BM-24410: Special characters are displayed verbatim in the legacy contact autocomplete, search highlighting, contact suggestions and the contact card note.
A subscription is no longer considered to have expired at 00:00 on its final day: the end date is now included. This prevents schema upgrades from failing on that day and eliminates any gap between two consecutive subscriptions.
Fix: Only an organizational unit manager can modify the administrators of a unit. A delegate can only grant or revoke the roles that they hold within the unit.
Fix: Only a domain administrator can remove a user from the list of administrators for all organizational units within the domain.
Fix: An organizational unit delegate can no longer move an external user from the domain root or another unit into their own unit.
Fix: An organizational unit delegate can no longer move a domain address book or calendar outside their unit (to the domain root or another unit).
Fix: Moving an address book or domain calendar to another unit is now processed immediately: delegates from the old unit immediately lose their access rights to it.
Fix: Only a user with the "check&repair" role can initiate the repair of a directory entry within the domain of that entry. Domain administrators and the relevant unit can still initiate the repair.
Fix: The Kerberos key (keytab) is no longer returned in plain text by the domains API: it is displayed in the format ****. Saving a domain via the console retains the existing key if the value is hidden or empty.
Fix: The list of a user’s containers now only displays those to which the user has access (their own, those shared with them, or those belonging to a user or shared mailbox that they manage).
Fix: A domain administrator can now only restore data from their own domain. Administrators of the relevant domain and holders of the manageDataProtect role can still do so.
Fix: A domain administrator can no longer make changes to mailboxes, groups or settings in another domain (quota, filter, index consolidation, reading settings, etc.).
Fix: Administrators of users, groups, shared mailboxes, resources, address books and domain calendars can now only perform actions (share, rename, configure, publish, synchronise, reset) on containers of that specific entry type. The domain S/MIME certificate manager no longer has any rights over containers. Domain administrators and unit delegates retain their rights.
Fix: A re-indexing request (for calendars, address books, to-do lists, notes) made without the necessary permissions is rejected immediately, without launching a task that would subsequently fail. The required permissions remain unchanged.
Fix: Modifying a domain’s authentication settings no longer writes the Kerberos key or the OpenID client secret to the logs. Only the name of the modified property is logged.
Fix: The ‘Read domain filters’ role no longer allows users to add, edit or delete domain filter rules. These actions require the ‘Manage mail filters’ role.
Fix: Only a system administrator can add or remove an index from the mail index ring. A domain administrator now receives a permission error.
Fix: A domain administrator can now only delete task runs within their own domain. The global administrator ‘admin0’ can still delete task runs across all domains.
Fix: Only users with the systemManagement or bmMonitoring role can view hot upgrades (ongoing, scheduled jobs, and completed tasks, and their progress). Launching them requires the systemManagement role. The notification regarding failed mandatory hot upgrades continues to be displayed to administrators.
Fix: An internal call to the core can no longer modify or delete a global parameter without the systemManagement role, even when using a domain administrator’s context.