version-6.4.0

docusaurus.config.js

@@ -37,7 +37,14 @@ module.exports = {
 					},
 					// editUrl: 'https://github.com/YetiForceCompany/YetiForceDoc/edit/main/',
 					showLastUpdateAuthor: false,
-					showLastUpdateTime: true
+					showLastUpdateTime: true,
+					versions: {
+						current: {
+							label: 'Stable',
+							path: ''
+						}
+					},
+					lastVersion: 'current'
 				},
 				theme: {
 					customCss: [require.resolve('./src/css/custom.css')]
@@ -111,7 +118,8 @@ module.exports = {
 
 				{ label: 'yetiforce.com', position: 'right', href: 'https://yetiforce.com/' },
 				{ label: 'GitHub', position: 'right', href: 'https://github.com/YetiForceCompany/YetiForceCRM' },
-				{ type: 'localeDropdown', position: 'right' }
+				{ type: 'localeDropdown', position: 'right' },
+				{ type: 'docsVersionDropdown', position: 'right' }
 			]
 		},
 		matomo: {

i18n/pl/docusaurus-plugin-content-docs/version-6.4.0/1-introduction/1-requirements/1-modsecurity-issues.md

@@ -0,0 +1,60 @@
+---
+title: Fałszywe pozytywne wyniki analizy YetiForce przez ModSecurity
+keywords:
+  - serwer
+  - wymagania
+  - systemu
+  - YetiForce
+  - ModSecurity
+tags:
+  - serwer
+  - wymagania
+  - systemu
+  - ModSecurity
+description: Jakie występują problemy w działaniu systemu YetiForce z ModSecurity
+---
+
+W domyślnej konfiguracji ModSecurity nie działa prawidłowo z systemem YetiForce, co skutkuje wykryciem fałszywie pozytywnych wyników, czyli znalezieniem podatności, które faktycznie nie istnieją.
+
+## Przykłady błędów
+
+### KaTeX parse error: Can't use function '$' in math mode at position
+
+```
+[Tue Oct 19 12:46:31.419489 2021] [:error] [pid 3665031] [client 10.0.1.2:53070] [client 10.0.1.2] ModSecurity: Warning. Pattern match "(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|\\\\$\\\
+
+KaTeX parse error: Can't use function '$' in math mode at position 6: |\\\\$̲\\\\(\\\\(|`|\\...
+)\\\\s(?:{|\\\\s\\\
+KaTeX parse error: Got function '\newline' with no arguments as superscript at position 1: \̲n̲e̲w̲l̲i̲n̲e̲
+
+\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"](?:l[\\\\\\\\'\\"] ..." at ARGS:historyUrl. [file "/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "123"] [id "932100"] [msg "Remote Command Execution: Unix Command Injection"] [data "Matched Data: &history found within ARGS:historyUrl: index.php?module=Calendar&view=CalendarExtended&history=true&viewType=month&start=2021-09-27&end=2021-11-06&user=22&time=current&cvid=undefined&hiddenDays=0,6"] [severity "CRITICAL"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "OWASP_CRS"] [tag "OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION"] [tag "WASCTC/WASC-31"] [tag "OWASP_TOP_10/A1"] [tag "PCI/6.5.2"] [hostname "yetiforce.example.com"] [uri "/index.php"] [unique_id "YW6iB-TmEYx0Wwg3C6b1hwAAAAk"]
+
+```
+
+### Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score
+
+```
+[Tue Oct 19 12:46:31.425358 2021] [:error] [pid 3665031] [client 10.0.1.2:53070] [client 10.0.1.2] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "91"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "yetiforce.example.com"] [uri "/index.php"] [unique_id "YW6iB-TmEYx0Wwg3C6b1hwAAAAk"]
+```
+
+### Operator GE matched 5 at TX:inbound_anomaly_score.
+
+```
+[Tue Oct 19 12:46:31.425742 2021] [:error] [pid 3665031] [client 10.0.1.2:53070] [client 10.0.1.2] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf"] [line "86"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [tag "event-correlation"] [hostname "yetiforce.example.com"] [uri "/index.php"] [unique_id "YW6iB-TmEYx0Wwg3C6b1hwAAAAk"]
+```
+
+## Adres nie zawiera ataku `Remote Command Execution: Unix Command Injection`
+
+Parametr `historyUrl` zawiera adres URL: "index.php?module=Calendar&view=CalendarExtended&history=true&viewType=month&start=2021-09-27&end=2021-11-06&user=22&time=current&cvid=undefined&hiddenDays=0,6", a nie polecenie powłoki `Remote Command Execution: Unix Command Injection`.
+
+## Nie zalecamy aby skrypty PHP były w stanie wywoływać funkcje do powłoki systemu operacyjnego
+
+W [`Konfiguracja systemu → Logi → Serwer - konfiguracja`](/administrator-guides/logs/server-configuration/) można zweryfikować, czy zostały wyłączone niebezpieczne funkcje (między innymi do wykonywania poleceń powłoki systemu):
+
+```ini
+disable_functions = pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,shell_exec,exec,system,passthru,popen
+```
+
+Dlatego nie ma ryzyka, jeśli serwer jest poprawnie skonfigurowany.
+
+## Każde dane wejściowe są odpowiednio weryfikowane pod kątem dozwolonych wartości i znaków

i18n/pl/docusaurus-plugin-content-docs/version-6.4.0/1-introduction/1-requirements/2-database-performance.md

@@ -0,0 +1,57 @@
+---
+title: Database performance
+description: This article does not describe the configuration procedures, but highlights a few crucial points in optimizing a server environment.
+keywords:
+  - serwer
+  - database
+  - wydajność
+  - YetiForce
+tags:
+  - database
+  - wydajność
+hide_table_of_contents: true
+preview: 2-database-performance.jpg
+---
+
+![2-database-performance.jpg](2-database-performance.jpg)
+
+A proper configuration of the database server is an important element within the system implementation process. This article does not describe the configuration procedures, but highlights a few crucial points in optimizing a server environment. These guidelines are not mandatory, they are suggestions that result from many years of experience within the IT environment:
+
+1. Your friends are: vmstat / dstat, iostat, top, ps and any graphical history of values.
+2. Define the bottleneck (read/write, memory, CPU, network). How? Refer to point 1.
+3. Server optimization according to the process: problem analysis > consideration > change (only one change a time) > test > implement > begin the process again until you achieve satisfactory / optimal results.
+4. Hardware
+
+   - Recommended to use RAID 10 (RAID 5 may not be sufficient).
+   - In most cases, the speed of CPU is the bottleneck, not the number of cores. It is a good idea to invest in faster CPUs.
+   - Use standard 1Gbit everywhere you can (in particular to connect application server to database server).
+   - Use drives with large cache (and protect it appropriately).
+   - Do not use virtualization for database servers!
+
+5. Software
+
+   - Use optimal systems (SLES, RHEL, Debian, CentOS).
+   - Use 64-bit architecture.
+   - Use the most up-to-date stable versions (kernel >= 2.6.12).
+   - Use mainstream file system, e.g. ext3, xfs.
+   - Not necessary to modify your operating system, because it is already optimal!
+   - Use a thread cache from your operating system.
+
+6. Database
+
+   - The big three (key_buffer_size, innodb_buffer_pool_size, innodb_log_file_size).
+   - Do not modify anything, unless you know what it is for. Use ready-made configuration templates, which establish a proper database optimization. Ask a specialist for advice!
+   - Unconditionally use InnoDB! (and the optimization for this engine).
+   - Monitor slow queries to optimize them.
+
+7. Application
+   - Index
+     - All attributes where you JOIN.
+     - All attributes where you filter (WHERE).
+     - All attributes where you ORDER or Group BY.
+     - All attributes where you do an Index Scan.
+   - Order
+     - Index elements only from left to right.
+     - For compound indexes, e.g. INDEX (a, b), INDEX (a,b(10)).
+
+The server optimization can increase the application speed up to 2x, the application optimization can increase the application operation up to 10x.

i18n/pl/docusaurus-plugin-content-docs/version-6.4.0/1-introduction/1-requirements/3-apache-500-internal-server-error.md

@@ -0,0 +1,38 @@
+---
+title: Apache 500 - Internal Server Error
+description: It is a common scenario for people responsible for installation, updates, and implementation of the system to receive error 500 in the browser.
+keywords:
+  - Server
+  - Apache
+  - Internal
+  - Error
+  - 500
+  - YetiForce
+tags:
+  - Error
+---
+
+It is a common scenario for people responsible for installation, updates, and implementation of the system to receive **error 500** in the browser. The first thing to understand is that this type of error isn’t an application error, but an http server error. However, it doesn't mean the application itself cannot cause the problem, but it means that the http server knows why this error appeared. Therefore, the most important information is why the http server displays the error. Read the following information to learn more about the error:
+
+## Enable http server logs and determine what causes the error
+
+- If you can’t see anything relevant in the logs - you will have to enable more detailed http server logs. Error 500 is a server error, and therefore the server knows best why the error is displayed.
+- If you don’t know how to enable logs - you should ask your server administrator to do it for you, or contact the server provider support.
+- YetiForce application logs may include a hint why the problem occurs, but you should mostly focus on what the server logs show.
+
+## The most common causes of error 500
+
+- **temporarily exceeding security services parameters**, including the scripts run by www. You can try to undo the last changes performed in www service, disable scripts/applications that can significantly burden the server.
+- **exceeding the timeout parameter for the server**. You can solve the problem by modifying scripts, so that their execution time doesn’t exceed the service safety parameters.
+- **misconfigured file and directory permissions**. You can change CHMOD, for example while connecting to the FTP server.
+- **incorrect entries in the .htaccess file**. You can solve the problem by removing or fixing incorrect directives, for example syntax errors, or calling options unavailable on the server.
+
+## How can the YetiForce team help you to solve this problem?
+
+This error is server-specific and requires an analysis of server logs, therefore the YetiForce team can only help you solve this problem directly if you purchase support hours available in [our store](https://yetiforce.com/en/marketplace/support.html).
+
+## How can the community help you solve this problem?
+
+If you submit a ticket in the [Issue tab](https://github.com/YetiForceCompany/YetiForceCRM/issues) of our GitHub repository, you can try to solve the problem together with the community. Remember to include the http server logs, because if you don’t provide them, identifying the problem will be hardly possible.
+
+If you find an error message and you have no clue what to do with it, you should ask the operating system administrator to conduct an analysis, or research the problem on the Internet on your own. Our team can only offer advice as far as configuration and development of the YetiForce system is concerned. When it comes to assistance with server issues, we recommend contacting companies who specialize in this area. We have Linux server specialists, but they support us in the development of the product, and they also help us during the implementation of paid projects.