Group Office 6.8.128

26 June 2025

Group Office version 6.8.128 is now available.

Upgrading to Group Office 6.8.128

What's New in Group Office 6.8.128

• Core: Fixed cursor jump in Firefox
  

• Files: only display 'Share' menu if sharing options are available.
  
• Core: better label for 'allowRegistration' option in system settings.
  

• Tasks/Core: Fixed invalid change event in tasklist combo where the tasklist name would be the value in the change event
  
• Leavedays: allow employees to request negative hours
  
• Core: SSE Push was broken
  
• Core: Polling omits Search and User like SSE for performance
  

• Leavedays: Manager of logged in user got notification if you added a holiday on behalf of someone else
  
• Updated German translations. Danke, Daniel!
  
• Leavedays: fully refactor notification
  
• Files: Use load() instead of reload() otherwise it might retrash the files as it will send the last load params
  
• Newsletters: When setting max messages per minute to 0 it will send as fast as possible and doesn't default to 120 messages per minute
  
• Newsletters: When a sending limit is applied the sending time is now taken in to account too.
  

• Leavedays: do not show notification if no open leave days (again)
  

• Leavedays: fix status loop when disapproving leave day requests
  
• Freebusy: Fix non editable free busy permissions after user creation
  
• Supportclient: Fixed grouping in support lists
  
• Core: XSS error fixed in my account -> sync
  
• Core: Reflected XSS in Look and feel section of the application
  
• Leavedays: add counter for open leave day requests
  

• ActiveSync: z-push sync for notes and tasks #1289
  

• Workflow: prevent sorting by virtual column
  
• Files: prevent permission error when restoring trashed file
  

• Files: Fixed opening file from link or search result
  
• Core: Z-Push upgraded to 2.7.5 (With some patches from us).
  
• Finance: Work around missing VAT rate ID
  
• Leavedays: force manager to select existing special leave budget when applicable
  

• OAuth2 client: minor tweak project_id label
  
• Core: Fixed: Blind Stored XSS in Phone Number Field Enables Forced Redirect and Unauthorized Actions
  
• Core: Fixed: DOM-Based XSS in all Date Input Fields Allow Arbitrary JavaScript Execution
  
• Core: fixed Stored XSS in Tasks Comment Section
  
• Files: Fixed: Group-Office vulnerable to path traversal Vulnerability ID: JVN#23673287
  
• History: Fixed cross site scripting vulnerability JVN#30520482, JVN#87138325 and JVN#72111431
  
• Email: fix deprecation error
  
• Support: bugfix saving default task list
  
• SUpportclient: make support list combo single select in 'new request' window
  

• ActiveSync: Fix broken utf-8 when recreating MIME for Z-push
  
• Comments: use translations for tasks feedback
  
• Core: Reset create link button on close so it won't fail when dialogs perform an async task before opening. This happened with documents in finance.
  
• Finance: Add payment due date to Zugferd invoice
  
• Addressbook: Filter ICD combo by selected country from address
  

• Files: fix ACL issues when restoring files or folders to their original position
  
• Files: Disable new webdav locking by default to test it more. can be enabled with $config['webdavEnableLocks'] = true;
  

• sync: workaround for Z-push error SyncObject->Check(): object from type SyncMail: parameter 'to' contains an invalid email address 'undisclosed-recipients:'. Address is removed.
  
• tasks: correct invalid state where due is before start date
  
• Files: do not show "Properties" menu when folder-id is not numeric
  
• Files: Dragging folders in tree was not possible
  
• Files: Merge folders if exist
  
• Files: pressing delete-key will not continue trashing a file with insufficient permissions
  
• Files: hide trash folders for non-admins
  
• Files: fix ACL issues when restoring files or folders to their original position
  
• Core: Shorten long filenames in the file button fields so the trash button is visible