News

1.2.0 has been released today. It includes a large number of security and data integrity enhancements, replication support, and more. This release marks a major milestone for LedgerSMB, and has some implications for those upgrading from SQL-Ledger.
Read on for Chris' release notes...

From: "Chris Travers"
To: Ledger-smb-users
Date: Thu 05/04/07 16:23:56 +1000

Hi all;

I thought it might be a good time to send out the changelog for 1.2.0.

This release fixes two serious bugs in 1.1.11:
1) Unable to generate sales orders from timecards
2) Installation overwriting user authentication data.

It is the preferred upgrade over 1.1.10.

Best Wishes,
Chris Travers

LedgerSMB 1.1.11 has been released, correcting a bug which caused
sales orders generated from timecards not to show the currency pulled from the customer. It can be downloaded on Sourceforge.

• Corrected arbitrary code execution issue in menu.pl

Corrected authentication bypass vulnerability in admin.pl

• Fixed DBI error on order consolidation
• Fixed whitelisting errors on template editing

Fixed another login issue

Changelog for Ledger SMB 1.1.6

• Fixed problem with login failures

• Updated version strings
• Whitelisted redirect destinations in Form::redirect
• Whitelisted destinations in bin/mozilla/am.pl
• Limited logout redirect destinations
• Whitelisted directories and file extensions used by the template editor
• Converted the template editor to using 3-arg open
• Limited configurable preferences in save_preferences
• Moved (error|info)_function strings from $form into environment variables
• Converted opens of $form->{IN} to 3-arg open in form printing
• User config items are now truncated at first ne

• Fixed problem with parts_short trigger not being created
• Fixed problem with custom fields functions not being created
• Pg driver is now checked by default.