Security
- Adding someone to your organization now always sends them an invitation, and nothing is created for them until they answer it. Where the email address does not yet have an ISO Mate account, choosing a password from that invitation is what creates the account and joins your organization, so an invitation nobody answers no longer takes up a place in your organization or a seat on your subscription. Recipients can also decline, and an address that was invited but never joined stays free to sign up on its own. Reported to us externally with a clear, reproducible proof of concept.
- PDF attachments are now cleaned when they are uploaded. A PDF can carry instructions that run automatically when the file is opened, and a document could use those to show a message box that looked like it came from ISO Mate, for example asking you to re-enter your password. Uploaded PDFs now have that capability removed before they are stored, and a document that cannot be cleaned safely is refused with an explanation. Existing attachments have been cleaned as part of this release. Reported to us externally with a clear, reproducible proof of concept.
- The limit on how many organizations one person can create is now enforced consistently, including when several are created at the same moment, so the ceiling cannot be stretched to collect additional free trials. Reported through our vulnerability disclosure program.
Improvements
- A role that allows managing users now also allows viewing the organization’s roles. Assigning a role to somebody means choosing from the list of roles, so a role that granted user management without it was unusable for the very thing it permits.
- The ticket form now shows the description last, below status, channel, priority, category, assigned agent, due date and tags. Those shorter fields are the ones changed most often, and they are now reachable without scrolling past the editor.
- Records linked to a ticket are easier to tell apart. Each one shows its type in its own colour, long titles no longer push the rows out of shape, and the status of a linked issue, task or incident appears as a coloured chip instead of plain text.
Fixes
- Viewing the members of your organization no longer shows a permission error to members who are not administrators. The list itself always loaded correctly. The message came from the page also trying to load the organization’s roles, which ordinary members are not permitted to see, so the filter by role is now only offered to those who can use it.
- Fixed the number of days remaining shown for a free trial, which was always a day short. A new organization now correctly shows 14 days rather than 13.