Openstamanager Laravel Package

Getting Started

• Read the beta banner first: v2.11.1-beta is explicitly not production-ready. Start on the latest stable (v2.11.0) and treat this beta as a staging-only candidate until it goes GA.
• Install/upgrade via your usual path (composer require or pulling the new Docker image), publish config, run migrations, and confirm the "Stato dei servizi" page reports hooks enabled correctly (the disable-hooks typo fix lands in this release).
• Where to look first: the plugin/hooks documentation, the mail-template settings, the API/OAuth2 configuration screen, and the CSV import/export helpers. These are the surfaces where most day-to-day work happens.
• First good use case: stand up a minimal tenant and exercise the fatture elettroniche import → righe articoli → PDF pipeline, plus an interventi → contratti → riepilogo stampa flow. That single loop touches FE import, articles query, PDF/mPDF, mail sending, and location scoping.

Implementation Patterns

• Location (sedi) scoping everywhere. This release fixes "gestione giacenze sedi in base ai permessi" and "visualizzazione limitata alle sedi abilitate". Treat sedi as a first-class scope: always filter lists, stock (giacenze), and plugin views (movimenti) by the caller's enabled locations. Don't rely on UI-only filtering — enforce it in queries.
• Hooks over forks. Use the hooks/plugin system (Stato dei servizi) for customizations instead of patching core files. The typo that blocked disabling hooks is fixed, so you can now reliably toggle custom logic per deployment.
• Plugin registration. Register custom plugins (e.g. movimenti-style views) with explicit location + permission metadata, and verify both the list rendering and the underlying query respect scope.
• Mail as a template-driven flow. Configure CC/BCC and reply-to at the template level; verify per-tenant overrides. Test every send path: the modal send button, company-level send, attachment selection, and the "indirizzo di risposta" handling.
• CSV round-trip. For article photos, contact imports, and FE imports, validate: escaping (fputcsv legacy escape), the preview rendering of cell values, and the actual persisted row. Re-run imports against MariaDB and MySQL, since article view queries were fixed for MariaDB compatibility.
• PDF generation. Sanitize HTML and restrict image URLs before handing to mPDF. Treat PDF generation as an untrusted-input boundary (the SSRF fix via <img> tags is the pattern to keep out of your own custom templates).
• OAuth2/API integrations. When you build API consumers or AppResource clients, verify record-level authorization on every endpoint — this beta closes multiple IDORs in API and OAuth2 surfaces, which means prior versions don't enforce them.
• Bulk actions. Group deletes of anagrafiche and VAT-line edits from bulk views are supported; wrap them in transactions and re-check permission and relation-lock behavior before deletion.
• Docker. Rebuild from the fixed image creation flow if you ship containers; validate multi-stage build and PHP version alignment (including <= 8.5 compatibility).

Gotchas and Tips

• Do not ship the beta. The release notes state it plainly. Pin to stable and schedule the GA upgrade once the security backports land — the list here implies prior versions are substantially vulnerable.
• Assume the CVEs matter. RCE in Configuration Wizard, multiple IDORs, SQLi in ajax_select.php and the zip-attachments action, stored/reflected XSS, SSRF in PDF generation, and settings-API authorization — audit any custom code that re-implements or bypasses these paths. Fixes in core don't protect custom endpoints.
• PHP <= 8.5 fputcsv escape. Audit your own CSV exports; the legacy escape argument is deprecated/changed. Match core behavior or you'll break exports on newer runtimes.
• MariaDB article view. If you run MariaDB, test the article listing after upgrade — the fix is engine-specific and may reveal prior duplicate/ordering quirks in your custom queries.
• Duplicate rows in list views. The "order by that wraps lines" fix implies pagination + multi-line order clauses were mishandled. Verify custom list queries for row duplication and stable pagination.
• Hooks disable path. Because the typo blocked disabling, deployments may have hooks stuck on. Re-check after upgrade and clean up any workarounds.
• protobufjs bump. If you vendor frontend bundles or use protobuf elsewhere, regenerate lockfiles and re-run the FE import path — dependency drift is a common silent break.
• Email edge cases. Reply-to, CC/BCC from templates, the modal send button, and attachment selection each have their own fix. Test separately; a green "send" in one path doesn't cover the others.
• Signatures. GDPR and Interventions signature errors are fixed — validate both flows again, especially on mobile/light theme.
• Extension points to lean on: hooks, plugins, mail templates, CSV importers, and the AJAX select endpoints. Extend through these rather than editing core; and when you do add endpoints that echo options back into JavaScript, escape them.
• Debugging: start at the "Stato dei servizi" panel, then the application log, then the mail log, then the Docker build log. Most of the fixed items surface as either a service-status toggle, a mail delivery gap, or a build failure.