Release Notes for Allegra 9.0.3

Security, Resource Planning and Stability

Allegra version 9.0.3 strengthens security throughout the application. The REST interface now limits requests to public endpoints and failed sign-in attempts, field restrictions and read permissions are applied more consistently, and several third-party libraries were updated. In resource planning, skill profile assignments now express a share of the whole pool. The rich text editor was improved as well, and numerous fixes benefit the Service Desk and everyday work with items.

Important: Please clear your browser cache after the update to ensure that all changes are loaded correctly.

If you are using the Allegra Service Desk application, please ensure it is updated as well to maintain compatibility.

Improvements

[31670] New Word export for one or more items, with a configurable selection of fields and related item data
[32103] Rich text editor improvements and bug fixes
[32923] Improved context-specific help
[33138] Improved REST API rate limiting
[33194] The percentage of a skill profile assignment now refers to the share of the whole pool
[33237] Security improvements and dependency updates

Skill profile assignments: 100% now stands for the whole pool, consistent with personal resources, where the percentage refers to the person’s capacity. Existing assignments on skill profiles with a capacity are converted automatically during the update; profiles without a capacity remain unchanged. The capacity of a skill profile must now be a positive number.

Rate limiting: The REST interface now also limits requests to public endpoints (per IP address) and failed authentication attempts (per IP address and credential). Both limits can be adjusted in conf/application.properties:

allegra.ratelimit.public.capacity (default 1200): maximum number of requests in a burst
allegra.ratelimit.public.refill-tokens (default 1200): number of requests made available again per period
allegra.ratelimit.public.refill-period-seconds (default 60): length of the period in seconds
allegra.ratelimit.authfail.capacity, allegra.ratelimit.authfail.refill-tokens and allegra.ratelimit.authfail.refill-period-seconds (default 60 each): the same for failed authentication attempts

When a limit is reached, the response includes a Retry-After header indicating when the next request will be accepted.

Bug Fixes

Email and Notifications

[32999] Inline-referenced files are attached to notification emails again
[33050] Improved email polling from Microsoft Exchange

[32943] Field restrictions are no longer cancelled by a role without read, modify or RACI rights
[32969] Fixed the item share link after a single sign-on login
[33250] Fixed the visibility of shared filter links created by other users

Working with Items

[32951] Fixed the numeric keypad entering wrong characters in the column filter search
[33245] Fixed the rendering and reloading of Scrum charts and restored the button for creating a cockpit from a template

Editor and Text Templates

[32916] Table column widths in text templates are retained after saving
[32917] Fixed the display of text templates in read mode
[32918] Table editing options are now also available in full-screen mode

Resource Management

[33189] Assigning a skill profile, location or other non-personal resource no longer offers adding it as editor or informed
[33242] Fixed skill profiles showing 0% workload when their manager is also the item’s responsible
[33244] Fixed saving the manager of a resource

Configuration and Administration

[33085] Fixed deleting deactivated users and guests
[33248] The cost center tree is refreshed after adding a cost center
[33258] The project setting “Disable version control” now takes effect

Service Desk

[32906] Fixed an error when creating items with restricted fields
[33080] The error page for denied access shows the server’s message and no longer refers to a lockout after failed sign-ins
[33140] Watchers whose email address contains special characters such as ”+” can now be added
[33174] Fixed saving items with extensible select fields; errors when saving are now always displayed
[33251] Fixed adding watchers
[33252] Fixed an error when loading avatars
[33253] Meaningful error message when an item cannot be found

Interfaces

[33083] Fixed a “403 Forbidden” error when creating tickets through the REST interface
[33138] The REST interface answers invalid requests with status 400 instead of 500

Christoph Friedrich

CEO Alltena GmbH

Christoph Friedrich is a computer scientist and certified Project Management Professional. He has extensive experience in the introduction and integration of project management tools as well as the analysis and definition of processes in project and service management.