cyberitsolutions/alloc

Professional Services Automation (PSA) solution, integrates Project Management, CRM, Time Sheets, Billing, Resources, Reporting, Tasks, Invoicing, Calendars & Reminders into an easy-to-install cross platform web application.

allocPSA

allocPSA is the web-app that takes care of your projects, employees, time sheets, invoicing and customers.

Installation

NOTE: If you are upgrading, please read the Upgrading section below.

allocPSA is generally intended to run with PHP>=5 and MySQL>=4 on a Linux server. It possibly runs on a Windows box, but is untested.

You will need to install php, mysql, and php-mbstring. The php-gd package is also recommended. On Debian, this will get all that is needed:

# apt-get install apache2 php php-mysql php-mbstring php-gd mariadb-server make python

Ensure mariadb is running in utf8 mode and not utf8mb4, see the config files for mariadb in /etc/.

To install allocPSA:

1. Put the allocPSA source code in a directory called e.g. alloc in your httpd servers document root. E.g.: /var/www/html/alloc/

2. Make the patches and css, e.g.:

$ make patches; make css

3. In a web browser, go to your servers hostname + directory where you put the alloc source code, such as: http://localhost/alloc/

4. Follow the instructions in the web browser to complete the installation.

Upgrading

To determine which version you are currently running, look at the fine print at the bottom of the login screen for allocPSA, or alternatively view the file: http://YOUR_ALLOC_INSTALLATION/util/alloc_version

Generic Upgrade Instructions

• Backup your allocPSA database. DO IT NOW.

• Unpack the new allocPSA source code alongside your current installation.

• Copy the alloc_config.php file from your current installation of allocPSA into the directory that contains the new installation of allocPSA.

• Finally, update your allocPSA database by going to this address in your web browser: http://YOUR_NEW_ALLOC_INSTALLATION/installation/patch.php

  Apply each patch separately, starting from the top and working your way down. If you get errors stop the process and use the support forums.

Developers!

We'd love your help, make an issue, write a pull request, start a discussion.

Also see doc/DEVELOPERS.md for an example development setup. 🙂

Support

Please feel free to contact us at Cyber IT Solutions [email protected] or use the forums if you have any questions.

If you found a bug, please create an issue!

Contact

Email [email protected] for commercial and hosting enquiries.

License

allocPSA is under the GNU Affero General Public License. For more info please see the LICENSE file or visit the GNU Affero General Public License webpage.

alloc's Issues

ZendSearch is unmaintained/obsolete. Consider alternatives.

ZendSearch is also painfully slow, and as used in alloc often breaks.

zendframework/ZendSearch#8 (comment)
zendframework/ZendSearch#24

Some possible options:

https://github.com/teamtnt/tntsearch
https://github.com/pucene/pucene

alloc-cli should be a seperate repo

alloc-cli should be in a separate repository.

Selecting text in th comments section is buggy

I the JS has auto hidden text, and you try to select unhidden text, the JS will cause the hidden text to show. This results in the text jumping around when you select it.

PHP 7 compatibilty.

PHP 7.x is the only PHP available on Debian Stable (Stretch/9) and Ubuntu 16.04/18.04. alloc should fully support PHP 7.

alloc should adopt a coding style

As for me I suggest using both PSR-2 and PHP Pear CS. And for times when those styles conflict, use PSR2.

Consider enforceing a JS coding style

Currently the Javascript in alloc is inconsistent. We should consider using a formatter to tidy the un-minified JS code. Based on my search, here are three options:

• esformatter - this one seems to be a dead project, last commit is from 3 years ago. It does minimal formatting and doesn't enforce a strict code style.

• jsfmt - I don't really get this one, it seems to extend esformatter? even more dead, last commit from 4 years ago. It also does minimal formatting and doesn't enforce a strict code style.

• Prettier This is a very opinionated formatter. I do like the idea of that, to a degree. Having all JS use the same strict format/style would have benefits, much like those described by the Black project.

TBH, IDK what is a good choice, but something needs to be done because the current JS style in alloc is a bit wobbly. @alexlance what do you think? Based on the popularity of Prettier, it's possibly a safe bet. But it's also very strict and opinionated.

Oh, I also tried UglifyJS, but it messes up some parts really bad. I guess it is better at compiling/minifying.

Do I need docker as well

Do I need docker as well? and is make necessary?

Remove or update 'phpass'

I've found 3 CVEs regarding the password hashing library 'phpass' used by alloc.

CVE-2014-9034 - https://www.cvedetails.com/cve/CVE-2014-9034/
CVE-2013-2173 - https://www.cvedetails.com/cve/CVE-2013-2173/
CVE-2014-9016 - https://www.cvedetails.com/cve/CVE-2014-9016/

The first 2 are for phpass as used in wordpress and the last one is for phpass as used in drupal. they are for a possible denial of service attack.

If you use alloc you should make sure you have it behind HTTP basic access authentication for additional security.

Move to HTML5

Currently there are issues with the html that gets generated. It would be good to move to HTML5 and make sure we are following the w3 specs.

When doing this, we should also make extensive use of class="" to make CSS theming easier.

Don't allow users to set passwords that are invalid for login

The below code:

alloc/person/templates/personM.tpl

Lines 39 to 43 in 05539b5

	<td><input type="password" name="password1" value=""></td>
	</tr>
	<tr>
	<td>Confirm Password</td>
	<td><input type="password" name="password2" value=""></td>

Allows a user to set a password longer than 32 characters.

But the below code:

alloc/login/templates/login.tpl

Line 18 in 05539b5

<span><input type="password" id="password" name="password" maxlength="32"></span>

Requires the password on the login form to be a max of 32 characters.

I have tested (accidentally) that I can set a 36-character password successfully, but then fail to log in with it due to the char limit of the HTML field.

Make alloc work when using snuffleupagus strict config

Snuffleupagus is a tool to prevent dangerous behavior in php 7 software. Currently alloc does not run under Snuffleupagus when sp.global_strict.enable(); is set.

Fix commit author's

They currently look a bit like this - I want to straighten them out. The downside is that the commit hashes will change. But the practical effect of that is... not really worrying at all come to think about it.

Any objection? @cjbayliss do you prefer your gmail.com or cyber.com.au email?

(edited to remove email addresses)

25 Author: Alex Lance <al
1770 Author: Alex Lance <al
3 Author: Alex Lance <al
72 Author: Alex Lance <al
171 Author: Alex Lance <al
189 Author: Alex Lance <co
2 Author: Alex Lancealla
11 Author: Alex Lance <xx
176 Author: alla <al
72 Author: Christopher Bayliss <ch
33 Author: Christopher Bayliss <cj
5 Author: conz <co
10 Author: Con Zymaris <co
9 Author: Con Zymaris <co
2 Author: Dinis Lage <di
6 Author: Dinis Lage <di
102 Author: Jeremy Chin <je
61 Author: Jeremy Chin <je
2 Author: Jeremy Chin je
1 Author: Jeremy Chin <je
10 Author: Jeremy Chin <je
1 Author: mattcen <ma
5 Author: Matthew Cengia <ma
63 Author: Patrick Clearwater <pa
4 Author: patrick <pa
1 Author: Peter Wright <pe
1 Author: root <ro
61 Author: root <ro
10 Author: root <ro
3 Author: Trent W. Buck <tw

Move alloc to a GitHub Organization

It would make working on alloc a lot easier and be simpler to promote people contributing if the allocPSA repo was on a GitHub Organiztion. This would simplify certain aspects of maintaining allocPSA.

installation/db_patches.sql missing

I am just trying to setup allocPSA and am unable to import installation/db_patches.sql as it is missing from the current revision

I can't test the database in the installer as "Can't get install_data from config table. Have you imported db_patches.sql as directed above" occurs.

Confirm alloc is not affected by CVE-2015-9251

The version of jQuery used in alloc is 1.9.2 which is affected by CVE-2015-9251.

Drag and drop to change priority.

This is an interesting idea that is seen in other PSAs, and would make managing priorities easier IMO.

Require 1 approved review before a merge can happen

Recreating issue number 14 from alloc-cli:

Github supposedly allows an admin to protect a branch and require X number of reviews before a merge can happen:

https://help.github.com/en/articles/merging-a-pull-request#required-reviews
https://help.github.com/en/articles/about-protected-branches

We should consider setting this up to prevent accidental unreviewed merges.

Integration with major git services.

It would be nice to integrate with GitHub, GitLab, and Bitbucket.

One idea is to somehow sync issues.

Another would be to allow linking of a task with a branch.

And I'm sure there are plenty of other integration things that would be great pleasantries.