jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

Release 2.58 (#5952)

Browse Source 
* bump version
* fix formatting locale reset after embedded controller sub-requests (#5944)
* fix GHSA-c6w6-57jj-62vh
* fix GHSA-m492-gv72-xvxj
* fix GHSA-jr9p-4h4j-6c58
* make sure to only use JS logic to call API endpoints
* fixes GHSA-r8vr-m544-qh4h
* make sure to only use JS logic to call API endpoints
* fix GHSA-rw46-qg69-vg6h
* fix GHSA-pj8j-p4g4-4vw8 - prevent kimai from rendering images via markdown
* fix GHSA-pj8j-p4g4-4vw8 - use a safe network client to prevent SSRF via images
* fix GHSA-xv4r-4885-gwpg
* fix GHSA-pgcc-vfmc-7cw5 - move GET routes to API with POST method to prevent CSRF
* fix tooltip survives page reload
* updated wizard images
* split wizard and password reset subscriber into two classes
* relax upper php limit
* added zizmor workflow scans and apply findings
* user permissions <name>_other_profile  now respect teams
* move all linting steps to new job
* updated docker image version names
* use .env.local for storing APP_SECRET
* improve build order and use given tag as ref for checkout, not default main branch
* improved APP_SECRET handling, see entrypoint.sh
* use local code for building the image for more flexibility, added dockerignore
This commit is contained in:
Kevin Papst
2026-05-25 15:39:47 +02:00
committed by GitHub
parent 8d245ae223
commit 31a8f887a5
85 changed files with 2737 additions and 472 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
templates/embeds/rates-table.html.twig
View File

@@ -56,7 +56,7 @@
<td class="actions">
<div class="btn-group">
<a href="{{ path(edit_route, {'id': entity.id, 'rate': rate.id}) }}" class="modal-ajax-form btn btn-icon">{{ icon('edit', true) }}</a>
<a href="{{ path(delete_route, {'id': entity.id, 'rateId': rate.id}) }}" class="btn btn-icon api-link" data-question="confirm.delete" data-event="kimai.rateUpdate kimai.rateDelete" data-method="DELETE" data-msg-error="action.delete.error">{{ icon('delete', true) }}</a>
<a href="#" data-href="{{ path(delete_route, {'id': entity.id, 'rateId': rate.id}) }}" class="btn btn-icon api-link" data-question="confirm.delete" data-event="kimai.rateUpdate kimai.rateDelete" data-method="DELETE" data-msg-error="action.delete.error">{{ icon('delete', true) }}</a>
</div>
</td>
</tr>

25
templates/embeds/teams.html.twig
View File

@@ -1,17 +1,28 @@
{%
{%
set options = {
'teams': teams,
'team': team|default(null),
'route_create': route_create|default(null),
'route_edit': route_edit|default(null),
'teams': teams,
'team': team|default(null),
'route_create': route_create|default(null),
'route_edit': route_edit|default(null),
'empty_message': empty_message|default('team.visibility_global')
}
}
%}
{% embed '@theme/embeds/card.html.twig' with options %}
{% import "macros/widgets.html.twig" as widgets %}
{% block box_tools %}
{% if route_create is not null and (teams|length == 0 or team is null) and is_granted('create_team') %}
{{ widgets.card_tool_button('create', {'title': 'team.create_default', 'translation_domain': 'teams', 'url': route_create}) }}
{{ widgets.card_tool_button('create', {
'title': 'team.create_default',
'translation_domain': 'teams',
'url': '#',
'class': 'api-link',
'attr': {
'data-href': route_create,
'data-method': 'POST',
'data-event': 'kimai.teamUpdate',
'data-msg-error': 'action.update.error'
}
}) }}
{% endif %}
{% if route_edit is not null %}
{{ widgets.card_tool_button('edit', {'class': 'modal-ajax-form open-edit', 'title': 'edit', 'url': route_edit}) }}