Release 2.58 (#5952)
* bump version * fix formatting locale reset after embedded controller sub-requests (#5944) * fix GHSA-c6w6-57jj-62vh * fix GHSA-m492-gv72-xvxj * fix GHSA-jr9p-4h4j-6c58 * make sure to only use JS logic to call API endpoints * fixes GHSA-r8vr-m544-qh4h * make sure to only use JS logic to call API endpoints * fix GHSA-rw46-qg69-vg6h * fix GHSA-pj8j-p4g4-4vw8 - prevent kimai from rendering images via markdown * fix GHSA-pj8j-p4g4-4vw8 - use a safe network client to prevent SSRF via images * fix GHSA-xv4r-4885-gwpg * fix GHSA-pgcc-vfmc-7cw5 - move GET routes to API with POST method to prevent CSRF * fix tooltip survives page reload * updated wizard images * split wizard and password reset subscriber into two classes * relax upper php limit * added zizmor workflow scans and apply findings * user permissions <name>_other_profile now respect teams * move all linting steps to new job * updated docker image version names * use .env.local for storing APP_SECRET * improve build order and use given tag as ref for checkout, not default main branch * improved APP_SECRET handling, see entrypoint.sh * use local code for building the image for more flexibility, added dockerignore
This commit is contained in:
Kevin Papst
@@ -107,7 +107,7 @@
|
||||
{% if teams is not null %}
|
||||
{% set options = {'teams': teams, 'team': team} %}
|
||||
{% if is_granted('permissions', activity) %}
|
||||
{% set options = options|merge({'route_create': path('activity_team_create', {'id': activity.id}), 'route_edit': path('admin_activity_permissions', {'id': activity.id})}) %}
|
||||
{% set options = options|merge({'route_create': path('post_activity_team', {'id': activity.id}), 'route_edit': path('admin_activity_permissions', {'id': activity.id})}) %}
|
||||
{% endif %}
|
||||
{% if activity.project is not null and (activity.project.teams|length > 0 or activity.project.customer.teams|length > 0) %}
|
||||
{% set options = options|merge({'empty_message': 'team.activity_visibility_inherited'}) %}
|
||||
|
||||
@@ -159,7 +159,7 @@
|
||||
{% if teams is not null %}
|
||||
{% set options = {'teams': teams, 'team': team} %}
|
||||
{% if is_granted('permissions', customer) %}
|
||||
{% set options = options|merge({'route_create': path('customer_team_create', {'id': customer.id}), 'route_edit': path('admin_customer_permissions', {'id': customer.id})}) %}
|
||||
{% set options = options|merge({'route_create': path('post_customer_team', {'id': customer.id}), 'route_edit': path('admin_customer_permissions', {'id': customer.id})}) %}
|
||||
{% endif %}
|
||||
{{ include('embeds/teams.html.twig', options) }}
|
||||
{% endif %}
|
||||
|
||||
@@ -56,7 +56,7 @@
|
||||
<td class="actions">
|
||||
<div class="btn-group">
|
||||
<a href="{{ path(edit_route, {'id': entity.id, 'rate': rate.id}) }}" class="modal-ajax-form btn btn-icon">{{ icon('edit', true) }}</a>
|
||||
<a href="{{ path(delete_route, {'id': entity.id, 'rateId': rate.id}) }}" class="btn btn-icon api-link" data-question="confirm.delete" data-event="kimai.rateUpdate kimai.rateDelete" data-method="DELETE" data-msg-error="action.delete.error">{{ icon('delete', true) }}</a>
|
||||
<a href="#" data-href="{{ path(delete_route, {'id': entity.id, 'rateId': rate.id}) }}" class="btn btn-icon api-link" data-question="confirm.delete" data-event="kimai.rateUpdate kimai.rateDelete" data-method="DELETE" data-msg-error="action.delete.error">{{ icon('delete', true) }}</a>
|
||||
</div>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
@@ -1,17 +1,28 @@
|
||||
{%
|
||||
{%
|
||||
set options = {
|
||||
'teams': teams,
|
||||
'team': team|default(null),
|
||||
'route_create': route_create|default(null),
|
||||
'route_edit': route_edit|default(null),
|
||||
'teams': teams,
|
||||
'team': team|default(null),
|
||||
'route_create': route_create|default(null),
|
||||
'route_edit': route_edit|default(null),
|
||||
'empty_message': empty_message|default('team.visibility_global')
|
||||
}
|
||||
}
|
||||
%}
|
||||
{% embed '@theme/embeds/card.html.twig' with options %}
|
||||
{% import "macros/widgets.html.twig" as widgets %}
|
||||
{% block box_tools %}
|
||||
{% if route_create is not null and (teams|length == 0 or team is null) and is_granted('create_team') %}
|
||||
{{ widgets.card_tool_button('create', {'title': 'team.create_default', 'translation_domain': 'teams', 'url': route_create}) }}
|
||||
{{ widgets.card_tool_button('create', {
|
||||
'title': 'team.create_default',
|
||||
'translation_domain': 'teams',
|
||||
'url': '#',
|
||||
'class': 'api-link',
|
||||
'attr': {
|
||||
'data-href': route_create,
|
||||
'data-method': 'POST',
|
||||
'data-event': 'kimai.teamUpdate',
|
||||
'data-msg-error': 'action.update.error'
|
||||
}
|
||||
}) }}
|
||||
{% endif %}
|
||||
{% if route_edit is not null %}
|
||||
{{ widgets.card_tool_button('edit', {'class': 'modal-ajax-form open-edit', 'title': 'edit', 'url': route_edit}) }}
|
||||
|
||||
@@ -10,7 +10,7 @@
|
||||
<div class="list-group-item">
|
||||
<div class="row align-items-center">
|
||||
<div class="col text-truncate" >
|
||||
<a class="api-link text-decoration-none text-body d-block" href="{{ path('restart_timesheet', {'id': entry.id}) }}"
|
||||
<a class="api-link text-decoration-none text-body d-block" href="#" data-href="{{ path('restart_timesheet', {'id': entry.id}) }}"
|
||||
data-event="kimai.timesheetStart kimai.timesheetUpdate" data-method="PATCH" data-msg-error="timesheet.start.error"
|
||||
data-msg-success="timesheet.start.success" data-bs-dismiss="modal">
|
||||
{{ label_activity(entry.activity) }}
|
||||
|
||||
@@ -154,7 +154,7 @@
|
||||
{% if teams is not null%}
|
||||
{% set options = {'teams': teams, 'team': team} %}
|
||||
{% if is_granted('permissions', project) %}
|
||||
{% set options = options|merge({'route_create': path('project_team_create', {'id': project.id}), 'route_edit': path('admin_project_permissions', {'id': project.id})}) %}
|
||||
{% set options = options|merge({'route_create': path('post_project_team', {'id': project.id}), 'route_edit': path('admin_project_permissions', {'id': project.id})}) %}
|
||||
{% endif %}
|
||||
{% if project.customer.teams|length > 0 %}
|
||||
{% set options = options|merge({'empty_message': 'team.project_visibility_inherited'}) %}
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
|
||||
{% block wizard_content %}
|
||||
<div class="card-body text-center py-4 p-sm-7">
|
||||
<img src="{{ asset('wizard/done.png') }}" height="120" class="mb-n2" alt="Illustration by Katerina Limpitsouni from https://undraw.co/">
|
||||
<img src="{{ asset('touch-icon-512x512.png') }}" height="120" class="mb-n2" alt="Illustration by Katerina Limpitsouni from https://undraw.co/">
|
||||
<h1 class="mt-5">{{ 'wizard.done.title'|trans({}, 'wizard') }}</h1>
|
||||
<p class="text-body-secondary">{{ 'wizard.done.description'|trans({}, 'wizard') }}</p>
|
||||
</div>
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
|
||||
{% block wizard_content %}
|
||||
<div class="card-body text-center py-4 p-sm-7">
|
||||
<img src="{{ asset('wizard/time-management.png') }}" height="120" class="mb-n2" alt="Illustration by Katerina Limpitsouni from https://undraw.co/">
|
||||
<img src="{{ asset('wizard/time-management.svg') }}" height="120" class="mb-n2" alt="Illustration by Katerina Limpitsouni from https://undraw.co/">
|
||||
<h1 class="mt-5">{{ 'wizard.intro.title'|trans({}, 'wizard') }}</h1>
|
||||
<p class="text-body-secondary">{{ 'wizard.intro.description'|trans({}, 'wizard') }}</p>
|
||||
</div>
|
||||
|
||||
Reference in New Issue
Block a user