During the last month we focused on fixing bugs, improving the behaviour of things, speeding-up performance issues - building on the changes from our release last month. But we also added many new features which we would like to introduce to you in this newsletter. For an in depth overview of the Tryton issues please take a look at our issue tracker or see the issues and merge requests filtered by label. Changes for the User Sales, Purchases and Projects We now add the optional gift ca...

Success story of Mifarma implementing Tryton

We’re honored to share that the Tryton Foundation has won this year GNU Health Social Medicine Award in the category “Organizations”. Those awards are given during the GNU Health Conference and are given to individuals and organizations committed to improve the live of the underprivileged. This awards comes after many years of collaboration between the GNU Health community and the Tryton community. We are sharing the same values: Free Software, Respect of the user’s freedoms and the conviction...

We are proud to announce the 7.8 release of Tryton. This release provides many bug fixes, performance improvements and some fine tuning. You can give it a try on the demo server, use the docker image or download it here. As usual upgrading from previous series is fully supported. Here is a list of the most noticeable changes: Changes for the User Client We added now a drop-down menu to the client containing the user’s notifications. Now when a user clicks on a notification, it is marke...

Success story of Grufesa implementing Tryton

Closes #3686

Mahdi Afshar and Abdulfatah Abdillahi have found that trytond sends the trace-back to the clients for unexpected errors. This trace-back may leak information about the server setup. Impact CVSS v3.0 Base Score: 4.3 Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None Workaround A possible workaround is to configure an error handler which would remove the trace-back from the respo...

Abdulfatah Abdillahi has found that sao does not escape the completion values. The content of completion is generally the record name which may be edited in many ways depending on the model. The content may include some JavaScript which is executed in the same context as sao which gives access to sensitive data such as the session. Impact CVSS v3.0 Base Score: 7.3 Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: Required Scope: Unchanged Confidentiality...

Cédric Krier has found that trytond does not enforce access rights for data export (since version 6.0). Impact CVSS v3.0 Base Score: 6.5 Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None Workaround There is no workaround. Resolution All affected users should upgrade trytond to the latest version. Affected versions per series: trytond: 7.6: <= 7.6.10 7.4: <= 7.4.20 7.0: <=...

Success story of Buchkontor Teltow implementing Tryton