highoncarbs / hafta

💸 Settle payrolls faster with Hafta.

New version under active development , checkout alpha branch.

Dead Simple way to manage Payrolls and performance of your employees
Built with Indian businesses , for Indian businesses

---

Built to help ease payrolls for Manufactoring segment of Indian Businesses specifically. Feel free to make changes to your needs .

Features

• Manage your employees , handle their advances , attendence and payroll with ease.
• HR tools to check performance of employees, add quick incident reports.
• Add basic data with Masters , allows for quick and easy customization.
• Check and allow advances to your employees .Set limits to number of times and amount allowed for each employee.

Setup & Running

NOTE: You'll need to use python3.

To install requirements :

pip install -r requirements.txt

Hafta uses MySQL as a backend , but you are free to use any. Just change the the Database URI in config.py

python ./run.py

Issues and Requests

For any issue or requests , please use Github Issues.

Projects Used

• Bulma
• Vue.js
• SQLAlchemy
• Buefy
• Flask
• Albemic

License

This project is licensed under the MIT License.

hafta's Issues

able to save the data in DB but not showing up at UI.

Conflict Versions

Conflict in the versions of lazy object proxy astroid, need to update the version in requirements.txt

Hardcoded secret key

Hello Hafta developers,

We are a cybersecurity research group from the CISPA Helmholtz Center for Information Security and Ca’ Foscari University of Venice. We recently conducted an analysis of the session management used in your web application as part of our research. We have discovered a security vulnerability that we believe requires your attention.

Vulnerability Description:

After our analysis, we have identified that your application is using a hard-coded secret key that is leaked through GitHub. If operators who install your web application do not change this secret key, they are vulnerable to cookie forgeries. The cookie forgery attack allows an attacker, knowing the key used to sign a cookie, to forge new arbitrary cookies to impersonate and take over other accounts.

Hafta/config.py

Line 3 in f47d1c6

SECRET_KEY = 'you-will-never-guess'

Recommendation for Mitigation:

To address this vulnerability and enhance the security posture of your web application, we highly recommend setting the secret key from an environment variable. If the environment file is not shared on GitHub then this would force operators of your application to create their own key upon installation, forcing them to set their own secure secret key.

We hope this notification helps improve your security. Should you have further questions or comments on this feel free to answer this thread or reach out to [email protected].

Kind regards,
Florian Hantke

Resource.txt is outdated and has version conflicts

What is the default username and password?

Get a license key not working.

I have installed this application successfully but when I tried to register one user it's showing me I need to have a license key. When I press to get a license key it's redirecting me the registration page.

Not able to enter the key

Not able to enter the key, If i press on get a license it will not change the window.