1.4

How do I backup my data?

Submitted by Anonymous (not verified) on

Log in to the the 'setup.pl' administrative interface, using your ledgersmb database admin user (usually "lsmb_dbadmin" or "postgres"). The default address for setup.pl is http://localhost/ledgersmb/setup.pl.

There are 2 buttons:

  • Backup database (parts, customers, accounting records, etc)
  • Backup roles (your login accounts and rights)

One creates a backup of the content of your database. The other creates a backup of the roles.

cve-2024-23831 (Cross Site Request Forgery)

Submitted by ehu on

Privilege escalation through CSRF attack on 'setup.pl'

Summary

When a LedgerSMB database administrator has an active session in /setup.pl,
an attacker can trick the admin into clicking on a link which automatically
submits a request to setup.pl without the admin's consent.  This request can
be used to create a new user account with full application (/login.pl)
privileges, leading to privilege escalation.


Known vulnerable

All of:

Security advisory for CVE-2021-3694 (Cross site scripting)

Submitted by ehu on

Reflected cross-site scripting of authenticated users in LedgerSMB

Summary

LedgerSMB does not sufficiently HTML-encode error messages sent to the browser.  By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure.

Known vulnerable

  All of:

Upgrade to LedgerSMB 1.8

Submitted by ehu on

Overview

Company database upgrades are supported all the way back from 1.4 directly to 1.8, using the 1.8 software. Company database upgrades from 1.3 and 1.2 are also supported, but due to the different nature of the upgrade process are called "migrations". The important difference being that when doing a migration, a copy of the data is being created in the 1.8 structure, while upgrades adjust the existing structure for 1.8.

1.4.42 Released (end-of-life release)

Submitted by ehu on

The LedgerSMB development team is happy to announce yet another new
version of its open source ERP and accounting application. This will
be the last release in the 1.4 series, which has reached End-Of-Life
(EOL) status on September 15, 2017; after three full years of active
maintenance. The fact that the release series has reached EOL status
means that no further community supported releases will be
created - except for translation updates when available. Users are
encouraged to upgrade to the 1.5 series which is now the community