Song: https://youtu.be/pIqrmGKfmQU
Passbolt 5.14.3 addresses issues identified after the 5.14 release.
Following the introduction of the permission confirmation dialog in 5.14, two behaviors needed correction. The dialog appeared when editing only the metadata of a shared resource, such as renaming it, even though no secret was changed. It now appears only when the secret is modified. Additionally, when creating a resource in a shared folder where the user is not the owner, the dialog allowed editing the permissions inherited from the parent folder, potentially overriding the access structure established by the organization. The dialog now opens in read-only mode in this situation, allowing the user to review permissions and group members before proceeding without overriding the permissions. Users authorized to manage access can still update permissions directly.
Additionally, the in-form menu could appear even when disabled on the API by feature flag. The API could in some cases return plugin configuration in an unexpected format, and the browser extension would fall back to enabling any plugin whose setting did not strictly match. Both the API and the browser extension now enforce a strict format, and the in-form menu correctly reflects the settings.
Finally, a separate regression prevented the API from running over HTTP. While this is not recommended, the regression could break testing or staging instances not using HTTPS.
Many thanks to everyone who reported these issues.
Changelogs
Fixed
- PB-53457 Fix env()-backed config flags to enforce strict boolean type
- PB-53498 Fix CSRF cookie not working over HTTP deployments