A date format stored by 8.46/8.47 breaks date handling fa5922b3c
Regional settings saved in 8.46/8.47 persisted the date format with CLDR's standalone month, e.g. LL/dd/yyyy. Tempo reads the L family as its own presets and rejects such a pattern
core/locale now rewrites L to M where it derives the locale data and repairs the stored value on startup
configure() is retried without the custom formats, so a bad pattern cannot cost the timezone again
A foreign sr-only can clip the custom checkbox away (ASB-274)
Custom checkboxes and radios stay visible when a plugin ships a Tailwind built sr-only utility, for instance Guard UI 8.52
A forged message showed the sender's verified badge 84825617c
Fixed a message that fails sender authentication showing the verified-sender badge of the domain it claims to come from, which is the case the badge exists to distinguish
A quoted literal in a custom format is read as a preset token 1b80c71b5
A custom date or time format containing quoted literal text, e.g. "MM/dd/yyyy 'LT'", was rejected as though the literal were a format token, which also discarded the configured locale, timezone and week numbering
The check now ignores quoted text, which CLDR treats as literal
BIMI logos never appeared for senders on a long TLD f075ef15f
Verified brand logos (BIMI) now appear for senders whose domain ends in a TLD longer than six letters, such as .technology, .photography or .international, and for internationalized TLDs. Previously the logo was silently never shown for any of them.
BIMI logos never appeared with Group by conversation enabled 3fc8eab3e
Fixed verified sender logos (BIMI) not appearing in the message list while "Group by conversation" is enabled
Ctrl+Enter saves without the value of the field it was pressed in 30f55cf86
Deleting the calendar you have open reports "Such a folder does not exist" d15bca37b
Dialogs opened from a mobile window lose their typed input 5ba3cfa93
Keep the Send button visible after adding a recipient on smartphones (ASB-253)
Signature designer e2e test fails when the middleware normalizes tel links d5d7e77f2
The setup wizard moves focus away while you type 25abf9520
The "display name" is not used to display names (ASB-246)
Deployments that maintain display names centrally - an oxDisplayName mapped from LDAP, for example - can now have those names shown throughout App Suite, instead of names composed from first and last name
Switched on per deployment with the "preferDisplayName" feature toggle, so everyone in an organization sees the same names; the name format setting then only decides how contacts without a display name are composed
Contact lists, address pickers and search are ordered by the display name as well, so what is shown and what a list is sorted by stay in step
Compose font sizes use points again, instead of pixels 0355e9ce6
Compose font sizes are shown in points again. The switch to pixels in 8.51 came out of making the font settings clearer, but we underestimated how much people go by the number rather than the unit. The familiar sizes exist in both lists, so the same number produced noticeably smaller text than before
Existing font size settings are converted back automatically. The earlier conversion had merged some sizes into one, so where the original is no longer recoverable the closest match is restored and anyone who had picked a specific size may want to confirm it once
The list of sizes gained 9pt, which closes the wide gap between 8pt and 10pt, plus 48pt and 72pt for larger headlines
A phone set to "Use system setting" loses its theme aefa545f8
Fixed the theme on phones set to "Use system setting", which lost its colors and left the browser's title bar white while a dark theme was shown
Fixed custom themes not being applied on phones
Accent color handling in the dark theme and auto dark mode 42f488ca8
A dark theme's accent color, including one set by configuration, now applies when auto dark mode switches to it, instead of the light theme's
An accent color the user picked still survives that switch, unless the theme fixes its own
Turning auto dark mode on or off no longer resets the accent color to the theme's default
Selecting several rows in dark mode now shows them all in the accent color, rather than the focused one in color and the rest in grey
Hovering a selected row in dark mode now lightens it slightly instead of making it darker than the rows around it
Complete the background ramp so dark-mode fixes can land cf003256e
Hovering a selected row in dark mode no longer flashes a near-white background
Dark mode in the account services list and the scheduling view d0a3bc14b
The service names and generic icons in the "Add storage account" dialog are legible in dark mode again, instead of being drawn light on white
Appointments in the scheduling view now use the same colors as the calendar shows them in, in both light and dark appearance
The grid lines, separators and weekend labels in the scheduling view follow the theme, instead of a fixed set that left the faintest line the most prominent one in dark mode and the strongest one invisible
Day labels and the hour scale in the scheduling view 062943a22
The day labels in the scheduling view no longer lose the space between the weekday and the date after navigating to another week
The hour scale in the scheduling view reads "8 AM" rather than "08:00 AM" in locales that use a 12-hour clock
E2e test "Create recurring appointments with one participant" (broken on certain dates)
Give checkboxes and radios one set of colours across the themes 5709588ec
Unchecked checkboxes are no longer drawn as a white square regardless of the theme, which was most visible in dark mode
Checkboxes in mail, calendar and Drive now match the ones in contacts and tasks, and themes can restyle both together
Missing and hard-to-see focus indicators, mostly in dark mode 841b0173d
Fixed several focus glitches: button labels that were nearly invisible on hover in dark mode, focus rings showing up after a mouse click, and weekday buttons in the calendar side panel with no visible keyboard focus
The keyboard focus indicator now follows the theme's accent color instead of the browser's default blue
Task list rows stopped tiling, leaving a 1 pixel gap 0b035cb6b
Fixed a 1 pixel gap between selected rows in the task list
Task status badges glare in dark mode, and overdue is not a warning 12517269f
Task status badges no longer glare in dark mode
Overdue tasks are marked in red rather than pink
Theme the checkboxes in the IMAP subscription dialog 70e312ad4
The checkboxes in the IMAP subscription dialog now follow the chosen accent color and the dark theme, instead of being drawn by the browser
Very long attendee names cause the calendar edit window to scroll (ASB-267)
Misleading German text for resending the share notification to other recipients (ASB-103)
Use the right role for Drive's storage entries in Quick Settings 25bf65f280
"Add storage account" and "Manage Shares" in Drive's Quick Settings are no longer announced as tree items; they carry the button role like every other action in the panel, which also fixes the axe violation in the Drive a11y tests
Attach files dropped as download URLs in mail compose (PBSR-1829)
Files dragged out of an electronic files application can be dropped straight onto the attachment area of the compose window and are attached like local files. Every file type is accepted, the usual attachment size quota applies, and a download that asks for credentials offers a sign-in
Dropping a multi-selection now works, as does dropping into Firefox
Off by default: dragDropAllowDownloads enables the feature, dragDropAllowDownloadsWithPassword additionally allows the sign-in prompt — so a deployment can permit downloads but never a credential prompt for an arbitrary origin
Configurable password generator, icons and theming (bizdev-84)
Password generator and strength meter can be switched on or off per deployment, with a minimum/maximum length, and follow the theme colors
Cross-Context Sharing, Deputy and Collaboration (PBSR-1717)
Mail and calendar folders can be shared with — and deputies appointed for — users of another context. Those users are offered in autocomplete and in all address pickers, and mail can be sent on their behalf
Gated per module; without the feature the UI behaves exactly as before
E-Akte integration: edit email templates from electronic files (PBSR-1681)
An electronic files application can hand an email to App Suite for editing. The draft opens in a template mode whose primary action is "Save and close", which uploads the result back to the originating application instead of sending it — such a window can never send the mail
The tooltip and the success message name the location the email is saved to. If the upload fails, the user can retry or close the window and keep the saved draft as a fallback copy
Requires the new mailtoEmlfile toggle (default off), which also gates the plain email import added in 8.52
Forgot-password and set-password Vue forms (bizdev-84)
Two new pages before sign-in: "Forgot password" requests a reset mail, "Set password" sets the new password from the link in that mail. An expired link is reported with a way to request a new mail
Multiple calendars per shared account (PBSR-1812)
A shared account can hold more than one calendar. The "Shared accounts" section lists them all: the account's default calendar carries the account name, additional ones are labeled "<account name>: <calendar title>" — the same name everywhere the calendar appears
Additional calendars are created via "Add new calendar" in the default calendar's context menu, which requires author level or above. Renaming and deleting require calendar administration rights and are never offered on the account's default calendar
Appointments can be moved between calendars of the same shared account; moving across accounts would change the organizer and stays unsupported
Security token for the mail d&d helper app (PBSR-1808)
The Drag & Drop helper app can now be protected with a shared secret. Without one, any web page the user visits can make the helper app show a drag bubble with attacker-chosen file names and subjects, which the user may then drag into a trusted application
New "Security token …" button in the Drag & Drop section of Mail → Advanced settings, with generate and copy-to-clipboard
Token-based mail drag-out plugin (PBSR-1791)
Emails can now be dragged out of App Suite into other web applications, not just desktop applications, using the new "Drag email to browser" button. Unlike the existing "Drag to desktop", which remains available, it works in every browser and not only in Chromium
A multi-selection is dragged as one list of all selected emails, up to 20 by default; larger selections get a hint. The overlay closes itself after two minutes, because the download links it hands out are short-lived
Enabled by default where the middleware supports it
Breaking change: Load external mail images directly; image proxy now opt-in 1279be5cf
External images in mail are now loaded directly by the browser (after the usual "images are blocked until you allow them" prompt), no longer through a server-side proxy. This is more reliable: central proxies are frequently blocked by content-delivery networks (Cloudflare, Akamai, …), which broke image loading for entire deployments.
Security is not affected. The reason the proxy existed is now handled by a strict Content-Security-Policy on the mail view, which blocks the same attacks regardless of how images load.
The proxy remains available but is now opt-in and OFF by default; its only remaining effect is hiding the recipient's IP address from the sender. Enabling it is not recommended unless IP hiding is a hard requirement, because proxied images often fail to load. To use it, configure the image proxy in the middleware and switch it on via io.ox/core//features/proxy (this setting only enables use of the proxy; it does not configure it).
Accept every url of a multi-line uri-list drop (PBSR-1791)
Cap oversized mail bodies with a clear truncation notice 280646eca
Fewer messages get truncated. The amount shown initially is raised well above the former 100 KB — to 3 MB on desktop and 1 MB on mobile. That tiny old cap routinely cut off ordinary mail, most often messages with inline images embedded as data URLs (a single one already exceeds 100 KB).
When a message is still larger than the initial cap, it is shown up to the cut-off point with a clear notice at the end and a "Show the entire message" action that loads the rest in place, up to 10 MB. Beyond that a notice states the maximum size that can be shown; the message can still be downloaded. Desktop and mobile behave the same.
The four size limits are configurable: io.ox/mail//maxSize/{desktop,mobile}/{view,viewLimit}.
Fetch mail unmodified (view=raw, no server proxy/sanitize)
HTML emails are now rendered fully in the browser: the middleware returns the message untouched and App Suite UI cleans and displays it itself. The UI has done the cleaning in the browser for years — this change now drops the middleware's remaining role, including its external-image proxy. The browser is the authority on parsing HTML and CSS, and the central proxy can be unreliable — CDNs (e.g. Cloudflare, Akamai) tend to block it, breaking images for whole deployments.
Dropping the proxy re-armed an attack it had been masking: a malicious email could reference an external font or stylesheet whose response demands authentication (Basic Auth), chaining to a native browser username/password dialog shown over the app (with attacker-chosen text) — making it look as though App Suite was asking you to sign in again.
Luckily, the fix is a simple to implement Content-Security-Policy on the mail-display frame — not sanitizing, since the email markup itself is harmless and the trick is in the network response. External fonts and media are blocked, so the prompt can no longer be provoked. Side effects: a sender's custom/brand font falls back to a standard system font (a minor visual change), and external content now loads only inside the isolated frame and only after you choose "Show images" — never silently in the background (which had also exposed your IP address to the sender).
Administrators who need a brand font in mail can allow-list a trusted font source via the io.ox/mail//csp/fontSrc setting (see documentation).
Gate 'Change permissions' on the announced permissions capability (PBSR-1812)
Harden Tempo timezone handling ddb54e36e
Appointments and invitations whose sender specifies the timezone as a plain UTC offset (for example "GMT-07:00") are displayed instead of breaking the view
Timezones keep the name they were received with, instead of being replaced by an outdated alias (for example Europe/Kyiv is no longer rewritten to Europe/Kiev)
Merge server unit tests into the root vitest run 4fb22a311
Share eml transfer sign-ins and offer to remember them (PBSR-1791)
A configured SystemV timezone is not resolved (ASB-134)
Before, a configured timezone from the older SystemV set (for example SystemV/CST6) was not translated to a supported one at startup. Dates and times were then shown in the wrong timezone, on some browsers the timezone could not be applied at all, and moving an appointment could store an unusable timezone on the server
Such a timezone is now resolved to its supported equivalent while the configuration is loaded, so it is applied correctly on startup
Accept token downloads in the uri-list mail import (PBSR-1791)
Add to Drive in Sharing Mail does not work after the share was removed from Drive (support#1563)
Always show close button in first-start wizard (bizdev-84)
Appointments from shared calendars hidden on mobile (support#1617)
Automatic replies for a shared account offer the shared account's addresses (support#1611)
The "Automatic replies" dialog of a shared account now offers the shared account's own addresses (primary plus aliases) in "Send from" and as additional recipient addresses; previously both lists showed the acting user's personal aliases, which are not valid for the shared account's rule
Blank UI on browsers without native Temporal (support#1626)
Button in Appointments might point to different Zoom meeting (support#1588)
Calendar: Email Attachment Without Preview (support#1532)
support eml attachments in all pim objects and drive
also support attachments of this eml attachments itself
Category or Attachment removed if created as an Follow-up (support#1620)
Closing the sidepanel leaves the app content pushed up on iOS (ASB-110)
Enterprise picker launcher opens a new floating window on every click (ASB-149)
Establish the existingSecret pattern for core-ui's db Secret (ASB-150)
New db.existingSecret and db.existingSecretKeys values read the database credentials from a Secret the chart does not create, for example one managed by an ExternalSecret
The database env vars and the migrations job now render on that path; previously they were emitted only for plaintext databases.* values
Exclude migration job pods from the core-ui service 8fafb8053
The core-ui service no longer routes requests to migration job pods
Horizontal mail view broken on tablets (support#1637)
Leading hyphens in task description not visible in task details (support#1590)
New assign action on contacts & tasks only allows one category (support#1609)
No read receipt prompt for own mails in a shared account's sent folder (PBSR-1786)
The "Send a read receipt" banner is no longer shown for the sender's own mails in sent and drafts folders; previously the sent folder of a shared (functional) mailbox offered to send a read receipt for one's own mail
Organizer appears twice when creating a follow-up (ASB-127)
Cause: a follow-up looked for the organizer among the copied participants by mail address, so an appointment created with a different sender address (an alias, or an address from before a domain rename) did not match and the organizer was added a second time
Solution: organizer and participants are now matched by identity, internal users by their user id and others by mail address; a follow-up also keeps the sender address of the original appointment as long as that address is still available
Quick Settings panel goes stale on view change (ASB-128)
Relogin dialog escape traps user in backgrounded OIDC PWA 9699760b3
Add a distinct, always-operable "Sign in again" escape button to the relogin dialog whose action calls a new state-independent recover() directly instead of routing through the consumable relogin:continue Deferred
Repair form semantics, focus rings and text spacing (ASB-118)
Resolve invalid user timezones from a single source of truth b1825ddb1
An invalid timezone in a user's configuration falls back to the local timezone instead of leaving dates unresolved
An unsupported favorite timezone no longer breaks the calendar settings pane
Clicking the "i" is selecting the contact instead of showing the contact overview in the enterprise contact picker (ASB-125)
Show manage shares button again after quick settings sidepanel refactoring 9b2ccffe1
Signature is lost when the compose editor is switched to HTML 68508c6d8
Signature placeholders in HTML attributes render nested markup (PBSR-1788)
Signature placeholders inside HTML attributes (e.g. <img data-src="{{ company.logo }}">) now render the plain value as documented; previously the key's default format nested markup inside the attribute, so e.g. the company logo never displayed
Signature preview freezes on a long run (ASB-151)
Fixed a freeze of the Email settings page caused by a signature containing a long run of non-breaking spaces, as produced by quoted text in some mail clients
The same freeze affected the Templates settings page
Task titles break in list view, sidepanel, and on mobile when show in calendars (ASB-141)
Fixed task titles breaking across two lines in the calendar list view, on mobile, and in the calendar sidepanel when tasks are shown in the calendar
Theme selection does not update the current card 51fbfaaaf
Unsharing mail folders is not working (support#1612)