v1.3.0

Security

Two weaknesses in versions before 1.3.0 are fixed. GHSA-xp4j-rmpv-g36p (high): in the default configuration every visitor could read the time data of all users, and the project, support and ticket pages listed all users' bookings even where arAllowedUsers limited access. GHSA-hp35-j4q2-p8v5 (medium): the user parameter and booking text were printed without escaping. Reported by @CybotTM, fixed in #32.

Upgrade notes

Timalytics now shows a visitor only their own data unless config.php sets one of allowAllUsers = true (every user, for installations behind a web server that restricts access), arAllowedUsers (listed users, filled by src/timetrackersessionuser.php) or arIpUser (user per IP address). Without any of them every page answers "Invalid user". The project and support pages need allowAllUsers = true and no arAllowedUsers. The Access section of the README describes the three modes.

PHP 8.1 or newer and Twig 3 are required (twig/twig 3.30.0 in composer.lock); user.php and standup.php use the Twig 3 API, and the calendar colours no longer depend on pear/image_color2. URL_BUGTRACKER in config.dist.php is now a placeholder (https://jira.example.org/browse/) and has to be set in config.php.

Features

• In-month contract changes are taken into account when the required hours are computed (TIM-134, #14, @cweiske).
• Saxon holidays for 2026 and 2027 (TIM-137, #18, @cweiske); holidays and halved working time on 24.12. and 31.12., configurable with HALF_DAY_POLICY (#4, @cweiske).

Other changes

• The report queries use bound parameters (#31, @CybotTM).
• docker-compose.yml drops privilege escalation and runs the web container with a read-only root file system (#29, @CybotTM).
• Release workflow: pushing a signed v* tag builds the source archive with SBOMs, checksums, signatures and attestations (#33, @CybotTM). run.sh and the README name PHP 8.

Full Changelog: v1.2.0...v1.3.0