In our endeavor to make OrangeHRM a highly secure enterprise application, we’ll soon be releasing a patch (2.5.0.5) for the latest stable version of OrangeHRM, with a few security improvements. We’re thankful to our community and various organizations that continue to test OrangeHRM and bring existing issues to our attention. We’re committed to fix these issues as soon as possible, and continue to improve the level of security in OrangeHRM.

The following bugs have been reported, and our development team is now fixing them:

• 3003346     Potential SQL injection vulnerability with ess login
• 3001611     Ess module is vulenerable to xss
• 3003358     Possible CSRF and PHP code injection
• 3003361     Not sanitized ajax reponses leads to XSS vulnerability
• 3000555     Sanitize the input data in jobs.php

We will soon make the fixes available with OrangeHRM 2.5.0.5.

In addition to security testing performed by external organizations, we’ve internally formed a security testing team, who will continue to test each new version of OrangeHRM thoroughly for possible security flaws.

We’ll be posting updates about our progress on this blog.

A performance evaluation is a stressful time for a manager. With the OrangeHRM performance module we make performance evaluation a walk through the park. While ensuring accurate reviews this new module will save a great deal of money and time.

Although this module was not introduced to OrangeHRM earlier many organizations around the world like DUKE NUS - Singapore, The ORS Group - Australia and CIM Technologies - USA use performance modules designed by OrangeHRM to suit each of these companies requirements.

This module will be released with the next stable version OrangeHRM 2.6. Development teams at OrangeHRM are working hard to release 2.6 by the end of March 2010.

A beta version will be released during the first week of March 2010.

OrangeHRM 2.5-alpha.8 development release is now available. The punch in/out feature which was combined with timesheets, is now separately available as “Attendance Tracking” with a new attendance report. Take a peek at this new behavior.

Download OrangeHRM 2.5-alpha.8 from here.

OrangeHRM 2.5-alpha.5 development release is now available with more user interface bug fixes in Admin and Leave modules.

Click here to download OrangeHRM 2.5-alpha.5

Of all requests for new features in OrangeHRM, 46.4% have been for an Employee Performance Review module. Now we have started the requirements phase of this long awaited module. You can also help us define this module by telling us what you would like to see in OrangeHRM Performance Review module by spending a few minutes to take the following survey.

Click here to take survey.

In an attempt to improve the usability of OrangeHRM, we have made it possible to expand and collapse the job description in a vacancy. This improvement is available in OrangeHRM-2.5-alpha.3 development release.

The full list of changes in OrangeHRM-2.5-alpha.3:

New Features
(1) Expand/Collapse feature in job descriptions at jobs.php (1941287 - On the job vacancies web page job desc. expand and collapse)
(2) Replacing capability in attached resumes.

Bug Fixes
(1) 2047767 - Code is not able to detect Innodb support

Download OrangeHRM-2.5-alpha.3 from here.

OrangeHRM 2.5-alpha.2 development release is now available to download from SourceForge.

The following enhancements are there in this release:
(1) Ability to upload a resume with a job application
(2) IE7 Compatibility related bug fixes
(3) Other UI fixes to conform to new UI look

Download OrangeHRM 2.5-alpha.2 from here.

OrangeHRM has released the first alpha version of the much awaited OrangeHRM 2.5, which has the new look user interface.

The user interface was designed with the intentions of making the product look more professional and making it more user friendly.

Download OrangeHRM 2.5-alpha.1 from here.

See: related post

The first stable version of OrangeHRM 2.4.1, which has an automated upgrader is now available to download from SourceForge.

Download OrangeHRM 2.4.1 from here.

Click here to see the release notes.

A number of users of OrangeHRM have asked us what’s next in OrangeHRM. This post is an attempt to give you an overview of what’s being developed now.

OrangeHRM 2.4.1 - The main feature is an automated upgrader. The beta releases are already out. We will soon be able to make a 2.4.1 stable release.

OrangeHRM 2.5 - Development has started. An early release will be available in January 2009. The main features are:
(1) New look of OrangeHRM. Improved look and feel of the OrangeHRM user inteface based on community feedback.
(2) Separation of Project Time and Punch In/Out features.
(3) Ability to attach a resume with a job application by an applicant.

Performance Evaluation Module - Requirements gathering is in progress. If you have any suggestions about what features this module should include, please send your suggestions to info@orangehrm.com. The target for implementation is Q2, 2009.