BM-23976: Fixes: When the network context changes, if the BlueMind client (Electron) is not restarted (and remains open), emails may no longer be sent, with a draft becoming stuck in a state where it cannot be saved, thereby preventing all other drafts from being saved.
BM-21721: Fixes: Loss of organizer on single appointment.
BM-23321: Fixes: Duplicate entries in the mapping of properties named ‘Outlook’ (pidmapping), which could prevent the installation upgrade from completing.
BM-24004: Fixes: Loss of an email saved in .msg format when dragged and dropped onto an appointment in Outlook.
BM-24250: Fixes: Confirming a calendar event causes the event to disappear in Outlook.
Fixes: Inability to attach a file that has already been attached to an event when the user does not have the permission to link files, and the removal of existing attachments from the event.
Fixes: A meeting may end up with no organiser or participants when Outlook sends a meeting request without an username.
Fixes: A contact search in the global directory could, for example due to a typo in an address, return all records in the domain, causing significant slowdowns in Outlook.
Improved reliability and performance of searches in the Global Address List (GAL) from Outlook during periods of high concurrent usage.
Several reliability fixes for server cloning that could have led to data loss or a complete system freeze: user settings and mailbox upgrades entered prior to the directory migration not being restored; organizational units or groups deleted but mistakenly recreated; and the decision to clone the directory being made on the wrong server (in which case the directory was not restored by either of the two streams).
Fixes: deadlocks and data corruption related to concurrent access during restoration (directory restoration pipeline, cloning status file potentially becoming unreadable and preventing recovery, orphan and starvation handlers).
Fixes: cloning no longer fails when a folder has an empty name (a random name is assigned; a subsequent save renames it).
Note: Concurrent restoration of the directory via the dir topic is temporarily disabled. The directory is restored from the domain topic, as was the case prior to migration.
BM-24040: Fix: Address books, calendars, to-do lists and notes linked to a shared mailbox are now correctly synchronised with that mailbox’s permissions: a user can no longer inadvertently reduce their own sharing rights on these items.
(Critical): Sorting of emails and conversations now only accepts known columns. An unknown column is rejected with the error INVALID_PARAMETER.
(High): the resolution of external entities and DTDs is disabled in the XML parsers of the DAV server (CalDAV/CardDAV), in net.bluemind.utils.DOMUtils (CAS, MAPI), in the MAPI tags and in the BigBlueButton client.
(Critical): Queries on scheduled jobs pass the domain as a bound parameter. A domain administrator can now only see runs within their own domain.
(Medium): The directory (AD/LDAP) password cache is cleared every time a password is changed in BlueMind. It now stores an HMAC hash instead of the plaintext password. Its duration can be set using core.security.directory-password-cache-ttl (maximum 20 minutes). (BM-24181)
(Medium): The BM* identity headers sent by the client are removed before processing.
(Hardening): requests for file sharing and password expiry now use related parameters.
Upgrades:
PostgreSQL 18.6
bm-JDK 25.0.4.1 (with fix for the update-alternatives configuration)