Herculino Trotta
e2f26b3629
fix(sharing): enforce object-level authorization outside the rules app
...
The rules endpoints were one instance of a pattern repeated across every
SharedObject-backed app. Route the rest through the same helper.
DCA entries were the worst case and are strictly wider than the reported
rules bug: DCAEntry has an unscoped default manager, so filtering by
strategy__id alone reached entries on strategies the caller could not see
at all. No public or shared strategy was needed -- only a guessable
integer. strategy_entry_add/edit/delete now resolve through the parent
strategy with via="strategy".
Every SharedObject delete view carried an inverted condition:
if obj.owner != request.user and request.user in obj.shared_with.all():
obj.shared_with.remove(request.user)
else:
obj.delete()
An object its owner had made public matched neither branch's intent and
fell through to delete(), so any authenticated user could destroy it.
Confirmed reachable for accounts, account groups, categories, tags,
entities and DCA strategies. The owner now deletes, a shared user revokes
only their own access, and anyone else gets a 403.
The API viewsets had no object-level check at all. DjangoModelPermissions
gated them shut for ordinary users, who hold no model permissions, so this
was not reachable in a default install -- but the check belongs there
regardless, and a user granted change_account in the admin could write any
visible account. SharedObjectPermission adds it for the SharedObject
viewsets, leaving reads to SharedObjectManager.
account_toggle_untracked only flips the calling user's own row in the
untracked_by m2m, so it takes READ rather than EDIT.
Refs GHSA-83g9-vjqf-2j5q
2026-09-01 23:15:41 -03:00
Herculino Trotta
cd48edddab
feat(transactions): add htmx filter presets
2026-08-16 01:40:11 -03:00
Herculino Trotta
6a19381672
feat(transactions): add attachments
2026-06-06 04:33:06 -03:00
Herculino Trotta
b074ef7929
feat: add late section to monthly and all views (w/ default ordering)
2026-01-10 02:52:46 -03:00
Herculino Trotta
2076903740
refactor: order management lists by name instead of id
2025-12-27 23:43:57 -03:00
Herculino Trotta
aed3fb11fe
feat: accept query params on standalone add transaction page
2025-12-06 16:17:37 -03:00
Herculino Trotta
af72e3f44e
fix(quick_transactions): ignore internal_id
2025-11-22 00:44:57 -03:00
Herculino Trotta
d724300513
changes
2025-09-02 15:54:45 -03:00
Herculino Trotta
c738f5ee29
changes
2025-09-02 09:47:27 -03:00
Herculino Trotta
55c4b920ee
feat(accounts): add option for untracking accounts on a per user basis
2025-08-09 03:35:39 -03:00
Herculino Trotta
2f33b5989f
feat(transactions): add menu itens for quickly changing transaction date
2025-08-07 15:30:42 -03:00
Herculino Trotta
2cdcc4ee26
fix: bulk delete not working
2025-08-06 11:41:57 -03:00
Herculino Trotta
5412e5b12c
feat: improve ordering when searching existing transactions on DCA creation
2025-07-20 00:24:31 -03:00
Herculino Trotta
d8234950c6
feat: quickly add an existing transaction as a model for quick transactions
...
Use the dropdown menu on a transaction
2025-07-19 16:22:50 -03:00
Herculino Trotta
ef5f3580a0
feat: allow single transactions to be hidden from summaries
...
Control is done via the dropdown menu on a transaction item
Transfers are hidden by default
fix #274
2025-07-19 16:19:11 -03:00
Herculino Trotta
756de12835
feat: creating a quick transaction triggers the proper rule
2025-06-28 00:04:45 -03:00
Herculino Trotta
d3b354e2b8
feat: add quick transactions
2025-06-20 02:01:09 -03:00
Herculino Trotta
d9c505ac79
fix(transactions): save and add similar not initializing dates properly
...
Fixes #248
2025-04-21 15:44:42 -03:00
Herculino Trotta
4b7ca61c29
feat(transactions): add another transaction (or a similar one) right after adding one
2025-04-20 15:55:50 -03:00
Herculino Trotta
020dd74f80
feat: multi tenancy support
2025-03-08 12:03:17 -03:00
Herculino Trotta
195a8a68d6
feat: insight page
2025-02-16 00:14:23 -03:00
Herculino Trotta
865618e054
feat(dca): link transactions to DCA
2025-02-15 00:41:06 -03:00
Herculino Trotta
f3bcef534e
feat(internal): trigger rules on bulk actions
2025-02-14 00:34:51 -03:00
Herculino Trotta
546ed5c6af
fix(transactions): bulk (un)paying transactions doesn't trigger update rules
2025-02-09 23:38:22 -03:00
Herculino Trotta
04ae7337f5
fix(transactions): paying transaction doesn't trigger update rules
2025-02-09 23:33:57 -03:00
Herculino Trotta
0a3e47819a
feat: add trash can to see deleted transactions
2025-02-01 11:12:43 -03:00
Herculino Trotta
39c1f634b6
feat: add account and currency info to monthly view
2025-02-01 00:51:16 -03:00
Herculino Trotta
b5671fcd0e
fix: 'tags__id' does not resolve to an item that supports prefetching
2025-01-30 00:26:07 -03:00
Herculino Trotta
48408cead8
fix: 'tags__id' does not resolve to an item that supports prefetching
2025-01-30 00:22:37 -03:00
Herculino Trotta
1140d9c896
feat: improve transactions list loading time
...
Prefetch more values and allow them to be cached
2025-01-29 13:46:06 -03:00
Herculino Trotta
5bf7f9f272
fix: unable to load transactions on first login
2025-01-29 00:56:06 -03:00
Herculino Trotta
19a65ac45f
feat: reduce db queries when saving order on session
2025-01-29 00:12:47 -03:00
Herculino Trotta
43382d2ffe
feat: store selected "order by" on session
...
Closes #95
2025-01-28 20:05:00 -03:00
Herculino Trotta
187c56c96c
refactor: remove user attr from datepicker
...
since monkey patched get_format already does what we want
2025-01-27 13:25:06 -03:00
Herculino Trotta
5c46a2c15e
feat: pluralize toast for bulk edit
2025-01-25 13:48:32 -03:00
Herculino Trotta
0fac78d15a
feat: add bulk duplicate action and toasts for existing actions
2025-01-25 13:44:39 -03:00
Herculino Trotta
73ca418dc8
fix: clear internal_id when duplicating
2025-01-25 13:42:23 -03:00
Herculino Trotta
2b6be8c6ac
feat: tidy up transactions action bar
2025-01-25 12:43:53 -03:00
Herculino Trotta
1ef7a780fb
feat: bulk edit selected transactions
2025-01-25 12:41:55 -03:00
Herculino Trotta
0857b44fc3
feat: add new /add/ endpoint for quickly adding new transactions
2025-01-24 22:50:39 -03:00
Herculino Trotta
97465c07fe
fix: import preset not working behind nginx due to long url/csrf missing
2025-01-24 16:06:47 -03:00
Herculino Trotta
60fe4c9681
feat(app): allow changing date and datetime format as a user setting
2025-01-20 19:35:22 -03:00
Herculino Trotta
315f4e1269
feat: add a duplicate/clone action to each transaction
2025-01-17 23:53:39 -03:00
Herculino Trotta
2cb8100129
feat(recurring-transaction): when explicitly finishing, delete any upcoming unpaid transactions
2025-01-11 13:40:10 -03:00
Herculino Trotta
afbbf7b25d
feat(recurring-transaction): when unpause start generating transactions from today or from existing date, whichever is higher
2025-01-11 13:38:51 -03:00
Herculino Trotta
baae6bb96a
feat(entities): add tab to show archived entities
2025-01-05 01:43:24 -03:00
Herculino Trotta
f5132e24bd
feat(tags): add tab to show archived tags
2025-01-05 01:36:30 -03:00
Herculino Trotta
0fc8b0ee49
feat(tags): add tab to show archived tags
2025-01-05 01:35:25 -03:00
Herculino Trotta
037014d024
feat(categories): add tab to show archived categories
2025-01-05 01:22:14 -03:00
Herculino Trotta
e461e87688
feat(transactions:all): add summary
2024-12-25 23:36:28 -03:00
Herculino Trotta