These fix two critical security vulnerabilities: a SQL Injection (CVE-2022-35947), and a Remote Code Execution (CVE-2022-35914, vulnerability in the third-party library, htmlawed), the latter has been massively exploited since October 3, 2022 to execute code on insecure servers, available on the internet, hosting GLPI (GLPI Network Cloud instances are not impacted).
If you are not on the latest version 9.5.9 or 10.0.3, you must update your instances according to the recommended method (from an empty folder, without overwriting existing GLPI files).
We noticed there is a scenario where the corrective versions can also be impacted: when a GLPI update has been performed, by unpacking the archive over the existing folders and files. We insist this way of updating GLPI is a bad practice and despite the current security problem, exposes you to bugs.
We invite you to correctly re-install your GLPI as indicated in the documentation:
from an empty folder
copy the files from the archive of the latest version
get your config/ and files/ directories from the old instance.
Workarounds to deal with RCE urgency (this does not fix SQL injection):
delete the vendor/htmlawed/htmlawed/htmLawedTest.php file (be careful not to touch the htmLawed.php file which is legitimate).
prevent web access to the vendor/ folder by setting (in the case of Apache for example) an adequate .htaccess.
If your server has already been corrupted, you probably need to start from a new server, on which you will import your SQL dump and the folders mentioned above.
We are happy to announce our new silver partner in the Dominican Republic – HarPer Srl.
HarPer Srl is an IT company primarily engaged in providing cybersecurity technological solutions to their customers.
They provide support of businesses throughout their life cycles from installment of new infrastructure, development of new systems, secure their data or even their physical locations. Also, they provide guidance or recommendations for business continuity.
Among many solutions, HarPer Srl offers:
Pentesting, hardening access control, vulnerability Assessment, implementation of information security improvements.
Implementation and troubleshooting of networks and infrastructure.
Development of desktop, web and mobile applications.
IT, network and security trainings|Project Management, Agile (Scrum, Kanban, etc.).
We are excited that GLPI ITSM solution is becoming more and more represented all over the world and GLPI Network (our support offer for on-premises – get your IT Infrastructure secured) subscription service will be available for more customers through our new partners.
Our large partnership network is always open for new collaborations. If you are interested in representing one of our products in your country, get in touch with us: https://glpi-project.org/contact/
Being a partner means:
Having an a direct access to the Teclib´s tech expertise;
Get special discounts;
Access official support,
Many other tools which will help you to gain more customers and increase reputation on the market by adding open source ITSM to your portfolio.
Help / Contribution needed Locales updates: Some languages don’t have maintainer, or are late (many untranslated content). Please contribute on Transifex.
We are happy to announce our new silver partner in Costa Rica – ANC Technology Services S.A (Amvix).
ANC Technology Services S.A (Amvix) is a company with more than 14 years of experience in the market. They are specialized in OpenSource technologies for the implementation of network, security, Internet and CRM solutions.
They provide support in preventive management, consulting and infrastructure scaling. They approach the business opportunities offered by new computing technologies.
Among many solutions, ANC Technology Services S.A (Amvix) offers:
We are excited that GLPI ITSM solution is becoming more and more represented all over the world and GLPI Network (our support offer for on-premises – get your IT Infrastructure secured) subscription service will be available for more customers through our new partners.
Our large partnership network is always open for new collaborations. If you are interested in representing one of our products in your country, get in touch with us: https://glpi-project.org/contact/
Being a partner means:
Having an a direct access to the Teclib´s tech expertise;
Get special discounts;
Access official support,
Many other tools which will help you to gain more customers and increase reputation on the market by adding open source ITSM to your portfolio.
Help / Contribution needed Locales updates: Some languages don’t have maintainer, or are late (many untranslated content). Please contribute on Transifex.
“One of the handy function I found with GLPI is that the asset association with users, it’s very useful when users can connect with their own device when they try to submit a ticket”.
GLPI SUCCESS CASES
YK Pao School
About the company
YK Pao School is a pioneering international Chinese school. The school is a private non-profit institution founded in 2007, in memory of shipping magnate Sir Yue-Kong Pao, the renowned Chinese businessman, statesman and philanthropist.
With around 1600 students from China and overseas, the school offers a unique Year 1-12 educational programme that integrates elements of Shanghai and international curricula, culminating with the IGCSE and IB Diploma programmes, both of which are complemented by core components of the Shanghai curriculum.
Challenge
GLPI helped us to quickly build up the IT Asset management system and the out-of-box solution for ticket management. The highlight function of AD integration is very important if you want to quickly build a solution for everyone in the organization. One of the handy function I found with GLPI is that the asset association with users, it’s very useful when users can connect with their own device when they try to submit a ticket.
Requirments
We use Asset Management the most, it has been super helpful since 0.85 with the Dashboard plugin. We also use the Helpdesk/Change – Problem Management feature. Financial management was integrated with Asset management, this is also important when you want to develop a long-term strategy for your asset management.
GLPI solution
Colin Chen, Director of Technology: “It was way back when I was at university, I was interesting in open source solutions and GLPI was the leading platform for IT Asset and Ticket management.
The first version I tried I guess should be 0.7x. At YK Pao School GLPI helped us to quickly build up the IT Asset management system and the out-of-box solution for ticket management.
The highlight function of AD integration is very important if you want to quickly build a solution for everyone in the organization. One of the handy function I found with GLPI is that the asset association with users, it’s very useful when users can connect with their own device when they try to submit a ticket”.
We are happy to announce our new silver partner in Croatia – KING ICT.
KING ICT is a system integrator specialized in advanced ICT solutions that positively influence business and society. Based on new technologies, the cloud and mobile first principle, they create innovative enterprise solutions.
They facilitate operations and create added value for their clients, driven by the desire to jointly build a connected and digital future. Their clients come from different branches, such as transport, energy, agriculture, health care, education, judiciary, trade, finance, and telecommunications.
Among many solutions, KING ICT offers:
• Application Development & Management; • Business Applications & Consulting; • Modern IT Infrastructure; • Cyber Security; • IT Services & Workplace Management; • Physical Security Systems.
We are excited that GLPI ITSM solution is becoming more and more represented all over the world and GLPI Network (our support offer for on-premises – get your IT Infrastructure secured) subscription service will be available for more customers through our new partners.
Our large partnership network is always open for new collaborations. If you are interested in representing one of our products in your country, get in touch with us: https://glpi-project.org/contact/
Being a partner means:
Having an a direct access to the Teclib´s tech expertise;
Get special discounts;
Access official support,
Many other tools which will help you to gain more customers and increase reputation on the market by adding open source ITSM to your portfolio.
In a few weeks we will launch the first beta version of GLPI 10. We are working on the last technical elements and preparing the release of compatible plugins on the Marketplace.
One of the biggest news of this version is a major overhaul of the interface and the user experience. The latest redesign since version 0.90 was done in October 2015.
The integration of these standard libraries will make it easier to develop new interfaces and above all brings a “responsive” display mode that is easier to maintain.
Here are some screenshots to give you an overview of the upcoming changes.
Beyond the change in design, we are making a number of user experience improvements, here is the list of key points:
Vertical menu
As you have noticed on the previous screenshots, GLPI now offers by default a layout with a vertical menu. It is still possible to switch to a layout similar to previous versions (named Horizontal) in user settings.
In the new layout it is possible to collapse the menu to have a compact display.
Button “Go to…”
Available since version 9.2 the “Go to” feature which allows a quick search of a menu is now highlighted and can be discovered on top of the menu.
The park equipment now has a panel on their right side where you can click on the images attached.
“Saved search” panel
The “saved search” panel now integrated into GLPI design. You can set it floating, or pinned to pages (to be kept permanently (even after browsing)).
Pinning is done page by page, e.g. a panel pinned to “tickets” will not be pinned to computers.
Note that now you can find it in the first tab, the saved searches corresponding to the type of object: list of tickets will be displayed according to priority of saved searches.
Second tab lists all other searches concerning other types of objects.
As the panel is now contextual to the type of object presented, you can access it via an icon named “Lists” placed next to the breadcrumb trail.
Invisible search engine
It is now possible to deactivate the display of the search engine.
You can navigate in GLPI only using saved searches!
Dynamic loading of search results
The search engine display is now launched in “AJAX” mode. A loading icon is displayed when a search is launched, page changes or sorting is in process. Once new results are available, only the content is replaced and not the entire page.
Multi-sorting of results
With a “ctrl” you can add several sorting modes to the columns of your search results.
Example: sort by “Name” and by “Modification date”.
Page of park elements.
The main element form now displays a panel on the right displaying the images associated with the corresponding model. These images could be previously accessed only in the display part of data center racks, now they are available everywhere.
Redesign of ITIL objects
Display and use of ITIL objects (Tickets, Problems and Changes) are thoroughly reviewed.
Many changes were made:
The order of messages in the “timeline” now goes from the oldest to the most recent, starting from top to bottom, following a usual reading order. New answer now placed below the last one.
A side panel contains the additional information of tickets (dates, priority matrix, actors, etc.). This panel can be temporarily enlarged. We also group by these changes the main tabs and “timeline” within the same view.
Documents added to the timeline are now displayed below the parent object (tracker, task) in a contextual way for easier reading.
Each of the types of actors (requesters, observer and assigned) are now displayed in a single field. Previously, several clicks were required to select a group or a user and then choose the final actor. It is now a single drop-down list unifying all possible objects (differentiating them with an icon) and providing autocompletion.
A button at the bottom of the main view allows you to switch to a “TODO list” view displaying the tasks and validation requests in an interactive vertical list, allowing you to follow the progress of a ticket (or another ITIL object)
New colors
With the arrival of new libraries tabler and Bootstrap 5, it is now much easier to create and modify GLPI palletes.
Very soon the new major version of GLPI will be released with many new features, including a major overhaul of the interface.
Here is the quick look at automatic inventory features.
GLPI Desktop / Server Agent
Fork of the Perl FusionInventory agent, this new agent is enhanced with several new features:
A new stand-alone interface (called Toolbox) allowing the configuration of network discoveries and inventories.
An improved proxy mode to allow inventory reporting from remote networks.
Remote inventory support (agentless), currently with support for WinRM (Windows) and SSH (Linux / Unix) protocols.
Inventory of database servers.
New exchange protocol with GLPI server in JSON format supporting partial inventory.
Soon: management of remote inventory tasks, including for ESX polls.
Improved Windows support including MSI packages.
Native support for MacOSX Big Sur and the new Apple Silicon M1 chip.
The GLPI agent can advantageously replace the FusionInventory agent because it remains fully compatible with the automatic inventory of the FusionInventory.
We provide the community with a documentation detailing the installation, use and configuration of this new agent. Note that there may still be a few aspects to be completed (the missing points will be filled in the coming weeks).
We also provide a perl script (see dedicated documentation) allowing you to install agent on Linux with a suitable package (rpm, deb, snap.)
Some screenshots to illustrate the ToolBox interface of new agent:
GLPI Android Agnet
Some time ago the android agent has returned to the google play store. It supports versions 4 to 10.
For GLPI Network subscription customers, we have also added the possibility of configuring the server URL via mechanism called “Deeplink”. Using QRCode agent automatically retrieves the configuration to connect to the server.
GLPI Native Inventory
We are happy to announce we add support for automatic inventory directly to GLPI core.
New API REST (front/inventory.php) will be available to receive inventory files in historical format (OCS, fusioninventory) or via new format json.
We therefore keep compatibility with the previous agents (just it will be necessary to reconfigure the server URLs of the historical agents, or to set up a web proxy to perform a redirection to the new URL).
You can now manage with this new format most of GLPI’s inventory objects, like telephones, applications, racks, etc. This is enabled by a new rewrite of the underlying code. The interface is inspired by the community projects mentioned above, the code is new.
This code now allows you to receive partial inventories.
This consists of sending only part of the particular information related to the object, and indicating to the server – via a flag – to update only the data concerned.
Transfer, processing, insertion and update of data is done in a significantly faster way.
Advanced tasks
As seen above, GLPI now integrates the basic building block concerning automatic inventory. However we have not yet taken over the advanced tasks allowed by previous projects. Here are a few points about these tasks:
Network discovery and inventory: now independently configurable by GLPI agent via Toolbox interface.
ESX query, soon supported by same interface
Collection (WMI, files, registers): not supported.
Tele-deployment: not supported.
For these last two features several scenarios are possible:
First of all, keep the previous plugin (if this one is updated)
Use our transition package. A fork of the FusionInventory plugin (GLPI inventory plugin) will be made available. It will redirect the classic inventories to the native part and keep the advanced tasks.
In our roadmap it is planned to work on rewriting of these parts, but as long as version 10 being almost done (and this substantial work), we are postponing their availability for a few months.
