starred/WYGIWYH
1
0
Fork 0
mirror of https://github.com/eitchtee/WYGIWYH.git synced 2026-09-08 19:01:48 +02:00
Code Issues 14 Packages Projects Releases 10 Wiki Activity
1,836 Commits 22 Branches 94 Tags
039ad225d3901e3bc762d0bceb8b49d7bb8be668
Commit Graph
1836 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Herculino Trotta 039ad225d3 test(rules): cover object-level authorization for transaction rules 
Regression tests for GHSA-83g9-vjqf-2j5q, one per endpoint the advisory
named plus the delete and view paths found alongside them: a non-owner
gets 403 on every mutation of a public or shared rule, and the object is
asserted unchanged afterwards.

Also covers the parts that are easy to regress in the other direction:
shared users keep read access, a shared user deleting only revokes their
own access, unowned rules stay claimable, and children of invisible rules
answer 404 rather than 403.

SharedObjectPredicateParityTests asserts is_visible_to agrees with
SharedObjectManager across every owner/visibility/shared combination.
The manager builds a Q and the predicate tests an instance, so they
cannot share an implementation and can otherwise drift apart.
 2026-09-01 21:43:13 -03:00
Herculino Trotta 18d4ab7d11 fix(rules): enforce object-level authorization on rule endpoints 
SharedObjectManager scopes querysets to what a user may see, which
includes other people's public and shared-with-them objects. Several
mutating rule endpoints treated that visibility as permission to write.

Generalise get_owned_object_or_403 into get_shared_object_or_error, which
takes an explicit access level instead of inferring one:

- READ requires the object to be visible; denial is 404 so the response
  does not confirm that an id exists.
- EDIT requires ownership; denial is 403, but only after the visibility
  check, so 403 never leaks the existence of an invisible object. This
  matters for TransactionRuleAction, whose manager is unscoped.

The previous owner_path resolved to a User and discarded the object, so
it could not express visibility at all. via= now points at the governing
SharedObject and is resolved with a plain getattr, so an unresolvable
path raises instead of silently granting access.

is_visible_to/is_editable_by replace is_accessible_by, which was never
called and tested visibility == "shared", a value that does not exist in
Visibility.

Also fixes two further holes in the same module:

- transaction_rule_delete fell through to delete() whenever the caller
  was not in shared_with, so any user could delete a public rule. Now
  only the owner deletes; a shared user revokes their own access.
- transaction_rule_view was read-only but is now explicitly READ, so
  rules shared with a user stay viewable.

The activate/deactivate control is hidden for rules the user does not
own, instead of rendering a button that always fails.

Refs GHSA-83g9-vjqf-2j5q
 2026-09-01 21:25:46 -03:00
Moshe Levi 68a9286ce5 Fix BOLA on transaction-rule endpoints via get_owned_object_or_403 
Add apps.common.functions.get_owned_object_or_403, an ownership-enforcing
variant of get_object_or_404, and apply it across every rules handler that
resolved a TransactionRule / (UpdateOrCreate)TransactionRuleAction from a URL id
without an owner check. Mirrors the check in transaction_rule_edit
(obj.owner and obj.owner != request.user); objects with no owner remain
accessible, preserving existing behaviour. Nested ownership (actions owned via
their parent rule) is handled with owner_path='rule.owner'.
 2026-08-31 20:14:40 +03:00
Herculino Trotta 1357688e7b Merge pull request #591 from eitchtee/dependabot/uv/sqlparse-0.6.0 
build(deps): bump sqlparse from 0.5.5 to 0.6.0
 2026-08-30 15:13:33 -03:00
Herculino Trotta ba1f421ad3 Merge pull request #590 from eitchtee/weblate 
Translations update from Weblate
 2026-08-30 15:13:24 -03:00
renardspark f60f86a5cb locale(French): update translation 
Currently translated at 98.8% (776 of 785 strings)

Translation: WYGIWYH/App
Translate-URL: https://translations.herculino.com/projects/wygiwyh/app/fr/
 2026-08-23 16:57:26 +00:00
renardspark 5588eb33b1 locale(French): update translation 
Currently translated at 98.8% (776 of 785 strings)

Translation: WYGIWYH/App
Translate-URL: https://translations.herculino.com/projects/wygiwyh/app/fr/
 2026-08-23 15:57:24 +00:00
renardspark 934e6bd8e0 locale(French): update translation 
Currently translated at 98.8% (776 of 785 strings)

Translation: WYGIWYH/App
Translate-URL: https://translations.herculino.com/projects/wygiwyh/app/fr/
 2026-08-23 14:57:25 +00:00
dependabot[bot] 7933f1c316 build(deps): bump sqlparse from 0.5.5 to 0.6.0 
Bumps [sqlparse](https://github.com/andialbrecht/sqlparse) from 0.5.5 to 0.6.0.
- [Changelog](https://github.com/andialbrecht/sqlparse/blob/master/CHANGELOG)
- [Commits](https://github.com/andialbrecht/sqlparse/compare/0.5.5...0.6.0)

---
updated-dependencies:
- dependency-name: sqlparse
  dependency-version: 0.6.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-17 21:31:28 +00:00
Dimitri Decrock 00f87bea3d locale(Dutch): update translation 
Currently translated at 100.0% (785 of 785 strings)

Translation: WYGIWYH/App
Translate-URL: https://translations.herculino.com/projects/wygiwyh/app/nl/
 2026-08-17 15:57:28 +00:00
Herculino Trotta 53ed0d791a Merge pull request #589 from eitchtee/weblate 
Translations update from Weblate
0.23.0 		2026-08-16 19:03:53 -03:00
Herculino Trotta 5147d939ef locale(Portuguese (Brazil)): update translation 
Currently translated at 100.0% (785 of 785 strings)

Translation: WYGIWYH/App
Translate-URL: https://translations.herculino.com/projects/wygiwyh/app/pt_BR/
 2026-08-16 22:03:32 +00:00
eitchtee 716bd6f57f chore(locale): update translation files 
[skip ci] Automatically generated by Django makemessages workflow
 2026-08-16 04:46:49 +00:00
Herculino Trotta ded4cb37d5 Merge pull request #588 from eitchtee/feat/filter-presets 
feat(transactions): add filter presets
 2026-08-16 01:46:18 -03:00
Herculino Trotta cd48edddab feat(transactions): add htmx filter presets 2026-08-16 01:40:11 -03:00
Herculino Trotta 9e135560fe feat(transactions): add filter preset model 2026-08-16 01:40:03 -03:00
eitchtee bdbccdec16 chore(locale): update translation files 
[skip ci] Automatically generated by Django makemessages workflow
 2026-08-15 18:12:40 +00:00
Herculino Trotta 907c511b59 Merge pull request #587 
feat(dca): add chart zoom navigation
 2026-08-15 15:12:14 -03:00
Herculino Trotta 33f0904a0f feat(dca): add chart zoom navigation 2026-08-15 15:10:10 -03:00
eitchtee 1c4f23a69e chore(locale): update translation files 
[skip ci] Automatically generated by Django makemessages workflow
 2026-08-15 17:43:26 +00:00
Herculino Trotta 8373732964 Merge pull request #586 
Add consolidated currency chart lines
 2026-08-15 14:42:54 -03:00
Herculino Trotta 8e09f3e8d8 feat(net-worth): add consolidated chart lines 2026-08-15 14:36:13 -03:00
Herculino Trotta 1516fe0281 Merge pull request #585 
fix(tools:calculator): prevent close button from drifiting to the right
 2026-08-15 11:41:44 -03:00
Herculino Trotta 3bd16602a0 fix(tools:calculator): prevent close button from drifiting to the right 2026-08-15 11:41:15 -03:00
Herculino Trotta 83c2b599d7 Merge pull request #584 
fix(docker:dev): handle CRLF endings on vite entrypoint
 2026-08-15 01:32:50 -03:00
Herculino Trotta f9eab3ce17 fix(docker:dev): handle CRLF endings on vite entrypoint 2026-08-15 01:32:02 -03:00
Herculino Trotta 62a33ddd2c Merge pull request #583 
feat(monthly): show asset accounts/currencies on specific sumaries
 2026-08-15 01:31:30 -03:00
Herculino Trotta ea3e9fd68f feat(monthly): show asset accounts/currencies on specific sumaries 2026-08-15 01:30:57 -03:00
Herculino Trotta d71bf3ccb3 Merge pull request #570 from eitchtee/dependabot/npm_and_yarn/frontend/immutable-5.1.9 
build(deps): bump immutable from 5.1.6 to 5.1.9 in /frontend
 2026-08-13 00:05:53 -03:00
Herculino Trotta 350d78356c Merge pull request #576 from eitchtee/dependabot/npm_and_yarn/frontend/postcss-8.5.26 
build(deps): bump postcss from 8.5.15 to 8.5.26 in /frontend
 2026-08-13 00:04:37 -03:00
Herculino Trotta 91dfba519c Merge branch 'main' into dependabot/npm_and_yarn/frontend/postcss-8.5.26 2026-08-13 00:04:24 -03:00
Herculino Trotta 0c9b41182b Merge pull request #575 from eitchtee/dependabot/uv/cryptography-50.0.0 
build(deps): bump cryptography from 48.0.1 to 50.0.0
 2026-08-13 00:03:51 -03:00
Herculino Trotta 7a900908dd Merge pull request #578 from eitchtee/dependabot/uv/django-5.2.16 
build(deps): bump django from 5.2.15 to 5.2.16
 2026-08-13 00:03:28 -03:00
Herculino Trotta dcd52ec189 Merge pull request #580 from eitchtee/dependabot/npm_and_yarn/frontend/nanoid-3.3.18 
build(deps): bump nanoid from 3.3.12 to 3.3.18 in /frontend
 2026-08-13 00:03:18 -03:00
Herculino Trotta 93e73b9aa6 Merge pull request #582 from eitchtee/dependabot/uv/tablib-3.10.0 
build(deps): bump tablib from 3.9.0 to 3.10.0
 2026-08-13 00:03:02 -03:00
eitchtee 7947d5f874 chore(locale): update translation files 
[skip ci] Automatically generated by Django makemessages workflow
 2026-08-13 03:01:16 +00:00
Herculino Trotta 2ab6621205 Merge pull request #581 from obervinov/fix/recurring-tags-scheduler 
fix: recurring tags and entities dropped when generated for another user
 2026-08-13 00:00:48 -03:00
Herculino Trotta 39c15eedec Merge pull request #579 from eitchtee/weblate 
Translations update from Weblate
 2026-08-12 23:59:05 -03:00
dependabot[bot] 6dcf5a63f8 build(deps): bump tablib from 3.9.0 to 3.10.0 
Bumps [tablib](https://github.com/jazzband/tablib) from 3.9.0 to 3.10.0.
- [Release notes](https://github.com/jazzband/tablib/releases)
- [Changelog](https://github.com/jazzband/tablib/blob/master/HISTORY.md)
- [Commits](https://github.com/jazzband/tablib/compare/v3.9.0...v3.10.0)

---
updated-dependencies:
- dependency-name: tablib
  dependency-version: 3.10.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-12 19:48:53 +00:00
obervinov 11a6b3faa6 fix(transactions): recurring tags and entities dropped when generated for another user 2026-08-12 22:33:01 +04:00
dependabot[bot] 9b1312b744 build(deps): bump nanoid from 3.3.12 to 3.3.18 in /frontend 
Bumps [nanoid](https://github.com/ai/nanoid) from 3.3.12 to 3.3.18.
- [Release notes](https://github.com/ai/nanoid/releases)
- [Changelog](https://github.com/ai/nanoid/blob/3.3.18/CHANGELOG.md)
- [Commits](https://github.com/ai/nanoid/compare/3.3.12...3.3.18)

---
updated-dependencies:
- dependency-name: nanoid
  dependency-version: 3.3.18
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-11 23:14:09 +00:00
GitEbu 72707f46e6 locale(German): update translation 
Currently translated at 86.2% (670 of 777 strings)

Translation: WYGIWYH/App
Translate-URL: https://translations.herculino.com/projects/wygiwyh/app/de/
 2026-08-10 12:57:27 +00:00
dependabot[bot] cf908ae87e build(deps): bump django from 5.2.15 to 5.2.16 
Bumps [django](https://github.com/django/django) from 5.2.15 to 5.2.16.
- [Commits](https://github.com/django/django/compare/5.2.15...5.2.16)

---
updated-dependencies:
- dependency-name: django
  dependency-version: 5.2.16
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-10 03:07:57 +00:00
dependabot[bot] b145d10fbd build(deps): bump postcss from 8.5.15 to 8.5.26 in /frontend 
Bumps [postcss](https://github.com/postcss/postcss) from 8.5.15 to 8.5.26.
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/postcss/postcss/compare/8.5.15...8.5.26)

---
updated-dependencies:
- dependency-name: postcss
  dependency-version: 8.5.26
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-07 07:51:02 +00:00
dependabot[bot] ee39dcf9ef build(deps): bump cryptography from 48.0.1 to 50.0.0 
Bumps [cryptography](https://github.com/pyca/cryptography) from 48.0.1 to 50.0.0.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/pyca/cryptography/compare/48.0.1...50.0.0)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-version: 50.0.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-05 03:39:39 +00:00
dependabot[bot] 5d330ddfbf build(deps): bump immutable from 5.1.6 to 5.1.9 in /frontend 
Bumps [immutable](https://github.com/immutable-js/immutable-js) from 5.1.6 to 5.1.9.
- [Release notes](https://github.com/immutable-js/immutable-js/releases)
- [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/immutable-js/immutable-js/compare/v5.1.6...v5.1.9)

---
updated-dependencies:
- dependency-name: immutable
  dependency-version: 5.1.9
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-24 06:23:28 +00:00
eitchtee 14011c2f60 chore(locale): update translation files 
[skip ci] Automatically generated by Django makemessages workflow
 2026-07-18 18:43:53 +00:00
Herculino Trotta a25adafe3b Merge pull request #568 
feat(automatic-exchange-rates): Add Yahoo Finance as a provider via yfinance
 2026-07-18 15:43:28 -03:00
Herculino Trotta 743951a862 feat(automatic-exchange-rates): Add Yahoo Finance as a provider via yfinance 2026-07-18 15:42:51 -03:00
Herculino Trotta 74d3d5fcf9 Merge pull request #567 
feat(docker:dev): npm dependencies are installed when container starts
 2026-07-17 21:30:29 -03:00