Updating to version 3.20.2

The values an email template renders are now escaped before they reach the body, so that a name, a justification or any other stored text cannot carry markup or code into a notification.

The templates shipped with RAC/M are updated. The tasks below apply only if you deployed your own copy of a notification template, which the update does not rewrite.

Post-startup tasks

• (If you customized the notification templates) Replace the == true comparison of the removed roles in remove_accesses_request/<language>/task.html:

  Required

  Left as it is, the task notification of a remove accesses request is no longer sent at all: the comparison fails while the body is rendered and the notification is abandoned.

  Before:

  @if{request.?rolesToRemoveLi == true}

  After:

  @if{request.?rolesToRemoveLi != ''}

  If you personalized other templates, make sure the following attributes do not use == true:

  • accountsToActivateLi
  • groupsToAddLi
  • groupsToRemoveLi
  • rolesToAddLi
  • rolesToRemoveLi
  • toAddLi
  • toRemoveLi
  • writtenRequestListLi
  • writtenRequestsLi