Release 4.3.6

Security fixes

• Password reset hardening – the reset token is now bound to the account it was issued for
• Sessions and login hardening – session identifier regeneration, login rate limiting, stricter cookie flags and session revocation on logout
• Report engine input handling – query parameters and PDF export in the report REST layer are validated more strictly
• Additional hardening – stronger password hashing, HTTPS/HSTS headers, less detailed error output, session timeout handling and rate limiting of the password reminder

New features

• Vuetify 4 – the frontend now uses Vuetify 4
• Faster record view – the record view loads noticeably faster thanks to fewer parallel requests
• Custom actions – record, mass and subpanel actions can now be loaded from custom/
• Mass update panel – shown above the list, below the filters
• No duplicated frontend files – the frontend build is no longer copied to the installation root and is served from vue/dist

Bug fixes

• Deleting records with child records (e.g. Kudos) no longer fails with an Internal Server Error
• Sending e-mail now authenticates correctly on standard SMTP servers
• Work plan duration is recalculated after changing dates in the work plan manager popup
• Fixes in creating work plans from the calendar, including skipping the activity dialog
• Fixed assigning the source value in the Candidatures module
• Fixed sidebar background and visibility after resizing the window
• Calendar API no longer returns removed meeting and call attendees