mirror of
https://github.com/MarijnDoeve/TijdVoorDeTest.git
synced 2026-07-10 09:30:14 +02:00
Marijn
0ee15e3cbb
* feat: add GDPR data export (download data) button Wires up the previously disabled "Download data" button on the settings page. Downloads a zip with a profile.xlsx (account + owned seasons), and per owned season a folder with each quiz's xlsx (questions, results, eliminations tabs) and a candidates.xlsx (candidates + season info tabs). Soft-deleted rows are included and flagged so the export reflects everything the app still holds about the user. * feat: include question bank in GDPR data export Adds a question-bank.xlsx per season folder with Questions (bank questions, answers, reusable/complete flags, labels, and which quizzes they've been used in) and Labels tabs, since BankQuestion/BankAnswer content was previously missing from the export. * fix: hard-delete quiz/audit-log data when deleting an account QuizCandidate, GivenAnswer, and Elimination are Gedmo\SoftDeleteable, so cascading their removal through Season -> Quiz/Candidate only set deletedAt instead of physically deleting the row. Since Candidate and Answer are hard-deleted via orphanRemoval, this broke their foreign keys and rolled back the entire account deletion whenever a candidate had actually participated in a quiz. Bulk DQL deletes now purge these rows before the cascade runs. Also purge BankQuestion audit-log rows (ext_log_entries), which store the editor's username/email but aren't foreign-keyed to the entity they log, so they were never cleaned up and would otherwise keep a deleted user's email around indefinitely. * style: make the download data button primary (blue) * feat: add raw answers crosstab to quiz export Adds a "Raw answers" tab to each quiz xlsx: one row per candidate, one column per question, with the given answer text in each cell — the raw data behind the aggregated Results tab. * i18n: translate new settings page string to Dutch * refactor: sanitize filenames with Symfony's AsciiSlugger instead of a hand-rolled regex Extracts a shared Tvdt\Helpers\FilenameSanitizer (backed by symfony/string's AsciiSlugger) and uses it everywhere user-controlled text (season/quiz names, account email) ends up in a zip entry path or a downloaded filename. AsciiSlugger is allowlist-based (only A-Z/0-9 survive; everything else, including unicode and path-traversal sequences, is folded or stripped) rather than a denylist of "unsafe" characters, and it's an officially maintained Symfony component already present as a transitive dependency. Also fixes BackofficeController::exportQuiz(), a pre-existing endpoint that built its Content-Disposition filename directly from an unsanitized quiz name — the same class of risk the data export already guarded against. Naming note: sanitized names are now slugs (spaces become dashes, unicode is ASCII-transliterated), e.g. "Krtek Weekend" -> "Krtek-Weekend". * fix: check ZipArchive open/close results and clean up temp files on failure Addresses CodeRabbit findings on the GDPR export: - ZipArchive::open() and close() can both return false without throwing; neither was checked, so a failure silently produced an empty or corrupt zip, and the temp zip path was never cleaned up on a mid-build exception. - writeToTempFile() leaked its tempnam()'d file if Writer\Xlsx::save() threw before the caller could track it for cleanup. * fix: drop public link identifier from the candidates export sheet The nameHash is a public quiz-access token, not something a data export should hand out — remove it from candidates.xlsx. * feat: add Quiz info tab covering dropouts, finalization, and disabled questions An entity-by-entity audit of the export vs. delete flows found the delete flow fully covered, but three Quiz/Question fields missing from the export: dropouts, finalizedAt, and Question.enabled. Adds a new "Quiz info" tab (first sheet) to each quiz's xlsx with this data, without touching the shared fillQuestionsSheet() used by the existing single-quiz template export/import feature. Deliberately left out per user decision: the BankQuestion audit log (would leak other owners' emails, consistent with hiding co-owner identities elsewhere in this export) and a few low-value timestamp fields already covered by existing Started/time-taken columns. * feat: require a confirmed email before exporting data Antispam measure: both the full data export (SettingsController::downloadData) and the single-quiz export (BackofficeController::exportQuiz) now redirect with a flash warning instead of exporting when the account's email isn't verified yet. Adds a matching hint on the settings page next to the download button.
131 lines
4.2 KiB
JSON
131 lines
4.2 KiB
JSON
{
|
|
"name": "marijndoeve/tijdvoordetest",
|
|
"type": "project",
|
|
"license": "MIT",
|
|
"description": "A minimal Symfony project recommended to create bare bones applications",
|
|
"minimum-stability": "stable",
|
|
"prefer-stable": true,
|
|
"require": {
|
|
"php": ">=8.5",
|
|
"ext-ctype": "*",
|
|
"ext-iconv": "*",
|
|
"doctrine/dbal": "^4.4.3",
|
|
"doctrine/doctrine-bundle": "^3.2.2",
|
|
"doctrine/doctrine-migrations-bundle": "^4.0",
|
|
"doctrine/orm": "^3.6.2",
|
|
"martin-georgiev/postgresql-for-doctrine": "^4.4",
|
|
"phpdocumentor/reflection-docblock": "^6.0.3",
|
|
"phpoffice/phpspreadsheet": "^5.5",
|
|
"phpstan/phpdoc-parser": "^2.3.2",
|
|
"sentry/sentry-symfony": "^5.9.0",
|
|
"stof/doctrine-extensions-bundle": "^1.15.3",
|
|
"symfony/asset": "8.1.*",
|
|
"symfony/asset-mapper": "8.1.*",
|
|
"symfony/brevo-mailer": "8.1.*",
|
|
"symfony/console": "8.1.*",
|
|
"symfony/dotenv": "8.1.*",
|
|
"symfony/flex": "^2.11.0",
|
|
"symfony/form": "8.1.*",
|
|
"symfony/framework-bundle": "8.1.*",
|
|
"symfony/mailer": "8.1.*",
|
|
"symfony/object-mapper": "8.1.*",
|
|
"symfony/property-access": "8.1.*",
|
|
"symfony/property-info": "8.1.*",
|
|
"symfony/runtime": "8.1.*",
|
|
"symfony/security-bundle": "8.1.*",
|
|
"symfony/security-csrf": "8.1.*",
|
|
"symfony/serializer": "8.1.*",
|
|
"symfony/string": "8.1.*",
|
|
"symfony/translation": "8.1.*",
|
|
"symfony/twig-bundle": "8.1.*",
|
|
"symfony/uid": "8.1.*",
|
|
"symfony/ux-turbo": "^3.1",
|
|
"symfony/validator": "8.1.*",
|
|
"symfony/yaml": "8.1.*",
|
|
"symfonycasts/reset-password-bundle": "^1.25",
|
|
"symfonycasts/sass-bundle": "^0.10",
|
|
"symfonycasts/verify-email-bundle": "^1.18.0",
|
|
"thecodingmachine/safe": "^3.4.0",
|
|
"twig/extra-bundle": "^3.24.0",
|
|
"twig/intl-extra": "^3.24.0",
|
|
"twig/twig": "^3.27.1"
|
|
},
|
|
"require-dev": {
|
|
"dama/doctrine-test-bundle": "^8.6",
|
|
"doctrine/doctrine-fixtures-bundle": "^4.3.1",
|
|
"friendsofphp/php-cs-fixer": "^3.94.2",
|
|
"phpstan/extension-installer": "^1.4.3",
|
|
"phpstan/phpstan": "^2.1.42",
|
|
"phpstan/phpstan-doctrine": "^2.0.20",
|
|
"phpstan/phpstan-phpunit": "^2.0.16",
|
|
"phpstan/phpstan-symfony": "^2.0.15",
|
|
"phpunit/phpunit": "^13.0.5",
|
|
"rector/rector": "^2.3.9",
|
|
"symfony/browser-kit": "8.1.*",
|
|
"symfony/css-selector": "8.1.*",
|
|
"symfony/maker-bundle": "^1.67.0",
|
|
"symfony/phpunit-bridge": "8.1.*",
|
|
"symfony/stopwatch": "8.1.*",
|
|
"symfony/web-profiler-bundle": "8.1.*",
|
|
"thecodingmachine/phpstan-safe-rule": "^1.4.3",
|
|
"vincentlanglet/twig-cs-fixer": "^4.0.0"
|
|
},
|
|
"config": {
|
|
"allow-plugins": {
|
|
"php-http/discovery": true,
|
|
"phpstan/extension-installer": true,
|
|
"symfony/flex": true,
|
|
"symfony/runtime": true
|
|
},
|
|
"bump-after-update": true,
|
|
"sort-packages": true
|
|
},
|
|
"autoload": {
|
|
"psr-4": {
|
|
"Tvdt\\": "src/"
|
|
}
|
|
},
|
|
"autoload-dev": {
|
|
"psr-4": {
|
|
"Tvdt\\Tests\\": "tests/"
|
|
}
|
|
},
|
|
"replace": {
|
|
"symfony/polyfill-ctype": "*",
|
|
"symfony/polyfill-iconv": "*",
|
|
"symfony/polyfill-mbstring": "*",
|
|
"symfony/polyfill-php72": "*",
|
|
"symfony/polyfill-php73": "*",
|
|
"symfony/polyfill-php74": "*",
|
|
"symfony/polyfill-php80": "*",
|
|
"symfony/polyfill-php81": "*",
|
|
"symfony/polyfill-php82": "*",
|
|
"symfony/polyfill-php83": "*",
|
|
"symfony/polyfill-php84": "*",
|
|
"symfony/polyfill-php85": "*"
|
|
},
|
|
"scripts": {
|
|
"auto-scripts": {
|
|
"cache:clear": "symfony-cmd",
|
|
"assets:install %PUBLIC_DIR%": "symfony-cmd",
|
|
"importmap:install": "symfony-cmd"
|
|
},
|
|
"post-install-cmd": [
|
|
"@auto-scripts"
|
|
],
|
|
"post-update-cmd": [
|
|
"@auto-scripts"
|
|
]
|
|
},
|
|
"conflict": {
|
|
"symfony/symfony": "*"
|
|
},
|
|
"extra": {
|
|
"symfony": {
|
|
"allow-contrib": false,
|
|
"require": "8.1.*",
|
|
"docker": true
|
|
}
|
|
}
|
|
}
|