Skip to content

TropaTT v0.2.0.7 — Security hardening + custom rates

Choose a tag to compare

View all tags
@Anton-Barinov Anton-Barinov released this 24 Aug 17:55
· 114 commits to main since this release
v0.2.0.7
48513c2

138 commits: 28 features, 96 fixes, 2 security, 2 docs, 10 other

Highlights

Major security hardening release with 56+ audit findings addressed across two audit passes, plus the full custom rates system (rate cards, snapshots, payout, period lock). Admin UI now correctly displays role permissions and KPI widgets.

Added

  • Custom rates by counterparty and project (cost, bill, payout) with named price lists, per-task overrides, and snapshotted earnings
  • Rate resolution and diagnostics (GET /api/v1/rates/preview)
  • Rate-card management UI with counterparty/project/task integration
  • Payout visibility for performers ("My earnings" page)
  • Work-type dictionary for time entries
  • Earnings report with client/work-type/ambiguous filters
  • Period locking and auto-close
  • Finance permissions and settings
  • Knowledge base template ACL (space-scoped templates)
  • Admin logs page (tabbed, filtered, paginated)
  • Server error logging to database

Fixed

  • Admin roles: permissions now display correctly in table and edit modal
  • Admin roles: create form now saves selected permissions
  • Admin KPI widgets now show real values from the database
  • Password validation messages match actual 12-char + complexity requirement
  • External user role change now cleans up stale project grants
  • CSP: inline event handlers removed, connect-src narrowed
  • Module code validator integrated into install flow
  • Cron scheduler fixed (proper return values, handler allowlists)
  • Profile/me no longer leaks financial fields
  • Task activity sanitized for external users
  • Rate card lines filtered by FinancialFieldPolicy
  • Chat participant validation (counterparty + is_active check)
  • Project identity hidden from external users
  • Self-deroot prevention
  • CSV formula injection protection
  • EXIF metadata stripped from chat images
  • LikeEscaper applied across 30+ repositories
  • Password reset tokens invalidated on password change
  • Installer locked after setup (HTTP 410)
  • Time-analytics period lock form fix

Security

  • 56+ audit findings addressed (4 CRITICAL, 12 HIGH, 22 MEDIUM, 18 LOW)
  • Module sandbox classes integrated (ModuleCodeValidator, ModuleTableValidator)
  • Root gate on module install/purge routes
  • MODULE_SIGNING_KEY required (fail-closed)
  • LikeEscaper across all 30+ repositories using LIKE queries
  • FinancialFieldPolicy applied to all financial data endpoints
  • External user RLS: task/project access properly scoped
  • Chat: FileService integration, path traversal protection, EXIF stripping
  • Knowledge: ACL enforcement for resolve/reopen, template scoping

Update server: Installed copies get updates from update.tropatt.com built from the latest main. This tag is for reference and release history.

Requirements: PHP 8.1+, MySQL, HTTPS recommended.
Demo: https://demo.tropatt.com/ (admin / adminadmin)

Assets 2
Loading