Release 2.49 (#5820)

* bump packages
* add column summarization per customer (#5808)
* clarify database requirements
* added helper methods to fetch original expected time

Co-authored-by: GregorB54321 <34287148+GregorB54321@users.noreply.github.com>

.editorconfig

@@ -21,7 +21,3 @@ indent_size = 4
 [*.yml]
 indent_style = space
 indent_size = 4
-
-[*.xml]
-indent_style = space
-indent_size = 4

.env.dist

@@ -45,7 +45,3 @@ APP_SECRET=change_this_to_something_unique
 #================================================================================
 # unlikely, that you need to change this one
 CORS_ALLOW_ORIGIN=^https?://localhost(:[0-9]+)?$
-
-###> symfony/messenger ###
-MESSENGER_TRANSPORT_DSN=doctrine://default?auto_setup=0
-###< symfony/messenger ###

.gitattributes

@@ -5,8 +5,10 @@ tests export-ignore
 .codecov.yml export-ignore
 .editorconfig export-ignore
 eslint.config.js export-ignore
+eslint.config.mjs export-ignore
 .gitattributes export-ignore
 .gitignore export-ignore
+.php-cs-fixer.dist.php export-ignore
 php-cs-fixer.dist.php export-ignore
 babel.config.js export-ignore
 package.json export-ignore

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -53,6 +53,7 @@ body:
         attributes:
             label: Which PHP version are you using?
             options:
+                - "8.5"
                 - "8.4"
                 - "8.2"
                 - "8.3"

.github/release-drafter.yml

@@ -22,7 +22,7 @@ version-resolver:
             - 'translation'
     default: patch
 template: |
-    **Compatible with PHP 8.1 to 8.4**
+    **Compatible with PHP 8.1 to 8.5**
     
     $CHANGES
     

.github/workflows/docker.yaml

@@ -60,7 +60,6 @@ jobs:
                   tags: |
                       kimai/kimai2:latest
                       kimai/kimai2:fpm
-                      kimai/kimai2:fpm-${{ env.kimai_version }}
                   push: true
 
             - name: Apache image
@@ -74,6 +73,7 @@ jobs:
                   target: prod
                   platforms: linux/amd64,linux/arm64
                   tags: |
+                      kimai/kimai2:stable
                       kimai/kimai2:apache
                       kimai/kimai2:apache-${{ env.kimai_version }}
                   push: true

.github/workflows/testing.yaml

@@ -19,7 +19,7 @@ jobs:
                 options: --health-cmd="mysqladmin ping" --health-interval=10s --health-timeout=5s --health-retries=3
         strategy:
             matrix:
-                php: ['8.1', '8.2', '8.3', '8.4']
+                php: ['8.1', '8.2', '8.3', '8.4', '8.5']
 
         name: Integration (${{ matrix.php }})
         steps:
@@ -87,7 +87,7 @@ jobs:
                     MAILER_URL: null://localhost
 
             -   name: Full test-suite
-                if: matrix.php != '8.2'
+                if: matrix.php != '8.5'
                 run: vendor/bin/phpunit tests/
                 env:
                     DATABASE_URL: mysql://root:kimai@127.0.0.1:${{ job.services.mysql.ports['3306'] }}/kimai?charset=utf8mb4&serverVersion=8.0.35
@@ -95,7 +95,7 @@ jobs:
                     MAILER_URL: null://localhost
 
             -   name: Full test-suite with coverage
-                if: matrix.php == '8.2'
+                if: matrix.php == '8.5'
                 run: vendor/bin/phpunit tests/ --coverage-clover=coverage.xml
                 env:
                     DATABASE_URL: mysql://root:kimai@127.0.0.1:${{ job.services.mysql.ports['3306'] }}/kimai?charset=utf8mb4&serverVersion=8.0.35
@@ -103,7 +103,7 @@ jobs:
                     MAILER_URL: null://localhost
 
             -   name: Upload code coverage
-                if: matrix.php == '8.2'
+                if: matrix.php == '8.5'
                 uses: codecov/codecov-action@v5
                 with:
                     token: ${{ secrets.CODECOV_TOKEN }}

.gitignore

@@ -3,6 +3,8 @@
 /.env-*
 /.idea/
 .DS_Store
+var/templates/
+
 
 # custom apache rules e.g. to deactivate ioncube loader
 /public/.user.ini
@@ -14,6 +16,7 @@
 # YARN 2
 /.yarnrc.yml
 /.yarn
+/.pnp.*
 
 # for keeping empty directories
 /config/packages/local.yaml

CONTRIBUTING.md

@@ -10,7 +10,7 @@ Send your ideas, code reviews, pull requests and feature requests to help to imp
 - Make your changes in a new git branch, based on the latest code in `main`
 - Apply our code-style by running `composer codestyle-fix`
 - Run the static code analysis with `composer phpstan`
-- Verify everything still works with `composer tests-unit` 
+- Verify everything still works with `composer tests` 
 - Add tests for your changes
 
 Further documentation can be found in the [developer documentation](https://www.kimai.org/documentation/developers.html).

README.md

@@ -6,11 +6,9 @@
     <a href="https://github.com/kimai/kimai/actions"><img alt="CI Status" src="https://github.com/kimai/kimai/actions/workflows/testing.yaml/badge.svg"></a>
     <a href="https://codecov.io/gh/kimai/kimai"><img alt="Code Coverage" src="https://codecov.io/gh/kimai/kimai/branch/main/graph/badge.svg"></a>
     <a href="https://packagist.org/packages/kimai/kimai"><img alt="Latest stable version" src="https://poser.pugx.org/kimai/kimai/v/stable"></a>
-    <a href="https://www.gnu.org/licenses/agpl-3.0.en.html"><img alt="License" src="https://poser.pugx.org/kimai/kimai/license"></a>
-    <a href="https://phpc.social/@kimai" rel="me"><img alt="Mastodon" src="https://img.shields.io/badge/toot-%40kimai-8c8dff"></a>
 </p>
 
-<h1 align="center">Kimai - time-tracker</h1>
+<h1 align="center">Kimai<br>#1 Open-Source Time-Tracker</h1>
 
 Kimai is a professional grade time-tracking application, free and open-source. 
 It handles use-cases of freelancers as well as companies with dozens or hundreds of users. 
@@ -29,8 +27,8 @@ and so much more.
 
 ### Requirements
 
-- PHP 8.1.3 minimum (support for PHP 8.2, 8.3, 8.4)
-- MariaDB or MySQL
+- PHP 8.1.3 minimum with support for 8.2, 8.3, 8.4, 8.5
+- MariaDB / MySQL in their oldest maintained LTS release, currently MariaDB >= [10.6](https://endoflife.date/mariadb) or MySQL >= [8.4](https://endoflife.date/mysql)
 - A webserver and subdomain (subdirectory is not supported)
 - PHP extensions: `gd`, `intl`, `json`, `mbstring`, `pdo`, `tokenizer`, `xml`, `xsl`, `zip`
 
@@ -44,7 +42,7 @@ and so much more.
 
 There are more documented ways for [on-premise hosting](https://www.kimai.org/documentation/chapter-on-premise.html). 
 
-And if you don't want to host Kimai, you can use [the Cloud version](https://www.kimai.cloud/) of it.
+And if you don't want to host Kimai, you can use the [Cloud version](https://www.kimai.cloud/) of it.
 
 ### Updating Kimai
 
@@ -71,6 +69,7 @@ The best way to start is to [open a new issue](https://github.com/kimai/kimai/is
 In case you want to contribute, but you wouldn't know how, here are some suggestions:
 
 - Spread the word: Please [write a testimonial for our Wall of love](https://love.kimai.org), vote for Kimai on any software platform, you can toot or tweet about it, share it on LinkedIn, Reddit and any other social media platform!
+- [Translate Kimai into your language](https://hosted.weblate.org/engage/kimai/), or help to improve the existing translations, many languages look for a contributor
 - Answer questions: You know the answer to another user's problem? Share your knowledge.
 - Something can be done better? An essential feature is missing? Create a feature request.
 - Report bugs makes Kimai better for everyone.
@@ -79,6 +78,12 @@ In case you want to contribute, but you wouldn't know how, here are some suggest
 
 There is one simple rule in our "Code of conduct": Don't be an ass!
 
+## Follow Kimai
+
+- Mastodon: [@kimai](https://phpc.social/@kimai)
+- Youtube: [@kimai_org](https://www.youtube.com/@kimai_org)
+- LinkedIn: [@kimai-org](https://www.linkedin.com/company/kimai-org/)
+
 ### Credits
 
 Kimai is based on modern technologies and frameworks such as [PHP](https://www.php.net/),

UPGRADING-3.md

@@ -13,6 +13,8 @@ Perform EACH version specific task between your version and the new one, otherwi
 
 ### Developer
 
+Do not use method chaining: all fluent interface, especially in Entities, are no longer supported. 
+
 Removed translations:
 - `action.edit`: use `edit` instead
 - `my.profile`: use `user_profile` instead

assets/invoice.js

@@ -1,2 +1,4 @@
-
+/**
+ * @deprecated use invoice-pdf instead
+ */
 require('./sass/_invoice.scss');

assets/js/forms/KimaiAutocompleteTags.js

@@ -24,7 +24,7 @@ export default class KimaiAutocompleteTags extends KimaiAutocomplete {
         API.get(apiUrl, {'name': query}, (data) => {
             let results = [];
             for (let item of data) {
-                results.push({text: item.name, value: item.name, color: item.color});
+                results.push({text: item.name, value: item.name, color: item['color-safe']});
             }
             callback(results);
         }, () => {

assets/js/plugins/KimaiAPILink.js

@@ -73,6 +73,7 @@ export default class KimaiAPILink extends KimaiPlugin {
         const ALERT = this.getContainer().getPlugin('alert');
         const successHandle = () => {
             EVENTS.trigger(eventName);
+            document.dispatchEvent(new CustomEvent('kimai.reloadedContent'));
             if (attributes['msgSuccess'] !== undefined) {
                 ALERT.success(attributes['msgSuccess']);
             }
@@ -82,6 +83,7 @@ export default class KimaiAPILink extends KimaiPlugin {
             if (attributes['msgError'] !== undefined) {
                 message = attributes['msgError'];
             }
+            document.dispatchEvent(new CustomEvent('kimai.reloadedContent'));
             API.handleError(message, error);
         };
 
@@ -90,6 +92,8 @@ export default class KimaiAPILink extends KimaiPlugin {
             data = attributes['payload'];
         }
 
+        document.dispatchEvent(new CustomEvent('kimai.reloadContent'));
+
         if (method === 'PATCH') {
             API.patch(url, data, successHandle, errorHandle);
         } else if (method === 'POST') {

assets/js/plugins/KimaiAjaxModalForm.js

@@ -217,8 +217,6 @@ export default class KimaiAjaxModalForm extends KimaiReducedClickHandler {
                 const eventName = form.dataset['formEvent'];
                 /** @type {KimaiEvent} alert */
                 const events = this.getContainer().getPlugin('event');
-                /** @type {KimaiAlert} alert */
-                const alert = this.getContainer().getPlugin('alert');
 
                 event.preventDefault();
                 event.stopPropagation();
@@ -259,15 +257,8 @@ export default class KimaiAjaxModalForm extends KimaiReducedClickHandler {
                             } else {
                                 events.trigger(eventName);
 
-                                // try to find form defined message first, but
-                                let msg = form.dataset['msgSuccess'];
-                                // if that is not available: use a generic fallback message
-                                if (msg === null || msg === undefined || msg === '') {
-                                    msg = 'action.update.success';
-                                }
                                 this._isDirty = false;
                                 this._getModal().hide();
-                                alert.success(msg);
                             }
                         });
                     })
@@ -277,6 +268,8 @@ export default class KimaiAjaxModalForm extends KimaiReducedClickHandler {
                             message = 'action.update.error';
                         }
 
+                        /** @type {KimaiAlert} alert */
+                        const alert = this.getContainer().getPlugin('alert');
                         alert.error(message, error.message);
 
                         // this is useful for changing form fields and retrying to save (and in development to test form changes)

assets/js/plugins/KimaiThemeInitializer.js

@@ -42,7 +42,7 @@ export default class KimaiThemeInitializer extends KimaiPlugin {
             }
 
             // at which element we append the loading screen
-            let container = 'body';
+            let container = 'div.page-wrapper';
             if (event.detail !== undefined && event.detail !== null) {
                 container = event.detail;
             }

assets/js/widgets/KimaiCalendar.js

@@ -70,8 +70,6 @@ export default class KimaiCalendar {
         const DATES = this.kimai.getPlugin('date');
         /** @type {KimaiAjaxModalForm} MODAL */
         const MODAL = this.kimai.getPlugin('modal');
-        /** @type {KimaiAlert} ALERT */
-        const ALERT = this.kimai.getPlugin('alert');
 
         // Instead of using "buttonIcons" the theme needs to be adjusted directly
         // https://fullcalendar.io/docs/buttonIcons
@@ -282,6 +280,7 @@ export default class KimaiCalendar {
                 droppable: true,
                 // drop function handles external draggable events
                 drop: (dropInfo) => {
+                    document.dispatchEvent(new CustomEvent('kimai.reloadContent'));
                     const entry = dropInfo.draggedEl;
                     const source = entry.parentElement;
                     let data = JSON.parse(entry.dataset.entry);
@@ -324,7 +323,7 @@ export default class KimaiCalendar {
                             (result) => {
                                 const newItem = this.convertSourceForCalendar(result);
                                 this.getCalendar().addEvent(newItem, true);
-                                ALERT.success('action.update.success');
+                                document.dispatchEvent(new CustomEvent('kimai.reloadedContent'));
                             }
                         );
                     } else {
@@ -334,7 +333,7 @@ export default class KimaiCalendar {
                             (result) => {
                                 const newItem = this.convertSourceForCalendar(result);
                                 this.getCalendar().addEvent(newItem, true);
-                                ALERT.success('action.update.success');
+                                document.dispatchEvent(new CustomEvent('kimai.reloadedContent'));
                             }
                         );
                     }
@@ -703,8 +702,6 @@ export default class KimaiCalendar {
 
         /** @type {KimaiAPI} API */
         const API = this.kimai.getPlugin('api');
-        /** @type {KimaiAlert} ALERT */
-        const ALERT = this.kimai.getPlugin('alert');
         /** @type {KimaiDateUtils} DATE */
         const DATES = this.kimai.getPlugin('date');
 
@@ -716,11 +713,14 @@ export default class KimaiCalendar {
             payload.end = null;
         }
 
+        document.dispatchEvent(new CustomEvent('kimai.reloadContent'));
+
         const updateUrl = this.options.url.update(event.id);
         API.patch(updateUrl, JSON.stringify(payload), () => {
-            ALERT.success('action.update.success');
+            document.dispatchEvent(new CustomEvent('kimai.reloadedContent'));
         }, (error) => {
             eventArg.revert();
+            document.dispatchEvent(new CustomEvent('kimai.reloadedContent'));
             API.handleError('action.update.error', error);
         });
     }

assets/sass/_kimai.scss

@@ -1,3 +1,4 @@
+@import "variables";
 @import "layout";
 @import "error-page";
 @import "print";

assets/sass/loading-spinner.scss

@@ -12,6 +12,6 @@
     width: 100%;
     height: 100%;
     z-index: 1021;
-    background-color: var(--tblr-backdrop-bg);
+    /*background-color: var(--tblr-backdrop-bg);*/
     opacity: $modal-backdrop-opacity;
 }

assets/sass/tabler-fixes.scss

@@ -48,4 +48,12 @@ fieldset.form-fieldset > legend {
     .page-title {
         color: var(--tblr-body-color);
     }
-}
+}
+
+/* Highlighted text is not visible - https://github.com/tabler/tabler/issues/2603 */
+[data-bs-theme=dark] {
+    ::selection,
+    .text-selected {
+        background-color: var(--#{$prefix}primary);
+    }
+}

assets/sass/variables.scss

@@ -0,0 +1,33 @@
+:root {
+    --kimai-public-holiday: var(--tblr-lime);
+    --kimai-holiday: var(--tblr-green);
+    --kimai-sickness: var(--tblr-yellow);
+    --kimai-time-off: var(--tblr-blue);
+    --kimai-other: var(--tblr-purple);
+
+    --kimai-public-holiday-bg: var(--tblr-lime-lt);
+    --kimai-holiday-bg: var(--tblr-green-lt);
+    --kimai-sickness-bg: var(--tblr-yellow-lt);
+    --kimai-time-off-bg: var(--tblr-blue-lt);
+    --kimai-other-bg: var(--tblr-purple-lt);
+
+    --kimai-unexpected-bg: var(--tblr-pink-lt);
+    --kimai-missing-bg: var(--tblr-pink-lt);
+    --kimai-weekend-bg: var(--tblr-bg-surface-tertiary);
+}
+
+.public-holiday { color: var(--kimai-public-holiday); }
+.holiday { color: var(--kimai-holiday); }
+.sickness { color: var(--kimai-sickness); }
+.time-off { color: var(--kimai-time-off); }
+.other { color: var(--kimai-other); }
+
+.bg-public-holiday{ background-color: var(--kimai-public-holiday-bg); --tblr-table-bg: var(--kimai-public-holiday-bg); i.fas{ color: var(--kimai-public-holiday); } };
+.bg-holiday { background-color: var(--kimai-holiday-bg); --tblr-table-bg: var(--kimai-holiday-bg); i.fas{ color: var(--kimai-holiday); } };
+.bg-sickness { background-color: var(--kimai-sickness-bg); --tblr-table-bg: var(--kimai-sickness-bg); i.fas{ color: var(--kimai-sickness); } };
+.bg-time-off { background-color: var(--kimai-time-off-bg); --tblr-table-bg: var(--kimai-time-off-bg); i.fas{ color: var(--kimai-time-off); } };
+.bg-other { background-color: var(--kimai-other-bg); --tblr-table-bg: var(--kimai-other-bg); i.fas{ color: var(--kimai-other); } };
+
+.bg-unexpected { background-color: var(--kimai-unexpected-bg); --tblr-table-bg: var(--kimai-unexpected-bg); };
+.bg-missing { background-color: var(--kimai-missing-bg); --tblr-table-bg: var(--kimai-missing-bg); };
+.bg-weekend { background-color: var(--kimai-weekend-bg); --tblr-table-bg: var(--kimai-weekend-bg); };

composer.json

@@ -14,7 +14,7 @@
         }
     ],
     "require": {
-        "php": "8.1.*||8.2.*||8.3.*||8.4.*",
+        "php": "8.1.*||8.2.*||8.3.*||8.4.*||8.5.*",
         "ext-gd": "*",
         "ext-intl": "*",
         "ext-json": "*",
@@ -74,7 +74,6 @@
         "symfony/translation": "^6.0",
         "symfony/twig-bundle": "^6.0",
         "symfony/validator": "^6.0",
-        "symfony/webhook": "^6.0",
         "symfony/webpack-encore-bundle": "^2.0",
         "symfony/yaml": "^6.0",
         "twig/cssinliner-extra": "^3.0",

config/packages/messenger.yaml

@@ -1,22 +0,0 @@
-framework:
-    messenger:
-        # Uncomment this (and the failed transport below) to send failed messages to this transport for later handling.
-        # failure_transport: failed
-
-        transports:
-            # https://symfony.com/doc/current/messenger.html#transport-configuration
-            # async: '%env(MESSENGER_TRANSPORT_DSN)%'
-            # failed: 'doctrine://default?queue_name=failed'
-            sync: 'sync://'
-
-        routing:
-            # Route your messages to the transports
-            # 'App\Message\YourMessage': async
-
-# when@test:
-#    framework:
-#        messenger:
-#            transports:
-#                # replace with your transport name here (e.g., my_transport: 'in-memory://')
-#                # For more Messenger testing tools, see https://github.com/zenstruck/messenger-test
-#                async: 'in-memory://'

config/packages/tabler.yaml

@@ -75,6 +75,7 @@ tabler:
         fax: fas fa-fax
         filter: fas fa-filter
         help: far fa-question-circle
+        holiday: fas fa-umbrella-beach
         home: fas fa-home
         info: fas fa-info-circle
         import: fas fa-file-import
@@ -95,6 +96,7 @@ tabler:
         ods: fas fa-table
         off: fas fa-toggle-off
         on: fas fa-toggle-on
+        other: fas fa-file-alt
         password: fas fa-key
         pause: fas fa-pause
         pause-small: far fa-pause-circle
@@ -108,6 +110,7 @@ tabler:
         profile: fas fa-user-edit
         profile-stats: far fa-chart-bar
         project: fas fa-briefcase
+        public-holiday: fas fa-calendar-day
         repeat: fas fa-repeat
         reporting: far fa-chart-bar
         report: far fa-chart-bar
@@ -119,6 +122,7 @@ tabler:
         save: far fa-save
         search: fas fa-search
         settings: fas fa-cog
+        sickness: fas fa-prescription-bottle-medical
         shop: fas fa-shopping-cart
         spinner: fas fa-spinner
         start: fas fa-play
@@ -130,6 +134,7 @@ tabler:
         team: fas fa-users
         timesheet: fas fa-clock
         timesheet-team: fas fa-user-clock
+        time-off: fas fa-couch
         trash: far fa-trash-alt
         unlocked: fas fa-unlock-alt
         upload: fas fa-upload

config/routes/webhook.yaml

@@ -1,3 +0,0 @@
-#webhook:
-#    resource: '@FrameworkBundle/Resources/config/routing/webhook.xml'
-#    prefix: /webhook

phpstan.neon

@@ -27,6 +27,7 @@ parameters:
         numericOperandsInArithmeticOperators: true
         switchConditionsMatchingType: true
         noVariableVariables: false
+    reportNonIntStringArrayKey: false
     paths:
         - src
     tmpDir: %rootDir%/../../../var/cache/phpstan
@@ -2644,16 +2645,6 @@ parameters:
             count: 1
             path: src/Form/Type/UserPreferenceType.php
 
-        -
-            message: "#^PHPDoc tag @var for variable \\$collection contains generic class Doctrine\\\\Common\\\\Collections\\\\ArrayCollection but does not specify its types\\: TKey, T$#"
-            count: 1
-            path: src/Form/Type/UserPreferencesCollectionType.php
-
-        -
-            message: "#^Parameter \\#1 \\$key of method Doctrine\\\\Common\\\\Collections\\\\ArrayCollection\\<\\(int\\|string\\),mixed\\>\\:\\:set\\(\\) expects \\(int\\|string\\), string\\|null given\\.$#"
-            count: 1
-            path: src/Form/Type/UserPreferencesCollectionType.php
-
         -
             message: "#^Cannot access offset mixed on mixed\\.$#"
             count: 1
@@ -3819,61 +3810,6 @@ parameters:
             count: 1
             path: src/Utils/ProfileManager.php
 
-        -
-            message: "#^Argument of an invalid type mixed supplied for foreach, only iterables are supported\\.$#"
-            count: 1
-            path: src/Utils/ReleaseVersion.php
-
-        -
-            message: "#^Cannot access offset 0 on mixed\\.$#"
-            count: 1
-            path: src/Utils/ReleaseVersion.php
-
-        -
-            message: "#^Cannot access property \\$body on mixed\\.$#"
-            count: 1
-            path: src/Utils/ReleaseVersion.php
-
-        -
-            message: "#^Cannot access property \\$draft on mixed\\.$#"
-            count: 1
-            path: src/Utils/ReleaseVersion.php
-
-        -
-            message: "#^Cannot access property \\$html_url on mixed\\.$#"
-            count: 1
-            path: src/Utils/ReleaseVersion.php
-
-        -
-            message: "#^Cannot access property \\$prerelease on mixed\\.$#"
-            count: 1
-            path: src/Utils/ReleaseVersion.php
-
-        -
-            message: "#^Cannot access property \\$published_at on mixed\\.$#"
-            count: 1
-            path: src/Utils/ReleaseVersion.php
-
-        -
-            message: "#^Cannot access property \\$tag_name on mixed\\.$#"
-            count: 2
-            path: src/Utils/ReleaseVersion.php
-
-        -
-            message: "#^Cannot access property \\$zipball_url on mixed\\.$#"
-            count: 1
-            path: src/Utils/ReleaseVersion.php
-
-        -
-            message: "#^Method App\\\\Utils\\\\ReleaseVersion\\:\\:getReleasesFromGithub\\(\\) return type has no value type specified in iterable type array\\.$#"
-            count: 1
-            path: src/Utils/ReleaseVersion.php
-
-        -
-            message: "#^Parameter \\#1 \\$json of function json_decode expects string, string\\|false given\\.$#"
-            count: 1
-            path: src/Utils/ReleaseVersion.php
-
         -
             message: "#^Cannot access offset 'pattern' on mixed\\.$#"
             count: 1
@@ -4008,8 +3944,3 @@ parameters:
             message: "#^Method App\\\\Form\\\\MultiUpdate\\\\MultiUpdateTableDTO\\:\\:setEntities\\(\\) has parameter \\$entities with generic interface Doctrine\\\\Common\\\\Collections\\\\Collection but does not specify its types\\: TKey, T$#"
             count: 1
             path: src/Form/MultiUpdate/MultiUpdateTableDTO.php
-
-        -
-          message: "#^Method App\\\\Entity\\\\InvoiceTemplate\\:\\:getMetaFields\\(\\) return type with generic interface Doctrine\\\\Common\\\\Collections\\\\Collection does not specify its types\\: TKey, T$#"
-          count: 1
-          path: src/Entity/InvoiceTemplate.php

phpunit.xml.dist

@@ -14,7 +14,7 @@
     <ini name="error_reporting" value="-1"/>
     <ini name="max_execution_time" value="-1"/>
     <ini name="date.timezone" value="UTC"/>
-    <ini name="intl.default_locale" value="en_US"/>
+    <ini name="intl.default_locale" value="en"/>
     <ini name="date.timezone" value="Europe/Vienna"/>
     <env name="KERNEL_CLASS" value="App\Kernel" force="true"/>
     <env name="SYMFONY_DEPRECATIONS_HELPER" value="weak"/>
@@ -38,13 +38,6 @@
         GRANT execute,select,insert,update,delete,create,alter,drop,index,references ON `kimai2_test`.* TO kimai2_test@127.0.0.1;
     -->
     <env name="BOOTSTRAP_RESET_DATABASE" value="true"/>
-
-        <!-- ###+ symfony/messenger ### -->
-        <!-- Choose one of the transports below -->
-        <!-- MESSENGER_TRANSPORT_DSN=amqp://guest:guest@localhost:5672/%2f/messages -->
-        <!-- MESSENGER_TRANSPORT_DSN=redis://localhost:6379/messages -->
-        <env name="MESSENGER_TRANSPORT_DSN" value="doctrine://default?auto_setup=0"/>
-        <!-- ###- symfony/messenger ### -->
   </php>
   <testsuites>
     <testsuite name="Kimai">

public/browserconfig.xml

@@ -4,7 +4,7 @@
         <tile>
             <square150x150logo src="favicon/mstile-150x150.png"/>
             <square310x310logo src="favicon/mstile-large.jpg"/>
-            <TileColor>#00a300</TileColor>
+            <TileColor>#ffffff</TileColor>
         </tile>
     </msapplication>
 </browserconfig>

public/build/chart.56f16a68.js.LICENSE.txt

@@ -1,7 +1,7 @@
 /*!
- * @kurkle/color v0.3.2
+ * @kurkle/color v0.3.4
  * https://github.com/kurkle/color#readme
- * (c) 2023 Jukka Kurkela
+ * (c) 2024 Jukka Kurkela
  * Released under the MIT License
  */
 

public/build/entrypoints.json

@@ -2,25 +2,25 @@
   "entrypoints": {
     "app": {
       "js": [
-        "/build/runtime.6c399d29.js",
-        "/build/app.9662939e.js"
+        "/build/runtime.684e9f6d.js",
+        "/build/app.41748d55.js"
       ],
       "css": [
-        "/build/app.c18ba3c6.css"
+        "/build/app.6bfb9c66.css"
       ]
     },
     "app-rtl": {
       "js": [
-        "/build/runtime.6c399d29.js",
+        "/build/runtime.684e9f6d.js",
         "/build/app-rtl.15853b82.js"
       ],
       "css": [
-        "/build/app-rtl.2003dce5.css"
+        "/build/app-rtl.16271884.css"
       ]
     },
     "export-pdf": {
       "js": [
-        "/build/runtime.6c399d29.js",
+        "/build/runtime.684e9f6d.js",
         "/build/export-pdf.395749ab.js"
       ],
       "css": [
@@ -29,7 +29,7 @@
     },
     "invoice": {
       "js": [
-        "/build/runtime.6c399d29.js",
+        "/build/runtime.684e9f6d.js",
         "/build/invoice.42b319e4.js"
       ],
       "css": [
@@ -38,7 +38,7 @@
     },
     "invoice-pdf": {
       "js": [
-        "/build/runtime.6c399d29.js",
+        "/build/runtime.684e9f6d.js",
         "/build/invoice-pdf.26d98626.js"
       ],
       "css": [
@@ -47,14 +47,14 @@
     },
     "chart": {
       "js": [
-        "/build/runtime.6c399d29.js",
-        "/build/chart.bafa38e7.js"
+        "/build/runtime.684e9f6d.js",
+        "/build/chart.56f16a68.js"
       ]
     },
     "calendar": {
       "js": [
-        "/build/runtime.6c399d29.js",
-        "/build/calendar.b2d70caa.js"
+        "/build/runtime.684e9f6d.js",
+        "/build/calendar.36a92145.js"
       ],
       "css": [
         "/build/calendar.d757753e.css"
@@ -62,8 +62,8 @@
     },
     "dashboard": {
       "js": [
-        "/build/runtime.6c399d29.js",
-        "/build/dashboard.6ce7ac9c.js"
+        "/build/runtime.684e9f6d.js",
+        "/build/dashboard.9708ae5e.js"
       ],
       "css": [
         "/build/dashboard.b7129fa1.css"
@@ -71,8 +71,8 @@
     },
     "highlight": {
       "js": [
-        "/build/runtime.6c399d29.js",
-        "/build/highlight.13d5d50e.js"
+        "/build/runtime.684e9f6d.js",
+        "/build/highlight.0296a734.js"
       ],
       "css": [
         "/build/highlight.98bf3927.css"
@@ -80,23 +80,23 @@
     }
   },
   "integrity": {
-    "/build/runtime.6c399d29.js": "sha384-/rm616f12czi8l/27GvWXtb3g608vJZf2XTUKxqCRI4tsa2vUHP+BW90edTok5zC",
-    "/build/app.9662939e.js": "sha384-bRL78SVI1wjTweqKeb+ZSSbA78i6By89S8/xx+55zmbOVtF1TCu3lf3pvdki5ZVJ",
-    "/build/app.c18ba3c6.css": "sha384-qkIgqLzngG2NchdFVImbGMU49lWlZg6Y9D0z2P0u1j2NQstDicA4KqIkkNYcpErm",
+    "/build/runtime.684e9f6d.js": "sha384-suKiEX2de4fdNqQzdYbUd6osp4AepD9FiMXl+1QdvgMW9dcQqUWQNQasf3KWzwLr",
+    "/build/app.41748d55.js": "sha384-iVPHnOXYjVDuq8567h8I3U2gl5SCV3mNMFNQCJdgMiNuFMZ4KO7PXOLanjgcGzTt",
+    "/build/app.6bfb9c66.css": "sha384-38+zSolYBrZdSwNcrDi5qCaQGCQlBJRKwtsJV+pnrf8rCCpf6z/M7fEpV4tS79Sz",
     "/build/app-rtl.15853b82.js": "sha384-UnKKgLMu9FnRT+CFE0no/+UiUks012bYriQdUWa6f02mo6Lswl947mPybjvKL503",
-    "/build/app-rtl.2003dce5.css": "sha384-pl8GyGo8sRRw1zLh9D42ZAvo450onfxeszZWocUUuzq70jAOwOlaoPYh/yyc20U7",
+    "/build/app-rtl.16271884.css": "sha384-P1x4vYfjfM4JL55NQ3sfLiy+BSy8cM4bNcshj9M62nMJ4JD2xAWUioNv6VrmaK7U",
     "/build/export-pdf.395749ab.js": "sha384-3Hjvmu4FC/0dhHnR8kyRBU7k2xMNy1lxBpGgOkrw8PxXnwyQDM8/5bQmkJbjVT1+",
     "/build/export-pdf.d8a6c23b.css": "sha384-ztepocHE4rnGE9eKZ4kL6jTKaePUyiwiB9TjJjstjpf/ckcKg1HedrEOOk/8ElJg",
     "/build/invoice.42b319e4.js": "sha384-xxK7sCe/ZhTjMPFPeX1xvILURxNRZz2hJHZxAGVaw9zE6TC++2/6y2eKqg8cz852",
     "/build/invoice.36018785.css": "sha384-jukM9uZ6pexDxXKgZThSxiqXimzsxzniBMHz08N9x8ryXZYkM5r/ZgaainCV0+J6",
     "/build/invoice-pdf.26d98626.js": "sha384-gwNzQiU1y6qU/M9DPGiNW0MVZkLctEHk37sCES2X9ov+zugEaDABdkMjKBYOC9lz",
     "/build/invoice-pdf.2b749265.css": "sha384-DXXgkz2WWnrWnfBnXX5fmfPQSPb98upMnWxYKwTGYS04EhrPIWfDCutB2unIrWh7",
-    "/build/chart.bafa38e7.js": "sha384-Ays2qGKvOqs4NSeN/zJOPcrnzIEC/uYSCIkC3kN0KQye+mA5Lq7UkfjZDjulvFUX",
-    "/build/calendar.b2d70caa.js": "sha384-FS7Q9iCWHpo2Nzk0tmNvnuTbxJKLdbXFba9F6WcXfHbKFAS2Q+lW29H9Mv+ap5kA",
+    "/build/chart.56f16a68.js": "sha384-SWnYjAbZ8OWEvTP+IZfGuBMWJIcH9OZWLYQ4p38KMPmqfufsc2zhzqWkALO3mCBO",
+    "/build/calendar.36a92145.js": "sha384-ZPLxxbep6OnPeUiIeBXRE1iscZFgbNuTpn3rx2Jpf1KR2l6sxIuNsieDUskbmQ3m",
     "/build/calendar.d757753e.css": "sha384-cTmQMgHYjd2gfObFWmEUph7qQLCyXaIkneSf+bQ2mqVmZwqOB+pJOm/UYTyTjALJ",
-    "/build/dashboard.6ce7ac9c.js": "sha384-5BOoyjZx/ZKr9IbogWfT/aBRHx7XA1fePADdUpUNlSF/rqVo3taXLLcrIoaDZ+8b",
+    "/build/dashboard.9708ae5e.js": "sha384-QN7XIQuxFZu76sHVrgdpZL81+Q2VTwcgF3aI2CnpwYZiMoPbzrcTGfPL3RDy696t",
     "/build/dashboard.b7129fa1.css": "sha384-2nn5hLA+3YedgHYBpge62S8Losj8aoPwK9Zk9EvN1xEYatvOUQ7H3rIR2UUJAGOS",
-    "/build/highlight.13d5d50e.js": "sha384-+RqBBPIzp5YQpbBeHgVNXzHiewK1PZtizPh4in1PlBU6RcT1bDleW3QSJMDeBnPO",
+    "/build/highlight.0296a734.js": "sha384-vGFKI/KM+uyGIlzKsKhQh4w41hQteB4u14oRYqObMT03/YTZXq6Re5nUN6g3sGQH",
     "/build/highlight.98bf3927.css": "sha384-YgweSwDwN0dI4DEmh478xYVw/TewJYvCO1QTbWHpaHFDPuLrZvYMR0Tc+QfFxVPE"
   }
 }

public/build/manifest.json

@@ -1,7 +1,7 @@
 {
-  "build/app.css": "/build/app.c18ba3c6.css",
-  "build/app.js": "/build/app.9662939e.js",
-  "build/app-rtl.css": "/build/app-rtl.2003dce5.css",
+  "build/app.css": "/build/app.6bfb9c66.css",
+  "build/app.js": "/build/app.41748d55.js",
+  "build/app-rtl.css": "/build/app-rtl.16271884.css",
   "build/app-rtl.js": "/build/app-rtl.15853b82.js",
   "build/export-pdf.css": "/build/export-pdf.d8a6c23b.css",
   "build/export-pdf.js": "/build/export-pdf.395749ab.js",
@@ -9,14 +9,14 @@
   "build/invoice.js": "/build/invoice.42b319e4.js",
   "build/invoice-pdf.css": "/build/invoice-pdf.2b749265.css",
   "build/invoice-pdf.js": "/build/invoice-pdf.26d98626.js",
-  "build/chart.js": "/build/chart.bafa38e7.js",
+  "build/chart.js": "/build/chart.56f16a68.js",
   "build/calendar.css": "/build/calendar.d757753e.css",
-  "build/calendar.js": "/build/calendar.b2d70caa.js",
+  "build/calendar.js": "/build/calendar.36a92145.js",
   "build/dashboard.css": "/build/dashboard.b7129fa1.css",
-  "build/dashboard.js": "/build/dashboard.6ce7ac9c.js",
+  "build/dashboard.js": "/build/dashboard.9708ae5e.js",
   "build/highlight.css": "/build/highlight.98bf3927.css",
-  "build/highlight.js": "/build/highlight.13d5d50e.js",
-  "build/runtime.js": "/build/runtime.6c399d29.js",
+  "build/highlight.js": "/build/highlight.0296a734.js",
+  "build/runtime.js": "/build/runtime.684e9f6d.js",
   "build/fonts/fa-solid-900.ttf": "/build/fonts/fa-solid-900.2582b0e4.ttf",
   "build/fonts/fa-brands-400.ttf": "/build/fonts/fa-brands-400.1815e004.ttf",
   "build/fonts/fa-solid-900.woff2": "/build/fonts/fa-solid-900.2463b90d.woff2",

public/build/runtime.684e9f6d.js

@@ -0,0 +1 @@
+!function(){"use strict";var e,r={},n={};function t(e){var o=n[e];if(void 0!==o)return o.exports;var i=n[e]={id:e,loaded:!1,exports:{}};return r[e].call(i.exports,i,i.exports,t),i.loaded=!0,i.exports}t.m=r,t.amdO={},e=[],t.O=function(r,n,o,i){if(!n){var u=1/0;for(l=0;l<e.length;l++){n=e[l][0],o=e[l][1],i=e[l][2];for(var f=!0,a=0;a<n.length;a++)(!1&i||u>=i)&&Object.keys(t.O).every(function(e){return t.O[e](n[a])})?n.splice(a--,1):(f=!1,i<u&&(u=i));if(f){e.splice(l--,1);var c=o();void 0!==c&&(r=c)}}return r}i=i||0;for(var l=e.length;l>0&&e[l-1][2]>i;l--)e[l]=e[l-1];e[l]=[n,o,i]},t.n=function(e){var r=e&&e.__esModule?function(){return e.default}:function(){return e};return t.d(r,{a:r}),r},t.d=function(e,r){for(var n in r)t.o(r,n)&&!t.o(e,n)&&Object.defineProperty(e,n,{enumerable:!0,get:r[n]})},t.g=function(){if("object"==typeof globalThis)return globalThis;try{return this||new Function("return this")()}catch(e){if("object"==typeof window)return window}}(),t.hmd=function(e){return(e=Object.create(e)).children||(e.children=[]),Object.defineProperty(e,"exports",{enumerable:!0,set:function(){throw new Error("ES Modules may not assign module.exports or exports.*, Use ESM export syntax, instead: "+e.id)}}),e},t.o=function(e,r){return Object.prototype.hasOwnProperty.call(e,r)},t.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},function(){var e={121:0};t.O.j=function(r){return 0===e[r]};var r=function(r,n){var o,i,u=n[0],f=n[1],a=n[2],c=0;if(u.some(function(r){return 0!==e[r]})){for(o in f)t.o(f,o)&&(t.m[o]=f[o]);if(a)var l=a(t)}for(r&&r(n);c<u.length;c++)i=u[c],t.o(e,i)&&e[i]&&e[i][0](),e[i]=0;return t.O(l)},n=self.webpackChunkkimai=self.webpackChunkkimai||[];n.forEach(r.bind(null,0)),n.push=r.bind(null,n.push.bind(n))}()}();

public/build/runtime.6c399d29.js

@@ -1 +0,0 @@
-!function(){"use strict";var e,r={},n={};function t(e){var o=n[e];if(void 0!==o)return o.exports;var i=n[e]={id:e,loaded:!1,exports:{}};return r[e].call(i.exports,i,i.exports,t),i.loaded=!0,i.exports}t.m=r,t.amdO={},e=[],t.O=function(r,n,o,i){if(!n){var u=1/0;for(l=0;l<e.length;l++){n=e[l][0],o=e[l][1],i=e[l][2];for(var f=!0,a=0;a<n.length;a++)(!1&i||u>=i)&&Object.keys(t.O).every((function(e){return t.O[e](n[a])}))?n.splice(a--,1):(f=!1,i<u&&(u=i));if(f){e.splice(l--,1);var c=o();void 0!==c&&(r=c)}}return r}i=i||0;for(var l=e.length;l>0&&e[l-1][2]>i;l--)e[l]=e[l-1];e[l]=[n,o,i]},t.n=function(e){var r=e&&e.__esModule?function(){return e.default}:function(){return e};return t.d(r,{a:r}),r},t.d=function(e,r){for(var n in r)t.o(r,n)&&!t.o(e,n)&&Object.defineProperty(e,n,{enumerable:!0,get:r[n]})},t.g=function(){if("object"==typeof globalThis)return globalThis;try{return this||new Function("return this")()}catch(e){if("object"==typeof window)return window}}(),t.hmd=function(e){return(e=Object.create(e)).children||(e.children=[]),Object.defineProperty(e,"exports",{enumerable:!0,set:function(){throw new Error("ES Modules may not assign module.exports or exports.*, Use ESM export syntax, instead: "+e.id)}}),e},t.o=function(e,r){return Object.prototype.hasOwnProperty.call(e,r)},t.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},function(){var e={121:0};t.O.j=function(r){return 0===e[r]};var r=function(r,n){var o,i,u=n[0],f=n[1],a=n[2],c=0;if(u.some((function(r){return 0!==e[r]}))){for(o in f)t.o(f,o)&&(t.m[o]=f[o]);if(a)var l=a(t)}for(r&&r(n);c<u.length;c++)i=u[c],t.o(e,i)&&e[i]&&e[i][0](),e[i]=0;return t.O(l)},n=self.webpackChunkkimai=self.webpackChunkkimai||[];n.forEach(r.bind(null,0)),n.push=r.bind(null,n.push.bind(n))}()}();

public/manifest.json

@@ -25,7 +25,7 @@
   ],
   "scope": "./",
   "start_url": "./",
-  "theme-color": "#1d273b",
+  "theme-color": "#262626",
   "background_color": "#ffffff",
   "display": "standalone"
 }

src/API/InvoiceController.php

@@ -43,8 +43,8 @@ final class InvoiceController extends BaseApiController
     #[IsGranted('view_invoice')]
     #[OA\Response(response: 200, description: 'Returns a collection of invoices', content: new OA\JsonContent(type: 'array', items: new OA\Items(ref: '#/components/schemas/InvoiceCollection')))]
     #[Route(methods: ['GET'], path: '', name: 'get_invoices')]
-    #[Rest\QueryParam(name: 'begin', requirements: [new Constraints\DateTime(format: 'Y-m-d\TH:i:s')], strict: true, nullable: true, description: 'Only records after this date will be included (format: HTML5 datetime-local, e.g. YYYY-MM-DDThh:mm:ss)')]
-    #[Rest\QueryParam(name: 'end', requirements: [new Constraints\DateTime(format: 'Y-m-d\TH:i:s')], strict: true, nullable: true, description: 'Only records before this date will be included (format: HTML5 datetime-local, e.g. YYYY-MM-DDThh:mm:ss)')]
+    #[Rest\QueryParam(name: 'begin', requirements: [new Constraints\DateTime(format: 'Y-m-d\TH:i:s')], strict: true, nullable: true, description: 'Only invoices created at or after this date-time will be included (format: HTML5 datetime-local, e.g. YYYY-MM-DDThh:mm:ss)')]
+    #[Rest\QueryParam(name: 'end', requirements: [new Constraints\DateTime(format: 'Y-m-d\TH:i:s')], strict: true, nullable: true, description: 'Only invoices created before or at this date-time will be included (format: HTML5 datetime-local, e.g. YYYY-MM-DDThh:mm:ss)')]
     #[Rest\QueryParam(name: 'customers', map: true, requirements: '\d+', strict: true, nullable: true, default: [], description: 'List of customer IDs to filter, e.g.: customers[]=1&customers[]=2')]
     #[Rest\QueryParam(name: 'status', map: true, requirements: 'pending|paid|canceled|new', strict: true, nullable: true, default: [], description: 'Invoice status: pending, paid, canceled, new. Default: all')]
     #[Rest\QueryParam(name: 'page', requirements: '\d+', strict: true, nullable: true, description: 'The page to display, renders a 404 if not found (default: 1)')]

src/API/TimesheetController.php

@@ -86,8 +86,8 @@ final class TimesheetController extends BaseApiController
     #[Rest\QueryParam(name: 'tags', map: true, strict: true, nullable: true, default: [], description: 'List of tag names, e.g. tags[]=bar&tags[]=foo')]
     #[Rest\QueryParam(name: 'orderBy', requirements: 'id|begin|end|rate', strict: true, nullable: true, description: 'The field by which results will be ordered. Allowed values: id, begin, end, rate (default: begin)')]
     #[Rest\QueryParam(name: 'order', requirements: 'ASC|DESC', strict: true, nullable: true, description: 'The result order. Allowed values: ASC, DESC (default: DESC)')]
-    #[Rest\QueryParam(name: 'begin', requirements: [new Constraints\DateTime(format: 'Y-m-d\TH:i:s')], strict: true, nullable: true, description: 'Only records after this date will be included (format: HTML5 datetime-local, e.g. YYYY-MM-DDThh:mm:ss)')]
-    #[Rest\QueryParam(name: 'end', requirements: [new Constraints\DateTime(format: 'Y-m-d\TH:i:s')], strict: true, nullable: true, description: 'Only records before this date will be included (format: HTML5 datetime-local, e.g. YYYY-MM-DDThh:mm:ss)')]
+    #[Rest\QueryParam(name: 'begin', requirements: [new Constraints\DateTime(format: 'Y-m-d\TH:i:s')], strict: true, nullable: true, description: 'Only records started at or after this date-time will be included (format: HTML5 datetime-local, e.g. YYYY-MM-DDThh:mm:ss)')]
+    #[Rest\QueryParam(name: 'end', requirements: [new Constraints\DateTime(format: 'Y-m-d\TH:i:s')], strict: true, nullable: true, description: 'Only records started at or before this date-time will be included (format: HTML5 datetime-local, e.g. YYYY-MM-DDThh:mm:ss)')]
     #[Rest\QueryParam(name: 'exported', requirements: '0|1', strict: true, nullable: true, description: 'Use this flag if you want to filter for export state. Allowed values: 0=not exported, 1=exported (default: all)')]
     #[Rest\QueryParam(name: 'active', requirements: '0|1', strict: true, nullable: true, description: 'Filter for running/active records. Allowed values: 0=stopped, 1=active (default: all)')]
     #[Rest\QueryParam(name: 'billable', requirements: '0|1', strict: true, nullable: true, description: 'Filter for non-/billable records. Allowed values: 0=non-billable, 1=billable (default: all)')]
@@ -380,7 +380,7 @@ final class TimesheetController extends BaseApiController
     #[IsGranted('view_own_timesheet')]
     #[OA\Response(response: 200, description: 'Returns a collection of recent user activities (always the latest entry of a unique working set grouped by customer, project and activity)', content: new OA\JsonContent(type: 'array', items: new OA\Items(ref: '#/components/schemas/TimesheetCollectionExpanded')))]
     #[Route(methods: ['GET'], path: '/recent', name: 'recent_timesheet')]
-    #[Rest\QueryParam(name: 'begin', requirements: [new Constraints\DateTime(format: 'Y-m-d\TH:i:s')], strict: true, nullable: true, description: 'Only records after this date will be included. Default: today - 1 year (format: HTML5 datetime-local, e.g. YYYY-MM-DDThh:mm:ss)')]
+    #[Rest\QueryParam(name: 'begin', requirements: [new Constraints\DateTime(format: 'Y-m-d\TH:i:s')], strict: true, nullable: true, description: 'Only records started at or after this date will be included. Default: today - 1 year (format: HTML5 datetime-local, e.g. YYYY-MM-DDThh:mm:ss)')]
     #[Rest\QueryParam(name: 'size', requirements: '\d+', strict: true, nullable: true, description: 'The amount of entries (default: 10)')]
     public function recentAction(ParamFetcherInterface $paramFetcher): Response
     {

src/Command/TranslationCommand.php

@@ -47,6 +47,8 @@ final class TranslationCommand extends Command
             ->addOption('fill-empty', null, InputOption::VALUE_NONE, 'Pre-fills empty translations with the english version')
             ->addOption('delete-empty', null, InputOption::VALUE_NONE, 'Delete all empty keys and files which have no translated key at all')
             ->addOption('move-resname', null, InputOption::VALUE_REQUIRED, 'Move a resname from one file to another (needs "source" and "target" options)')
+            ->addOption('copy-resname', null, InputOption::VALUE_REQUIRED, 'Copy a resname within one file (needs "source" option)')
+            ->addOption('target-resname', null, InputOption::VALUE_REQUIRED, 'Target resname when copying (needs "source" option)')
             ->addOption('move-all', null, InputOption::VALUE_NONE, 'Move all keys from one file to another (needs "source" and "target" options)')
             ->addOption('source', null, InputOption::VALUE_REQUIRED, 'Single source file to use')
             ->addOption('only-core', null, InputOption::VALUE_NONE, 'Do not include plugin and theme directories')
@@ -150,6 +152,21 @@ final class TranslationCommand extends Command
             return $this->moveResname($io, $moveResname, $sources, $targets);
         }
 
+        // ==========================================================================
+        // Move resname from source to target
+        // ==========================================================================
+        $copyResname = $input->getOption('copy-resname');
+        $targetResname = $input->getOption('target-resname');
+        if (\is_string($copyResname)) {
+            if (!\is_string($targetResname)) {
+                $io->error('To copy a resname, we need a target-resname');
+
+                return Command::FAILURE;
+            }
+
+            return $this->copyResname($io, $copyResname, $targetResname, $sources);
+        }
+
         // ==========================================================================
         // Move all keys from source to target
         // ==========================================================================
@@ -491,7 +508,7 @@ final class TranslationCommand extends Command
                     \sprintf('Missing english translation for key: %s in file %s', $key, $file)
                 );
             }
-            $unit->target[0] = $translations[$key];
+            $unit->target[0] = $translations[$key]; // @phpstan-ignore-line
             $unit->target['state'] = 'needs-translation';
             $foundEmpty = true;
         }
@@ -654,6 +671,62 @@ final class TranslationCommand extends Command
         return Command::SUCCESS;
     }
 
+    /**
+     * @param array<string> $sources
+     */
+    private function copyResname(SymfonyStyle $io, string $resname, string $target, array $sources): int
+    {
+        foreach ($sources as $source) {
+            $tmp = basename($source);
+            $pos = strpos($tmp, '.');
+            if ($pos === false) {
+                $io->error('Unexpected filename: ' . $source);
+
+                return Command::FAILURE;
+            }
+
+            $sourceDocument = new \DOMDocument('1.0');
+            $sourceDocument->load($source);
+
+            $copiedNode = false;
+
+            /** @var \DOMElement $element */
+            foreach ($sourceDocument->getElementsByTagName('trans-unit') as $element) {
+                if (!$element->hasAttribute('resname')) {
+                    continue;
+                }
+
+                $key = $element->getAttribute('resname');
+
+                if ($key === $resname) {
+                    $newElement = clone $element;
+                    $newElement->setAttribute('resname', $target);
+                    foreach ($newElement->childNodes->getIterator() as $child) {
+                        if ($child->nodeName === 'source') {
+                            $child->textContent = $target;
+                        }
+                    }
+                    $newElement->setAttribute('id', $this->generateId($target));
+
+                    $newNode = $sourceDocument->importNode($newElement, true);
+                    $sourceDocument->documentElement->firstElementChild->firstElementChild->appendChild($newNode); // @phpstan-ignore-line
+                    $copiedNode = true;
+                    break;
+                }
+            }
+
+            if ($copiedNode) {
+                $xmlDocument = new \DOMDocument('1.0');
+                $xmlDocument->preserveWhiteSpace = false;
+                $xmlDocument->formatOutput = true;
+                $xmlDocument->loadXML($sourceDocument->saveXML()); // @phpstan-ignore-line
+                file_put_contents($source, $xmlDocument->saveXML());
+            }
+        }
+
+        return Command::SUCCESS;
+    }
+
     /**
      * @param array<string> $sources
      * @param array<string> $targets

src/Constants.php

@@ -17,11 +17,11 @@ final class Constants
     /**
      * The current release version
      */
-    public const VERSION = '2.45.0';
+    public const VERSION = '2.49.0';
     /**
      * The current release: major * 10000 + minor * 100 + patch
      */
-    public const VERSION_ID = 24500;
+    public const VERSION_ID = 24900;
     /**
      * The software name
      */

src/Controller/CustomerController.php

@@ -90,7 +90,7 @@ final class CustomerController extends AbstractController
         $table->addColumn('company', ['class' => 'd-none']);
         $table->addColumn('vat_id', ['class' => 'd-none w-min']);
         $table->addColumn('contact', ['class' => 'd-none']);
-        $table->addColumn('address', ['class' => 'd-none']);
+        $table->addColumn('city', ['class' => 'd-none']);
         $table->addColumn('country', ['class' => 'd-none w-min']);
         $table->addColumn('currency', ['class' => 'd-none w-min']);
         $table->addColumn('phone', ['class' => 'd-none']);

src/Controller/DoctorController.php

@@ -108,10 +108,30 @@ final class DoctorController extends AbstractController
             'logLines' => $logLines,
             'logSize' => $this->getLogSize(),
             'composer' => $this->getComposerPackages(),
-            'release' => $latestRelease
+            'release' => $latestRelease,
+            'opcache' => $this->getOpcacheConfiguration()
         ]);
     }
 
+    /**
+     * @return array{enabled: bool, status: false|array<mixed>}
+     */
+    private function getOpcacheConfiguration(): array
+    {
+        $status = \function_exists('opcache_get_status') ? opcache_get_status() : false;
+
+        $enabled = \is_array($status) && $status['opcache_enabled'];
+
+        if ($enabled && \array_key_exists('scripts', $status)) {
+            unset($status['scripts']);
+        }
+
+        return [
+            'enabled' => $enabled,
+            'status' => $status,
+        ];
+    }
+
     /**
      * @return array<string, string>
      */
@@ -264,7 +284,12 @@ final class DoctorController extends AbstractController
             'sys_temp_dir',
             'date.timezone',
             'session.gc_maxlifetime',
-            'disable_functions'
+            'disable_functions',
+            'opcache.enable',
+            'opcache.memory_consumption',
+            'opcache.interned_strings_buffer',
+            'opcache.max_accelerated_files',
+            'opcache.validate_timestamps',
         ];
 
         $settings = [];

src/Controller/InvoiceController.php

@@ -61,18 +61,15 @@ use Twig\Environment;
 final class InvoiceController extends AbstractController
 {
     public function __construct(
-        private readonly ServiceInvoice $service,
-        private readonly InvoiceTemplateRepository $templateRepository,
-        private readonly InvoiceRepository $invoiceRepository,
         private readonly EventDispatcherInterface $dispatcher
     ) {
     }
 
     #[Route(path: '/', name: 'invoice', methods: ['GET', 'POST'])]
     #[IsGranted('create_invoice')]
-    public function indexAction(Request $request, CsrfTokenManagerInterface $csrfTokenManager): Response
+    public function indexAction(Request $request, ServiceInvoice $service, InvoiceTemplateRepository $templateRepository): Response
     {
-        if (!$this->templateRepository->hasTemplate()) {
+        if (!$templateRepository->hasTemplate()) {
             if ($this->isGranted('manage_invoice_template')) {
                 return $this->redirectToRoute('admin_invoice_template_create');
             }
@@ -95,7 +92,7 @@ final class InvoiceController extends AbstractController
 
         if ($form->isValid() && $query->getTemplate() !== null) {
             try {
-                $models = $this->service->createModels($query);
+                $models = $service->createModels($query);
                 $searched = true;
             } catch (Exception $ex) {
                 $this->flashUpdateException($ex);
@@ -139,12 +136,8 @@ final class InvoiceController extends AbstractController
     #[Route(path: '/preview/{customer}/{token}', name: 'invoice_preview', methods: ['GET'])]
     #[IsGranted('create_invoice')]
     #[IsGranted('access', 'customer')]
-    public function previewAction(Customer $customer, string $token, Request $request): Response
+    public function previewAction(Customer $customer, string $token, Request $request, ServiceInvoice $service): Response
     {
-        if (!$this->templateRepository->hasTemplate()) {
-            return $this->redirectToRoute('invoice');
-        }
-
         if (!$this->isCsrfTokenValid('invoice.preview', $token)) {
             $this->flashError('action.csrf.error');
 
@@ -164,10 +157,10 @@ final class InvoiceController extends AbstractController
         if ($form->isValid()) {
             try {
                 $query->setCustomers([$customer]);
-                $model = $this->service->createModel($query);
+                $model = $service->createModel($query);
                 $model->setPreview(true);
 
-                return $this->service->renderInvoice($model, $this->dispatcher, true);
+                return $service->renderInvoice($model, $this->dispatcher, true);
             } catch (Exception $ex) {
                 $this->flashUpdateException($ex);
             }
@@ -181,12 +174,8 @@ final class InvoiceController extends AbstractController
     #[Route(path: '/save-invoice/{customer}/{token}', name: 'invoice_create', methods: ['GET'])]
     #[IsGranted('create_invoice')]
     #[IsGranted('access', 'customer')]
-    public function createInvoiceAction(Customer $customer, string $token, Request $request, CustomerRepository $customerRepository): Response
+    public function createInvoiceAction(Customer $customer, string $token, Request $request, CustomerRepository $customerRepository, ServiceInvoice $service): Response
     {
-        if (!$this->templateRepository->hasTemplate()) {
-            return $this->redirectToRoute('invoice');
-        }
-
         if (!$this->isCsrfTokenValid('invoice.create', $token)) {
             $this->flashError('action.csrf.error');
 
@@ -203,7 +192,7 @@ final class InvoiceController extends AbstractController
         if ($form->isValid()) {
             try {
                 $query->setCustomers([$customer]);
-                $model = $this->service->createModel($query);
+                $model = $service->createModel($query);
 
                 // save default template for customer if not yet set
                 if ($customer->getInvoiceTemplate() === null) {
@@ -211,7 +200,7 @@ final class InvoiceController extends AbstractController
                     $customerRepository->saveCustomer($customer);
                 }
 
-                $invoice = $this->service->createInvoice($model, $this->dispatcher);
+                $invoice = $service->createInvoice($model, $this->dispatcher);
 
                 $this->flashSuccess('action.update.success');
 
@@ -229,7 +218,7 @@ final class InvoiceController extends AbstractController
     #[Route(path: '/change-status/{id}/{status}/{token}', name: 'admin_invoice_status', methods: ['GET', 'POST'])]
     #[IsGranted('create_invoice')]
     #[IsGranted(new Expression("is_granted('access', subject.getCustomer())"), 'invoice')]
-    public function changeStatusAction(Invoice $invoice, string $status, string $token, Request $request, CsrfTokenManagerInterface $csrfTokenManager): Response
+    public function changeStatusAction(Invoice $invoice, string $status, string $token, Request $request, CsrfTokenManagerInterface $csrfTokenManager, ServiceInvoice $service): Response
     {
         if (!$csrfTokenManager->isTokenValid(new CsrfToken('invoice.status', $token))) {
             $this->flashError('action.csrf.error');
@@ -254,7 +243,7 @@ final class InvoiceController extends AbstractController
         }
 
         try {
-            $this->service->changeInvoiceStatus($invoice, $status);
+            $service->changeInvoiceStatus($invoice, $status);
             $this->flashSuccess('action.update.success');
         } catch (Exception $ex) {
             $this->flashUpdateException($ex);
@@ -266,14 +255,14 @@ final class InvoiceController extends AbstractController
     #[Route(path: '/edit/{id}', name: 'admin_invoice_edit', methods: ['GET', 'POST'])]
     #[IsGranted('create_invoice')]
     #[IsGranted(new Expression("is_granted('access', subject.getCustomer())"), 'invoice')]
-    public function editAction(Invoice $invoice, Request $request): Response
+    public function editAction(Invoice $invoice, Request $request, InvoiceRepository $invoiceRepository): Response
     {
         $form = $this->createInvoiceEditForm($invoice);
         $form->handleRequest($request);
 
         if ($form->isSubmitted() && $form->isValid()) {
             try {
-                $this->invoiceRepository->saveInvoice($invoice);
+                $invoiceRepository->saveInvoice($invoice);
                 $this->flashSuccess('action.update.success');
 
                 return $this->redirectToRoute('admin_invoice_list');
@@ -292,7 +281,7 @@ final class InvoiceController extends AbstractController
     #[Route(path: '/delete/{id}/{token}', name: 'admin_invoice_delete', methods: ['GET'])]
     #[IsGranted('delete_invoice')]
     #[IsGranted(new Expression("is_granted('access', subject.getCustomer())"), 'invoice')]
-    public function deleteInvoiceAction(Invoice $invoice, string $token, CsrfTokenManagerInterface $csrfTokenManager): Response
+    public function deleteInvoiceAction(Invoice $invoice, string $token, CsrfTokenManagerInterface $csrfTokenManager, ServiceInvoice $service): Response
     {
         if (!$csrfTokenManager->isTokenValid(new CsrfToken('invoice.status', $token))) {
             $this->flashError('action.csrf.error');
@@ -303,7 +292,7 @@ final class InvoiceController extends AbstractController
         $csrfTokenManager->refreshToken('invoice.status');
 
         try {
-            $this->service->deleteInvoice($invoice, $this->dispatcher);
+            $service->deleteInvoice($invoice, $this->dispatcher);
             $this->flashSuccess('action.delete.success');
         } catch (Exception $ex) {
             $this->flashDeleteException($ex);
@@ -315,9 +304,9 @@ final class InvoiceController extends AbstractController
     #[Route(path: '/download/{id}', name: 'admin_invoice_download', methods: ['GET'])]
     #[IsGranted('view_invoice')]
     #[IsGranted(new Expression("is_granted('access', subject.getCustomer())"), 'invoice')]
-    public function downloadAction(Invoice $invoice): Response
+    public function downloadAction(Invoice $invoice, ServiceInvoice $service): Response
     {
-        $file = $this->service->getInvoiceFile($invoice);
+        $file = $service->getInvoiceFile($invoice);
 
         if (null === $file) {
             throw $this->createNotFoundException(
@@ -330,12 +319,12 @@ final class InvoiceController extends AbstractController
 
     #[Route(path: '/show/{page}', defaults: ['page' => 1], requirements: ['page' => '[1-9]\d*'], name: 'admin_invoice_list', methods: ['GET'])]
     #[IsGranted('view_invoice')]
-    public function showInvoicesAction(Request $request, int $page): Response
+    public function showInvoicesAction(Request $request, int $page, InvoiceRepository $invoiceRepository): Response
     {
         $invoice = null;
 
         if (null !== ($id = $request->query->get('id'))) {
-            $invoice = $this->invoiceRepository->find($id);
+            $invoice = $invoiceRepository->find($id);
         }
 
         $query = new InvoiceArchiveQuery();
@@ -347,7 +336,7 @@ final class InvoiceController extends AbstractController
             return $this->redirectToRoute('admin_invoice_list');
         }
 
-        $entries = $this->invoiceRepository->getPagerfantaForQuery($query);
+        $entries = $invoiceRepository->getPagerfantaForQuery($query);
         $metaColumns = $this->findMetaColumns($query);
 
         $table = new DataTable('invoices', $query);
@@ -389,7 +378,7 @@ final class InvoiceController extends AbstractController
 
     #[Route(path: '/export', name: 'invoice_export', methods: ['GET'])]
     #[IsGranted('view_invoice')]
-    public function exportAction(Request $request, EntityWithMetaFieldsExporter $exporter): Response
+    public function exportAction(Request $request, EntityWithMetaFieldsExporter $exporter, InvoiceRepository $invoiceRepository, InvoiceTemplateRepository $templateRepository): Response
     {
         $query = new InvoiceArchiveQuery();
         $query->setCurrentUser($this->getUser());
@@ -398,7 +387,7 @@ final class InvoiceController extends AbstractController
         $form->setData($query);
         $form->submit($request->query->all(), false);
 
-        $entries = $this->invoiceRepository->getInvoicesForQuery($query);
+        $entries = $invoiceRepository->getInvoicesForQuery($query);
 
         $spreadsheet = $exporter->export(
             Invoice::class,
@@ -412,12 +401,12 @@ final class InvoiceController extends AbstractController
 
     #[Route(path: '/template/{page}', requirements: ['page' => '[1-9]\d*'], defaults: ['page' => 1], name: 'admin_invoice_template', methods: ['GET', 'POST'])]
     #[IsGranted('manage_invoice_template')]
-    public function listTemplateAction(int $page): Response
+    public function listTemplateAction(int $page, InvoiceTemplateRepository $templateRepository): Response
     {
         $query = new BaseQuery();
         $query->setPage($page);
 
-        $entries = $this->templateRepository->getPagerfantaForQuery($query);
+        $entries = $templateRepository->getPagerfantaForQuery($query);
 
         $table = new DataTable('invoice_template', $query);
         $table->setPagination($entries);
@@ -449,16 +438,16 @@ final class InvoiceController extends AbstractController
 
     #[Route(path: '/template/{id}/edit', name: 'admin_invoice_template_edit', methods: ['GET', 'POST'])]
     #[IsGranted('manage_invoice_template')]
-    public function editTemplateAction(InvoiceTemplate $template, Request $request): Response
+    public function editTemplateAction(InvoiceTemplate $template, Request $request, InvoiceTemplateRepository $templateRepository): Response
     {
-        return $this->renderTemplateForm($template, $request);
+        return $this->renderTemplateForm($template, $request, $templateRepository);
     }
 
     #[Route(path: '/document_download/{document}', name: 'admin_invoice_document_download', methods: ['GET'])]
     #[IsGranted('upload_invoice_template')]
-    public function downloadDocument(string $document, Environment $twig): Response
+    public function downloadDocument(string $document, ServiceInvoice $service): Response
     {
-        $event = new InvoiceDocumentsEvent($this->service->getDocuments(true));
+        $event = new InvoiceDocumentsEvent($service->getDocuments(true));
         $this->dispatcher->dispatch($event);
 
         foreach ($event->getInvoiceDocuments() as $doc) {
@@ -472,7 +461,7 @@ final class InvoiceController extends AbstractController
 
     #[Route(path: '/document_upload', name: 'admin_invoice_document_upload', methods: ['GET', 'POST'])]
     #[IsGranted('upload_invoice_template')]
-    public function uploadDocumentAction(Request $request, string $projectDirectory, InvoiceDocumentRepository $documentRepository, Environment $twig, SystemConfiguration $systemConfiguration): Response
+    public function uploadDocumentAction(Request $request, string $projectDirectory, InvoiceDocumentRepository $documentRepository, Environment $twig, SystemConfiguration $systemConfiguration, ServiceInvoice $service, InvoiceTemplateRepository $templateRepository): Response
     {
         $dir = $documentRepository->getUploadDirectory();
         $invoiceDir = $dir;
@@ -484,11 +473,11 @@ final class InvoiceController extends AbstractController
         $invoiceDir = rtrim($invoiceDir, DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR;
 
         $used = [];
-        foreach ($this->templateRepository->findAll() as $template) {
+        foreach ($templateRepository->findAll() as $template) {
             $used[$template->getRenderer()] = $template;
         }
 
-        $event = new InvoiceDocumentsEvent($this->service->getDocuments(true));
+        $event = new InvoiceDocumentsEvent($service->getDocuments(true));
         $this->dispatcher->dispatch($event);
 
         $documents = [];
@@ -606,7 +595,7 @@ final class InvoiceController extends AbstractController
 
     #[Route(path: '/document/{id}/delete/{token}', name: 'invoice_document_delete', methods: ['GET', 'POST'])]
     #[IsGranted('manage_invoice_template')]
-    public function deleteDocument(string $id, string $token, CsrfTokenManagerInterface $csrfTokenManager, InvoiceDocumentRepository $documentRepository): Response
+    public function deleteDocument(string $id, string $token, CsrfTokenManagerInterface $csrfTokenManager, InvoiceDocumentRepository $documentRepository, InvoiceTemplateRepository $templateRepository): Response
     {
         $document = $documentRepository->findByName($id);
         if ($document === null) {
@@ -629,7 +618,7 @@ final class InvoiceController extends AbstractController
             }
         }
 
-        foreach ($this->templateRepository->findAll() as $template) {
+        foreach ($templateRepository->findAll() as $template) {
             if ($template->getRenderer() === $id) {
                 $this->flashError('Document is used and cannot be deleted.');
 
@@ -649,19 +638,19 @@ final class InvoiceController extends AbstractController
 
     #[Route(path: '/template/create/{id}', name: 'admin_invoice_template_copy', methods: ['GET', 'POST'])]
     #[IsGranted('manage_invoice_template')]
-    public function copyTemplateAction(Request $request, InvoiceTemplate $copyFrom): Response
+    public function copyTemplateAction(Request $request, InvoiceTemplate $copyFrom, InvoiceTemplateRepository $templateRepository): Response
     {
-        return $this->createTemplate($request, $copyFrom);
+        return $this->createTemplate($request, $templateRepository, $copyFrom);
     }
 
     #[Route(path: '/template/create', name: 'admin_invoice_template_create', methods: ['GET', 'POST'])]
     #[IsGranted('manage_invoice_template')]
-    public function createTemplateAction(Request $request): Response
+    public function createTemplateAction(Request $request, InvoiceTemplateRepository $templateRepository): Response
     {
-        return $this->createTemplate($request, null);
+        return $this->createTemplate($request, $templateRepository, null);
     }
 
-    private function createTemplate(Request $request, ?InvoiceTemplate $copyFrom = null): Response
+    private function createTemplate(Request $request, InvoiceTemplateRepository $templateRepository, ?InvoiceTemplate $copyFrom = null): Response
     {
         $template = new InvoiceTemplate();
         $template->setLanguage($request->getLocale());
@@ -671,12 +660,12 @@ final class InvoiceController extends AbstractController
             $template->setName($copyFrom->getName() . ' (1)');
         }
 
-        return $this->renderTemplateForm($template, $request);
+        return $this->renderTemplateForm($template, $request, $templateRepository);
     }
 
     #[Route(path: '/template/{id}/delete/{csrfToken}', name: 'admin_invoice_template_delete', methods: ['GET', 'POST'])]
     #[IsGranted('manage_invoice_template')]
-    public function deleteTemplate(InvoiceTemplate $template, string $csrfToken, CsrfTokenManagerInterface $csrfTokenManager): Response
+    public function deleteTemplate(InvoiceTemplate $template, string $csrfToken, CsrfTokenManagerInterface $csrfTokenManager, InvoiceTemplateRepository $templateRepository): Response
     {
         if (!$csrfTokenManager->isTokenValid(new CsrfToken('invoice.delete_template', $csrfToken))) {
             $this->flashError('action.csrf.error');
@@ -687,7 +676,7 @@ final class InvoiceController extends AbstractController
         $csrfTokenManager->refreshToken('invoice.delete_template');
 
         try {
-            $this->templateRepository->removeTemplate($template);
+            $templateRepository->removeTemplate($template);
             $this->flashSuccess('action.delete.success');
         } catch (Exception $ex) {
             $this->flashDeleteException($ex);
@@ -727,7 +716,7 @@ final class InvoiceController extends AbstractController
         $this->flashError('action.update.error', $err);
     }
 
-    private function renderTemplateForm(InvoiceTemplate $template, Request $request): Response
+    private function renderTemplateForm(InvoiceTemplate $template, Request $request, InvoiceTemplateRepository $templateRepository): Response
     {
         $event = new InvoiceTemplateMetaDefinitionEvent($template);
         $this->dispatcher->dispatch($event);
@@ -738,7 +727,7 @@ final class InvoiceController extends AbstractController
 
         if ($editForm->isSubmitted() && $editForm->isValid()) {
             try {
-                $this->templateRepository->saveTemplate($template);
+                $templateRepository->saveTemplate($template);
                 $this->flashSuccess('action.update.success');
 
                 return $this->redirectToRoute('admin_invoice_template');

src/Entity/ColorTrait.php

@@ -23,7 +23,8 @@ trait ColorTrait
      * The assigned color in HTML hex format, e.g. #dd1d00
      */
     #[ORM\Column(name: 'color', type: Types::STRING, length: 7, nullable: true)]
-    #[Serializer\Exclude]
+    #[Serializer\Expose]
+    #[Serializer\Groups(['Default'])]
     #[Exporter\Expose(label: 'color')]
     #[Constraints\HexColor]
     private ?string $color = null;
@@ -50,10 +51,10 @@ trait ColorTrait
     abstract public function getName(): ?string;
 
     /**
-     * Internal value: this color will never be empty and is generated by the tag name if not set explicit.
+     * Color will never be empty and is generated from the entity tag name if not set explicit.
      */
     #[Serializer\VirtualProperty]
-    #[Serializer\SerializedName('color')]
+    #[Serializer\SerializedName('color-safe')]
     #[Serializer\Groups(['Default'])]
     public function getColorSafe(): string
     {

src/Entity/Customer.php

@@ -231,7 +231,7 @@ class Customer implements EntityWithMetaFields, EntityWithBudget, CreatedAt
     #[Assert\Length(max: 50)]
     #[Serializer\Expose]
     #[Serializer\Groups(['Customer_Entity'])]
-    #[Exporter\Expose(label: 'buyer_reference')]
+    #[Exporter\Expose(label: 'buyerReference')]
     private ?string $buyerReference = null;
 
     public function __construct(string $name)

src/Entity/ExportTemplate.php

@@ -256,6 +256,18 @@ class ExportTemplate
         return \is_string($font) ? $font : null;
     }
 
+    public function isAvailableForAll(): bool
+    {
+        $isAllowed = $this->getOption('user_access', false);
+
+        return \is_bool($isAllowed) ? $isAllowed : false;
+    }
+
+    public function setAvailableForAll(bool $userAccess): void
+    {
+        $this->setOption('user_access', $userAccess);
+    }
+
     public function __toString(): string
     {
         return $this->title ?? 'New';

src/Entity/ExportableItem.php

@@ -12,8 +12,8 @@ namespace App\Entity;
 use Doctrine\Common\Collections\Collection;
 
 /**
- * @method getTags() array
- * @method getBreak() int
+ * @method array<Tag> getTags()
+ * @method int getBreak()
  */
 interface ExportableItem
 {

src/Entity/InvoiceTemplate.php

@@ -88,6 +88,10 @@ class InvoiceTemplate implements EntityWithMetaFields
      */
     #[ORM\OneToMany(mappedBy: 'template', targetEntity: InvoiceTemplateMeta::class, cascade: ['persist'])]
     private Collection $meta;
+    /**
+     * @var array<Tax>
+     */
+    private array $taxRates = [];
 
     public function __construct()
     {
@@ -268,23 +272,36 @@ class InvoiceTemplate implements EntityWithMetaFields
         $this->language = $language;
     }
 
+    /**
+     * @param array<Tax> $taxRates
+     */
+    public function setTaxRates(array $taxRates): void
+    {
+        $this->taxRates = $taxRates;
+    }
+
     /**
      * @return Tax[]
      */
     public function getTaxRates(): array
     {
-        // TODO make me configurable via UI
+        if (\count($this->taxRates) > 0) {
+            return $this->taxRates;
+        }
+
         $tax = new Tax(
             TaxType::STANDARD,
-            'VAT',
-            $this->vat ?? 0.00
+            $this->vat ?? 0.00,
+            'vat',
+            true,
+            null
         );
 
         return [$tax];
     }
 
     /**
-     * @return Collection|MetaTableTypeInterface[]
+     * @return Collection<int, InvoiceTemplateMeta>
      */
     public function getMetaFields(): Collection
     {

src/Entity/MetaTableTypeInterface.php

@@ -11,6 +11,10 @@ namespace App\Entity;
 
 use Symfony\Component\Validator\Constraint;
 
+/**
+ * @method null|string getSection()
+ * @method void setSection(?string $name)
+ */
 interface MetaTableTypeInterface
 {
     /**
@@ -43,6 +47,8 @@ interface MetaTableTypeInterface
     /**
      * This will merge the current object with the values from the given $meta instance.
      * It should NOT update the name or value, but only the form settings.
+     *
+     * Settings from the given $meta object will win over the current ones.
      */
     public function merge(MetaTableTypeInterface $meta): MetaTableTypeInterface;
 
@@ -132,6 +138,16 @@ interface MetaTableTypeInterface
      */
     public function getOrder(): int;
 
+    /**
+     * FIXME activate with 3.0
+     */
+    //public function setSection(?string $section): void;
+
+    /**
+     * FIXME activate with 3.0
+     */
+    //public function getSection(): ?string;
+
     /**
      * Whether true if this field is defined by a plugin, or false if it is a value stored in the database.
      */

src/Entity/MetaTableTypeTrait.php

@@ -67,6 +67,7 @@ trait MetaTableTypeTrait
      */
     private mixed $data = null;
     private bool $updated = false;
+    private ?string $section = null;
 
     public function getName(): ?string
     {
@@ -193,13 +194,11 @@ trait MetaTableTypeTrait
 
     public function merge(MetaTableTypeInterface $meta): MetaTableTypeInterface
     {
-        $this
-            ->setConstraints($meta->getConstraints())
-            ->setIsRequired($meta->isRequired())
-            ->setIsVisible($meta->isVisible())
-            ->setOptions($meta->getOptions())
-            ->setOrder($meta->getOrder())
-        ;
+        $this->setConstraints($meta->getConstraints());
+        $this->setIsRequired($meta->isRequired());
+        $this->setIsVisible($meta->isVisible());
+        $this->setOptions($meta->getOptions());
+        $this->setOrder($meta->getOrder());
 
         if ($meta->getLabel() !== null) {
             $this->setLabel($meta->getLabel());
@@ -209,6 +208,10 @@ trait MetaTableTypeTrait
             $this->setType($meta->getType());
         }
 
+        if ($meta->getSection() !== null) {
+            $this->setSection($meta->getSection());
+        }
+
         return $this;
     }
 
@@ -266,6 +269,16 @@ trait MetaTableTypeTrait
         }
     }
 
+    public function setSection(?string $section): void
+    {
+        $this->section = $section;
+    }
+
+    public function getSection(): ?string
+    {
+        return $this->section;
+    }
+
     /**
      * Whether this field is defined by a plugin or just a value stored in the database.
      */

src/Entity/Tax.php

@@ -13,8 +13,10 @@ final class Tax
 {
     public function __construct(
         private readonly TaxType $type,
-        private readonly string $name = 'VAT',
-        private readonly float $rate = 0.0,
+        private readonly float $rate,
+        private readonly string $name,
+        private readonly bool $show,
+        private readonly ?string $note,
     )
     {
     }
@@ -33,4 +35,14 @@ final class Tax
     {
         return $this->rate;
     }
+
+    public function isShow(): bool
+    {
+        return $this->rate > 0.0 || $this->show;
+    }
+
+    public function getNote(): ?string
+    {
+        return $this->note;
+    }
 }

src/Entity/User.php

@@ -376,14 +376,24 @@ class User implements UserInterface, EquatableInterface, ThemeUserInterface, Pas
     }
 
     /**
+     * This method is called from the "edit user preferences" form.
+     * Therefor it just merges the values for existing preferences and adds new ones.
+     * But it will NOT remove existing preferences or replace the underlying collection.
+     *
      * @param iterable<UserPreference> $preferences
      */
     public function setPreferences(iterable $preferences): User
     {
-        $this->preferences = new ArrayCollection();
-
         foreach ($preferences as $preference) {
-            $this->addPreference($preference);
+            if (($name = $preference->getName()) === null) {
+                continue;
+            }
+            $p = $this->getPreference($name);
+            if ($p === null) {
+                $this->addPreference($preference);
+            } else {
+                $p->setValue($preference->getValue());
+            }
         }
 
         return $this;

src/Entity/WebhookConfiguration.php

@@ -1,60 +0,0 @@
-<?php
-
-/*
- * This file is part of the Kimai time-tracking app.
- *
- * For the full copyright and license information, please view the LICENSE
- * file that was distributed with this source code.
- */
-
-namespace App\Entity;
-
-class WebhookConfiguration
-{
-    private string $name;
-    private string $url;
-    private string $transport;
-    private string $secret;
-    private string $authentication;
-
-    public function __construct(
-        string $name,
-        string $url,
-        string $transport,
-        #[\SensitiveParameter]
-        string $secret,
-        string $authentication
-    )
-    {
-        $this->name = $name;
-        $this->url = $url;
-        $this->transport = $transport;
-        $this->secret = $secret;
-        $this->authentication = $authentication;
-    }
-
-    public function getName(): string
-    {
-        return $this->name;
-    }
-
-    public function getUrl(): string
-    {
-        return $this->url;
-    }
-
-    public function getTransport(): string
-    {
-        return $this->transport;
-    }
-
-    public function getSecret(): string
-    {
-        return $this->secret;
-    }
-
-    public function getAuthentication(): string
-    {
-        return $this->authentication;
-    }
-}

src/Entity/WebhookEvent.php

@@ -1,32 +0,0 @@
-<?php
-
-/*
- * This file is part of the Kimai time-tracking app.
- *
- * For the full copyright and license information, please view the LICENSE
- * file that was distributed with this source code.
- */
-
-namespace App\Entity;
-
-class WebhookEvent
-{
-    private string $name;
-    private WebhookConfiguration $configuration;
-
-    public function __construct(string $name, WebhookConfiguration $configuration)
-    {
-        $this->name = $name;
-        $this->configuration = $configuration;
-    }
-
-    public function getName(): string
-    {
-        return $this->name;
-    }
-
-    public function getConfiguration(): WebhookConfiguration
-    {
-        return $this->configuration;
-    }
-}

src/Entity/WorkingTime.php

@@ -36,6 +36,7 @@ class WorkingTime
     #[ORM\Column(name: 'expected', type: Types::INTEGER, nullable: false)]
     #[Assert\NotNull]
     private int $expectedTime = 0;
+    private ?int $originalExpectedTime = null;
     #[ORM\Column(name: 'actual', type: Types::INTEGER, nullable: false)]
     #[Assert\NotNull]
     private int $actualTime = 0;
@@ -75,6 +76,39 @@ class WorkingTime
     public function setExpectedTime(int $expectedTime): void
     {
         $this->expectedTime = $expectedTime;
+        $this->storeOriginalExpectedTime();
+    }
+
+    public function storeOriginalExpectedTime(): void
+    {
+        if ($this->originalExpectedTime === null) {
+            $this->originalExpectedTime = $this->expectedTime;
+        }
+    }
+
+    public function getOriginalExpectedTime(): int
+    {
+        $this->storeOriginalExpectedTime();
+
+        return $this->originalExpectedTime ?? 0;
+    }
+
+    public function halveExpectedTime(): int
+    {
+        $this->storeOriginalExpectedTime();
+
+        $reduceBy = ($this->getOriginalExpectedTime() / 2);
+
+        $this->expectedTime = $this->expectedTime - $reduceBy;
+
+        return $reduceBy;
+    }
+
+    public function emptyExpectedTime(): void
+    {
+        $this->storeOriginalExpectedTime();
+
+        $this->expectedTime = 0;
     }
 
     public function getActualTime(): int

src/Event/InvoicePreRenderEvent.php

@@ -14,6 +14,14 @@ use App\Invoice\RendererInterface;
 use App\Model\InvoiceDocument;
 use Symfony\Contracts\EventDispatcher\Event;
 
+/**
+ * Triggered right before an invoice is rendered.
+ *
+ * You can use this event to:
+ * - add invoice hydrator
+ * - read and change invoice model
+ * - change tax rates
+ */
 final class InvoicePreRenderEvent extends Event
 {
     public function __construct(

src/EventSubscriber/Actions/TimesheetsSubscriber.php

@@ -34,7 +34,7 @@ final class TimesheetsSubscriber extends AbstractActionsSubscriber
 
         if ($this->isGranted('export_own_timesheet')) {
             foreach ($this->serviceExport->getTimesheetExporter() as $exporter) {
-                $event->addActionToSubmenu('export', $exporter->getId(), ['url' => $this->path('timesheet_export', ['exporter' => $exporter->getId()]), 'class' => 'toolbar-action', 'title' => 'button.' . $exporter->getId(), 'translation_domain' => 'messages']);
+                $event->addActionToSubmenu('export', $exporter->getId(), ['url' => $this->path('timesheet_export', ['exporter' => $exporter->getId()]), 'class' => 'toolbar-action', 'title' => $exporter->getTitle()]);
             }
         }
     }

src/EventSubscriber/Actions/TimesheetsTeamSubscriber.php

@@ -35,7 +35,7 @@ final class TimesheetsTeamSubscriber extends AbstractActionsSubscriber
 
         if ($this->isGranted('export_other_timesheet')) {
             foreach ($this->serviceExport->getTimesheetExporter() as $exporter) {
-                $event->addActionToSubmenu('export', $exporter->getId(), ['url' => $this->path('admin_timesheet_export', ['exporter' => $exporter->getId()]), 'class' => 'toolbar-action', 'title' => 'button.' . $exporter->getId(), 'translation_domain' => 'messages']);
+                $event->addActionToSubmenu('export', $exporter->getId(), ['url' => $this->path('admin_timesheet_export', ['exporter' => $exporter->getId()]), 'class' => 'toolbar-action', 'title' => $exporter->getTitle()]);
             }
         }
     }

src/Export/Base/HtmlRenderer.php

@@ -24,7 +24,7 @@ use App\Repository\Query\ActivityQuery;
 use App\Repository\Query\CustomerQuery;
 use App\Repository\Query\ProjectQuery;
 use App\Repository\Query\TimesheetQuery;
-use App\Twig\SecurityPolicy\ExportPolicy;
+use App\Twig\SecurityPolicy\StrictPolicy;
 use Psr\EventDispatcher\EventDispatcherInterface;
 use Symfony\Component\DependencyInjection\Attribute\Exclude;
 use Symfony\Component\HttpFoundation\Response;
@@ -100,9 +100,12 @@ class HtmlRenderer implements ExportRendererInterface
         $summary = $this->calculateSummary($exportItems);
 
         // enable basic security measures
-        $sandbox = new SandboxExtension(new ExportPolicy());
+        if (!$this->twig->hasExtension(SandboxExtension::class)) {
+            $this->twig->addExtension(new SandboxExtension(new StrictPolicy()));
+        }
+
+        $sandbox = $this->twig->getExtension(SandboxExtension::class);
         $sandbox->enableSandbox();
-        $this->twig->addExtension($sandbox);
 
         $content = $this->twig->render($this->getTemplate(), array_merge([
             'entries' => $exportItems,
@@ -117,7 +120,11 @@ class HtmlRenderer implements ExportRendererInterface
             'userPreferences' => $userPreferences,
         ], $this->getOptions($query)));
 
+        // allows to run in development mode, otherwise toolbar would be blocked
+        $sandbox->disableSandbox();
+
         $response = new Response();
+        $response->headers->set('Content-Type', 'text/html');
         $response->setContent($content);
 
         return $response;

src/Export/Base/PDFRenderer.php

@@ -17,7 +17,7 @@ use App\Pdf\PdfContext;
 use App\Pdf\PdfRendererTrait;
 use App\Project\ProjectStatisticService;
 use App\Repository\Query\TimesheetQuery;
-use App\Twig\SecurityPolicy\ExportPolicy;
+use App\Twig\SecurityPolicy\StrictPolicy;
 use Symfony\Component\DependencyInjection\Attribute\Exclude;
 use Symfony\Component\HttpFoundation\Response;
 use Twig\Environment;
@@ -103,9 +103,12 @@ class PDFRenderer implements DispositionInlineInterface, ExportRendererInterface
         $summary = $this->calculateSummary($exportItems);
 
         // enable basic security measures
-        $sandbox = new SandboxExtension(new ExportPolicy());
+        if (!$this->twig->hasExtension(SandboxExtension::class)) {
+            $this->twig->addExtension(new SandboxExtension(new StrictPolicy()));
+        }
+
+        $sandbox = $this->twig->getExtension(SandboxExtension::class);
         $sandbox->enableSandbox();
-        $this->twig->addExtension($sandbox);
 
         $content = $this->twig->render($this->getTemplate(), array_merge([
             'entries' => $exportItems,
@@ -116,6 +119,8 @@ class PDFRenderer implements DispositionInlineInterface, ExportRendererInterface
             'pdfContext' => $context
         ], $this->getOptions($query)));
 
+        $sandbox->disableSandbox();
+
         $pdfOptions = array_merge($context->getOptions(), $this->getPdfOptions());
 
         $content = $this->converter->convertToPdf($content, $pdfOptions);

src/Export/ExportRendererInterface.php

@@ -14,9 +14,9 @@ use App\Repository\Query\TimesheetQuery;
 use Symfony\Component\HttpFoundation\Response;
 
 /**
- * TODO change interface for 3.0
- * @method getType() string
- * @method isInternal() bool
+ * FIXME change interface for 3.0
+ * @method string getType()
+ * @method bool isInternal()
  */
 interface ExportRendererInterface
 {

src/Export/Renderer/CsvRendererFactory.php

@@ -35,7 +35,7 @@ final class CsvRendererFactory
 
     public function createDefault(): CsvRenderer
     {
-        $template = new DefaultTemplate($this->eventDispatcher, 'csv');
+        $template = new DefaultTemplate($this->eventDispatcher, 'csv', 'en', 'csv');
 
         return new CsvRenderer($this->converter, $this->translator, $template);
     }

src/Export/Renderer/HtmlRendererFactory.php

@@ -25,7 +25,7 @@ final class HtmlRendererFactory
     ) {
     }
 
-    public function create(string $id, string $template): HtmlRenderer
+    public function create(string $id, string $template, string $title = 'print'): HtmlRenderer
     {
         return new HtmlRenderer(
             $this->twig,
@@ -33,7 +33,7 @@ final class HtmlRendererFactory
             $this->projectStatisticService,
             $this->activityStatisticService,
             $id,
-            'print',
+            $title,
             $template
         );
     }

src/Export/Renderer/XlsxRendererFactory.php

@@ -27,7 +27,7 @@ final class XlsxRendererFactory
 
     public function createDefault(): XlsxRenderer
     {
-        $template = new DefaultTemplate($this->eventDispatcher, 'xlsx');
+        $template = new DefaultTemplate($this->eventDispatcher, 'xlsx', 'en', 'xlsx');
 
         return new XlsxRenderer($this->converter, $this->translator, $template);
     }

src/Export/ServiceExport.php

@@ -10,6 +10,7 @@
 namespace App\Export;
 
 use App\Entity\ExportableItem;
+use App\Entity\ExportTemplate;
 use App\Event\ExportItemsQueryEvent;
 use App\Export\Renderer\CsvRendererFactory;
 use App\Export\Renderer\HtmlRendererFactory;
@@ -74,6 +75,15 @@ final class ServiceExport
         $this->renderer[] = $renderer;
     }
 
+    private function filenameToTitle(string $title): string
+    {
+        if (str_contains($title, '.')) {
+            $title = explode('.', $title)[0];
+        }
+
+        return str_replace(['-', '_'], ' ', $title);
+    }
+
     /**
      * @return ExportRendererInterface[]
      */
@@ -82,32 +92,15 @@ final class ServiceExport
         $renderer = [
             $this->csvRendererFactory->createDefault(),
             $this->xlsxRendererFactory->createDefault(),
-            $this->pdfRendererFactory->create('pdf', 'export/pdf-layout.html.twig', 'default'),
-            $this->htmlRendererFactory->create('html', 'export/print.html.twig'),
+            $this->pdfRendererFactory->create('pdf', 'export/pdf-layout.html.twig', 'pdf'),
+            $this->htmlRendererFactory->create('print', 'export/print.html.twig'),
         ];
 
         foreach ($this->exportTemplateRepository->findAll() as $template) {
-            $tpl = new Template((string) $template->getId(), $template->getTitle()); // @phpstan-ignore argument.type
-            $tpl->setColumns($template->getColumns());
-            $tpl->setLocale($template->getLanguage());
-            $tpl->setOptions($template->getOptions());
-
-            switch ($template->getRenderer()) {
-                case 'csv':
-                    $renderer[] = $this->csvRendererFactory->create($tpl);
-                    break;
-
-                case 'xlsx':
-                    $renderer[] = $this->xlsxRendererFactory->create($tpl);
-                    break;
-
-                case 'pdf':
-                    $renderer[] = $this->pdfRendererFactory->createFromTemplate($tpl);
-                    break;
-
-                default:
-                    $this->logger->error('Unknown export template type: ' . $template->getRenderer());
-                    break;
+            try {
+                $renderer[] = $this->createTemplateFromExportTemplate($template);
+            } catch (\Exception $exception) {
+                $this->logger->error('Unknown export template type: ' . $template->getRenderer());
             }
         }
 
@@ -124,7 +117,7 @@ final class ServiceExport
                         continue;
                     }
 
-                    $renderer[] = $this->htmlRendererFactory->create($tplName, '@export/' . $tplName);
+                    $renderer[] = $this->htmlRendererFactory->create($tplName, '@export/' . $tplName, $this->filenameToTitle($tplName));
                 }
             }
 
@@ -136,7 +129,7 @@ final class ServiceExport
                         continue;
                     }
 
-                    $renderer[] = $this->pdfRendererFactory->create($tplName, '@export/' . $tplName);
+                    $renderer[] = $this->pdfRendererFactory->create($tplName, '@export/' . $tplName, $this->filenameToTitle($tplName));
                 }
             }
         }
@@ -144,6 +137,28 @@ final class ServiceExport
         return array_merge($this->renderer, $renderer);
     }
 
+    private function createTemplateFromExportTemplate(ExportTemplate $template): ExportRendererInterface
+    {
+        $tpl = new Template((string) $template->getId(), $template->getTitle()); // @phpstan-ignore argument.type
+        $tpl->setColumns($template->getColumns());
+        $tpl->setLocale($template->getLanguage());
+        $tpl->setOptions($template->getOptions());
+
+        switch ($template->getRenderer()) {
+            case 'csv':
+                return $this->csvRendererFactory->create($tpl);
+
+            case 'xlsx':
+                return $this->xlsxRendererFactory->create($tpl);
+
+            case 'pdf':
+                return $this->pdfRendererFactory->createFromTemplate($tpl);
+
+            default:
+                throw new \Exception('Unknown export template type: ' . $template->getRenderer());
+        }
+    }
+
     public function getRendererById(string $id): ?ExportRendererInterface
     {
         foreach ($this->getRenderer() as $renderer) {
@@ -165,6 +180,7 @@ final class ServiceExport
      */
     public function getTimesheetExporter(): array
     {
+        // TODO 3.0 cache the result, as this is one extra database query on the timesheet pages
         $exporter = [
             $this->pdfRendererFactory->create('pdf', '@export/timesheet.pdf.twig'),
             $this->xlsxRendererFactory->createDefault(),
@@ -172,6 +188,17 @@ final class ServiceExport
             $this->htmlRendererFactory->create('print', 'timesheet/export.html.twig'),
         ];
 
+        foreach ($this->exportTemplateRepository->findAll() as $template) {
+            if (!$template->isAvailableForAll()) {
+                continue;
+            }
+            try {
+                $exporter[] = $this->createTemplateFromExportTemplate($template);
+            } catch (\Exception $exception) {
+                $this->logger->error('Unknown export template type: ' . $template->getRenderer());
+            }
+        }
+
         return array_merge($this->timesheetExporter, $exporter);
     }
 

src/Form/ExportTemplateSpreadsheetForm.php

@@ -15,6 +15,7 @@ use App\Form\Type\ExportRendererType;
 use App\Form\Type\ExportSummaryColumnsType;
 use App\Form\Type\LanguageType;
 use App\Form\Type\PdfFontType;
+use App\Form\Type\YesNoType;
 use Symfony\Component\Form\AbstractType;
 use Symfony\Component\Form\Extension\Core\Type\ChoiceType;
 use Symfony\Component\Form\Extension\Core\Type\TextType;
@@ -22,6 +23,9 @@ use Symfony\Component\Form\FormBuilderInterface;
 use Symfony\Component\OptionsResolver\OptionsResolver;
 use Symfony\Component\Validator\Constraints\Length;
 
+/**
+ * TODO rename with 3.0 to ExportTemplateForm
+ */
 class ExportTemplateSpreadsheetForm extends AbstractType
 {
     public function buildForm(FormBuilderInterface $builder, array $options): void
@@ -77,6 +81,11 @@ class ExportTemplateSpreadsheetForm extends AbstractType
             'row_attr' => ['data-type' => 'pdf'],
             'required' => false,
         ]);
+
+        $builder->add('availableForAll', YesNoType::class, [
+            'label' => 'user_access_all',
+            'required' => false,
+        ]);
     }
 
     public function configureOptions(OptionsResolver $resolver): void

src/Form/Type/ExportRendererType.php

@@ -19,9 +19,9 @@ final class ExportRendererType extends AbstractType
     {
         $resolver->setDefaults([
             'choices' => [
-                'button.csv' => 'csv',
-                'button.xlsx' => 'xlsx',
-                'button.pdf' => 'pdf'
+                'csv' => 'csv',
+                'xlsx' => 'xlsx',
+                'pdf' => 'pdf'
             ],
         ]);
     }

src/Form/Type/TeamType.php

@@ -33,8 +33,9 @@ final class TeamType extends AbstractType
                 return $team->getName();
             },
             'documentation' => [
-                'type' => 'integer',
-                'description' => 'Team ID',
+                'type' => 'array',
+                'items' => ['type' => 'integer', 'description' => 'Team IDs'],
+                'description' => 'Array of Team IDs',
             ],
         ]);
 

src/Form/Type/UserPreferencesCollectionType.php

@@ -30,11 +30,10 @@ final class UserPreferencesCollectionType extends AbstractType
         $builder->addEventListener(
             FormEvents::PRE_SET_DATA,
             function (FormEvent $event): void {
-                /** @var ArrayCollection<UserPreference> $collection */
+                /** @var ArrayCollection<int, UserPreference> $collection */
                 $collection = $event->getData();
+                $preferences = new ArrayCollection();
                 foreach ($collection as $collectionItem) {
-                    $collection->removeElement($collectionItem);
-
                     if (!($collectionItem instanceof UserPreference)) {
                         continue;
                     }
@@ -44,8 +43,9 @@ final class UserPreferencesCollectionType extends AbstractType
                         continue;
                     }
 
-                    $collection->set($collectionItem->getName(), $collectionItem);
+                    $preferences->set($collectionItem->getName(), clone $collectionItem);
                 }
+                $event->setData($preferences);
             },
             // must be a higher priority then the listener in UserPreferenceType
             100

src/Invoice/Hydrator/InvoiceModelDefaultHydrator.php

@@ -31,6 +31,10 @@ final class InvoiceModelDefaultHydrator implements InvoiceModelHydrator
         $subtotal = $calculator->getSubtotal();
         $formatter = $model->getFormatter();
         $language = $template->getLanguage();
+        if ($language === null) {
+            throw new \InvalidArgumentException('InvoiceTemplate needs a language');
+        }
+
         $taxRows = $calculator->getTaxRows();
 
         $vat = 0.00;
@@ -48,7 +52,7 @@ final class InvoiceModelDefaultHydrator implements InvoiceModelHydrator
             'invoice.language' => $language, // since 1.9
             'invoice.currency_symbol' => $formatter->getCurrencySymbol($currency),
             'invoice.vat' => $vat, // @deprecated, use invoice.tax_rows instead
-            'invoice.tax_hide' => $model->isHideZeroTax() && $tax === 0.00,
+            'invoice.tax_hide' => $model->isHideZeroTax() && $tax === 0.00, // @deprecated, use invoice.tax_rows instead
             'invoice.tax' => $formatter->getFormattedMoney($tax, $currency), // @deprecated, use invoice.tax_rows instead
             'invoice.tax_nc' => $formatter->getFormattedMoney($tax, $currency, false), // @deprecated, use invoice.tax_rows instead
             'invoice.tax_plain' => $tax, // @deprecated, use invoice.tax_rows instead
@@ -91,11 +95,17 @@ final class InvoiceModelDefaultHydrator implements InvoiceModelHydrator
         ];
 
         $values['invoice.tax_rows'] = [];
+        $counter = 1;
         foreach ($taxRows as $taxRow) {
+            $tax = $taxRow->getTax();
             $values['invoice.tax_rows'][] = [
-                'type' => $taxRow->getTax()->getType()->value,
-                'name' => $taxRow->getTax()->getName(),
-                'rate' => $taxRow->getTax()->getRate(),
+                'counter' => $counter++,
+                'type' => $tax->getType()->value,
+                'name' => $tax->getName(),
+                'rate' => $tax->getRate(),
+                'note' => $tax->getNote(),
+                'show' => $tax->isShow(),
+                'currency' => $currency,
                 'amount' => $taxRow->getAmount(), // do not format, only available in twig anyway
                 'base' => $taxRow->getBasePrice(), // do not format, only available in twig anyway
             ];

src/Invoice/InvoiceItemHydrator.php

@@ -9,6 +9,9 @@
 
 namespace App\Invoice;
 
+use Symfony\Component\DependencyInjection\Attribute\AutoconfigureTag;
+
+#[AutoconfigureTag]
 interface InvoiceItemHydrator
 {
     public function setInvoiceModel(InvoiceModel $model): void;

src/Invoice/InvoiceModel.php

@@ -9,20 +9,10 @@
 
 namespace App\Invoice;
 
-use App\Activity\ActivityStatisticService;
-use App\Customer\CustomerStatisticService;
 use App\Entity\Customer;
 use App\Entity\ExportableItem;
 use App\Entity\InvoiceTemplate;
 use App\Entity\User;
-use App\Invoice\Hydrator\InvoiceItemDefaultHydrator;
-use App\Invoice\Hydrator\InvoiceModelActivityHydrator;
-use App\Invoice\Hydrator\InvoiceModelCustomerHydrator;
-use App\Invoice\Hydrator\InvoiceModelDefaultHydrator;
-use App\Invoice\Hydrator\InvoiceModelIssuerHydrator;
-use App\Invoice\Hydrator\InvoiceModelProjectHydrator;
-use App\Invoice\Hydrator\InvoiceModelUserHydrator;
-use App\Project\ProjectStatisticService;
 use App\Repository\Query\InvoiceQuery;
 use App\Timesheet\RateCalculator\RateCalculatorMode;
 use Symfony\Component\DependencyInjection\Attribute\Exclude;
@@ -43,7 +33,6 @@ final class InvoiceModel
     private ?NumberGeneratorInterface $generator = null;
     private \DateTimeInterface $invoiceDate;
     private ?User $user = null;
-    private InvoiceFormatter $formatter;
     /**
      * @var InvoiceModelHydrator[]
      */
@@ -64,24 +53,13 @@ final class InvoiceModel
      * @internal use InvoiceModelFactory
      */
     public function __construct(
-        InvoiceFormatter $formatter,
-        CustomerStatisticService $customerStatistic,
-        ProjectStatisticService $projectStatistic,
-        ActivityStatisticService $activityStatistic,
+        private InvoiceFormatter $formatter,
         private readonly Customer $customer,
         private readonly InvoiceTemplate $template,
         private readonly RateCalculatorMode $rateCalculatorMode
     )
     {
         $this->invoiceDate = new \DateTimeImmutable();
-        $this->formatter = $formatter;
-        $this->addModelHydrator(new InvoiceModelDefaultHydrator());
-        $this->addModelHydrator(new InvoiceModelCustomerHydrator($customerStatistic));
-        $this->addModelHydrator(new InvoiceModelIssuerHydrator());
-        $this->addModelHydrator(new InvoiceModelProjectHydrator($projectStatistic));
-        $this->addModelHydrator(new InvoiceModelActivityHydrator($activityStatistic));
-        $this->addModelHydrator(new InvoiceModelUserHydrator());
-        $this->addItemHydrator(new InvoiceItemDefaultHydrator());
     }
 
     /**

src/Invoice/InvoiceModelFactory.php

@@ -9,27 +9,36 @@
 
 namespace App\Invoice;
 
-use App\Activity\ActivityStatisticService;
-use App\Customer\CustomerStatisticService;
 use App\Entity\Customer;
 use App\Entity\InvoiceTemplate;
-use App\Project\ProjectStatisticService;
 use App\Repository\Query\InvoiceQuery;
 use App\Timesheet\RateCalculator\RateCalculatorMode;
+use Symfony\Component\DependencyInjection\Attribute\TaggedIterator;
 
 final class InvoiceModelFactory
 {
+    /**
+     * @param iterable<InvoiceModelHydrator> $modelHydrators
+     * @param iterable<InvoiceItemHydrator> $itemHydrators
+     */
     public function __construct(
-        private readonly CustomerStatisticService $customerStatisticService,
-        private readonly ProjectStatisticService $projectStatisticService,
-        private readonly ActivityStatisticService $activityStatisticService,
-        private readonly RateCalculatorMode $rateCalculatorMode
+        private readonly RateCalculatorMode $rateCalculatorMode,
+        #[TaggedIterator(InvoiceModelHydrator::class)]
+        private readonly iterable $modelHydrators,
+        #[TaggedIterator(InvoiceItemHydrator::class)]
+        private readonly iterable $itemHydrators,
     ) {
     }
 
     public function createModel(InvoiceFormatter $formatter, Customer $customer, InvoiceTemplate $template, InvoiceQuery $query): InvoiceModel
     {
-        $model = new InvoiceModel($formatter, $this->customerStatisticService, $this->projectStatisticService, $this->activityStatisticService, $customer, $template, $this->rateCalculatorMode);
+        $model = new InvoiceModel($formatter, $customer, $template, $this->rateCalculatorMode);
+        foreach ($this->modelHydrators as $modelHydrator) {
+            $model->addModelHydrator($modelHydrator);
+        }
+        foreach ($this->itemHydrators as $itemHydrator) {
+            $model->addItemHydrator($itemHydrator);
+        }
 
         $model->setQuery($query);
 

src/Invoice/InvoiceModelHydrator.php

@@ -9,6 +9,9 @@
 
 namespace App\Invoice;
 
+use Symfony\Component\DependencyInjection\Attribute\AutoconfigureTag;
+
+#[AutoconfigureTag]
 interface InvoiceModelHydrator
 {
     public function hydrate(InvoiceModel $model): array;

src/Invoice/Renderer/AbstractTwigRenderer.php

@@ -13,7 +13,7 @@ use App\Invoice\InvoiceModel;
 use App\Invoice\RendererInterface;
 use App\Model\InvoiceDocument;
 use App\Twig\LocaleFormatExtensions;
-use App\Twig\SecurityPolicy\InvoicePolicy;
+use App\Twig\SecurityPolicy\StrictPolicy;
 use Symfony\Bridge\Twig\Extension\TranslationExtension;
 use Symfony\Contracts\Translation\LocaleAwareInterface;
 use Twig\Environment;
@@ -64,7 +64,7 @@ abstract class AbstractTwigRenderer implements RendererInterface
         }
 
         if (!$twig->hasExtension(SandboxExtension::class)) {
-            $twig->addExtension(new SandboxExtension(new InvoicePolicy()));
+            $twig->addExtension(new SandboxExtension(new StrictPolicy()));
         }
 
         $sandbox = $twig->getExtension(SandboxExtension::class);

src/Repository/Query/CustomerQuery.php

@@ -16,14 +16,14 @@ class CustomerQuery extends BaseQuery implements VisibilityInterface
     public const CUSTOMER_ORDER_ALLOWED = [
         'name',
         'description' => 'comment',
-        'country', 'number',
+        'country',
+        'number',
         'homepage',
         'email',
         'mobile',
         'fax',
         'phone',
         'currency',
-        'address',
         'contact',
         'company',
         'vat_id',

src/Serializer/Serializer.php

@@ -1,64 +0,0 @@
-<?php
-
-/*
- * This file is part of the Kimai time-tracking app.
- *
- * For the full copyright and license information, please view the LICENSE
- * file that was distributed with this source code.
- */
-
-namespace App\Serializer;
-
-use JMS\Serializer\Context;
-use JMS\Serializer\DeserializationContext;
-use JMS\Serializer\SerializationContext;
-use JMS\Serializer\Serializer as CoreSerializer;
-use JMS\Serializer\SerializerInterface as CoreSerializerInterface;
-
-class Serializer implements SerializerInterface
-{
-    public function __construct(private readonly CoreSerializerInterface $serializer)
-    {
-    }
-
-    private function prepareContext(Context $jmsContext, array $context = []): void
-    {
-        $groups = ['Default'];
-        if (\array_key_exists('groups', $context)) {
-            $groups = $context['groups'];
-        }
-
-        $jmsContext->setGroups($groups);
-        $jmsContext->enableMaxDepthChecks();
-    }
-
-    public function toArray(mixed $data, array $context = []): array
-    {
-        $jmsContext = SerializationContext::create();
-        $this->prepareContext($jmsContext, $context);
-
-        if ($this->serializer instanceof CoreSerializer) {
-            return $this->serializer->toArray($data, $jmsContext);
-        }
-
-        $json = $this->serializer->serialize($data, 'json', $jmsContext);
-
-        return json_decode($json, true, 512, JSON_THROW_ON_ERROR);
-    }
-
-    public function serialize(mixed $data, string $format, array $context = []): string
-    {
-        $jmsContext = SerializationContext::create();
-        $this->prepareContext($jmsContext, $context);
-
-        return $this->serializer->serialize($data, $format, $jmsContext);
-    }
-
-    public function deserialize(mixed $data, string $type, string $format, array $context = []): mixed
-    {
-        $jmsContext = DeserializationContext::create();
-        $this->prepareContext($jmsContext, $context);
-
-        return $this->serializer->deserialize($data, $type, $format, $jmsContext);
-    }
-}

src/Serializer/SerializerInterface.php

@@ -1,17 +0,0 @@
-<?php
-
-/*
- * This file is part of the Kimai time-tracking app.
- *
- * For the full copyright and license information, please view the LICENSE
- * file that was distributed with this source code.
- */
-
-namespace App\Serializer;
-
-use Symfony\Component\Serializer\SerializerInterface as BaseSerializerInterface;
-
-interface SerializerInterface extends BaseSerializerInterface
-{
-    public function toArray(mixed $data, array $context = []): array;
-}

src/Twig/SecurityPolicy/ChainPolicy.php

@@ -1,48 +0,0 @@
-<?php
-
-/*
- * This file is part of the Kimai time-tracking app.
- *
- * For the full copyright and license information, please view the LICENSE
- * file that was distributed with this source code.
- */
-
-namespace App\Twig\SecurityPolicy;
-
-use Twig\Sandbox\SecurityPolicyInterface;
-
-final class ChainPolicy implements SecurityPolicyInterface
-{
-    /** @var array<SecurityPolicyInterface> */
-    private array $policies = [];
-
-    public function __construct()
-    {
-    }
-
-    public function addPolicy(SecurityPolicyInterface $policy): void
-    {
-        $this->policies[] = $policy;
-    }
-
-    public function checkSecurity($tags, $filters, $functions): void
-    {
-        foreach ($this->policies as $policy) {
-            $policy->checkSecurity($tags, $filters, $functions);
-        }
-    }
-
-    public function checkMethodAllowed($obj, $method): void
-    {
-        foreach ($this->policies as $policy) {
-            $policy->checkMethodAllowed($obj, $method);
-        }
-    }
-
-    public function checkPropertyAllowed($obj, $property): void
-    {
-        foreach ($this->policies as $policy) {
-            $policy->checkPropertyAllowed($obj, $property);
-        }
-    }
-}

src/Twig/SecurityPolicy/DefaultPolicy.php

@@ -9,22 +9,34 @@
 
 namespace App\Twig\SecurityPolicy;
 
+use Symfony\Component\DependencyInjection\Attribute\Exclude;
 use Twig\Sandbox\SecurityPolicyInterface;
 
 /**
- * The Twig environment needs the sandbox extension, which itself needs a policy to start working.
+ * @deprecated since 2.47.0 - use StrictPolicy instead
  */
+#[Exclude]
 final class DefaultPolicy implements SecurityPolicyInterface
 {
+    private SecurityPolicyInterface $securityPolicy;
+
+    public function __construct()
+    {
+        $this->securityPolicy = new StrictPolicy();
+    }
+
     public function checkSecurity($tags, $filters, $functions): void
     {
+        $this->securityPolicy->checkSecurity($tags, $filters, $functions);
     }
 
     public function checkMethodAllowed($obj, $method): void
     {
+        $this->securityPolicy->checkMethodAllowed($obj, $method);
     }
 
     public function checkPropertyAllowed($obj, $property): void
     {
+        $this->securityPolicy->checkPropertyAllowed($obj, $property);
     }
 }

src/Twig/SecurityPolicy/ExportPolicy.php

@@ -9,33 +9,34 @@
 
 namespace App\Twig\SecurityPolicy;
 
+use Symfony\Component\DependencyInjection\Attribute\Exclude;
 use Twig\Sandbox\SecurityPolicyInterface;
 
 /**
- * Represents the security policy for custom Twig export templates.
+ * @deprecated since 2.47.0 - use StrictPolicy instead
  */
+#[Exclude]
 final class ExportPolicy implements SecurityPolicyInterface
 {
-    private ChainPolicy $policy;
+    private SecurityPolicyInterface $securityPolicy;
 
     public function __construct()
     {
-        $this->policy = new ChainPolicy();
-        $this->policy->addPolicy(new DefaultPolicy());
+        $this->securityPolicy = new StrictPolicy();
     }
 
     public function checkSecurity($tags, $filters, $functions): void
     {
-        $this->policy->checkSecurity($tags, $filters, $functions);
+        $this->securityPolicy->checkSecurity($tags, $filters, $functions);
     }
 
     public function checkMethodAllowed($obj, $method): void
     {
-        $this->policy->checkMethodAllowed($obj, $method);
+        $this->securityPolicy->checkMethodAllowed($obj, $method);
     }
 
     public function checkPropertyAllowed($obj, $property): void
     {
-        $this->policy->checkPropertyAllowed($obj, $property);
+        $this->securityPolicy->checkPropertyAllowed($obj, $property);
     }
 }

src/Twig/SecurityPolicy/ForbiddenPolicy.php

@@ -1,109 +0,0 @@
-<?php
-
-/*
- * This file is part of the Kimai time-tracking app.
- *
- * For the full copyright and license information, please view the LICENSE
- * file that was distributed with this source code.
- */
-
-namespace App\Twig\SecurityPolicy;
-
-use Twig\Markup;
-use Twig\Sandbox\SecurityNotAllowedFilterError;
-use Twig\Sandbox\SecurityNotAllowedFunctionError;
-use Twig\Sandbox\SecurityNotAllowedMethodError;
-use Twig\Sandbox\SecurityNotAllowedPropertyError;
-use Twig\Sandbox\SecurityNotAllowedTagError;
-use Twig\Sandbox\SecurityPolicyInterface;
-use Twig\Template;
-
-/**
- * A blocking approach for Twig templates.
- */
-final class ForbiddenPolicy implements SecurityPolicyInterface
-{
-    /** @var array<string, array<string>> */
-    private array $forbiddenMethods = [];
-
-    /**
-     * @param array<string> $forbiddenTags
-     * @param array<string> $forbiddenFilters
-     * @param array<string, array<string>> $forbiddenMethods
-     * @param array<string, array<string>> $forbiddenProperties
-     * @param array<string> $forbiddenFunctions
-     */
-    public function __construct(
-        private readonly array $forbiddenTags = [],
-        private readonly array $forbiddenFilters = [],
-        array $forbiddenMethods = [],
-        private readonly array $forbiddenProperties = [],
-        private readonly array $forbiddenFunctions = []
-    )
-    {
-        $this->forbiddenMethods = [];
-        foreach ($forbiddenMethods as $class => $m) {
-            $this->forbiddenMethods[$class] = array_map(function ($value) { return strtr($value, 'ABCDEFGHIJKLMNOPQRSTUVWXYZ', 'abcdefghijklmnopqrstuvwxyz'); }, \is_array($m) ? $m : [$m]);
-        }
-    }
-
-    public function checkSecurity($tags, $filters, $functions): void
-    {
-        foreach ($tags as $tag) {
-            if (\in_array($tag, $this->forbiddenTags)) {
-                throw new SecurityNotAllowedTagError(\sprintf('Tag "%s" is not allowed.', $tag), $tag);
-            }
-        }
-
-        foreach ($filters as $filter) {
-            if (\in_array($filter, $this->forbiddenFilters)) {
-                throw new SecurityNotAllowedFilterError(\sprintf('Filter "%s" is not allowed.', $filter), $filter);
-            }
-        }
-
-        foreach ($functions as $function) {
-            if (\in_array($function, $this->forbiddenFunctions)) {
-                throw new SecurityNotAllowedFunctionError(\sprintf('Function "%s" is not allowed.', $function), $function);
-            }
-        }
-    }
-
-    public function checkMethodAllowed($obj, $method): void
-    {
-        if ($obj instanceof Template || $obj instanceof Markup) { // @phpstan-ignore instanceof.internalClass
-            return;
-        }
-
-        $forbidden = false;
-        $method = strtr($method, 'ABCDEFGHIJKLMNOPQRSTUVWXYZ', 'abcdefghijklmnopqrstuvwxyz');
-        foreach ($this->forbiddenMethods as $class => $methods) {
-            if ($obj instanceof $class) {
-                $forbidden = \in_array($method, $methods);
-
-                break;
-            }
-        }
-
-        if ($forbidden) {
-            $class = \get_class($obj);
-            throw new SecurityNotAllowedMethodError(\sprintf('Calling "%s" method on a "%s" object is not allowed.', $method, $class), $class, $method);
-        }
-    }
-
-    public function checkPropertyAllowed($obj, $property): void
-    {
-        $forbidden = false;
-        foreach ($this->forbiddenProperties as $class => $properties) {
-            if ($obj instanceof $class) {
-                $forbidden = \in_array($property, \is_array($properties) ? $properties : [$properties]);
-
-                break;
-            }
-        }
-
-        if ($forbidden) {
-            $class = \get_class($obj);
-            throw new SecurityNotAllowedPropertyError(\sprintf('Calling "%s" property on a "%s" object is not allowed.', $property, $class), $class, $property);
-        }
-    }
-}

src/Twig/SecurityPolicy/InvoicePolicy.php

@@ -9,220 +9,34 @@
 
 namespace App\Twig\SecurityPolicy;
 
-use App\Invoice\InvoiceModel;
-use App\Pdf\PdfContext;
-use Symfony\Component\String\UnicodeString;
-use Twig\Markup;
-use Twig\Sandbox\SecurityPolicy;
+use Symfony\Component\DependencyInjection\Attribute\Exclude;
 use Twig\Sandbox\SecurityPolicyInterface;
-use Twig\Template;
 
 /**
- * Represents the security policy for custom Twig invoice templates.
+ * @deprecated since 2.47.0 - use StrictPolicy instead
  */
+#[Exclude]
 final class InvoicePolicy implements SecurityPolicyInterface
 {
-    private ChainPolicy $policy;
+    private SecurityPolicyInterface $securityPolicy;
 
     public function __construct()
     {
-        $this->policy = new ChainPolicy();
-        $this->policy->addPolicy(new DefaultPolicy());
-        $this->policy->addPolicy(new SecurityPolicy(
-            ['block', 'if', 'for', 'set', 'extends', 'import'],
-            [
-                // =================================================================
-                // vendor/twig/twig/src/Extension/CoreExtension.php
-
-                // formatting filters
-                'date',
-                'date_modify',
-                'format',
-                'replace',
-                'number_format',
-                'abs',
-                'round',
-
-                // encoding
-                'url_encode',
-                'json_encode',
-                'convert_encoding',
-
-                // string filters
-                'title',
-                'capitalize',
-                'upper',
-                'lower',
-                'striptags',
-                'trim',
-                'nl2br',
-                'spaceless',
-
-                // array helpers
-                'join',
-                'split',
-                'sort',
-                'merge',
-                'batch',
-                'column',
-                'filter',
-                'map',
-                'reduce',
-
-                // string/array filters
-                'reverse',
-                'length',
-                'slice',
-                'first',
-                'last',
-
-                // iteration and runtime
-                'default',
-                'keys',
-
-                // =================================================================
-                // vendor/twig/twig/src/Extension/EscaperExtension.php
-                'escape',
-                'e',
-                'raw',
-
-                // =================================================================
-                // vendor/symfony/twig-bridge/Extension/TranslationExtension.php
-                'trans',
-
-                // =================================================================
-                // vendor/twig/string-extra/StringExtension.php
-                'u',
-                'slug',
-
-                // =================================================================
-                // vendor/twig/intl-extra/IntlExtension.php
-                'country_name',
-                'currency_name',
-                'currency_symbol',
-                'language_name',
-                'locale_name',
-                'timezone_name',
-                'format_currency',
-                'format_number',
-                'format_decimal_number',
-                'format_currency_number',
-                'format_percent_number',
-                'format_scientific_number',
-                'format_spellout_number',
-                'format_ordinal_number',
-                'format_duration_number',
-                'format_datetime',
-                'format_date',
-                'format_time',
-
-                // =================================================================
-                // src/Twig/LocaleFormatExtensions.php
-                'month_name',
-                'day_name',
-                'date_short',
-                'date_time',
-                'date_full',
-                'date_format',
-                'date_weekday',
-                'time',
-                'duration',
-                'duration_decimal',
-                'money',
-                'amount',
-
-                // =================================================================
-                // src/Twig/RuntimeExtensions.php
-                'md2html',
-                'desc2html',
-                'comment2html',
-                'comment1line',
-
-                // =================================================================
-                // src/Twig/Extensions.php
-                'multiline_indent',
-                'color',
-                'font_contrast',
-                'default_color',
-                'nl2str',
-            ],
-            [
-                PdfContext::class => ['setoption'],
-                InvoiceModel::class => ['toarray'],
-            ],
-            [], // properties
-            [
-                // =================================================================
-                // vendor/twig/twig/src/Extension/CoreExtension.php
-                'max',
-                'min',
-                'range',
-                'constant',
-                'cycle',
-                'random',
-                'date',
-                'asset',
-                'range',
-
-                // =================================================================
-                // vendor/symfony/twig-bridge/Extension/TranslationExtension.php
-                't',
-
-                // =================================================================
-                // vendor/symfony/webpack-encore-bundle/src/Twig/EntryFilesTwigExtension.php
-                'encore_entry_css_source',
-
-                // =================================================================
-                // vendor/symfony/twig-bridge/Extension/AssetExtension.php
-                'asset',
-
-                // =================================================================
-                // vendor/symfony/twig-bridge/Extension/SecurityExtension.php
-                'is_granted',
-
-                // =================================================================
-                // Twig/RuntimeExtensions.php
-                'qr_code_data_uri',
-
-                // =================================================================
-                // Twig/Configuration.php
-                'config',
-
-                // =================================================================
-                // Twig/LocaleFormatExtensions.php
-                'create_date',
-                'month_names',
-                'locale_format',
-            ]
-        ));
+        $this->securityPolicy = new StrictPolicy();
     }
 
     public function checkSecurity($tags, $filters, $functions): void
     {
-        $this->policy->checkSecurity($tags, $filters, $functions);
+        $this->securityPolicy->checkSecurity($tags, $filters, $functions);
     }
 
     public function checkMethodAllowed($obj, $method): void
     {
-        if ($obj instanceof Template || $obj instanceof Markup || $obj instanceof UnicodeString) { // @phpstan-ignore instanceof.internalClass
-            return;
-        }
-
-        $lm = strtolower($method);
-
-        if (str_starts_with($lm, 'get') || str_starts_with($lm, 'is') || str_starts_with($lm, 'has')) {
-            return;
-        }
-
-        if ($lm === '__tostring') {
-            return;
-        }
-
-        $this->policy->checkMethodAllowed($obj, $method);
+        $this->securityPolicy->checkMethodAllowed($obj, $method);
     }
 
     public function checkPropertyAllowed($obj, $property): void
     {
-        $this->policy->checkPropertyAllowed($obj, $property);
+        $this->securityPolicy->checkPropertyAllowed($obj, $property);
     }
 }

src/Twig/SecurityPolicy/StrictPolicy.php

@@ -0,0 +1,165 @@
+<?php
+
+/*
+ * This file is part of the Kimai time-tracking app.
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace App\Twig\SecurityPolicy;
+
+use App\Entity\MetaTableTypeInterface;
+use App\Entity\User;
+use App\Pdf\PdfContext;
+use Symfony\Bridge\Twig\AppVariable;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\ServerBag;
+use Symfony\Component\HttpFoundation\Session\SessionInterface;
+use Symfony\Component\String\UnicodeString;
+use Twig\Sandbox\SecurityNotAllowedFilterError;
+use Twig\Sandbox\SecurityNotAllowedFunctionError;
+use Twig\Sandbox\SecurityNotAllowedMethodError;
+use Twig\Sandbox\SecurityNotAllowedTagError;
+use Twig\Sandbox\SecurityPolicyInterface;
+
+/**
+ * The Twig environment needs the sandbox extension, which itself needs a policy to start working.
+ */
+final class StrictPolicy implements SecurityPolicyInterface
+{
+    /** @var string[] */
+    private array $allowedTags = ['block', 'if', 'for', 'set', 'macro', 'import', 'extends', 'from'];
+    /** @var string[] */
+    private array $allowedFunctions = [
+        // vendor/twig/twig/src/Extension/CoreExtension.php
+        'max', 'min', 'range', 'constant', 'cycle', 'random', 'date',
+        // vendor/symfony/twig-bridge/Extension/TranslationExtension.php
+        't',
+        // vendor/symfony/webpack-encore-bundle/src/Twig/EntryFilesTwigExtension.php
+        'encore_entry_css_source', 'encore_entry_link_tags', 'encore_entry_script_tags',
+        // vendor/symfony/twig-bridge/Extension/SecurityExtension.php
+        'is_granted',
+        // Twig/RuntimeExtensions.php
+        'qr_code_data_uri',
+        // Twig/Configuration.php
+        'config',
+        // Twig/LocaleFormatExtensions.php
+        'create_date', 'month_names', 'locale_format',
+        // Twig/Extensions.php
+        'class_name'
+    ];
+    /** @var string[] */
+    private array $allowedFilters = [
+        // vendor/twig/twig/src/Extension/CoreExtension.php
+        // formatting filters
+        'date', 'date_modify', 'format', 'replace', 'number_format', 'abs', 'round',
+        // encoding
+        'url_encode', 'json_encode',
+        // string filters
+        'title', 'capitalize', 'upper', 'lower', 'striptags', 'trim', 'nl2br', 'spaceless',
+        // array helpers
+        'join', 'split', 'sort', 'merge', 'column', 'filter', 'map',
+        // string/array filters
+        'reverse', 'length', 'slice', 'first', 'last',
+        // iteration and runtime
+        'default', 'keys',
+        // vendor/twig/twig/src/Extension/EscaperExtension.php
+        'escape', 'e', 'raw',
+        // vendor/symfony/twig-bridge/Extension/TranslationExtension.php
+        'trans',
+        // vendor/twig/string-extra/StringExtension.php
+        'u', 'slug',
+        // vendor/twig/intl-extra/IntlExtension.php
+        'country_name', 'currency_name', 'currency_symbol', 'language_name', 'locale_name', 'timezone_name',
+        'format_currency', 'format_number', 'format_decimal_number', 'format_currency_number',
+        'format_duration_number', 'format_datetime', 'format_date', 'format_time',
+        // src/Twig/LocaleFormatExtensions.php
+        'month_name', 'day_name', 'date_short', 'date_time', 'date_full', 'date_format',
+        'date_weekday', 'time', 'duration', 'duration_decimal', 'money', 'amount',
+        // src/Twig/RuntimeExtensions.php
+        'md2html', 'desc2html', 'comment2html', 'comment1line',
+        // src/Twig/Extensions.php
+        'multiline_indent', 'color', 'nl2str'
+    ];
+
+    public function checkSecurity($tags, $filters, $functions): void
+    {
+        foreach ($tags as $tag) {
+            if (!\in_array($tag, $this->allowedTags, true)) {
+                throw new SecurityNotAllowedTagError(\sprintf('Tag "%s" is not allowed.', $tag), $tag);
+            }
+        }
+
+        foreach ($filters as $filter) {
+            if (!\in_array($filter, $this->allowedFilters, true)) {
+                throw new SecurityNotAllowedFilterError(\sprintf('Filter "%s" is not allowed.', $filter), $filter);
+            }
+        }
+
+        foreach ($functions as $function) {
+            if (!\in_array($function, $this->allowedFunctions, true)) {
+                throw new SecurityNotAllowedFunctionError(\sprintf('Function "%s" is not allowed.', $function), $function);
+            }
+        }
+    }
+
+    public function checkMethodAllowed($obj, $method): void
+    {
+        if ($obj instanceof UnicodeString) {
+            return;
+        }
+
+        if ($obj instanceof ServerBag) {
+            throw new SecurityNotAllowedMethodError('Tried to access server environment', ServerBag::class, $method);
+        }
+
+        if ($obj instanceof SessionInterface) {
+            throw new SecurityNotAllowedMethodError('Tried to access session', SessionInterface::class, $method);
+        }
+
+        $lcm = strtolower($method);
+
+        if ($obj instanceof PdfContext) {
+            if ($lcm !== 'setoption') {
+                throw new SecurityNotAllowedMethodError('Tried to access forbidden method on PdfContext', PdfContext::class, $method);
+            }
+
+            return;
+        }
+
+        if ($obj instanceof MetaTableTypeInterface && $lcm === 'merge') {
+            return;
+        }
+
+        if ($obj instanceof Request) {
+            if (!str_starts_with($lcm, 'get')) {
+                throw new SecurityNotAllowedMethodError('Tried to call setter() of app variable', AppVariable::class, $method);
+            }
+
+            return;
+        }
+
+        if ($obj instanceof AppVariable) {
+            if (!\in_array($lcm, ['getrequest', 'getuser', 'getlocale'], true)) {
+                throw new SecurityNotAllowedMethodError('Tried to access forbidden app variable method', User::class, $method);
+            }
+
+            return;
+        }
+
+        if (!str_starts_with($lcm, 'get') && !str_starts_with($lcm, 'has') && !str_starts_with($lcm, 'is') && $lcm !== '__tostring') {
+            throw new SecurityNotAllowedMethodError('Tried to access non-read method', $obj::class, $method);
+        }
+
+        if ($obj instanceof User) {
+            if (\in_array($lcm, ['getpassword', 'gettotpsecret', 'getplainpassword', 'getconfirmationtoken', 'gettotpauthenticationconfiguration'], true)) {
+                throw new SecurityNotAllowedMethodError('Tried to access user secrets', User::class, $method);
+            }
+        }
+    }
+
+    public function checkPropertyAllowed($obj, $property): void
+    {
+    }
+}

src/Utils/ReleaseVersion.php

@@ -21,10 +21,7 @@ final class ReleaseVersion
     /**
      * Get all releases from GitHub.
      *
-     * @throws \Exception
-     * @return array|null
-     * @return array<string, array{'version': string, 'date': \DateTimeInterface, 'url': string, 'download': string, 'content': string}>
-     * @return array
+     * @return array<string, array{'version': non-empty-string, 'date': \DateTimeInterface, 'url': non-empty-string, 'download': non-empty-string, 'content': string}>
      */
     private function getReleasesFromGithub(): array
     {
@@ -41,19 +38,24 @@ final class ReleaseVersion
         $context = stream_context_create($opts);
 
         $releases = file_get_contents('https://api.github.com/repos/' . Constants::GITHUB_REPO . '/releases', false, $context);
-        $releases = json_decode($releases);
-
-        if (!isset($releases[0])) {
-            throw new \Exception('API error - no release found at GitHub repository: ' . Constants::GITHUB_REPO);
+        if ($releases === false) {
+            throw new \Exception('Could not load releases from GitHub repository: ' . Constants::GITHUB_REPO);
         }
+        /** @var array<string, array{url: non-empty-string, html_url: non-empty-string, tag_name: non-empty-string, name: non-empty-string, draft: bool, immutable: bool, prerelease: bool, created_at: non-empty-string, updated_at: non-empty-string, published_at: non-empty-string, zipball_url: non-empty-string, body: string}> $releases */
+        $releases = json_decode($releases, true);
+
+        if ($releases === false) {
+            throw new \Exception('Failed parsing release found at GitHub repository: ' . Constants::GITHUB_REPO);
+        }
+
         $parsed = [];
         foreach ($releases as $release) {
-            if ($release->draft || $release->prerelease) {
+            if ($release['draft'] || $release['prerelease']) {
                 continue;
             }
 
             try {
-                $normalized = $versionParser->normalize($release->tag_name);
+                $normalized = $versionParser->normalize($release['tag_name']);
             } catch (\UnexpectedValueException $e) {
                 continue;
             }
@@ -62,19 +64,19 @@ final class ReleaseVersion
                 continue;
             }
 
-            $date = $release->published_at;
+            $date = $release['published_at'];
             try {
                 $date = new \DateTimeImmutable($date);
             } catch (\Exception $ex) {
-                // can be ignored, we return a string
+                continue;
             }
 
             $parsed[$normalized] = [
-                'version' => $release->tag_name,
+                'version' => $release['tag_name'],
                 'date' => $date,
-                'url' => $release->html_url,
-                'download' => $release->zipball_url,
-                'content' => $release->body,
+                'url' => $release['html_url'],
+                'download' => $release['zipball_url'],
+                'content' => $release['body'],
             ];
         }
         $versions = Semver::rsort(array_keys($parsed));