Attach files dropped as download URLs in mail compose (PBSR-1829)
Files dragged out of an electronic files application can be dropped straight onto the attachment area of the compose window and are attached like local files. Every file type is accepted, the usual attachment size quota applies, and a download that asks for credentials offers a sign-in
Dropping a multi-selection now works, as does dropping into Firefox
Off by default: dragDropAllowDownloads enables the feature, dragDropAllowDownloadsWithPassword additionally allows the sign-in prompt — so a deployment can permit downloads but never a credential prompt for an arbitrary origin
Configurable password generator, icons and theming (bizdev-84)
Password generator and strength meter can be switched on or off per deployment, with a minimum/maximum length, and follow the theme colors
Cross-Context Sharing, Deputy and Collaboration (PBSR-1717)
Mail and calendar folders can be shared with — and deputies appointed for — users of another context. Those users are offered in autocomplete and in all address pickers, and mail can be sent on their behalf
Gated per module; without the feature the UI behaves exactly as before
E-Akte integration: edit email templates from electronic files (PBSR-1681)
An electronic files application can hand an email to App Suite for editing. The draft opens in a template mode whose primary action is "Save and close", which uploads the result back to the originating application instead of sending it — such a window can never send the mail
The tooltip and the success message name the location the email is saved to. If the upload fails, the user can retry or close the window and keep the saved draft as a fallback copy
Requires the new mailtoEmlfile toggle (default off), which also gates the plain email import added in 8.52
Forgot-password and set-password Vue forms (bizdev-84)
Two new pages before sign-in: "Forgot password" requests a reset mail, "Set password" sets the new password from the link in that mail. An expired link is reported with a way to request a new mail
Multiple calendars per shared account (PBSR-1812)
A shared account can hold more than one calendar. The "Shared accounts" section lists them all: the account's default calendar carries the account name, additional ones are labeled "<account name>: <calendar title>" — the same name everywhere the calendar appears
Additional calendars are created via "Add new calendar" in the default calendar's context menu, which requires author level or above. Renaming and deleting require calendar administration rights and are never offered on the account's default calendar
Appointments can be moved between calendars of the same shared account; moving across accounts would change the organizer and stays unsupported
Security token for the mail d&d helper app (PBSR-1808)
The Drag & Drop helper app can now be protected with a shared secret. Without one, any web page the user visits can make the helper app show a drag bubble with attacker-chosen file names and subjects, which the user may then drag into a trusted application
New "Security token …" button in the Drag & Drop section of Mail → Advanced settings, with generate and copy-to-clipboard
Token-based mail drag-out plugin (PBSR-1791)
Emails can now be dragged out of App Suite into other web applications, not just desktop applications, using the new "Drag email to browser" button. Unlike the existing "Drag to desktop", which remains available, it works in every browser and not only in Chromium
A multi-selection is dragged as one list of all selected emails, up to 20 by default; larger selections get a hint. The overlay closes itself after two minutes, because the download links it hands out are short-lived
Enabled by default where the middleware supports it
Breaking change: Load external mail images directly; image proxy now opt-in 1279be5cf
External images in mail are now loaded directly by the browser (after the usual "images are blocked until you allow them" prompt), no longer through a server-side proxy. This is more reliable: central proxies are frequently blocked by content-delivery networks (Cloudflare, Akamai, …), which broke image loading for entire deployments.
Security is not affected. The reason the proxy existed is now handled by a strict Content-Security-Policy on the mail view, which blocks the same attacks regardless of how images load.
The proxy remains available but is now opt-in and OFF by default; its only remaining effect is hiding the recipient's IP address from the sender. Enabling it is not recommended unless IP hiding is a hard requirement, because proxied images often fail to load. To use it, configure the image proxy in the middleware and switch it on via io.ox/core//features/proxy (this setting only enables use of the proxy; it does not configure it).
Accept every url of a multi-line uri-list drop (PBSR-1791)
Cap oversized mail bodies with a clear truncation notice 280646eca
Fewer messages get truncated. The amount shown initially is raised well above the former 100 KB — to 3 MB on desktop and 1 MB on mobile. That tiny old cap routinely cut off ordinary mail, most often messages with inline images embedded as data URLs (a single one already exceeds 100 KB).
When a message is still larger than the initial cap, it is shown up to the cut-off point with a clear notice at the end and a "Show the entire message" action that loads the rest in place, up to 10 MB. Beyond that a notice states the maximum size that can be shown; the message can still be downloaded. Desktop and mobile behave the same.
The four size limits are configurable: io.ox/mail//maxSize/{desktop,mobile}/{view,viewLimit}.
Fetch mail unmodified (view=raw, no server proxy/sanitize)
HTML emails are now rendered fully in the browser: the middleware returns the message untouched and App Suite UI cleans and displays it itself. The UI has done the cleaning in the browser for years — this change now drops the middleware's remaining role, including its external-image proxy. The browser is the authority on parsing HTML and CSS, and the central proxy can be unreliable — CDNs (e.g. Cloudflare, Akamai) tend to block it, breaking images for whole deployments.
Dropping the proxy re-armed an attack it had been masking: a malicious email could reference an external font or stylesheet whose response demands authentication (Basic Auth), chaining to a native browser username/password dialog shown over the app (with attacker-chosen text) — making it look as though App Suite was asking you to sign in again.
Luckily, the fix is a simple to implement Content-Security-Policy on the mail-display frame — not sanitizing, since the email markup itself is harmless and the trick is in the network response. External fonts and media are blocked, so the prompt can no longer be provoked. Side effects: a sender's custom/brand font falls back to a standard system font (a minor visual change), and external content now loads only inside the isolated frame and only after you choose "Show images" — never silently in the background (which had also exposed your IP address to the sender).
Administrators who need a brand font in mail can allow-list a trusted font source via the io.ox/mail//csp/fontSrc setting (see documentation).
Gate 'Change permissions' on the announced permissions capability (PBSR-1812)
Harden Tempo timezone handling ddb54e36e
Appointments and invitations whose sender specifies the timezone as a plain UTC offset (for example "GMT-07:00") are displayed instead of breaking the view
Timezones keep the name they were received with, instead of being replaced by an outdated alias (for example Europe/Kyiv is no longer rewritten to Europe/Kiev)
Merge server unit tests into the root vitest run 4fb22a311
Share eml transfer sign-ins and offer to remember them (PBSR-1791)
A configured SystemV timezone is not resolved (ASB-134)
Before, a configured timezone from the older SystemV set (for example SystemV/CST6) was not translated to a supported one at startup. Dates and times were then shown in the wrong timezone, on some browsers the timezone could not be applied at all, and moving an appointment could store an unusable timezone on the server
Such a timezone is now resolved to its supported equivalent while the configuration is loaded, so it is applied correctly on startup
Accept token downloads in the uri-list mail import (PBSR-1791)
Add to Drive in Sharing Mail does not work after the share was removed from Drive (support#1563)
Always show close button in first-start wizard (bizdev-84)
Appointments from shared calendars hidden on mobile (support#1617)
Automatic replies for a shared account offer the shared account's addresses (support#1611)
The "Automatic replies" dialog of a shared account now offers the shared account's own addresses (primary plus aliases) in "Send from" and as additional recipient addresses; previously both lists showed the acting user's personal aliases, which are not valid for the shared account's rule
Blank UI on browsers without native Temporal (support#1626)
Button in Appointments might point to different Zoom meeting (support#1588)
Calendar: Email Attachment Without Preview (support#1532)
support eml attachments in all pim objects and drive
also support attachments of this eml attachments itself
Category or Attachment removed if created as an Follow-up (support#1620)
Closing the sidepanel leaves the app content pushed up on iOS (ASB-110)
Enterprise picker launcher opens a new floating window on every click (ASB-149)
Establish the existingSecret pattern for core-ui's db Secret (ASB-150)
New db.existingSecret and db.existingSecretKeys values read the database credentials from a Secret the chart does not create, for example one managed by an ExternalSecret
The database env vars and the migrations job now render on that path; previously they were emitted only for plaintext databases.* values
Exclude migration job pods from the core-ui service 8fafb8053
The core-ui service no longer routes requests to migration job pods
Horizontal mail view broken on tablets (support#1637)
Leading hyphens in task description not visible in task details (support#1590)
New assign action on contacts & tasks only allows one category (support#1609)
No read receipt prompt for own mails in a shared account's sent folder (PBSR-1786)
The "Send a read receipt" banner is no longer shown for the sender's own mails in sent and drafts folders; previously the sent folder of a shared (functional) mailbox offered to send a read receipt for one's own mail
Organizer appears twice when creating a follow-up (ASB-127)
Cause: a follow-up looked for the organizer among the copied participants by mail address, so an appointment created with a different sender address (an alias, or an address from before a domain rename) did not match and the organizer was added a second time
Solution: organizer and participants are now matched by identity, internal users by their user id and others by mail address; a follow-up also keeps the sender address of the original appointment as long as that address is still available
Quick Settings panel goes stale on view change (ASB-128)
Relogin dialog escape traps user in backgrounded OIDC PWA 9699760b3
Add a distinct, always-operable "Sign in again" escape button to the relogin dialog whose action calls a new state-independent recover() directly instead of routing through the consumable relogin:continue Deferred
Repair form semantics, focus rings and text spacing (ASB-118)
Resolve invalid user timezones from a single source of truth b1825ddb1
An invalid timezone in a user's configuration falls back to the local timezone instead of leaving dates unresolved
An unsupported favorite timezone no longer breaks the calendar settings pane
Clicking the "i" is selecting the contact instead of showing the contact overview in the enterprise contact picker (ASB-125)
Show manage shares button again after quick settings sidepanel refactoring 9b2ccffe1
Signature is lost when the compose editor is switched to HTML 68508c6d8
Signature placeholders in HTML attributes render nested markup (PBSR-1788)
Signature placeholders inside HTML attributes (e.g. <img data-src="{{ company.logo }}">) now render the plain value as documented; previously the key's default format nested markup inside the attribute, so e.g. the company logo never displayed
Signature preview freezes on a long run (ASB-151)
Fixed a freeze of the Email settings page caused by a signature containing a long run of non-breaking spaces, as produced by quoted text in some mail clients
The same freeze affected the Templates settings page
Task titles break in list view, sidepanel, and on mobile when show in calendars (ASB-141)
Fixed task titles breaking across two lines in the calendar list view, on mobile, and in the calendar sidepanel when tasks are shown in the calendar
Theme selection does not update the current card 51fbfaaaf
Unsharing mail folders is not working (support#1612)