InvoiceShelf

Closes two security issues in the file disk settings and fixes foreign-currency documents on PostgreSQL.

Security

• Any request could pick the file disk the app wrote to for its whole lifetime with a file_disk_id parameter. Only the backup routes choose a disk now. (#873)
• A file disk’s saved credentials could set the storage driver and other internal options. The driver comes only from the disk’s type, which must be one InvoiceShelf supports. (#873)

Fixes

• On PostgreSQL, saving an estimate, invoice, recurring invoice, payment or expense in a foreign currency failed whenever the exchange rate had decimals, with invalid input syntax for type bigint. Amounts converted to the company currency are now rounded to whole cents before they are stored. The exchange rate keeps its decimals. (#798, #861, #863)
• An invoice converted from an estimate now gets its balance in the company currency, and estimate lines take their company-currency tax from the line instead of from the whole estimate. (#861)
• The exchange-rate update for existing documents, which runs after the company currency changes, took each document’s discount from its subtotal and converted taxes twice. It now converts each amount from its own value. (#861)

Upgrade notes

• Documents saved before this release keep the company-currency amounts they were stored with. Saving a document again recalculates them.

Docker: invoiceshelf/invoiceshelf:2.4.6 (also :2.4, :2 and :latest).