Release 2.23.0 (#5075)

config/packages/doctrine.yaml

@@ -25,6 +25,8 @@ doctrine:
             datetime_immutable: App\Doctrine\UTCDateTimeImmutableType
     orm:
         controller_resolver:
+            # FIXME this is causing a deprecation and needs to be changed
+            # auto_mapping: false
             auto_mapping: true
         auto_generate_proxy_classes: '%kernel.debug%'
         default_entity_manager: default

config/packages/kimai.yaml

@@ -105,7 +105,7 @@ kimai:
             TEAMS: ['view_team','create_team','edit_team','delete_team']
             LOCKDOWN: ['lockdown_grace_timesheet','lockdown_override_timesheet']
             REPORTING: ['view_reporting','view_other_reporting','project_reporting','customer_reporting']
-            EVERYONE: ['api_access']
+            EVERYONE: ['api_access','hours_own_profile']
             # permissions which are deactivated, as these features are hidden for now
             # brave users can try to activate them and be surprised what happens
             REGISTER_BETA: []
@@ -117,10 +117,10 @@ kimai:
             ROLE_SUPER_ADMIN: ['ACTIVITIES','PROJECTS','CUSTOMERS','INVOICE','INVOICE_ADMIN','TIMESHEET','TIMESHEET_OTHER','PROFILE','PROFILE_OTHER','USER','TEAMS','RATE','RATE_OTHER','EXPORT','BILLABLE','TAGS','LOCKDOWN','REPORTING', 'EVERYONE']
         # mapping a "role name" to an array of "permission names"
         roles:
-            ROLE_USER: ['view_team_member','time_team_project','create_tag','view_reporting','hours_own_profile']
-            ROLE_TEAMLEAD: ['view_rate_own_timesheet','view_rate_other_timesheet','hourly-rate_own_profile','view_team_member','hours_other_profile','hours_own_profile']
-            ROLE_ADMIN: ['hourly-rate_own_profile','edit_exported_timesheet','teams_own_profile','view_team_member','view_all_data','contract_other_profile','hours_other_profile','hours_own_profile']
-            ROLE_SUPER_ADMIN: ['hourly-rate_own_profile','hourly-rate_other_profile','roles_own_profile','supervisor_own_profile','system_information','system_configuration','plugins','edit_exported_timesheet','teams_own_profile','view_team_member','upload_invoice_template','view_all_data','contract_other_profile','hours_other_profile','hours_own_profile']
+            ROLE_USER: ['view_team_member','time_team_project','create_tag','view_reporting']
+            ROLE_TEAMLEAD: ['view_rate_own_timesheet','view_rate_other_timesheet','hourly-rate_own_profile','view_team_member','hours_other_profile']
+            ROLE_ADMIN: ['hourly-rate_own_profile','edit_exported_timesheet','teams_own_profile','view_team_member','view_all_data','contract_other_profile','hours_other_profile']
+            ROLE_SUPER_ADMIN: ['hourly-rate_own_profile','hourly-rate_other_profile','roles_own_profile','supervisor_own_profile','system_information','system_configuration','plugins','edit_exported_timesheet','teams_own_profile','view_team_member','upload_invoice_template','view_all_data','contract_other_profile','hours_other_profile']
 # --------------------------------------------------------------------------------
 
 

config/packages/monolog.yaml

@@ -6,11 +6,16 @@ when@prod:
         handlers:
             main:
                 type: fingers_crossed
-                action_level: notice
-                handler: nested
-                excluded_http_codes: [403, 404]
+                action_level: error
+                handler: file_log
+                excluded_http_codes:
+                    - {400: ['^/api/']}
+                    - {401: ['^/api/']}
+                    - 403
+                    - 404
+                    - {405: ['/homepage$', '/login_check$', '/export/data$']}
                 channels: ["!deprecation"]
-            nested:
+            file_log:
                 type: stream
                 level: info
                 path: "%kernel.logs_dir%/%kernel.environment%.log"
@@ -24,10 +29,20 @@ when@dev:
     monolog:
         handlers:
             main:
+                type: fingers_crossed
+                action_level: notice
+                handler: file_log
+                excluded_http_codes:
+                    - {400: ['^/api/']}
+                    - {401: ['^/api/']}
+                    - 403
+                    - 404
+                    - {405: ['/homepage$', '/login_check$', '/export/data$']}
+                channels: ["!event", "!deprecation"]
+            file_log:
                 type: stream
                 path: "%kernel.logs_dir%/%kernel.environment%.log"
                 level: debug
-                channels: ["!event", "!deprecation"]
                 formatter: monolog.formatter.kimai
             console:
                 type: console

config/packages/nelmio_cors.yaml

@@ -3,12 +3,7 @@ parameters:
 
 nelmio_cors:
     defaults:
-        allow_credentials: false
-#        allow_origin: ['%env(CORS_ALLOW_ORIGIN)%']
-#        allow_headers: ['Content-Type', 'Authorization', 'X-AUTH-USER', 'X-AUTH-TOKEN']
-#        allow_methods: ['GET', 'OPTIONS', 'POST', 'PUT', 'PATCH', 'DELETE']
-#        expose_headers: ['Link']
-#        max_age: 3600
+        # for security reasons we do not allow CORS by default
         allow_origin: []
         allow_headers: []
         allow_methods: []
@@ -17,10 +12,18 @@ nelmio_cors:
         hosts: []
         origin_regex: true
         forced_allow_origin_value: ~
-#        allow_private_network: true
     paths:
+        # only the API endpoints are accessible
         '^/api/':
+            # allow_origin: ['%env(CORS_ALLOW_ORIGIN)%']
             allow_origin: ['*']
-            allow_headers: ['X-AUTH-USER', 'X-AUTH-TOKEN', 'Content-Type', 'Authorization']
+            allow_headers: ['Content-Type', 'Authorization', 'X-AUTH-USER', 'X-AUTH-TOKEN']
             allow_methods: ['GET', 'OPTIONS', 'POST', 'PUT', 'PATCH', 'DELETE']
+            # expose_headers: ['Link']
             max_age: 3600
+
+when@dev:
+    nelmio_cors:
+        paths:
+            '^/api/':
+                allow_private_network: true

config/packages/rate_limiter.yaml

@@ -5,3 +5,17 @@ framework:
             limit: 250
             interval: '1 hour'
             lock_factory: null
+        reset_password:
+            policy: 'fixed_window'
+            limit: 10
+            interval: '1 hour'
+            lock_factory: null
+
+when@test:
+    framework:
+        rate_limiter:
+            reset_password:
+                policy: 'fixed_window'
+                limit: 100
+                interval: '1 minute'
+                lock_factory: null

config/services.yaml

@@ -22,6 +22,7 @@ services:
         exclude:
             - '../src/API/Model/'
             - '../src/DependencyInjection/'
+            - '../src/Doctrine/Extensions/'
             - '../src/Entity/'
             - '../src/Event/'
             - '../src/Form/Model/'