| Table of Contents | ||
|---|---|---|
|
This release note is in progress
Summary 🌟
In this release note, we 've introduced new automation tools, an option to abstain, and enhancements like date and time synchronization, along with styling fix and updates.
New Features 
...
introduce improved filtering, and several bug fixes. Notable updates include security vulnerability fixes, and improved CSS styling.
...
Improvements
Improved Visual & Layout
| Status | |
|---|---|
|
...
Improvements
Replace icon for 'no result' - dashboard
| Status | ||||
|---|---|---|---|---|
|
Replace old ES icon with magnifier icon
...
|
...
New type of definition step, ‘Automation Step’ has been added.
Automation step has features listed below.
Change Page StatusThis action changes the status of a page and offers two options.Space suggested status - the user can provide the name of the desired status. If no status with that name is found, this step will be skipped.Custom status - As custom statuses are user-specific, You need to provide a name, and we'll match it with the statuses available to the user who started the approval, or create a new one for them. Alternatively, you can select a user, choose one of their statuses, or provide a new one. The custom status will be added by the selected user. If you provide a custom status that does not yet exist, you can also select its color. The default color is blue.
Add a Comment on PageAdds a text comment to a page.
Add/Remove Label(s)Adds or removes a label on a page.
Set Entity PropertyAdds an entity property with a specified key and value. You can use page properties to generate detailed reports on pages that are not covered by Confluence's default fields.
Abstain option
| Status | ||||
|---|---|---|---|---|
|
Abstain option has been implemented. This option was added due to customer’s feedback. Abstain allows approvers to express vote of abstention, it also works as silent approval. Here is available Abstain Option documentation for details.
Success step
| Status | ||||
|---|---|---|---|---|
|
...
|
Tasks marked as "Done" now show with a strikethrough, now it’s easy to distinguish if tasks are completed.
...
We have also improved the scroll behavior on the timeline table. Both horizontal and vertical scrolls are now visible.
Card layouts are now evenly distributed across the page for a cleaner look. Also, a new icon has been introduced for "no result" in the dashboard.
...
Improved user verification
| Status | ||||
|---|---|---|---|---|
|
We have improved the SAML workspace setup process by introducing a mandatory user verification step. This ensures that only for creating or joining new SAML workspaces. Only authorized users can create or join a new SAML workspace.
Improved
...
filtering for the filter/JQL share view
| Status | ||||
|---|---|---|---|---|
|
Added text input support for label filtering in JQL. Previously, labels couldn't have spaces or special characters, causing errors. This restriction has been removed, allowing more flexible label usage.
...
You can now filter by additional fields, including user, project, and status, allowing for more precise searches.
Improved user experience
| Status | ||||
|---|---|---|---|---|
|
Added strikethrough text to the status of issues marked as "Done" on both boards and custom boards. This enhancement visually distinguishes completed tasks from ongoing ones, improving clarity.
Improved Link Management: Drag and Drop for Order
| Status | ||||
|---|---|---|---|---|
|
...
In Global Settings - Page Customization, links can now be rearranged via drag-and-drop
...
Added Confirmation Popup for "Restore Default Values"
| Status | ||||
|---|---|---|---|---|
|
...
. Also, We added a confirmation popup for the "Restore all default values
...
?" button to prevent accidental resets.
...
We have redesigned error pages with more detailed information.
We replaced the markdown editor with a custom editor, allowing for more customized comment formatting.
Bug Fixes
...
Security Fixes
| Status | ||||
|---|---|---|---|---|
|
| Jira Legacy | ||||||
|---|---|---|---|---|---|---|
|
Igor Hercer
...
Fixed issues where unauthorized users could delete shares or change board settings, and corrected a security issue so attackers won’t be able to access or change settings.
Fixed XSS vulnerability
| Status | ||||
|---|---|---|---|---|
|
| Jira Legacy | ||||||
|---|---|---|---|---|---|---|
|
...
Resolved an XSS vulnerability triggered when creating an external share link with a project name containing an XSS payload.
Fixed SMTP issue
| Status | ||||
|---|---|---|---|---|
|
We resolved Fixed an issue where the comment author prefix was not appearing in Jira when comments were added via External Share. After the fix, comments now correctly display the author's name.
Comment window in es link overlaps with other fields when a window is small
| Status | ||||
|---|---|---|---|---|
|
Make a small window in you browser
Observe the behavior
...
custom email settings blocked notifications from being sent to users.
Fixed filter error
| Status | ||||
|---|---|---|---|---|
|
Previously, when users entered a project name in the search input, an error page was displayed. After the fix, the system now correctly displays issues or results from the searched project as expected. Additionally, filtering using multiple projects via JQL is now fully supported without errors.
Unauthorized Share Deletion Vulnerability Fixed
| Status | ||||
|---|---|---|---|---|
|
We addressed a critical security issue where users with customer privileges in a Jira Service Desk portal could delete external shares, even without direct Jira access. The vulnerability allowed customers to obtain a valid JWT and delete shares created by Jira administrators, compromising the integrity of shared information. This issue has now been fixed, and external shares are secured from unauthorized deletion. All operations related to shares—list, get, update, delete, and email notifications—have been thoroughly tested and verified to function correctly across different pages and roles.
...
. Also, fixed an issue where null values in time tracking fields caused crashes in the filter view.
CSS Fixes
| Status | ||||
|---|---|---|---|---|
|
We addressed a security vulnerability where a "customer" user, self-registered on a Jira helpdesk portal, could modify the board card settings in Jira without direct access to the system. The issue allowed attackers to obtain a valid JWT and manipulate the configuration of board cards, compromising the integrity of external shares. This vulnerability has been resolved, ensuring that only authorized users can modify board card layouts, and external attackers are now blocked from altering these settings.
Cross-Instance IDOR Vulnerability Fixed in Jira Share Settings
| Status | ||||
|---|---|---|---|---|
|
We resolved a critical broken access control vulnerability in the Jira external share application that allowed an attacker from one Jira instance to modify external share settings in a different Jira instance. This vulnerability occurred when attackers used the GID (globally unique identifier) of a share to alter settings, such as changing the board configuration, issue displays, and permissions, compromising the confidentiality and integrity of shared data.
With this fix, external share settings are now protected from unauthorized cross-instance modifications, ensuring that only users with proper permissions can alter these settings.
Cross-Instance IDOR Vulnerability Fixed: Unauthorized Access to Jira API Key Usage History
| Status | ||||
|---|---|---|---|---|
|
We fixed a severe cross-instance IDOR (Insecure Direct Object Reference) vulnerability in the Jira external share application. This flaw allowed attackers to access the API key usage history of any other Jira instance. The issue occurred when an attacker, authenticated in their own Jira instance, could use a JWT to retrieve sensitive information, such as request details, IP addresses, user agents, and API key activity from a victim's Jira instance.
With the fix, the confidentiality of API key usage data is protected, and only authorized users within the same instance can access this sensitive information.
Fixed Issue with allowCreateNewIssue Field Not Set During Share Creation
| Status | ||||
|---|---|---|---|---|
|
We resolved an issue where the allowCreateNewIssue field was not being set during the creation of a new share in Jira. This caused the permission to create new issues via the external share to remain disabled by default. After the fix, the allowCreateNewIssue field is correctly set during share creation, ensuring that the intended permissions are applied consistently.
Custom board - unable to start watching issues
| Status | ||||
|---|---|---|---|---|
|
Previously, attempting to watch issues resulted in an error. This bug has been fixed, and users can now successfully watch all issues on custom boards without errors.
...
Fixed an issue where extra space appeared when using the "Group By" filter on board.
Fixed wrong color text format tab appeared in dark mode.
Fixed display issues where icons for issue types were not showing up properly in shared links.
Fixed an issue where long text and code snippets overflowed in the comment section.
...
Fixed comment issue
| Status | ||||
|---|---|---|---|---|
|
We fixed CSS styling issues in dark mode where "Issue Type - Description" and "Timeline - Filters" had unreadable whitish backgrounds with gray text. The colors are now adjusted for better visibility and readability.
...
Fixed an issue where the author's name was missing from comments.
Fixed multiple submission issue
| Status | ||||
|---|---|---|---|---|
|
We fixed CSS styling issues in dark mode where "Issue Type - Description" and "Timeline - Filters" had unreadable whitish backgrounds with gray text. The colors are now adjusted for better visibility and readability.
Fixed Frontend Error: 'undefined' Provided Instead of Stream
| Status | ||||
|---|---|---|---|---|
|
We resolved an error where 'undefined' was given instead of a valid stream type
| Jira Legacy | ||||||
|---|---|---|---|---|---|---|
|
| Jira Legacy | ||||||
|---|---|---|---|---|---|---|
|
Fixed Extra Space in Board Share Group By Filter
| Status | ||||
|---|---|---|---|---|
|
Resolved an issue where extra space appeared when using the "Group By" filter on boards and custom board shares for fields like Epic and Assignee'Create External Share Board' button is now disabled immediately after the first click to prevent multiple submissions due to delayed response.