What's Changed

This is a corrective release on the 3.2.3 line. TeamPass 3.2.3.1 cannot be installed from scratch: the database step of the web installer stops on 35 tables (GHSA-pxjv-6qgf-xhcg). 3.2.3.2 fixes the installer, verifies the certificate of the SMTP server, shows creation and modification dates in the knowledge base, and displays the licence dates in the date format of the instance. Upgrading is recommended for every installation, and 3.2.3.2 is the version to use for any new installation. Do not fall back to 3.2.3.0 or an earlier release to get a working installation: they are exposed to the two critical vulnerabilities fixed in 3.2.3.1.

This release changes the database schema. The kb table gains two columns for the article dates, so UPGRADE_MIN_DATE is raised and every installation goes through the upgrade wizard once.

🔒 Security fixes

• Fresh installations work again (GHSA-pxjv-6qgf-xhcg, Low, found and fixed by @guerricv) - the GHSA-8xp7-fh3p-5pcr fix of 3.2.3.1 replaced the dynamic dispatch of the installer with a list of allowed actions, but the list for step 5 stopped at user_private_keys. The 35 tables created after it were refused with Action not recognized, the installation stopped at step 5 and no usable instance was produced, from the archive and from the Docker image alike. Existing and upgraded installations were not affected. The list now holds every table the installer creates, and a test compares it with the installer's schedule so a new table can no longer be left out. The issue is not exploitable; it has an advisory because the obvious workaround, installing an older release, exposes the new instance to GHSA-8xp7-fh3p-5pcr and GHSA-988j-pf6f-2m2r. After a failed 3.2.3.1 installation, the database holds no user data yet: drop and recreate it, or empty it, then run the installer of 3.2.3.2.

• The certificate of the SMTP server can be verified - TeamPass disabled the verification of the mail server certificate unconditionally: with SSL or TLS the connection was encrypted but not authenticated, so anyone on the network path to the relay could impersonate it and read the SMTP credentials and every email TeamPass sends. The new option Verify the SMTP server certificate (Admin → Emails) is enabled on new installations. On an upgraded installation it is off, so a relay with a self-signed or internal certificate keeps working, and the administrator dashboard recommends enabling it while an SSL/TLS relay is not verified. If the test email then fails with certificate verify failed, add the certificate authority of the relay to the trust store of the TeamPass server. See Security hardening.

✨ New features

• Creation and modification dates in the knowledge base (PR #5435, @guerricv) - an open article shows its creation date and its last modification date next to its category, comments and author; the article list shows the last modification date, or the creation date when no modification is recorded, with the full timestamp on hover. Dates follow the date and time formats and the timezone of the instance. Changes to the article, its associated items or its attachments update the modification date; reading, commenting and saving without changes do not, and deleting then restoring an article keeps its dates. The dates are stored with the article, so purging the activity logs no longer loses them. See Knowledge base.

🐛 Bug fixes

• Licence dates follow the date format of the instance (PR #5434, @guerricv) - the expiry tile of Statistics → Licence and the Browser Extension tile of the administration dashboard showed the raw date of the licence server (2027-06-16), and the chart and its history used the locale of the browser. They now all use the date format set in Settings. The licence panel of Settings → API already used that format, but showed the expiry one day late on any instance east of UTC, because the calendar day of the licence server was converted to the timezone of the instance; it now shows the day the licence server states.

• Article titles and categories containing & are no longer re-encoded on save (PR #5435, @guerricv) - the editor showed the title or category of an article containing, for example, R&D as R&D, and each save added one more level of encoding. The editor now decodes the stored text before showing it.

🌍 Translations

• The Russian translation now covers every text up to 3.2.3.0, and the Polish one nearly all of them, thanks to the translators of the POEditor project.
• 52 Italian, Polish and Brazilian Portuguese translations that held an identifier instead of a text (for example id_client for Client ID) are removed: the English text is displayed until they are translated again.

⬆️ Upgrade notes

• Schema. The upgrade adds created_at and updated_at to the kb table and fills them from the article history still in the logs, where it can be attributed. A date that cannot be recovered stays unknown and is not displayed; the upgrade time is never used instead. On an older article, a missing modification date does not prove it was never edited.
• SMTP certificate verification. Upgraded installations keep the previous behaviour (no verification). Enable Verify the SMTP server certificate in Admin → Emails, then use Send a test email.
• New installation after a failed 3.2.3.1 attempt. Start again from an empty database with 3.2.3.2.
• Back up your database before upgrading, as always.

Full Changelog: 3.2.3.1...3.2.3.2

Important

• Requires at least PHP 8.2

Languages

Please join Teampass v3 translation project on Poeditor and translate it for your language.

Installation

Follow instructions from Documentation.

Upgrade

Follow instructions from Documentation.

Ideas and comments

Are welcome ... please use Discussions.