GHSA-rh42-6rj2-xwmc

## Summary The Twig sandbox used for invoice templates blocks certain sensitive `User` methods (password, TOTP secret, etc.) via a blocklist in `StrictPolicy::checkMethodAllowed()`. However, `getApiToken()` and `getPlainApiToken()` are not on the blocklist. An admin who creates an invoice template can embed calls to these methods, causing the bcrypt or sodium hashed API password of any user who generates an invoice using that template to be included in the rendered output. Only relevant for OnPremise installations with template upload activated. ## Background Kimai allows admins (`ROLE_ADMIN` and above) with the `manage_invoice_template` permission to create Twig-based invoice templates. These templates are rendered in a sandboxed Twig environment with `StrictPolicy` controlling which methods and properties are accessible. `StrictPolicy` explicitly blocks: ```php // src/Twig/SecurityPolicy/StrictPolicy.php:156 if (\in_array($lcm, [ 'getpassword', 'gettotpsecret', 'getplainpassword', 'getconfirmationtoken', 'gettotpauthenticationconfiguration' ], true)) { throw new SecurityNotAllowedMethodError(...); } ``` `getApiToken()` and `getPlainApiToken()` are **not** in this list and are freely callable. ## Vulnerable Code `StrictPolicy.php` — missing entries in the User method blocklist: ```php // Current ['getpassword', 'gettotpsecret', 'getplainpassword', 'getconfirmationtoken', 'gettotpauthenticationconfiguration'] // Should also include: 'getapitoken', 'getplainapitoken' ``` The invoice model passes a `User` object through `model.user`, accessible in any twig invoice template. ## Steps to Reproduce 1. Log in as an admin with the `manage_invoice_template` permission. 2. Create a new Twig invoice template (HTML or PDF) containing: ```twig API Token: {{ model.user.getApiToken() }} Plain Token: {{ model.user.getPlainApiToken() }} ``` 3. Save the template and set it as the default for a customer. 4. Log in as a regular user assigned to