What's Changed

This release opens the 3.2.4 line. It adds a command-line upgrade that backs up the database, runs the upgrade in maintenance mode and restores the backup if a step fails. The item view and the item edit form are redesigned: one page with foldable sections, a sticky action bar, an icon picker and tags edited as chips. Users get an inventory of their active Secure Send links, and administrators are reminded to save a Recovery Package. The release also fixes folder, favourite and Knowledge Base names stored with HTML entities (O'Brien instead of O'Brien), makes searches match the displayed text again, and repairs several upgrade paths: maintenance mode in the web wizard, the data clean-ups in Docker, and background tasks that ran against an older schema. It closes a High severity flaw that let a session opened on the installer before the setup rewrite settings.php on a live instance (GHSA-6x8j-28p6-mmfm), and several HTML injection and information disclosure paths in the item view, the tag suggestions and the command palette. Upgrading is recommended for all installations, and strongly recommended for instances installed with 3.2.3.1 to 3.2.3.3: delete or lock down their public/install directory if it is still reachable.

This release does not change the database schema: no new table, no new column, no data migration. UPGRADE_MIN_DATE keeps its 3.2.3.3 value. Because the version moves to a new line (3.2.3 → 3.2.4), every installation still goes through the upgrade once, through the web wizard, the new command line or the Docker entrypoint. The upgrade only records the new release.

🔒 Security fixes

• The installer no longer accepts a pre-install session after the setup (GHSA-6x8j-28p6-mmfm, High, reported by @kta1kri) - on instances installed with 3.2.3.1 to 3.2.3.3, a session opened on install.php before the setup finished kept every installer step usable after go-live, including the one that rewrites app/config/settings.php: someone holding such a session could point the instance at their own database or replace its encryption key. Once settings.php exists, the steps now refuse every install session except the one that wrote it, which may only finish step 6 while the file is unchanged. The install grant is revoked when the installation completes, and the key file name written into settings.php must be a plain file name. Upgraded instances were never exposed. The advisory lists indicators of compromise.
• Tags can no longer run script in the item view - the tag badges were built as HTML with an inline onclick handler, so a crafted tag ran script for every user opening the item. They are now built as text, and the click handler is bound in JavaScript.
• Knowledge Base labels are rendered as text in the item view - a double-encoded label survived the server-side purifier and was turned back into live markup by the client decoding. The chips are now built with text-only DOM operations, as the tags and the Knowledge Base page already were.
• Tag suggestions only offer the tags of items the user can read - the tag field of the item form suggested every tag of the instance, which revealed the tags of folders and items the user has no access to.
• The command palette no longer reveals the names of inaccessible parent folders - the path shown next to a result listed every ancestor folder, including folders the user cannot see. Only folders within the user's search scope are now shown (PR #5444, @guerricv).
• Knowledge Base item suggestions respect item restrictions - linking an item to an article offered items restricted to other users or roles in folders the user can see (PR #5444, @guerricv).

✨ New features

• Command-line upgrade - app/scripts/upgrade-cli.php, run as the PHP service account once the new files are deployed, upgrades databases at 3.2.2 or later. check tells whether an upgrade is waiting and changes nothing. run puts TeamPass in maintenance mode, disconnects every user, makes and verifies a database backup, runs the upgrade steps and, if one fails, restores that backup (--on-failure=revert by default). status, resume <run-id> and revert <run-id> act on a previous run. Outcomes are e-mailed to the administrators and written to the admin logs, and check --notify can run from cron. The web wizard and the command line now read one shared list of upgrade steps, so they can never run different steps. See Command-line upgrade.
• Redesigned item view - a sticky action bar keeps Edit, Link, Secure Send and Notify visible and moves the other actions into a More menu, with the previous/next item arrows. Credentials show as rows (label, value, actions), empty rows are hidden and the OTP code sits under the password. A single countdown ring shows how long the password stays revealed and how long the OTP code is valid. Status badges become readable sentences in an About panel. Sections fold and remember their state, and the layout follows the width of the panel in split view.
• Item edit form on one page - the tabs become foldable sections (Main, Fields, Attachments, Details) reached from shortcuts under a sticky Save/Cancel bar. The label is edited in place as the form title. Ctrl+S saves, and an Unsaved changes badge shows pending edits. Attachments are file cards, files upload as soon as they are dropped, and deleting one asks for confirmation.
• Icon picker - item and folder icons are picked from the Font Awesome Free icons, with a search that understands their terms ("bank", "password"), suggestions for the usual subjects of a password manager, and the brands. Typing a Font Awesome class by hand is no longer needed. The picker is available in the item form and in the six folder icon fields of the Items and Folders pages.
• Tags as chips - Enter, space, comma or semicolon add a tag, Backspace removes the last one, and refused characters are reported while typing instead of at save time.
• Secure Send inventory (PR #5442, @guerricv) - a paper-plane icon in the top bar shows how many Secure Send links the user has active, and opens the list of those links, where each one can be revoked or its source item opened. Administrators see the number of active links in the current statistics. Links suspended because an administrator now forbids notes or requires a passphrase stay in the list with a suspended badge and can still be revoked, but are not counted.
• Recovery Package reminder (PR #5440, @guerricv) - the administrator dashboard shows a notice until a Recovery Package matching the current keys and settings has been downloaded, and again whenever a change makes the saved one obsolete. Each completed download is recorded in the system logs, and the Backups page shows the last one.
• Community card - the support card of the administrator dashboard lists ways to help TeamPass be found and funded. Each administrator can hide it for six months.

🛠️ Improvements

• Searches match the displayed text (PR #5444, @guerricv) - the item search, the command palette, the log filters, the Knowledge Base lookups and the metadata facets compared the stored, HTML-encoded form of a name: O'Brien or R&D were not found, and results could fall off a page before matching. They now compare the decoded text, without regard to accents, before pagination.
• Secure Send settings explain their scope - the public sharing address only applies to links whose sender selects Use public address, the Emails page URL applies to every TeamPass e-mail but never to Secure Send links, and a proxy that rewrites the Host header invalidates every public link. Each refused Host is now logged with the received and expected host names, without the link credentials.

🐛 Bug fixes

• The web installer never showed its final page - since 3.2.3.1, the installer refused its own step 7 once settings.php was written, so the button that deletes the install directory and clears the database credentials kept in the browser never appeared. The installing session sees that page again.
• Folder names showed HTML entities (PR #5443, @guerricv) - a name stored with HTML5 entities, which the importer writes, showed as Lab O'Brien in the folder tree, breadcrumbs, folder lists, favourites and Knowledge Base categories, and the tree search did not find it. Names are now decoded before display and search.
• The web upgrade wizard never enabled maintenance mode - its opt-out checkbox was never sent and the query matched an empty setting name. Because every 3.2.x upgrade script records an upgrade timestamp, sign-in reopened halfway through a multi-version upgrade. The wizard now enables maintenance mode at step 2 and restores the previous value at the end.
• Docker images skipped the upgrade data clean-ups - the entrypoint ran the upgrade scripts but never the data operations the wizard runs after them. Each step now applies them before the version is recorded, so a failed one is retried at the next boot.
• Background tasks ran against an older schema - between the deployment of new files and the upgrade, the background task handler ran the new code against the old tables every minute. It now waits until the database matches the deployed files.
• restore.php --force-disconnect left users connected under strict SQL mode, because the session end column is compared as text. Users are now disconnected by id.
• Item view and form glitches - the automatic password update marker showed on every item, the automatic deletion marker showed when the feature was off, copy buttons copied once per item previously viewed, an uploaded file stayed in the upload list instead of joining the attachments, an item without attachments could show the files of the previous item, and the top progress bar kept running after an attachment download.

⬆️ Upgrade notes

• The upgrade runs once, with no schema change. The version moves to 3.2.4, so every installation is redirected to the upgrade wizard until the upgrade has run. Use the wizard, app/scripts/upgrade-cli.php run (databases at 3.2.2 or later), or let the Docker entrypoint do it. If you removed or locked down the install directory after the previous upgrade, put it back first.
• The web wizard now enables maintenance mode and disconnects users while it runs, then restores the previous maintenance setting.
• Background tasks pause between deploying the files and running the upgrade. E-mails, key generation and the other queued tasks resume once the upgrade is done, so do not leave the new files deployed without running it.
• Every upgraded instance shows "Save a Recovery Package" on the administrator dashboard until an administrator downloads one from the Backups page.
• Folder names already in a user's tree cache can keep their encoded form until the tree is rebuilt: use Refresh in the folder menu of the Items page.
• Tag suggestions are narrower: users no longer see the tags of items they cannot read.
• Instances installed with 3.2.3.1 to 3.2.3.3: their install directory may still be online, because the final page of the installer never showed. Once the upgrade is done, delete public/install or deny HTTP access to it, and check the indicators of compromise listed in GHSA-6x8j-28p6-mmfm.
• Back up your database before upgrading, as always.

Full Changelog: 3.2.3.3...3.2.4.0

Important

• Requires at least PHP 8.2

Languages

Please join Teampass v3 translation project on Poeditor and translate it for your language.

Installation

Follow instructions from Documentation.

Upgrade

Follow instructions from Documentation.

Ideas and comments

Are welcome ... please use Discussions.

Help others find TeamPass

If TeamPass serves your team well, a ⭐ on this repository, a like on AlternativeTo or a short review on SourceForge helps other administrators find it.