It's much more fun, when you can discuss your problems with others...
You are not logged in. Please login or register.
FrontAccounting forum → Posts by apmuthu
You will need to pull in the data from FA into your application from within your application or program a trigger in the FA DB to populate your application DB.
To pull in FA data from within your application, use the FA SlimAPI to create a script that can be run on demand or in a cron job.
@joe: Thanks.
Connecting to other applications is best done using the REST API (See SlimAPI in the wiki).
How did you import the banking transactions into FA without having the relevant bank account(s) in place?
If you have a backup prior to importing the transactions, then restore it and logout and login again and then create the bank accounts and then import the transactions afresh.
Which version of FA are you using?
What does "21 year" mean, assuming "14000" is the number of transactions imported you refer to?
@joe: Which setting closes a date (not fiscal year) for further transactions / edits?
Remove Edit permissions in a role for such a restricted user.
@joe / @itronics: any progress on @braathwaate's commit and way forward here?
Prepare the BoM and make sure it also has the necessary labour / equipment charges as cost items. How do you wish to apportion the fixed overheads?
Short of creating your own custom module / hard code changes, you can prefix all items in each location with the appropriate Loc ID prefix. Also to produce Item A from each location prefix it with the appropriate Loc ID. Now the BoM for ItemA_Loc1 will be present n Loc1 only and hence can be used for manufacturing in Work Centre 1.
Native FA allows any location to supply any item to any work centre.
Elaborate on what you mean by close and open accounting periods for each module.
The P&L should be prepared for the fiscal year and hence the close and open for it.
Do you mean to restrict entry to a certain accounting period (what least count?) for each module?
If so, what about reporting across multiple periods, year, years?
For now, focus on the field order in the tables where memo_ is present in your output above, especially in the first one below:
ALTER TABLE `0_budget_trans` MODIFY `memo_` tinytext NOT NULL;
ALTER TABLE `0_comments` MODIFY `memo_` tinytext;
ALTER TABLE `0_gl_trans` MODIFY `memo_` tinytext NOT NULL;
ALTER TABLE `0_supp_invoice_items` MODIFY `memo_` tinytext;
ALTER TABLE `0_voided` MODIFY `memo_` tinytext NOT NULL;Do not make any change to your current schema unless you are sure of the direction of change (from which schema to which) for now.
Which Chart of Accounts are you using and where and when did you get it from?
Was it upgraded from an earlier FA v2.3.x?
A few sql upgrade scripts merely add an new field instead of positioning them to be in synch with the field order in the latest sql/en_US-new.sql file. Even some charts in the official pkg repo too need to have their fields and tables synched likewise. A more uptodate set of charts are in my FA24extensions repo.
There are 5 tables that have the memo_ field and their order can be checked from the attachment herein with that in your backup.
Online MySQL Schema Compare
DBDiff @ Github
Discussion @ StackOverflow
FA now natively supports upto PHP 7.1.x only. PHP 7.2.x is not yet supported.
PHP 5.3.x is still the most widely used and texted version for FA so far for long time users though later versions happen to be discussed in the forum as newbies try to grapple with their maiden installs.
Most script based installs (Scriptaculous, cPanel, SimpleScripts, Fantastico, public OpenVZ templates, etc) rely on outdated versions of FA where the hosting providers make several versions of PHP available on a per application basis possibly in CGI mode.
PHP 7.1 to 7.2 Migration Notes.
The code changes stated in my post above are not required.
The show_codes field in the preferences form is meant to display item_codes in the drop down select boxes for items in the Web UI.
The show_po_item_codes entry in the sys-prefs table controlled by the Setup => Banking and GL Setup form is to direct the display of the item codes in the PO Report (rep209.php).
The show_codes checkbox "name" is available in the preferences menu and gets stored in the users table.
The show_po_item_codes is present as an entry in the sys_prefs table. Under Setup => Banking and GL Setup => Show PO item codes can be checked, and we can then see the item_code printed out in the PO report (rep209.php).
In fixing this, we need to suppress the display of the Item Code heading if not chosen.
The class sys_prefs contains the method show_po_item_codes() which promptly returns the value from the sys_prefs table.
Hence, for now, change line 142 of reporting/rep209.php:
if ($SysPrefs->show_po_item_codes()) {to be:
if ($SysPrefs->show_po_item_codes() || user_show_codes()) {What is the logic behind this redundancy.....
Not yet.
Which version of FA are you using?
Did you modify the PO report file - rep209.php?
Did you recently change your PHP / MySQL versions?
https://frontaccounting.com/fawiki/uploads/Help/Rep209_PurchaseOrders.png
Looks like this is an old CSRF vulnerability for FA v2.3.4 as of 2011-03-05 wrongly posted here as for v2.4.3.
https://0day.today/exploit/16029
Then when the manufacturing charges invoice is raised, put in the cost of goods sold and price of goods received instead so that the net result is what you need to book as manufacturing charges after allowing for tax credits.
Alternatively:
Treat the Company B as a regular Customer and another account for Company B as a Supplier. Keep the Sales and Purchases separate and provide for tax credits on purchase back of manufactured items.
If your tax accountant agrees, make a delivery on consignment for manufacture to Company B so that no billing needs to be done except in escrow and contra-ed when the purchase is made.
@itronics: Thanks for stating the design decision reasons. A separate hint gettext is probably in order.
When we create a new company (non-default) and choose the en_US-demo.sql company, we get the extra permissions by default - 256;257;258;259;260 but the code possibly handles this anomaly by restricting such permissions for the non-default company. When we edit the System Administrator Role in the new non-default company without making any changes (dummy save), the said permissions vanish in the backup. There is no restoration of any backups involved here.
Use straight Manufacturing and pay Company B manufacturing charges.
There was a CSRF case for a while in FA v2.3.12 stated in my post then.
The said file admin/users.php was last modified on 2015-05-10.
The Exploit form when submitted will return the following:
{
"id":"0"
,"js":[
{
"n":"up"
,"t":"_page_body"
,"why":"_page_body"
,"data":"<br><br><form method='post' action='\/frontaccounting\/admin\/users.php?' name='loginform'>\n<center><table class='login' cellpadding='2' cellspacing='0'>\n<tr>\n<td align='center' colspan=2><a target='_blank' href='http:\/\/frontaccounting.com'><img src='..\/themes\/default\/images\/logo_frontaccounting.png' alt='FrontAccounting' height='50' onload='fixPNG(this)' border='0' ><\/a><\/td>\n<\/tr>\n<tr><td colspan=2 class='tableheader'>Version 2.4.3 Build 04.02.2018 - Login<\/td><\/tr>\n<tr><td class='label'>User name<\/td><td><input type=\"text\" name=\"user_name_entry_field\" size=\"20\" maxlength=\"30\" value=\"\"><\/td>\n<\/tr>\n<tr><td class='label'>Password:<\/td><td ><input type='password' name='password' size=20 maxlength=20 value='' ><\/td>\n<\/tr>\n<tr><td>Company<\/td><td><select name='company_login_name'>\n<option value=0 selected>Default24 Company<\/option><option value=1 >Training24 Co<\/option><option value=2 >South Africa Company<\/option><\/select>\n<\/td><\/tr><tr>\n<td colspan=2 align='center' id='log_msg'>Please login here<\/td>\n<\/tr>\n<\/table><\/center>\n<br><input type='hidden' id=ui_mode name='ui_mode' value='' >\n<center><input type='submit' value=' Login --> ' name='SubmitUser' onclick='set_fullmode();' ><\/center>\n<input type='hidden' name='show_inactive' value=''><input type='hidden' name='user_id' value='Newadmin'><input type='hidden' name='real_name' value='New Admin'><input type='hidden' name='phone' value=''><input type='hidden' name='email' value=''><input type='hidden' name='role_id' value='8'><input type='hidden' name='language' value='C'><input type='hidden' name='pos' value='1'><input type='hidden' name='print_profile' value=''><input type='hidden' name='rep_popup' value='1'><input type='hidden' name='ADD_ITEM' value='Add new'><input type='hidden' name='_focus' value='user_id'><input type='hidden' name='_modified' value='0'><input type='hidden' name='_confirmed' value=''><input type='hidden' name='_token' value='Ta6aiT2xqlL2vg8u9aAvagxx'><input type='hidden' name='_random' value='757897.6552143205\r\n'><br><input type=\"hidden\" name=\"_focus\" value=\"user_id\"><input type=\"hidden\" name=\"_modified\" value=\"0\"><input type=\"hidden\" name=\"_confirmed\" value=\"\"><input type=\"hidden\" name=\"_token\" value=\"A83xncEdy_cwjfrIEHd03wxx\"><\/form>\n<script language='JavaScript' type='text\/javascript'>\n \/\/<![CDATA[\n <!--\n document.forms[0].user_name_entry_field.select();\n document.forms[0].user_name_entry_field.focus();\n \/\/-->\n \/\/]]>\n <\/script>"
}
,{
"n":"js"
,"why":true
,"data":"document.forms[0].password.focus();"
}
]
,"text":""
}When the exploit form was submitted after having logged in, the following page is output:
{
"id":"0"
,"js":[
{
"n":"up"
,"t":"_page_body"
,"why":"_page_body"
,"data":"<form method='post' action='\/frontaccounting\/admin\/users.php' >\n<center><table class='tablestyle' cellpadding='2' cellspacing='0'>\n<tr>\n<td class='tableheader' >User login<\/td>\n<td class='tableheader' >Full Name<\/td>\n<td class='tableheader' >Phone<\/td>\n<td class='tableheader' >E-mail<\/td>\n<td class='tableheader' >Last Visit<\/td>\n<td class='tableheader' >Access Level<\/td>\n<td class='tableheader' ><\/td>\n<td class='tableheader' ><\/td>\n<\/tr>\n<tr class='evenrow'>\n<td >admin<\/td>\n<td >Administrator<\/td>\n<td ><\/td>\n<td ><a href='mailto:adm@example.com'>adm@example.com<\/a><\/td>\n<td nowrap>02\/21\/2018<\/td>\n<td >System Administrator<\/td>\n<td align='center'><button type='submit' class='editbutton' name='Edit1' value='1' title='Edit' ><img src='..\/themes\/default\/images\/edit.gif' style='vertical-align:middle;width:12px;height:12px;border:0;' >\n<\/button>\n<\/td><td ><\/td>\n<\/tr>\n<tr><td colspan=8><div style='float:left;'><input type='checkbox' name='show_inactive' value='1' onclick='JsHttpRequest.request(\"_show_inactive_update\", this.form);' >\nShow also Inactive<\/div><div style='float:right;'><button class=\"inputsubmit\" type=\"submit\" style='display:none;' name=\"Update\" id=\"Update\" value=\"Update\"><span>Update<\/span><\/button>\n<\/div><\/td><\/tr><\/table><\/center>\n<br><center><table class='tablestyle2' cellpadding='2' cellspacing='0'>\n<tr><td class='label'>User Login:<\/td><td><input type=\"text\" name=\"user_id\" size=\"22\" maxlength=\"20\" value=\"Newadmin\"><\/td>\n<\/tr>\n<tr><td class='label'>Password:<\/td><td ><input type='password' name='password' size=20 maxlength=20 value='' ><\/td>\n<\/tr>\n<tr><td class='label'>Full Name:<\/td><td><input type=\"text\" name=\"real_name\" size=\"50\" maxlength=\"50\" value=\"New Admin\" ><\/td>\n<\/tr>\n<tr><td class='label'>Telephone No.:<\/td><td><input type=\"text\" name=\"phone\" size=\"30\" maxlength=\"30\" value=\"\" ><\/td>\n<\/tr>\n<tr><td class='label'>Email Address:<\/td><td><input type=\"text\" name=\"email\" size=\"50\" maxlength=\"50\" value=\"\" ><\/td>\n<\/tr>\n<tr><td class='label'>Access Level:<\/td><td><span id='_role_id_sel'><select id='role_id' autocomplete='off' name='role_id' class='combo' title='' ><option selected value='8'>AP Officer<\/option>\n<option value='7'>AR Officer<\/option>\n<option value='1'>Inquiries<\/option>\n<option value='9'>Accountant<\/option>\n<option value='5'>Production Manager<\/option>\n<option value='6'>Purchase Officer<\/option>\n<option value='3'>Salesman<\/option>\n<option value='4'>Stock Manager<\/option>\n<option value='10'>Sub Admin<\/option>\n<option value='2'>System Administrator<\/option>\n<\/select>\n<\/span>\n<\/td>\n<\/tr>\n<tr><td class='label'>Language:<\/td><td><span id='_language_sel'><select autocomplete='off' name='language' class='combo' title=''><option selected value='C'>English<\/option>\n<\/select>\n<\/span>\n<\/td>\n<\/tr>\n<tr><td class='label'>User's POS:<\/td>\n<td><span id='_pos_sel'><select id='pos' autocomplete='off' name='pos' class='combo' title='' ><option selected value='1'>Default<\/option>\n<\/select>\n<\/span>\n<\/td><\/tr>\n<tr><td class='label'>Printing profile:<\/td>\n<td><span id='_print_profile_sel'><select autocomplete='off' name='print_profile' class='combo' title=''><option selected value=''>Browser printing support<\/option>\n<option value='Central'>Central<\/option>\n<option value='Out of office'>Out of office<\/option>\n<option value='Sales Department'>Sales Department<\/option>\n<\/select>\n<\/span>\n<input type='submit' class='combo_select' style='border:0;background:url(..\/themes\/default\/images\/button_ok.png) no-repeat;display:none;' aspect='fallback' name='_print_profile_update' value=' ' title='Select'> \n<\/td><\/tr>\n<tr><td class='label'>Use popup window for reports:<\/td><td ><input checked type='checkbox' name='rep_popup' value='1' title='Set this option to on if your browser directly supports pdf files' >\n<\/td><\/tr>\n<\/table><\/center>\n<br><center><button class=\"ajaxsubmit\" type=\"submit\" aspect='default' name=\"ADD_ITEM\" id=\"ADD_ITEM\" value=\"Add new\"><img src='..\/themes\/default\/images\/ok.gif' height='12' alt=''><span>Add new<\/span><\/button>\n<\/center><input type=\"hidden\" name=\"_focus\" value=\"user_id\"><input type=\"hidden\" name=\"_modified\" value=\"0\"><input type=\"hidden\" name=\"_confirmed\" value=\"\"><input type=\"hidden\" name=\"_token\" value=\"xug4LnCbMhztG65aZRdVUgxx\"><\/form>\n<center><center><table width='20%' cellpadding='2' cellspacing='0'>\n<tr>\n<td align=center><a href='javascript:goBack();'>Back<\/a><\/td>\n<\/tr>\n<\/table><\/center>\n<\/center><br>"
}
,{
"n":"fc"
,"why":true
,"data":"user_id"
}
,{
"n":"js"
,"why":"editors"
,"data":"editors = [ ];"
}
]
,"text":"<div class='err_msg'>Request from outside of this page is forbidden.<\/div>"
}Hence it is seen that it is not affected.
The hidden field _token is present in the form and is checked by the server side and hence protects it from malicious submitted data.
This was tested in the FA 2.4.3+ Current Git Master using PHP 5.3.1 on XAMPP 1.7.3. If this issue persists in other installs, indicate versions of PHP / MySQL / WebServer used.
Create a custom report. See rep114.php - Sales Summary Report for example code.
The default FA install will have Price After Tax - hence add whatever tax you want in each line item of a Direct Sales Invoice Entry Form. The tax reporting is based on tax per item. That is why we have item tax. The default Sales Invoice PDF does not have the individual taxes but the total tax included as a summary line.
FrontAccounting forum → Posts by apmuthu
Powered by PunBB, supported by Informer Technologies, Inc.
Currently installed 4 official extensions. Copyright © 2003–2009 PunBB.