We are proud to announce the 4.2 release of Tryton.
With this release, Tryton extends its scope to tailored user applications like Chronos and also as backend for webservice. A part of the effort was put also on closing the feature gap between the web and the desktop client. The web client is still a little bit behind in terms of features but at the current rate the gap will disappear in few releases. This release contains many bug fixes and performance improvements. Polish is now an official language of Tryton.
Of course, migration from previous series is fully supported.
The tabs in list view can now have a counter showing to the user the number of records under them. The feature is activated by default on tabs where the number should tend to zero thus providing some hint to the user about pending tasks.
When creating a new record from the drop down menu of a relation, the form will have the value entered in the field as default value. This helps the user fill the form.
The buttons can now be configured to be clicked by a number of different users before being triggered. The user can see on the button how many clicks it already received and on the tooltip who clicked.
With the recent Neso retirement the database management from the client has been removed. This improve the security of the system by removing a potential attack vector.
It is now possible to define for each record a different color on the calendar view. This allow to group records visually.
The icons of the relation field has been improved. The experiences have shown that the old version had drawbacks which confused some users. The result was that some users thought they were searching for a new record while actually they were editing it.
As a result the editing button has now been put in on the left and a new button to clear the current value has been put on the right of the field.
The web client completes its sets of functionalities in order to be closer to desktop client. The new features implemented in this release are:
The CSV Import/Export.
The calendar view based on the FullCalendar.
Support for translated fields.
The Favorites menu.
The date picker is now locale aware.
Add support for column sorting.
Support for confirm attribute on the buttons.
A comparison amount has been added on Balance Sheet and Income Statement, allowing the amounts to be compared with different date, fiscal year or periods.
The second currency of account is now enforced, closing the gap between the documentation and the code. Thus it is possible to compute the balance of such accounts in the account currency.
The creation of a tax can be quite complex. To ease the process, a testing wizard has been added allowing to see the result of the computation in order to validate the definition of the tax.
A new module for managing purchase requisitions has been added. It allows users to create their purchase requisitions which will be approved or rejected by a member of the Approval group. On approval, purchase requests will be created.
A Web-Extension named Chronos has been published. It allows to quickly encode timesheet entries using the new user application API (see below). The application supports to work offline and synchronises when the user is back online.
It will be available soon on the different browser markets.
It is now possible to define a start and an end date for the employees. In such case, they will not be allowed to encode timesheet outside the period.
The work has be simplified by removing the tree structure. It was considered redundant with the tree structure of the projects.
Following the work on previous versions, the production area has received two new modules to extend its functionalities:
It allows to track the time spent per production work.
Similar to the stock_split module, this module allows to split a production into several units.
The login process has been reworked to be very customizable. It is now possible to plug any authentication factors without the need to adapt the clients.
The authentication_sms module allows to send by SMS a code to the mobile phone of the user that he will have to enter to proceed with the login.
The module web_user is the first of a new set of module which aims to provide facilities to developers who want to use Tryton as backend for web development.
This edition was a great success with more than 60 participants who followed the 18 talks and participated to the different dinners and about 25 developers for the sprint.
The conference was divided in two days. The first day was dedicated to business talks where we discovered among others the new features of the release 4.2. We also learned about some use cases about billiard balls manufacture, insurance sector or advocate office etc. The first day closed on the foundation meeting where the accounting of the foundation was presented, followed by discussion on how to improve the mission of the foundation.
The second day was more oriented to the attention of the developers. Many talks were talking about performance with some impressive numbers like the generation of 1 million invoices in 1 hour. Others talks were about how to use some of the new features of Tryton like the distributed transactions, the development of user applications or the new pluggable authentication system.
25 developers joined the NaN-tic office to sprint during 3 days. 11 of them achieved to have at least one patch pushed into the repository and for some of them it was the first one. Others worked on improving the documentation and some blueprints for future new features. Even if the sprint is finished, it still influences the project as many continue to contribute which is the main goal of the sprint: to onboard new developers. Another result of the sprint is the creation of a monthly remote sprint to keep the good spirit.
The CVE-2016-1241 allows an authenticated user to read the hashed password of other users. The exploitation is not easy thanks to the existing protection of Tryton against such leak. Those protections are usage of strong hash method (bcrypt or sha1) and the salt of the password with random data (protection against rainbow tables).
The CVE-2016-1242 allows an authenticated user with write access to report or icon definition to make the server opens any readable file. By default, only the administrator group has such right access.
There is no workaround for CVE-2016-1241.
For CVE-2016-1242, the modification rights could be removed to all users for the report and icon records.
All users should upgrade trytond to the latest version.
It is recommended that every user changes his password.
Affected versions per series: <=3.2.16, <=3.4.13, <=3.6.11, <=3.8.7 and <=4.0.3
Non affected versions per series: >=3.2.17, >=3.4.14, >= 3.6.12, >=3.8.8 and >=4.0.4
Any security concerns should be reported on the bug-tracker at https://bugs.tryton.org/ with the type security.
This will be the sixth edition. Users, developers and interested people will have the opportunity to discover or talk about Tryton.
This year the first day will be dedicated to business oriented talks. And the second day will remain more focused on developer talks.
Talk proposals and schedule are managed on Lanyrd.
A Sprint is planned to be organised the 19th, 20th and 21st. The place will be announced later.
Registration is available at TUB 2016.
If you want to request a talk on a specific topic, you can send your request to the Tryton mailing list. If you have question about the organisation, please contact the foundation at firstname.lastname@example.org.
And don't forget to spread the word! #TUB2016
A missing access right has been found by Cédric Krier for the Model 'product.product-production.bom'. That allows a malicious authenticated user to write, create or delete records of this type (see issue5570).
Any authenticated user can modify the links between products and BoM's.
All users should create manually a default model access which limits to read only and a second model access limited to the group "Production Administration" with full access.
Affected versions: all versions of production module prior to series 4.0 included.
Non affected version: all versions of production module after series 4.0 non-included.
Any security concerns should be reported on the bug-tracker at https://bugs.tryton.org/ with the type security.
Due to an issue with Pootle, the initial release of series 4.0 is missing many translations. So we decided to make new set of releases with the correct translations even if it breaks rule of no database updates for bug fix releases.
If you have already updated your server to the series 4.0, you need to also update the database for this bug fix release. Sorry for the inconvenient.
We are proud to announce the 4.0 release of Tryton.
This is the first release of Tryton that adds support for Python 3. The server and most of the modules support it. The missing modules are mainly the ones using the WebDAV and LDAP. The client will be ported once GTK-3 support is added. The release sees also a large refactoring of the protocol stack which was previously based on the SimpleHTTPServer of Python. Now it uses a WSGI application running on the Werkzeug server by default. Any WSGI server can be used to run Tryton, this removes the design constraint of single threaded process and opens the way for using workers. All modules have been reviewed to enforce the naming convention about the document identification. The name "code" is used for all referential documents like parties, product. The name "number" is used for the internal identification of all operational documents like sales, purchases, invoices etc. And finally, the name "reference" is used for identifications from external systems like the sale order number of the supplier of your purchase. Two new languages are now available on default installation the Lao and the Simplified Chinese.
As Richard Stallman reminded to us, the migration from previous series is fully supported.
The new note functionality handles the management system for general textual notes on any arbitrary model in Tryton. On click it opens a notes dialog, where the user can maintain notes. The read state of every note is managed per user. Like the attachments, the icon in the tool-bar visualizes when there are notes on a model.
The CSV import and export has been highly reworked for a better experience. The import dialog now supports drag and drop to order the selected columns like the CSV export wizard. Both wizards are able to use any of the encodings available in Python. It is now possible to configure the CSV parameters for the export result.
The charts provided by the graph view have been improved. Now they use softer colors, thinner lines and smaller arcs. On the background, dash style is used instead normal line for axis representation. A smart transparency value is applied for filling lines to always show through it.
A new button in the scheduler allows running a job once, useful to run jobs on demand or to test new settings.
The report design of the General Ledger, Trial Balance and Aged Balance has been re-worked. They are now based on the new dynamic views. This provides a performance burst and allows to filter the records more precisely. In addition to the previous printable output, they also gain the CSV export which is useful to perform specific operations in a spreadsheet application.
A date field is added to the Aged Balance, to modify the date on which the calculations are based. With this feature, it is possible to generate reports based on a past date as if it would have been generated by ignoring reconciliation that happened after that date.
The functionality of Third Party Balance is merged into the Aged Balance. We found that the Third Party Balance computed the same data as the Aged Balance with the type Customers and Suppliers.
A configuration form is added to the product module with these options:
- The default value for Use Category fields.
- The default value for the Cost Price Method.
It was not always easy to explain the design of products with the templates, especially when it was not really relevant for the current business. So we have redesigned both views to be very similar and indeed they use the exact same design. The fields, that do not exist on the product, are automatically replaced by the value of the template.
The field Category is replaced by a Categories field, to support the ability of adding many categories to one product. This is very useful for example to create multi-axis categories for web shop.
This new module defines the reference basis to create different kinds of classifications for products. It adds a generic field Classification on the product form.
The purchase request functionalities have been decoupled from stock_supply and sale_supply modules into a new separate module named purchase_request. This is to prepare future work that will use only purchase requests without the need of other stock_supply features.
This new module defines the routings, steps and operations for productions. A routing is a list of ordered steps and each step is defined by a generic operation.
This new module completes the routing module by creating the Works of a production based on its routing. A Work is linked to a Work Center which defines the cost using one of these two methods: Per Cycle or Per Hour. The cost of a work is computed using the Cycles created on it and later added to the global cost of the production.
The reconciliation process now stores the date of the reconciliation. By default, it is the highest date of the reconciled lines. This allows to filter reconciled lines based on this date, for example to generate a report with the unreconciled lines before a specific date.
The Credit Notes have been merged into the Invoices. They are now standard invoices with negative quantities. This allows to easily group both types into a single document. The numbering can still be differentiated depending on the sign of the lines.
Note: with the merge of Invoice and Credit Note, the signs of the taxes for Credit Note must be inverted manually.
WebDAV has been decoupled from trytond into a separate module which improves the modularity of the system. Indeed many setups do not use the WebDAV so it was a little bit bloated to have it into the base. Also dependencies of this module prevented to add the support of Python 3 to trytond. So, for now, the WebDAV protocol is managed by a separated process but it will probably return in the future into the main process.
As already announced on the Spanish mailing list, several Spanish companies who provide services around Tryton are organizing the I Jornadas Tryton in Barcelona, which will be held on 23th and 24th May at an excellent location, the Mobile World Centre.
The plan is that the content of the conference will be split between user-oriented on Monday 23th and developer-oriented on Tuesday 24th.
Subscription is already open at Eventbrite.
Yet the event will not succeed without your participation, so it's time to collect your proposals to make a presentation for the event, which will be held in Spanish.
Topics may target users or developers and can include, among others:
Do not hesitate to send us your proposal. We're looking forward to learn about what you know and how Tryton is changing businesses around you.
Just send an e-mail to email@example.com before 17th April with a short explanation of what your talk will be about.
After last year's excellent Tryton Unconference in Buenos Aires, the Tryton Foundation already started to think about this year's unconference, which will be held just after 4.2 release due in autumn.
If you're interested as an individual or organization to host TUx 2016 (our sixth unconference already!) do not hesitate to send your application to firstname.lastname@example.org before 30th April.
Which city will follow Liège, Barcelona, Leipzig and Buenos Aires?