Achievo.org blog

Achievo 1.4.5 - Security Bugfix release

nospam@example.com (Sandy Pleyte) — Mon, 27 Sep 2010 22:09:49 +0200

Again we received an email from the CYBSEC S.A company that they discovered 2 vulnerabilities in Achievo 1.4.4 and below. The first one was an authorization flaw in the Time registration module, that made it possible to delete/add records of other users. The second one was a CSRF in ATK how it handles the validation of the actions. Both problems are fixed in Achievo 1.4.5.

For a full list of resolved issues, you can visit: http://www.achievo.org/download/releasenotes/1_4_5.

Sandy

Achievo 1.4.4 - Security Bugfix release

nospam@example.com (Sandy Pleyte) — Fri, 21 May 2010 09:23:04 +0200

Yesterday we received an email from Stefan Esser which was testing Achievo for the Month Of PHP Security. During the SQL Injection marathon he found one in the script that generates the project graphs. This security bugfix release will fix this issue.

For a full list of resolved issues, you can visit: http://www.achievo.org/download/releasenotes/1_4_4.

Sandy

Achievo 1.4.3 - Security Bugfix release

nospam@example.com (Sandy Pleyte) — Thu, 03 Dec 2009 21:55:32 +0100

Today we received an email from the CYBSEC S.A company that they discovered 2 vulnerabilities in Achievo 1.4.2 and below. The first one was about an XSS that people could enter javascript in a scheduler category. And the second one was about the document manager. This module didn't check the files that where upload which made it possible to upload php files for example. Therefore we updated the document manager and added a new config (docmanager_allowedfiletypes) for it in /configs/docmanager.php.inc. With this config you can tell the docmanager what type of files a user can upload. Both problems are now fixed in Achievo 1.4.3 this means that we have a new release 6 hours after they where reported, which is a new record

For a full list of resolved issues, you can visit: http://www.achievo.org/download/releasenotes/1_4_3.

Sandy

Achievo 1.4.2 - Bugfix release

nospam@example.com (Sandy Pleyte) — Tue, 01 Dec 2009 22:15:41 +0100

I'm pleased to announce the immediate availability of the 1.4.2 release. This release is the second maintenance release in the 1.4 series, and includes 2 bugfixes, a language update and a new config for turning on the ages in the scheduler birthday view. Many thanks to all the contributors who helped with this release, including translators and reporters.

For a full list of resolved issues, you can visit: http://www.achievo.org/download/releasenotes/1_4_2.

Sandy

Achievo 1.4.1 - Bugfix release

nospam@example.com (Sandy Pleyte) — Wed, 28 Oct 2009 22:50:35 +0100

I'm pleased to announce the immediate availability of the 1.4.1 release. This release is the first maintenance release in the 1.4 series, and includes 5 bugfixes and 2 language updates. Many thanks to all the contributors who helped with this release, including translators and reporters.

For a full list of resolved issues, you can visit: http://www.achievo.org/download/releasenotes/1_4_1.

Sandy

Achievo 1.4.0

nospam@example.com (Sandy Pleyte) — Sun, 11 Oct 2009 22:57:36 +0200

Two weeks after the release candidate we can now present you a new stable release. One of the new problems we had is that many people where switching to PHP 5.3, while the last stable version didn't run correctly this version will run without problems. And other often heard problem on the forum was the speed of Achievo. In this release we make a lot of optimizations which resulted in a 50% performance for some parts in Achievo. This release also fixed multiple security vulnerabilities, so please upgrade as soon as possible.

For a list of changes and other important information about this release, or to download it, see the release-notes.

Sandy

Achievo 1.4.RC1

nospam@example.com (Sandy Pleyte) — Mon, 21 Sep 2009 20:43:45 +0200

After more then 1 year we are proud to announce the first release candidate for Achievo 1.4.
For a list of changes and other important information about this release, or to download it, see the release-notes.

Some people will wonder what we did in the mean while, well we worked on Achievo 2.0, but it's still far from release ready. I will try to setup a demo version soon so you all can see what Achievo 2.0 will become. To give you some hints, in Achievo 2.0 you can expect a complete rewrite of the time registration and the project modules. Soon more.....

Sandy

Visit us at CEBIT Hall 9, booth C72, 6 March, Hannover

nospam@example.com (Sandy Pleyte) — Sun, 01 Mar 2009 11:56:00 +0100

We will be exhibiting at CeBit this year! The CeBit trade show takes place every year in Hanover, Germany. It is the world’s largest IT trade fair and thanks to HIS (one of the major sponsors for Achievo 2) we have opportunity to show the IT world the latest preview of Achievo!

This is the first time that Achievo will be present, and we are extremely excited to be attending. If you plan on coming, we’d love to meet you. You can find us on 6 March, in Hall 9, booth C72 (map).

Follow Achievo on LinkedIn and Twitter

nospam@example.com (Sandy Pleyte) — Tue, 24 Feb 2009 16:36:32 +0100

We’ve established a LinkedIn group called Achievo. LinkedIn is a networking site for professionals and the purpose of this group is to extend the Achievo community and provide a place for further discussion and knowledge sharing amongst Achievo enthusiasts. Also we signed up for a Twitter account. Go check it out, follow, and get the latest updates and developments about Achievo.

Join the Achievo group on LinkedIn, and follow Achievo on Twitter:

Achievo on LinkedIn: http://www.linkedin.com/groups?gid=59134
Twitter: http://twitter.com/achievo

Achievo 1.3.4 - Bug fix release

nospam@example.com (Sandy Pleyte) — Tue, 12 Aug 2008 22:38:48 +0200

Today the fourth update to Achievo 1.3 has been made available. Although the changelog is not particularly long, the release should be worthwhile to upgrade to. The scheduler has received some fixes for recurring items and an hidden feature has been turned on. The cronjob for checking the booked hours also received some fixes. And some other small fixes have been done which can be found in the release notes.
We also received some translations for French, Spain, Portuguese -Brazil, Czech which are also included now.

You can download and read the list of changes here.

Sandy

Achievo 1.3.3 - Security Release

nospam@example.com (Sandy Pleyte) — Wed, 11 Jun 2008 23:02:06 +0200

An exploit has been posted for the "mcpuk" file manager that we're shipping with FCKeditor in the Achievo versions 1.2.0 till 1.3.2. The exploit allows an attacker to upload and execute arbitrary code.

While FCKeditor is not used in Achievo, this exploit works even when FCKeditor is disabled, as it calls the vulnerable file directly.

For people who can't upgrade to Achievo 1.3.3 because of modules that don't work with the latest version we advice to remove the file manager manually.

To remove the file manager, go to the 'atk/attributes/fck/editor' directory and remove the entire 'filemanager' subdirectory. Then, you should disable the file manager in the FCKeditor configuration file, 'fckconfig.js' (in atk/attributes/fck). It contains the following three options, all of which should be set to "false" to disable the file manager:

FCKConfig.LinkBrowser = false;
(...)
FCKConfig.ImageBrowser = false;
(...)
FCKConfig.FlashBrowser = false;

Next, you should check if anyone managed to upload malicious code to your site.
After these changes, FCKeditor should continue to work, but you won't be able to upload files with it.

If you have any questions just send me an email.

Sandy

Achievo 1.3.2

nospam@example.com (Sandy Pleyte) — Thu, 06 Mar 2008 22:07:48 +0100

Today we released a bugfix release for Achievo 1.3, this will bring the current version up to 1.3.2. This release fixes 8 bugs that have been reported by the community and sponsors. I'd like to thank the forum users for their help with finding the bugs and even for providing me fixes for the bugs they found.

You can download and read the list of changes here.

Sandy

Achievo 1.3.1

nospam@example.com (Sandy Pleyte) — Sun, 24 Feb 2008 22:33:19 +0100

2 Weeks after the major 1.3 release I received 2 serious bugs from the community (thanks for reporting them). Of course most of the time I try to test everything, but I am using (and testing) Achievo in the same way as I develop it. The result is that I don't always find those bugs.

So here is the first bugfix release with 4 bugfixes, you can read the details here.

Sandy

SVN and Ohloh

nospam@example.com (Sandy Pleyte) — Tue, 19 Feb 2008 22:50:27 +0100

I nagged a long time for it at the company where I work (almost 2 years ), but we now have a public SVN server for Achievo and the Achievo modules. So if you want to develop some code, you can now use SVN for updating your achievo to the latest version. I made an SVN page where you can find all details. A web based SVN viewer is also on the planning, but I will report on it later.

Thanks to this SVN repository I also could add the Achievo project to Ohloh. This site analyses applications based on their source code and full svn history and gives some pretty cool statistics.

Sandy

Achievo 1.3.0 and a brand new website

nospam@example.com (Sandy Pleyte) — Sun, 10 Feb 2008 23:59:00 +0100

I'm thrilled to announce the immediate availability of Achievo 1.3.0 This significant release marks both the end of the long and intensive development cycle leading up to Achievo 1.3.0. The major changes are the new modules that are added to the Achievo core modules. The modules are:

Quotation module, for managing quotations.
Document manager, for adding documents to projects, quotations and organizations.
CRM Module, this will add some CRM features to the organization/contacts (see the new sales main menu).
A brand new Scheduler module with recurring events.

Also more than 100 improvements are done in this release and we moved to PHP5.
In case you run into problems please post your problem in the forum.

To celebrate this long awaiting release Ibuildings sponsored a brand new website for the Achievo project.
I'm still busy with completing the site, so it's possible that some pages are missing.

Enjoy,

Sandy