jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

Release 2.58 (#5952)

Browse Source 
* bump version
* fix formatting locale reset after embedded controller sub-requests (#5944)
* fix GHSA-c6w6-57jj-62vh
* fix GHSA-m492-gv72-xvxj
* fix GHSA-jr9p-4h4j-6c58
* make sure to only use JS logic to call API endpoints
* fixes GHSA-r8vr-m544-qh4h
* make sure to only use JS logic to call API endpoints
* fix GHSA-rw46-qg69-vg6h
* fix GHSA-pj8j-p4g4-4vw8 - prevent kimai from rendering images via markdown
* fix GHSA-pj8j-p4g4-4vw8 - use a safe network client to prevent SSRF via images
* fix GHSA-xv4r-4885-gwpg
* fix GHSA-pgcc-vfmc-7cw5 - move GET routes to API with POST method to prevent CSRF
* fix tooltip survives page reload
* updated wizard images
* split wizard and password reset subscriber into two classes
* relax upper php limit
* added zizmor workflow scans and apply findings
* user permissions <name>_other_profile  now respect teams
* move all linting steps to new job
* updated docker image version names
* use .env.local for storing APP_SECRET
* improve build order and use given tag as ref for checkout, not default main branch
* improved APP_SECRET handling, see entrypoint.sh
* use local code for building the image for more flexibility, added dockerignore
This commit is contained in:
Kevin Papst
2026-05-25 15:39:47 +02:00
committed by GitHub
parent 8d245ae223
commit 31a8f887a5
85 changed files with 2737 additions and 472 deletions
Download Patch File Download Diff File Expand all files Collapse all files

106
tests/Voter/TimesheetVoterTest.php
View File

@@ -192,19 +192,6 @@ class TimesheetVoterTest extends AbstractVoterTestCase
$this->assertVote($other, $timesheet, 'is_owner', VoterInterface::ACCESS_DENIED);
}
public function testIsOwnerUsesObjectIdentityNotId(): void
{
// The is_owner branch compares with strict identity ($user === $subject->getUser()),
// not by id like the permission-based branches. Two distinct User instances that
// share the same id are therefore NOT considered the same owner.
$tokenUser = self::getUser(1, User::ROLE_USER);
$timesheetUser = self::getUser(1, User::ROLE_USER);
$timesheet = self::getTimesheet($timesheetUser);
$this->assertVote($tokenUser, $timesheet, 'is_owner', VoterInterface::ACCESS_DENIED);
}
public function testIsOwnerDeniedWhenTimesheetHasNoUser(): void
{
$user = self::getUser(1, User::ROLE_USER);
@@ -653,6 +640,99 @@ class TimesheetVoterTest extends AbstractVoterTestCase
$this->assertVote($requester, $timesheet, 'view', VoterInterface::ACCESS_GRANTED);
}
/**
* Reproduces GHSA-c6w6-57jj-62vh.
*
* After a user loses team access to a project, "restart" (start) and
* "duplicate" must NOT be allowed on one of their own historical timesheets:
* both operations derive a brand-new record from the old entry and would
* therefore create a new write under the now-unauthorized project/activity.
*
* The "_own_timesheet" branch in the voter currently short-circuits before
* checkTeamAccess*() runs, so this test FAILS on vulnerable code (the voter
* returns ACCESS_GRANTED) and documents the expected secure behaviour.
*/
public function testStartAndDuplicateDeniedAfterProjectAccessRevoked(): void
{
$owner = self::getUser(1, User::ROLE_USER);
// The project is now restricted to a team the owner is NOT a member of.
// This is the post-revocation state from the advisory's PoC.
$restrictedTeam = new Team('restricted after revocation');
$customer = new Customer('Acme');
$project = new Project();
$project->setCustomer($customer);
$project->addTeam($restrictedTeam);
$activity = new Activity();
$activity->setProject($project);
$timesheet = new Timesheet();
$timesheet->setUser($owner);
$timesheet->setProject($project);
$timesheet->setActivity($activity);
$this->assertVote($owner, $timesheet, 'start', VoterInterface::ACCESS_DENIED);
$this->assertVote($owner, $timesheet, 'duplicate', VoterInterface::ACCESS_DENIED);
}
/**
* Reproduces GHSA-c6w6-57jj-62vh for activity-level restriction.
*
* Even if the project is unrestricted, a restricted activity (a team the
* owner is no longer in) must block restart/duplicate.
*/
public function testStartAndDuplicateDeniedAfterActivityAccessRevoked(): void
{
$owner = self::getUser(1, User::ROLE_USER);
$customer = new Customer('Acme');
$project = new Project();
$project->setCustomer($customer);
$activity = new Activity();
$activity->setProject($project);
$activity->addTeam(new Team('restricted after revocation'));
$timesheet = new Timesheet();
$timesheet->setUser($owner);
$timesheet->setProject($project);
$timesheet->setActivity($activity);
$this->assertVote($owner, $timesheet, 'start', VoterInterface::ACCESS_DENIED);
$this->assertVote($owner, $timesheet, 'duplicate', VoterInterface::ACCESS_DENIED);
}
/**
* Positive control for GHSA-c6w6-57jj-62vh: when the owner still has team
* access to the project and activity, restart/duplicate stay allowed.
* Guards the fix against over-restriction.
*/
public function testStartAndDuplicateGrantedWhenOwnerStillHasProjectAccess(): void
{
$owner = self::getUser(1, User::ROLE_USER);
$team = new Team('still a member');
$team->addUser($owner);
$customer = new Customer('Acme');
$project = new Project();
$project->setCustomer($customer);
$project->addTeam($team);
$activity = new Activity();
$activity->setProject($project);
$timesheet = new Timesheet();
$timesheet->setUser($owner);
$timesheet->setProject($project);
$timesheet->setActivity($activity);
$this->assertVote($owner, $timesheet, 'start', VoterInterface::ACCESS_GRANTED);
$this->assertVote($owner, $timesheet, 'duplicate', VoterInterface::ACCESS_GRANTED);
}
private static function getTimesheetFor(User $owner, ?Team $customerTeam = null, ?Team $projectTeam = null, ?Team $activityTeam = null): Timesheet
{
$customer = new Customer('Acme');