Security fixes. Vulnerabilities resolved:
The restriction on editing elapsed time now works again: the event handler was bound to a non-existent method, which allowed changing the date and comment of an existing record without validation.
The date check can no longer be bypassed by swapping request fields: a timer record is determined by server data, not by fields sent by the browser.
If the record date cannot be recognized, the record is rejected instead of being skipped without validation.
The permission check on the module settings page has been fixed: a user without module permissions can no longer change settings, exclusions, or reset them.
An XSS vulnerability on the module settings page has been fixed: user names, group names, and access codes in the exclusion list are now escaped.
Logic fixes:
In the new task card, manually added time is validated: previously, such records were incorrectly treated as timer records and not checked.
The date received from the new task card as a date object (rather than a string) is now handled correctly.
When editing a record without changing the date, saving is no longer incorrectly blocked.
When rejecting an edit, the user receives an error message instead of a fatal PHP error.
The error is passed using the standard Bitrix method, not as an exception.
In the new task card, the error text is displayed in a popup notification: previously, the form would simply freeze, and the record would disappear after the page refreshes.