lock exported timesheets

[kevinpapst]

Description

Exported records are locked to prevent further updates by regular users.
This limitation can be circumvented by users with the new permission edit_exported_timesheet, which by default is given to ROLE_ADMIN and ROLE_SUPER_ADMIN.

These users will see a warning instead:

A new API method was added to switch the export state of timesheet records.

Fixes #686

Testing

Can be tested at http://demo-branch.kimai.org/

Please try it with both an admin and a regular user. The regular user cannot switch the "exported" state, so you have to either use the export screen or switch it manually in the timesheet administration with the admin user.
Regular user should not be able to edit the exported timesheets.
Admin user should see a warning.

Types of changes

• New feature (non-breaking change which adds functionality)

Checklist

• I ran bin/console kimai:codestyle --fix to verify the correct code style
• I have updated the documentation accordingly
• I have added tests to cover my changes
• I agree that this code is used in Kimai and will be published under the MIT license

[j0hannesr0th]

I've tested it.

So for exported objects the user can't edit it since there is not edit button:

But why can the user still delete the entry? This doesn't make sense to me. If it's exported it should be read only for the user - except he has special privilegs.

[kevinpapst]

Pretty good argument, I simply did not think about it at all :-D
I think I will re-use the permission edit_exported_timesheet or shall we create another permission for deletion?

[j0hannesr0th]

I think reusing

edit_exported_timesheet

would be the best.

[kevinpapst]

added "prevent deletion of exported timesheets"

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs. If you use Kimai on a daily basis, please consider donating to support further development of Kimai.