Going Backwards | Browser Extension & API
Passbolt 5.14.3: “Going Backwards” is a hotfix that addresses issues identified after the 5.14 release.
Safer Permission Handling for shared folders
When creating a resource in a shared folder where the user is not the owner, the dialog allows editing the permissions inherited from the parent folder, potentially overriding the access structure established by the organization. The dialog now opens in read-only mode in this situation, allowing the user to review permissions and group members before proceeding without overriding the permissions. Users authorized to manage access can still update permissions directly.
Fewer interruptions for routine edits
Following the introduction of the permission confirmation dialog in 5.14, the dialog appeared when editing only the metadata of a shared resource, such as renaming it, even though no secret was changed. It now appears only when the secret is modified.
Correct plugin availability detection
The in-form menu could appear even when disabled on the API by feature flag. The API could in some cases return plugin configuration in an unexpected format, and the browser extension would fall back to enabling any plugin whose setting did not strictly match. Both the API and the browser extension now enforce a strict format, and the in-form menu correctly reflects the settings.
Finally, a separate regression prevented the API from running over HTTP. While this is not recommended, the regression could break testing or staging instances not using HTTPS.
Conclusion
Many thanks to everyone who reported these issues.
API
Fixed
- PB-53457 Fix env()-backed config flags to enforce strict boolean type
- PB-53498 Fix CSRF cookie not working over HTTP deployments
Browser extension
Fixed
- PB-53406 - PCD: do not display when editing a shared resource metadata only
- PB-53417 - PCD: creation of a shared resource in a non owned folder should display the PCD in read-only
- PB-53546 - SiteSettings: Fix passbolt.plugins.inFormIntegration.enabled type from string to boolean
