Dries Peeters 89623682c8 fix(security): sandbox Jinja2 for database-backed PDF and email templates ...

Add render_sandboxed_string() using SandboxedEnvironment so stored invoice and
quote HTML, ReportLab text templates, admin PDF previews, and invoice email
HTML are not evaluated with Flask's full template globals (mitigating SSTI).

Add regression tests for sandbox behavior and demo user permissions.

2026-04-24 21:13:29 +02:00

..

models

fix: CI tests, code quality, and duplicate DB indexes

2026-03-15 10:51:52 +01:00

test_integration

feat(quotes): invoice-style line items, costs, and extra goods (#585)

2026-04-12 14:00:12 +02:00

test_models

fix(inventory): harden purchase-order creation and stock idempotency

2026-03-26 14:52:06 +01:00

test_repositories

test: extend fixtures and add scope, auth, recurring, reports tests

2026-03-15 09:37:15 +01:00

test_routes

feat(api): clarify /api vs /api/v1 and reduce duplication

2026-04-16 15:36:01 +02:00

test_services

feat: smart in-app notifications, value dashboard stats, and search scope helpers

2026-04-15 12:15:23 +02:00

test_utils

fix(auth): scope client portal users to their assigned client

2026-04-24 16:15:24 +02:00

conftest.py

feat: smart in-app notifications, value dashboard stats, and search scope helpers

2026-04-15 12:15:23 +02:00

factories.py

test: extend fixtures and add scope, auth, recurring, reports tests

2026-03-15 09:37:15 +01:00

smoke_test_email.py

feat(admin): persist test recipient and send invoice email template tests

2026-03-27 06:39:16 +01:00

smoke_test_prepaid_hours.py

…

smoke_test_project_dashboard.py

Update tests

2026-03-08 06:50:42 +01:00

smoke_test_user_settings.py

Update tests

2026-03-08 06:50:42 +01:00

test_activity_feed.py

fix(activity-feed): validate date params and return 400 for invalid API input

2026-03-16 16:42:53 +01:00

test_admin_dashboard_charts.py

test: extend fixtures and add scope, auth, recurring, reports tests

2026-03-15 09:37:15 +01:00

test_admin_email_routes.py

feat(admin): persist test recipient and send invoice email template tests

2026-03-27 06:39:16 +01:00

test_admin_settings_logo.py

…

test_admin_users.py

fix(smoke): resolve 3 failing smoke tests (dashboard cache, password reset)

2026-01-25 09:13:14 +01:00

test_analytics.py

feat(telemetry): migrate analytics pipeline from PostHog to OTLP

2026-03-26 17:01:55 +01:00

test_api_audit_activities_v1.py

Update tests

2026-03-08 06:50:42 +01:00

test_api_budget_alerts_v1.py

Update tests

2026-03-08 06:50:42 +01:00

test_api_calendar_v1.py

Update tests

2026-03-08 06:50:42 +01:00

test_api_client_notes_v1.py

Update tests

2026-03-08 06:50:42 +01:00

test_api_comments_v1.py

Update tests

2026-03-08 06:50:42 +01:00

test_api_comprehensive.py

docs(api): document value dashboard; fix project tasks API test

2026-04-16 15:09:03 +02:00

test_api_contract.py

test: extend fixtures and add scope, auth, recurring, reports tests

2026-03-15 09:37:15 +01:00

test_api_credit_notes_v1.py

Update tests

2026-03-08 06:50:42 +01:00

test_api_deprecation_headers.py

feat(api): clarify /api vs /api/v1 and reduce duplication

2026-04-16 15:36:01 +02:00

test_api_expenses_v1.py

Update tests

2026-03-08 06:50:42 +01:00

test_api_favorites_v1.py

Update tests

2026-03-08 06:50:42 +01:00

test_api_invoice_templates_api_v1.py

Update tests

2026-03-08 06:50:42 +01:00

test_api_invoice_templates_v1.py

Update tests

2026-03-08 06:50:42 +01:00

test_api_invoices_v1.py

Update tests

2026-03-08 06:50:42 +01:00

test_api_kanban_v1.py

Update tests

2026-03-08 06:50:42 +01:00

test_api_mileage_v1.py

Update tests

2026-03-08 06:50:42 +01:00

test_api_payments_v1.py

Update tests

2026-03-08 06:50:42 +01:00

test_api_per_diem_v1.py

Update tests

2026-03-08 06:50:42 +01:00

test_api_project_costs_v1.py

Update tests

2026-03-08 06:50:42 +01:00

test_api_purchase_orders_v1.py

fix(inventory): harden purchase-order creation and stock idempotency

2026-03-26 14:52:06 +01:00

test_api_recurring_invoices_v1.py

Update tests

2026-03-08 06:50:42 +01:00

test_api_route_contract.py

fix(api): align client search, OpenAPI version, and Client construction

2026-04-15 12:57:01 +02:00

test_api_saved_filters_v1.py

Update tests

2026-03-08 06:50:42 +01:00

test_api_tax_currency_v1.py

Update tests

2026-03-08 06:50:42 +01:00

test_api_time_entry_templates_v1.py

Update tests

2026-03-08 06:50:42 +01:00

test_api_v1_inventory_movements.py

Update tests

2026-03-08 06:50:42 +01:00

test_api_v1.py

fix(apps): harden desktop and mobile server connectivity

2026-04-16 19:59:20 +02:00

test_audit_log_model.py

…

test_audit_log_routes.py

…

test_audit_logging.py

fix: restore audit logging by using before_flush for updates/deletes

2026-01-21 13:59:13 +01:00

test_audit_trail_smoke.py

fix(tests): resolve smoke test failures (audit, session, PDF)

2026-01-25 08:59:54 +01:00

test_basic.py

…

test_budget_alert_model.py

…

test_budget_alerts_smoke.py

Update tests

2026-03-08 06:50:42 +01:00

test_budget_forecasting.py

…

test_bulk_task_operations.py

test: add bulk task operations tests

2026-03-06 15:46:07 +01:00

test_calendar_event_model.py

…

test_calendar_routes.py

feat(calendar): default view setting and remember last view

2026-02-09 20:22:08 +01:00

test_cii_invoice.py

fix: quote create 500, line order, and Factur-X PDF parity

2026-04-12 13:34:58 +02:00

test_client_note_model.py

Fix Client.notes backref: add delete-orphan cascade and fix dynamic loader test

2026-01-25 09:44:46 +01:00

test_client_notes_routes.py

…

test_client_portal.py

feat(client-portal): add report date range and CSV export

2026-03-16 16:43:35 +01:00

test_client_prepaid_model.py

Update tests

2026-03-08 06:50:42 +01:00

test_client_single_simplification.py

feat: auto-select and gray out client when only one exists (#467)

2026-01-30 17:26:14 +01:00

test_comprehensive_tracking.py

…

test_config_priority.py

…

test_currency_display.py

fix(tests): resolve integration test failures (custom fields, roles, uploads, currency)

2026-01-25 09:38:11 +01:00

test_custom_field_definitions.py

fix(tests): resolve integration test failures (custom fields, roles, uploads, currency)

2026-01-25 09:38:11 +01:00

test_delete_actions.py

…

test_demo_mode_and_safe_templates.py

fix(security): sandbox Jinja2 for database-backed PDF and email templates

2026-04-24 21:13:29 +02:00

test_email.py

Update tests

2026-03-08 06:50:42 +01:00

test_enhanced_ui.py

test: add and update tests for client portal, shortcuts, Jira, inventory API

2026-03-16 15:16:11 +01:00

test_error_handling.py

feat(offline): store method, headers, and body in queue for correct POST/PUT replay

2026-03-16 16:44:09 +01:00

test_excel_export.py

…

test_expenses.py

…

test_extra_good_model.py

…

test_factories_smoke.py

Update tests

2026-03-08 06:50:42 +01:00

test_favorite_projects.py

…

test_i18n.py

Update tests

2026-03-08 06:50:42 +01:00

test_import_export.py

…

test_installation_config.py

test(telemetry): consent gate, base first_seen/heartbeat, install_id

2026-03-16 13:01:41 +01:00

test_invoice_currency_fix.py

…

test_invoice_currency_smoke.py

Update tests

2026-03-08 06:50:42 +01:00

test_invoice_email.py

feat(admin): persist test recipient and send invoice email template tests

2026-03-27 06:39:16 +01:00

test_invoice_expenses.py

…

test_invoice_numbering.py

feat(invoices): add fully configurable invoice number patterns

2026-03-26 14:51:55 +01:00

test_invoice_pdf_postprocess.py

fix: quote create 500, line order, and Factur-X PDF parity

2026-04-12 13:34:58 +02:00

test_invoice_validators.py

fix: quote create 500, line order, and Factur-X PDF parity

2026-04-12 13:34:58 +02:00

test_invoices.py

feat(invoices): add fully configurable invoice number patterns

2026-03-26 14:51:55 +01:00

test_keyboard_shortcuts_api.py

test: add and update tests for client portal, shortcuts, Jira, inventory API

2026-03-16 15:16:11 +01:00

test_keyboard_shortcuts_input_fix.py

…

test_keyboard_shortcuts.py

test: add and update tests for client portal, shortcuts, Jira, inventory API

2026-03-16 15:16:11 +01:00

test_logo_pdf.py

chore: move invoice template and tests; remove obsolete root files

2026-03-15 10:16:49 +01:00

test_models_comprehensive.py

…

test_models_extended.py

…

test_multiselect_filters.py

feat(kanban,gantt): quick add task from board and Gantt views (#465)

2026-01-30 17:25:56 +01:00

test_new_features.py

…

test_oidc_logout.py

fix(oidc): avoid login loop by storing id_token server-side instead of in session cookie

2026-02-02 17:24:45 +01:00

test_oidc_session_cookie_bloat.py

fix(oidc): avoid login loop by storing id_token server-side instead of in session cookie

2026-02-02 17:24:45 +01:00

test_onboarding.py

…

test_otel_integration.py

feat(observability): add OpenTelemetry traces, OTLP metrics, and log correlation

2026-03-28 17:32:18 +01:00

test_overtime_leave.py

test(overtime): YTD helpers and overtime-as-leave validation (Issue #560)

2026-03-11 17:39:37 +01:00

test_overtime_smoke.py

test(overtime): YTD helpers and overtime-as-leave validation (Issue #560)

2026-03-11 17:39:37 +01:00

test_overtime.py

test(overtime): YTD helpers and overtime-as-leave validation (Issue #560)

2026-03-11 17:39:37 +01:00

test_payment_model.py

…

test_payment_routes.py

…

test_payment_smoke.py

fix(tests): stabilize smoke suite for SA2 flush, auth, and admin routes

2026-03-28 20:07:19 +01:00

test_pdf_layout.py

Fix admin menu and PDF layout; update docs

2026-02-20 09:56:44 +01:00

test_pdfa3.py

fix: quote create 500, line order, and Factur-X PDF parity

2026-04-12 13:34:58 +02:00

test_peppol_identifiers.py

fix(invoicing): harden PEPPOL transport and PDF/A-3 export compliance

2026-03-02 20:55:02 +01:00

test_peppol_service.py

feat(invoicing): add Factur-X CII export validation and transport guidance

2026-03-06 22:15:29 +01:00

test_permissions_routes.py

fix(tests): stabilize smoke suite for SA2 flush, auth, and admin routes

2026-03-28 20:07:19 +01:00

test_permissions.py

…

test_prepaid_allocator.py

…

test_profile_avatar.py

…

test_project_archiving_models.py

test: extend fixtures and add scope, auth, recurring, reports tests

2026-03-15 09:37:15 +01:00

test_project_archiving.py

…

test_project_costs.py

test: extend fixtures and add scope, auth, recurring, reports tests

2026-03-15 09:37:15 +01:00

test_project_dashboard.py

…

test_project_inactive_status.py

…

test_quick_wins.py

chore: move invoice template and tests; remove obsolete root files

2026-03-15 10:16:49 +01:00

test_reports_task_report.py

test: extend fixtures and add scope, auth, recurring, reports tests

2026-03-15 09:37:15 +01:00

test_role_module_visibility.py

feat(roles): add per-role module visibility (hide modules by role)

2026-02-02 19:18:28 +01:00

test_routes.py

fix(api): align client search, OpenAPI version, and Client construction

2026-04-15 12:57:01 +02:00

test_security.py

…

test_service_worker.py

…

test_silent_exception_fixes.py

test: add and update tests for client portal, shortcuts, Jira, inventory API

2026-03-16 15:16:11 +01:00

test_support_services.py

feat(web): high-visibility support modal, prompts, and supporter UX

2026-04-15 10:55:37 +02:00

test_system_ui_flags.py

…

test_task_edit_project.py

…

test_tasks_filters_ui.py

…

test_tasks_templates.py

fix(tests): resolve smoke test failures (audit, session, PDF)

2026-01-25 08:59:54 +01:00

test_telemetry_consent_and_base.py

fix(telemetry): use embedded config and add stable install identifiers

2026-03-26 18:25:10 +01:00

test_telemetry.py

feat(telemetry): migrate analytics pipeline from PostHog to OTLP

2026-03-26 17:01:55 +01:00

test_time_entry_duplication.py

…

test_time_entry_freeze.py

…

test_time_entry_resume.py

fix(tests): resolve smoke test failures (audit, session, PDF)

2026-01-25 08:59:54 +01:00

test_time_entry_templates.py

…

test_time_rounding_param.py

…

test_time_rounding.py

…

test_timer_edit_own_time_entries.py

test(timer): integration tests for own-entry schedule edits (#572)

2026-03-27 06:41:03 +01:00

test_timezone.py

…

test_ui_quick_wins.py

…

test_uploads_persistence.py

fix(tests): resolve integration test failures (custom fields, roles, uploads, currency)

2026-01-25 09:38:11 +01:00

test_user_report_entries_export_excel.py

feat(reports): export detailed user time entries to Excel

2026-02-02 17:59:59 +01:00

test_user_settings.py

feat(overtime): allow overtime calculation by weekly hours (Issue #551)

2026-03-09 20:33:48 +01:00

test_utils.py

test: extend fixtures and add scope, auth, recurring, reports tests

2026-03-15 09:37:15 +01:00

test_version_reading.py

…

test_weekly_goals.py

fix(weekly-goals): use 5 workdays for days_remaining when exclude_weekends is on

2026-01-25 08:36:02 +01:00

test_zugferd.py

fix: quote create 500, line order, and Factur-X PDF parity

2026-04-12 13:34:58 +02:00