Release 2.14 (#4710)

- show "link has expired message" in password reset screen
- added date objects as hydrator variables - for custom date formats in invoice templates
- show meta-fields with null values (e.g. booleans with `false` where hidden)
- fix permission check: allow to remove `view_own_timesheet` but still record times
- prevent error 500 if customer country is empty
- fix API 500 error if project does not exist when creating new timesheet
- fix tags are not created in remote-search mode
- do not check "export items" by default
- fix daterange query, if user an request locale are different
- added logging for invalid SAML responses (see various discussions)

src/Controller/AbstractController.php

@@ -255,6 +255,8 @@ abstract class AbstractController extends BaseAbstractController implements Serv
     }
 
     /**
+     * Use "performSearch=1" to skip loading session searches.
+     *
      * @param array<string> $filterParams parameter names, which should not be saved (neither session, nor database)
      * @throws \Exception
      */
@@ -298,7 +300,6 @@ abstract class AbstractController extends BaseAbstractController implements Serv
         }
         $searchName = $this->getSearchName($data);
 
-        /** @var BookmarkRepository $bookmarkRepo */
         $bookmarkRepo = $this->getBookmark();
         $bookmark = $bookmarkRepo->getSearchDefaultOptions($this->getUser(), $searchName);
 

src/Controller/CustomerController.php

@@ -325,7 +325,7 @@ final class CustomerController extends AbstractController
             $rates = $rateRepository->getRatesForCustomer($customer);
         }
 
-        if (null !== $customer->getTimezone()) {
+        if ($customer->getTimezone() !== null && $customer->getTimezone() !== '') {
             $timezone = new \DateTimeZone($customer->getTimezone());
         }
 

src/Controller/Security/PasswordResetController.php

@@ -132,6 +132,8 @@ final class PasswordResetController extends AbstractController
         }
 
         if (!$user->isPasswordRequestNonExpired($this->configuration->getPasswordResetTokenLifetime())) {
+            $this->flashWarning('This link has already expired');
+
             return $this->redirectToRoute('resetting_request');
         }
 

src/Controller/TimesheetController.php

@@ -19,8 +19,15 @@ use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\Routing\Annotation\Route;
 use Symfony\Component\Security\Http\Attribute\IsGranted;
 
+/**
+ * No permission check on controller level, only for single routes.
+ *
+ * There was "view_own_timesheet" here once, but it is a bug, as some companies (rarely, but existing) want their
+ * employees to enter time, but not to see it afterward.
+ *
+ * It is legit to only own "create_own_timesheet" without "view_own_timesheet".
+ */
 #[Route(path: '/timesheet')]
-#[IsGranted('view_own_timesheet')]
 final class TimesheetController extends TimesheetAbstractController
 {
     #[Route(path: '/', defaults: ['page' => 1], name: 'timesheet', methods: ['GET'])]

src/Controller/TimesheetTeamController.php

@@ -27,8 +27,15 @@ use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\Routing\Annotation\Route;
 use Symfony\Component\Security\Http\Attribute\IsGranted;
 
+/**
+ * No permission check on controller level, only for single routes.
+ *
+ * There was "view_other_timesheet" here once, but it is a bug.
+ * Some companies (rarely, but existing) want their employees to enter time, but not to see it afterward.
+ *
+ * It is legit to only own "create_other_timesheet" without "view_other_timesheet".
+ */
 #[Route(path: '/team/timesheet')]
-#[IsGranted('view_other_timesheet')]
 final class TimesheetTeamController extends TimesheetAbstractController
 {
     #[Route(path: '/', defaults: ['page' => 1], name: 'admin_timesheet', methods: ['GET'])]