Herculino Trotta
e2f26b3629
fix(sharing): enforce object-level authorization outside the rules app
...
The rules endpoints were one instance of a pattern repeated across every
SharedObject-backed app. Route the rest through the same helper.
DCA entries were the worst case and are strictly wider than the reported
rules bug: DCAEntry has an unscoped default manager, so filtering by
strategy__id alone reached entries on strategies the caller could not see
at all. No public or shared strategy was needed -- only a guessable
integer. strategy_entry_add/edit/delete now resolve through the parent
strategy with via="strategy".
Every SharedObject delete view carried an inverted condition:
if obj.owner != request.user and request.user in obj.shared_with.all():
obj.shared_with.remove(request.user)
else:
obj.delete()
An object its owner had made public matched neither branch's intent and
fell through to delete(), so any authenticated user could destroy it.
Confirmed reachable for accounts, account groups, categories, tags,
entities and DCA strategies. The owner now deletes, a shared user revokes
only their own access, and anyone else gets a 403.
The API viewsets had no object-level check at all. DjangoModelPermissions
gated them shut for ordinary users, who hold no model permissions, so this
was not reachable in a default install -- but the check belongs there
regardless, and a user granted change_account in the admin could write any
visible account. SharedObjectPermission adds it for the SharedObject
viewsets, leaving reads to SharedObjectManager.
account_toggle_untracked only flips the calling user's own row in the
untracked_by m2m, so it takes READ rather than EDIT.
Refs GHSA-83g9-vjqf-2j5q
2026-09-01 23:15:41 -03:00
Herculino Trotta
cd48edddab
feat(transactions): add htmx filter presets
2026-08-16 01:40:11 -03:00
Herculino Trotta
9e135560fe
feat(transactions): add filter preset model
2026-08-16 01:40:03 -03:00
obervinov
11a6b3faa6
fix(transactions): recurring tags and entities dropped when generated for another user
2026-08-12 22:33:01 +04:00
Herculino Trotta
6a19381672
feat(transactions): add attachments
2026-06-06 04:33:06 -03:00
pawelaugustyn
9ecf8279b4
feat: default account for new transactions
2026-02-15 22:59:18 +01:00
Herculino Trotta
b074ef7929
feat: add late section to monthly and all views (w/ default ordering)
2026-01-10 02:52:46 -03:00
Herculino Trotta
dd6a390e6b
fix(transactions): empty internal_id raises duplicate error when editing via django admin
2026-01-09 23:25:13 -03:00
Herculino Trotta
a2871d5289
feat(transactions:filter): add filter for muted and unmuted transactions
2025-12-28 13:09:41 -03:00
Herculino Trotta
2076903740
refactor: order management lists by name instead of id
2025-12-27 23:43:57 -03:00
Herculino Trotta
edcad37926
fix: recurring transactions not adding entities or tags to created transactions
2025-12-19 23:55:30 -03:00
Herculino Trotta
dc33fda5d3
feat: prevent background tasks from running all at once
2025-12-13 15:07:38 -03:00
Herculino Trotta
aed3fb11fe
feat: accept query params on standalone add transaction page
2025-12-06 16:17:37 -03:00
Herculino Trotta
49f28834e9
fix: unable to create transactions with an empty reference date when importing
...
fixes #410
2025-11-26 16:39:51 -03:00
Herculino Trotta
af72e3f44e
fix(quick_transactions): ignore internal_id
2025-11-22 00:44:57 -03:00
Herculino Trotta
0b0d760bab
feat: guess what, more changes
2025-11-11 20:21:01 -03:00
Herculino Trotta
7e37948616
feat: more changes and fixes
2025-11-09 15:31:50 -03:00
Herculino Trotta
cd54df6f2d
feat: more changes and fixes
2025-11-08 14:06:01 -03:00
Herculino Trotta
a878af28f1
feat: more changes and fixes
2025-11-05 13:09:31 -03:00
Herculino Trotta
89b2d0118d
feat: another batch of fixes
2025-11-02 03:03:22 -03:00
Herculino Trotta
a63367a772
feat: first batch of work
2025-11-01 03:15:44 -03:00
Herculino Trotta
637c62319b
feat(transactions): Try to convert amount to the expected Decimal if it is a str, int or float
2025-09-14 01:23:49 -03:00
Herculino Trotta
2235bdeabb
changes
2025-09-02 23:17:04 -03:00
Herculino Trotta
d724300513
changes
2025-09-02 15:54:45 -03:00
Herculino Trotta
c738f5ee29
changes
2025-09-02 09:47:27 -03:00
Herculino Trotta
72904266bf
feat(rules): add optional rules ordering
2025-08-31 09:06:48 -03:00
Herculino Trotta
4565dc770b
fix(transactions:quick-transactions): error when saving due to wrong field definition
2025-08-27 23:16:06 -03:00
Herculino Trotta
37f4ead058
feat(transactions): filter for unset category/tag/entity
...
implements #327
2025-08-15 12:29:32 -03:00
Herculino Trotta
55c4b920ee
feat(accounts): add option for untracking accounts on a per user basis
2025-08-09 03:35:39 -03:00
Herculino Trotta
d2e5c1d6b3
feat(transactions:recurring): try to create transactions on update
2025-08-07 23:35:57 -03:00
Herculino Trotta
2f33b5989f
feat(transactions): add menu itens for quickly changing transaction date
2025-08-07 15:30:42 -03:00
Herculino Trotta
a544dc4943
feat(tasks:check_for_updates): add env variable to disable checking
2025-08-06 16:58:58 -03:00
Herculino Trotta
9353d498ef
Merge pull request #313
...
feat(transactions:recurring): allow to set how many future instances of a recurring transaction to create in advance
2025-08-06 13:20:58 -03:00
Herculino Trotta
4f6903e8e4
feat(transactions:recurring): Allow to set how many future instances of a recurring transaction to create in advance
2025-08-06 13:13:59 -03:00
Herculino Trotta
2cdcc4ee26
fix: bulk delete not working
2025-08-06 11:41:57 -03:00
Herculino Trotta
5b6c123fa1
refactor: properly name shareable objects generic fields
2025-07-27 23:19:39 -03:00
Herculino Trotta
8db885f47d
feat: add quick transactions to django admin and properly name it
...
+ fix some wrongly assigned admin instances
2025-07-27 23:18:42 -03:00
Herculino Trotta
c2510b2261
feat: allow to select if transfer transactions are muted or not on creation
2025-07-21 10:15:02 -03:00
Herculino Trotta
5412e5b12c
feat: improve ordering when searching existing transactions on DCA creation
2025-07-20 00:24:31 -03:00
Herculino Trotta
d8234950c6
feat: quickly add an existing transaction as a model for quick transactions
...
Use the dropdown menu on a transaction
2025-07-19 16:22:50 -03:00
Herculino Trotta
ef5f3580a0
feat: allow single transactions to be hidden from summaries
...
Control is done via the dropdown menu on a transaction item
Transfers are hidden by default
fix #274
2025-07-19 16:19:11 -03:00
Herculino Trotta
756de12835
feat: creating a quick transaction triggers the proper rule
2025-06-28 00:04:45 -03:00
Herculino Trotta
d3b354e2b8
feat: add quick transactions
2025-06-20 02:01:09 -03:00
Herculino Trotta
1213ffebeb
feat(transactions:calculations): add deep_search param to return consolidated amounts for currencies without transactions / sort results by their final total
2025-05-12 20:43:47 -03:00
Herculino Trotta
59ce50299a
fix(transactions): duplicate totals when account is shared with owner or owner-less and shared
...
#247
2025-04-27 15:57:55 -03:00
Herculino Trotta
d9c505ac79
fix(transactions): save and add similar not initializing dates properly
...
Fixes #248
2025-04-21 15:44:42 -03:00
Herculino Trotta
4b7ca61c29
feat(transactions): add another transaction (or a similar one) right after adding one
2025-04-20 15:55:50 -03:00
Herculino Trotta
86f0c4365e
feat(transactions): add transaction owner to recurring and installments
2025-04-13 12:48:18 -03:00
Herculino Trotta
aea149bd13
fix(transactions): recurring transactions not getting created
2025-04-13 12:47:01 -03:00
Herculino Trotta
73e8fdbf04
feat: alphabetically order most models by default
...
#207
2025-03-09 18:55:29 -03:00
Herculino Trotta