Changed
- Updated user deletion handling to use Craft’s deletion blockers, with options to reassign, unassign, or delete related submissions.
Fixed
- Fixed Craft emitting deprecation warnings while loading Formie fields.
- Fix SugarCRM connections sending an invalid placeholder client secret, and allow custom OAuth client credentials. (#2988)
- Fix non-form JSON files causing an error when reviewed for import. (#3001)
- Fix long-running queue workers sending email notifications with settings cached from an earlier job. (#2998)
- Fixed element integration mappings accepting unsupported query or element attributes.
- Fixed element field option ordering accepting unsupported query expressions.
- Fixed Entries and other element field handles rendering empty in email notification Twig, including query methods, length checks and numeric indexing. (#2996)
- Fix logged-in user variables being blocked by the Twig sandbox in File Upload field subpaths.
- Fix
{systemEmail},{systemReplyTo}, and{systemName}resolving to literal environment variable names in email notifications. (#2997) - Fixed form notification settings accepting changes without the corresponding form-builder permission.
- Fixed control-panel lists and import summaries rendering untrusted values as markup.
- Fixed support requests disabling TLS certificate verification.
- Fixed provider secrets being included in reCAPTCHA request URLs.
- Fixed Pardot prospect email values being interpolated into API paths without encoding.
- Fix Pardot form handlers treating multiple checkbox and multi-select values as one combined option by sending each selected value as a separate parameter.
- Fixed form duplication and form-builder metadata endpoints bypassing their corresponding permissions.
- Fixed notification IDs being accepted when they belonged to another form.
- Fixed submission bulk actions applying changes outside the current user's save permissions.
- Fixed element-index requests accepting client-controlled form scopes for submissions and sent notifications.
- Fixed notification editors being able to attach assets they are not permitted to view.
- Fixed read-only submission viewers being offered subscription cancellation actions.