Summary 🌟
In this release note, we’ve improved the contract creation UI and , enhanced security by masking sensitive data , and redesigned various UI elements including error pages and icons. As for bug fixes, XSS vulnerabilities, OAuth errors and unauthorized access from Jira Service Desk customer session tokens resolvedsuch as IP addresses and phone numbers. Additional improvements include a redesigned 'no result' icon, upgraded error pages for clearer messaging, and added security checks. Finally, we fixed a 400 Bad Request OAuth error to prevent unauthorized requests.
...
Improvements
Improved UI for adding new signers when creating contract
...
Improved security by masking of sensitive data
We have improved the security of our system by masking sensitive data. This includes IP Addresses, name, phone numbers, secrets. They are now masked in the .toString()
method.
Redesigned icon for 'no result' in dashboard
We have replaced old icon with magnifier icon.
...
Improved security verification
We have introduced an additional security check in the AtlassianAuthHandler
by verifying a special boolean condition URL parameter. This enhancement ensures that direct calls from Atlassian Jira to our app maintain security integrity without impacting functionality.
Redesigned error pages for detailed information
Error pages are redesigned to view issue page with respective message like license expired, Atlassian reload required, version mismatch. Applied for a view for both light and dark mode.
...
Bug Fixes
Fixed
...
We have resolved a stored XSS vulnerability in the "Person" name field on contract pages.
Fixed OAuth Error
We resolved an issue where users encountered a 400 Bad Request
error. The fix ensures preventing unauthorized requests.
Fixed unauthorized access from Jira Service Desk customer session token
We have fixed an issue where Jira Service Desk customers with "customer" privileges could access contracts linked to their requests without authorization. Now, only authorized users can access and manage contracts, preserving the confidentiality of sensitive contractual information and preventing unauthorized actions.https://warsaw-dynamics.atlassian.net/issues/DS-591?jql=project%20in%20%28%22Contract%20Signatures%22%29%20AND%20issueType%20%21%3D%20%22Sub-task%22%20AND%20status%20changed%20TO%20%22Released%22%20DURING%20%28%222024%2F07%2F01%22%2C%20%222024%2F07%2F31%22%29