New version Formcreator 2.12.7 has been released

This version is compatible with GLPI 9.5.5 or later only. Users of GLPI 10 must use Formcreator 2.13 or later. Support of GLPI 9.5.4 and earlier has been dropped, see notes of version 2.11.3 to know the reason.

⚠️ Version 2.12.6 had missing files for LDAP questions. This release address this problem.

Help / Contribution needed

  • Locales updates: Some languages don’t have maintainer, or are late (many untranslated content). Please contribute on Transifex.
  • documentation review and updates

Bug Fixes

New version Formcreator 2.13.3 has been released

This version is compatible with GLPI 10.0.

Upgrade from 2.13.0 or later

A database sanity check is done before running the upgrade. If the tables of the plugin have a difference with the expected schema the upgrade will fail with a message similar to the following:

The database schema is not consistent with the installed Formcreator 2.13.0. 
To see the logs enable the plugin and run the command bin/console glpi:database:check_schema_integrity -p formcreator

It is required to fix the database, using the diff produced by the CLI command given in the message. Once done, try again to upgrade.

ℹ️ If you know what you are doing you may bypass the sanity check from CLI with the following command.

bin/console glpi:plugin:install formcreator -f -p skip-db-check

Possible encoding problems in tickets created in GLPI 9.5 or older

⚠️ GLPI 10.0 encodes rich text content in a different way compared to GLPI 9.5. This revealed some bugs in the plugin in previous versions and GLPI may display old tickets with HTML tags. A CLI tool is available to fix 3 types of inconsistencies. You should test the command in a testing environment or do a backup first.

bin/console glpi:plugins:formcreator:clean_tickets

Bug Fixes

  • abstractitiltarget: copy may generate unwanted ouput to navigator (8792ed3dc)
  • abstracttarget: support for sla and ola from question (e4c6ffeb6)
  • category: do not access page if the plugin is not active (a959839c7)
  • category: don’t activate plugin to access categories (4cd4f600e)
  • checkboxesfield: back to BR (c8908f265)
  • checkboxesfield: back to BR (56d1e7e94)
  • checkboxesfield, radiosfield: checkboxes and radios backslashes (#3050) (47da0ea0a)
  • common: captcha check (b2b7efc89)
  • dashboard: fix dashboard height (712bdc8ad)
  • datefield: change event and comparison (9da947783)
  • filefield: do not assume index of files (a02a9c7ce)
  • form: delete question does not reset preview tab (ad87ddc87)
  • form: prevent SQL error (17aa94309)
  • form: prevent sending two csrf tokens (c04c71bab)
  • form: tab name must obey ‘show count’ setting (b89232eb3)
  • form_language: call to undefined method (137a66047)
  • formanswer: page switching loose filter (14d3ed7ac)
  • install: bad command in error message (f357d9ca4)
  • install: handle possible null while changing fields (0a847af4c)
  • issue: access to saved searches from service catalog (b7481825a)
  • issue: default joint for issue (631888e47)
  • issue: show save button for followup edit (810c854f1)
  • issue: sync issue fails when a ticket has several validators (3f51fbdd9)
  • issue: useless criteria nesting (369fdb57b)
  • selectfield: too many unescaping (706b70faa)
  • targetticket: set request source if no rule specified (2e04680eb)
  • textareadifield: error when deduplicating uploads (666d81395)
  • wizard: consistent breadcrumb on several pages (6639cda03)

Features

New version Formcreator 2.12.6 for GLPI 9.5.10 and GLPI 9.5.11

This version is compatible with GLPI 9.5.5 or later only. Users of GLPI 10 must use Formcreator 2.13 or later. Support of GLPI 9.5.4 and earlier has been dropped, see notes of version 2.11.3 to know the reason.

⚠️ This version intends to fix compatibility with GLPI 9.5.10 and 9.5.11 which contains an upgrade of TinyMCE (used for rich text editors). Some other fixes are also available in this release; see the changelog.

⚠️ Important note: Some administrators use business rules relying on the request source field in tickets to distinguish tickets created by Formcreator. A change has been done in the plugin to allow customization of the request source via ticket templates. Target ticktets without template will lose the request source “Formcreator”. If business rules use the request source “Formcreator” it is recommended to add a ticket template to target tickets, with a predefiend field “request source” set to “Formcreator”.

Bug Fixes

  • abstracttarget: retrieve sub itemtype from question (eccf3d1a)
  • condition: empty sql IN statement (8e4d0491)
  • dropdownfield,glpiselectfield: shiw item ID only on user preference (53dc3aeb)
  • form: lightbulb always gray in darker theme (76a42bb4)
  • glpiselectfield: bad WHERE criteria with entities (154a3531)
  • glpiselectfield: comparison with regex (e6986b04)
  • issue: performance problem in sync issue query (0e1761c9)
  • issue: performance problem in sync issue query (74b38ec0)
  • issue: requester replaced by author on ticket update (a8580a79)
  • issue: sync issues problem when a ticket has several validators (backport 2.12) (#2971) (e3011590)
  • radiosfield: accessibility from keyboard (e528aae7)
  • targetticket: assign group actor from object (42aaadd4)
  • textareafield: compatibility with GLPI 9.10 (a325a948)
  • textareafield: compatibility with GLPI 9.5.10 (7f2ff1a9)
  • textfield: remove invalid ‘\r\n’ tokens (#3065) (da9d8dca)
  • wizard: bad label when searching KB items (f469d048)

Features

  • ldapselectfield: lazy loading (1afc6753)

Help / Contribution needed

  • Locales updates: Some languages don’t have maintainer, or are late (many untranslated content). Please contribute on Transifex.
  • documentation review and updates

New silver partner: C&A Systems

We are happy to announce our new silver partner in the Mexico – C&A Systems.

C&A Systems is an innovative, avant-garde and proudly Mexican company, in the IT sector and digital development.

They are characterized for having extensive experience in the development of technological services for the public and private market, backed by more than 17 years of experience and international quality standards such as ISO 27001 and ISO 20000.

They firmly believe in technological evolution, and are a company committed to offering high quality solutions for any market need.

Among many solutions, C&A Systems offers:

  • Business transformation;
  • Business Solutions;
  • Operation and IT Security;
  • Digital Services and Marketing;
  • Project development;
  • Human development.

Website: https://www.casystem.com.mx/

We are excited that GLPI ITSM solution is becoming more and more represented all over the world and GLPI Network (our support offer for on-premises – get your IT Infrastructure secured) subscription service will be available for more customers through our new partners.

Our large partnership network is always open for new collaborations. If you are interested in representing one of our products in your country, get in touch with us: https://glpi-project.org/contact/

Being a partner means:

  • Having an a direct access to the Teclib´s tech expertise;
  • Get special discounts;
  • Access official support,
  • Many other tools which will help you to gain more customers and increase reputation on the market by adding open source ITSM to your portfolio.

Discover all benefits of being a partner here: https://glpi-project.org/partners/

GLPI news and work in progress (Fall 2022). 

The presentation is hosted by Alexandre Delaunay, in charge of the GLPI development team and the product owner for GLPI. 

In this video he talks about roadmap and some features development team wants in GLPI for the next major version. Here is the transcription:  

“To keep the presentation short, we will discuss only about: 

Major topics 

Or very graphical ones 

And I would like to insist on the fact that there is no promises of time regarding the delivery.  

We will try our best to add the features, but in function of how the year will go, some will be OK, others not.  

  1. Assets genericity. 

Now, we have in our marketplace 2 plugins to address generic adds: 

– Genericobject 

– Fields 

We want to add the possibility to let you customize each type of objects displayed in the Assets menu (at first). 

The first part of that is to let you define your types. 

We will provide a list of predefined types matching the current assets list and let you add new ones if you want. Like servers in addition to desktop or laptop computers. Or to do something completely different from IT management, e.g: cars, desks, etc. 

Some of the current types will still be not removable like Software, Rack, Cable, Cartridge and Consumable. The reason is their behavior, or their presentation differs from other assets. 

You will still be able to disable these if you want but deletion will be impossible. 

So, GENERICITY covers the creation of new asset types. 

  1. Assets composition 

In addition, on the same setup page, you will be able to define which capacity an asset type use. 

E.g. contracts, management, etc., COMPOSITION of an asset type, with some checkboxes to select capacities. 

This permits you to remove or add tabs to the object. 

Or if an object can be inventoried by an agent.

  1. GLPI Agent 

Let us talk a little about features related to the GLPI inventory agent. 

Remote inventory reminder. 

Before talking about roadmap, let us do a quick reminder about remote inventory feature 

This is a task you can set up for an agent to let it query other computers on your network to construct an inventory file for each. 

The single agent will aggregate all inventory files and send them in one pass to the inventory API of GLPI. 

So, the main purpose is to have only one deployed agent. 

We use SSH and WinRM protocols to achieve that.  

GLPI Agent – Roadmap (1/2). 

The first point we want to improve is to ease the inventory process of your network. 

We currently have two tasks: 

– discover which “ping” addresses in an IP range 

– network inventory, which takes the result of the discovery to do a full SNMP inventory for network equipment and printers. 

We will change the process, by: 

– adding remote inventory of COMPUTERS 

– and let discovery task directly doing a FULL inventory if it knows the type of the remote device. A SNMP query for network equipment, SSH or WinRm queries for computers. 

With one unified task and one setup, we aim to let you discover all your network devices. 

The two last bullet points describe things required by unified discovery. The new toolbox UI will receive forms: 

– to plan tasks for the agent. 

– to save credentials, like SNMP community, login password couple for Windows domain or public key for a SSH connection. In summary, any information to let the agent connect to a remote device. 

GLPI Agent – Roadmap (2/2) 

We thought about rewriting a large part of the agents, and we shortlisted Golang for that. 

The fact the agent is written with the language PERL. 

Recently, finding developers comfortable with this language has been hard. 

We will try a prototype within the year to measure our capacity to switch to this new language. 

We plan also to enforce exchange between agents and backend by adding authentication and registration flows. This will be recommended but you will be able to do simple exchanges if you prefer. 

And we still need to redo all forms to drive remotely the agent in GLPI UI. 

This is still planned. 

  1. GLPI  

Let us talk a bit about features related to the GLPI web application. 

High-level API (1/2) 

Firstly, we will add a new API, again. 

We observe that, despite the old one permits more usage, due to its low-level connection with the framework, it is hard to maintain its stability and avoid regression. 

We maintain an interface to address depreciation for this previous API, but it is getting harder and harder to do. 

So, a new API connected to a higher level with stabilized endpoints and parameters. 

And we took advantage to add some comfort features: 

– we have a dedicated UI based on Swagger UI to ease discovering and testing endpoints and their parameters 

– we also use RSQL, a common Query language for filtering API. 

High-level API (2/2) 

For the second slide, you can see in action a GET request to list users in GLPI database. 

  1. DCIM 

 We want to extend the datacenter features in the next version. Mainly about adding graphical views. 

DCIM – Network equipment’s panels 

 The first and the simpler one is graphical panel for network ports list in equipment forms. 

We will take the front and rear pictures defined in the model of the equipment and display them above the ports list. 

The user will get information about each port directly on the picture panel by hovering them. 

A single click on a port will scroll the page to the good line to get more information. 

In the model setup, you will have a new tab to draw each port’s position. 

DCIM – Graphical enclosures (1/2) 

In the same way, slots of an enclosure can be drawn and indexed to indicate to GLPI where sub items can be placed. 

DCIM – Graphical enclosures (2/2) 

On a rack view where an enclosure is inserted, instead of a single blank rectangle, slots will be displayed and usual controls available, like hovering or clicking to get more information. 

DCIM – Graphical connections 

Finally, for DCIM part, we will try to add some representation for network or power connections. 

The goal is to get links between equipment. 

This is early to talk about this, we have short specifications for this, and it requires more research to find a library, for example. 

Keep in mind the current screenshot does not represent any existing development. 

  1. Misc 

Workflows – Processes 

We have a functional prototype for this. 

A new view to let GLPI administrator’s set up their business processes. 

With steps, transitions, conditions and actions, a full toolkit to describe a full workflow. 

This aims to replace legacy rules. 

And for a start, it will be available for assistance objects like tickets or change. 

Nutanix inventory import 

 Another development currently in alpha is the connector to Nutanix API to get: 

– Clusters 

– Hosts 

– Virtual machines 

– Disks 

The module parses the distant API and sends them to the native inventory API of GLPI. 

The merger with existing devices is done with the rule engine as usual. 

SCIM 

 Another connector, GLPI will serve a SCIM endpoint for your Microsoft Azure instance. 

This protocol pushes changes of users from the directory to connected application. 

So instead of synchronizing the whole user’s database and matching everyone, any change in the directory will be immediately pushed to GLPI. 

  1. Security 

Now, a security feature, two factors authentication! 

Administrators can enforce users’ logins in the security setup to ask them to register an external application like Google Authenticator or Authy. 

Security – 2 factors (2/2) 

After a successful login, a new field will appear asking users to paste a pin code from the authentication application. 

Security – Oauth Server 

We will add an Oauth server to GLPI for 2 purposes: 

– connect applications to GLPI to delegate the login feature and identity management 

– secure our several API like inventory one or the general purpose one. 

Security – misc 

– Vulnerabilities management 

– Scanners integration (vuls, tsunamin) 

– CVE matching 

Some various points: 

In the management menu, a new entry to list vulnerabilities. 

The goal is, with the help of external scanners, like vuls or tsnunamin, as well as some API to get CVE and match them to known software’s to see if a host has some security vulnerabilities. 

Some dashboard cards and alerts will also be added to enhance reporting about this subject. 

Technical changes 

– Web root for the application will be `/public` 

– continue work on twig (removing legacy echo) 

– removal of legacy auto escaping 

– modularization of critical features 

– e-charts lib for dashboards 

Last slide to tell you we continue to improve the core of GLPI. 

The most impactful for you will be the move of the web root of the application. 

Now, it will be a sub-folder named /public. 

Thereby, all other sub-folders (like files for example) will not be available on the web when the webserver is not well set up. 

The next point is legacy codebase we need to clean. 

And to finish, we moved to a new charting library called e-charts. 

It is simpler to use on our side and you appreciate the new colors and its interactivity. 

Timeline? 

– Currently, finish stabilize 10.0 version 

– End of 2023, beta of next major version 

We are still working on bugfixing the 10 version. This last brought substantial changes, especially on the assistance part. 

But we aim to work on the incoming yearly results fully on the latest version. 

Success Story: Laboratorios La Santé

We met with José Melendez, an infrastructure specialist at Laboratorios La Santé, a company located in Venezuela. The La Santé Business Unit produces and markets generic prescription and over-the-counter medicines.


They currently have more than 30 international bioequivalence and pharmaceutical equivalence studies that support the effectiveness and safety of their medicines. In this interview you will discover what GLPI tools José uses in his day-to-day life and how he improves his work and that of his team.

New GLPI version 10.0.4

A new GLPI version is available.

This release fixes several security issues that has been recently discovered. Update is recommended!

You can download the GLPI 10.0.4 archive on GitHub.
We also provide a security release for 9.5 branch : GLPI 9.5.10 archive

You will find below the list of security issues fixed in this bugfixes version:

  • Blind SSRF in RSS feeds and planning (CVE-2022-39276)
  • Stored XSS in user information (CVE-2022-39372)
  • Stored XSS in entity name (CVE-2022-39373)
  • Improper input validation on emails links (CVE-2022-39376)
  • Improper access to debug panel (CVE-2022-39370)
  • User’s session persist after permanently deleting his account (CVE-2022-39234)
  • Stored XSS on login page (CVE-2022-39262)
  • XSS in external links (CVE-2022-39277)
  • XSS through public RSS feed (CVE-2022-39375)
  • SQL Injection on REST API (CVE-2022-39323)
  • Stored XSS through asset inventory (CVE-2022-39371)

Also, here is a short list of main changes done in this version:

  • Increase significantly dashboards performance
  • Several bugs on images pasting
  • Fixed and improved inventory locks management
  • Display of printer cartridges
  • Display and hide actors tooltips in tickets
  • Improve display of headers above forms
  • Move breakpoints on responsive displays
  • Inventory API is now disabled by default
  • Dedicated rights has been added for inventory

The full changelog is available for more details.

We would like to thank all people who contributed to this new version and all those who contributes regularly to the GLPI project!

Regards.

New version of Formcreator 2.13.2

This version is compatible with GLPI 10.0.

Upgrade from 2.13.0 or later

A database sanity check is done before running the upgrade. If the tables of the plugin have a difference with the expected schema the upgrade will fail with a message similar to the following:

The database schema is not consistent with the installed Formcreator 2.13.0.
To see the logs enable the plugin and run the command bin/console glpi:database:check_schema_integrity -p formcreator

It is required to fix the database, using the diff produced by the CLI command given in the message. Once done, try again to upgrade.

ℹ️ If you know what you are doing you may bypass the sanity check from CLI with the following command.

bin/console glpi:plugin:install formcreator -f -p skip-db-check

Possible encoding problems in tickets created in GLPI 9.5 or older

⚠️ GLPI 10.0 encodes rich text content in a different way compared to GLPI 9.5. This revealed some bugs in the plugin in previous versions and GLPI may display old tickets with HTML tags. A CLI tool is available to fix 2 types of inconsistencies. You should test the command in a testing environment or do a backup first.

bin/console glpi:plugins:formcreator:clean_tickets

Bug Fixes

  • just reencode br (cce2e7e1c)
  • show KB items without category (91f4deb75)
  • abstractitiltarget: email addresses were ignored (4c28a09b8)
  • docs: mix of single and singular/plural locales (dc8f38cc3)
  • dropdownfield: tree depth not restored in design dialog (af4096bba)
  • fields: add default value to prevent SQL error (#2965) (19f039569)
  • form: risk of selecting the wrong form in DOM (bb31fd163)
  • form: submit once (b00844208)
  • form: unescape form name (5b802658a)
  • formanswer: PHP 8.1 compatbility, error message if invalid JSON detected (8ff7ff91a)
  • formanswer: PHP 8.1 compatibility: null passed instead of string (297fb2713)
  • formanswer: redirect after submission of targetless form (4d60239d1)
  • requesttypefield: warning if comparing against empty value (dca5afb82)
  • section: label for conditions in designer (01e570319)
  • wizard: FAQ list (#3031) (bb0732ca7)

Features

  • tool to repair escaping problem in some tickets (68db0ffda)
  • form: submit forms once (abed86101)
  • formanswer: notification with URL to generated objets (fa6a360f0)
  • formanswer: restore toasts when craeting targets (f43df3ebb)
  • install: show the DB diff when upgrade runs from CLI (#2994) (4abb099a6)

Help / Contribution needed
Locales updates: Some languages don’t have maintainer, or are late (many untranslated content). Please contribute on Transifex.

Success story: Neocos Laboratories

We met with Alejandro Rodríguez Girbés, who leads the IT department of the company Neocos Laboratorios, located in Valencia, Spain.

The company manufactures hair dyes and hair care products for companies such as Mercadona. In this interview you will discover what GLPI tools Alejandro uses in his day to day life and how he improves his work and that of his team.

Interview:

– Hi Alejandro, thank you very much for joining us today. Please could you tell us your name and position

– My name is Alejandro Rodriguez, I work in Neocos Laboratorios as IT responsible for the IT of the company. We are dedicated to make hair dyes for Mercadona, I have more than 100 users, about 150.

-How did you hear about GLPI? What was the first version you tried?

– I have been using GLPI for maybe 5 years now. We implemented it in the company and it is a tool that being free is very easy to introduce to management and learn how to use it and then as soon as the users see how easy it is to put tickets it is very easy to implement in the company.


– How did you find out about GLPI?

I don’t remember how I found out about it. I think I was searching the internet looking for tools that would allow me to implement ITIL standards and one day I came across GLPI and since that day I have implemented it in this and other companies I have been in.


-What version are you currently using?
– I am currently starting to use the latest version 10.0.3 since the last two weeks. And my idea, is, once I finish implementing it well, to go to the Cloud version for convenience.


– What GLPI functions do you use? Helpdesk, Asset Management, Problem Management, Change Management, Financial Management, Reporting, User Management, Knowledge Base, etc.?
– I have always used it for inventorying all my IT equipment and for ticketing but then the ticketing part also has associated internal management of recurring cases and so on and in this version 10, which is already integrated the issue of inventorying more comfortable, in fact the documentation I found it right away and I inventoried all my part.
Now with this version 10 I am also inventorying the terminals that before I did not do it and now it is very simple and I am even with the management of contracts, budgets and projects. I think I use everything or almost everything! It is very comfortable for me!


– Do you use any GLPI network plugins? If yes, which ones?
– Not at the moment. I did install the IPs plugin and so on, but I didn’t have time.


– How does GLPI help you in your work? What were your requirements for the software and what business/IT problems were you willing to solve with GLPI?
– Starting with ticketing, it is very convenient for me to keep a record of the day to day quantified in numbers, then, it is very useful to keep the inventory of all the park I have, in that sense it is very comfortable because I can draw statistics and then take action based on that, and keep a budget item for the issue of hardware, software. Likewise, it is easier to keep a record of each year’s investment than to look at it folder by folder.


– What is the best feature of GLPI for you?
– Of the whole package, the best is the inventory, having integrated it natively into the tool. For me it has been a very attractive solution.


– Can you give an overall assessment of GLPI (summarize your experience with GLPI)?
– The ease of implementation and the ease of starting to use it. If I have a need, I just look where it is and that’s it. For example, with the issue of recording internal invoicing, it is very convenient for me, the issue of getting a report on the age of the hardware, it is very easy to work with the tool.

– Great, very good. Thank you very much for all your answers, very clear.