06.22.05-00
Improvements
Sync the delta changes of tasks/dates for booking lines having Timesheets. (R2-18515)
Rolling out new Labor with refreshed UI/UX...
A product's UI is the gateway to deliver the functionality and business logic it intends to offers to its users.
Thus, in our relentless efforts to make the R2 Labor' UI/UX more user-centric, we have brought in some exciting and appealing changes to the fonts and color-schemes with the new Labor.
Lets take a look at what R2Labor with refresh UI/UX offers:
Widgets on home page have been re-arranged to give larger viewport to Calendar.
Entire UI is now re-designed in dual-tone color theme (Blue and White).
Grids with white background and no cell borders to focus more on the data legibility.
More seamless and fluid look to the UI by eliminating unnecessary borders.
Modified font family for better readability.
No more need for branding since UBS logo is removed.
You can update multiple booking lines EWT through 'Assign Dates' action. Know more? Functionality to update EWTs from 'Update lines' action is no longer supported.
Most importantly, we have replaced the dreadful floating bar with something simple — a 'pencil icon' .[!]
Click on the 'Pencil Icon' [!] now brings up an 'Actions' pop-over .
The pop-over displays all the 'actions' arranged in alphabetical order.
With the new refreshed UI/UX, there was no need to have multiple themes. Now we have a standard theme to make it uniform across all the product suite.
CRM is now offered as a separate next generation web tool, no longer a part of R2labor. Click here to know more.
Bug Fixes
SR-8585 — 'Booking view' screen for crew in R2Labor, does not display relevant information.
SR-8875 - When running the custom report ‘Crew Callsheet’ from within the custom report wizard, system mismatches the date-time format between two fields.
SR-8412 — Replies from Crew on Availability Request / Confirmation Request /Job Information not visible from within R2 Labor.
SR-5493 — Update Pay Policy script incorrectly overrides the line amount of booking lines having fixed unit to $0.
SR-8823 — The Purchase Order Email template does not display the Transaction Currency as expected.
Improvements
The response of the Asset PUT method returns the entire object.
When a new object is created or an existing one is update through an API, the system will now return the entire object along with all the values that were entered.
This is very similar to when upon submitting an online form, it is displayed back to the user for validation purpose that all entered values were captured correctly, and there are no typographical or syntactical error.Remediating WSO2 Critical vulnerability CVE-2022-29464.
CVE-2022-29464 vulnerability is an unauthenticated unrestricted arbitrary file upload which allows unauthenticated attackers to gain RCE on WSO2 servers via uploading malicious JSP files.
The vulnerable upload route is
/fileuploadwhich is handled byFileUploadServlet servlet.. This is unprotected route by IAM as it can be seen inindentity.xmlconfiguration file.In simple conversational verbatim - Due to improper validation of user input, a malicious actor could upload an arbitrary file to a user controlled location of the server. By leveraging the arbitrary file upload vulnerability, it is further possible to gain remote code execution on the server.
For our R2 deployment, following products are affected:
R2 API
R2 Labor
R2 NG-CRM
As an immediate mitigation step, we have added the necessary lines of code to the file <product_home>/repository/conf/deployment.toml>
Updated file has been packaged in the current release.