Security Release for issue3446

Publié: 2013-11-04 10:00:00 release security

Synopsis

A vulnerability in tryton has been found, that might allow a malicious server to send a crafted extention as answer to a report request leading the client to write the report on any file of the client host with the right of the user running the client (see issue3446).

Impact

Any file can be created on the client host with the access permissions of the user running the client.

Workaround

Users should connect only to trusted servers.

Resolution

All users should upgrade to the latest version of the used series.

Concern?

Any security concerns should be reported on the bug-tracker at http://bugs.tryton.org/ with the type security.

New Tryton release 3.0

Publié: 2013-10-21 18:00:00 release

We are happy to announce the 3.0 release of Tryton.

This release brings a new calendar view for the graphical user interface and sees the result of a large refactoring of the code started 2 years ago with the project python-sql. But also as usual there are many bug-fixes, improvements and new modules (see below).

Of course, migration from previous series is fully supported.

Major changes in graphical user interface

  • A calendar view is now available. It allows to display records on a calendar using a start and/or an end date/datetime fields. It supports the Drag & Drop of events and the edition on double-click. The view is optimized to fetch only the events displayed.

    production calendar
  • The URL scheme, introduced in 2.0, is now accessible at the bottom of all tabs. This URL allows to open the same tab on any other client.

    url
  • The request has been removed. It is suggested to use emails with URL instead.

  • The selected records in list view is remembered between sessions.

Major changes on the server side

  • The server uses now python-sql to generate the SQL queries. This change brings a better compatibility with all the different Databases currently supported (and also with the future ones).
  • The searcher method can now return a full domain (instead of one limited to AND clause only).
  • The older order_field attribute is replaced by method order_<field name> to be more modular.
  • The database backend can be loaded dynamically which means it is possible to define one in a external package of trytond.
  • The performance of MPTT storage has been improved by removing the default order and reducing the number of queries.
  • A new attribute grouped can be added on the data tag. It allows to create all the records of the same Model at once. This improves the installation time of modules with large sets of data.
  • It is possible to define a default order on the Action Window.

Modules

  • Many modules have been adapted to a new design to link generated documents with their origin. Instead of copying the code of the origin as reference, a Reference field is used and most of the time the field is on the lines. This brings a better vision of the links between documents without loosing information when merge of documents occurs.

Account

  • A new wizard appears to ease the creation of the balance move for non-deferral accounts at the end of the fiscal year.
  • All accounts of a chart must always be in the same company. This constraint improves drastically the performance of computing the debit/credit.
  • Any move posted with one line of zero is automatically reconciled if it is on an account to reconcile. With this feature, invoices with amount of zero are automatically marked as paid.
  • The centralised counterpart option on journal has been removed.

Account Invoice

  • Once an invoice is posted, the account move is used to show the amounts instead of computing it from the lines. This improves a little bit the performance especially for invoices with a lot of lines.

Account Statement

  • Now it is possible to directly set an invoice on a statement line. This will fill the party and account automatically.

Stock

  • It is now possible to query the stock quantity with any kind of grouping parameters. For example, it can be used to compute the stock quantity of a lot instead of a product.
  • The code of inventory has been reworked to allow easy customization of the move creation and also of the unique constraint on the inventory lines.
  • The period cache can now be adapted to cache different kind of grouped quantities.

Stock Lot

  • The quantity and forecast quantity fields have been added on lot.
  • It is now possible to create inventories with lot.
  • The period cache stores also the quantities per lot.

Stock Supply

  • A new wizard appears to create automatically internal shipments.
  • If there are late supplier moves when creating purchase requests, the wizard shows a warning to allow the user to change the date of those moves into the future if needed otherwise those incoming moves will be ignored.

New modules

  • The Bank module defines the concept of bank and account.
  • The Account Dunning module allows to manage the dunning following a procedure with different levels.
  • The Account Dunning Letter module adds the generation of a letter when processing dunnings.
  • The Sale Invoice Grouping module adds an option to define how invoice lines generated from sales will be grouped.

Tryton Unconference Barcelona 2013

Publié: 2013-09-17 12:00:00 TUB

This year the annual Tryton Unconference will take place in Barcelona the 8th, 9th and 10th of November.

In this third global meeting you will have the opportunity to gather together community members (both users and developers), to talk about the future of Tryton and of course to discover the city of Barcelona.

Until now, the following talks are proposed:

  • How to release module
  • Why you should not do localization modules?
  • A documentation framework
  • Tryton from a user point of view
  • GNU Health status
  • Roundtable about the future development

(Follow the changes on our Talks planning page)

The first Foundation Supporter Meeting will take place on Saturday 9th, 18.30 at the same place of the Unconference.

We have reserved Sunday 10th for a Coding Sprint.

Registration to the event is available at TUB 2013.

If you like to give a talk (about your work, to give your feedback etc.), please add yourself to the wiki page or send an email to foundation@tryton.org.

Please, spread the word! #TUB2013

News from Development July13

Publié: 2013-07-08 12:00:00 development

Here are some changes recently landed in the development branch of Tryton that will be available on the next release.

Server

  • A factor on number widgets. This factor is used for conversion between the value displayed and the internal value. The main usage is showing the user a percent value like 10%, while storing 0.1.

    factor
  • The requests have been removed. Instead the server sends emails to notify users and thanks to the Tryton URL users are able to communicate about specific records by referencing them. This also removes load on the server as each client was polling every 5 minutes for new requests.

Client

  • A new kind of view has been added: calendar. It allows to display records on a calendar using ane start and/or an end date/datetime fields. It is based on the widget GooCalendar. It supports the Drag&Drop of events, the edition on double-click and it fetches only the events to display.

    production calendar
  • Since the version 2.0, Tryton has a URL scheme that the client can read. But in the past there was no easy way for the user to get the URL of a record. Now the URL is visible at the bottom of each tab. It contains all information to open the same tab on any other client.

    url

Modules

Account

  • Now any move posted with one line of zero is automaticaly reconciled if it is on an account to reconcile. With this feature, invoices with an amount of zero are automatically marked as paid.
  • A legacy of OpenERP, the centralised counterpart option on journal, has been removed after a poll that shows nobody was using it.

Account Invoice

  • Once an invoice is posted, the account move is used to show the amounts instead of computing it from the lines. This improve a little bit the performance especially for invoices with a lot of lines.

Account Statement

  • Now it is possible to directly set an invoice on a statement line. This will fill the party and account automatically.

Stock

  • It is now possible to query the stock quantity with any kind of grouping parameters. For example, it can be used to compute the stock quantity of a lot instead of a product.
  • The code of inventory has been reworked to allow easy customization of the move creation and also of the unique constraint on the inventory lines.
  • The period cache can now be adapted to cache different kind of grouped quantities.

Stock Lot

  • It is now possible to create inventories with lot.
  • The period cache store also the quantities per lot.

Stock Supply

  • If there are late supplier moves when creating purchase requests, the wizard shows a warning to allow the user to change the date of those moves into the future if needed otherwise those incoming moves will be ignored.

Last maintenance releases for series 1.8

Publié: 2013-05-16 12:00:00 release

Two weeks ago, the series 1.8 received its very last bugfix releases. Two-and-a-half year after the first release, we are going to close the maintenance for this series. Additionally series 2.0, 2.2, 2.4 and 2.6 got several bugfix releases that were already provided in the 2.8 series. As usual, no database update is required for these releases.

New Tryton release 2.8

Publié: 2013-04-22 18:00:00 release

We are happy to announce the 2.8 release of Tryton.

This release brings many changes for the graphical user interface in order to improve the workflow of the users like bookmarks, auto-completion, global search and a review of all error messages to provide more information. As usual there are many bug-fixes, module improvements and new modules (see below).

Of course, migration from previous series is fully supported.

Major changes in graphical user interface

  • Add domains on Action Window: This feature allows to set above any list view tabs which filter the records. All modules have been updated to take advantage of it and thus it reduced the number of menu entries.
Action Window domain
  • Bookmarks for search: Users can now bookmark their own searches and recall them anytime.
Bookmark
  • Auto-completion on Many2One, Many2Many and One2Many: When typing in those fields, the client will try to auto-complete them to allow a fast encoding. The completion also proposes two more actions to create a new record and to enter a complex search.
Completion
  • Replace shortcuts by menu favorites: A new design for favorites aka shortcuts has been implemented for a better user experience.
Menu Favorites
  • Add global search: A quick entry box has been added on top of the menu. It allows to search over all the business documents and the menu entries for fast access. When a search result is selected, the client will open its form view or will trigger the action for menu entries. The kind of documents to search is configurable.
Global Search

Major changes on the server side

  • The create method takes now a list of values thus unifying the API. This also improves the creation performance by validating in a bunch the created records.
  • (Field, Operator, Operand) are replaced by Domain on Rule in addition to unify such definition, it speeds up the computation and eases caching.
  • A new kind of field Dict is introduced. This field allows to store a dictionary for which the definitions of the keys are stored in the database. This feature is used in the new module product_attribute (see below).
  • It was decided to remove _inherits because it doesn't fulfill its mission. It was replaced case by case by Function fields, by a Mixin class or simply by an explicit Many2One.
  • The selection values of Selection and Reference fields can now be dynamic thanks to the selection_change_with attribute.

Modules

account

  • The Move Sequence on Period is optional. So if it is empty the fiscal year's one will be used.
  • Tax Rule and Tax Group have sale, purchase or other kind attribute which allow to define where they can be used.

account_invoice

  • Invoice Sequences on Period are also optional.
  • When cancelling an Invoice, the existing move will be deleted if possible or cancelled with an opposite move.
  • On validate Supplier Invoice, the draft Move is created. This allows in case of two step validation to get reports already up to date.
  • Supplier Invoice and Credit Note can no longer be refunded automatically because they must be checked with the supplier one.

dashboard

  • To ease user to select the actions for the dashboard, they are filtered based on the usage dashboard.

party

  • The new url widget on list view is used for contact mechanisms.
Contact Mechanisms

purchase

  • It is now possible to let the delivery time empty for a product supplier. This means that we don't know when the supplier will deliver.

stock

  • With the new workflow design, it was no more a bottleneck to add it on stock move.
  • All shipment Many2One on Move have been merged into one single shipment Reference.

stock_supply

  • The method find_best_supplier doesn't optimize anymore on the delivery delay and so it fully respects the priority order to select a supplier.

timesheet

  • It is now possible to define a period on which a work can be used to fill a timesheet.

New modules

  • account_asset adds depreciation of fixed assets.
  • sale_supply adds a supply on sale option on product to generate purchase request from sale lines regardless of the stock levels.
  • sale_supply_drop_shipment adds a drop shipment option on product supplier if supply on sale is checked to generate a drop shipment.
  • project_invoice adds some invoice methods (Manual, On Effort, On Timesheet) on project.
  • product_attribute adds flexible attributes on product.
Product Attribute

Other changes in graphical user interface

  • It is possible to use a range for Date/Time fields in filter box.
  • Multi-selection for Selection field is allowed in filter box.
  • View list can now disply url's.
  • The Plugins menu is moved into the toolbar Actions.

Other changes on server side

  • The default language is stored in the database which prevents unexpected behaviors in case the configuration of the server is changed.
  • The unique constraint on model and field access has been removed to allow many modules create their own accesses that overlap.
  • The _constraints list is deprecated and is replaced by the validate method on ModelStorage to allow better error messages.
  • Now it is possible to search on the target of a Reference field.

Derniers développements

Publié: 2013-02-18 12:00:00 development

Voici les changements récents qui sont rentrés dans la branche de développement de Tryton et donc qui seront disponibles dans la prochaine version.

Serveur

  • Maintenant la langue par défaut est stockée dans la base de données et prévaut sur celui du fichier de configuration. Ceci permet d'avoir un serveur multi-DB avec des langues par défaut différentes.
  • L'ensemble (Champ, Operateur, Operande) dans les règles d'enregistrement a été remplacé par un simple domaine standard. Ce changement a permis un gain de performance de 30% sur l'exécution des tests unitaires.
  • L'API de ModelStorage.create a été changée pour utiliser une liste de valeurs. Ceci permet de créer plusieurs enregistrements en un seul appel et ainsi tirer avantage de la validation par groupe.
  • Un nouveau type de champs a été ajouté : Dict. Ce champ permet de stocker un dictionaire pour lequel les définitions des clés viennent de la base de données.
  • L'attribut selection_change_with a été ajouté aux champs Selection et Reference. Il se comporte comme le on_change_with mais il modifie la liste des valeurs de la selection. Le processus de validation prend évidement en compte ce nouvel attribut.

Client

  • La boite de recherche a été améliorée pour permettre:

    • la sélection multiple de valeurs pour les champs Selection

      sélection multiple de recherche
    • une plage pour les champs Date et DateTime

      recherche par plage de date
  • Afin de réduire le nombre d'entrées de menu, un nouveau concept est introduit: le Domain d'onglet. Il ajoute un ensemble d'onglets liés à un domaine. En passant d'un onglet à un autre, la liste des enregistrements est mise à jour suivant le domaine. Tous les modules ont été mis à jour pour tirer avantage de cette fonctionalité et ainsi réduire le nombre d'entrées dans le menu.

    domain d'onglet
  • Les utilisateurs peuvent maintenant mettre en signet leur propre recherche.

    signet de recherche
  • L'icône du widget URL peut être dynamique.

  • Le widget URL est disponible en vue liste.

  • Les favoris remplacent les raccourcis menu. La nouvelle conception donne une meilleure expérience utilisateur.

    favorites menu
  • Une recherche globale est maintenant disponible. Elle permet de rechercher sur tous les enregistrements métiers.

    recherche globale

Modules

Account Asset

C'est un nouveau module pour la gestion des amortissements des immobilisations. Pour l'instant, seul l'amortissement «linéaire» est disponible mais le module est conçu pour en accueillir de nouveaux.

Account

  • Un champ kind a été ajouté aux Group de taxe et Règle de taxe avec les valeurs possibles: Vente, Achat ou Les deux. Chaque plan comptable peut les utiliser pour faciliter la sélection de taxe.

Account Invoice

  • Le « workflow » de la Facture a été revu. Voici le résultat:
    • Dans l'état Annulé, le Mouvement sur la Facture est supprimé ou annulé.
    • Un Mouvement brouillon est créé à la validation de Facture fournisseur. Ceci permet d'avoir des rapports comptables plus précis en mode brouillard.
    • L'état Proforma est renommé en Validé pour être plus générique.
    • L'état Ouvert est renommé en Posté pour être plus cohérent avec le reste du logiciel.

Stock

  • Un « workflow » a été ajouté au Mouvement de stock grâce au nouveau « workflow » léger introduit dans la série 2.4 qui ne pose plus de problème de performance.

Product Attribute

C'est un nouveau module pour gérer tout un ensemble d'attributs sur le Produit en utilisant le nouveau champ Dict.

attribute de produit

Formation Tryton par B2CK

Publié: 2013-01-02 16:00:00 training

B2CK organise une session de formation technique sur Tryton à Liège le 17 et 18 janvier 2013.

La session couvrira des sujets techniques. Le but principal de cette formation est de donner rapidemment aux participants les capacité nécessaires pour retirer un maximum de Tryton afin qu'ils construisent leur premier module avec notre aide. Les pré-requis sont : une connaissance basique de la programmation (de préférent en Python), n'oubliez pas d'emporter votre ordinateur portable. Après cette formation, vous pourrez packager et créer un ensemble de modèles Tryton et leur flux de travail.

Plus d'informations

Versions de maintenance pour les séries supportées 1.8, 2.0, 2.2, 2.4 et 2.6

Publié: 2012-12-24 12:00:00 release

Les séries 1.8, 2.0, 2.2, 2.4 et 2.6 ont reçus des versions de correction de bogues. Aucune mise à jour de la base de données n'est requise pour ces versions de correctives.

La fondation Tryton est maintenant officielle

Publié: 2012-12-18 12:00:00 foundation

Après plus d'une année de préparation, la fondation Tryton existe maintenant sous la forme d'une fondation privée de droit belge. En tant que telle, son rôle est de poursuivre un objectif désintéressé. Les missions de la fondation sont les suivantes:

  • Organiser et promouvoir des conférences, réunions et activités de la communauté,
  • administrer l'infrastructure de tryton.org,
  • organiser la communauté des sympathisants
  • et gérer et promouvoir la marque Tryton.

Le conseil d'administration est composé de : Albert Cervera i Areny, Bertrand Chenal, Nicolas Évrard, Cédric Krier, Sebastián Marró, Udo Spallek et Sharoon Thomas.

La fondation accepte déjà les donations, si vous dépendez d'une manière ou d'une autre du projet Tryton, n'hésitez-pas à aidez celle-ci à remplir ses missions.

Les candidatures des sympathisants sont ouvertes depuis une semaine. Le rôle de l'assemblée des sympathisants est de représenter les intérêts de la communauté au sein de la fondation.

Toutes ces informations sont rassemblées sur http://foundation.tryton.org/. Cette page évoluera au fil du temps et accueillera la liste des sympathisants et celle des donateurs.