- devel - lists.freelock.com

[SECURITY] Advisory for cross site scripting security vulnerability CVE-2021-3694
by Erik Huelsmann 23 Aug '21

23 Aug '21

On August 4th, the LedgerSMB project was advised of a security vulnerability in the code. Please see below our security advisory. Reflected cross-site scripting of authenticated users in LedgerSMB Summary: ======== LedgerSMB does not sufficiently HTML-encode error messages sent to the browser. By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure. Known vulnerable: ================= All of: - 1.1.0 upto 1.1.12 (including) - 1.2.0 upto 1.2.26 (including) - 1.3.0 upto 1.3.47 (including) - 1.4.0 upto 1.4.42 (including) - 1.5.0 upto 1.5.30 (including) - 1.6.0 upto 1.6.33 (including) - 1.7.0 upto 1.7.32 (including) - 1.8.0 upto 1.8.17 (including) Known fixed: ============ - 1.7.33 - 1.8.18 Details: ======== When encountering an error, LedgerSMB sends the user feedback which may include user-provided input. This input was not sufficiently sanitized before being included in the error report. This allows an attacker inject a script in the error response page by send a specially crafted URL to an authenticated user. As the error page itself does not contain any sensitive information, a sophisticated payload in addition to targetting a sufficiently privileged user, is required for information disclosure. Proper audit control and separation of duties limit Integrity impact of the attack vector. The vulnerable code to provide this user-feedback dates back to version 1.0. Please note that not error messages are vulnerable to this attack as not all messages report the problematic input to the user. Severity: ========= CVSSv3.1 Base Score: 8.2 (High) CVSSv3.1 Vector: AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N Recommendations: ================ We recommend all users to upgrade to known-fixed versions. Versions prior to 1.7 are end-of-life and will not receive security fixes from the LedgerSMB project. Users who cannot upgrade, may apply the included patches or are advised to contact a vendor for custom support. There are no workarounds available for this vulnerability. References: =========== CVE-2021-3694 (LedgerSMB) https://ledgersmb.org/cve-2021-3694-cross-site-scripting https://huntr.dev/bounties/ef7f4cf7-3a81-4516-b261-f5b6ac21430c/ Reported by: ============ ranjit-git, user of the huntr.dev platform Patches: ======== Patch for LedgerSMB 1.8 (1.8.0 upto 1.8.17, including): ------------------------------------------------------- [[[ diff --git a/lib/LedgerSMB/PSGI/Util.pm b/lib/LedgerSMB/PSGI/Util.pm index 11c01918f..bf443d886 100644 --- a/lib/LedgerSMB/PSGI/Util.pm +++ b/lib/LedgerSMB/PSGI/Util.pm @@ -24,6 +24,7 @@ use strict; use warnings; use Carp; +use HTML::Escape; use HTTP::Status qw( HTTP_OK HTTP_INTERNAL_SERVER_ERROR HTTP_SEE_OTHER HTTP_BAD_REQUEST ); @@ -41,7 +42,7 @@ Returns a standard error representation for HTTP status 500 sub internal_server_error { - my ($msg, $title, $company, $dbversion) = @_; + my ($msg, $title, $company, $dbversion) = map { escape_html($_ // '') } @_; $title //= 'Error!'; $msg =~ s/\n/<br>/g; diff --git a/old/lib/LedgerSMB/oldHandler.pm b/old/lib/LedgerSMB/oldHandler.pm index 1db966406..848eeb75c 100644 --- a/old/lib/LedgerSMB/oldHandler.pm +++ b/old/lib/LedgerSMB/oldHandler.pm @@ -57,6 +57,7 @@ use LedgerSMB::Sysconfig; use Cookie::Baker; use Digest::MD5; +use HTML::Escape; use Log::Log4perl; use Try::Tiny; @@ -184,14 +185,17 @@ sub handle { sub _error { my ($form, $msg, $status) = @_; $msg = "? _error" if !defined $msg; + my $html_msg = escape_html($msg); + my $html_dbversion = escape_html($form->{dbversion}); + my $html_company = escape_html($form->{company}); $status = 500 if ! defined $status; print qq|Status: $status ISE Content-Type: text/html; charset=utf-8 <html> -<body><h2 class="error">Error!</h2> <p><b>$msg</b></p> -<p>dbversion: $form->{dbversion}, company: $form->{company}</p> +<body><h2 class="error">Error!</h2> <p><b>$html_msg</b></p> +<p>dbversion: $html_dbversion, company: $html_company</p> </body> </html> |; ]]] Patch for LedgerSMB 1.7 (1.7.0 upto 1.7.32, including): ------------------------------------------------------- [[[ diff --git a/lib/LedgerSMB/PSGI/Util.pm b/lib/LedgerSMB/PSGI/Util.pm index 2d6195d69..b716a01c4 100644 --- a/lib/LedgerSMB/PSGI/Util.pm +++ b/lib/LedgerSMB/PSGI/Util.pm @@ -24,6 +24,7 @@ use strict; use warnings; use Carp; +use HTML::Escape; use HTTP::Status qw( HTTP_OK HTTP_INTERNAL_SERVER_ERROR HTTP_SEE_OTHER HTTP_UNAUTHORIZED ); @@ -41,7 +42,7 @@ Returns a standard error representation for HTTP status 500 sub internal_server_error { - my ($msg, $title, $company, $dbversion) = @_; + my ($msg, $title, $company, $dbversion) = map { escape_html($_ // '') } @_; $title //= 'Error!'; $msg =~ s/\n/<br>/g; diff --git a/old/bin/old-handler.pl b/old/bin/old-handler.pl index 24fa7a0a0..87864fc7e 100644 --- a/old/bin/old-handler.pl +++ b/old/bin/old-handler.pl @@ -187,14 +187,16 @@ $form->{dbh}->disconnect() if defined $form->{dbh}; sub _error { my ($form, $msg, $status) = @_; $msg = "? _error" if !defined $msg; + my $html_msg = escape_html($msg); + my $html_dbversion = escape_html($form->{dbversion}); + my $html_company = escape_html($form->{company}); $status = 500 if ! defined $status; print qq|Status: $status ISE Content-Type: text/html; charset=utf-8 - <html> -<body><h2 class="error">Error!</h2> <p><b>$msg</b></p> -<p>dbversion: $form->{dbversion}, company: $form->{company}</p> +<body><h2 class="error">Error!</h2> <p><b>$html_msg</b></p> +<p>dbversion: $html_dbversion, company: $html_company</p> </body> </html> |; ]]] -- Bye, Erik. http://efficito.com -- Hosted accounting and ERP. Robust and Flexible. No vendor lock-in.

1 0

[SECURITY] Advisory for cross site scripting security vulnerability CVE-2021-3693
by Erik Huelsmann 23 Aug '21

23 Aug '21

On August 4th, the LedgerSMB project was advised of a security vulnerability in the code. Please see below our security advisory. DOM cross-site scripting of authenticated users in LedgerSMB Summary: ======== LedgerSMB does not check the origin of HTML fragments merged into the browser's DOM. By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure. Known vulnerable: ================= All of: - 1.5.0 upto 1.5.30 (including) - 1.6.0 upto 1.6.33 (including) - 1.7.0 upto 1.7.32 (including) - 1.8.0 upto 1.8.17 (including) Known fixed: ============ - 1.7.33 - 1.8.18 Details: ======== LedgerSMB uses the URL's hash fragment (the part after the '#'-sign) to store which screen the user is on, for the purpose of history navigation (the back button). The hash fragment is assumed to be a URL that is part of the web application's URL space. This assumption is not verified. This allows an attacker inject a script into the page by send a specially crafted URL to an authenticated user. As the process of loading the attack payload overwrites any content in the main window, the attack by itself does not expose sensitive information; a sophisticated payload in addition to targetting a sufficiently privileged user, is required for information disclosure. Proper audit control and separation of duties limit Integrity impact of the attack vector. The vulnerable code dates back to version 1.5 when LedgerSMB moved to the Single Page Application (SPA) model for web applications. Severity: ========= CVSSv3.1 Base Score: 7.1 (High) CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N Recommendations: ================ We recommend all users to upgrade to known-fixed versions. Versions prior to 1.7 are end-of-life and will not receive security fixes from the LedgerSMB project. Users who cannot upgrade, may apply the included patches or are advised to contact a vendor for custom support. There are no workarounds available for this vulnerability. References: =========== CVE-2021-3693 (LedgerSMB) https://ledgersmb.org/cve-2021-3693-cross-site-scripting https://huntr.dev/bounties/daf1384d-648a-43fd-9b35-5c37d8ead667/ Reported by: ============ ranjit-git, user of the huntr.dev platform Patches: ======== Patch for LedgerSMB 1.8 (1.8.0 upto 1.8.17, including): ------------------------------------------------------- [[[ diff --git a/UI/js-src/lsmb/MainContentPane.js b/UI/js-src/lsmb/MainContentPane.js index 9c0d6113c..ebfa36f05 100644 --- a/UI/js-src/lsmb/MainContentPane.js +++ b/UI/js-src/lsmb/MainContentPane.js @@ -7,8 +7,8 @@ define([ "dojo/dom-style", "dojo/_base/lang", "dojo/promise/Promise", + "dojo/Deferred", "dojo/promise/all", - "dojo/request/xhr", "dojo/query", // "dojo/request/iframe", "dojo/dom-class" @@ -19,12 +19,21 @@ define([ domStyle, lang, Promise, + Deferred, all, - xhr, query, // iframe, domClass ) { + var docURL = new URL(document.location); + var domReject = function (request) { + return ( + request.getResponseHeader("X-LedgerSMB-App-Content") !== "yes" || + (request.getResponseHeader("Content-Disposition") || "").startsWith( + "attachment" + ) + ); + }; return declare("lsmb/MainContentPane", [ContentPane], { last_page: null, interceptClick: null, @@ -74,17 +83,62 @@ define([ ); }, load_form: function (url, options) { + var tgt = new URL(url, docURL); + if (tgt.origin !== docURL.origin) { + return new Deferred().resolve(); + } + var self = this; self.fade_main_div(); - return xhr(url, options).then( - function (doc) { - self.hide_main_div(); - self.set_main_div(doc); - }, - function (err) { - self.show_main_div(); - self.report_request_error(err); - } + var req = new XMLHttpRequest(); + var dfd = new Deferred(function () { + req.abort(); + }); + try { + req.open(options.method || "GET", tgt); + var headers = options.headers; + for (var hdr in headers || {}) { + req.setRequestHeader(hdr, headers[hdr]); + } + if ( + options.data && + !(options.data instanceof FormData) && + !headers["Content-Type"] + ) { + req.setRequestHeader( + "Content-Type", + "application/x-www-form-urlencoded" + ); + } + req.setRequestHeader("X-Requested-With", "XMLHttpRequest"); + req.addEventListener("load", function () { + dfd.resolve(req); + }); + req.addEventListener("error", function () { + dfd.reject(req); + }); + req.send(options.data || ""); + } catch (e) { + dfd.reject(e); + } + + return dfd.then( + function (request) { + if (domReject(request)) { + return self.show_main_div(); + } + + self.hide_main_div(); + return self.set_main_div(request.response); + }, + function (request) { + if (domReject(request)) { + return self.show_main_div(); + } + + self.show_main_div(); + return self.report_request_error({ err: request }); + } ); }, download_link: function (/*href*/) { diff --git a/lib/LedgerSMB/Middleware/DynamicLoadWorkflow.pm b/lib/LedgerSMB/Middleware/DynamicLoadWorkflow.pm index 99a964548..07f2feb34 100644 --- a/lib/LedgerSMB/Middleware/DynamicLoadWorkflow.pm +++ b/lib/LedgerSMB/Middleware/DynamicLoadWorkflow.pm @@ -29,6 +29,7 @@ use HTTP::Status qw/ HTTP_REQUEST_ENTITY_TOO_LARGE /; use List::Util qw{ none any }; use Module::Runtime qw/ use_module /; use Plack::Request; +use Plack::Util; use Plack::Util::Accessor qw( script script_name module ); use LedgerSMB::PSGI::Util; @@ -91,7 +92,15 @@ sub call { $env->{'lsmb.script_name'} = $self->script_name; $env->{'lsmb.action'} = $action; $env->{'lsmb.action_name'} = $action_name; - return $self->app->($env); + return Plack::Util::response_cb( + $self->app->($env), + sub { + if (not Plack::Util::header_exists($_[0]->[1], + 'X-LedgerSMB-App-Content')) { + Plack::Util::header_push($_[0]->[1], + 'X-LedgerSMB-App-Content', 'yes'); + } + }); } diff --git a/lib/LedgerSMB/PSGI.pm b/lib/LedgerSMB/PSGI.pm index 26b4ec6b3..b0b20a95b 100644 --- a/lib/LedgerSMB/PSGI.pm +++ b/lib/LedgerSMB/PSGI.pm @@ -119,7 +119,15 @@ sub old_app { my $env = shift; local $psgi_env = $env; - return $handler->($env); + return Plack::Util::response_cb( + $handler->($env), + sub { + if (not Plack::Util::header_exists($_[0]->[1], + 'X-LedgerSMB-App-Content')) { + Plack::Util::header_push($_[0]->[1], + 'X-LedgerSMB-App-Content', 'yes'); + } + }); } } ]]] Patch for LedgerSMB 1.7 (1.7.0 upto 1.7.32, including): ------------------------------------------------------- [[[ diff --git a/UI/js-src/lsmb/MainContentPane.js b/UI/js-src/lsmb/MainContentPane.js index 17ac8d391..5bc1bd4fa 100644 --- a/UI/js-src/lsmb/MainContentPane.js +++ b/UI/js-src/lsmb/MainContentPane.js @@ -6,6 +6,7 @@ define([ "dojo/dom-style", "dojo/_base/lang", "dojo/promise/Promise", + "dojo/Deferred", "dojo/on", "dojo/hash", "dojo/promise/all", @@ -15,8 +16,14 @@ define([ "dojo/dom-class" ], function(ContentPane, declare, event, registry, style, - lang, Promise, on, hash, all, xhr, query, iframe, + lang, Promise, Deferred, on, hash, all, xhr, query, iframe, domClass) { + var docURL = new URL(document.location); + var domReject = function (request) { + return ( + request.getResponseHeader("X-LedgerSMB-App-Content") !== "yes" || + (request.getResponseHeader("Content-Disposition") || "").startsWith("attachment")); + }; return declare("lsmb/MainContentPane", [ContentPane], { @@ -56,17 +63,61 @@ define([ }); }, load_form: function(url, options) { + var tgt = new URL(url, docURL); + if (tgt.origin !== docURL.origin) { + return (new Deferred()).resolve(); + } + var self = this; self.fade_main_div(); - return xhr(url, options).then( - function(doc){ + var req = new XMLHttpRequest(); + var dfd = new Deferred(function () { + req.abort(); + }); + try { + req.open(options.method || "GET", tgt); + var headers = options.headers || {}; + for (var hdr in headers) { + req.setRequestHeader(hdr, headers[hdr]); + } + if (options.data && + !(options.data instanceof FormData) && + ! headers["Content-Type"]) { + req.setRequestHeader( + "Content-Type", + "application/x-www-form-urlencoded" + ); + } + req.setRequestHeader("X-Requested-With", "XMLHttpRequest"); + req.addEventListener("load", function () { + dfd.resolve(req); + }); + req.addEventListener("error", function () { + dfd.reject(req); + }); + req.send(options.data || ""); + } catch (e) { + dfd.reject(e); + } + + return dfd.then( + function (request) { + if (domReject(request)) { + return self.show_main_div(); + } + self.hide_main_div(); - self.set_main_div(doc); + return self.set_main_div(request.response); }, - function(err){ + function (request) { + if (domReject(request)) { + return self.show_main_div(); + } + self.show_main_div(); - self.report_request_error(err); - }); + return self.report_request_error({ err: request }); + } + ); }, download_link: function(href) { // while it would have been nice for the code below diff --git a/lib/LedgerSMB/Middleware/DynamicLoadWorkflow.pm b/lib/LedgerSMB/Middleware/DynamicLoadWorkflow.pm index 94737a25d..6964798a5 100644 --- a/lib/LedgerSMB/Middleware/DynamicLoadWorkflow.pm +++ b/lib/LedgerSMB/Middleware/DynamicLoadWorkflow.pm @@ -28,6 +28,7 @@ use parent qw ( Plack::Middleware ); use List::Util qw{ none any }; use Module::Runtime qw/ use_module /; use Plack::Request; +use Plack::Util; use LedgerSMB::PSGI::Util; @@ -95,7 +96,15 @@ sub call { $env->{'lsmb.script_name'} = $script_name; $env->{'lsmb.action'} = $action; $env->{'lsmb.action_name'} = $action_name; - return $self->app->($env); + return Plack::Util::response_cb( + $self->app->($env), + sub { + if (not Plack::Util::header_exists($_[0]->[1], + 'X-LedgerSMB-App-Content')) { + Plack::Util::header_push($_[0]->[1], + 'X-LedgerSMB-App-Content', 'yes'); + } + }); } diff --git a/lib/LedgerSMB/PSGI.pm b/lib/LedgerSMB/PSGI.pm index 328e80ad3..ec8be07f1 100644 --- a/lib/LedgerSMB/PSGI.pm +++ b/lib/LedgerSMB/PSGI.pm @@ -78,7 +78,7 @@ Returns a 'PSGI app' which handles requests for the 'old-code' scripts in old/bi =cut sub old_app { - return CGI::Emulate::PSGI->handler( + my $handler = CGI::Emulate::PSGI->handler( sub { my $uri = $ENV{REQUEST_URI}; $uri =~ s/\?.*//; @@ -86,6 +86,18 @@ sub old_app { _run_old(); }); + + return sub { + return Plack::Util::response_cb( + $handler->(@_), + sub { + if (not Plack::Util::header_exists($_[0]->[1], + 'X-LedgerSMB-App-Content')) { + Plack::Util::header_push($_[0]->[1], + 'X-LedgerSMB-App-Content', 'yes'); + } + }); + } } ]]] -- Bye, Erik. http://efficito.com -- Hosted accounting and ERP. Robust and Flexible. No vendor lock-in.

1 0

LedgerSMB 1.8.17 released
by Erik Huelsmann 28 Jul '21

28 Jul '21

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.8.17 * Align filters between UI and the database on draft transaction search (#5692) * Correctly present manual tax and invoice total on reversing invoice (#5721) * Repeatedly saving a draft invoice pops up an SQL error (#5679) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.8.17/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.8.17 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.8.17 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.8.17 These are the sha256 checksums of the uploaded files: b1eabf07226041216fe286b68d7204b2ac7925bef56140bc15b2897587e247c9 ledgersmb-1.8.17.tar.gz fcb5994b391716b8c8c51b04977717ca9d8df5edd8789a864d1afdb380a683c5 ledgersmb-1.8.17.tar.gz.asc

1 0

Re: Progress on Invoice webservice (discussion solicited)
by Erik Huelsmann 14 Jul '21

14 Jul '21

Hi David, On Mon, Jul 12, 2021 at 12:04 PM lsmbdev <lsmbdev(a)sbts.com.au> wrote: > Regarding my suggestion for 3 sets of price data to be stored against each > invoice line. > There is another reason (other than the obvious) I'm suggesting that. > It allows accurate reporting on sales "variations" > Ok. To be able to do that, I don't see more than the requirement for 2 sets: the actual data used in the invoice (which is already there now) and the numbers calculated by the system. If the numbers have not been overridden by the user, the "variation" is zero. > For example a salesperson may vary the price by applying a discount or > manually changing the price on an item. > In general thats good sales practice as long as the net sales margin from > a customer is above some target level. > Right. Or maybe other criteria that the sales has been mandated for. > Without storing all three items of data it becomes difficult, if not > impossible, to correctly report on this with enough detail to be useful for > basic oversight let alone malicious behaviour. > Ok. I can see how this would be convenient for oversight. However - assuming the business doesn't change its prices daily (but rather more quarterly or less often) - the data required to do oversight should be there when the oversight is effective: short after the actual sale. At that time, the data is all there. The pricematrix price derivation is even in the database now (see https://github.com/ledgersmb/LedgerSMB/blob/816e740f0702af2a2192dfe4832dc3e…) So, assuming sufficiently constant prices, you could retrieve the oversight data nicely. All the data needed to report e.g. an average sales price (per part) is also there. > I've run into other use cases in the past as well. > Ok. I was thinking to introduce the ability to track the applicable pricing at a given point in time, so as to be able to provide an audit trail on how invoice prices were determined. With the schema currently proposed, there will at least be an indicator that the person compiling the invoice either set their own price, or that the price was inherited from an order/quote (as contrasted by "taken from the pricing mechanism/calculated by the software"). Regards, Erik. > > Sent from my Galaxy > > > -------- Original message -------- > From: Erik Huelsmann <ehuels(a)gmail.com> > Date: 12/7/21 15:09 (GMT+08:00) > To: lsmbdev <lsmbdev(a)sbts.com.au> > Cc: devel(a)lists.ledgersmb.org, John Locke <john(a)freelock.com>, "Yves > Lavoie, GaYLi" <ylavoie(a)yveslavoie.com> > Subject: Re: Progress on Invoice webservice (discussion solicited) > > Hi David, > > Thanks for your response. We've discussed my earlier mail on the chat > channel as well; I'll summarize in response to your mail. > > On Tue, Jul 6, 2021 at 4:22 AM lsmbdev <lsmbdev(a)sbts.com.au> wrote: > >> Shouldn't the linetotal be returned within the calculated block rather >> than the user supplied block? >> Doing otherwise seems like a massive rounding nightmare. >> > > Yes, it should (and will); I was posting an unfortunate combination of > request and response structures. (since the response is just a superset of > the request, it's hard to separate the two in my mind). > > >> As for handling db side changes during the life cycle of the invoice (eg: >> price and tax changes) I'm not sure I see an easy solution. >> We currently have a problem here anyway. >> If we follow a full quote => order => invoice workflow you expect a price >> as shown on a quote to be static throughout the sequence. >> However it will most likely change if any source info changes along the >> way. >> > > That's a good point. Yes, I too expect the current implementation to apply > price-changes during that life cycle. Thanks for pointing that out: > Evaluating the solution to the original problem discussed on the chat > channel, I think that with a few minor changes we can support this workflow > the way it's expected to work. > > >> Personally, I think a specific request to update a line is required. >> To that end, I think each line should (as the first element) contain a >> boolean "recalc" element and a "lastcalc" timestamp >> As should the entire invoice. >> > > The solution we discussed on the chat channel is just as simple as > effective: John proposed we add a boolean to each invoice line which > indicates the price in that line should be excluded from pricematrix > calculations; e.g. named 'pricefreeze'. That way, the line gets excluded > from pricematrix calculations and won't be updated when the invoice gets > saved. How the UI gets to set the 'pricefreeze' boolean, is out of scope of > the current consideration. It didn't feel right to add another checkbox on > the already crowded invoice input screen. We came up with other ways to set > the value. But, as said, that's to be dealt with later. > > Applying this solution to your "full quote > invoice" workflow, I think > the expected behaviour can be had by setting the 'pricefreeze' parameter on > orders spawned from quotes and invoices spawned from orders. > > >> Regardless, there probably needs to be 3 sets of price data presented. >> - user overrides >> - system calculated >> - actual data for use >> > > The response is currently expected to hold just the price used for > calculation. I was originally expecting to send the list price or the price > matrix price too, but I found that to be confusing, because: which price do > you send when there's a price matrix price for the current vendor and > invoice line, but the user has overridden the price manually? > > >> All of the above should be permanently stored in the db. (FYI, we should >> be doing this even for non API entries as well. >> This preserves the data. Allowing better auditing and diagnostics) >> > > I was considering the option to add a time-dimension to the parts table, > allowing various parts uses to reference explicit lines in the table, with > the price data as it applied at the specific time of modification of the > quote/order/invoice. It's quite complex though, because: do you create a > full copy of the price matrix too? and what about the parts line itself > when e.g. a line in the makemodel table is changed? > > I decided that storing a full audit trail on modified parts data is > probably a good idea, but not something to be addressed while creating the > invoice API. For now, I'm really happy with John's "pricefreeze" suggestion > as it allows us to move forward on the implementation without endless > complexities. > > >> There is probably more to consider, but there's a start for discussion >> > > Regards, > > Erik. > > >> >> Regards >> David G >> >> -------- Original message -------- >> From: Erik Huelsmann <ehuels(a)gmail.com> >> Date: 6/7/21 04:56 (GMT+08:00) >> To: devel(a)lists.ledgersmb.org >> >> Hi, >> >> Over the past months, I've been working on a webservice for LedgerSMB to >> post invoices. The current status can be viewed here: >> https://github.com/ehuelsmann/LedgerSMB/blob/webservices/lib/LedgerSMB/Rout… >> >> Summarizing what I have achieved so far: >> >> * An endpoint /erp/api/v0/invoices/, which accepts POST requests >> * The "specification" of the payload can be found here: >> https://github.com/ehuelsmann/LedgerSMB/blob/webservices/lib/LedgerSMB/Rout… >> * The toplevel keys "eca", "account", "dates", "lines", "taxes", >> "currency", "description", >> "invumber", "ordnumber", "ponumber" are supported >> * The pricematrix is consulted when determining pricing >> * Customers and vendors are supported (each with their own type of >> pricematrix) >> >> The endpoint has been coded defensively, throwing an "unacceptable input" >> error on anything that's not consistent with what the database should >> expect. A lot of things are currently not supported: >> >> * Invoices will end up in "draft" state and cannot be Post-ed >> * Payments are not processed >> * Rounding (in the price matrix, but also of the line-totals) isn't in >> place >> * Complex taxes have limited support ("simple taxes only") >> * No multi-currency support yet >> * No support for "taxes included" tax extraction calculation (from the >> gross invoice amount) >> * I have no idea what happens with Cost Of Goods Sold calculations >> * No support for shipping addresses >> * No support for printing/mailing/etc. >> * All invoices are posted into the 'ar' table (oops!) >> >> That said, I have some questions with respect to what the functionality >> needs to be able to do, especially with respect to saving invoices in order >> to post them later. With respect to saving and posting invoices, I'm >> envisaging the workflow to require a number (lots) of save actions on the >> invoice in order to calculate its prices, i.e. to calculate the price >> matrix. There may be other reasons to save the invoice in the mean time. >> In the current invoice-entry process (running through "old code"), >> there's a lot of code which tries to determine if anything changed in the >> invoice based on the fields entered. If it did (or rather, if the deduction >> code thinks it did), the invoice will be recalculated either partial or in >> full. >> This code causes lots of headaches, because most of the time the user >> didn't expect their edits to trigger a full recalculation, or, the >> recalculation didn't happen the way it should e.g. due to the fact that >> prices had been overridden by the user. >> To prevent similar complexity in the webservice, I've created a structure >> where each line returns the data entered by the user (as provided on input) >> as well as calculated data. It is up to the front-end to present that data >> in a useful way to the user. Just as an example, the following structure >> could be a line in the invoice: >> >> { "part": { "number": "p1", "description": "p1 desc", "price": 1.23 }, >> "quantity": 5, >> "description": null, "price": null, "linetotal": 6.15, "discount": >> null } >> >> The above line means to say that the user didn't enter a price, >> description or discount. The part has been configured with a price of $1.23 >> for the current customer/vendor and the quantity on the line is 5 (as >> entered by the user). If the user enters a description, the description >> field in the line itself gets filled with that, e.g. "bike rental fees". >> Assuming that the user saves the above line without further input and >> continues by posting the invoice, I'm thinking that the posting action >> should copy the description and price from the part configuration to the >> invoice. >> This poses a timing challenge: what if in the mean time the part >> configuration gets changed and the price is updated to 5.23? Then the >> actual invoice posted goes from a linetotal of 6.15$ to 25.15$. Seems >> unacceptable. >> So, the other option is: create a "calculate the price matrix for this >> invoice without actually storing it" endpoint and do the "copy data from >> part" step on save instead of on posting. Here, I'm running into a problem >> too: lets assume the user wants to save the invoice only to work on it more >> tomorrow? In that case, all the prices have been filled and the price >> matrix calculation won't work anymore, because it doesn't work due to the >> "price" fields no longer being 'null'. >> >> The above problem exists not only for parts, but also for taxes; maybe >> other scenarios too. >> >> By posting this, I hope to get some good discussion on the topic (and >> hopefully some good additional ideas)! >> >> >> >> >> -- >> Bye, >> >> Erik. >> >> http://efficito.com -- Hosted accounting and ERP. >> Robust and Flexible. No vendor lock-in. >> > > > -- > Bye, > > Erik. > > http://efficito.com -- Hosted accounting and ERP. > Robust and Flexible. No vendor lock-in. > -- Bye, Erik. http://efficito.com -- Hosted accounting and ERP. Robust and Flexible. No vendor lock-in.

2 1

Re: Progress on Invoice webservice (discussion solicited)
by Erik Huelsmann 12 Jul '21

12 Jul '21

Hi David, Thanks for your response. We've discussed my earlier mail on the chat channel as well; I'll summarize in response to your mail. On Tue, Jul 6, 2021 at 4:22 AM lsmbdev <lsmbdev(a)sbts.com.au> wrote: > Shouldn't the linetotal be returned within the calculated block rather > than the user supplied block? > Doing otherwise seems like a massive rounding nightmare. > Yes, it should (and will); I was posting an unfortunate combination of request and response structures. (since the response is just a superset of the request, it's hard to separate the two in my mind). > As for handling db side changes during the life cycle of the invoice (eg: > price and tax changes) I'm not sure I see an easy solution. > We currently have a problem here anyway. > If we follow a full quote => order => invoice workflow you expect a price > as shown on a quote to be static throughout the sequence. > However it will most likely change if any source info changes along the > way. > That's a good point. Yes, I too expect the current implementation to apply price-changes during that life cycle. Thanks for pointing that out: Evaluating the solution to the original problem discussed on the chat channel, I think that with a few minor changes we can support this workflow the way it's expected to work. > Personally, I think a specific request to update a line is required. > To that end, I think each line should (as the first element) contain a > boolean "recalc" element and a "lastcalc" timestamp > As should the entire invoice. > The solution we discussed on the chat channel is just as simple as effective: John proposed we add a boolean to each invoice line which indicates the price in that line should be excluded from pricematrix calculations; e.g. named 'pricefreeze'. That way, the line gets excluded from pricematrix calculations and won't be updated when the invoice gets saved. How the UI gets to set the 'pricefreeze' boolean, is out of scope of the current consideration. It didn't feel right to add another checkbox on the already crowded invoice input screen. We came up with other ways to set the value. But, as said, that's to be dealt with later. Applying this solution to your "full quote > invoice" workflow, I think the expected behaviour can be had by setting the 'pricefreeze' parameter on orders spawned from quotes and invoices spawned from orders. > Regardless, there probably needs to be 3 sets of price data presented. > - user overrides > - system calculated > - actual data for use > The response is currently expected to hold just the price used for calculation. I was originally expecting to send the list price or the price matrix price too, but I found that to be confusing, because: which price do you send when there's a price matrix price for the current vendor and invoice line, but the user has overridden the price manually? > All of the above should be permanently stored in the db. (FYI, we should > be doing this even for non API entries as well. > This preserves the data. Allowing better auditing and diagnostics) > I was considering the option to add a time-dimension to the parts table, allowing various parts uses to reference explicit lines in the table, with the price data as it applied at the specific time of modification of the quote/order/invoice. It's quite complex though, because: do you create a full copy of the price matrix too? and what about the parts line itself when e.g. a line in the makemodel table is changed? I decided that storing a full audit trail on modified parts data is probably a good idea, but not something to be addressed while creating the invoice API. For now, I'm really happy with John's "pricefreeze" suggestion as it allows us to move forward on the implementation without endless complexities. > There is probably more to consider, but there's a start for discussion > Regards, Erik. > > Regards > David G > > -------- Original message -------- > From: Erik Huelsmann <ehuels(a)gmail.com> > Date: 6/7/21 04:56 (GMT+08:00) > To: devel(a)lists.ledgersmb.org > > Hi, > > Over the past months, I've been working on a webservice for LedgerSMB to > post invoices. The current status can be viewed here: > https://github.com/ehuelsmann/LedgerSMB/blob/webservices/lib/LedgerSMB/Rout… > > Summarizing what I have achieved so far: > > * An endpoint /erp/api/v0/invoices/, which accepts POST requests > * The "specification" of the payload can be found here: > https://github.com/ehuelsmann/LedgerSMB/blob/webservices/lib/LedgerSMB/Rout… > * The toplevel keys "eca", "account", "dates", "lines", "taxes", > "currency", "description", > "invumber", "ordnumber", "ponumber" are supported > * The pricematrix is consulted when determining pricing > * Customers and vendors are supported (each with their own type of > pricematrix) > > The endpoint has been coded defensively, throwing an "unacceptable input" > error on anything that's not consistent with what the database should > expect. A lot of things are currently not supported: > > * Invoices will end up in "draft" state and cannot be Post-ed > * Payments are not processed > * Rounding (in the price matrix, but also of the line-totals) isn't in > place > * Complex taxes have limited support ("simple taxes only") > * No multi-currency support yet > * No support for "taxes included" tax extraction calculation (from the > gross invoice amount) > * I have no idea what happens with Cost Of Goods Sold calculations > * No support for shipping addresses > * No support for printing/mailing/etc. > * All invoices are posted into the 'ar' table (oops!) > > That said, I have some questions with respect to what the functionality > needs to be able to do, especially with respect to saving invoices in order > to post them later. With respect to saving and posting invoices, I'm > envisaging the workflow to require a number (lots) of save actions on the > invoice in order to calculate its prices, i.e. to calculate the price > matrix. There may be other reasons to save the invoice in the mean time. > In the current invoice-entry process (running through "old code"), there's > a lot of code which tries to determine if anything changed in the invoice > based on the fields entered. If it did (or rather, if the deduction code > thinks it did), the invoice will be recalculated either partial or in full. > This code causes lots of headaches, because most of the time the user > didn't expect their edits to trigger a full recalculation, or, the > recalculation didn't happen the way it should e.g. due to the fact that > prices had been overridden by the user. > To prevent similar complexity in the webservice, I've created a structure > where each line returns the data entered by the user (as provided on input) > as well as calculated data. It is up to the front-end to present that data > in a useful way to the user. Just as an example, the following structure > could be a line in the invoice: > > { "part": { "number": "p1", "description": "p1 desc", "price": 1.23 }, > "quantity": 5, > "description": null, "price": null, "linetotal": 6.15, "discount": > null } > > The above line means to say that the user didn't enter a price, > description or discount. The part has been configured with a price of $1.23 > for the current customer/vendor and the quantity on the line is 5 (as > entered by the user). If the user enters a description, the description > field in the line itself gets filled with that, e.g. "bike rental fees". > Assuming that the user saves the above line without further input and > continues by posting the invoice, I'm thinking that the posting action > should copy the description and price from the part configuration to the > invoice. > This poses a timing challenge: what if in the mean time the part > configuration gets changed and the price is updated to 5.23? Then the > actual invoice posted goes from a linetotal of 6.15$ to 25.15$. Seems > unacceptable. > So, the other option is: create a "calculate the price matrix for this > invoice without actually storing it" endpoint and do the "copy data from > part" step on save instead of on posting. Here, I'm running into a problem > too: lets assume the user wants to save the invoice only to work on it more > tomorrow? In that case, all the prices have been filled and the price > matrix calculation won't work anymore, because it doesn't work due to the > "price" fields no longer being 'null'. > > The above problem exists not only for parts, but also for taxes; maybe > other scenarios too. > > By posting this, I hope to get some good discussion on the topic (and > hopefully some good additional ideas)! > > > > > -- > Bye, > > Erik. > > http://efficito.com -- Hosted accounting and ERP. > Robust and Flexible. No vendor lock-in. > -- Bye, Erik. http://efficito.com -- Hosted accounting and ERP. Robust and Flexible. No vendor lock-in.

2 1

LedgerSMB 1.8.16 released
by Erik Huelsmann 10 Jul '21

10 Jul '21

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.8.16 * Fix incorrectly encoded UTF-8 characters on journal entry (#5583) * Fix multiple updates in payment screen resetting user input (#5614) * Improve error message when missing cash discount configuraition (#5632) * Fix payment information for credit accounts which are Persons (#5632) * Fix memos sometimes being associated with incorrect payment rows (#5646) * Fix wrong fx value due to formatted exchangerate used in calculation (#5656) * Fix decimal places setting not applied for AR/AP transactions (#5657) * Fix duplicated income statement figures due to reversed year end (#5682) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.8.16/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.8.16 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.8.16 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.8.16 These are the sha256 checksums of the uploaded files: 17a2e068e6655b833e209aa954b51bc6b8bb82fa4ea87bade9abefdc98cadff2 ledgersmb-1.8.16.tar.gz 7f0cd165beb22953712a11c2380dc587966e588bfc25cca75166e7d94bba3a93 ledgersmb-1.8.16.tar.gz.asc

1 0

LedgerSMB 1.7.32 released
by Erik Huelsmann 09 Jul '21

09 Jul '21

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.7.32 * Fix multiple updates in payment screen resetting user input (#5614) * Improve error message when missing cash discount configuraition (#5632) * Fix payment information for credit accounts which are Persons (#5632) * Fix memos sometimes being associated with incorrect payment rows (#5646) * Fix wrong fx value due to formatted exchangerate used in calculation (#5656) * Fix decimal places setting not applied for AR/AP transactions (#5657) * Fix duplicated income statement figures due to reversed year end (#5682) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.7.32/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.7.32 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.7.32 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.7.32 These are the sha256 checksums of the uploaded files: 22fb6f99d68c7a1372949f7a7ecef5f76c3ce8ebec610f73d6076a44b19b266a ledgersmb-1.7.32.tar.gz 9c13b3bf6fbb13d61c4adef3e342eb86c8027808dddedbab30cae4027fe1d9d3 ledgersmb-1.7.32.tar.gz.asc

1 0

Progress on Invoice webservice (discussion solicited)
by Erik Huelsmann 05 Jul '21

05 Jul '21

Hi, Over the past months, I've been working on a webservice for LedgerSMB to post invoices. The current status can be viewed here: https://github.com/ehuelsmann/LedgerSMB/blob/webservices/lib/LedgerSMB/Rout… Summarizing what I have achieved so far: * An endpoint /erp/api/v0/invoices/, which accepts POST requests * The "specification" of the payload can be found here: https://github.com/ehuelsmann/LedgerSMB/blob/webservices/lib/LedgerSMB/Rout… * The toplevel keys "eca", "account", "dates", "lines", "taxes", "currency", "description", "invumber", "ordnumber", "ponumber" are supported * The pricematrix is consulted when determining pricing * Customers and vendors are supported (each with their own type of pricematrix) The endpoint has been coded defensively, throwing an "unacceptable input" error on anything that's not consistent with what the database should expect. A lot of things are currently not supported: * Invoices will end up in "draft" state and cannot be Post-ed * Payments are not processed * Rounding (in the price matrix, but also of the line-totals) isn't in place * Complex taxes have limited support ("simple taxes only") * No multi-currency support yet * No support for "taxes included" tax extraction calculation (from the gross invoice amount) * I have no idea what happens with Cost Of Goods Sold calculations * No support for shipping addresses * No support for printing/mailing/etc. * All invoices are posted into the 'ar' table (oops!) That said, I have some questions with respect to what the functionality needs to be able to do, especially with respect to saving invoices in order to post them later. With respect to saving and posting invoices, I'm envisaging the workflow to require a number (lots) of save actions on the invoice in order to calculate its prices, i.e. to calculate the price matrix. There may be other reasons to save the invoice in the mean time. In the current invoice-entry process (running through "old code"), there's a lot of code which tries to determine if anything changed in the invoice based on the fields entered. If it did (or rather, if the deduction code thinks it did), the invoice will be recalculated either partial or in full. This code causes lots of headaches, because most of the time the user didn't expect their edits to trigger a full recalculation, or, the recalculation didn't happen the way it should e.g. due to the fact that prices had been overridden by the user. To prevent similar complexity in the webservice, I've created a structure where each line returns the data entered by the user (as provided on input) as well as calculated data. It is up to the front-end to present that data in a useful way to the user. Just as an example, the following structure could be a line in the invoice: { "part": { "number": "p1", "description": "p1 desc", "price": 1.23 }, "quantity": 5, "description": null, "price": null, "linetotal": 6.15, "discount": null } The above line means to say that the user didn't enter a price, description or discount. The part has been configured with a price of $1.23 for the current customer/vendor and the quantity on the line is 5 (as entered by the user). If the user enters a description, the description field in the line itself gets filled with that, e.g. "bike rental fees". Assuming that the user saves the above line without further input and continues by posting the invoice, I'm thinking that the posting action should copy the description and price from the part configuration to the invoice. This poses a timing challenge: what if in the mean time the part configuration gets changed and the price is updated to 5.23? Then the actual invoice posted goes from a linetotal of 6.15$ to 25.15$. Seems unacceptable. So, the other option is: create a "calculate the price matrix for this invoice without actually storing it" endpoint and do the "copy data from part" step on save instead of on posting. Here, I'm running into a problem too: lets assume the user wants to save the invoice only to work on it more tomorrow? In that case, all the prices have been filled and the price matrix calculation won't work anymore, because it doesn't work due to the "price" fields no longer being 'null'. The above problem exists not only for parts, but also for taxes; maybe other scenarios too. By posting this, I hope to get some good discussion on the topic (and hopefully some good additional ideas)! -- Bye, Erik. http://efficito.com -- Hosted accounting and ERP. Robust and Flexible. No vendor lock-in.

2 1

Preparations for 1.9 release - translator heads-up
by Erik Huelsmann 14 Jun '21

14 Jun '21

Last weekend, the project created the 1.9 release branch as part of the preparations for the upcoming 1.9 release now planned for late July/early August. This mail is a call to translators to update the LedgerSMB translations on Transifex (https://www.transifex.com/ledgersmb/ledgersmb/dashboard/) while there is still time. Please note that some translations don't have any active translators assigned at the moment, yet are in need of updating. So for those of you who are wondering what to give back to the community, please sign up and spend some time translating terms for your favorite language. There's no need to be all-or-nothing about this: all contributions are appreciated - there's no need to wait for a moment where you have time to do a full translation. While working on the 1.9 translation, all translations that match those in 1.7 and 1.8 are being copied to those versions by Transifex automatically, so by contributing to 1.9, you also contribute to 1.7 and 1.8. If you don't want to sign up with Transifex: no problem, contact me off-list and we can figure out a way to shepherd your contributions into a release. -- Bye, Erik. http://efficito.com -- Hosted accounting and ERP. Robust and Flexible. No vendor lock-in.

1 0

LedgerSMB 1.8.15 released
by Erik Huelsmann 14 Jun '21

14 Jun '21

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.8.15 * Improve reconciliation of data entered before migration to 1.8 * Fix AR/AP transaction+invoice 'New' button throwing an error (#5539) * Fix transaction total in AR/AP transactions with applied payments (#5528) * Stop doubling of the number of lines in an AR/AP transaction on Save (#5529) * Fix vendors appearing in the AR customer drop-down and vice versa (#5534) * Fix second and consecutive Save actions on invoices throwing an error (#5532) * Only limit Customer/Vendor History by country with explicit filter (#4361) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.8.15/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.8.15 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.8.15 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.8.15 These are the sha256 checksums of the uploaded files: 819fad10619041981a44aa18849ca00a2630e6447c6e2ff7003e81d022e6095d ledgersmb-1.8.15.tar.gz 9d21b09abbeb867ffd5da5e940b24ac6b60013479c76b532196f0bf33f0e9aea ledgersmb-1.8.15.tar.gz.asc

1 0

LedgerSMB 1.7.31 released
by Erik Huelsmann 14 Jun '21

14 Jun '21

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.7.31 * Stop doubling of the number of lines in an AR/AP transaction on Save (#5529) * Fix vendors appearing in the AR customer drop-down and vice versa (#5534) * Fix second and consecutive Save actions on invoices throwing an error (#5532) * Only limit Customer/Vendor History by country with explicit filter (#4361) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.7.31/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.7.31 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.7.31 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.7.31 These are the sha256 checksums of the uploaded files: e7c3bcd0e8771374982658968b0ead909aad77ca0517ad28ef17a709f452bcd2 ledgersmb-1.7.31.tar.gz 849ae7fa4b1726d3d7fdb9a77df013a9c50bd8af746a660569e18224464671a8 ledgersmb-1.7.31.tar.gz.asc

1 0

LedgerSMB 1.8.14 released
by Erik Huelsmann 03 Jun '21

03 Jun '21

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.8.14 * Follow-up (fix) to upgrades blocked by files attached to transactions For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.8.14/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.8.14 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.8.14 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.8.14 These are the sha256 checksums of the uploaded files: 655c3a6571d584ca8cac55c01ced75f64299fcdc44bfa273cd45e32a1f3edbbe ledgersmb-1.8.14.tar.gz c7a55e1a5b48ef525cefb932a9d8ebd3ee7d167fb94b38cd1dee502b7d1a5ef6 ledgersmb-1.8.14.tar.gz.asc

1 0

LedgerSMB 1.7.30 released
by Erik Huelsmann 03 Jun '21

03 Jun '21

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.7.30 * Follow-up (fix) to upgrades blocked by files attached to transactions For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.7.30/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.7.30 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.7.30 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.7.30 These are the sha256 checksums of the uploaded files: 9d70f9a392d8283128cca62a757e2d1e4c1febcb8a9ba44d90be4bb4d530f4a0 ledgersmb-1.7.30.tar.gz 41064f1f5fedc29ae46ac0410c1da8e09dcb0ae642573564449c1b6f6f4047ce ledgersmb-1.7.30.tar.gz.asc

1 0

LedgerSMB 1.6.33 released
by Erik Huelsmann 03 Jun '21

03 Jun '21

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.6.33 * Follow-up (fix) to upgrades blocked by files attached to transactions (Erik H) Erik H is Erik Huelsmann For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.6.33/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.6.33 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.6.33 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.6.33 These are the sha256 checksums of the uploaded files: ece4c7f63e725eea5dc2cbebbef0622b8426e24e1742daf98b1bc95fa292f6a9 ledgersmb-1.6.33.tar.gz 16d22e4c2a06a63d90ee5aca2a4e132f8e94b2eef252608da52ae0da7401c69e ledgersmb-1.6.33.tar.gz.asc

1 0

LedgerSMB 1.8.13 released
by Erik Huelsmann 29 May '21

29 May '21

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.8.13 * Update welcome.html and README, removing FreeNode and updating Element * Fix double-quoting values in GL transaction 'notes' and 'description' (#5415) * Fix GL transaction after file attachment showing up empty (#5416) * Retain AR/AP account across 'Update' on invoices and transactions (#5453) * Don't drop creation date on AR/AP transactions and invoices from 1.3 (#5417) * Fix reconciliations incorrectly updated when including new transactions (#5417) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.8.13/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.8.13 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.8.13 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.8.13 These are the sha256 checksums of the uploaded files: 77edb7fdc3c156049bbb5dc694762b380d04b708126cf690c4baa7825a146505 ledgersmb-1.8.13.tar.gz eb1da2060dcf40de485038c214c9eac7bf666c7dd01cbb26d81f488959fc13b5 ledgersmb-1.8.13.tar.gz.asc

1 0

LedgerSMB 1.7.29 released
by Erik Huelsmann 29 May '21

29 May '21

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.7.29 * Update welcome.html and README, removing FreeNode and updating Element * Fix double-quoting values in GL transaction 'notes' and 'description' (#5415) * Fix GL transaction after file attachment showing up empty (#5416) * Retain AR/AP account across 'Update' on invoices and transactions (#5453) * Don't drop creation date on AR/AP transactions and invoices from 1.3 (#5417) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.7.29/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.7.29 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.7.29 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.7.29 These are the sha256 checksums of the uploaded files: 007aeb38e738f305fdd6753e85a14ca97923867619855b2fbf2aecceeee63d34 ledgersmb-1.7.29.tar.gz 5ff541bbca56546378b6379b8eecfbb9fb773215369e912885548ddc69e11a5a ledgersmb-1.7.29.tar.gz.asc

1 0

LedgerSMB 1.6.32 released
by Erik Huelsmann 29 May '21

29 May '21

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release will be the last one in the 1.6 release line as it will hit end-of-life next week*; it contains the following fixes and improvements: Changelog for 1.6.32 * Update welcome.html and README, removing FreeNode and updating Element (Erik H) * Fix double-quoting values in GL transaction 'notes' and 'description' (Erik H) * Fix GL transaction after file attachment showing up empty (Erik H) * Retain AR/AP account across 'Update' on invoices and transactions (Erik H) * Don't drop creation date on AR/AP transactions and invoices from 1.3 (Erik H) Erik H is Erik Huelsmann For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.6.32/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.6.32 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.6.32 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.6.32 These are the sha256 checksums of the uploaded files: 19debeacdb24db78a3578a1f9d15b4c5a6b7685e115ff07cbc00f0c6f37c6fbb ledgersmb-1.6.32.tar.gz 020c8b55cde42728ddbc552cdec0221d523415fe76727dbfb729f1975abd64ed ledgersmb-1.6.32.tar.gz.asc * Please note that "end of life" refers to community provided support; commercial support may be available -- please refer to the website to find such support if you need to keep using 1.6 beyond its end-of-life date.

1 0

1.6 release line End-Of-Life notice
by Erik Huelsmann 07 May '21

07 May '21

I'm sending notice that the 1.6 release line will reach End-Of-Life by Thursday 10 June - next month. As per our community policy, there will be no further fixes applied to the 1.6 series of releases. After its initial release on June 10, 2018 and 31 patch releases - the latest released just 5 days ago on May 2 - the 1.6 release line will have received 3 years of support. Note that even though the community won't provide further releases, the software is considered highly stable and will keep working as it has. This End-Of-Life announcement has no impact on migration paths to newer versions of LedgerSMB: upgrades from 1.6 to more recent versions will remain supported for many years to come. (Upgrade paths from LedgerSMB 1.2 and 1.3 have seen recent maintenance.) Should you want to keep running 1.6 and be in need of support or maintenance, you could try contacting one of the parties listed on the page for commercial support: https://ledgersmb.org/content/commercial-support. They may be able to provide support beyond the community commitment. Available options for versions with community support are the 1.7 release line which will receive community releases until October 04, 2022 or the 1.8 release line which will see community support until September 04, 2022. (For releases 1.8 and newer, only 2 years of community support have been committed due to the increased release frequency: new minor versions are now released on a yearly basis.) For community support until 2023, upgrading to 1.9 is advised, which is expected to be released later this summer. -- Bye, Erik. http://efficito.com -- Hosted accounting and ERP. Robust and Flexible. No vendor lock-in.

1 0

Messy WIP for LedgerSMB importing into OpenBSD on git
by Chris Bennett 05 May '21

05 May '21

Hi, I finally put up copies of the work I started to import the Perl modules needed to make LedgerSMB work with OpenBSD. Yes, this is a mess. I had to drop a server out of the two I was using. I was also editing files on my laptop, which can no longer run -current OpenBSD. I decided now that I had a chance to, just to push up what I had. I'll clean things up as I have time. Most of the modules are very straightforward to get committed. Just prepare all the dependencies for what you want to submit. But if you want to help, it's OK to just do one of the dependencies as a good start. The work is pretty simple, but time consuming. OpenBSD has it's own testing and installation structure, so don't run the install process that works from CPAN. Feel free to ask me or on ports(a)openbsd.org if you have any questions. https://github.com/CPBen/LSMB-for-OBSD-WIP I've never worked as a group on git, so I'm not sure if I need to do anything to allow pushing, etc. Thanks, Chris Bennett

2 2

Re: [ledgersmb-users] LedgerSMB 1.8.12 released
by Zeeshan Riaz 04 May '21

04 May '21

Hi Erik It's very helpful for the community; if your team uploaded the Installation Tutorials Videos (For each type of OS) on YOUTUBE. -- regards Zeeshan On Sun, May 2, 2021 at 10:36 PM Erik Huelsmann <erik(a)efficito.com> wrote: > The LedgerSMB development team is happy to announce yet another new > version of its open source ERP and accounting application. > This release contains the following fixes and improvements: > > Changelog for 1.8.12 > * Improve upgrades in light of files attached to transactions > * Fix 1.3 upgrade breaking on default currency function type > * Fix duplicate key error in upgrade data validation > > > For installation instructions and system requirements, see > https://github.com/ledgersmb/LedgerSMB/blob/1.8.12/README.md > > The release can be downloaded from our download site at > https://download.ledgersmb.org/f/Releases/1.8.12 > > The release can be downloaded from GitHub at > https://github.com/ledgersmb/LedgerSMB/releases/tag/1.8.12 > > Or pulled from Docker Hub using the command > $ docker pull ledgersmb/ledgersmb:1.8.12 > > These are the sha256 checksums of the uploaded files: > > e6dbb8830ac36164af9f33a8b191a543a2eee1168ca80c9e59ebcc8c8f9de178 > ledgersmb-1.8.12.tar.gz > e72a30afc303995741580f7c4a57a5fc7b00ee1adeacf603bfd299b8cb1e1fdd > ledgersmb-1.8.12.tar.gz.asc > _______________________________________________ > users mailing list -- users(a)lists.ledgersmb.org > To unsubscribe send an email to users-leave(a)lists.ledgersmb.org >

2 1

Re: LedgerSMB 1.8.12 released
by Erik Huelsmann 02 May '21

02 May '21

Hi, The release announcement forgot to mention one fix which was contributed by a first-time contributor (@Lianto2020 on GitHub) fixing import of goods from CSV. I'm sorry this was accidentally dropped from the release notes which is especially painful since it concerns a first-time contribution. My apologies! Regards, Erik. On Sun, May 2, 2021 at 7:36 PM Erik Huelsmann <erik(a)efficito.com> wrote: > The LedgerSMB development team is happy to announce yet another new > version of its open source ERP and accounting application. > This release contains the following fixes and improvements: > > Changelog for 1.8.12 > * Improve upgrades in light of files attached to transactions > * Fix 1.3 upgrade breaking on default currency function type > * Fix duplicate key error in upgrade data validation > > > For installation instructions and system requirements, see > https://github.com/ledgersmb/LedgerSMB/blob/1.8.12/README.md > > The release can be downloaded from our download site at > https://download.ledgersmb.org/f/Releases/1.8.12 > > The release can be downloaded from GitHub at > https://github.com/ledgersmb/LedgerSMB/releases/tag/1.8.12 > > Or pulled from Docker Hub using the command > $ docker pull ledgersmb/ledgersmb:1.8.12 > > These are the sha256 checksums of the uploaded files: > > e6dbb8830ac36164af9f33a8b191a543a2eee1168ca80c9e59ebcc8c8f9de178 > ledgersmb-1.8.12.tar.gz > e72a30afc303995741580f7c4a57a5fc7b00ee1adeacf603bfd299b8cb1e1fdd > ledgersmb-1.8.12.tar.gz.asc > _______________________________________________ > announce mailing list -- announce(a)lists.ledgersmb.org > To unsubscribe send an email to announce-leave(a)lists.ledgersmb.org > -- Bye, Erik. http://efficito.com -- Hosted accounting and ERP. Robust and Flexible. No vendor lock-in.

1 0

LedgerSMB 1.8.12 released
by Erik Huelsmann 02 May '21

02 May '21

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.8.12 * Improve upgrades in light of files attached to transactions * Fix 1.3 upgrade breaking on default currency function type * Fix duplicate key error in upgrade data validation For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.8.12/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.8.12 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.8.12 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.8.12 These are the sha256 checksums of the uploaded files: e6dbb8830ac36164af9f33a8b191a543a2eee1168ca80c9e59ebcc8c8f9de178 ledgersmb-1.8.12.tar.gz e72a30afc303995741580f7c4a57a5fc7b00ee1adeacf603bfd299b8cb1e1fdd ledgersmb-1.8.12.tar.gz.asc

1 0

LedgerSMB 1.7.28 released
by Erik Huelsmann 02 May '21

02 May '21

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.7.28 * Improve upgrades in light of files attached to transactions * Fix 1.3 upgrade breaking on default currency function type * Fix duplicate key error in upgrade data validation For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.7.28/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.7.28 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.7.28 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.7.28 These are the sha256 checksums of the uploaded files: 658dee52d007659c8f38ed8f595e13cc9f17fa14a390b15e1e86f92717e77abc ledgersmb-1.7.28.tar.gz 0b965d34aacadf18d47babdb6c4263e1c551f1f5f9f8e7deeb4058086ad10b5c ledgersmb-1.7.28.tar.gz.asc

1 0

LedgerSMB 1.6.31 released
by Erik Huelsmann 02 May '21

02 May '21

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.6.31 * Improve upgrades in light of files attached to transactions (Erik H, #5405) Erik H is Erik Huelsmann For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.6.31/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.6.31 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.6.31 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.6.31 These are the sha256 checksums of the uploaded files: 8f3b7086241efed77d2b78f1009457619c6069a681b875175f2bb301f02ff679 ledgersmb-1.6.31.tar.gz 9da5c73431f8ea0b1668e658c67bc404fe422baed5a0401ed5c2dca83b0e375d ledgersmb-1.6.31.tar.gz.asc

1 0

LedgerSMB 1.8.11 released
by Erik Huelsmann 21 Mar '21

21 Mar '21

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.8.11 * Fix Number not updated by 'Save as New' on order and quote (#5358) * Fix failure to save purchase shipping addresses and contacts (#5289) * Fix searching and opening saved invoices with gapless AR enabled (#5369) * Performance improvements through added database indexes For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.8.11/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.8.11 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.8.11 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.8.11 These are the sha256 checksums of the uploaded files: d1eb9503675adef638b0b8ddc41065a115ed478ba33cb10d578464550e4a254a ledgersmb-1.8.11.tar.gz ffbcfb9775a2a43270009000299349634fedd0bc3c7d4a9d4c3670e6a49ff5d6 ledgersmb-1.8.11.tar.gz.asc

1 0