- devel - lists.freelock.com

Processed: closing 911542
by Debian Bug Tracking System 22 Jan '22

22 Jan '22

Processing commands for control(a)bugs.debian.org: > close 911542 1.6.8+ds-1 Bug #911542 [ledgersmb] ledgersmb - debian/po/*.po translations need to be updated Marked as fixed in versions ledgersmb/1.6.8+ds-1. Bug #911542 [ledgersmb] ledgersmb - debian/po/*.po translations need to be updated Marked Bug as done > thanks Stopping processing here. Please contact me if you need assistance. -- 911542: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=911542 Debian Bug Tracking System Contact owner(a)bugs.debian.org with problems

1 0

LedgerSMB 1.9.7 released
by Erik Huelsmann 19 Jan '22

19 Jan '22

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the fix for a dataloss issue that was reported to us two days ago. The issue concerns the deletion of batches, which causes loss of information linking payments to the transactions being paid. This issue is present in all 1.8 releases before 1.8.25 and all 1.9 releases before 1.9.7. Additionally, it contais the following fixes and improvements: Changelog for 1.9.7 * Fix clearing To/Cc/Bcc/... fields which were cleared in the UI (#6168) * Fix invoice amounts for invoices generated from orders (#6125) * Fix saving purchase orders as invoices (#6341) * Require gain/loss account setup to post FX transaction payments #6360) * [DATALOSS] Fix deletion of any batch removing payment information (#6368) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.9.7/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.9.7 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.9.7 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.9.7 These are the sha256 checksums of the uploaded files: f1fc0faf40b5a9f925e35ffc2718cbe1ac9d744db0f0ce8863fa604c93fca375 ledgersmb-1.9.7.tar.gz abf7f430b68cd703a435d317ec49ba4d62ad53af5425ef53d6785d86366002c6 ledgersmb-1.9.7.tar.gz.asc

1 0

LedgerSMB 1.8.25 released
by Erik Huelsmann 19 Jan '22

19 Jan '22

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the fix for a dataloss issue that was reported to us two days ago. The issue concerns the deletion of batches, which causes loss of information linking payments to the transactions being paid. This issue is present in all 1.8 releases before 1.8.25. Additionally, it contais the following fixes and improvements: Changelog for 1.8.25 * Fix batch details printing throwing a PSGI error (#6325) * Fix saving of AR/AP vouchers throwing errors (#6327) * Fix account initialization in tax calculation module (#6335) * Require gain/loss account setup to post FX transaction payments (#6360) * [DATALOSS] Fix deletion of any batch removing payment information (#6368) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.8.25/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.8.25 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.8.25 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.8.25 These are the sha256 checksums of the uploaded files: 185d12a8f4e75b8c519042b98e0c7e2142193b2c3c4874fc2eaea193c61f2f24 ledgersmb-1.8.25.tar.gz c5438af7ccddda0aa0d485df6d077624df5b65c2a436df041023b19b19dca76e ledgersmb-1.8.25.tar.gz.asc

1 0

LedgerSMB 1.7.38 released
by Erik Huelsmann 19 Jan '22

19 Jan '22

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.7.38 * Fix batch details printing throwing a PSGI error (#6325) * Fix saving of AR/AP vouchers throwing errors (#6327) * Fix account initialization in tax calculation module (#6335) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.7.38/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.7.38 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.7.38 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.7.38 These are the sha256 checksums of the uploaded files: fcb593db1760ad37f1d428f657fecb4a34361bf62db8e320b271128d666a0969 ledgersmb-1.7.38.tar.gz 91697911649244be9628261914279dd8691de1d3e043904ca50a68388d678c07 ledgersmb-1.7.38.tar.gz.asc

1 0

LedgerSMB 1.9.6 released
by Erik Huelsmann 05 Jan '22

05 Jan '22

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.9.6 * Populate more fields in batch approval details report (#6271) * Fix error when posting an invoice created from an order (#6280) * Fix saving invoices and transactions as part of vouchers (#6327) * Fix printing batch details from batch details approval screen (#6324) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.9.6/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.9.6 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.9.6 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.9.6 These are the sha256 checksums of the uploaded files: 8748d005601557a690898758c06a3c7a88c3b3130ca778a53ade630a46e1a342 ledgersmb-1.9.6.tar.gz 97fb3bbfa6ce1cc4a52eab767bf65ec7780935132263db73ab3c45eee45de920 ledgersmb-1.9.6.tar.gz.asc

1 0

LedgerSMB Community overview 2021
by Erik Huelsmann 27 Dec '21

27 Dec '21

As the year-end approaches, it's time to provide an overview of what our community has achieved over the past year. At the end of last year, I wished everybody a healthy and prosperous 2021. The year has turned out to be as challenging as the last and I hope this overview reaches you in a health as good as (or better than) last year's. == Community interest == Although the number of hits on the website has declined steadily over the years, it seems that the decrease is slowing down: ca 1,000 fewer hits than in 2020, but 2020 lost ca 6,000 hits when compared to 2019. Traffic on the mailing lists was - in line with 2020 - very low this year. However, from the fact that during the year, we've also seen the number of Stars and Forks on GitHub slowly but steadily increase (Stars went up from 207 on 22 December 2020 to 260 today), we can conclude that there is still interest in the project, however, the broader community didn't have much time to engage with the project this year -- similar to what other volunteer-driven projects are experiencing this year. == Releases == With the release of 1.9.0 on 25 September 2021, we realized our goal to release 1.9 in the second half of the year, around a year after 1.8. This way, our target of releasing around the middle of the year, in order for the software to mature well before year-end (when most companies close their books). Despite the short release cycle, we were able to include a sizeable list of new functionalities, changes and (code) cleanups through 902 files changed, 306,496 added lines and 271,066 removed lines of code (and comments) between 1.8.0 and 1.9.0. With the number of releases doubled in 2020 over 2019 (44 releases over ~20 before), the question was whether we'd keep it up to release that often. Turns out we were able to meet our prior year standards with 38 releases in 2021: 1.6 (5): 1.6.29 - 1.6.33 1.7 (12): 1.7.26 - 1.7.37 1.8 (15): 1.8.10 - 1.8.24 1.9 (6): 1.9.0 - 1.9.5 Which excludes the alpha, beta and release candidate releases. == Packaging and installation == For the 1.9 Docker images, we moved from Debian Buster to Debian Bullseye as the base operating system. Contrary to prior experience - moving to Buster - there were no notable problems in the move. Significant engineering effort went into automating the mapping of Perl dependencies to their Debian package names during the Docker build process. By having this automation in place, error margin and manual release maintenance has been eliminated. The automation worked so well that it was backported from the initial 1.9 implemenetation to the release processes for 1.8 and 1.7 as well. With some help from the Debian community, we were able to fix the packages that come with Debian Bullseye: the packages that were there before were missing the "old/lib/" subdirectory. Unfortunately, Debian still includes 1.6. == Development progress == This year saw fewer commits than last year. Although this could be an indication that our project is suffering from the same problem many other Open Source projects have during the pandemic: a loss of available time from their contributors. I don't think that's the case for our project as some of it can be explained by the tougher topics being picked up in the second half of the year. Although the sheer number of commits was lower, the number of pull requests (832) is in the same order of magnitude as those from last year. The number of active developers - judging by accepted commits - went up from 47 last year to 9 people contributing commits this year - even though 2 of last year's contributors were one-off contributions. Last year I expressed my desire to close a number of long-standing issues this year and in fact, we have: * #975: Edit/Update on a saved invoice or transaction clobbers changes * #1135: Ability to delete a login account * #816: Ability to install in a schema other than "public" * #835: Performance of the balance sheet report (should use cached balances) All from 2015, just to name a few. Project commits on all branches (excluding merges and bots): 895 Erik Huelsmann* 139 Yves Lavoie* 61 Aung Zaw Win* 11 Neil Tiffin* 4 Richard T. Weeks 3 NoGare 2 lianto.ruyang 2 daOrangePeeler 1 Xin Wang * includes contributions on maintenance branches By comparison, these are the figures for 2020: 1247 Erik Huelsmann* 179 Yves Lavoie* 108 Nick Prater* 37 Aung Zaw Win* 3 Håvard Sørli 1 Bobberty 1 Andreas Karlsson Please note that the number of commits is in no way a measure of time spent on the project. Also note that these numbers don't include the time spent by those taking the effort to report their problems and taking the time to respond to developer questions as well as helping to test solutions when developers think they solved the problem. Similarly, there was a lot of activity with respect to issues: Number of open issues at 2021-01-01: 226 of which remain open today: 137 Issues closed: 173 of which created before 2021-01-01: 89 Issues created: 105 of which still open: 21 Number of open issues today: 158 This amount of development activity triggers many CI/CD jobs. Last year, we had just moved our regular CI loads to GitHub Actions; this year we have run almost 2,000 CI workflows on the main repository alone(!). A high number of jobs was triggered by Dependabot and Renovate Bot, two bots which have helped us to keep our JavaScript dependencies up to date. While Dependabot could run integration checks multiple times a day, we moved to Renovate in order to be able to reduce the number of CI jobs and merges. They're now set to once a week -- we're not releasing multiple times per day from our repository anyway. In the Changelog for 1.10 (https://github.com/ledgersmb/LedgerSMB/blob/master/Changelog#L3) you'll be able to read where we spent our time, for all effort that didn't end up in 1.9 and wasn't listed above. Areas that we're currently spending time on, include: Encapsulating Dojo widgets in "custom elements" in order more easily switch component libraries Putting the requirements in place in order to develop our UI with Vue3 Development of webservice APIs The 158 issues that are open today summarize into these statistics: * 11 bite-sized: a good place to start when looking to make contributions * 69 enhancement: requesting new features added to the application * 4 help wanted: looking for someone to help out on this issue * 10 migration: these issues need help testing and developing migration from SQL Ledger * 6 needs-documentation: there's not enough documentation... (Note that an issue may fall into more than one category or none at all.) == New functionality and improvements == Distributed with 1.10, a very nice although somewhat niche, functionality was added supporting localized handling of taxes: in the US, Washington State (WA) operates a web service which serves the tax rate in the tax district. We have built a module that queries this service based on the billing address on the invoice. The module calculates the applicable tax amount and posts it. The webservice returns a "tax district code" which gets posted with the amount for tracking and auditing by an accountant. This use-case goes to show what customizations are becoming possible after the years LedgerSMB has been in development, with all the code cleanup that has been going on. == Looking forward to 2022 == In 2022, we'll likely release 1.10 around the middle of the year; again in a release cycle a bit shorter than a year. This year two release branches will reach End-Of-Life status: 1.8 on 4 September 2022 and 1.7 on 4 October 2022. By the end of 2022, we'll be back to supporting two active release branches as we were before we switched to yearly release cycles. Experience has shown that given sufficient automation, maintenance of 3 branches is doable, but still challenging; there are simply too many merge conflicts on any non-trivial backport to do the job well. And last but not least, I'm hoping for 1 or 2 new contributors (not necessarily developers; translators, testers, documentation writers or UI artists are all greatly appreciated!). If you want to contribute, but don't know where to start, please contact me. == In closing == Thanks to everybody who contributed to any of the above in any way, especially to Computerisms.ca for hosting our DNS Freelock.com for hosting our website and mailing lists Efficito.com for hosting our mailing list archive, apt repository, release and download server GitHub.com, CircleCI and coveralls.io for hosting our development workflow My special personal thanks go to my GitHub Sponsors for supporting me for time, efforts and (financial) resources dedicated to the project! Leaves me only to wish everybody in our community - and their loved ones - happy holidays and a safe and productive 2022! -- Bye, Erik. http://efficito.com -- Hosted accounting and ERP. Robust and Flexible. No vendor lock-in.

2 1

LedgerSMB 1.9.5 released
by Erik Huelsmann 08 Dec '21

08 Dec '21

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.9.5 * Fix correct AR/AP account being selected on Update and when editing (#6191) * On date-entry, add the separator character immediatly when possible (#6121) * Fix the end date on credit accounts being shown correctly (#6235) * Fix calculation of credit limit remaining shown on transactions and invoices * Fix credit limit remaining calculation for foreign currency transactions * Extend AR/AP batch import to support multi currency imports (#6250) * Fix login errors being hidden behind an "insecure response" error (#6251) * Fix deletion of unapproved batches failing (#6252) * Fix GL batch import menu item missing, even with appropriate permissions (#6248) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.9.5/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.9.5 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.9.5 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.9.5 These are the sha256 checksums of the uploaded files: 94d1fe61b5c5c2914c0f02bc57794754ae51cbd52efea115ff4a7bdc16bcee94 ledgersmb-1.9.5.tar.gz fcd0872685e3c112cfe19a915e8bf13189a733630ea67960211e27cebd153a87 ledgersmb-1.9.5.tar.gz.asc

1 0

LedgerSMB 1.8.24 released
by Erik Huelsmann 08 Dec '21

08 Dec '21

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.8.24 * Fix multiple issues with bank account reconciliation (#6122) * Fix correct AR/AP account being selected on Update and when editing (#6191) * Fix the end date on credit accounts being shown correctly (#6235) * Fix calculation of credit limit remaining shown on transactions and invoices * Fix credit limit remaining calculation for foreign currency transactions * Fix login errors being hidden behind an "insecure response" error (#6251) * Fix GL batch import menu item missing, even with appropriate permissions (#6248) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.8.24/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.8.24 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.8.24 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.8.24 These are the sha256 checksums of the uploaded files: 9fa485960be1a0c7500e60d2041380d494c84b542706e4fba3150b4c43657275 ledgersmb-1.8.24.tar.gz 1aafc72d4fe1ca161b6a0c3bbc00d299e4f1fb621774c37330d671493d528b16 ledgersmb-1.8.24.tar.gz.asc

1 0

LedgerSMB 1.7.37 released
by Erik Huelsmann 08 Dec '21

08 Dec '21

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.7.37 * Fix login errors being hidden behind an "insecure response" error (#6251) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.7.37/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.7.37 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.7.37 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.7.37 These are the sha256 checksums of the uploaded files: 4508200782fd5f39b4ac14521c80e0112f224c8db50581e2829e686c7555a82d ledgersmb-1.7.37.tar.gz db63bf9c2c3c3cfcf0ca87fbb2aa835a8c28322ee2f48d522fbbdb1a2e500624 ledgersmb-1.7.37.tar.gz.asc

1 0

What versions should I port in?
by Chris Bennett 05 Dec '21

05 Dec '21

I was wondering which versions I should try to port in. 1.7, 1.8, 1.9? Bringing in more than one version is OK, but what are people using the most? Which ones are approaching end of life/support? As far as the optional features, I can just leave a message after installation about being able to get those features afterwards by downloading the necessary packages. I can't do any testing at home. The amdgpu firmware hasn't worked out for my laptop. -- Regards, Chris Bennett

2 1

Once again going to try to port into OpenBSD. :-}
by Chris Bennett 04 Dec '21

04 Dec '21

Hello again! I found a nice Black Friday special on a server I can afford. So, another time, 4th time, but who's counting? As I suspected, I would hit a moment where I couldn't come up with $136 a month. So I had to drop that server. Same server, but $67 now. I saved my work on github, which is a big mess, but will help a lot. I learned a ton about submitting and how to deal with that set of Locale::CLDR modules. I also had a strange problem. As far as I have seen, nobody has ever done a project with dozens of dependencies to bring in as just a single person. These types of projects have always been done by groups or really top notch porters, with commit powers to the CVS repository. One problem I had was not seeing the obvious solution to how to deal with really long chains of new dependencies. The people who review submissions DO NOT want single ports to be submitted one at a time, because they are very busy. It didn't occur to me how to deal with this problem until after I stopped working on this. Rather than submit a ridiculously long set of 12 or more dependencies from the LedgerSMB cpanfile outwards, I needed to go out to the end of the chain and work inwards instead, thus submitting only 2-4 at a time. I am now starting up again. I would really appreciate any help, including just a little bit. Even getting just one Perl module ready to submit is more than enough. Different OS's have different goals. OpenBSD is primarily security oriented, so the method of getting a port ready is very strict. Building a port outside of the porting system is strictly forbidden. The FAQ's about porting and the man pages are a bit overwhelming, but most of the needed dependencies are pretty easy to work with. It does require running OpenBSD -current, but that has been amazingly good for quite some time. If you would either like to help or just tell me if you are wanting this to be done, please let me know. Just telling me you want this is really encouraging for me. My ugly mess is at https://github.com/CPBen/LSMB-for-OBSD-WIP It's so messy since I had to upload and download a few hundred GB to and from home and across two servers. Sorry. -- Regards, Chris Bennett

1 0

LedgerSMB 1.9.4 released
by Erik Huelsmann 25 Nov '21

25 Nov '21

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.9.4 * Fix balance sheet printing template listing account descriptions (#6203) * Fix reconciliations to include Source value from transactions (#6122) * Fix error thrown from CSV export function (#6140) * Fix reporting of login problems due to e.g. version mismatch (#5976) * Fix 'import' of username on HR > Employee menu | User tab (#5287) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.9.4/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.9.4 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.9.4 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.9.4 These are the sha256 checksums of the uploaded files: 30d5f86a48b0861ac142fef48e9a1617757be88c190b1a772f7d8cef1f95f690 ledgersmb-1.9.4.tar.gz 155d1bf2f93f86f1848fed5c3a0e90924decb5592d27284264a1afc41e6bce4f ledgersmb-1.9.4.tar.gz.asc

1 0

LedgerSMB 1.9.3 released
by Erik Huelsmann 16 Nov '21

16 Nov '21

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.9.3 * Sort the buttons on the e-mail entry screen * Fix issues with the PDF output for PNL and Balance sheet reports * Fix indenting on the hierarchical PNL and balance sheet HTML reports * Add link to download HTML PNL and balance sheet reports * Add rudimentary CSS to HTML PNL and balance sheet reports * Fix off-by-one column on the PNL and balance sheet total lines * Remove application links on downloaded HTML PNL and balance sheet reports * Use a temp table to prevent bulk payments trampling on each other * Fix sorting on fixed asset searches (#6151) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.9.3/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.9.3 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.9.3 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.9.3 These are the sha256 checksums of the uploaded files: 265aaa291f2a021e5c77e9fb674740669a19d552856f841b73f62cc040bf0a4a ledgersmb-1.9.3.tar.gz f97ecc7fa4277648a018ff508d656c403b2445cf4669a0e52908e23f83c74861 ledgersmb-1.9.3.tar.gz.asc

3 2

LedgerSMB 1.8.23 released
by Erik Huelsmann 14 Nov '21

14 Nov '21

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.8.23 * Use a temp table to prevent bulk payments trampling on each other * Fix sorting on fixed asset searches (#6151) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.8.23/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.8.23 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.8.23 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.8.23 These are the sha256 checksums of the uploaded files: ec929dd8ecb522ed2ff1b7cfe43d73746095df1736cd7807d0cec8baef3469fa ledgersmb-1.8.23.tar.gz 0cdc60f7e95b63f950d2561dddd08d0d12d5c696ef675af67684aae6b8466193 ledgersmb-1.8.23.tar.gz.asc

1 0

LedgerSMB 1.9.2 released
by Erik Huelsmann 12 Oct '21

12 Oct '21

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.9.2 * Fix sending mail with multiple Bcc addresses (#6087) * Fix manual taxes on credit invoices (#5721) * Add missing account configuration on Sales account (#6100) * Fix Update clobbering invoice header data (e.g. fx rate) (#6114) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.9.2/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.9.2 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.9.2 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.9.2 These are the sha256 checksums of the uploaded files: 73a5006669cbb177c732602ecbf9f85c3b11d8171eeecebcc0cf933eca9f7c02 ledgersmb-1.9.2.tar.gz 50c09dd7652d6054189e82d5e1f37b4b1bca19467f7a14fc54a68ff80dcb7deb ledgersmb-1.9.2.tar.gz.asc

1 0

[SECURITY] Security advisory for CVE-2021-3882 (non-Secure session cookie)
by Erik Huelsmann 12 Oct '21

12 Oct '21

On September 16th, the LedgerSMB project was advised of a security vulnerability in the code. Please see below our security advisory. Sensitive Cookie in HTTPS Session Without 'Secure' Attribute Summary: ======== LedgerSMB does not set the 'Secure' attribute on the session authorization cookie when the client uses HTTPS and the LedgerSMB server is behind a reverse proxy. By tricking a user to use an unencrypted connection (HTTP), an attacker may be able to obtain the authentication data by capturing network traffic. Known vulnerable: ================= All of: - 1.8.0 upto 1.8.21 (including) Known fixed: ============ - 1.8.22 Details: ======== LedgerSMB 1.8 and newer switched from Basic authentication to using cookie authentication with encrypted cookies. Although an attacker can't access the information inside the cookie, nor the password of the user, possession of the cookie is enough to access the application as the user from which the cookie has been obtained. In order for the attacker to obtain the cookie, first of all the server must be configured to respond to unencrypted requests, the attacker must be suitably positioned to eavesdrop on the network traffic between the client and the server *and* the user must be tricked into using unencrypted HTTP traffic. Proper audit control and separation of duties limit Integrity impact of the attack vector. Severity: ========= CVSSv3.1 Base Score: 5.9 (Medium) CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N Recommendations: ================ Users of LedgerSMB 1.8 are urged to upgrade to known-fixed versions. Users of LedgerSMB 1.7 or 1.9 are unaffected by this vulnerability and don't need to take action. As a workaround, users may configure their Apache or Nginx reverse proxy to add the Secure attribute at the network boundary instead of relying on LedgerSMB. For Apache, please refer to the 'Header always edit' configuration command in the mod_headers module. For Nginx, please refer to the 'proxy_cookie_flags' configuration command. References: =========== CVE-2021-3882 (LedgerSMB) https://ledgersmb.org/cve-2021-3882-sensitive-non-secure-cookie https://huntr.dev/bounties/7061d97a-98a5-495a-8ba0-3a4c66091e9d/ Reported by: ============ 0xdhinu, user of the huntr.dev platform Patches: ======== index 8dbcacddd..063e44415 100644 --- a/lib/LedgerSMB/Middleware/AuthenticateSession.pm +++ b/lib/LedgerSMB/Middleware/AuthenticateSession.pm @@ -209,7 +209,7 @@ sub call { $dbh->rollback; $dbh->disconnect; - my $secure = ($env->{SERVER_PROTOCOL} eq 'https') ? '; Secure' : ''; + my $secure = ($env->{HTTPS} eq 'ON') ? '; Secure' : ''; my $path = LedgerSMB::PSGI::Util::cookie_path($env->{SCRIPT_NAME}); return Plack::Util::response_cb( $res, sub { -- Bye, Erik. http://efficito.com -- Hosted accounting and ERP. Robust and Flexible. No vendor lock-in.

1 0

LedgerSMB 1.8.22 released
by Erik Huelsmann 12 Oct '21

12 Oct '21

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.8.22 * Fix sending mail with multiple Bcc addresses (#6087) * Fix manual taxes on credit invoices (#5721) * Fix 'Secure' flag on session cookie; CVE-2021-3882 * Improve configuring acceptable reverse proxy addresses For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.8.22/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.8.22 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.8.22 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.8.22 These are the sha256 checksums of the uploaded files: 583f56c2d303eeb133222467d368a58b5e66ee080040335d3608dfc672aa7316 ledgersmb-1.8.22.tar.gz 15affde0f85b03dd9a1784304958a030fa9b5009df800e093f443bce55c541a0 ledgersmb-1.8.22.tar.gz.asc

1 0

LedgerSMB 1.7.36 released
by Erik Huelsmann 12 Oct '21

12 Oct '21

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.7.36 * Fix manual taxes on credit invoices (#5721) * Improve configuring acceptable reverse proxy addresses For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.7.36/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.7.36 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.7.36 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.7.36 These are the sha256 checksums of the uploaded files: 8c638acc822a43a1ec66268f08c961f5b392b6fadd6069eb6c2462e5b2ce9030 ledgersmb-1.7.36.tar.gz d85b50e090e99f5917c6d834cb8d54360d56af9dff8b05b4ffff3d4cf9984ccb ledgersmb-1.7.36.tar.gz.asc

1 0

LedgerSMB 1.9.1 released
by Erik Huelsmann 01 Oct '21

01 Oct '21

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. Through a week of outstanding teamwork, we're able to bring 15 fixes and small changes (not all fixes for regressions) in this release. This release contains the following fixes and improvements: Changelog for 1.9.1 * Fix license declaration in package.json (gpl-v2.0-or-newer) * Fix scrollbars in the main window overlapping with real content (#5874) * Fix 'setup.pl' to work with Safari for creation of new data sets (#6016) * Fix no payment lines shown after saving invoices and transactions (#6017) * Fix e-mailed invoices not being sent to Bcc addresses * Add support for workflow overrides * Add a list of available e-mail variables for expansion * Restore e-mail body variable expansion (#6042) * Add example Chart of Accounts with hierarchy (US General based) (#6057) * Fix SQL date errors using date formats other than yyyy-mm-dd (#6040) * Fix default to/cc/bcc addresses not applied to e-mail (#6045) * Correctly present password experation in preferences (#6067) * Fix initialization of 'current earnings' setting from CoA XML * Correctly select the default country on Contact address entry (#6058) * Correctly set parent of CoA headers when loading from XML (#6068) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.9.1/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.9.1 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.9.1 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.9.1 These are the sha256 checksums of the uploaded files: a705e14658c1729e73478626fee3b7bda123e963d95b506d6a2d6ef1ac926822 ledgersmb-1.9.1.tar.gz 5873f92712243977b5ec50f44560ea89a332c618294d062e14ba888c9b73bec0 ledgersmb-1.9.1.tar.gz.asc

1 0

LedgerSMB 1.9.0 released
by Erik Huelsmann 24 Sep '21

24 Sep '21

The LedgerSMB development team is happy to announce the first release of a new release branch: 1.9.0. This series features a wide variety of new features, improvements, bug fixes and cleanup. To name a few: * Emailed documents are added to the database as attachments * Orders and invoices show change history * Command line application for administrative tasks (bin/ledgersmb-admin) * Faster HTML response generation (optimized HTML preprocessing) * Report filters and account settings hide GIFI when not configured * Configuration setting 'Only Timeout Locks' removed * Clicking 'Update' no longer clobbers saved invoices and transactions * Fixed mailing of aging reports (regression since 1.3.42) * Optimize balance sheet report (use balance snapshots from period closing) * Reformat UI HTML templates & HTML5 upgrade (from 4.01 Transitional) * Code cleanup reducing the number of warnings in the server logs * JavaScript now built using WebPack (no longer using Dojo's build only) * Removal of licence-incompatible code in utils/lib/ * Performance tuning of UI template handling code For the full changelog see https://github.com/ledgersmb/LedgerSMB/blob/1.9/Changelog For a more in-depth coverage of notable changes in this release, please consult the release notes at https://ledgersmb.org/content/19-release-notes For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.9.0/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.9.0 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.9.0 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.9.0 These are the sha256 checksums of the uploaded files: 7892ceab986c80ccaf4d5722096c21bac2ff9cfdfc240e9681326fb033c50b11 ledgersmb-1.9.0.tar.gz 6d9985c146bb992ba97c3b5bb31e37dbc47204d7011f84dc21c81abb9ed98498 ledgersmb-1.9.0.tar.gz.asc

1 0

LedgerSMB 1.9.0-rc1 released
by Erik Huelsmann 18 Sep '21

18 Sep '21

Hi, As one of the last steps in the release process leading up to the release of 1.9.0, there's the release of 1.9.0-rc1, release candidate 1. This release is considered production ready and provided for general testing and last-minute bug feedback. The release notes for the 1.9.0 release apply to this release as well and can be found at https://ledgersmb.org/content/19-release-notes ; please report any issues with the release notes just as well as with the released software! The release is available as a docker image and can be run using the updated docker compose file at https://github.com/ledgersmb/ledgersmb-docker/blob/1.9/docker-compose.yml or with the docker command: $ docker pull ledgersmb/ledgersmb:1.9 The release tarball can be downloaded from our download site at https://download.ledgersmb.org/f/Beta Releases/1.9.0-rc1 Please provide your feedback in reply to this e-mail or as issues filed on the GitHub site at https://github.com/ledgersmb/LedgerSMB -- Bye, Erik. http://efficito.com -- Hosted accounting and ERP. Robust and Flexible. No vendor lock-in.

1 0

LedgerSMB 1.8.21 released
by Erik Huelsmann 18 Sep '21

18 Sep '21

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.8.21 * Prevent draft approval by user without permission (#5984) * Fix UI consistency (missing CSS class) in purchase invoice (#5988) * Fix performance problem deleting huge draft transactions (#5993) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.8.21/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.8.21 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.8.21 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.8.21 These are the sha256 checksums of the uploaded files: d75d9d4dfbc4dadf02f0a25d3c64a22c348802ca3d926a8c550af4d705d90027 ledgersmb-1.8.21.tar.gz 6659d193b4922d6c11b8c09162484e15bd019e502aebc29faf4942809a997679 ledgersmb-1.8.21.tar.gz.asc

1 0

LedgerSMB 1.9.0-beta1 released
by Erik Huelsmann 12 Sep '21

12 Sep '21

Hi all, Yesterday, I've uploaded the first beta for LedgerSMB 1.9.0 (ledgersmb-1.9.0-beta1). This release is available for download from https://download.ledgersmb.org/f/Beta%20Releases/1.9.0-beta1/ Or as a docker image with the command $ docker pull ledgersmb/ledgersmb:1.9.0-beta1 This beta is a feature complete version of ledgersmb-1.9.0 made available for testing and evaluation. Please send any bug reports, questions or surprises to the developers mailing list at devel(a)lists.ledgersmb.org or create an issue in the GitHub Issue tracker at https://github.com/ledgersmb/LedgerSMB/issues The 1.9.0 release has an impressive list of changes, available in the Changelog file at https://github.com/ledgersmb/LedgerSMB/blob/master/Changelog#L6-L90 ; if you have any questions regarding the items listed, please feel free to join the LedgerSMB chat channel at https://app.element.io/#/room/#ledgersmb:matrix.org or post your question to the developers mailing list. -- Bye, Erik. http://efficito.com -- Hosted accounting and ERP. Robust and Flexible. No vendor lock-in.

1 1

ledgersmb 1.6.9+ds-2.1 MIGRATED to testing
by Debian testing watch 06 Sep '21

06 Sep '21

FYI: The status of the ledgersmb source package in Debian's testing distribution has changed. Previous version: 1.6.9+ds-2 Current version: 1.6.9+ds-2.1 -- This email is automatically generated once a day. As the installation of new packages into testing happens multiple times a day you will receive later changes on the next day. See https://release.debian.org/testing-watch/ for more information.

1 0

LedgerSMB 1.8.20 released
by Erik Huelsmann 03 Sep '21

03 Sep '21

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.8.20 * Fix for chart of accounts headings import from CSV (#5987) * Correctly set the payment account in invoices and transactions (#5801) * Fix regression in CVE-2021-3693 failing to show errors as popups (#5921) * Fix regression in CVE-2021-3693 with broken downloads of backups (#5931) In addition to the above, it should be noted that the Docker images have been built with a new build procedure which provides better mapping of Perl dependencies to Debian packages. Due to this change, dependencies will be updated automatically. Should there be any issues with the images despite this improvement, please report to the GitHub issue tracker for the Docker images at: https://github.com/ledgersmb/ledgersmb-docker/issues For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.8.20/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.8.20 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.8.20 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.8.20 These are the sha256 checksums of the uploaded files: fd9c6dd36e656df592a2a241d1d3c1296e9fc45eb94610beccf5e0eab7db6541 ledgersmb-1.8.20.tar.gz 870128cf20b30f3b17d6d57ccbebd1769190ad72994ad28cd69e869b807d717e ledgersmb-1.8.20.tar.gz.asc

1 0