On the price security issue .. my intention was to have two levels of price security - one that allows changes to the price on the sales order entry and the other level that allows changes to the prices in the Prices.php script - which are permanent price alterations. This does use a hard coded security token... and has done for quite a while.
I was envisaging a senior customer services person having permission to alter a price on a sales order entry, but junior ones not. It is clearly unworkable to have only the pricing administrator with permission to over-ride prices at sales order entry time - unless that person is the same as the order entry clerk! However, our security system is geared around scripts and we don't have a script for this. I think maybe I need to make up a dummy script for "SeniorOrderEntry" and add this to the scripts table - although it doesn't actually exist!! It would solve the problem Tim describes though. Currently if the hard coded PageSecurity token is deleted then this causes problems for the current code.
There was discussion around this on the developers mailing list at the time.
Clearly there are differences between some of the things I am saying and those Tim is saying.... there can be only one explanation of course. It should be noted that Tim now has several forks and I guess his motives might be to discredit webERP or me - I am really not sure. I have documented and put up the full story up at
http://www.logicworks.co.nz/TimSchofieldDispute.html which gives the full facts around this ongoing nonsense.
