('admin_project_permissions', ['id' => $project->getId()]),
@@ -167,19 +167,19 @@ final class ProjectController extends AbstractController
 
     #[Route(path: '/create/{customer}', name: 'admin_project_create_with_customer', methods: ['GET', 'POST'])]
     #[IsGranted('create_project')]
-    public function createWithCustomerAction(Request $request, Customer $customer)
+    public function createWithCustomerAction(Request $request, Customer $customer): Response
     {
         return $this->createProject($request, $customer);
     }
 
     #[Route(path: '/create', name: 'admin_project_create', methods: ['GET', 'POST'])]
     #[IsGranted('create_project')]
-    public function createAction(Request $request)
+    public function createAction(Request $request): Response
     {
         return $this->createProject($request, null);
     }
 
-    private function createProject(Request $request, ?Customer $customer = null)
+    private function createProject(Request $request, ?Customer $customer = null): Response
     {
         $project = $this->projectService->createNewProject($customer);
 
@@ -206,7 +206,7 @@ final class ProjectController extends AbstractController
 
     #[Route(path: '/{id}/comment_delete/{token}', name: 'project_comment_delete', methods: ['GET'])]
     #[IsGranted(new Expression("is_granted('edit', subject.getProject()) and is_granted('comments', subject.getProject())"), 'comment')]
-    public function deleteCommentAction(ProjectComment $comment, string $token, CsrfTokenManagerInterface $csrfTokenManager)
+    public function deleteCommentAction(ProjectComment $comment, string $token, CsrfTokenManagerInterface $csrfTokenManager): Response
     {
         $projectId = $comment->getProject()->getId();
 
@@ -229,7 +229,7 @@ final class ProjectController extends AbstractController
 
     #[Route(path: '/{id}/comment_add', name: 'project_comment_add', methods: ['POST'])]
     #[IsGranted('comments', 'project')]
-    public function addCommentAction(Project $project, Request $request)
+    public function addCommentAction(Project $project, Request $request): Response
     {
         $comment = new ProjectComment($project);
         $form = $this->getCommentForm($comment);
@@ -249,7 +249,7 @@ final class ProjectController extends AbstractController
 
     #[Route(path: '/{id}/comment_pin/{token}', name: 'project_comment_pin', methods: ['GET'])]
     #[IsGranted(new Expression("is_granted('edit', subject.getProject()) and is_granted('comments', subject.getProject())"), 'comment')]
-    public function pinCommentAction(ProjectComment $comment, string $token, CsrfTokenManagerInterface $csrfTokenManager)
+    public function pinCommentAction(ProjectComment $comment, string $token, CsrfTokenManagerInterface $csrfTokenManager): Response
     {
         $projectId = $comment->getProject()->getId();
 
@@ -274,16 +274,14 @@ final class ProjectController extends AbstractController
     #[Route(path: '/{id}/create_team', name: 'project_team_create', methods: ['GET'])]
     #[IsGranted('create_team')]
     #[IsGranted('permissions', 'project')]
-    public function createDefaultTeamAction(Project $project, TeamRepository $teamRepository)
+    public function createDefaultTeamAction(Project $project, TeamRepository $teamRepository): Response
     {
         $defaultTeam = $teamRepository->findOneBy(['name' => $project->getName()]);
-        if (null !== $defaultTeam) {
-            $this->flashError('action.update.error', 'Team already existing');
 
-            return $this->redirectToRoute('project_details', ['id' => $project->getId()]);
+        if (null === $defaultTeam) {
+            $defaultTeam = new Team($project->getName());
         }
 
-        $defaultTeam = new Team($project->getName());
         $defaultTeam->addTeamlead($this->getUser());
         $defaultTeam->addProject($project);
 
@@ -298,7 +296,7 @@ final class ProjectController extends AbstractController
 
     #[Route(path: '/{id}/activities/{page}', defaults: ['page' => 1], name: 'project_activities', methods: ['GET', 'POST'])]
     #[IsGranted('view', 'project')]
-    public function activitiesAction(Project $project, int $page, ActivityRepository $activityRepository)
+    public function activitiesAction(Project $project, int $page, ActivityRepository $activityRepository): Response
     {
         $query = new ActivityQuery();
         $query->setCurrentUser($this->getUser());
@@ -322,7 +320,7 @@ final class ProjectController extends AbstractController
 
     #[Route(path: '/{id}/details', name: 'project_details', methods: ['GET', 'POST'])]
     #[IsGranted('view', 'project')]
-    public function detailsAction(Project $project, TeamRepository $teamRepository, ProjectRateRepository $rateRepository, ProjectStatisticService $statisticService, CsrfTokenManagerInterface $csrfTokenManager)
+    public function detailsAction(Project $project, TeamRepository $teamRepository, ProjectRateRepository $rateRepository, ProjectStatisticService $statisticService, CsrfTokenManagerInterface $csrfTokenManager): Response
     {
         $event = new ProjectMetaDefinitionEvent($project);
         $this->dispatcher->dispatch($event);
@@ -427,7 +425,7 @@ final class ProjectController extends AbstractController
 
     #[Route(path: '/{id}/edit', name: 'admin_project_edit', methods: ['GET', 'POST'])]
     #[IsGranted('edit', 'project')]
-    public function editAction(Project $project, Request $request)
+    public function editAction(Project $project, Request $request): Response
     {
         $editForm = $this->createEditForm($project);
         $editForm->handleRequest($request);
@@ -452,7 +450,7 @@ final class ProjectController extends AbstractController
 
     #[Route(path: '/{id}/duplicate/{token}', name: 'admin_project_duplicate', methods: ['GET', 'POST'])]
     #[IsGranted('edit', 'project')]
-    public function duplicateAction(Project $project, string $token, ProjectDuplicationService $projectDuplicationService, CsrfTokenManagerInterface $csrfTokenManager)
+    public function duplicateAction(Project $project, string $token, ProjectDuplicationService $projectDuplicationService, CsrfTokenManagerInterface $csrfTokenManager): Response
     {
         if (!$csrfTokenManager->isTokenValid(new CsrfToken('project.duplicate', $token))) {
             $this->flashError('action.csrf.error');
@@ -471,7 +469,7 @@ final class ProjectController extends AbstractController
 
     #[Route(path: '/{id}/delete', name: 'admin_project_delete', methods: ['GET', 'POST'])]
     #[IsGranted('delete', 'project')]
-    public function deleteAction(Project $project, Request $request, ProjectStatisticService $statisticService)
+    public function deleteAction(Project $project, Request $request, ProjectStatisticService $statisticService): Response
     {
         $stats = $statisticService->getProjectStatistics($project);
 
@@ -514,7 +512,7 @@ final class ProjectController extends AbstractController
     }
 
     #[Route(path: '/export', name: 'project_export', methods: ['GET'])]
-    public function exportAction(Request $request, EntityWithMetaFieldsExporter $exporter)
+    public function exportAction(Request $request, EntityWithMetaFieldsExporter $exporter): Response
     {
         $query = new ProjectQuery();
         $query->setCurrentUser($this->getUser());

src/Controller/SystemConfigurationController.php

@@ -432,6 +432,7 @@ final class SystemConfigurationController extends AbstractController
                         ])
                         ->setRequired(true)
                         ->setType(TextType::class)
+                        ->setConstraints([new NotBlank()])
                         ->setTranslationDomain('system-configuration'),
                 ]),
             $authentication,
@@ -459,6 +460,10 @@ final class SystemConfigurationController extends AbstractController
                         ->setRequired(true)
                         ->setType(TextType::class)
                         ->setTranslationDomain('system-configuration'),
+                    (new Configuration('customer.rules.allow_duplicate_number'))
+                        ->setLabel('customer.allow_duplicate_number')
+                        ->setType(YesNoType::class)
+                        ->setTranslationDomain('system-configuration'),
                 ]),
             (new SystemConfigurationModel('project'))
                 ->setConfiguration([

src/Controller/UserController.php

@@ -47,7 +47,7 @@ final class UserController extends AbstractController
 
     #[Route(path: '/', defaults: ['page' => 1], name: 'admin_user', methods: ['GET'])]
     #[Route(path: '/page/{page}', requirements: ['page' => '[1-9]\d*'], name: 'admin_user_paginated', methods: ['GET'])]
-    public function indexAction($page, Request $request): Response
+    public function indexAction(int $page, Request $request): Response
     {
         $query = new UserQuery();
         $query->setCurrentUser($this->getUser());