Herculino Trotta 66351aee49 fix(sharing): clarify what shared and public visibility allow ...

"Only editable by the owner" read as covering an account's transactions
too, which led to GHSA-36w2-769w-h62g being reported. Sharing an account
or making it public deliberately opens its ledger to everyone who can
see it; only the object itself stays owner-only.

State that in the generic visibility help text, and spell out the
account case on the account share panel.

2026-11-14 03:18:37 -03:00

..

decorators

feat: user management screen; allow users to edit their profile

2025-04-13 19:00:25 -03:00

fields

fix(forms): resolve dynamic select values from the form's queryset

2026-11-08 02:26:40 -03:00

functions

fix(rules): enforce object-level authorization on rule endpoints

2026-09-01 21:25:46 -03:00

management

chore(demo): add sub-transaction examples to the demo data

2026-11-14 02:13:22 -03:00

middleware

feat: multi tenancy support

2025-03-08 12:03:17 -03:00

migrations

initial commit

2024-09-26 11:00:40 -03:00

templatetags

fix(updates): keep update banner across page loads and restarts

2026-11-02 17:24:28 -03:00

tests

Merge pull request #680 from eitchtee/fix/rule-dry-run-connection

2026-11-14 02:37:12 -03:00

utils

fix(datepicker): wrong datetime format

2025-01-26 20:53:16 -03:00

widgets

feat(transactions): allow filtering the transaction picker search

2026-11-10 21:55:29 -03:00

__init__.py

initial commit

2024-09-26 11:00:40 -03:00

admin.py

feat(sharing): add action for turning shareable objects into public or private on Django Admin

2025-07-27 23:17:14 -03:00

apps.py

fix(updates): keep update banner across page loads and restarts

2026-11-02 17:24:28 -03:00

checks.py

feat(app): add sanity checks for env variables

2025-12-26 09:55:57 -03:00

forms.py

fix(sharing): clarify what shared and public visibility allow

2026-11-14 03:18:37 -03:00

models.py

fix(rules): enforce object-level authorization on rule endpoints

2026-09-01 21:25:46 -03:00

oauth_views.py

Compare the DCR initial access token as bytes so a non-ASCII token gets a 401, not a 500

2026-11-08 08:46:34 +00:00

procrastinate.py

fix(rules): keep the connection when tasks run inside a transaction

2026-11-14 02:11:15 -03:00

tasks.py

fix(updates): keep update banner across page loads and restarts

2026-11-02 17:24:28 -03:00

urls.py

feat: add "Clear cache" button to user menu

2025-01-27 21:49:32 -03:00

views.py

feat: add today button to MonthYearPicker

2025-08-15 22:54:04 -03:00