GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing.

GLPI

Last update: Jan 2, 2023

Related tags

Asset Management helpdesk asset-manager inventory ticketing data-center cmdb glpi itsm itil dcim assets-management hacktoberfest itam license-management impact-analysis

Overview

About GLPI

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing.

GLPI features:

Inventory of computers, peripherals, network printers and any associated components through an interface, with inventory tools such as: FusionInventory or OCS Inventory
Data Center Infrastructure Management (DCIM)
Item lifecycle management
Licenses management (ITIL compliant)
Management of warranty and financial information (purchase order, warranty and extension, damping)
Management of contracts, contacts, documents related to inventory items
Incidents, requests, problems and changes management
Knowledge base and Frequently-Asked Questions (FAQ)
Asset reservation

Moreover, GLPI supports many plugins that provide additional features.

Demonstration

Check GLPI features by asking a free personnal demonstration on glpi-network.cloud

License

It is distributed under the GNU GENERAL PUBLIC LICENSE Version 2 - please consult the file called COPYING for more details.

Some screenshots

Tickets Timeline

DCIM drag&drop

Components

Prerequisites

A web server (Apache, Nginx, IIS, etc.)
MariaDB >= 10.0 or MySQL >= 5.6
PHP 7.2 or higher
Mandatory PHP extensions:
- ctype
- curl
- gd (picture generation)
- iconv
- intl
- json
- mbstring
- mysqli
- session
- simplexml
- zlib
Recommended PHP extensions (to enable optional features)
- exif (security enhancement on images validation)
- imap (mail collector and users authentication)
- ldap (users authentication)
- openssl (encrypted communication)
- sodium (performances enhancement on sensitive data encryption/decryption)
- zip and bz2 (installation of zip and bz2 packages from marketplace)
Supported browsers:
- Edge
- Firefox (including 2 latests ESR version)
- Chrome

Please, consider using browsers on editor's supported version

Download

See :

releases for tarball packages.
Remi's RPM repository for RPM packages (Fedora, RHEL, CentOS)

Documentation

Here is a pdf version. We are working on a markdown version

Additional resources

Support

GLPI is a living software. Improvements are continuously made, new functionalities are being developed, and issues are being fixed.

To ease support and development, we need your help when encountering issues. There is a GLPI version typical lifecycle:

A new major version (9.3) is released.
Minor versions (9.3.x), fixing bugs or issues, are published after several weeks. Please consider updating to the latest realeased minor version if you encounter some bugs or performance issues.
Several months after major version realesed, a new major version (9.4) is released Previous major versions become unsupported, please update to the new major version. Obviously, we provide support for the migration tools too!

Comments

[0.90.1] Upload document not working with Internet Explorer 11

Hi,

The upload of a document not working with Internet Explorer 11.

If i configure IE in "IE 9" compatibility mode, the upload working, the document upload succefully. If i let IE in "Edge" compatibility mode the document never upload :

Same issue with IE in "IE 10" compatibility mode. The upload seems to not working with Internet Explorer version > 9.

I use Internet Explorer 11 in Windows 7 64 bits.

Thanks to solve it

++
wontfix

opened by barbuslex 95
Security die. trying to load an forbidden class name

Hello

when I go in a ticket and historical I have this message :

Security die. trying to load an forbidden class name

And nothing appears

The same when I create a new task in the ticket, if I refresh the page the task appears
wontfix

opened by satyan01 93
after update from 90.3 to 9.1 i lost network objects

hello! anyway, objects still alive: i can find it by http://prntscr.com/c565i1 and so on: http://prntscr.com/c565q0 but in networks directory targetly: http://prntscr.com/c564zy they are don't.
help wanted

opened by Zegordo 76
0.91 lock mechanism

Lock Mechanism implementation (fixes #54):

Added a new right: UNLOCK in define.php Changed back modifications on Html::convDate() as it is needed! And added a new $format=null parameter to Html::convDateTime() to allow format of datetime. Deleted a number (4204) that was in javascript block in Html::initEditorSystem() (line 3873) Added case "0.90.1" in cliupdate.php to be able to perform update to 0.91 within console Commented out a new Followup in ticket.class.php (used no where)
enhancement

opened by tomolimo 75
Latencies on GLPI

in my prod 0.85.2 I have sometimes latencies on GLPI, and it is the same thing with 0.91. Have you any idea ?

latencies at logon - in all module, never at the same time, nothing in logs, nothing on mysql, I have tried many things to improve but without success

0.85.2 - xamp - apache 2.4.13 - php 5.5 0.91 - apache 2.4.17 - php 7.02

opened by satyan01 57

10.0.3 - mysql DB errors

Code of Conduct

[X] I agree to follow this project's Code of Conduct

Is there an existing issue for this?

[X] I have searched the existing issues

Version

1.0.3

Bug description

I have a lot errors in sql-errors.log. Is anybody having an Idea how to handle this errors?

Relevant log output

> [2022-10-27 16:01:51] glpisqllog.WARNING: DBmysql::query() in /var/www/glpi/src/DBmysql.php line 404
  *** MySQL query warnings:
  SQL: SELECT `glpi_peripherals`.`id`, `glpi_networkports`.`id` AS `portid` FROM `glpi_peripherals` LEFT JOIN `glpi_networkports` ON (`glpi_peripherals`.`id` = `glpi_networkports`.`items_id` AND `glpi_networkports`.`itemtype` = 'Peripheral') WHERE (`glpi_networkports`.`mac` IN ('e0:07:1b:4e:68:10')) AND (`glpi_networkports`.`logical_number` = 'E0-07-1B-4E-68-12')
  Warnings:
1292: Truncated incorrect DOUBLE value: 'E0-07-1B-4E-68-12'
  Backtrace :
  src/DBmysqlIterator.php:110
  src/DBmysql.php:1048                               DBmysqlIterator->execute()
  src/RuleImportAsset.php:538                        DBmysql->request()
  src/Rule.php:1649                                  RuleImportAsset->findWithGlobalCriteria()
  src/Rule.php:1507                                  Rule->checkCriterias()
  src/RuleCollection.php:1591                        Rule->process()
  src/Inventory/Asset/NetworkPort.php:251            RuleCollection->processAllRules()
  src/Inventory/Asset/NetworkPort.php:514            Glpi\Inventory\Asset\NetworkPort->handleLLDPConnection()
  src/Inventory/Asset/NetworkPort.php:538            Glpi\Inventory\Asset\NetworkPort->handleConnections()
  src/Inventory/Asset/NetworkPort.php:533            Glpi\Inventory\Asset\NetworkPort->portChanged()
  src/Inventory/Asset/InventoryNetworkPort.php:610   Glpi\Inventory\Asset\NetworkPort->portCreated()
  src/Inventory/Asset/InventoryNetworkPort.php:120   Glpi\Inventory\Asset\NetworkPort->handleCreates()
  src/Inventory/Asset/NetworkPort.php:690            Glpi\Inventory\Asset\NetworkPort->handlePortsTrait()
  src/Inventory/Asset/NetworkPort.php:523            Glpi\Inventory\Asset\NetworkPort->handlePorts()
  src/Inventory/Asset/MainAsset.php:834              Glpi\Inventory\Asset\NetworkPort->handle()
  src/Inventory/Asset/MainAsset.php:754              Glpi\Inventory\Asset\MainAsset->handleAssets()
  src/Inventory/Asset/NetworkEquipment.php:221       Glpi\Inventory\Asset\MainAsset->rulepassed()
  src/RuleImportAsset.php:946                        Glpi\Inventory\Asset\NetworkEquipment->rulepassed()
  src/Rule.php:1510                                  RuleImportAsset->executeActions()
  src/RuleCollection.php:1591                        Rule->process()
  src/Inventory/Asset/MainAsset.php:554              RuleCollection->processAllRules()
  src/Inventory/Inventory.php:701                    Glpi\Inventory\Asset\MainAsset->handle()
  src/Inventory/Inventory.php:336                    Glpi\Inventory\Inventory->handleItem()
  ...inc/communicationnetworkinventory.class.php:156 Glpi\Inventory\Inventory->doInventory()
  marketplace/glpiinventory/hook.php:1096            PluginGlpiinventoryCommunicationNetworkInventory->import()
  src/Plugin.php:1523                                plugin_glpiinventory_network_inventory()
  src/Inventory/Request.php:278                      Plugin::doHookFunction()
  src/Inventory/Request.php:250                      Glpi\Inventory\Request->network()
  src/Inventory/Request.php:98                       Glpi\Inventory\Request->networkInventory()
                                                                                                                                                                                           10911,3       99%

Page URL

No response

Steps To reproduce

No response

Your GLPI setup information

Informationen über das System, die Installation und die Konfiguration

GLPI 10.0.3 ( => /var/www/glpi)
Installation mode: TARBALL
Current language:de_DE

Server

Operating system: Linux glpi 5.4.0-131-generic #147-Ubuntu SMP Fri Oct 14 17:07:22 UTC 2022 x86_64 PHP 7.4.3 apache2handler (Core, FFI, PDO, Phar, Reflection, SPL, SimpleXML, Zend OPcache, apache2handler, apc, apcu, bcmath, bz2, calendar, ctype, curl, date, dom, exif, fileinfo, filter, ftp, gd, gettext, hash, iconv, imap, intl, json, ldap, libxml, mbstring, mysqli, mysqlnd, openssl, pcre, pdo_mysql, posix, readline, session, shmop, sockets, sodium, standard, sysvmsg, sysvsem, sysvshm, tokenizer, xml, xmlreader, xmlrpc, xmlwriter, xsl, zip, zlib) Setup: max_execution_time="600" memory_limit="1024M" post_max_size="32M" safe_mode="" session.save_handler="files" upload_max_filesize="32M" Software: Apache/2.4.41 (Ubuntu) (Apache/2.4.41 (Ubuntu) Server at X.Y.lu Port 80 ) Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0 Server Software: (Ubuntu) Server Version: 8.0.31-0ubuntu0.20.04.1 Server SQL Mode: STRICT_TRANS_TABLES,NO_ZERO_IN_DATE,NO_ZERO_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_ENGINE_SUBSTITUTION Parameters: X@localhost/glpi Host info: Localhost via UNIX socket

PHP version (7.4.3) is supported. Sessions configuration is OK. Allocated memory is sufficient. mysqli extension is installed. Following extensions are installed: dom, fileinfo, json, simplexml. curl extension is installed. gd extension is installed. intl extension is installed. libxml extension is installed. zlib extension is installed. The constant SODIUM_CRYPTO_AEAD_XCHACHA20POLY1305_IETF_NPUBBYTES is present. Database engine version (8.0.31) is supported. The log file could not be created in /var/www/glpi/files/_log. Write access to /var/www/glpi/files/_cache has been validated. Write access to /var/www/glpi/config has been validated. Write access to /var/www/glpi/files/_cron has been validated. Write access to /var/www/glpi/files has been validated. Write access to /var/www/glpi/files/_dumps has been validated. Write access to /var/www/glpi/files/_graphs has been validated. Write access to /var/www/glpi/files/_lock has been validated. Write access to /var/www/glpi/files/_pictures has been validated. Write access to /var/www/glpi/files/_plugins has been validated. Write access to /var/www/glpi/files/_rss has been validated. Write access to /var/www/glpi/files/_sessions has been validated. Write access to /var/www/glpi/files/_tmp has been validated. Write access to /var/www/glpi/files/_uploads has been validated. Web access to files directory is protected PHP directive "session.cookie_httponly" should be set to "on" to prevent client-side script to access cookie values. exif extension is installed. ldap extension is installed. openssl extension is installed. zip extension is installed. bz2 extension is installed. Zend OPcache extension is installed. Following extensions are installed: ctype, iconv, mbstring, sodium. Write access to /var/www/glpi/marketplace has been validated. Timezones seems loaded in database.

GLPI constants

 
GLPI_ROOT: /var/www/glpi
GLPI_CONFIG_DIR: /var/www/glpi/config
GLPI_VAR_DIR: /var/www/glpi/files
GLPI_MARKETPLACE_DIR: /var/www/glpi/marketplace
GLPI_USE_CSRF_CHECK: 1
GLPI_CSRF_EXPIRES: 7200
GLPI_CSRF_MAX_TOKENS: 100
GLPI_USE_IDOR_CHECK: 1
GLPI_IDOR_EXPIRES: 7200
GLPI_ALLOW_IFRAME_IN_RICH_TEXT: 
GLPI_SERVERSIDE_URL_ALLOWLIST: Array
GLPI_TELEMETRY_URI: https://telemetry.glpi-project.org
GLPI_INSTALL_MODE: TARBALL
GLPI_NETWORK_MAIL: [email protected]
GLPI_NETWORK_SERVICES: https://services.glpi-network.com
GLPI_MARKETPLACE_ALLOW_OVERRIDE: 1
GLPI_MARKETPLACE_MANUAL_DOWNLOADS: 1
GLPI_USER_AGENT_EXTRA_COMMENTS: 
GLPI_DISABLE_ONLY_FULL_GROUP_BY_SQL_MODE: 1
GLPI_AJAX_DASHBOARD: 1
GLPI_CALDAV_IMPORT_STATE: 0
GLPI_DEMO_MODE: 0
GLPI_CENTRAL_WARNINGS: 1
GLPI_DOC_DIR: /var/www/glpi/files
GLPI_CACHE_DIR: /var/www/glpi/files/_cache
GLPI_CRON_DIR: /var/www/glpi/files/_cron
GLPI_DUMP_DIR: /var/www/glpi/files/_dumps
GLPI_GRAPH_DIR: /var/www/glpi/files/_graphs
GLPI_LOCAL_I18N_DIR: /var/www/glpi/files/_locales
GLPI_LOCK_DIR: /var/www/glpi/files/_lock
GLPI_LOG_DIR: /var/www/glpi/files/_log
GLPI_PICTURE_DIR: /var/www/glpi/files/_pictures
GLPI_PLUGIN_DOC_DIR: /var/www/glpi/files/_plugins
GLPI_RSS_DIR: /var/www/glpi/files/_rss
GLPI_SESSION_DIR: /var/www/glpi/files/_sessions
GLPI_TMP_DIR: /var/www/glpi/files/_tmp
GLPI_UPLOAD_DIR: /var/www/glpi/files/_uploads
GLPI_INVENTORY_DIR: /var/www/glpi/files/_inventories
GLPI_NETWORK_REGISTRATION_API_URL: https://services.glpi-network.com/api/registration/
GLPI_MARKETPLACE_PLUGINS_API_URI: https://services.glpi-network.com/api/glpi-plugins/
GLPI_I18N_DIR: /var/www/glpi/locales
GLPI_VERSION: 10.0.3
GLPI_SCHEMA_VERSION: 10.0.3@a130db99c7d9b131c2e2ea59fe0d6260fe93d831
GLPI_MARKETPLACE_PRERELEASES: 
GLPI_MIN_PHP: 7.4.0
GLPI_MAX_PHP: 8.3.0
GLPI_YEAR: 2022

Libraries

 
htmlawed/htmlawed version 1.2.9 in (/var/www/glpi/vendor/htmlawed/htmlawed)
phpmailer/phpmailer version 6.6.0 in (/var/www/glpi/vendor/phpmailer/phpmailer/src)
simplepie/simplepie version 1.5.8 in (/var/www/glpi/vendor/simplepie/simplepie/library)
tecnickcom/tcpdf version 6.5.0 in (/var/www/glpi/vendor/tecnickcom/tcpdf)
michelf/php-markdown in (/var/www/glpi/vendor/michelf/php-markdown/Michelf)
true/punycode in (/var/www/glpi/vendor/true/punycode/src)
iamcal/lib_autolink in (/var/www/glpi/vendor/iamcal/lib_autolink)
sabre/dav in (/var/www/glpi/vendor/sabre/dav/lib/DAV)
sabre/http in (/var/www/glpi/vendor/sabre/http/lib)
sabre/uri in (/var/www/glpi/vendor/sabre/uri/lib)
sabre/vobject in (/var/www/glpi/vendor/sabre/vobject/lib)
laminas/laminas-i18n in (/var/www/glpi/vendor/laminas/laminas-i18n/src)
laminas/laminas-servicemanager in (/var/www/glpi/vendor/laminas/laminas-servicemanager/src)
monolog/monolog in (/var/www/glpi/vendor/monolog/monolog/src/Monolog)
sebastian/diff in (/var/www/glpi/vendor/sebastian/diff/src)
donatj/phpuseragentparser in (/var/www/glpi/vendor/donatj/phpuseragentparser/src/UserAgent)
elvanto/litemoji in (/var/www/glpi/vendor/elvanto/litemoji/src)
symfony/console in (/var/www/glpi/vendor/symfony/console)
scssphp/scssphp in (/var/www/glpi/vendor/scssphp/scssphp/src)
laminas/laminas-mail in (/var/www/glpi/vendor/laminas/laminas-mail/src/Protocol)
laminas/laminas-mime in (/var/www/glpi/vendor/laminas/laminas-mime/src)
rlanvin/php-rrule in (/var/www/glpi/vendor/rlanvin/php-rrule/src)
blueimp/jquery-file-upload in (/var/www/glpi/vendor/blueimp/jquery-file-upload/server/php)
ramsey/uuid in (/var/www/glpi/vendor/ramsey/uuid/src)
psr/log in (/var/www/glpi/vendor/psr/log/Psr/Log)
psr/simple-cache in (/var/www/glpi/vendor/psr/simple-cache/src)
psr/cache in (/var/www/glpi/vendor/psr/cache/src)
league/csv in (/var/www/glpi/vendor/league/csv/src)
mexitek/phpcolors in (/var/www/glpi/vendor/mexitek/phpcolors/src/Mexitek/PHPColors)
guzzlehttp/guzzle in (/var/www/glpi/vendor/guzzlehttp/guzzle/src)
guzzlehttp/psr7 in (/var/www/glpi/vendor/guzzlehttp/psr7/src)
glpi-project/inventory_format in (/var/www/glpi/vendor/glpi-project/inventory_format/lib/php)
wapmorgan/unified-archive in (/var/www/glpi/vendor/wapmorgan/unified-archive/src)
paragonie/sodium_compat in (/var/www/glpi/vendor/paragonie/sodium_compat/src)
symfony/cache in (/var/www/glpi/vendor/symfony/cache)
html2text/html2text in (/var/www/glpi/vendor/html2text/html2text/src)
symfony/css-selector in (/var/www/glpi/vendor/symfony/css-selector)
symfony/dom-crawler in (/var/www/glpi/vendor/symfony/dom-crawler)
twig/twig in (/var/www/glpi/vendor/twig/twig/src)
twig/string-extra in (/var/www/glpi/vendor/twig/string-extra)
symfony/polyfill-ctype not found
symfony/polyfill-iconv not found
symfony/polyfill-mbstring not found
symfony/polyfill-php80 in (/var/www/glpi/vendor/symfony/polyfill-php80)
symfony/polyfill-php81 in (/var/www/glpi/vendor/symfony/polyfill-php81)
symfony/polyfill-php82 in (/var/www/glpi/vendor/symfony/polyfill-php82)
phpCas version 1.3.8 in (/usr/share/php/CAS/source)

LDAP directories

 
Server: 'X', Port: '389', BaseDN: 'dc=X,dc=local', Connection filter:
		'(&(objectClass=user)(objectCategory=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(memberof=cn=app_glpi,ou=groups,ou=X,dc=X,dc=local))',
		RootDN: '[email protected]', Use TLS: none

SQL replicas

 
Not active

Notifications

 
Way of sending emails: SMTP ([email protected])

Plugins list

fields Name: Additional fields Version: 1.18.2 State: Enabled Install Method: Marketplace datainjection Name: Data injection Version: 2.12.0 State: Installed / not activated Install Method: Marketplace glpiinventory Name: GLPI Inventory Version: 1.0.4 State: Enabled Install Method: Marketplace uninstall Name: Item's Lifecycle (uninstall) Version: 2.8.0 State: Enabled Install Method: Marketplace satisfaction Name: More satisfaction Version: 1.6.1 State: Error / to clean Install Method: Manual genericobject Name: Objects management Version: 2.14.0 State: Enabled Install Method: Marketplace printlabel Name: Print Label Version: 0.0.1 State: Enabled Install Method: Manual printlabelprinter Name: Print Label Printer Version: 0.0.1 State: Enabled Install Method: Manual printercounters Name: Printer counters Version: 2.0.0 State: Error / to clean Install Method: Manual

Anything else?

No response

Need feedback

opened by vollkommenIrrelevant 56

the GLPI Network registration key can not be saved and retruns a blank Page

Describe the bug The GLPI Network registration key can not be saved and stored. Clicking over the button "save" in /Home/Setup/Plugins/General/GLPI Network/Registration key, returns a blank page without displaying any error, and the content in the database of the field glpinetwork_registration_key in the table glpi_configs is empty.

Version: GLPI 9.5.5 and 9.5.6 and 9.5.7 URL: /front/config.form.php?forcetab=GLPINetwork%241

help wanted Stale

opened by edupulpillo 54
GLPI LDAP Mass Sync doesn't load thumbnails

Using GLPI 0.91 and GLPI LDAP Mass Sync. The users's thumbnails (users's pictures) are not loaded into GLPI. We must force synchronization to get them.
bug

opened by tomolimo 54
strange recurrent SQL error
Hello team, I have a strange bug with GLPI 9.1. Extract from sql-errors.log :

2016-11-09 08:51:02 [@glpi] *** MySQL query error: SQL: INSERT INTO glpi_ticketfollowups (content,tickets_id,users_id,requesttypes_id,is_private,date,date_creation,date_mod) VALUES ('Bonsoir,\nJe vous réponds pour vous donner la réponse à ma question secrète : xxxx,\nSi je me suis trompé, pourriez vous quand même envoyer l'identifiant sur la boite laposte.net ? \nVous remerciant d'avance,\nCordialement,\nA. François\n\nLe 4 novembre 2016 à 22:22, <[email protected]> a écrit :\n\n \n\n','2602','0','0',0,'2016-11-09 08:51:01','2016-11-09 08:51:01','2016-11-09 08:51:01')

As you can see, the value of the field "is_private" is not delimited by simple quotes. There is a new line in sql-erros.log every 5 minutes (this is the time-step I choosed for cron) since #4 of november.

So I have 2 or 3 questions :

why is this request malformed ? It's the only one of this sort in sql-errors.log

why is GLPI still trying to insert this request after several trials ? Isn't there a time-out for such errors ? Today, I have 1033 trials !

I have restarted Apache, and even rebooted the server, thinking of something like a cache. No way, GLPI is still trying to insert this wrong request. Where is it stored ? How can I delete this request ?

Sincerely, Valéry config_GLPI.txt
bug Need feedback
opened by vrocheUP 53
Add kanban view to projects
| Q | A | ------------- | --- | Bug fix? | no | New feature? | yes | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | -

Add Kanban view for projects.

Related: Note on GitHub roadmap UserEcho Request

[x] Display card counts per board (Needs to dynamically update when dragging or adding items)

[x] Add items from Kanban

[x] Show user/team badges on cards

[x] Add type, milestone, and progress to card content

[x] Global Kanban view

[x] Collapsible boards

[x] Plugin hooks for adding content to cards before and after the main content (Specifically thinking about the Tags plugin).

enhancement
opened by cconard96 52
[9.1RC2][0.90][0.85]Bug with "<" in ticket description

When creating a ticket ( helpdesk, collector) with description : "le temps de réponse passe de < 1ms à < 200ms" it is ok but when no spaces between < and next caracter then description is truncated : "le temps de réponse passe de <1ms à <200ms" ->bug

ver 0.85.4 or On line 0.90 DEMO ->bug in 0.83.8 it seems ok
bug

opened by ladenree76000 46
build(deps-dev): bump mini-css-extract-plugin from 2.7.1 to 2.7.2
Bumps mini-css-extract-plugin from 2.7.1 to 2.7.2.

Release notes

Sourced from mini-css-extract-plugin's releases.

v2.7.2

2.7.2 (2022-12-06)

Bug Fixes

don't crash in web workers (#1004) (4d98d4b)

Changelog

Sourced from mini-css-extract-plugin's changelog.

2.7.2 (2022-12-06)

Bug Fixes

don't crash in web workers (#1004) (4d98d4b)

Commits

b616093 chore(release): 2.7.2

4d98d4b fix: don't crash in web workers (#1004)

5ef989b chore(deps): bump minimist from 1.2.5 to 1.2.6 (#928)

cd7d933 chore(deps): bump loader-utils from 2.0.3 to 2.0.4 (#993)

9178a0c chore: update dependencies to the latest version (#1003)

See full diff in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies javascript
opened by dependabot[bot] 0
build(deps-dev): bump eslint from 8.28.0 to 8.31.0
Bumps eslint from 8.28.0 to 8.31.0.

Release notes

Sourced from eslint's releases.

v8.31.0

Features

52c7c73 feat: check assignment patterns in no-underscore-dangle (#16693) (Milos Djermanovic)

b401cde feat: add options to check destructuring in no-underscore-dangle (#16006) (Morten Kaltoft)

30d0daf feat: group properties with values in parentheses in key-spacing (#16677) (Francesco Trotta)

Bug Fixes

35439f1 fix: correct syntax error in prefer-arrow-callback autofix (#16722) (Francesco Trotta)

87b2470 fix: new instance of FlatESLint should load latest config file version (#16608) (Milos Djermanovic)

Documentation

4339dc4 docs: Update README (GitHub Actions Bot)

4e4049c docs: optimize code block structure (#16669) (Sam Chen)

54a7ade docs: do not escape code blocks of formatters examples (#16719) (Sam Chen)

e5ecfef docs: Add function call example for no-undefined (#16712) (Elliot Huffman)

a3262f0 docs: Add mastodon link (#16638) (Amaresh S M)

a14ccf9 docs: clarify files property (#16709) (Sam Chen)

3b29eb1 docs: fix npm link (#16710) (Abdullah Osama)

a638673 docs: fix search bar focus on Esc (#16700) (Shanmughapriyan S)

f62b722 docs: country flag missing in windows (#16698) (Shanmughapriyan S)

4d27ec6 docs: display zh-hans in the docs language switcher (#16686) (Percy Ma)

8bda20e docs: remove manually maintained anchors (#16685) (Percy Ma)

b68440f docs: User Guide Getting Started expansion (#16596) (Ben Perlmutter)

Chores

65d4e24 chore: Upgrade @eslint/eslintrc@1.4.1 (#16729) (Brandon Mills)

8d93081 chore: fix CI failure (#16721) (Sam Chen)

8f17247 chore: Set up automatic updating of README (#16717) (Nicholas C. Zakas)

4cd87cb ci: bump actions/stale from 6 to 7 (#16713) (dependabot[bot])

fd20c75 chore: sort package.json scripts in alphabetical order (#16705) (Darius Dzien)

10a5c78 chore: update ignore patterns in eslint.config.js (#16678) (Milos Djermanovic)

v8.30.0

Features

075ef2c feat: add suggestion for no-return-await (#16637) (Daniel Bartholomae)

7190d98 feat: update globals (#16654) (Sébastien Règne)

Bug Fixes

1a327aa fix: Ensure flat config unignores work consistently like eslintrc (#16579) (Nicholas C. Zakas)

9b8bb72 fix: autofix recursive functions in no-var (#16611) (Milos Djermanovic)

Documentation

6a8cd94 docs: Clarify Discord info in issue template config (#16663) (Nicholas C. Zakas)

ad44344 docs: CLI documentation standardization (#16563) (Ben Perlmutter)

293573e docs: fix broken line numbers (#16606) (Sam Chen)

fa2c64b docs: use relative links for internal links (#16631) (Percy Ma)

75276c9 docs: reorder options in no-unused-vars (#16625) (Milos Djermanovic)

7276fe5 docs: Fix anchor in URL (#16628) (Karl Horky)

6bef135 docs: don't apply layouts to html formatter example (#16591) (Tanuj Kanti)

dfc7ec1 docs: Formatters page updates (#16566) (Ben Perlmutter)

... (truncated)

Changelog

Sourced from eslint's changelog.

v8.31.0 - December 31, 2022

65d4e24 chore: Upgrade @eslint/eslintrc@1.4.1 (#16729) (Brandon Mills)

35439f1 fix: correct syntax error in prefer-arrow-callback autofix (#16722) (Francesco Trotta)

87b2470 fix: new instance of FlatESLint should load latest config file version (#16608) (Milos Djermanovic)

8d93081 chore: fix CI failure (#16721) (Sam Chen)

4339dc4 docs: Update README (GitHub Actions Bot)

8f17247 chore: Set up automatic updating of README (#16717) (Nicholas C. Zakas)

4e4049c docs: optimize code block structure (#16669) (Sam Chen)

54a7ade docs: do not escape code blocks of formatters examples (#16719) (Sam Chen)

52c7c73 feat: check assignment patterns in no-underscore-dangle (#16693) (Milos Djermanovic)

e5ecfef docs: Add function call example for no-undefined (#16712) (Elliot Huffman)

a3262f0 docs: Add mastodon link (#16638) (Amaresh S M)

4cd87cb ci: bump actions/stale from 6 to 7 (#16713) (dependabot[bot])

a14ccf9 docs: clarify files property (#16709) (Sam Chen)

3b29eb1 docs: fix npm link (#16710) (Abdullah Osama)

fd20c75 chore: sort package.json scripts in alphabetical order (#16705) (Darius Dzien)

a638673 docs: fix search bar focus on Esc (#16700) (Shanmughapriyan S)

f62b722 docs: country flag missing in windows (#16698) (Shanmughapriyan S)

4d27ec6 docs: display zh-hans in the docs language switcher (#16686) (Percy Ma)

8bda20e docs: remove manually maintained anchors (#16685) (Percy Ma)

b401cde feat: add options to check destructuring in no-underscore-dangle (#16006) (Morten Kaltoft)

b68440f docs: User Guide Getting Started expansion (#16596) (Ben Perlmutter)

30d0daf feat: group properties with values in parentheses in key-spacing (#16677) (Francesco Trotta)

10a5c78 chore: update ignore patterns in eslint.config.js (#16678) (Milos Djermanovic)

v8.30.0 - December 16, 2022

f2c4737 chore: upgrade @eslint/eslintrc@1.4.0 (#16675) (Milos Djermanovic)

1a327aa fix: Ensure flat config unignores work consistently like eslintrc (#16579) (Nicholas C. Zakas)

075ef2c feat: add suggestion for no-return-await (#16637) (Daniel Bartholomae)

ba74253 chore: standardize npm script names per #14827 (#16315) (Patrick McElhaney)

6a8cd94 docs: Clarify Discord info in issue template config (#16663) (Nicholas C. Zakas)

0d9af4c ci: fix npm v9 problem with file: (#16664) (Milos Djermanovic)

7190d98 feat: update globals (#16654) (Sébastien Règne)

ad44344 docs: CLI documentation standardization (#16563) (Ben Perlmutter)

90c9219 refactor: migrate off deprecated function-style rules in all tests (#16618) (Bryan Mishkin)

9b8bb72 fix: autofix recursive functions in no-var (#16611) (Milos Djermanovic)

293573e docs: fix broken line numbers (#16606) (Sam Chen)

fa2c64b docs: use relative links for internal links (#16631) (Percy Ma)

75276c9 docs: reorder options in no-unused-vars (#16625) (Milos Djermanovic)

7276fe5 docs: Fix anchor in URL (#16628) (Karl Horky)

6bef135 docs: don't apply layouts to html formatter example (#16591) (Tanuj Kanti)

dfc7ec1 docs: Formatters page updates (#16566) (Ben Perlmutter)

8ba124c docs: update the prefer-const example (#16607) (Pavel)

e6cb05a docs: fix css leaking (#16603) (Sam Chen)

v8.29.0 - December 2, 2022

0311d81 docs: Configuring Plugins page intro, page tweaks, and rename (#16534) (Ben Perlmutter)

... (truncated)

Commits

d9a39c7 8.31.0

5d182ce Build: changelog update for 8.31.0

65d4e24 chore: Upgrade @eslint/eslintrc@1.4.1 (#16729)

35439f1 fix: correct syntax error in prefer-arrow-callback autofix (#16722)

87b2470 fix: new instance of FlatESLint should load latest config file version (#16608)

8d93081 chore: fix CI failure (#16721)

4339dc4 docs: Update README

8f17247 chore: Set up automatic updating of README (#16717)

4e4049c docs: optimize code block structure (#16669)

54a7ade docs: do not escape code blocks of formatters examples (#16719)

Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies javascript
opened by dependabot[bot] 0
build(deps): bump @fullcalendar/resource-timeline from 4.4.2 to 5.11.3
Bumps @fullcalendar/resource-timeline from 4.4.2 to 5.11.3.

Release notes

Sourced from @fullcalendar/resource-timeline's releases.

v5.11.3

No release notes provided.

v5.11.2

No release notes provided.

v5.11.0

No release notes provided.

v5.10.2

No release notes provided.

v5.10.1

No release notes provided.

v5.10.0

No release notes provided.

v5.9.0

No release notes provided.

v5.8.0

No release notes provided.

v5.7.2

No release notes provided.

v5.7.0

No release notes provided.

v5.6.0

No release notes provided.

v5.5.1

No release notes provided.

v5.5.0

No release notes provided.

v5.4.0

No release notes provided.

v5.3.2

No release notes provided.

v5.3.1

No release notes provided.

v5.3.0

No release notes provided.

... (truncated)

Commits

See full diff in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies javascript
opened by dependabot[bot] 0
build(deps): bump gridstack from 7.1.1 to 7.1.2
Bumps gridstack from 7.1.1 to 7.1.2.

Release notes

Sourced from gridstack's releases.

v7.1.2

fix #939 'prototype' undefined error for dd-gridstack.js

add #939 disable/enable are methods now recursive by default

add better GridStackEventHandlerCallback spelled out types

add We now have support for Angular Component wrappers out of the box included in the build, with docs and demo! Need help to do that for React and Vue.

Changelog

Sourced from gridstack's changelog.

7.1.2 (2022-12-29)

fix #939 'prototype' undefined error for dd-gridstack.js

add #939 disable/enable are methods now recursive by default

add better GridStackEventHandlerCallback spelled out types

add We now have support for Angular Component wrappers out of the box included in the build, with docs and demo! Need help to do that for React and Vue.

Commits

5dc62fe Merge pull request #2132 from adumesny/master

497a1fc rev 7.1.2

744f707 Merge pull request #2131 from adumesny/master

c0693e2 addWidget() & load() fix for existing element

6afb383 Merge pull request #2130 from adumesny/master

0da2115 Complete Angular wrapper

8f0b663 Merge pull request #2129 from adumesny/master

be886c8 Angular component examples

e4096bf better GridStackEventHandlerCallback types (#2128)

89b8484 better GridStackEventHandlerCallback types

Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies javascript
opened by dependabot[bot] 0
build(deps-dev): bump css-loader from 6.7.2 to 6.7.3
Bumps css-loader from 6.7.2 to 6.7.3.

Release notes

Sourced from css-loader's releases.

v6.7.3

6.7.3 (2022-12-14)

Bug Fixes

remove sourceURL from emitted CSS (#1487) (962924c)

Changelog

Sourced from css-loader's changelog.

6.7.3 (2022-12-14)

Bug Fixes

remove sourceURL from emitted CSS (#1487) (962924c)

Commits

ef749f2 chore(release): 6.7.3

36fb945 chore: fix cspell

962924c fix: remove sourceURL from emitted CSS (#1487)

3f3f302 chore(deps): bump decode-uri-component from 0.2.0 to 0.2.2 (#1486)

04ca713 chore: update dependencies to the latest version (#1485)

9449827 chore: update styfle/cancel-workflow-action (#1484)

6c67af8 chore: add cSpell to check spelling issues (#1482)

239b9ac chore(deps): bump loader-utils from 2.0.3 to 2.0.4 (#1481)

See full diff in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies javascript
opened by dependabot[bot] 0
build(deps): bump tinymce-i18n from 22.10.18 to 22.12.27
Bumps tinymce-i18n from 22.10.18 to 22.12.27.

Release notes

Sourced from tinymce-i18n's releases.

22.12.27

What's Changed

Fix #11: Put js-beautify package in dev dependency by @jmagano-ena in mklkj/tinymce-i18n#12

Update langs 2022-12-27 by @github-actions in mklkj/tinymce-i18n#13

New Contributors

@jmagano-ena made their first contribution in mklkj/tinymce-i18n#7

Full Changelog: https://github.com/mklkj/tinymce-i18n/compare/06aee1ffebaffd4d26a927838eb7a2ecd5bee9c0..22.12.27

Commits

See full diff in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies javascript
opened by dependabot[bot] 0

Releases(10.0.5)

10.0.5(Nov 4, 2022)
Following the last releases of 10.0.4 and 9.5.10, an annoying issue has been detected in one of the security fixes provided. The user is logged out when he tries to switch to another entity.

So, we release new versions to address the bug, you can download them on github:

GLPI 10.0.5 archive

GLPI 9.5.11 archive

Source code(tar.gz)
Source code(zip)
glpi-10.0.5.tgz(54.49 MB)
9.5.11(Nov 4, 2022)
Following the last releases of 10.0.4 and 9.5.10, an annoying issue has been detected in one of the security fixes provided. The user is logged out when he tries to switch to another entity.

So, we release new versions to address the bug, you can download them on github:

GLPI 10.0.5 archive

GLPI 9.5.11 archive

Source code(tar.gz)
Source code(zip)
glpi-9.5.11.tgz(42.76 MB)
10.0.4(Nov 3, 2022)
This is a security release, upgrading is recommended

This release fixes several security issues that has been recently discovered. Update is recommended!

You can download the GLPI 10.0.4 archive on GitHub. We also provide a security release for 9.5 branch: GLPI 9.5.10 archive.

You will find below the list of security issues fixed in this bugfixes version:

[SECURITY - Low] Blind SSRF in RSS feeds and planning (CVE-2022-39276)

[SECURITY - Low] Stored XSS in user information (CVE-2022-39372)

[SECURITY - Low] Stored XSS in entity name (CVE-2022-39373)

[SECURITY - Low] Improper input validation on emails links (CVE-2022-39376)

[SECURITY - Moderate] Improper access to debug panel (CVE-2022-39370)

[SECURITY - Moderate] User's session persist after permanently deleting his account (CVE-2022-39234)

[SECURITY - Moderate] Stored XSS on login page (CVE-2022-39262)

[SECURITY - Moderate] XSS in external links (CVE-2022-39277)

[SECURITY - Moderate] XSS through public RSS feed (CVE-2022-39375)

[SECURITY - High] SQL Injection on REST API (CVE-2022-39323)

[SECURITY - High] Stored XSS through asset inventory (CVE-2022-39371)

Also, here is a short list of main changes done in this version:

[FIX] Increase significantly dashboards performance

[FIX] Several bugs on images pasting

[FIX] Fixed and improved inventory locks management

[FIX] Display of printer cartridges

[FIX] Display and hide actors tooltips in tickets

[FIX] Improve display of headers above forms

[FIX] Move breakpoints on responsive displays

[SECURITY] Inventory API is now disabled by default

[FEATURE] Dedicated rights has been added for inventory

The full changelog is available for more details.

We would like to thank all people who contributed to this new version and all those who contributes regularly to the GLPI project!

Regards.
Source code(tar.gz)
Source code(zip)
glpi-10.0.4.tgz(54.45 MB)
9.5.10(Nov 3, 2022)
This is a security release, upgrading is recommended

This release fixes several security issues that has been recently discovered. Update is recommended!

You will find below the list of security issues fixed in this bugfixes version:

[SECURITY - Low] Blind SSRF in RSS feeds and planning (CVE-2022-39276)

[SECURITY - Low] Stored XSS in user information (CVE-2022-39372)

[SECURITY - Low] Improper input validation on emails links (CVE-2022-39376)

[SECURITY - Moderate] Improper access to debug panel (CVE-2022-39370)

[SECURITY - Moderate] User's session persist after permanently deleting his account (CVE-2022-39234)

[SECURITY - Moderate] Stored XSS on login page (CVE-2022-39262)

[SECURITY - Moderate] XSS in external links (CVE-2022-39277)

[SECURITY - Moderate] XSS through public RSS feed (CVE-2022-39375)

[SECURITY - High] SQL Injection on REST API (CVE-2022-39323)

Regards.
Source code(tar.gz)
Source code(zip)
glpi-9.5.10.tgz(42.76 MB)
10.0.3(Sep 14, 2022)
This is a security release, upgrading is recommended

This release fixes several critical security issues that has been recently discovered. Update is strongly recommended!

You can download the GLPI 10.0.3 archive on GitHub. Exceptionally, as we have critical security issues that affects GLPI 9.5, we also release a GLPI 9.5.9 archive.

You will find below the list of security issues fixed in this bugfixes version:

[SECURITY] XSS through registration API (CVE-2022-35945)

[SECURITY] Leak of sensitive information through login page error (CVE-2022-31143)

[SECURITY] Stored XSS through global search (CVE-2022-31187)

[SECURITY] [critical] Command injection using a third-party library script (CVE-2022-35914)

[SECURITY] SQL injection through plugin controller (CVE-2022-35946)

[SECURITY] [critical] Authentication via SQL injection (CVE-2022-35947)

[SECURITY] Blind Server-Side Request Forgery (SSRF) in RSS feeds and planning (CVE-2022-36112)

Also, here is a short list of main changes done in this version:

[FEATURE] More precise rights checks on inventory (#12610)

[FEATURE] Display of last inventoried value for locked fields (#12602)

[FEATURE] Permit to use rules to add computers as virtual machines (#12572)

[SECURITY] Delegate session cookies security to sysadmin (#12302)

[FIX] Prevent collector failure on invalid mail header (#12232)

[FIX] Many fixes on network inventory

The full changelog is available for more details.

We would like to thank all people who contributed to this new version and all those who contributes regularly to the GLPI project!

Regards.
Source code(tar.gz)
Source code(zip)
glpi-10.0.3.tgz(56.35 MB)
9.5.9(Sep 14, 2022)
This is a security release, upgrading is recommended

This release fixes several critical security issues that has been recently discovered. Update is strongly recommended!

You will find below the list of security issues fixed in this bugfixes version:

[SECURITY] XSS through registration API (CVE-2022-35945)

[SECURITY] Leak of sensitive information through login page error (CVE-2022-31143)

[SECURITY] [critical] Command injection using a third-party library script (CVE-2022-35914)

[SECURITY] SQL injection through plugin controller (CVE-2022-35946)

[SECURITY] [critical] Authentication via SQL injection (CVE-2022-35947)

[SECURITY] Blind Server-Side Request Forgery (SSRF) in RSS feeds and planning (CVE-2022-36112)

Regards.
Source code(tar.gz)
Source code(zip)
glpi-9.5.9.tgz(42.61 MB)
10.0.2(Jun 28, 2022)
This is a security release, upgrading is recommended

A lot of issues have been fixed since GLPI 10.0.1 version. Below, you'll find a short list of key points of this release:

[SECURITY] Unauthenticated SQL injection on login page (CVE-2022-31061)

[SECURITY] SQL injection on actor part in assistance forms (CVE-2022-31056)

[SECURITY] Unauthenticated Sensitive Data Exposure on Refused Inventory Files (CVE-2022-31068)

FIX adding actors to ITIL Objects (#11796, #11957)

FIX unwanted "promote to ticket" feature on self-service interface (#11834)

FIX native inventory do not inject switch information (#11864)

FIX entity for software creation (#11887, #11837)

FEAT permits global lock on entity (#11853)

The full changelog is available for more details.

We would like to thank all people who contributed to this new version and all those who contribute regularly to the GLPI project!
Source code(tar.gz)
Source code(zip)
glpi-10.0.2.tgz(57.68 MB)
9.5.8(Jun 28, 2022)
This is a security release, upgrading is recommended

Non exhaustive list of changes:

[SECURITY] SQL injection on login page [CVE-2022-31061]

[SECURITY] XSS / open redirect via SVG file upload [CVE-2022-24868]

[SECURITY] Cross Site CSS Injection [CVE-2022-24869]

and more!

See changelog for details.
Source code(tar.gz)
Source code(zip)
glpi-9.5.8.tgz(44.24 MB)
10.0.1(Jun 2, 2022)
This is a security release, upgrading is recommended

Here is the first bugfixes release for GLPI 10.

A lot of issues have been fixed since the first GLPI 10 version. Below, you'll find a short list of key points of this release:

several fixes on inventory rules

several fixes for reservation feature

Fix status change in assistance objects when modifying actors

fix preselection as requester in assistance object

Add global locks management for inventory

Re-implementation of the document addition action in assistance object

impersonate feature now displays hints if unavailable

updates with GLPI console can now check integrity of the database

The gantt feature has been moved to a plugin

The GLPI licence has been moved to GPLv3+

The full changelog is available for more details.

We would like to thank all people who contributed to this new version and all those who contribute regularly to the GLPI project!
Source code(tar.gz)
Source code(zip)
glpi-10.0.1.tgz(57.50 MB)
10.0.0(Apr 20, 2022)
GLPI 10.0.0

We are happy to announce the new major release of GLPI 🥳 In a few words:

New Modern interface with Bootstrap + tabler.io + Twig

Redesign of Helpdesk objects

Native automatic inventory

and more...

Features

(Click to expand / see details)

New interface

Modern interface by Bootstrap and Tabler

Redesign of the timeline of ITIL objects

Two new menu display modes: vertical on the left / horizontal at the top

"Go to..." button

Enhanced Dark Mode

Add photos / images for CMDB objects

Saved searches: the list is displayed on the left of the search results

Saved search: possibility to anchor the list so it does not disappear

Saved search: the list is adapted to the browsing context

Possibility to completely hide the search criteria block

Dynamic refresh (AJAX) of search results

Possibility to classify / sort the results of several columns at the same time

The titles of the columns of the results remain displayed even if you scroll down the page

Option to choose the timeline direction: natural (last followed at bottom) or inverted (last followed at top)

Improve browser tab names: now starting with Itemtype and Item ID

Browse items by category tree (when this field exists)

Add emoticon picker on rich text editor

Assistance

Kanban view for ITIL objects

Linking contracts and tickets

Add ability to mention users in ITIL objects

Management of "pending status" reasons

"Pending status" reasons: option to automatically reissue a ticket

"Pending status" reasons: option to automatically close a ticket after X reminders

Management of recurring changes

New: search criteria "Myself" (assigned to technician - myself)

Expanded text for validations

Option to anonymize technicians / groups in the simplified interface

Observers can now add a follow-up (new right)

New massive action to link multiple tickets to a problem

Business rules: action to add a task (from a template)

Business rules: action to assign an “Application”

Business rules: action to modify the global validation status

Business rules: “Validation” criteria

Add emoticon picker on rich text editor

Add task promotion to ticket

Business rules: add Writer to RuleTicket Criteria

Highlight TTO/TTR only when exceeded

Make SolutionTemplate translatable

Remove global_validation field from ITIL forms

Knowledge base: several categories per article, target self-service users

Inventory / CMDB

Native dynamic inventory (retrieving data from inventory agents)

Support for partial inventories (an agent can send part of the inventory to GLPI)

New objects supported by dynamic inventory (examples: telephones, applications, racks, etc.)

Overhaul of import rules and equipment binding

Improved management of rejected equipment

Possibility of remaking import of refused equipment

Automatic action to purge refused equipment

Automatic action to purge inventory files

Possibility to add PCI / USB vendors (dropdown)

Adding database inventory

Add device "Camera"

Automatic action to remove software versions without installation

Automatic action to remove software without versions

Possibility to add manual links (in addition to external links)

Add PassiveDCEquipment to global search types

Add four columns to computers list "Number of [Monitor/Periph/Printer/Phone]"

Add problems to impact "status" badge

Add Color for Expiration Date field for domains & certificates

Supplier and contact: add administrative number

Inventory Agent

New inventory agent "GLPI Agent"

Remote inventory without agent installation: WinRM (windows), SSH (Linux/Unix)

Local administration interface to the agent (tools / toolbox)

New plugins “proxy”, “ssl”, “inventory-collector”

New communication protocol in JSON format supporting partial inventory

Soon, management of remote inventory tasks, including for ESX polls

Improved Windows support including MSI packages

Native support for MacOSX Big Sur and the new Apple Silicon M1 chip

Various

Add vars in templates

Possibility to modify the criteria of a saved search

Support for authentication with CERT / KEY file for LDAPS

Option to set the timeout for LDAP authentications

Report of the same modifications on the status.php page

Redesign of the Gantt view on Projects

Redesign of the “Tools> Reservations” view

New button to empty user's synchronization field

Button to copy the search results (“Name” column only) to the clipboard

Massive actions now are on the old plugins´ page

Possibility to export the results of "History" tab in CSV format

Improve requirements checks

Make rules sortable by drag&drop

Display avatars in user list

Ability to run massive actions from API

Possibility to choose entity / profile from the URL (force_entity, force_profile)

LDAP User Restoration Process

Added changelog icon if plugin declares any (xml:changelog_url)

Added rule action to skip remaining rules

Add ability to define From and No-Reply addresses in entity config

Ability to disable central warning with define variable GLPI_CENTRAL_WARNINGS

Add filters for Kanban

Drop autocomplete feature on "name" fields

Console

Added commands for utf8mb4 migration:

bin/console glpi:migration:dynamic_row_format convert database tables to "Dynamic" row format (required for "utf8mb4" character support)

bin/console glpi:migration:utf8mb4 convert database character set from "utf8" to "utf8mb4"

Added command to migrate "signed" INT keys to "unsigned" INT:

bin/console glpi:migration:unsigned_keys

Improvement of the system:status command in the CLI console to:

filter services to monitor (see list_services command)

configure the return format (plain-text format / json)

Added list_services command:

bin/console glpi:system:list_services list system services (for status command)

Added marketplace command in CLI console:

bin/console marketplace:download download plugin from the GLPI marketplace

bin/console marketplace:info get information about a plugin

bin/console marketplace:search search GLPI marketplace

Added Database Plugin Migration Script:

bin/console glpi:migration:databases_plugin_to_core

Added cache commands:

bin/console glpi:cache:clear clear GLPI cache (rename from glpi:system:clear_cache)

bin/console glpi:cache:configure define cache configuration

bin/console glpi:cache:debug debug GLPI cache

bin/console glpi:cache:set_namespace_prefix define cache namespace prefix

Added glpi:tools:check_database_* commands:

bin/console glpi:tools:check_database_keys check database for missing and errounous keys

bin/console glpi:tools:check_database_schema_consistency check database schema consistency

Added cleansoftware command:

bin/console glpi:assets:cleansoftware remove software versions with no installation and software with no version

Framework

Removed support for PHP versions lower than 7.3

Removed support for MySQL version lower than 5.7

Removed support for MariaDB version lower than 10.2

Use utf8mb4 MySQL character set

Use unsigned INT keys

PHP 8.1 compatibility

PHP PSR-4 autoload

PHP PSR-12

Add hook for custom debug tabs (debug_tabs)

Force usage of node v16 and npm v8

Usage of XML-RPC API is deprecated

Add getWebDir to twig "Plugin" extension

Debug mode: expose SQL warnings

Support 'multiple' option for item dropdowns

Add a new hook filter_actors

Add timeline hook for plugins (show_in_timeline, timeline_actions, timeline_answer_actions)

Hook constants / Hooks Manager classes

Replace TCPDF by mPDF

See full changelog for detail.
Source code(tar.gz)
Source code(zip)
glpi-10.0.0.tgz(84.67 MB)
10.0.0-rc3(Mar 22, 2022)
GLPI 10.0.0-rc3

Major features:

New Modern interface with Bootstrap + tabler.io + Twig

Redesign of the timeline of Helpdesk objects

Native automatic inventory

Refresh of GANTT and reservations view

Kanban in helpdesk list

See changelog for detail.

Many things has changed since the release of GLPI 10.0.0-rc2, including:

begin to work on PHP 8.2 support (#10975)

issues on network ports metrics (#10987)

agent should be linked to computers only (#10819)

rework inventory logs (#10997, #11020)

fix IPNetwork inventory (#10983)

fix predefined fields in selfservice (#10886)

permits to reach actors loading from template when opening new ticket (#10950 )

and many more!

See rc2 to rc3 changelog for detail.
Source code(tar.gz)
Source code(zip)
glpi-10.0.0-rc3.tgz(84.33 MB)
10.0.0-rc2(Mar 2, 2022)

See rc1 to rc2 changelog for detail.
Source code(tar.gz)
Source code(zip)
glpi-10.0.0-rc2.tgz(83.27 MB)
10.0.0-rc1(Feb 3, 2022)

See beta to rc1 changelog for detail.
Source code(tar.gz)
Source code(zip)
glpi-10.0.0-rc1.tgz(83.44 MB)
9.5.7(Jan 27, 2022)
This is a security release, upgrading is recommended

Non exhaustive list of changes:

[SECURITY] SQL injection using custom CSS administration form [CVE-2022-21720]

[SECURITY] Reflected XSS using reload button [CVE-2022-21719]

FIX missing mail headers in mail collector rules engine (#10337)

FIX infinite loop when collecting mail attachments with the same name (#9667)

FIX zero height images in mail collector (#10109)

FIX duplicate ranking when rules are ordered (#9888)

FIX anonymous ticket creation (#10320)

FIX project cloning (#9964)

and more!

See changelog for details.
Source code(tar.gz)
Source code(zip)
glpi-9.5.7.tgz(43.97 MB)
10.0.0-beta(Dec 15, 2021)
Major features:

New Modern interface with Bootstrap + tabler.io + Twig

Redesign of the timeline of Helpdesk objects

Native automatic inventory

Refresh of GANTT and reservations view

Kanban in helpdesk list

See changelog for detail
Source code(tar.gz)
Source code(zip)
glpi-10.0.0-beta.tgz(83.08 MB)
9.5.6(Sep 15, 2021)
This is a security release, upgrading is recommended

Non exhaustive list of changes:

[SECURITY] Disclosure of GLPI and server informations in telemetry endpoint [CVE-2021-39211]

[SECURITY] Autologin cookie accessible by scripts [CVE-2021-39210]

[SECURITY] Bypassable CSRF protection on ajax endpoints [CVE-2021-39209]

[SECURITY] Bypassable IP restriction on GLPI API using custom header injection [CVE-2021-39213]

FIX Mailgate "Missing type for Ticket template" warning

FIX Display of images in tickets from collected mails

FIX Encoding issue with emails in GB2312 containing special characters

FIX Emails rules not working after upgrading to 9.5.5

FIX Incorrect KPIs Dashboards compared to the GLPI filter

FIX marking LDAP user as deleted after a failed password

FIX Prevent usage of date filters on full LDAP sync

and more!

See changelog for details.
Source code(tar.gz)
Source code(zip)
glpi-9.5.6.tgz(43.82 MB)
9.5.5(Apr 13, 2021)
This is a security release, upgrading is recommended

Non exhaustive list of changes:

[security] Stored XSS in plugins information (CVE-2021-3486)

fix entity creation

removal of raw html in massive actions list

fix issue with date_creation fields updated with older instances of MySQL servers

fix wrong count of software counts in assets

Fix Core API errors on deprecation checks

and more!

See changelog for details.
Source code(tar.gz)
Source code(zip)
glpi-9.5.5.tgz(43.55 MB)
9.5.4(Mar 2, 2021)
This is a security release, upgrading is recommended

Note: those are medium security issues. Some are present since a long time (version 0.68), but this time none of these issues were considered as high/critical.

Non exhaustive list of changes:

[security] Horizontal Privilege Escalation (CVE-2021-21326)

[security] entities switch IDOR (CVE-2021-21255)

[security] XSS injection in ajax/kanban (CVE-2021-21258)

[security] XSS injection on ticket update (CVE-2021-21314)

[security] Stored XSS on documents (CVE-2021-21312)

[security] XSS on tabs (CVE-2021-21313)

[security] Stored XSS in budget type (CVE-2021-21325)

[security] Unsafe Reflection in getItemForItemtype() (CVE-2021-21327)

[security] Insecure Direct Object Reference (IDOR) on "Solutions" (CVE-2021-21324)

Handle RFC5987 format in Content-Disposition header

Fix email attachement decoding logic

Fix tickets ID fetching from email headers

Fix graph counts

Add search filter criteria for widget by year

New filter ‘my groups’

Populate meta criteria in a generic way

Make custom css from entity inheritables

and more!

See changelog for details.
Source code(tar.gz)
Source code(zip)
glpi-9.5.4.tgz(43.62 MB)
9.5.3(Nov 25, 2020)
This is a security release, upgrading is recommended

Note: those are medium security issues.

Non exhaustive list of changes:

[security] Insecure Direct Object Reference on ajax/comments.php and ajax/getDropdownValue.php (CVE-2020-27662 and CVE-2020-27663)

[security] Any CalDAV calendars is read-only for every authenticated user (CVE-2020-26212)

several dashboards issues

several fixes and enhancements with mail collector

new dashboard filters on tech users and tech groups

PHP8 compatibility

and more!

See changelog for details.
Source code(tar.gz)
Source code(zip)
glpi-9.5.3.tgz(41.72 MB)
9.5.2(Oct 7, 2020)
This is a security release, upgrading is highly recommended

Note: some of fixed vulnerabilities are present since a long time (0.68).

Non exhaustive list of changes:

[security] SQL injection with a query parameter of user form (CVE-2020-15176)

[security] Removal of .htaccess file in the files folder via a plugin endpoint (CVE-2020-15175)

[security] Leakage issue with knowledge base (CVE-2020-15217)

[security] Stored XSS in install script (CVE-2020-15177)

[security] Minor SQL Injection in Search API (CVE-2020-15226)

several mailgate issues

several dashboards issues

dashboards improvements: personnal filters, new summary and articles widgets, ...

and more!

See changelog for details.
Source code(tar.gz)
Source code(zip)
glpi-9.5.2.tgz(41.52 MB)
9.5.1(Jul 16, 2020)
This is a security release, upgrading is highly recommended

Non exhaustive list of changes:

(security) SQL injection on new clone feature

alignment of some table columns

added domains in global search and Assets > global

fixed several problems with email retrieval via email collectors

fixed several display problems in the planning

correction (and error display) of marketplace registration key input

and more!

See changelog for details.
Source code(tar.gz)
Source code(zip)
glpi-9.5.1.tgz(41.17 MB)
9.5.0(Jul 7, 2020)
Official announcement / Annonce officielle / Anuncio oficial

Major features:

Marketplace,

Impact and relationship management,

Dashboards,

Follow-up templates,

Kanban for projects,

Timezones,

Impersonate,

Password security policy,

and more!

See changelog for details.
Source code(tar.gz)
Source code(zip)
glpi-9.5.0.tgz(41.15 MB)
9.5.0-rc2(Jun 26, 2020)
Second look at GLPI 9.5

Following the publishing of the Release Candidate of GLPI version 9.5 15 days ago, you have reported a number of small issues that have been fixed, including:

Planning display was broken,

The warning about missing dependencies during installation or update was absent,

Inability to register to access the marketplace,

Missing translations,

and others

Today, we are releasing new RC version for you to test the improvements.

Unless a major problem is detected, the next version will be the final stable release.

How can you help us ?

Download the rc archive, test the migration and the new features (you may also test the existing ones) and report us the issues you encounter on the bug tracker (tag it as [RC feedback]).

Translators, please, add missing sentences for your language on transifex.
Source code(tar.gz)
Source code(zip)
glpi-9.5.0-rc2.tgz(41.11 MB)
9.5.0-rc1(Jun 10, 2020)
First look at GLPI 9.5

In some weeks we will launch the new major version of GLPI: 9.5. A lot of new features will be available, here is a short list:

New marketplace for plugins.

Impacts and dependencies vizualisation for assets.

New graphical and customizable dashboards.

New canned responses for follow-up form.

Support for field templates for Problems and Changes.

Kanban board for project management.

Enhanced planning view and a new full caldav server.

Timezones support.

Impersonate function for super-admins.

Various improvements in UI and UX.

Consult the full changelog for a more complete list.

Please note, we dropped Kerberos support in mail collector setup as we needed to move to another library for mail support that does not provide this option. Please contact us if it's an issue for you.

Today, we release a release candidate archive for this version.

How can you help us ?

Download the rc archive, test the migration and the new features (you may also test the existing ones) and report us the issues you encounter on the bug tracker (tag it as [RC feedback]).

Translators, please, add missing sentences for your language on transifex.
Source code(tar.gz)
Source code(zip)
glpi-9.5.0-rc1.tgz(40.32 MB)
9.4.6(May 5, 2020)
This is a security release, upgrading is highly recommended

Non exhaustive list of changes:

(security) Prevent execution of SQL injection while assigning a technician,

(security) Permit to change key used to store passwords,

(security) Improve CSRF token,

(security) Fix several possible XSS,

(security) Fix a few possible SQL injections,

Fix SCSS caching issues,

Fix inline images handling on item update,

Fix PHP 7.4 compatibility,

Connect to database using socket,

and more!

See changelog for details.
Source code(tar.gz)
Source code(zip)
glpi-9.4.6.tgz(33.38 MB)
9.4.5(Dec 18, 2019)
Non exhaustive list of changes:

add link PDU on tickets,

fix several issues on search queries,

fix LDAP group import,

fix linking on ITIL objects depending on status

fix case issues synchronizing Active Directoy emails

and more!

See changelog for details.
Source code(tar.gz)
Source code(zip)
glpi-9.4.5.tgz(33.44 MB)
9.4.4(Sep 24, 2019)
This is a security release, upgrading is highly recommended

Non exhaustive list of changes:

[security] Prevent account takeover vulnerability ,

[security] Prevent execution of XSS on rich text,

fix cache key lenght issues,

fix user picture removal at login,

several fixes on recurring tickets,

fix some transfer errors related to entities among others,

and more!

See changelog for details.
Source code(tar.gz)
Source code(zip)
glpi-9.4.4.tgz(33.25 MB)
9.4.3(Jun 20, 2019)
This is a security release, upgrading is highly recommended

Non exhaustive list of changes:

[security] Prevent execution of XSS on rich text,

[security] Prevent xss attack on user picture,

Fix performance issues when using entities,

New “Prevent take into account” action on tickets business rules,

New “Status” criterion on tickets business rules,

Change and problem tasks can now be marked as private,

and more!

See changelog for details.
Source code(tar.gz)
Source code(zip)
glpi-9.4.3.tgz(33.23 MB)
9.4.2(Apr 11, 2019)
This is a security release, upgrading is highly recommended

Non exhaustive list of changes:

[security] Prevent external redirections

Fix some performances issues

Fix various issues on plugins loading (cache conflict, bad locales)

Fix display of documents in tickets

Fix display of user's pictures

Fix lost of some relations and sql errors when transferring items

Feature: add Historical tab on config page

And many more!

See changelog for details.
Source code(tar.gz)
Source code(zip)
glpi-9.4.2.tgz(33.21 MB)
9.3.4(Apr 11, 2019)
This is a security release, upgrading is highly recommended

Non exhaustive list of changes:

[security] Bad chevrons rendering on dropdowns (#5468)

[security] Iframe and forms are rendered in rich text contents (#5519)

[security] Type juggling authentication bypass (#5520)

[security] Malicious images upload (#5580)

[security] Password token date was not reset (#5577)

[security] Prevent timed attack and enforce cookie security (#5562)

[security] Prevent external redirections

And more!

Source code(tar.gz)
Source code(zip)
glpi-9.3.4.tgz(32.14 MB)