· We are pleased to release Zammad 3.5. This is also a Security-Release.
We always receive plenty of valuable suggestions and ideas on how to further improve Zammad (truly appreciated!). So here we go again: Zammad 3.5 offers new features that have been requested by our users for a while now: an easier process for deleting a user and the possibility of acting as both a customer and an agent. Let's dive in deeper! 🎈🎈🎈
Category: Data Security
Data security is a very current topic. We have now improved the way a user account (and its information) can be deleted in Zammad to be in line with the following regulations:
In Zammad's particular case this is related to enquiries about the deletion of a user's account and data. For example, a user might reach out to us and ask us to remove all their information from the system (which is always a bummer!).
Easy: A user and all their data and tickets can now be removed from the system within seconds. If they are the only user in their organisation, the organisation will be deleted too. However, auditability is still ensured, as all ticket numbers and pseudonymised user data remain in the system. So all editing history can still be retraced.
The result? An efficient solution to a concrete problem. Which is something only few helpdesk softwares can offer. ;)
The process is easy. There are two possible methods:
Afterwards you will be forwarded to the admin area of Data Privacy. A preview will show you which tickets are about to be deleted. Besides that you can also delete the organisation if no more users are connected to it.
The (asynchronic) process of deleting the user and their data will only start after you have confirmed this action twice. Hence a deletion by accident is pretty much impossible (please don't take this as a challenge to prove us wrong!).
And that's all, folks! 💪
Category: Permissions
If you're scratching your head now wondering why or for what purpose you would need this feature – don't worry: it is not relevant for all use cases. But for teams and organisations who use Zammad to administrate their own internal enquiries as well as customer tickets it is a big deal.
Until now Zammad was based on the concept that every user has one role. The role defines what the user can do and which menus and overviews they can access in the Zammad web surface.
Now Zammad can also reflect extensive organisational and administrative structures. The corresponding rights are very easy to grant.
The main benefit of this new feature can be easily explained in a simple example: Imagine there is an HR team and an IT team within the same company, and both are using Zammad.
Which would cause the following situations:
These restrictions are now a thing of the past, since users can be both agents and customers.
It's as easily said as it is done:
Go to the user management of the admin section, where you can now grant any user with both admin and customer rights. Afterwards you can decide which group(s) the respective rights are used and performed in. There – done already!
Some longtime users of Zammad, including several teams working with Zammad, have been asking to rebuild this permission structure. And thanks to our feature sponsors we have now changed the perspective and realigned structures: the City of Dornbirn Hospital and the EKHN (The Protestant Church in Hesse and Nassau). 🎉🎉🎉
Zammad is here to build a rock-solid customer service platform you can rely on. If there are things you wish Zammad could do, don't hesitate to get in touch and find out how to make your feature idea a reality.
After the major security audits of Zammad 3.3, we took the opportunity to dig in a little deeper ourselves. Thanks to additional support from the community, we’re proud to report that we’ve identified and fixed two more vulnerabilities in Zammad.
Hosted users: Your instance has been automatically updated already. No action on your part is required.
Self-hosted users: We recommend that you update your installations immediately.
The following Security Advisories have been addressed in this release.
It's strongly recommended to update the NGINX / Apache2 configuration according to ZAA-2020-18 Authentication bypass in SSO endpoint (CVE pending)
The required Ruby version was changed from 2.6.5 to 2.6.6 due to the security vulnerabilities CVE-2020-10663 and CVE-2020-10933
Debian 8 has reached EOL status and will no longer be provided packages for with the upcoming Zammad version 3.6
The SSO functionality now needs to be activated via Admin -> Security -> Third-party Applications -> Authentication via SSO
The add and delete endpoints of the REST API for tags and links have changed
All improvements can be found in the changelog.
Changelog (2020-09-22)
Changelog (2020-09-22)
Information about upgrading a Zammad installation can be found here:
Your Zammad team!