Edit timesheet , delete user edit own timesheet

[celestice441]

Hello,

I would like to know how to block the possibility for users to change their own time after entering the time.

I need that only the admins can modify the timesheet but not the users themselves.

i have already been in local.yaml, user.md, kimai.yaml and permissions.md and i can not find how.

Can you help me ?

thx

[kevinpapst]

I don't know if that is even possible right now. Did you try to remove edit_own_timesheet for the USER_ROLE?
See https://github.com/kevinpapst/kimai2/blob/master/var/docs/permissions.md

[celestice441]

Hello,

thank you for your quick answer, yes I try to edit the roles but it has no effect.

So I blocked access to this function using apache2 authentication (.htpasswd in / public) and modified the .htacces in / public by adding this:

`AuthType Basic
AuthName "aquama protection"
AuthUserFile /var/www/kimai2/public/.htpasswd

#SetEnvIf REQUEST_URI "^/(admin|secure)/" PROTECTED

Require expr %{REQUEST_URI} !~ m#^/(.*)/timesheet/(.*)/edit# Require not env PROTECTED Require valid-user ` I managed to make it work and so the edit button needs additional authentication

I think it would be useful to add this possibility in Kimai because it is a legal obligation not to change these hours.

thank you very much and continue your beautiful project

[kevinpapst]

What is your use-case? No edit at all or only after the entry was stopped?

[kevinpapst]

As there was no feedback, I am closing this issue.

I'd like to understand your problem / your use-case to see if Kimai and the community could benefit from a solution. If you still care: post an answer and I will re-open the issue.

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs. If you use Kimai on a daily basis, please consider donating to support further development of Kimai.