Ελληνικά

Reporting a security problem

If you think you have found a vulnerability in OnPraxia by IXXO, tell us here. Please give us time to fix it before making it public.

What we promise

• We answer within 3 working days, if you leave an address.
• We tell you when it is fixed, and name you if you wish.
• We take no legal action against research done in good faith.
• We publish what was fixed once the fix is available.

What we ask

• Test only with your own account, and don't look at, change or keep other people's data.
• Do not slow down or interrupt the service.

Tell us

Security fixes released

• 1.0.0-rc.154 (high): The bill reader's download libraries (urllib3 2.6.3, requests 2.32.5) had known flaws. Install this release, make sure the server has Python 3.12 or 3.11 with its venv package (on Ubuntu 22.04: add-apt-repository -y ppa:deadsnakes/ppa && apt-get install -y python3.12 python3.12-venv), then run the setup again with --ocr.
• 1.0.0-rc.149 (critical): The bill reader's image library (Pillow 11.3.0) had known flaws in its image decoders. Install this release, make sure the server has Python 3.10, 3.11 or 3.12 with its venv package (for example: apt-get install python3.12 python3.12-venv), then run the setup again with --ocr.
• 1.0.0-rc.118 (medium): The AML form's password was kept in a form that staff could read back. Install this release. Clients who still need their password get a new link and password from AML › the client's form.
• 1.0.0-rc.117 (low): Sign-up and forgotten password could be posted without the page's robot check. Install this release. Nothing else to do.
• 1.0.0-rc.107 (low): Responses showed the PHP version. Install this release. Nothing else to do.
• 1.0.0-rc.107 (medium): Browsers weren't told to insist on HTTPS on Plesk and the website. Install this release. Nothing else to do.
• 1.0.0-rc.107 (medium): A small Office file could stop the text job. Install this release. Nothing else to do.
• 1.0.0-rc.107 (medium): A supplier name could add markup to a report's column heading. Install this release. Nothing else to do.
• 1.0.0-rc.107 (medium): Database error text could be shown to company users. Install this release. Nothing else to do.
• 1.0.0-rc.107 (medium): The outbound address guard let some non-public ranges through. Install this release. Nothing else to do.
• 1.0.0-rc.107 (medium): A read-only auditor could change the company's chart template. Install this release. Nothing else to do.
• 1.0.0-rc.107 (medium): Publishing a rota was written before the permission check. Install this release. Nothing else to do.
• 1.0.0-rc.107 (medium): Production accepted a plain http address and the example signing key. Install this release. If the self-check reports either one, correct it as it says.
• 1.0.0-rc.107 (medium): An invitation repeated the name typed in a public form. Install this release. Nothing else to do.
• 1.0.0-rc.107 (medium): A broken byte switched the public forms' spam check off. Install this release. Nothing else to do.
• 1.0.0-rc.107 (medium): The public forms' spam check missed disguised links. Install this release. Nothing else to do.
• 1.0.0-rc.107 (medium): The employee link's cookie still worked after signing out. Install this release. Nothing else to do.
• 1.0.0-rc.107 (medium): Inside's sign-out worked by a plain link and left the device valid. Install this release. Nothing else to do.
• 1.0.0-rc.107 (medium): An invalid sign-up said whether an address has an account. Install this release. Nothing else to do.
• 1.0.0-rc.107 (medium): A second factor on one session passed the extra check on another. Install this release. Nothing else to do.
• 1.0.0-rc.107 (medium): A session with no second factor had no idle limit. Install this release. Nothing else to do.
• 1.0.0-rc.107 (high): A changed key file in a genuine package could replace the key that accepts updates. Install this release. Nothing else to do.
• 1.0.0-rc.107 (high): An uploaded bill original could run a script on the admin address. Install this release. Nothing else to do.
• 1.0.0-rc.107 (high): Four upload paths checked only a file's first bytes. Install this release. Nothing else to do.
• 1.0.0-rc.107 (high): A value in some CSV exports could run as a spreadsheet formula. Install this release. Nothing else to do.
• 1.0.0-rc.107 (high): A person who could only read reports could delete saved reports and accountant packs. Install this release. Nothing else to do.
• 1.0.0-rc.107 (high): A device's branch and a ticket's document could point to another company. Install this release. Nothing else to do.
• 1.0.0-rc.107 (high): Ask my accountant was open to anyone in the company. Install this release. Nothing else to do.
• 1.0.0-rc.107 (high): A locked session could approve an app. Install this release. Nothing else to do.
• 1.0.0-rc.107 (high): A password reset left the apps' access working. Install this release. People sign in to the apps again after their next password reset.
• 1.0.0-rc.107 (high): An accented spelling of an address got around the sign-in lock. Install this release. Nothing else to do.
• 1.0.0-rc.107 (critical): An accounting practice could change another account's company numbers through an onboarding file. Install this release. Nothing else to do.
• 1.0.0-rc.107 (critical): A person with export rights on one company could take the data of all the account's companies. Install this release. Nothing else to do.
• 1.0.0-rc.107 (low): A company's mail server name was checked when saved, not when connected to. Install this release. Nothing else to do.
• 1.0.0-rc.107 (low): A member with no role read cost centres, projects and approval rules. Install this release. Nothing else to do.
• 1.0.0-rc.107 (low): A company's reviewer list named people of the account's other companies. Install this release. Nothing else to do.
• 1.0.0-rc.107 (low): A broken byte in a long field of a public form gave a server error. Install this release. Nothing else to do.
• 1.0.0-rc.107 (low): The spam check passed more spellings of web addresses. Install this release. Nothing else to do.
• 1.0.0-rc.107 (low): The time limit on an unlocked AML form or send link was only in the cookie. Install this release. Open forms ask for the password once more.
• 1.0.0-rc.107 (low): After the idle limit, someone with no PIN could not give the second factor alone. Install this release. Nothing else to do.
• 1.0.0-rc.107 (medium): The sign-up and forgotten password pages sent mail with no robot check on what the page sent. Install this release. Switch on the captcha in Console, Form protection, before the forms reopen.
• 1.0.0-rc.107 (low): The first sign-in lowered the password hash from cost 12 to cost 10. Install this release. Nothing else to do.
• 1.0.0-rc.107 (medium): Sign-in attempts sent together got past the limit of five wrong passwords. Install this release. Nothing else to do.
• 1.0.0-rc.107 (medium): How long an answer took could show whether an address has an account. Install this release. Nothing else to do.
• 1.0.0-rc.107 (medium): An app code from before a password reset still gave a working token. Install this release. People connect their apps again after a password reset.
• 1.0.0-rc.107 (medium): The main AML link could read and replace an invited officer's own answers. Install this release. Nothing else to do.
• 1.0.0-rc.107 (medium): The platform support desk filed an email that failed DMARC as the customer's own ticket. Install this release. Treat email as unproved for account changes.
• 1.0.0-rc.107 (medium): Setting another person's till PIN left no record and worked for anyone. Install this release. A company administrator resets anyone else's PIN.
• 1.0.0-rc.107 (medium): A company on its own Stripe keys could lower the platform fee with an event it signed. Install this release. Nothing else to do.
• 1.0.0-rc.107 (medium): The production self-check passed with no signing key. Install this release. If the self-check reports the key, generate one.
• 1.0.0-rc.107 (medium): Public links wrote into accounts that were moving or had ended. Install this release. Nothing else to do.
• 1.0.0-rc.107 (high): Practice chart templates could be changed and deleted with no permission. Install this release. Check your practice's chart templates if someone without that right may have changed them.
• 1.0.0-rc.107 (high): A person shut out of a client read that client's questions on the practice desk. Install this release. Nothing else to do.
• 1.0.0-rc.107 (high): Counter staff could read the company's books and invoices and close a colleague's till. Install this release. Give anyone who needs the books a role that holds them.
• 1.0.0-rc.107 (medium): A person who manages nobody could publish the company's rota. Install this release. Nothing else to do.
• 1.0.0-rc.107 (high): The careers form had no robot guard and repeated typed names in e-mail. Install this release. Nothing else to do.
• 1.0.0-rc.107 (high): An authenticator secret being set up was handed to every password session. Install this release. If you did not set up your authenticator yourself, set it up again.
• 1.0.0-rc.107 (high): A key limited to one document kind read attachments, previews and disputes of the others. Install this release. Nothing else to do.
• 1.0.0-rc.107 (high): A send link still served a file held by the malware scan. Install this release. Nothing else to do.
• 1.0.0-rc.107 (high): Adding a till, exports, accountant access and connecting an app ran without a fresh second factor. Install this release. Staff confirm with their passkey or code when asked.
• 1.0.0-rc.107 (high): An invitation could bring back a removed person's old account role. Install this release. Check who holds owner and administrator roles on Team.
• 1.0.0-rc.107 (high): A delegated approver could sign in without a second factor. Install this release. People covering such a role set up two-step verification in Settings.
• 1.0.0-rc.107 (high): A partner's connected app could approve documents. Install this release. Nothing else to do.
• 1.0.0-rc.107 (critical): Practice fees read a client's company details past the access rules. Install this release. Nothing else to do.
• 1.0.0-rc.107 (critical): An export asked for by a practice held a company its grant did not name. Install this release. Nothing else to do.
• 1.0.0-rc.107 (critical): Overlapping refund events could record one gateway refund twice. Install this release. Compare recorded refunds with the gateway's statement for payments with an unallocated part.
• 1.0.0-rc.107 (critical): A practice limited to purchase work could take the client's whole-tenant export. Install this release. Review any export packages a practice requested before it.
• 1.0.0-rc.107 (critical): Files added to a signed release package passed the update check. Install this release. Upload packages exactly as they were built.
• 1.0.0-rc.107 (critical): A connected app's token could reach an accounting practice's clients. Install this release. Nothing else to do.
• 1.0.0-rc.103 (low): The team's e-mail about a website request copied what the visitor typed, so a robot could put a link in front of staff. Install this release or a later one. Nothing else to do.