starred/WYGIWYH
1
0 Fork 0
mirror of https://github.com/eitchtee/WYGIWYH.git synced 2026-11-13 12:23:44 +01:00
Code Issues 14 Packages Projects Releases 10 Wiki Activity
1,924 Commits 6 Branches 100 Tags
8794aba1c55e4eae3150eb58ca090cce41d8138c
Commit Graph
1398 Commits
Author SHA1 Message Date
eitchtee 8794aba1c5 chore(locale): update translation files 
[skip ci] Automatically generated by Django makemessages workflow
 2026-10-12 05:47:31 +00:00
Herculino Trotta 3261e5f266 fix(transactions): apply the form amount to a paid transaction converted into an installment plan 2026-10-12 02:41:14 -03:00
Herculino Trotta 35ef1dd716 fix(transactions): apply the form amount to a paid transaction converted into a recurring transaction 2026-10-12 02:41:14 -03:00
Herculino Trotta f52a0f8cd5 locale(Portuguese (Brazil)): update translation 
Currently translated at 98.0% (801 of 817 strings)

Translation: WYGIWYH/App
Translate-URL: https://translations.herculino.com/projects/wygiwyh/app/pt_BR/
 2026-10-10 21:57:23 +00:00
eitchtee ac16359ff4 chore(locale): update translation files 
[skip ci] Automatically generated by Django makemessages workflow
 2026-10-10 21:20:53 +00:00
Herculino Trotta 174d2eb340 fix(simulator): use money mask on amount field 
Match the other amount fields by using the Alpine money mask, and parse the masked value with the user's separators.
 2026-10-10 18:19:07 -03:00
Herculino Trotta 5f71288e44 Merge pull request #612 from fxmacrodata/fxmacrodata-hardening 
fix(automatic-exchange-rates): don't follow redirects or log the key in the FXMacroData provider
 2026-10-10 17:52:17 -03:00
eitchtee ca267fedef chore(locale): update translation files 
[skip ci] Automatically generated by Django makemessages workflow
 2026-10-10 20:52:09 +00:00
Herculino Trotta 92c33a9fcc Merge pull request #615 from eitchtee/fix/oidc-unverified-email-autoconnect 
feat(auth): make OIDC email trust configurable
 2026-10-10 17:51:37 -03:00
Herculino Trotta d1bb9698a0 Merge pull request #614 from eitchtee/feat/simulation-tool 
feat: add Simulator tool
 2026-10-10 17:51:24 -03:00
Herculino Trotta c274e92f86 Merge pull request #613 from eitchtee/feat/transaction-convert-menu 
feat(transactions): convert a transaction into a quick transaction, recurring transaction or installment plan
 2026-10-10 17:51:13 -03:00
Herculino Trotta 2544820e1a Merge pull request #569 from eitchtee/copilot/fix-code-scanning-alerts 
Stop exposing exception text in OAuth dynamic client registration errors
 2026-10-10 17:50:53 -03:00
Herculino Trotta e925822574 fix(oauth): keep specific DCR errors without exposing exception text 
Parsing helpers now return (value, error) instead of raising, so no
exception object flows into the response while clients keep the
precise messages they had before.

full_clean() failures map to fixed per-field messages; redirect URI
errors surface as NON_FIELD_ERRORS from Application.clean().

Also reject non-string token_endpoint_auth_method with a 400 instead
of crashing with a TypeError.
 2026-10-10 17:48:14 -03:00
Herculino Trotta 59de9f2443 feat(auth): configure OIDC email trust 
Allow verified-only linking with OIDC_TRUST_EMAIL=false while retaining case-insensitive matching. Keep unconditional trust enabled by default for compatibility with #518; that mode retains the documented takeover risk.
 2026-10-10 17:01:52 -03:00
Herculino Trotta 6e72594ec7 test(simulator): cover baseline calculation and page 2026-10-10 15:26:59 -03:00
Herculino Trotta 916c401ce3 feat(sidebar): add simulator to tools menu 2026-10-10 15:26:59 -03:00
Herculino Trotta bdf0cf8d4c feat(simulator): add simulator tool page 
Hyperscript-driven page to simulate one-time, recurring and installment expenses or incomes over the projected balance.
 2026-10-10 15:26:59 -03:00
Herculino Trotta 81e572c8ab feat(simulator): add projected baseline calculation 
Per-currency monthly net changes from active, tracked accounts, plus the exchange rate for currencies with an exchange currency.
 2026-10-10 15:26:59 -03:00
Herculino Trotta 195da63998 feat(transactions): add Convert submenu to the transaction actions menu 
Replaces the "Add as quick transaction" action.
 2026-10-09 23:25:20 -03:00
Herculino Trotta 8c5c299312 feat(transactions): add views to convert a transaction into a quick transaction, recurring transaction or installment plan 2026-10-09 23:25:19 -03:00
Herculino Trotta cd6069f857 feat(transactions): let new recurring transactions and installment plans adopt an existing transaction 2026-10-09 23:25:19 -03:00
Robert Tidball 237f8efc6c fix(automatic-exchange-rates): don't follow redirects or log the key in the FXMacroData provider 2026-10-05 21:45:20 +11:00
eitchtee 8c631d2893 chore(locale): update translation files 
[skip ci] Automatically generated by Django makemessages workflow
 2026-10-03 17:07:08 +00:00
Robert Tidball 1c3c29d366 feat(automatic-exchange-rates): add FXMacroData as a provider 2026-10-01 15:33:26 +10:00
Herculino Trotta 17673681ea locale(Portuguese (Brazil)): update translation 
Currently translated at 99.8% (787 of 788 strings)

Translation: WYGIWYH/App
Translate-URL: https://translations.herculino.com/projects/wygiwyh/app/pt_BR/
 2026-09-13 14:34:33 +00:00
Dimitri Decrock 138fb07ae7 locale(Dutch): update translation 
Currently translated at 100.0% (788 of 788 strings)

Translation: WYGIWYH/App
Translate-URL: https://translations.herculino.com/projects/wygiwyh/app/nl/
 2026-09-13 11:48:49 +00:00
eitchtee 0de1914ed9 chore(locale): update translation files 
[skip ci] Automatically generated by Django makemessages workflow
 2026-09-13 05:22:24 +00:00
Herculino Trotta 28e05d3c95 Merge pull request #603 
feat(transactions): update cuelume; bring back improved volume user setting
 2026-09-13 02:21:56 -03:00
Herculino Trotta a2ee0b4ae6 feat(transactions): update cuelume; bring back improved volume user setting 2026-09-13 01:24:37 -03:00
eitchtee 5a1c0ab818 chore(locale): update translation files 
[skip ci] Automatically generated by Django makemessages workflow
 2026-09-12 21:03:37 +00:00
Herculino Trotta f32805ba02 Merge pull request #602 
feat(insights): replace fixed overviews with a single arrangeable overview
 2026-09-12 18:03:14 -03:00
Herculino Trotta 82211567d0 feat(insights): replace fixed overviews with a single arrangeable overview 
Categories, Tags and Entities Overview are merged into one Overview page.
Levels are chips that can be dragged (or moved with the arrow keys) to set
the hierarchy and clicked to switch off, so any ordering of the three is
reachable from the same page.

Only the results reload on change; the controls stay in place. The chip
order is kept in the session and defaults to categories by tags, matching
the old Categories Overview.
 2026-09-12 18:02:24 -03:00
eitchtee 398c783b53 chore(locale): update translation files 
[skip ci] Automatically generated by Django makemessages workflow
 2026-09-12 20:35:49 +00:00
Herculino Trotta d67482e9c6 Merge pull request #601 from eitchtee/dev 
fix(ui): reserve scrollbar space to prevent layout shift
 2026-09-12 17:35:15 -03:00
Herculino Trotta 3a5e688a90 feat(insights): add tags and entities overview 2026-09-12 14:31:12 -03:00
eitchtee 4569dc6fdc chore(locale): update translation files 
[skip ci] Automatically generated by Django makemessages workflow
 2026-09-12 17:16:12 +00:00
Herculino Trotta 6bf335169c Merge pull request #600 
feat(insights: categories-overview): searching shows the imedaite parents and children to provide better context
 2026-09-12 14:15:52 -03:00
Herculino Trotta 5404716a81 feat(insights: categories-overview): searching shows the imedaite parents and children to provide better context 2026-09-12 14:15:31 -03:00
eitchtee fa05538c56 chore(locale): update translation files 
[skip ci] Automatically generated by Django makemessages workflow
 2026-09-12 16:46:42 +00:00
Herculino Trotta d77600add6 Merge pull request #599 
feat(ui:transaction): deleting transactions is smoother and no longer requires a full list refresh
 2026-09-12 13:46:03 -03:00
Herculino Trotta 52fe81f564 feat(ui:transaction): deleting transactions is smoother and no longer requires a full list refresh 2026-09-12 13:45:41 -03:00
eitchtee c3773ccd3a chore(locale): update translation files 
[skip ci] Automatically generated by Django makemessages workflow
 2026-09-12 15:07:56 +00:00
Herculino Trotta b2d29071f0 Merge pull request #598 
feat(ui:filter): add quick clear button to filter button
 2026-09-12 12:07:28 -03:00
Herculino Trotta 0ab2a41ccc feat(ui:filter): add quick clear button to filter button 2026-09-12 12:06:55 -03:00
eitchtee e892bfd3da chore(locale): update translation files 
[skip ci] Automatically generated by Django makemessages workflow
 2026-09-12 13:00:41 +00:00
Herculino Trotta c9133c559f Merge pull request #597 
fix(ui): daily spending help text not showing up
 2026-09-12 10:00:14 -03:00
Herculino Trotta 721b2dcd8d fix(ui): daily spending help text not showing up 2026-09-12 09:57:30 -03:00
Dimitri Decrock bed2b1d516 locale(Dutch): update translation 
Currently translated at 100.0% (785 of 785 strings)

Translation: WYGIWYH/App
Translate-URL: https://translations.herculino.com/projects/wygiwyh/app/nl/
 2026-09-07 16:57:24 +00:00
eitchtee f280fcb172 chore(locale): update translation files 
[skip ci] Automatically generated by Django makemessages workflow
 2026-09-06 19:42:46 +00:00
Herculino Trotta e2f26b3629 fix(sharing): enforce object-level authorization outside the rules app 
The rules endpoints were one instance of a pattern repeated across every
SharedObject-backed app. Route the rest through the same helper.

DCA entries were the worst case and are strictly wider than the reported
rules bug: DCAEntry has an unscoped default manager, so filtering by
strategy__id alone reached entries on strategies the caller could not see
at all. No public or shared strategy was needed -- only a guessable
integer. strategy_entry_add/edit/delete now resolve through the parent
strategy with via="strategy".

Every SharedObject delete view carried an inverted condition:

    if obj.owner != request.user and request.user in obj.shared_with.all():
        obj.shared_with.remove(request.user)
    else:
        obj.delete()

An object its owner had made public matched neither branch's intent and
fell through to delete(), so any authenticated user could destroy it.
Confirmed reachable for accounts, account groups, categories, tags,
entities and DCA strategies. The owner now deletes, a shared user revokes
only their own access, and anyone else gets a 403.

The API viewsets had no object-level check at all. DjangoModelPermissions
gated them shut for ordinary users, who hold no model permissions, so this
was not reachable in a default install -- but the check belongs there
regardless, and a user granted change_account in the admin could write any
visible account. SharedObjectPermission adds it for the SharedObject
viewsets, leaving reads to SharedObjectManager.

account_toggle_untracked only flips the calling user's own row in the
untracked_by m2m, so it takes READ rather than EDIT.

Refs GHSA-83g9-vjqf-2j5q
 2026-09-01 23:15:41 -03:00