<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /></head><body style='font-size: 10pt; font-family: Verdana,Geneva,sans-serif'>
<p><span style="font-weight: 400;">Hello everyone, I’m sure you’ve missed me!</span></p>
<p><span style="font-weight: 400;">I've been with this project for over 12 years, although I'm present here less and less with each day. I'm following closely changes and what is happening here, more out of sentiment than real business benefit.</span></p>
<p><span style="font-weight: 400;">We haven't transferred a single line of Vtiger code to our fork for 5 years. Believe me, this is not something normal, because the license allows it, and our fork had 100% Vtiger files 6 years ago. How can you develop a project for 6 years and not contribute anything valuable to it, so that developers could benefit from it?!?</span></p>
<p><span style="font-weight: 400;">The greatest change over the last 10 years was the update from 5.4 to 6.x when a new GUI was created and a large part of the libraries were updated. Back then, Vtiger did a huge amount of work [I suppose it was a few thousand hours of programming work or even more] and the changes they made at the time were groundbreaking for this project [Vtiger caught up with the changes in PHP and JS technology]. Obviously, version 6.x was not stable, but that's understandable for such significant changes [you can read more on their blog: </span><a href="https://www.vtiger.com/blog/vtiger-crm-open-source-version-6-0-released/"><span style="font-weight: 400;">https://www.vtiger.com/blog/vtiger-crm-open-source-version-6-0-released/</span></a><span style="font-weight: 400;">]. All the changes were so revolutionary for us that we learned from Vtiger how to code.</span></p>
<p><span style="font-weight: 400;">Unfortunately, after the release of 6.x, the project was no longer developed technologically [there were improvements, new functionalities and a new look and feel for the Cloud version, however, the Community version sometimes only had some minor fixes]. All the changes were made only from the frontend side, because the backend was stopped being developed. Novelties in the programming languages [php, js] and the thousands of libraries available for use on GitHub have been ignored. Developers code the same way as 5-10 years ago.</span></p>
<p><span style="font-weight: 400;">Community is a process and takes time, unfortunately, Vtiger discouraged the Community for years and all those willing to develop the system were ignored. This led to some huge mistakes</span></p>
<ol>
<li style="font-weight: 400;"><span style="font-weight: 400;">A few forks were created and each of them weakened the Community [there were probably 4 forks - at least I remember 4]</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">Nobody does core programming - what can be seen on code.vtiger.com is such a small amount of work that one developer can do more in a month than the whole community and Vtiger in a year!</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">There are no language translators, and what we see in Cloud looks like it was translated in Google Translate.</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">The code quality is so low [compared to today's standards] that no new developers join, and if someone joins, they run away very quickly. Because how can they code in files from 10-15 years ago? How can they not use composer and yarn?</span></li>
</ol>
<p><span style="font-weight: 400;">Finally, an extremely bad thing happened and the community ceased to exist and those who stayed stopped demanding, they are satisfied with every crumb they receive. They have become so dependent on Vtiger that removing their module from the Vtiger Marketplace would destroy them financially. There are also members who generally either don't want to or are afraid of changes. The joy and excitement of a handful of people over the recent changes were amazing, Vtiger did nearly nothing but everyone was so happy as if they had received the greatest gift.</span></p>
<p><span style="font-weight: 400;">How can you not have the courage and not say a word for 5-10 years, not to rebel, not to unite as a Community and not force the producer to meet your expectations? And why if the producer does not meet them, you do not create a new solution together? How can you accept bad solutions that affect not only you, your companies but also your customers? You have consciously accepted low quality, no security, no progress. You have become so useless to the project that you have not forced even the smallest significant changes on the producer for 10 years.</span></p>
<p><span style="font-weight: 400;">That’s what you have created together:</span></p>
<ul>
<li style="font-weight: 400;"><span style="font-weight: 400;">The system that introduces nothing new.</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">The system that doesn’t comply with any security standards.</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">The system that is technologically outdated, where neither the producer nor the Community can program at least one new function that complies with the applicable standards.</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">The system with no Community and no future.</span></li>
</ul>
<p><span style="font-weight: 400;">Everything the Community is able to say right now is silent requests for the same changes that you asked for a year ago, two years ago, five years ago, or ten years ago. As if the last 10 years have taught you nothing. And you will probably wait for the next 2-3 years to receive maybe 5% of what could be done with one developer.</span></p>
<p><span style="font-weight: 400;">Is there at least one developer in the Community who is aware of what stage this project is at? Do you think that if you don't have libraries organized using composer and yarn, you can't see what's inside? Today, I downloaded the latest version of VtigerCRM and that’s what I found in 4 hours:</span></p>
<ul>
<li style="font-weight: 400;"><span style="font-weight: 400;">~ 99% libraries in Vtiger are outdated [below are the first 40 I found, and there are around 150 of them]. This means that this system has never passed ANY security audit. Because if it did, the report would have 150 libraries to update!</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">~ 20% of libraries have known security vulnerabilities [below is a list of those that I found in these 4 hours], and some of these vulnerabilities have been around for over 5 years. There is such a mess in the libraries that often one library appears in the system in 5 different versions and in different folders without any control.</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">~ 50% of libraries are so outdated that they should be removed from Vtiger. Most of them have not been updated in over 5 years, a large part of the libraries no longer exist or have been replaced with others. There are libraries that are 10-12 years old and their code is structured!</span></li>
</ul>
<p><span style="font-weight: 400;">There are hundreds of security errors in the application, it is possible to access any records without permissions, there are unlimited brute force attacks, there is no information about performing unauthorized operations, no 2FA, there are hundreds of SQL injections and XSS. Obviously, I'm aware of the fact that every application has security bugs, but here I'm talking about ignoring security for the last 10 years. Currently, VtigerCRM does not comply with any of the requirements described in OWASP ASVS 4!</span></p>
<p><span style="font-weight: 400;">Obviously, Vtiger can write whatever they want on the website, e.g .:</span></p>
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">
<p><em><span style="font-weight: 400;">Engineering practices</span></em></p>
<p><em><span style="font-weight: 400;">Engineering teams follow secure coding guidelines, as well as manual review/ screening of the code before it is deployed in the production.</span></em></p>
<p><em><span style="font-weight: 400;">The secure coding guidelines are based on OWASP standards and implemented accordingly to protect against common threats and attack vectors (like SQL injection,Cross site scripting) within the application layer.</span></em></p>
<p><span style="font-weight: 400;">but the truth is that every lie has no legs and if we know how to crack any protection in Vtiger open source and cloud along with extracting data without logging into the system, it doesn't take much time for others to find the same.</span></p>
</blockquote>
<h2><strong>Outdated libraries</strong></h2>
<ul>
<li style="font-weight: 400;"><span style="font-weight: 400;">PHPMailer 5.2.27 > 6.1.7 [support finished with 5.2.x ]</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">reCAPTCHA [chyba w wersji 1] - abandoned library</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">simplehtmldom 1.5 > 1.9.1 - library has 8 years</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">Zend Framework 1.12.0rc4 > 3.0.0 - library has 8 years</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">KCFinder 2.21 > 3.12- library has over 10 years</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">Anchorme.js 0.6.0 > 2.1.1 - library has over 3 years</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">Moment.js 2.8.1 / 2.10.3 > 2.28.0 - library has over 6 years</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">Daterangepicker.js 1.3.17 > 3.1 - library has over 6 years</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">Bootstrap Notify 3.0.2 > 3.1.3 - library has over 5 years</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">jQuery v1.11.2 / 1.7 / 1.3.2 > 3.5.1 - library has over 11 years</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">FullCalendar 1.5.3 / 3.1.0 > 5.3.2 - library has over 8 years</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">Gridster.js - 0.1.0 / 0.5.6 > 0.7.0 - library has over 8 years</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">Handsontable 0.7.0-beta / 0.15.1 > 8.0.0 - library has over 8 years</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">ZeroClipboard 2.2.0 > 2.3.0 - library has over 6 years</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">jQuery UI 1.11.3 / 1.8.16 > 1.12.1 - library should be replaced with a more developed one</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">jQuery Validation Plugin 1.13.1 > 1.19.2- library has over 6 years</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">instaFilta 1.4.4 - library not developed for 5 years</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">perfect-scrollbar 0.6.5 > 1.5.0 - library has over 3 years</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">select2 3.2 / 3.4.8 - 4.0.13 - library has over 6 years</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">jquery-timepicker 1.8.1 > 1.13.14 - library has over 5 years</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">webui popover plugin 1.1.3 - library not developed for 5 years</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">jQuery Migrate 1.0.0 > 3.3.1 - library not developed for 5 years</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">Bootstrap 3.3.0 > 4.5.2 - library has over 6 years</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">ADOdb 5.20.9 > 5.20.18 - library has over 4 years</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">Google-api-php-client 1.1.1 > 2.7.1 - library has over 6 years</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">HTML Purifier 4.10.0 > 4.13.0 - library has over 2 years</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">HTTP_Session 0.5.6 - abandoned library, it is over 13 years old</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">HTTP_Session2 0.7.3 - abandoned library, it is over 10 years old</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">Jasny Bootstrap 3.1.3 > 4.0.0 - library has over 6 years</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">BxSlider v4.1 > 4.2.14 - library has over 8 years</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">Chosen 0.9.5 > 1.8.7 - library has over 9 years</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">CKEditor 4.3.1 > 4.15 - library has over 7 years</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">jQueryGantt 1.0 > 6.3 - library has over 6 years</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">Sticky Plugin v1.0.0 > 1.0.4 - library has over 6 years</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">jqPlot Charts 1.0.2 > 1.1.0 - library has over 10 years</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">LazyYT 0.3.0 > 0.3.4 - library has over 6 years</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">Nusoap 1.94 > library has over 15 years</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">PHPExcel 1.7.7 > PhpSpreadsheet > library has over 8 years</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">PHP Markdown 1.4.1 > 1.9.0 - library has over 6 years</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">Smarty 3.1.7 > 3.1.35 - library has over 9 years</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">Tcpdf 4.6.012 > 6.3.5 - library has over 11 years</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">+110 other libraries for which I didn’t have time</span></li>
</ul>
<h2><strong>Security</strong></h2>
<ul>
<li style="font-weight: 400;"><span style="font-weight: 400;">Numerous security vulnerabilities to the old version of Zend Framework and dozens of related libraries - </span><a href="https://www.cvedetails.com/vulnerability-list/vendor_id-5025/product_id-24644/version_id-142145/Zend-Zend-Framework-1.12.0.html"><span style="font-weight: 400;">https://www.cvedetails.com/vulnerability-list/vendor_id-5025/product_id-24644/version_id-142145/Zend-Zend-Framework-1.12.0.html</span></a><span style="font-weight: 400;">] </span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">Security vulnerabilities for the old version of KCFinder - </span><a href="https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=KCFinder"><span style="font-weight: 400;">https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=KCFinder</span></a><span style="font-weight: 400;"> </span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">Security vulnerabilities for the old version of Moment.js - </span><a href="https://www.cvedetails.com/vulnerability-list/vendor_id-16043/Moment-Project.html"><span style="font-weight: 400;">https://www.cvedetails.com/vulnerability-list/vendor_id-16043/Moment-Project.html</span></a><span style="font-weight: 400;"> </span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">Security vulnerabilities for old version of jquery - </span><a href="https://www.cvedetails.com/vulnerability-list/vendor_id-6538/product_id-11031/Jquery-Jquery.html"><span style="font-weight: 400;">https://www.cvedetails.com/vulnerability-list/vendor_id-6538/product_id-11031/Jquery-Jquery.html</span></a><span style="font-weight: 400;"> </span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">Security vulnerabilities for old version of jquery ui - </span><a href="https://www.cvedetails.com/cve/CVE-2016-7103"><span style="font-weight: 400;">https://www.cvedetails.com/cve/CVE-2016-7103</span></a></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">Security vulnerabilities for old version of select2 - </span><a href="https://github.com/select2/select2/issues/4587"><span style="font-weight: 400;">https://github.com/select2/select2/issues/4587</span></a><span style="font-weight: 400;"> </span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">Security vulnerabilities for old version of jQuery Migrate - </span><a href="https://snyk.io/vuln/npm:jquery-migrate"><span style="font-weight: 400;">https://snyk.io/vuln/npm:jquery-migrate</span></a></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">Security vulnerabilities for the old version of Bootstrap - </span><a href="https://www.cvedetails.com/vulnerability-list/vendor_id-19522/product_id-51406/Getbootstrap-Bootstrap.html"><span style="font-weight: 400;">https://www.cvedetails.com/vulnerability-list/vendor_id-19522/product_id-51406/Getbootstrap-Bootstrap.html</span></a></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">Security vulnerabilities for the old AdoDB library - </span><a href="https://github.com/ADOdb/ADOdb/blob/v5.20.7/docs/changelog.md"><span style="font-weight: 400;">https://github.com/ADOdb/ADOdb/blob/v5.20.7/docs/changelog.md</span></a><span style="font-weight: 400;"> </span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">Security vulnerabilities for old CKEditor library - </span><a href="https://www.cvedetails.com/vulnerability-list/vendor_id-12058/Ckeditor.html"><span style="font-weight: 400;">https://www.cvedetails.com/vulnerability-list/vendor_id-12058/Ckeditor.html</span></a><span style="font-weight: 400;"> </span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">Security vulnerabilities for old Smarty library - </span><a href="https://www.cvedetails.com/vulnerability-list/vendor_id-2921/product_id-5111/Smarty-Smarty.html"><span style="font-weight: 400;">https://www.cvedetails.com/vulnerability-list/vendor_id-2921/product_id-5111/Smarty-Smarty.html</span></a></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">Security vulnerabilities for old tcpdf library -</span><a href="https://www.cvedetails.com/vulnerability-list/vendor_id-16116/product_id-35979/Tcpdf-Project-Tcpdf.html"><span style="font-weight: 400;">https://www.cvedetails.com/vulnerability-list/vendor_id-16116/product_id-35979/Tcpdf-Project-Tcpdf.html</span></a><span style="font-weight: 400;"> </span></li>
</ul>
<p><span style="font-weight: 400;">Only some known vulnerabilities are listed above, but there are many more of them, and they are often described on less-known blogs or forums.</span></p>
<p><span style="font-weight: 400;">Have a look at jquery, which can be found in different versions in various places of the system, and several dozen plugins are loaded along with the main library. The plugins are also in different versions, and ready-made CVEs can be found for many of them.</span></p>
<div>--<br />
<div class="pre global">
<div style="padding: 0px 5px;">
<div style="font-family: Tahoma, Geneva, sans-serif; font-size: 12.5px; color: #01374d; font-weight: 200;">Kind regards</div>
<div style="padding-top: 7px; font-family: Tahoma, Geneva, sans-serif; font-size: 21.67px; color: #01374d; font-weight: bold;"><span style="font-size: 12pt;">Błażej Pabiszczak</span></div>
<div style="padding-top: 4px; font-family: Tahoma, Geneva, sans-serif; font-size: 14.17px; color: #93cfd8; font-weight: bold;">CEO & Co-Founder at YetiForce</div>
<div style="padding-top: 8px; font-family: Tahoma, Geneva, sans-serif; font-size: 10px; color: #01374d; font-weight: 400;"><span style="margin-right: 6px;"><a style="color: #01374d; text-decoration: none;">+48 884 999 123</a></span> | <span style="margin-left: 6px;"> <a style="color: #01374d; text-decoration: none;">b.pabiszczak@yetiforce.com</a></span></div>
<div style="padding-top: 6px; padding-bottom: 11px;"><a style="font-family: Tahoma, Geneva, sans-serif; font-size: 10px; color: #01374d; font-weight: bold; text-decoration: none;">www.yetiforce.com</a></div>
<div style="width: 70px; height: 4px; background: #ebebeb;"> </div>
</div>
</div>
</div>
<p>W dniu 2020-09-11 07:58, Uma S napisał(a):</p>
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0"><!-- html ignored --><!-- head ignored --><!-- meta ignored -->
<div dir="ltr">Dear Developer,
<div> </div>
<div>
<div>We are happy to accept more ideas from the community on what are the top 10 wish enhancements for 7.4? So that we can make the release fruitful.</div>
<div> </div>
<div>I would request all the community members to take part in this to share their thoughts.</div>
<div> </div>
-- <br />
<div class="gmail_signature" dir="ltr">
<div dir="ltr">With<br />Best Regards<br />Uma.S<br />
<div>Vtiger Team</div>
</div>
</div>
</div>
</div>
<br />
<div class="pre" style="margin: 0; padding: 0; font-family: monospace">_______________________________________________<br /> <a href="http://www.vtiger.com/" target="_blank" rel="noopener noreferrer">http://www.vtiger.com/</a></div>
</blockquote>
</body></html>