ExistingUISettingsSecret checksum and document existing*Secret values
Backport of main commit ab96e610c2f to stable-8.49.
The existingUISettingsSecret was missing from core-mw.existingSecretsChecksum, so content changes to that secret did not trigger a rolling restart unlike the other existing* secrets. Added the missing block.
Also added a guide on the existing*Secret values to the chart README, clarified the additive-vs-replace behavior in the values.yaml comments, and bumped the chart version to 6.20.3.
NPE in OXFolderManagerImpl.parseTruncated() for truncated 'meta' folder column; enlarge meta BLOB to MEDIUMBLOB (core#512)
SCR-1709: Enlarge the "meta" column from BLOB to MEDIUMBLOB for the "oxfolder_tree" and "del_oxfolder_tree" tables
Externalize data: URL inline images into managed files (support#931)
Sanitize illegal filename characters when saving mail attachments to Drive (support#1459)
The "Save to Drive" action (PUT /mail?action=attachment) only replaced "/" with "_" in the attachment file name, leaving other characters that are illegal in file-storage names (":", "", "?", "*", """, "<", ">", "|") to flow down into the storage layer which then rejected the request with FILE_NAME contains illegal characters.
Reuse FilenameValidationUtils.sanitizeName to replace every illegal character with "_", trim trailing dots/whitespace and fall back to a generated default name for reserved names; use MailMessageParser.generateFilename as the fallback so the original sequence id and MIME type drive the substitute name.
Adds FilenameValidationUtilsTest covering the colon scenario from the support ticket plus the existing replacement, trim, reserved-name and Unicode cases.
Send failure notification for scheduled mails even when transport setup fails (support#1460)
Pre-upgrade task now enumerates legacy single-schema pools (support#1462)
Harden Redis Failsafe defaults to prevent bulkhead-full floods (support#1464)
The previous defaults turned a brief Redis latency spike into a mass REDIS-0014 ("Too many concurrent commands") flood:
bulkhead.maxWaitTimeMillis = 5 made the bulkhead a hard reject limit instead of providing backpressure
breaker.enabled = false left no recovery net once the bulkhead saturated
retry.maxRetries = 0 propagated single transient reconnect errors straight to callers
The common circuit breaker's failure predicate ignored BulkheadFullException, so sustained saturation never tripped it
FailsafePolicies: extend the common breaker predicate to include BulkheadFullException (and the wrapped TOO_MANY_COMMANDS code) so sustained bulkhead-full conditions open the breaker and let the end-point recover
Redis.yml: align documented defaults with RedisProperty (connect.breaker thresholds/delay and the three new defaults)
Add FailsafePoliciesTest covering all three predicates incl. the new bulkhead-full case
Orphaned mail accounts with oauth=0 disappear from account list
Reject 0 as a valid OAuth account identifier across all mail account read/write paths (DB layer, cache codec, user-copy provisioning) and add an update task that migrates pre-existing 0 values to NULL.
Optional aggressive ACL cleanup when revoking a deputy permission (support#1004)
Introduces "com.openexchange.deputy.provider.imap.aggressiveAclCleanupOnRevoke" (default: false). When enabled, the revocation flow unconditionally removes the deputy's ACL entry from every considerable personal mailbox instead of consulting the ACL directory captured at grant time.
This is intended for deployments that grant ACLs solely via the deputy feature: because servers like Dovecot inherit ACLs from parent folders and from INBOX (acl_defaults_from_inbox), the captured directory cannot reliably distinguish deputy-induced from pre-existing ACLs once subfolders are involved. Any remaining ACL entry for a former deputy is then treated as a leftover and wiped.
Property is honored by both the IMAP-direct (DeputyImapProvider) and the DoveAdm-based (DoveAdmProvider) deputy provider.
Movecontextdatabase failed with "Table '<oxdb>.context' doesn't exist"
When disabling the context at the start of doMoveDatabaseContextInternal(), the source user-DB connection (oxDbWriteCon) was passed to myEnableDisableContext(), which executes UPDATE context SET enabled = 0. The context table only exists in configdb, so the statement was issued against the user schema (e.g. oxdatabase_444) and failed.
Pass null instead so myEnableDisableContext() acquires its own configdb write connection -- restoring the pre-e316526b33a behaviour of disable(ctx, reason). The mutual exclusion of concurrent provisioning is already handled by the surrounding context claim, so no transactional coupling with oxDbWriteCon is needed here.
Invalidate cached MailAccess instances when mail account is changed (core#504)
After a SOAP provisioning operation that changes a user's PrimaryEmail, the generated iOS/MacOS onboarding mobileconfig profile contained the previous login in IncomingMailServerUsername / OutgoingMailServerUsername, while EmailAddress reflected the new address. Cause: the node-local SingletonMailAccessCache holds MailAccess instances whose MailConfig has the login eagerly populated from the MailAccount and was not invalidated when the underlying MailAccount or user changed; the cache only expired via its idle timeout.
CachingMailAccountStorage.invalidateMailAccount(s) now also clears the node-local MailAccess cache for the affected user and broadcasts a cluster-wide invalidation event over the existing MAIL_SESSION_EVENTS channel, so other nodes drop their cached MailAccess instances too.
New MailAccessCacheInvalidator listens on the same channel and drops cached MailAccess entries on remote events.
New MailSessionCache.fireMailCacheInvalidationEvent publishes the event unconditionally (in contrast to clearFor, which only publishes when the publishing node has matching local sessions - not the case for the admin node performing SOAP provisioning).
Defense in depth: MailOnboardingProvider now refreshes the MailConfig via MailConfig.getConfig(...) analog to the existing TransportConfig refresh, so the onboarding plist is correct even if the cache invalidation does not reach this node.
Added possibility to log all connection-using thread on "too many connections" error (support#1363)
Changed: Added possibility to log all connection-using thread on "too many connections" error - /appsuite/support#1363
Changed: Add jitter/offset to periodic (general) clean-up jobs to avoid start burst - /appsuite/support#1363
Fixed: Reduce configdb pressure of nightly cleanup runs - appsuite/support#1363
Mitigates the synchronized configdb-connection burst at the beginning of the nightly cleanup window that surfaces as DBP-0001 / "too many connections" against the cluster:
Mix a per-node salt (hostname + random component) into the deterministic per-job offset so that the same job is started in a different slot on every pod, preventing the cluster-wide synchronized burst that pure jobId.hashCode()-based offsets produced.
Make the per-job schema concurrency configurable via com.openexchange.database.cleanup.schemaConcurrencyLevel (default 4 instead of the previously hard-coded 10), which is the main multiplier for parallel configdb access per pod.
Add a global hard cap on concurrent configdb schema look-ups via com.openexchange.database.cleanup.maxConcurrentSchemaLookups (default 8), independent of concurrencylevel/schemaConcurrencyLevel.
Pre-resolve representativeContextId -> PoolAndSchema in a single batch lookup per cleanup run and pass it through to CleanUpJobRunnable, so per-schema cleanup no longer issues an additional configdb roundtrip per schema.
Add a soft submission ramp-up at the start of the schedule window via com.openexchange.database.cleanup.rampUpMillis (default 60s) on top of the existing jitter, eliminating the exact window-boundary spike independent of hash collisions.
Treat Category.CATEGORY_SERVICE_DOWN (e.g. DBP-0001 "Cannot get connection to config DB" / "Cannot create pooled object") as retry-able with exponential back-off and jitter both for per-schema execution and for uncached configdb schema look-ups, so the pool can recover instead of being hammered while saturated.