1.9

Bug explained: Double allocation of parts for COGS

Submitted by ehu on

Am I affected?

Books which meet these conditions are likely affected:

  • Running (now or in the past) a LedgerSMB version between 1.3.41 and 1.12.11; and
  • Enabled "Separation of Duties"; and
  • Using "Parts" from "Goods and Services"; and
  • Saving invoices multiple times before approving

Please note that "Services" are not affected.

COGS assembly fix

Submitted by ehu on

All versions from 1.3.0 to 1.11.16 are affected by a bug in Cost of Goods Sold (COGS) accounting for assemblies: Instead of accounting expenses and reducing inventory, negative expenses are posted, putting goods into inventory.

I never used assemblies; am I affected too?

No. Only if you used assemblies in combination with LedgerSMB 1.3.0 through 1.11.15, you're affected.

cve-2024-23831 (Cross Site Request Forgery)

Submitted by ehu on

Privilege escalation through CSRF attack on 'setup.pl'

Summary

When a LedgerSMB database administrator has an active session in /setup.pl,
an attacker can trick the admin into clicking on a link which automatically
submits a request to setup.pl without the admin's consent.  This request can
be used to create a new user account with full application (/login.pl)
privileges, leading to privilege escalation.


Known vulnerable

All of:

1.9.30 Released

Submitted by LedgerSMB_Team on

The LedgerSMB development team is happy to announce yet another new
version of its open source ERP and accounting application.
This release contains the following fixes and improvements:

Changelog for 1.9.30

1.9.29 Released

Submitted by LedgerSMB_Team on

The LedgerSMB development team is happy to announce yet another new
version of its open source ERP and accounting application.
This release contains the following fixes and improvements:

Changelog for 1.9.29

1.9.28 Released

Submitted by LedgerSMB_Team on

The LedgerSMB development team is happy to announce yet another new
version of its open source ERP and accounting application.
This release contains the following fixes and improvements:

Changelog for 1.9.28

  • Fix deletion of parts groups (#7363)
  • Align invoice/order entry between databases with and without parts (#7374)

For installation instructions and system requirements, see
https://github.com/ledgersmb/LedgerSMB/blob/1.9.28/README.md

1.9.27 Released

Submitted by LedgerSMB_Team on

The LedgerSMB development team is happy to announce yet another new
version of its open source ERP and accounting application.
This release contains the following fixes and improvements:

Changelog for 1.9.27

Subscribe to 1.9