31a8f887a5
* bump version * fix formatting locale reset after embedded controller sub-requests (#5944) * fix GHSA-c6w6-57jj-62vh * fix GHSA-m492-gv72-xvxj * fix GHSA-jr9p-4h4j-6c58 * make sure to only use JS logic to call API endpoints * fixes GHSA-r8vr-m544-qh4h * make sure to only use JS logic to call API endpoints * fix GHSA-rw46-qg69-vg6h * fix GHSA-pj8j-p4g4-4vw8 - prevent kimai from rendering images via markdown * fix GHSA-pj8j-p4g4-4vw8 - use a safe network client to prevent SSRF via images * fix GHSA-xv4r-4885-gwpg * fix GHSA-pgcc-vfmc-7cw5 - move GET routes to API with POST method to prevent CSRF * fix tooltip survives page reload * updated wizard images * split wizard and password reset subscriber into two classes * relax upper php limit * added zizmor workflow scans and apply findings * user permissions <name>_other_profile now respect teams * move all linting steps to new job * updated docker image version names * use .env.local for storing APP_SECRET * improve build order and use given tag as ref for checkout, not default main branch * improved APP_SECRET handling, see entrypoint.sh * use local code for building the image for more flexibility, added dockerignore
114 lines
3.7 KiB
YAML
114 lines
3.7 KiB
YAML
security:
|
|
password_hashers:
|
|
App\Entity\User: auto
|
|
|
|
providers:
|
|
chain_provider:
|
|
chain:
|
|
providers: [kimai_internal,kimai_ldap]
|
|
kimai_internal:
|
|
entity:
|
|
class: App\Entity\User
|
|
kimai_ldap:
|
|
id: App\Ldap\LdapUserProvider
|
|
|
|
firewalls:
|
|
dev:
|
|
pattern: ^/(_(profiler|wdt)|css|images|js)/
|
|
security: false
|
|
|
|
api:
|
|
access_token:
|
|
token_handler: App\API\Authentication\AccessTokenHandler
|
|
success_handler: App\API\Authentication\AccessTokenSuccessHandler
|
|
remember_me: false
|
|
request_matcher: App\API\Authentication\ApiRequestMatcher
|
|
user_checker: App\Security\UserChecker
|
|
stateless: true
|
|
remember_me: false
|
|
provider: chain_provider
|
|
custom_authenticators:
|
|
- App\API\Authentication\TokenAuthenticator
|
|
|
|
secured_area:
|
|
kimai_ldap: ~
|
|
pattern: ^/
|
|
user_checker: App\Security\UserChecker
|
|
stateless: false
|
|
|
|
entry_point: form_login
|
|
|
|
custom_authenticators:
|
|
- App\Saml\SamlAuthenticator
|
|
|
|
remember_me:
|
|
name: KIMAI_REMEMBER
|
|
secret: '%kernel.secret%'
|
|
lifetime: 604800
|
|
path: /
|
|
always_remember_me: true
|
|
|
|
# activate all configured user provider
|
|
provider: chain_provider
|
|
|
|
form_login:
|
|
check_path: security_check
|
|
login_path: login
|
|
enable_csrf: true
|
|
|
|
two_factor:
|
|
auth_form_path: 2fa_login
|
|
check_path: 2fa_login_check
|
|
remember_me_sets_trusted: true
|
|
|
|
logout:
|
|
path: logout
|
|
target: homepage
|
|
enable_csrf: false
|
|
|
|
login_throttling:
|
|
max_attempts: 5
|
|
interval: '5 minutes'
|
|
|
|
login_link:
|
|
check_route: link_login_check
|
|
# 'password' binds the HMAC signature to the password hash, so a
|
|
# link becomes invalid as soon as the user changes the password
|
|
signature_properties: ['id', 'password']
|
|
lifetime: 900
|
|
max_uses: 3
|
|
|
|
access_decision_manager:
|
|
# only grants access if there is no voter denying access
|
|
strategy: unanimous
|
|
allow_if_all_abstain: false
|
|
|
|
role_hierarchy:
|
|
ROLE_USER: ~
|
|
ROLE_TEAMLEAD: ROLE_USER
|
|
ROLE_ADMIN: ROLE_TEAMLEAD
|
|
ROLE_SUPER_ADMIN: ROLE_ADMIN
|
|
|
|
access_control:
|
|
- {path: '^/auth/2fa', role: IS_AUTHENTICATED_2FA_IN_PROGRESS}
|
|
- {path: '^/auth', roles: PUBLIC_ACCESS}
|
|
- {path: '^/{_locale}$', role: PUBLIC_ACCESS}
|
|
- {path: '^/{_locale}/auth', role: PUBLIC_ACCESS}
|
|
- {path: '^/{_locale}/login', role: PUBLIC_ACCESS}
|
|
- {path: '^/{_locale}/register', role: PUBLIC_ACCESS}
|
|
- {path: '^/{_locale}/resetting', role: PUBLIC_ACCESS}
|
|
- {path: '^/{_locale}/', roles: ROLE_USER}
|
|
- {path: '^/api', roles: IS_AUTHENTICATED}
|
|
|
|
when@test:
|
|
# this configuration simplifies testing URLs protected by the security mechanism
|
|
# See https://symfony.com/doc/current/cookbook/testing/http_authentication.html
|
|
security:
|
|
password_hashers:
|
|
App\Entity\User:
|
|
algorithm: auto
|
|
# see https://github.com/symfony/recipes/pull/1026
|
|
cost: 4 # Lowest possible value for bcrypt
|
|
time_cost: 3 # Lowest possible value for argon
|
|
memory_cost: 10 # Lowest possible value for argon
|