- announce - lists.freelock.com

[ledgersmb-announce] LedgerSMB 1.6.0 released
by Erik Huelsmann 10 Jun '18

10 Jun '18

The LedgerSMB development team is happy to announce the start of a new series of stable releases: 1.6.0. Over the past 18 months (since the release of 1.5.0) the team has worked on a multitude of aspects of the system with the primary focus to build a solid foundation for future development as well as reducing system complexity -- both at the code and installation levels. User Interface * Reports and search results exportable to XLS(X) (Yves L) * Left menu replaced by a (faster) Dojo-based version (Yves L/Erik H) Installation & Administration * Added 'System Information' page to setup.pl for problem diagnosis (Erik H) * Numerous improvements for the migrations and infrastructure (Yves L/Erik H) * Better detection of incorrect @INC paths (David G) * Automatic date format selection using browser locale (Yves L/Erik H) * No more warnings from database creation and upgrade (Erik H) * Improved logging: various logs correlated using unique request IDs (Erik H) * Functions 'warn()' and 'die()' logged to debug logs (Erik H) * Removed need for 'tempdir' and associated configuration option (Nick P) * Removed numerous unused configuration options (Nick P) * Specific output formats can be disabled in configuration (Yves L) * Respect smtpuser and smtppass configuration options (Nick P) * Add smtpport configuration option (Nick P) * Database upgrades now ask for user input on (expected) faulty data (Erik H) Performance * PSGI responses no longer written to file but kept in memory (Erik H/Yves L) Rewritten inventory tracking and adjustments * Removed the need for the ill-understood 'Inventory Entity' (Erik H) * Inventory adjustments GL transactions instead of dummy invoices (Erik H) * SQL & in-browser(BDD) tests (Erik H) Code cleanup * Removed code duplication in - Template handling framework (Yves L) * Remove unused variables and unreachable code (Nick P) * Remove fragments of REST framework never fully implemented (Erik H) * Authentication handling centralized in request dispatch code (Erik H) * Cleaned up handling of uploaded files in request handling (Erik H) * Moved to Plack::Request (from CGI::Simple & LedgerSMB) (Erik H) * Template format plugin cleanup and refactoring (Erik H/Nick P) * Template handling code cleanup (Erik H/Nick P) * Unreferenced UI templates deleted (Erik H) * Centralized and more robust entry point for code in old/ (Erik H) * Merge of SQL-Ledger 2.8 and 3.0 migration code; improved consistency (Yves L) * Improved cleanup of temp files and dirs after use (Erik H) * Improved HTML structure (balanced closing/opening tags, etc) (Yves L) * Factored HTTP response responsibility out of LedgerSMB::Template (Erik H) * Moved request pre- and post-processing into custom Plack Middlewares (Erik H) Quality assurance * Port testing of database routines to pgTAP (and Perl's 'prove') (Yves L) * Enforce numerous Perl::Critic policies with code cleanup (Nick P/Rob R) * Add tests for all template output formats (Nick P) * Constrain password_duration setting to valid values (Nick P) Erik H is Erik Huelsmann Yves L is Yves Lavoie Nick P is Nick Prater Rob R is Rob Ransbottom David G is David Godfrey For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.6.0/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.6.0 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.6.0 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.6.0 These are the sha256 checksums of the uploaded files: 97de4d0749b0789bf2f1e4fac1fa91e5fe936cd0889697b225f94b5255491484 ledgersmb-1.6.0.tar.gz 1a619c49b6c8a225c25bff74c4101a3d0ef988e37a8d0b7b2152784102419793 ledgersmb-1.6.0.tar.gz.asc

1 0

[ledgersmb-announce] Security announcement for CVE-2018-9246 / PGObject::Util::DBAdmin
by Erik Huelsmann 06 Jun '18

06 Jun '18

This mail is sent to this mailing list because PGObject::Util::DBAdmin itself doesn't have a mailing list to send the disclosure to. We'll update its repository to reflect the announcement below. Please take note of the security advisory below, known as CVE-2018-9246 Nick Prater discovered that the PGObject::Util::DBAdmin insufficiently sanitizes or escapes variable values used as part of shell command execution, resulting in shell code injection. The vulnerability allows an attacker to execute arbitrary code with the same privileges as the running application through the create(), run_file(), backup() and restore() functions. Affected versions: PGObject::Util::DBAdmin versions 0.110.0 and lower. Vulnerability type: Insufficiently sanitized arguments in external program invocation Discoverer: Nick Prater (NP Broadcast LTD) Resolution: Upgrade to PGObject::Util::DBAdmin 0.120.0 or newer. (0.130.0 available on CPAN). Kind regards, -- Bye, Erik. http://efficito.com -- Hosted accounting and ERP. Robust and Flexible. No vendor lock-in.

1 1

[ledgersmb-announce] LedgerSMB 1.6.0-rc2 released
by Erik Huelsmann 06 Jun '18

06 Jun '18

Hi, After the LedgerSMB 1.6.0-rc1 release of two weeks ago, work has continued and we've found and solved several issues. We're now releasing 1.6.0-rc2 with the fixes listed below for your testing. Please send feedback to devel(a)lists.ledgersmb.org or file your issues through GitHub ( https://github.com/ledgersmb/LedgerSMB/issues) Fixes in LedgerSMB 1.6.0-rc2 (over 1.6.0-rc1): - Add more scripts to help resolve schema migration problems - Fix mailing of invoices, orders, etc. - Fix UTF-8 encoding issue with schema migration check output - Fix CSV import code not processing uploaded input correctly - Correctly detect UTF-8 (due to BOM) on uploaded form content (files) - Fix e-mail attachments - Fix and clean up LedgerSMB::File module and children (with tests) Please note that we're releasing 1.6.0-rc2; this means we think this code is production ready and that the database schema is stable. You're highly encouraged to try this version, however, if you run it in production (even though some of the developers are), you should consider yourself an early adopter. We'd highly appreciate your testing and feedback. For an overview of the changes in version 1.6, please check our release notes: https://ledgersmb.org/content/16-release-notes; for an in-depth listing of the changes since 1.5, see our Changelog: https://github.com/ledgersmb/LedgerSMB/blob/master/Changelog#L2-L60 As always, the release can be downloaded from the download site: https://download.ledgersmb.org/f/Beta%20Releases/1.6.0-rc2/ Or Docker images can be pulled through: $ docker pull ledgersmb/ledgersmb:1.6 With our Docker Compose file ( https://github.com/ledgersmb/ledgersmb-docker/blob/1.6/docker-compose.yml) you can set up a full evaluation environment with a single command: $ docker-compose up -d from the directory where the docker-compose.yml file is stored. -- Bye, Erik. http://efficito.com -- Hosted accounting and ERP. Robust and Flexible. No vendor lock-in.

1 2

[ledgersmb-announce] Release of ledgersmb-1.5 v1.5.21-1
by Robert J. Clay 01 Jun '18

01 Jun '18

An initial version of the debian ledgersmb-1.5 package for version 1.5.21-1 has been released and uploaded to our apt package repository for 'main' in stretch[1]. It has also been uploaded to our PPA[2], for 'artful' (v17.10) as well as 'xenial (v16.04 LTS) and 'bionic (v18.04 LTS). (The Debian source packages are available as well.) (Note also that this is likely the last time that a build for 'artful' will be done as it hits End of Life next month.) The packages at both our apt package repository and our PPA: ledgersmb-1.5 ledgersmb-1.5-apache ledgersmb-1.5-lighttpd ledgersmb-1.5-nginx ledgersmb-1.5-varnish Only the main 'ledgersmb-1.5' package is required; the others are related to which web proxy you might want to use and you only need one of them. -- Robert James Clay rjclay(a)gmail.com, jame(a)rocasa.us GPG ID: 2448 3AE0 874D 8696 6DCD ECF4 198C AB6F 43B7 EA9A. [1] https://apt.ledgersmb.org/ [2] https://launchpad.net/~ledgersmb/+archive/ubuntu/main/+packages -- Robert J. Clay rjclay(a)gmail.com

1 0

[ledgersmb-announce] LedgerSMB 1.5.21 released
by Erik Huelsmann 31 May '18

31 May '18

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.5.21 * Clarify message after changing password through Preferences (Nick P) * Fix errors in ODS report tepmlate's title page (Nick P) * Fix #3642: Taxform report generation failing (Erik H) * Detect BOM to determine UTF-8 CSV imports (Erik H) Nick P is Nick Prater Erik H is Erik Huelsmann For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.5.21/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.5.21 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.5.21 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.5.21 These are the sha256 checksums of the uploaded files: 0262e77b9651521eca30bc69621dcdb68e7d13667facdaf845ad9bab23efc79e ledgersmb-1.5.21.tar.gz 1d1d2c858b46c22f0c29f201b42732a9d3b60c81f7bd0340c22031674b228683 ledgersmb-1.5.21.tar.gz.asc

1 0

[ledgersmb-announce] [ANNOUNCE] LedgerSMB 1.6.0-rc1 released
by Erik Huelsmann 22 May '18

22 May '18

Hi, After the LedgerSMB 1.6.0-beta2 release of last week, work has continued and we've found and solved several issues. We're now releasing 1.6.0-rc1 with the fixes listed below for your testing. Please send feedback to devel(a)lists.ledgersmb.org or file your issues through GitHub ( https://github.com/ledgersmb/LedgerSMB/issues) Fixes in LedgerSMB 1.6.0-rc1 (over 1.6.0-beta2): - Fixed file (document attachment) uploads - Fix (invoice, etc) template uploads - Fix SQL Ledger migration script execution With special thanks to Nick Prater who found and fixed all of them. Please note that we're releasing 1.6.0-rc1; this means we think this code is production ready and that the database schema is stable. You're highly encouraged to try this version, however, if you run it in production (even though some of the developers are), you should consider yourself an early adopter. We'd highly appreciate your testing and feedback. For an overview of the changes in version 1.6, please check our release notes: https://ledgersmb.org/content/16-release-notes; for an in-depth listing of the changes since 1.5, see our Changelog: https://github.com/ledgersmb/LedgerSMB/blob/master/Changelog#L2-L60 As always, the release can be downloaded from the download site: https://download.ledgersmb.org/f/Beta%20Releases/1.6.0-rc1/ Or Docker images can be pulled through: $ docker pull ledgersmb/ledgersmb:1.6 With our Docker Compose file ( https://github.com/ledgersmb/ledgersmb-docker/blob/1.6/docker-compose.yml) you can set up a full evaluation environment with a single command: $ docker-compose up -d from the directory where the docker-compose.yml file is stored. -- Bye, Erik. http://efficito.com -- Hosted accounting and ERP. Robust and Flexible. No vendor lock-in.

1 0

[ledgersmb-announce] [ANNOUNCE] LedgerSMB 1.6.0-beta2 released
by Erik Huelsmann 13 May '18

13 May '18

Hi, After the LedgerSMB 1.6.0-beta1 release of last week, work continued on the regular high pace and we've found and solved several issues. We're now releasing 1.6.0-beta2 with the fixes listed below for your further testing. Please send your feedback to devel(a)lists.ledgersmb.org or file your issues through GitHub (https://github.com/ledgersmb/LedgerSMB/issues) Fixes in LedgerSMB 1.6.0-beta2 (over 1.6.0-beta1): - Stricter checking for failure during schema setup and updates - Multiple fixes for schema updates from 1.4 and 1.5 - Database version check not happening (regression) fixed - Fix regression in rendering of aging reports, warehouse listing and recurring transactions listing - Add a validity constraint to the password-duration setting - Clarified error message in case of failure to set password through Preferences menu - Fix password reset button and Save groups buttons in setup.pl - Invert the meaning of the checkmark in the Payment/Receipt screen - Remove execute bit from *.po (translation) files - Remove SourceForge list address from translation files (replace with current ledgersmb.org address) - Fix title pages for ODS, XLS and XLSX templates - Fix no data showing up in PDF output for reports - Fix broken permalinks to search output - Restore Save popup when downloading report output The list of changes in 1.6 (over 1.5) is at https://github.com/ledgersmb/LedgerSMB/blob/master/Changelog#L2-L60 The release tarball can be downloaded from https://download.ledgersmb.org/f/Beta%20Releases/1.6.0-beta2/ Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.6 -- Bye, Erik. http://efficito.com -- Hosted accounting and ERP. Robust and Flexible. No vendor lock-in.

1 0

[ledgersmb-announce] 1.6.0-beta1 uploaded for general testing
by Erik Huelsmann 06 May '18

06 May '18

Hi, This is to let you know that I've just finished uploading LedgerSMB 1.6.0beta1 (taken from our repository at commit hash 9956baac) for early-bird testing and evaluation purposes to https://download.ledgersmb.org/f/Beta%20Releases/1.6.0-beta1/ . Note that the difference between the uploaded tar and the git commit is that the tar contains our minified Dojo Toolkit dependency. Among other things, we'll be using this upload to develop our Docker images before the final 1.6.0 release. You're encouraged to do the same with any dependencies and/or packaging procedures you may have and report your problems either to devel(a)lists.ledgersmb.org or in the GitHub issue tracker. Before filing a ticket, please check if a similar issue has already been filed. The changelog for the 1.6 release series can be found here: https://github.com/ledgersmb/LedgerSMB/blob/1.6/Changelog#L2-L59 -- Bye, Erik. http://efficito.com -- Hosted accounting and ERP. Robust and Flexible. No vendor lock-in.

1 1

[ledgersmb-announce] [ANNOUNCE] 1.6 ready for translation
by Erik Huelsmann 05 May '18

05 May '18

Hi, This is an announcement for translators: on Friday we branched 1.6 and prepared it for translation. We expect to release 1.6.0 late this quarter or early next quarter. Although translations can be done any time, releasing 1.6.0 with complete translations makes for a much better impression on new users of course. To those who aren't translators yet: this is an opportunity to contribute to the project! It's easy to become a LedgerSMB translator by navigating to https://www.transifex.com/ledgersmb/ledgersmb/dashboard/ , click on the "Help translate LedgerSMB" button and follow the sign-up steps. If you have any questions regarding translation, please post to devel(a)lists.ledgersmb.org. Regards, Erik

1 0

[ledgersmb-announce] Release of ledgersmb-1.5 v1.5.20-1
by Robert J. Clay 14 Apr '18

14 Apr '18

An initial version of the debian package ledgersmb-1.5 for version 1.5.20-1 has been released and uploaded to our apt repository for 'main' in stretch[1]. It has also been uploaded to our PPA[2], for 'artful' (v17.10) as well as 'xenial (v16.04) and 'bionic (which will be v18.04). (The Debian source packages are available as well.) The packages at both our apt package repository and our PPA: ledgersmb-1.5 ledgersmb-1.5-apache ledgersmb-1.5-lighttpd ledgersmb-1.5-nginx ledgersmb-1.5-varnish Only the main 'ledgersmb-1.5' package is required; the others are related to which web proxy you might want to use and you only need one of them. -- Robert J. Clay rjclay(a)gmail.com, jame(a)rocasa.us GPG ID: 2448 3AE0 874D 8696 6DCD ECF4 198C AB6F 43B7 EA9A. [1] https://apt.ledgersmb.org/ [2] https://launchpad.net/~ledgersmb/+archive/ubuntu/main/+packages

1 0