What's Changed
Bug Fixes
Active Directory - objectGUID byte order
Fixed a long-standing bug where AD group lookup failed silently for users authenticating via Azure AD / Active Directory. The manual byte-sequential unpacking of objectGUID produced a byte-swapped UUID that never matched the value shown in the AD portal.
Replaced with LdapRecord\Models\Attributes\Guid which handles the Windows mixed-endian byte order correctly.
Password generator - search retry loop (PR #5141)
Fixed a regression where the password generator could skip already-tried sizes when retrying in both directions. The retry loop now checks both lowerTriedSizes and upperTriedSizes on every iteration, preventing redundant AJAX calls. A missing warning message is now shown via toastr when the generator cannot find a password matching the required complexity.
Admin - change user password dialog reset (PR #5143)
Removed a duplicate .prop('checked', false) call that fired before resetAdminChangeUserPasswordDialogContext(), causing a visual glitch where the password checkbox flickered on dialog open.
Background tasks - user display in logs (PR #5143)
Fixed log entries where background task rows showed no user name. getBackgroundTaskUserDisplayFromUserId() now correctly falls back to login when name/lastname are empty, and HTML entities are decoded then re-encoded safely before output.
Email recipient name in new-user notification (PR #5143)
Fixed emails sent to new users having a blank recipient name. The task handler now builds the display name from name + lastname, falling back to login when both are empty.
Improvements
API - network ACL enforcement (PR #5142)
The REST API (/api/index.php) now enforces the network access control rules configured in TeamPass settings. Requests from blocked IP ranges receive a 403 Forbidden response with a localized error message. Language detection from Accept-Language header is supported (English and French).
Folder depth filter - persistent state (PR #5140)
The folder depth filter selection is now persisted across page reloads via store.js instead of sessionStorage, consistent with the rest of the TeamPass client-side state management.
Items page - code simplification
Eight single-use helper functions in items.js.php have been inlined at their call sites, reducing indirection and making the file easier to follow. A redundant websocketClientAvailable check in reloadItemDetailsAfterSave was removed (the condition reduces to websocketExpected only).
Logs datatable - function ordering
Moved normalizeBackgroundTaskDisplayValue(), getBackgroundTaskUserDisplayFromUserId(), and resolveBackgroundTaskUserDisplay() above their first call site in logs.datatables.php to eliminate forward-reference issues.
Full Changelog
Important
- Requires at least
PHP 8.1
Languages
Please join Teampass v3 translation project on Poeditor and translate it for your language.
Installation
Follow instructions from Documentation.
Upgrade
Follow instructions from Documentation.
Ideas and comments
Are welcome ... please use Discussions.