v3.3.1

Changes

• #202 Documentation: the context of a process is visible to every user (stored in its execution and its log records), do not pass secrets in it; a password given as argument of cleverage:ui-process:user-create is visible in the process list and the shell history.
• #138 Installation documentation: describe the Symfony Flex recipe, which registers the bundle, imports the bundle controllers routes (config/routes/clever_age_ui_process.yaml, the EasyAdmin routes being imported by the EasyAdmin recipe) and creates config/packages/clever_age_ui_process.yaml, and the manual setup without Flex.

Fixes

• #200 UserCrudController::generateToken(): reserved to ROLE_ADMIN (403), as the users, and 404 for an unknown user: the action relied on EasyAdmin not loading the entity for a user without the entity permission (a 500).
• GHSA-jwvw-9x95-x352 LaunchAction: a process without form (ui_launch_mode: modal or ~) is launched by a POST request with a CSRF token only (a GET request answers 405, an invalid token 403), and the launch URL of an unknown or private process answers 404, as with the HTTP API and the scheduler: a link on another site made a logged-in user launch a process, and any user could launch a private process. The confirmation of the modal and the "Launch" action of ui_launch_mode: ~ are POST forms.
• GHSA-m5c8-mc3j-px8f ProcessExecutionCrudController, LogRecordCrudController: disable the new, edit, delete and batch delete actions (403), only hidden until now: any user could delete the process executions and their logs.