A missing access right has been found by Cédric Krier for the Model 'product.product-production.bom'. That allows a malicious authenticated user to write, create or delete records of this type (see issue5570).
Any authenticated user can modify the links between products and BoM's.
All users should create manually a default model access which limits to read only and a second model access limited to the group "Production Administration" with full access.
Affected versions: all versions of production module prior to series 4.0 included.
Non affected version: all versions of production module after series 4.0 non-included.
Any security concerns should be reported on the bug-tracker at https://bugs.tryton.org/ with the type security.
Due to an issue with Pootle, the initial release of series 4.0 is missing many translations. So we decided to make new set of releases with the correct translations even if it breaks rule of no database updates for bug fix releases.
If you have already updated your server to the series 4.0, you need to also update the database for this bug fix release. Sorry for the inconvenient.
We are proud to announce the 4.0 release of Tryton.
This is the first release of Tryton that adds support for Python 3. The server and most of the modules support it. The missing modules are mainly the ones using the WebDAV and LDAP. The client will be ported once GTK-3 support is added. The release sees also a large refactoring of the protocol stack which was previously based on the SimpleHTTPServer of Python. Now it uses a WSGI application running on the Werkzeug server by default. Any WSGI server can be used to run Tryton, this removes the design constraint of single threaded process and opens the way for using workers. All modules have been reviewed to enforce the naming convention about the document identification. The name "code" is used for all referential documents like parties, product. The name "number" is used for the internal identification of all operational documents like sales, purchases, invoices etc. And finally, the name "reference" is used for identifications from external systems like the sale order number of the supplier of your purchase. Two new languages are now available on default installation the Lao and the Simplified Chinese.
As Richard Stallman reminded to us, the migration from previous series is fully supported.
The new note functionality handles the management system for general textual notes on any arbitrary model in Tryton. On click it opens a notes dialog, where the user can maintain notes. The read state of every note is managed per user. Like the attachments, the icon in the tool-bar visualizes when there are notes on a model.
The CSV import and export has been highly reworked for a better experience. The import dialog now supports drag and drop to order the selected columns like the CSV export wizard. Both wizards are able to use any of the encodings available in Python. It is now possible to configure the CSV parameters for the export result.
The charts provided by the graph view have been improved. Now they use softer colors, thinner lines and smaller arcs. On the background, dash style is used instead normal line for axis representation. A smart transparency value is applied for filling lines to always show through it.
A new button in the scheduler allows running a job once, useful to run jobs on demand or to test new settings.
The report design of the General Ledger, Trial Balance and Aged Balance has been re-worked. They are now based on the new dynamic views. This provides a performance burst and allows to filter the records more precisely. In addition to the previous printable output, they also gain the CSV export which is useful to perform specific operations in a spreadsheet application.
A date field is added to the Aged Balance, to modify the date on which the calculations are based. With this feature, it is possible to generate reports based on a past date as if it would have been generated by ignoring reconciliation that happened after that date.
The functionality of Third Party Balance is merged into the Aged Balance. We found that the Third Party Balance computed the same data as the Aged Balance with the type Customers and Suppliers.
A configuration form is added to the product module with these options:
- The default value for Use Category fields.
- The default value for the Cost Price Method.
It was not always easy to explain the design of products with the templates, especially when it was not really relevant for the current business. So we have redesigned both views to be very similar and indeed they use the exact same design. The fields, that do not exist on the product, are automatically replaced by the value of the template.
The field Category is replaced by a Categories field, to support the ability of adding many categories to one product. This is very useful for example to create multi-axis categories for web shop.
This new module defines the reference basis to create different kinds of classifications for products. It adds a generic field Classification on the product form.
The purchase request functionalities have been decoupled from stock_supply and sale_supply modules into a new separate module named purchase_request. This is to prepare future work that will use only purchase requests without the need of other stock_supply features.
This new module defines the routings, steps and operations for productions. A routing is a list of ordered steps and each step is defined by a generic operation.
This new module completes the routing module by creating the Works of a production based on its routing. A Work is linked to a Work Center which defines the cost using one of these two methods: Per Cycle or Per Hour. The cost of a work is computed using the Cycles created on it and later added to the global cost of the production.
The reconciliation process now stores the date of the reconciliation. By default, it is the highest date of the reconciled lines. This allows to filter reconciled lines based on this date, for example to generate a report with the unreconciled lines before a specific date.
The Credit Notes have been merged into the Invoices. They are now standard invoices with negative quantities. This allows to easily group both types into a single document. The numbering can still be differentiated depending on the sign of the lines.
Note: with the merge of Invoice and Credit Note, the signs of the taxes for Credit Note must be inverted manually.
WebDAV has been decoupled from trytond into a separate module which improves the modularity of the system. Indeed many setups do not use the WebDAV so it was a little bit bloated to have it into the base. Also dependencies of this module prevented to add the support of Python 3 to trytond. So, for now, the WebDAV protocol is managed by a separated process but it will probably return in the future into the main process.
As already announced on the Spanish mailing list, several Spanish companies who provide services around Tryton are organizing the I Jornadas Tryton in Barcelona, which will be held on 23th and 24th May at an excellent location, the Mobile World Centre.
The plan is that the content of the conference will be split between user-oriented on Monday 23th and developer-oriented on Tuesday 24th.
Subscription is already open at Eventbrite.
Yet the event will not succeed without your participation, so it's time to collect your proposals to make a presentation for the event, which will be held in Spanish.
Topics may target users or developers and can include, among others:
Do not hesitate to send us your proposal. We're looking forward to learn about what you know and how Tryton is changing businesses around you.
Just send an e-mail to email@example.com before 17th April with a short explanation of what your talk will be about.
After last year's excellent Tryton Unconference in Buenos Aires, the Tryton Foundation already started to think about this year's unconference, which will be held just after 4.2 release due in autumn.
If you're interested as an individual or organization to host TUx 2016 (our sixth unconference already!) do not hesitate to send your application to firstname.lastname@example.org before 30th April.
Which city will follow Liège, Barcelona, Leipzig and Buenos Aires?
Any authenticated user can write on field for which he doesn't have access. Other access rights are correctly enforced.
There is no workaround.
All users should upgrade trytond to the latest version.
Affected versions per series: <=3.8.0, <=3.6.4, <=3.4.7 and <=3.2.9
Non affected version per series: >=3.8.1, >=3.6.5, >=3.4.8 and >=3.2.10
Any security concerns should be reported on the bug-tracker at https://bugs.tryton.org/ with the type security.
We are proud to announce the 3.8 release of Tryton.
For the first time the release contains sao, the new web client of Tryton. It is the result of the Indiegogo campaign. It is developed using mainly jQuery and Bootstrap and its design is responsive. It requires a recent HTML5 compatible browser. Its usage doesn't require any modification on the server side, every modules are working out of the box with sao just like they do with the GTK client. A demo is available at http://demo.tryton.org using demo/demo as login/password. This brings to 3 the number of supported client for Tryton.
A lot of work has been done to improve the accessibility of the GTK and web clients. For the GTK client, we followed the GNOME Accessibility Developers Guide as much as possible and for the web client, we followed the Web Accessibility Initiative of the W3C. You can follow further progress on this topic on the issue3459.
And of course, this release contains many bug fixes and performance improvements.
As usual, migration from previous series is fully supported.
The following screenshots are based on sao but the same feature exists also on the GTK client.
Here is a comparison of the render of sao versus tryton:
The client is now able to generate meaningful error messages for all kind of validation. Those error messages use the same syntax as the search filter.
For a better accessibility the custom background color on widget is replaced by 'bold' label for required fields and 'italic' label for editable fields. In the same spirit, the color of rows has been removed and can be replaced by icons.
A new option for fast tabbing has been added to the client. If activated, it skips read-only fields when navigating with the tab key. This was the previous default behaviour which needed to be optional to allow users with disabilities to navigate on read-only field for reading.
The export feature now works only on selected records but it can export a tree structure.
A new report showing the cash journal amounts over a period is added. This is useful to check closing cashier.
The French accounting generates the FEC (Fichier des Écritures Comptables).
The wizard that generates payments allows to set a date instead of the default which is today.
The default revenue and expense accounts can be configured from accounting configuration.
The date of statements can be corrected after they are posted.
The language of the party depends on the company now.
An extensible list of identifiers replace the field VAT.
The computation of the project tree has been hugely improved by grouping the computation and use of better queries.
There is now a progress field on the projects and tasks and of course a total which is the sum of the children.
A new method to generate invoice from project has been added which is based on the progress field.
It is now possible to link purchase lines to a project which will be added to the cost field.
The time sheet works have now a total duration field which compute the duration of the work and its children.
The delivery date on sale line shows the effective date once the goods are delivered.
It is now possible to deliver the sale to another party from the one on the invoice. This is the other side of the drop shipment which makes Tryton fully support drop shipments.
The drop shipment now uses two distinct moves using an temporary drop location.
It is possible to ask Tryton to recompute the average cost price of a product by replaying all the moves since the beginning.
It is possible to configure another picking location different from the storage location for the warehouses.
It is possible to set an internal provisioning per location which is used for internal order point by default for all products.
Those new modules allow to record landed cost on supplier shipments after their reception. A new document is created to link supplier invoice lines with shipments and to define which method to use for cost allocation. For now, there are two methods available: By Value and By Weight. And thanks to the Update Cost Price wizard, the cost price of the products can recomputed taking into account the landed cost.
A new module allows to define the Tarif Code from the Harmonized System and its duty rate on the products. The duty rate is stored for a country over a period and two computation types are available: a fixed amount or an amount per quantity.
This new module is for managing customer complaint about sales or invoices. Actions can be defined to solve the complaints like returning the sale or crediting the invoice. A work flow for approval of the complaint actions is set up using the access rights.
It is now possible to apply formula based promotions on sales selected thanks to some criteria. The promotion changes the unit price of the line when the sale goes into quotation (and is restored if it goes back to draft) but only if the promotion is in favor of the customer. The available criteria are: the price list, a period, the quantity and the products.
This new module checks at the quotation of the sale if there are enough quantity of products in the warehouse. It also checks that the new sale will not hurt older sale that will be shipped later.
This will be the fifth edition and the first one outside the Europe. Users, developers and interested people will have the opportunity to discover or talk about Tryton.
Talk proposals and schedule are managed on Lanyrd.
The third Foundation Supporter Meeting will take place on Saturday 14th, 18.00.
Registration is available at TUBA 2015.
If you want to request a talk on a specific topic, you can send your request to the Tryton mailing list. If you have question about the organisation, please contact the foundation at email@example.com.
And don't forget to spread the word! #TUBA2015