Fixes an admin lockout, two ways contacts could go missing, and adds contact fields people actually use.
Upgrading: the Avatars plugin needs updating separately
Plugins live in your data directory, not in the webmail archive, so updating Tachyon does not update them. If you want contact photos shown as sender avatars, update the Avatars plugin to 1.25 as well, from the Packages tab in the admin panel.
Everything else in this release works with the webmail update alone.
An admin could lock themselves out by looking at two-factor
The security tab has a Generate button that fills the TOTP field so a QR code can be drawn. Saving anything on that tab then wrote whatever was in the field, so pressing Generate out of curiosity and then changing your password silently switched on two-factor authentication for a secret you had never scanned. The next login demanded codes nobody could produce, and the only way back was editing application.ini by hand.
Two-factor is now only changed when you actually change it, and switching it on requires a current code first, which proves you can still get in. Turning it off still needs only your password.
If you are locked out on an earlier version: blank admin_totp in data/_data_/_default_/configs/application.ini.
The same tab's Save button also did nothing at all unless the current password field was filled. It now says so.
Contacts
- Address, birthday, instant messaging and photo. Addresses were half-built: they were parsed from your server but never shown or saved, so an address could arrive and sit there invisibly. There is now an Addresses tab with a home or work type per address, and birthday, instant messaging and photo fields. Photos are scaled to 256px before storing, since they travel inside the vCard on every sync. From #40 by @m0urs
- Saving a new contact twice made two contacts. A newly created contact never received its id back, so the next press created another one instead of updating the first. #39
- Looking a contact up by address returned it without its vCard, so anything needing more than a name got nothing. Long-standing, found through the avatar work.
Sender avatars from your contacts
If a sender is in your address book and has a photo, it now appears in the message list and message view, ahead of Gravatar and BIMI. A photo you set yourself should win over anything fetched from elsewhere.
Photos are read in every shape servers store them in: embedded as a data URI, embedded as bare base64, or held as a URL, which is what Nextcloud writes. A URL is handed to your browser rather than fetched by the server, so a self-hosted setup on a private address works and the server never makes requests to addresses that came out of contact data.
Accounts
The account you log in with can now be named, by clicking it in the accounts list exactly like the others. Leave the name empty and it falls back to your identity name. From #41 by @m0urs
Admin panel
Calendar and logging have their own tabs instead of being buried in the long Config list. Calendar includes a connection test. Logging shows the level as a named list, since "4" tells you nothing and "4 - Warning" does, and keeps the debug options together behind a note that they are for development.
Also
Reopening any popup while it was still fading out kept the previous item's contents. Rare to hit deliberately, easy to hit by accident, and it affected every popup rather than one screen.