OpenCATS Newsletter

0.9.7 Security update

2023-01-30T00:00:00+00:00

Security release and vulnerability news

After a detailed security audit, we have released OpenCATS version 0.9.7 which detected and corrected several vulnerabilities.

Overview

@hansmach1ne identified a number of vulnerabilities on the ‘internal’ webpages and would require a valid username/password to reach. It’s been greatly appreciated by the project that these vulnerabilities were checked and mitigating PR’s proposed.

I’m very appreciative of the work that they’ve put in here and once the release is produced will share it on the project website.

Mitigation steps - I’d always recommend users / admins read the security guidelines and think carefully for themselves https://github.com/opencats/OpenCATS/wiki/Security-Considerations which actually include mention of some of these ‘internal facing’ vulnerabilities

Remediation

We recommend that you upgrade your opencats instance asap.

If you wish to apply a fix instead, please view the changes in the github PR instead.

Thanks

We are extremely grateful to @hansmach1ne for finding these vulnerability and proposing remediation steps.

Support queries?

If you have any questions regarding this security fix, please visit the User support forums or if you have found an issue with the code - then raise an issue on github

0.9.4 Security update

2019-07-01T00:00:00+00:00

Urgent Security release

In response to an XML External Entity (XXE) Injection vulnerability we have released OpenCats v0.9.4-3.

Overview

OpenCats suffers from an unauthenticated xml external entity injection that allows remote users to read files on the underlying operating system.

Date Reported: 28 Jun 2019

More information:

OpenCats XML External Entity (XXE) Injection

Remote users (job applicants) can upload docx or odt files to read files on the underlying operating system. A docx file will be used here, but odt files can be used as well since the same vulnerable functions in DocumentTotext.php are used to parse the files.

Remediation

This problem has been fixed in version 0.9.4-3

We recommend that you upgrade your opencats instance asap.

If you wish to apply a fix instead, please view the changes which requries you to add a single line to /lib/DocumentToText.php

Thanks

We are extremely grateful to Mark Ruther for finding this vulnerability and notifying the OpenCATS project.

Support queries?

If you have any questions regarding this security fix, please visit the User support forums or if you have found an issue with the code - then raise an issue on github

0.9.4 Release announcement

2017-05-12T00:00:00+00:00

Introduction

OpenCATS is the leading open-source Applicant Tracking System for recruiters and companies. It is the ongoing result of the community’s hard work and collaborative development since it was forked from the original base project (which moved into a closed-source SAAS model). This version of OpenCATS provides a number of new features, addresses critical security concerns, and maintains compatibility with current releases of PHP and MySQL..

ACL system for role-based restrictions

It is now possible to configure granular permissions for users based upon their roles and permit/restrict access to specific sections of the application. This is configured in the global configuration file config.php

Replacement of TinyMCE with CKEditor

All references to TinyMCE have been removed and it’s replaced in it’s entirety throughout the application with the current version of CKEditor.

Zipcode lookup via google.

When adding in new candidate or contact details, the address details will auto-populate using a lookup to google services. Note that some formatting varies per country. Currently this is tested for USA / Europe.

Working hard for the future

We’re well along the path for the next major version, too - moving to the Symfony framework and with a refreshed GUI based on bootstrap.

Changelog

The full details of the release (including changelog) are at https://github.com/opencats/OpenCATS/releases/tag/0.9.4

Thank you to the developers

The unsung heroes are the developers who have put an immense amount of personal time into maintaining and enhancing this project. You can find them in the release notes.. Every single one of them should be honoured!

Come and help!

If you want to out with the brand new challenges of OpenCATS as it migrates to Symfony and Bootstrap - please view the project on github and lend a hand. We actively monitor github issues, and regularly collaborate on slack.

http://github.com/opencats/opencats
http://opencats.slack.com

Support queries?

If you’ve deployed OpenCATS and have a support query, please visit the User support forums or if you have found an issue with the code - then raise an issue on github

ALternatively, you can email me night or day - russh@opencats.org

Thanks,

The OpenCATS team!

Newsletter #2 - A good journey

2016-12-01T00:00:00+00:00

Welcome to the second newsletter for opencats.

Playing Catch Up

Let’s take a look at some of the milestones of the previous six months;

General News

A re-energised and active Developer team actively working to improve base code and functionality.
several new features introduced including candidate address completion by zipcode, customisable job-codes, and configurable levels for users.
Installation and User documentation is now standardised into a readthedocs site , viewable online and easily printed to PDF.

Development News

Several deprecated errors corrected,
license is clarified
code deployment is now far more robust - Travis CI runs test-cases for each PR, and codacy automatically reviews the code quality

At 20,000 Feet

You may be wondering, “just how much has changed since it forked from CATS?” Well, let’s look at the overall changelog

Changelog

Unreleased

Full Changelog

Closed issues:

datagrid.php has strict errors (solved) and Deprecated errors on some tabs #155
Composer needs to be manually run even on a normal install #154
Including Candidates name while sending emails from ATS #133
Missing packages and modules #102
Update License #98
Canadian Postal Codes #38
TODO: add in Wordpress front-end from Ultrasimplified #12

Merged pull requests:

Update LICENSE.md #170 (RussH)
Zipcode address completion via google #167 (RussH)
Fixes error with globalStyle not being defined #166 (Bloafer)
Strict standards: Non-static method #165 (Bloafer)
Pass by Ref error on Strict Standards #164 (Bloafer)
Configurable Job Types #159 (skrchnavy)

0.9.3-3 (2016-11-22)

Full Changelog

Closed issues:

Powered by CATS pic on Careers Page does not appear correctly #139
While sending email to candidates the body field does not appear #131
Notice: Undefined variable: commandResult #105

Merged pull requests:

Generate packages with full dependencies on Travis #162 (mlespiau)
Extended xml export #158 (skrchnavy)
Logging into DB fix #157 (skrchnavy)
Remove references to pro version and links to downloads page #151 (cptr13)
Fix of attachments processing #149 (skrchnavy)
Fixes in db shcema #148 (skrchnavy)
Fixed Favicon.ico now showing #143 (amaisonneuve)
Powered By broken link #142 (amaisonneuve)
Upgraded ckeditor to current (version 4.5.11) to address #131 #132 (RussH)
Access level tests #125 (skrchnavy)
Update InstallationTests.php #124 (theSlyest)
Replace deprecated simpletest with phpunit and behat #123 (mlespiau)
Tests using behat isolated in test directory #100 (skrchnavy)

0.9.3-2 (2016-11-22)

Full Changelog

Closed issues:

Feature Request - add a ‘is Hot?’ column to cold call list #161
500 error while creating a company or job order #160
How can I access to my opencats web in the vps from another pc #146
Forgot Password link in the login screen missing #141
Content area turns blue when something is added #140
500 Error after install #138
Error while creating http://localhost/opencats #129
Resume Upload error #126

0.9.1a (2016-08-26)

Full Changelog

0.9.3-1 (2016-08-26)

Full Changelog

Closed issues:

No actions work against list members in 0.9.3 #121

Merged pull requests:

fixed send email and add candidates #122 (skrchnavy)

opencats-0.9.3(alpha) (2016-08-22)

Full Changelog

opencats-0.9.3(final) (2016-08-22)

Full Changelog

Closed issues:

Troubleshoot MySQL #111
Non editable “paste the resume contents” field #104
Issue with vagrant #103
Windows installation #99
From Forums - Manuel’s attachment issue #95
asp File in module #69
ElementITMultiPowUpload1.7.swf #68
Unable to login #64
i need to change menu names #63
Sync from Uservoice #24
TODO: add in fixes from Debian packaging #10

0.9.3 (2016-03-09)

Full Changelog

Closed issues:

Add JobOrder available for ReadOnly user on Job Orders page #109
Add Candidate available for ReadOnly user on Candidates page #107
Add Contact available for ReadOnly user on Contacts page #101
Cannot import any data. New Unit test? #86
Initial sign-in, cookie error #85
Tests do not run #70
Use fluid width pages #58
Update installation procedure #57
Initial password displayed in installer page is wrong #53
Plain Text Password #45
Decoding of UTF-8 characters mangles Calendar entries #42
update phpmailer to more recent version #37
disable the catsone.com version check #35
update exceptions table with two additional fields or it’ll throw errors #28
Include updated SVG artwork #21
Default username wrong #19
TODO: add in LDAP integration from LIBREGEEK #11
Incompatibility with Explorer 11 in the editor #2
datepicker returns the wrong default date when adding activities #1

Merged pull requests:

update version no / name to 0.9.3 Inferno #119 (RussH)
updated styling for login screen #117 (RussH)
Checks for access level #114 (skrchnavy)
Fix of permission in Job Orders for readOnly user #110 (skrchnavy)
Fix of permission in candidates for readOnly user #108 (skrchnavy)
Fix of permission in contacts for readOnly user #106 (skrchnavy)
Waffle badges in README #96 (skrchnavy)
fixes some typo errors #92 (skrchnavy)
docker - added execute permission for installing composr #90 (skrchnavy)
Wait for mysql and apache before running tests in travis #89 (mlespiau)
Issue 86 cannot import data after initial setup #88 (mlespiau)
Datagrid filters ui refactor and bugfixes #87 (mlespiau)
Fixed issues with UTF8 #84 (skrchnavy)
Mysql utf8 character set #81 (mlespiau)
Add cucumber like functional tests #80 (mlespiau)
Docker for development #78 (mlespiau)
Flexible layout #74 (mlespiau)
Ldap module improvements #73 (skrchnavy)
Fix unit tests #72 (mlespiau)
Replace GroupTest class with TestSuite as it was removed from Simplet… #71 (mlespiau)
Added grave accents, backticks, to database schema name #66 (aaam)
Update lib.js #62 (theSlyest)
Update suggest.js #61 (theSlyest)
Fixed #57 - Updated documentation. Fixed #45 - Added md5 encryption to passwords. #59 (libregeek)
Updated phpmailer library refer #37 #56 (vinay-athiyil)
LDAP authentication support and default password display #54 (libregeek)

opencats-0.9.3 (2016-03-09)

Closed issues:

OpenCATS vs CandidATS #46
Strict standards: Only variables should be passed by reference in D:\wamp\www\cats\lib\DataGrid.php on line 1714 #39
Error in config.php for email settings #34
Cannot generate report on CATS 0.9.2 #33
Error while trying to generate report from Jobs view #31
Cats freezes/stops working when creating candidate #30
Sync from Uservoice #27
Disable Modules #26
issues on UI application #22
CATS references in Install Wizard #16
Sync from Uservoice #15
Add in latest PHP fixes from crossgate9 #14
Add in updated and enhanced Sphinx Search from Allan Jones #13
When editing a company the fields at the right side isn’t lined up well #8
Missing Icon in calandar #7
Deprecated error in Opencats #5

Merged pull requests:

Update from RussH fork #49 (RussH)
Make CSV exports in UTF-8 readable for Excel #41 #48 (wjcheers)
Fix bug and add duplicated phone number check. #47 (wjcheers)
removing the old superseded simpletest library #20 (RussH)
Updated SQL to ensure tag db is created. #18 (RussH)
Please merge Opencats fixes as below #17 (RussH)

Newsletter #1 - A New Hope

2014-06-06T00:00:00+00:00

Welcome to the first newsletter for Opencats, a project that hopes to give a new beginning to an ATSthat we all love.

Playing Catch Up

Let’s take a look at some of the milestones of the months preceding May:

General News

March 20:

Development News

Imported source code was cleaned up.
Legacy system support was removed.

At 20,000 Feet

You may be wondering, “just how much has changed since it forked from CATS?” Well, let’s look.

Recent Development

Now that we have detailed some of the milestones before the month of May started, we can now look at what has happened in the last month.