diff --git a/source/administration-guide/comply/electronic-discovery.rst b/source/administration-guide/comply/electronic-discovery.rst index bea43c2bcef..166081be688 100644 --- a/source/administration-guide/comply/electronic-discovery.rst +++ b/source/administration-guide/comply/electronic-discovery.rst @@ -58,7 +58,7 @@ Include the ``token`` value sent in the response as part of the Authorization he .. code-block:: sh - curl -i -H 'Authorization: Bearer yi94pwci6ibjfc9phbikhqutbe http://yourmattermosturl/api/v4/users/me' + curl -i -H 'Authorization: Bearer yi94pwci6ibjfc9phbikhqutbe' http://yourmattermosturl/api/v4/users/me Once you're authenticated into Mattermost, you can use the `Compliance API to create a new compliance report `__. The curl based example below demonstrates how to send a request that bases the authentication token and asks Mattermost to create a report that spans posts from Dec 31, 2017 - 8:15 PM to Dec 31, 2018 - 8:15 PM for a user with the email address craig@mattermost.com: diff --git a/source/administration-guide/configure/authentication-configuration-settings.rst b/source/administration-guide/configure/authentication-configuration-settings.rst index 9052f3087d9..f9e68d6b7cf 100644 --- a/source/administration-guide/configure/authentication-configuration-settings.rst +++ b/source/administration-guide/configure/authentication-configuration-settings.rst @@ -821,9 +821,6 @@ ID attribute .. note:: If a user's ID Attribute changes, a new Mattermost account is created that is not associated with the previous account. If you need to change this field after users have signed-in, use the :ref:`mmctl ldap idmigrate ` command. -.. note:: - The ID attribute value is matched verbatim - Mattermost applies no case normalization. With PostgreSQL's default case-sensitive collation, a change in casing is treated as a new user and a separate account is created. Ensure your AD/LDAP server returns this attribute with consistent casing. - .. config:setting:: login-id-attribute :displayname: Login ID attribute (AD/LDAP > Account Synchronization) :systemconsole: Authentication > AD/LDAP @@ -1032,9 +1029,6 @@ Group ID attribute .. note:: This attribute is only used when AD/LDAP Group Sync is enabled and it is **required**. See the :doc:`AD/LDAP Group Sync documentation ` for more information. -.. note:: - The Group ID attribute value is matched verbatim - Mattermost applies no case normalization. With PostgreSQL's default case-sensitive collation, a change in casing means Mattermost no longer recognizes the previously synced group and treats it as a new, unlinked group. Ensure your AD/LDAP server returns this attribute with consistent casing. - Synchronization performance ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ @@ -1561,9 +1555,6 @@ Id attribute | String input. | - Environment variable: ``MM_SAMLSETTINGS_IDATTRIBUTE`` | +----------------------------------------------------------------------------------------------------------------------+--------------------------------------------------------------+ -.. note:: - The ID attribute value is matched verbatim - Mattermost applies no case normalization. With PostgreSQL's default case-sensitive collation, a change in casing is treated as a new user and a separate account is created. Ensure your identity provider returns this attribute with consistent casing. - .. config:setting:: guest-attribute :displayname: Guest attribute (SAML) :systemconsole: Authentication > SAML 2.0 diff --git a/source/administration-guide/configure/azure-blob-storage.rst b/source/administration-guide/configure/azure-blob-storage.rst deleted file mode 100644 index 2a238454a3c..00000000000 --- a/source/administration-guide/configure/azure-blob-storage.rst +++ /dev/null @@ -1,217 +0,0 @@ -Configure Azure Blob Storage as the Mattermost file store -========================================================== - -.. include:: ../../_static/badges/all-commercial.rst - :start-after: :nosearch: - -Mattermost can store user uploads -- attachments, profile images, plugin assets, emoji, compliance exports -- in an Azure Storage account. This guide walks an administrator through the steps to provision the Azure side and point a Mattermost server at it via the System Console. - -Prerequisites -------------- - -- An Azure subscription with a storage account and a container already created. -- Either the Azure portal, or the `Azure CLI `__ (``az``) installed and signed in with ``az login``. Both are documented below. -- A Mattermost deployment (v11.9 or later) with System Console access for a System Admin account. - -If you plan to migrate existing files from another backend, take a backup of the current storage location (S3 bucket, local disk, etc.) before changing the configuration. Switching the file driver does not migrate existing files automatically. - -Step 1: Choose an authentication mode -------------------------------------- - -Mattermost supports two ways for the server to authenticate to Azure. Pick the one that fits how the server runs: - -- **Shared key**: the server signs each request with the :ref:`Storage Account access key `. Works anywhere Mattermost runs (on-premises, non-Azure cloud, local development) because it does not depend on the host having an Azure identity. The trade-off is that the key is a long-lived secret stored in ``config.json``. -- **Default credential (Microsoft Entra ID)**: the server obtains a token from Microsoft Entra ID and signs requests with it. No long-lived secret in Mattermost configuration. This is the recommended mode for deployments running on Azure, where the host environment already provides an identity (managed identity on Azure VM / App Service / AKS, workload identity for federated workloads, or a service principal). - -The Azure-side setup differs slightly between the two modes. Follow the subsection that matches your choice; you can switch modes later by changing the :ref:`Azure authentication ` setting in the System Console. - -Option A: Shared key -~~~~~~~~~~~~~~~~~~~~ - -Retrieve the Storage Account access key. - -**Azure portal** - -1. Open the storage account, then **Security + networking** > **Access keys**. -2. Select **Show** next to ``key1`` (or ``key2``) and copy the value. - -**Azure CLI** - -.. code-block:: bash - - az storage account keys list \ - --account-name acmemattermost \ - --resource-group mm-prod-files \ - --query "[0].value" -o tsv - -.. note:: - - Treat the shared key as a secret -- anyone with it has full access to the storage account (every container and all data it holds). A shared key can't be scoped to a single container, to specific operations, or to a resource group; if you need least-privilege access, use `Option B: Default credential (Microsoft Entra ID)`_ with a container-scoped **Storage Blob Data Contributor** role instead. Azure provides two keys so you can rotate without downtime: update Mattermost to ``key2``, regenerate ``key1``, then swap on the next rotation cycle. Plan a rotation cadence that matches your organisation's policy. - -Option B: Default credential (Microsoft Entra ID) -~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -The server uses ``DefaultAzureCredential`` from the Azure SDK, which discovers a working identity at runtime in this order. The first source that returns a token is used. - -#. ``EnvironmentCredential`` -- service-principal environment variables. -#. ``WorkloadIdentityCredential`` -- federated workload identity. -#. ``ManagedIdentityCredential`` -- the platform-provided managed identity. -#. ``AzureCLICredential`` -- the signed-in ``az`` session, useful for local development. - -Whichever identity the SDK selects, **that** identity needs **Storage Blob Data Contributor** (or a custom role with the equivalent ``read/write/list/delete`` data-plane actions) on the storage account or container. Without it, ``TestConnection`` returns ``AuthorizationPermissionMismatch``. - -Pick the identity source that matches the host: - -.. list-table:: - :header-rows: 1 - :widths: 25 75 - - * - Host - - Identity source - * - Azure VM, App Service, AKS, Container Apps - - Assign a **system-assigned** or **user-assigned managed identity** to the compute resource. ``DefaultAzureCredential`` resolves to ``ManagedIdentityCredential`` with no extra configuration. For user-assigned identities, set ``AZURE_CLIENT_ID`` in the server's environment so the SDK picks the right one. - * - AKS with workload-identity federation - - Annotate the Mattermost ``ServiceAccount`` with the client ID and configure the OIDC issuer per the `AKS workload identity guide `__. ``DefaultAzureCredential`` resolves to ``WorkloadIdentityCredential``. - * - Non-Azure host or container - - Create a service principal and set ``AZURE_TENANT_ID``, ``AZURE_CLIENT_ID``, and ``AZURE_CLIENT_SECRET`` (or ``AZURE_CLIENT_CERTIFICATE_PATH``) in the server's environment. ``DefaultAzureCredential`` resolves to ``EnvironmentCredential``. - * - Local development on an admin's workstation - - Sign in with ``az login``. ``DefaultAzureCredential`` resolves to ``AzureCLICredential``. - -To prepare the account you're going to use, you'll need to assign the role from the Azure Portal or using the Azure CLI, as shown below (substitute the principal of the identity Mattermost will authenticate as): - -.. code-block:: bash - - STORAGE_ACCOUNT_ID=$(az storage account show \ - --name acmemattermost \ - --resource-group mm-prod-files \ - --query id -o tsv) - - # For a managed identity (system-assigned on a VM/App Service/AKS pod): - az role assignment create \ - --assignee-object-id "" \ - --assignee-principal-type ServicePrincipal \ - --role "Storage Blob Data Contributor" \ - --scope "$STORAGE_ACCOUNT_ID" - - # For a service principal: - az role assignment create \ - --assignee "" \ - --role "Storage Blob Data Contributor" \ - --scope "$STORAGE_ACCOUNT_ID" - -.. note:: - - Granting the role requires **User Access Administrator** or **Owner** on the storage account; ``Contributor`` is not enough. Plan to have an administrator with that role run the ``az role assignment create`` step. If you scope the role to a single container instead of the whole storage account, replace ``--scope "$STORAGE_ACCOUNT_ID"`` with ``--scope "$STORAGE_ACCOUNT_ID/blobServices/default/containers/"``. - -.. tip:: - - Azure RBAC role assignments can take 30-120 seconds to propagate. If the first ``TestConnection`` returns ``AuthorizationPermissionMismatch`` immediately after the role assignment, wait a minute and retry before assuming a misconfiguration. - -.. note:: - - Mattermost holds the credential, not the token. Microsoft Entra ID access tokens are short-lived, but the Azure SDK caches each token and refreshes it automatically before it expires, so routine token rotation never interrupts file access while the server is running. Access stops only if the underlying identity or its authorization changes or is removed. - -Step 2: Configure Mattermost ----------------------------- - -Sign in as a System Admin and open **System Console > Environment > File Storage**. - -1. **File storage system**: select **Azure Blob Storage**. The Azure-specific fields appear and the S3/local fields are hidden. -2. **Azure cloud**: select the Azure cloud that hosts the storage account: - - - **Azure Commercial** (default): the global Azure cloud (``{account}.blob.core.windows.net``). Only the storage account name is required. - - **Azure Government**: the US Government cloud (``{account}.blob.core.usgovcloudapi.net``). Only the storage account name is required. - - **Custom Endpoint**: any other Azure cloud (for example, Azure China), an Azurite emulator, or a reverse proxy. Provide the full Blob service URL via **Azure endpoint** below. - -3. **Azure Storage account**: the storage account name (for example, ``acmemattermost``). -4. **Azure container**: the container name (for example, ``mattermost``). -5. **Azure path prefix**: optional. Set this if you want Mattermost to write under a sub-path inside the container, for example ``prod/``. Leave empty to use the container root. -6. **Azure authentication**: select the mode you set up in step 1: - - - **Shared key** (default): Mattermost signs each request with the Storage Account access key. Choose this if you completed `Option A: Shared key`_. - - **Default credential (Microsoft Entra ID)**: Mattermost authenticates as the identity provided by the host environment. Choose this if you completed `Option B: Default credential (Microsoft Entra ID)`_. The **Azure Storage account key** field below is hidden because the access key is not used in this mode. - -7. **Azure Storage account key** (visible only when **Azure authentication** is **Shared key**): paste the shared key from `Option A: Shared key`_. -8. **Azure endpoint** (visible only when **Azure cloud** is set to **Custom Endpoint**): the full Blob service URL, including scheme and storage account. Mattermost passes this URL to the Azure SDK unchanged, so the storage account must already be embedded in the hostname (vhost-style, for example ``https://acmemattermost.blob.core.chinacloudapi.cn/``) or in the path (path-style, for example ``http://localhost:10000/devstoreaccount1/`` for Azurite). The chosen authentication mode signs against the host this URL points at, so the host must serve the storage account named above. -9. **Enable secure Azure Blob Storage connections** (visible only when **Azure cloud** is **Azure Commercial** or **Azure Government**): keep this enabled (the default). The Custom Endpoint cloud determines the scheme from the **Azure endpoint** URL, so this toggle is hidden for that mode. -10. **Azure request timeout (milliseconds)**: default is ``30000`` (30 seconds). Increase only if your network needs more time for large objects. - -Save the settings and click **Test Connection**. Mattermost issues a no-op write/read/delete against the configured container using the credentials submitted in the form. A green ``Connection was successful`` message confirms the credentials, container name, and endpoint all work. A red error message includes the underlying reason; common ones are listed in `Troubleshooting`_. - -.. warning:: - - **Restart required.** The Mattermost server caches the file storage backend at startup and does not re-create it when the file storage configuration changes. After saving, restart every Mattermost server in the deployment (``systemctl restart mattermost``, recycle the container, or roll the deployment in your cluster) for the new driver to take effect. **Test Connection** works before the restart because it builds a temporary backend from the submitted form values. - -.. warning:: - - Switching the file driver does **not** migrate existing files. If you are moving an existing deployment from Amazon S3, see `Migrate existing files from Amazon S3`_ below before changing the driver. For migrations from local disk, copy the directory contents into the Azure container using ``azcopy`` (`docs `__). In either case, files uploaded before the switch are unreachable once the driver changes unless they are present at the same key in the destination. - -Step 3: Verify --------------- - -1. After the restart, reload the System Console or any channel. -2. Upload an attachment in any channel. A small image is a good test, because Mattermost stores three blobs for an image (original, preview, thumbnail), which exercises the upload path more thoroughly than a plain file. -3. The post should render the attachment and preview as usual. -4. In the Azure portal, open the container and confirm new blobs appeared under the path ``/teams//channels//users///`` (the same layout the local-disk and S3 backends use). For an image you will see ``.``, ``_preview.``, and ``_thumb.``. - -Migrate existing files from Amazon S3 -------------------------------------- - -If you are switching an existing deployment from S3 to Azure Blob Storage, the file content must be present in the Azure container at the same key Mattermost would have written to. Mattermost itself does not move files between backends, so this is an out-of-band copy that you run once before flipping the driver. - -Mattermost writes blobs at the same relative path on every backend: - -.. code-block:: text - - {path-prefix}/{YYYYMMDD}/teams/{teamID}/channels/{channelID}/users/{userID}/{fileID}/{filename} - -This means a straight key-for-key copy from the S3 bucket to the Azure container is sufficient. If you use ``AmazonS3PathPrefix`` on the S3 side, set ``AzurePathPrefix`` to the same value on the Azure side (or rewrite the prefix during the copy). - -There are multiple ways to accomplish this. The recommended way is using the `Azure Storage Mover service `__, which provides a cloud-to-cloud migration from Amazon S3 to Azure Blob Storage. - -There are alternative tools that can also help, like `rclone `__ and `AzCopy `__. - -(Optional) Configure the export backend ---------------------------------------- - -Compliance and data exports can be stored separately from regular file uploads. The **File Storage (Exports)** section directly below **File Storage** in the System Console mirrors the fields above and accepts the same Azure credentials. Customers typically point exports at a different container (or a different account) so the export retention policy can differ from regular uploads. The export target is an independent backend with its own driver and credentials, so it doesn't have to use the same provider as regular uploads; e.g., you can keep uploads on Amazon S3 and send exports to Azure Blob Storage, or the reverse. - -See :ref:`Enable dedicated export filestore target ` for the full list of ``ExportAzure*`` keys. - -Troubleshooting ---------------- - -.. list-table:: - :header-rows: 1 - :widths: 35 65 - - * - Symptom - - Likely cause - * - ``AuthenticationFailed`` on **Test Connection** - - When **Azure authentication** is **Shared key**: wrong account name or shared key. Confirm both in the **Access keys** blade of the Azure portal. When **Azure authentication** is **Default credential**: no identity source was available -- the host has no managed identity, the workload-identity federation is not set up, and no ``AZURE_TENANT_ID`` / ``AZURE_CLIENT_ID`` / ``AZURE_CLIENT_SECRET`` environment variables are set. - * - ``AuthorizationPermissionMismatch`` on **Test Connection** - - Only applies when **Azure authentication** is **Default credential**. The identity the SDK selected does not hold a data-plane role on the storage account. Grant **Storage Blob Data Contributor** to that identity per `Option B: Default credential (Microsoft Entra ID)`_, then wait 30-120 seconds for the role assignment to propagate. - * - ``ContainerNotFound`` - - Container name is wrong or was created under a different storage account. - * - ``connection refused`` or TLS errors - - When **Azure cloud** is **Custom Endpoint**, the **Azure endpoint** URL points at a host that isn't reachable or uses the wrong scheme. When **Azure cloud** is **Azure Commercial** or **Azure Government**, **Enable secure Azure Blob Storage connections** is disabled in front of a TLS-only destination. - * - **Test Connection** succeeds but uploads in channels fail - - Check **System Console > Reporting > Server Logs** for the Azure error returned by the SDK. The most common cause is a forgotten server restart after **Save**. - * - Files uploaded before the switch are no longer visible - - The existing files are still on the previous backend. For S3 migrations, follow `Migrate existing files from Amazon S3`_ to copy the bucket into the Azure container at matching keys. For other backends, copy the contents into the Azure container with ``azcopy`` (or equivalent) and confirm the destination path matches the layout Mattermost uses. - -Reference ---------- - -Each Azure setting is documented in detail in :ref:`Environment configuration settings `: - -- :ref:`File storage system ` (``FileSettings.DriverName``) -- :ref:`Azure Storage account ` (``FileSettings.AzureStorageAccount``) -- :ref:`Azure container ` (``FileSettings.AzureContainer``) -- :ref:`Azure path prefix ` (``FileSettings.AzurePathPrefix``) -- :ref:`Azure authentication ` (``FileSettings.AzureAuthMode``) -- :ref:`Azure Storage account key ` (``FileSettings.AzureAccessKey``) -- :ref:`Azure cloud ` (``FileSettings.AzureCloud``) -- :ref:`Azure endpoint ` (``FileSettings.AzureEndpoint``) -- :ref:`Enable secure Azure Blob Storage connections ` (``FileSettings.AzureSSL``) -- :ref:`Azure request timeout ` (``FileSettings.AzureRequestTimeoutMilliseconds``) diff --git a/source/administration-guide/configure/enabling-chinese-japanese-korean-search.rst b/source/administration-guide/configure/enabling-chinese-japanese-korean-search.rst index 3eebe335612..921e66a59e0 100644 --- a/source/administration-guide/configure/enabling-chinese-japanese-korean-search.rst +++ b/source/administration-guide/configure/enabling-chinese-japanese-korean-search.rst @@ -9,8 +9,7 @@ Chinese, Japanese and Korean search .. attention:: - Starting in Mattermost v11.9, CJK post search is enabled by default on PostgreSQL. - In Mattermost v11.5 through v11.8, enable the `feature flag `_ ``MM_FEATUREFLAGS_CJKSEARCH``. + Starting on Mattermost v11.5, searching for Chinese, Japanese or Korean (CJK) characters can be enabled with the `feature flag `_ ``MM_FEATUREFLAGS_CJKSEARCH``. The general recommendation of `using either Elasticsearch or Opensearch once the server reaches 2.5 million posts `_ still applies. @@ -87,7 +86,7 @@ Below is additional information on how to configure the database for different l .. code-block:: sql -- 创建 extension - CREATE EXTENSION zhparser + CREATE EXTENSION zhparser; -- 创建 text search configuration CREATE TEXT SEARCH CONFIGURATION simple_zh_cfg (PARSER = zhparser); -- 配置 token mapping diff --git a/source/administration-guide/configure/environment-configuration-settings.rst b/source/administration-guide/configure/environment-configuration-settings.rst index 5db975b32fa..e3a47df768d 100644 --- a/source/administration-guide/configure/environment-configuration-settings.rst +++ b/source/administration-guide/configure/environment-configuration-settings.rst @@ -2000,11 +2000,7 @@ With self-hosted deployments, you can configure file storage settings by going t .. note:: - Mattermost supports storing files on the local filesystem, Amazon S3 or S3-compatible containers, and Azure Blob Storage. We have tested Mattermost with `Digital Ocean Spaces `__, but not all S3-compatible containers on the market. If you are looking to use other S3-compatible containers, we recommend completing your own testing. You can also use local storage or a network drive using NFS. - -.. seealso:: - - For a step-by-step walk-through covering Azure resource provisioning, System Console configuration, and verification, see :doc:`Configure Azure Blob Storage as the Mattermost file store `. + Mattermost currently supports storing files on the local filesystem and Amazon S3 or S3-compatible containers. We have tested Mattermost with `Digital Ocean Spaces `__, but not all S3-compatible containers on the market. If you are looking to use other S3-compatible containers, we recommend completing your own testing. You can also use local storage or a network drive using NFS. .. config:setting:: file-storage-system :displayname: File storage system (File Storage) @@ -2015,14 +2011,13 @@ With self-hosted deployments, you can configure file storage settings by going t - **local**: **(Default)** Files and images are stored in the specified local file directory. - **amazons3**: Files and images are stored on Amazon S3 based on the access key, bucket, and region fields provided. - - **azureblob**: Files and images are stored on Azure Blob Storage based on the storage account, key, and container fields provided. File storage system ~~~~~~~~~~~~~~~~~~~ +---------------------------------------------------------------+-----------------------------------------------------------------------------+ | The type of file storage system used. | - System Config path: **Environment > File Storage** | -| Can be Local File System, Amazon S3, or Azure Blob Storage. | - ``config.json`` setting: ``FileSettings`` > ``DriverName`` > ``"local"`` | +| Can be either Local File System or Amazon S3. | - ``config.json`` setting: ``FileSettings`` > ``DriverName`` > ``"local"`` | | | - Environment variable: ``MM_FILESETTINGS_DRIVERNAME`` | | - **local**: **(Default)** Files and images are stored in | | | the specified local file directory. | | @@ -2030,15 +2025,8 @@ File storage system | based on the access key, bucket, and region fields | | | provided. The driver is compatible with other S3-compatible | | | services, such as Digital Ocean Spaces. | | -| - **azureblob**: Files and images are stored on Azure Blob | | -| Storage based on the storage account name, shared key, and | | -| container fields provided. | | +---------------------------------------------------------------+-----------------------------------------------------------------------------+ -.. note:: - - After saving a new file storage system, restart every Mattermost server in the deployment for the change to take effect. The file storage backend is initialized at startup and isn't rebuilt automatically when ``FileSettings`` change at runtime. - .. config:setting:: local-storage-directory :displayname: Local storage directory (File Storage) :systemconsole: Environment > File Storage @@ -2486,200 +2474,6 @@ Amazon S3 request timeout | Default is 30000 (30 seconds). | | +---------------------------------------------------------------+--------------------------------------------------------------------------------------------------+ -.. config:setting:: azure-storage-account - :displayname: Azure Storage account (File Storage) - :systemconsole: Environment > File Storage - :configjson: .FileSettings.AzureStorageAccount - :environment: MM_FILESETTINGS_AZURESTORAGEACCOUNT - :description: The name of your Azure Storage account. - -Azure Storage account -~~~~~~~~~~~~~~~~~~~~~ - -+---------------------------------------------------------------+--------------------------------------------------------------------------+ -| The name of your Azure Storage account. | - System Config path: **Environment > File Storage** | -| | - ``config.json`` setting: ``FileSettings`` > ``AzureStorageAccount`` | -| A string with the storage account name as it appears in the | - Environment variable: ``MM_FILESETTINGS_AZURESTORAGEACCOUNT`` | -| Azure portal. Must be 3-24 lowercase letters and numbers. | | -+---------------------------------------------------------------+--------------------------------------------------------------------------+ - -.. config:setting:: azure-container - :displayname: Azure container (File Storage) - :systemconsole: Environment > File Storage - :configjson: .FileSettings.AzureContainer - :environment: MM_FILESETTINGS_AZURECONTAINER - :description: The name of the container in your Azure Storage account. - -Azure container -~~~~~~~~~~~~~~~ - -+---------------------------------------------------------------+--------------------------------------------------------------------------+ -| The name of the container in your Azure Storage account | - System Config path: **Environment > File Storage** | -| where Mattermost stores uploads. | - ``config.json`` setting: ``FileSettings`` > ``AzureContainer`` | -| | - Environment variable: ``MM_FILESETTINGS_AZURECONTAINER`` | -| A string with the container name. | | -+---------------------------------------------------------------+--------------------------------------------------------------------------+ - -.. config:setting:: azure-path-prefix - :displayname: Azure path prefix (File Storage) - :systemconsole: Environment > File Storage - :configjson: .FileSettings.AzurePathPrefix - :environment: MM_FILESETTINGS_AZUREPATHPREFIX - :description: An optional path prefix to use for blobs in your Azure container. Leave empty to write at the container root. - -Azure path prefix -~~~~~~~~~~~~~~~~~ - -+---------------------------------------------------------------+--------------------------------------------------------------------------+ -| An optional path prefix to use for blobs in your Azure | - System Config path: **Environment > File Storage** | -| container. | - ``config.json`` setting: ``FileSettings`` > ``AzurePathPrefix`` | -| | - Environment variable: ``MM_FILESETTINGS_AZUREPATHPREFIX`` | -| A string containing the path prefix. Leave empty to write at | | -| the container root. | | -+---------------------------------------------------------------+--------------------------------------------------------------------------+ - -.. config:setting:: azure-authentication - :displayname: Azure authentication (File Storage) - :systemconsole: Environment > File Storage - :configjson: .FileSettings.AzureAuthMode - :environment: MM_FILESETTINGS_AZUREAUTHMODE - :description: Selects how Mattermost authenticates to Azure. One of ``shared_key`` (default) or ``default_credential``. - -Azure authentication -~~~~~~~~~~~~~~~~~~~~ - -+---------------------------------------------------------------+--------------------------------------------------------------------------+ -| Selects how Mattermost authenticates to the Azure Storage | - System Config path: **Environment > File Storage** | -| account. | - ``config.json`` setting: ``FileSettings`` > ``AzureAuthMode`` | -| | - Environment variable: ``MM_FILESETTINGS_AZUREAUTHMODE`` | -| - ``shared_key``: **(Default)** Mattermost signs requests | | -| with the Storage Account access key in | | -| ``FileSettings.AzureAccessKey``. Works for any deployment | | -| (on-premises, non-Azure cloud, local development). | | -| - ``default_credential``: Mattermost obtains an Entra ID | | -| token via the Azure SDK's ``DefaultAzureCredential`` chain | | -| (managed identity, workload identity, service-principal | | -| environment variables, or ``az login`` -- in that order) | | -| and signs requests with it. ``FileSettings.AzureAccessKey`` | | -| is ignored. Recommended for deployments on Azure where the | | -| host already provides a managed identity. | | -| | | -| The identity the SDK selects must hold **Storage Blob | | -| Data Contributor** (or equivalent) on the storage account | | -| or container. | | -+---------------------------------------------------------------+--------------------------------------------------------------------------+ - -.. config:setting:: azure-storage-account-key - :displayname: Azure Storage account key (File Storage) - :systemconsole: Environment > File Storage - :configjson: .FileSettings.AzureAccessKey - :environment: MM_FILESETTINGS_AZUREACCESSKEY - :description: The shared key for your Azure Storage account. Used only when ``FileSettings.AzureAuthMode`` is ``shared_key``. - -Azure Storage account key -~~~~~~~~~~~~~~~~~~~~~~~~~ - -+---------------------------------------------------------------+--------------------------------------------------------------------------+ -| The shared key for your Azure Storage account. Used only | - System Config path: **Environment > File Storage** | -| when ``FileSettings.AzureAuthMode`` is ``shared_key``. | - ``config.json`` setting: ``FileSettings`` > ``AzureAccessKey`` | -| Find this value in the Azure portal under your storage | - Environment variable: ``MM_FILESETTINGS_AZUREACCESSKEY`` | -| account's **Security + networking > Access keys** blade. | | -+---------------------------------------------------------------+--------------------------------------------------------------------------+ - -.. note:: - - Treat the shared key as a secret. Azure provides two keys to support rotation without downtime: update Mattermost to one key, regenerate the other, then swap on the next rotation cycle. - -.. config:setting:: azure-cloud - :displayname: Azure cloud (File Storage) - :systemconsole: Environment > File Storage - :configjson: .FileSettings.AzureCloud - :environment: MM_FILESETTINGS_AZURECLOUD - :description: Selects which Azure cloud hosts the storage account. One of ``commercial`` (default), ``government``, or ``custom``. - -Azure cloud -~~~~~~~~~~~ - -+---------------------------------------------------------------+--------------------------------------------------------------------------+ -| Selects which Azure cloud Mattermost connects to. The choice | - System Config path: **Environment > File Storage** | -| determines which host the Azure SDK signs requests against. | - ``config.json`` setting: ``FileSettings`` > ``AzureCloud`` | -| | - Environment variable: ``MM_FILESETTINGS_AZURECLOUD`` | -| - ``commercial``: **(Default)** Vhost-style against | | -| ``{account}.blob.core.windows.net``. Only the storage | | -| account name is required. | | -| - ``government``: Vhost-style against | | -| ``{account}.blob.core.usgovcloudapi.net`` (Azure | | -| Government). Only the storage account name is required. | | -| - ``custom``: Mattermost uses the value of | | -| ``FileSettings.AzureEndpoint`` as the full Blob service | | -| URL. Use this for Azurite, reverse proxies, Azure China, or | | -| any other Azure cloud that doesn't have a built-in preset. | | -+---------------------------------------------------------------+--------------------------------------------------------------------------+ - -.. config:setting:: azure-endpoint - :displayname: Azure endpoint (File Storage) - :systemconsole: Environment > File Storage - :configjson: .FileSettings.AzureEndpoint - :environment: MM_FILESETTINGS_AZUREENDPOINT - :description: Full Blob service URL used when ``FileSettings.AzureCloud`` is ``custom``. Ignored for the ``commercial`` and ``government`` clouds. - -Azure endpoint -~~~~~~~~~~~~~~ - -+---------------------------------------------------------------+--------------------------------------------------------------------------+ -| Full Blob service URL, including scheme and storage account. | - System Config path: **Environment > File Storage** | -| Used only when ``FileSettings.AzureCloud`` is ``custom``; | - ``config.json`` setting: ``FileSettings`` > ``AzureEndpoint`` | -| ignored for the ``commercial`` and ``government`` clouds | - Environment variable: ``MM_FILESETTINGS_AZUREENDPOINT`` | -| (which derive the URL from the storage account name). | | -| | | -| Mattermost passes this URL to the Azure SDK unchanged, so | | -| the storage account must already be embedded in the hostname | | -| (vhost-style, for example | | -| ``https://acmemattermost.blob.core.chinacloudapi.cn/``) or in | | -| the path (path-style, for example | | -| ``http://localhost:10000/devstoreaccount1/`` for Azurite). | | -| Shared-key auth signs against the host this URL points at, so | | -| make sure it actually serves the storage account configured | | -| in ``FileSettings.AzureStorageAccount``. | | -+---------------------------------------------------------------+--------------------------------------------------------------------------+ - -.. config:setting:: enable-secure-azure-blob-storage-connections - :displayname: Enable secure Azure Blob Storage connections (File Storage) - :systemconsole: Environment > File Storage - :configjson: .FileSettings.AzureSSL - :environment: MM_FILESETTINGS_AZURESSL - :description: Enable or disable secure Azure Blob Storage connections. Default value is **true**. - -Enable secure Azure Blob Storage connections -~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -+---------------------------------------------------------------+--------------------------------------------------------------------------+ -| Enable or disable secure connections to Azure Blob Storage. | - System Config path: **Environment > File Storage** | -| | - ``config.json`` setting: ``FileSettings`` > ``AzureSSL`` > ``true`` | -| - **true**: **(Default)** Enables only secure Azure Blob | - Environment variable: ``MM_FILESETTINGS_AZURESSL`` | -| Storage connections. | | -| - **false**: Allows insecure connections. Only set to | | -| **false** when pointing at a local emulator without TLS. | | -+---------------------------------------------------------------+--------------------------------------------------------------------------+ - -.. config:setting:: azure-request-timeout - :displayname: Azure request timeout (File Storage) - :systemconsole: Environment > File Storage - :configjson: .FileSettings.AzureRequestTimeoutMilliseconds - :environment: MM_FILESETTINGS_AZUREREQUESTTIMEOUTMILLISECONDS - :description: Amount of time, in milliseconds, before requests to Azure Blob Storage time out. Default value is 30000 (30 seconds). - -Azure request timeout -~~~~~~~~~~~~~~~~~~~~~ - -+---------------------------------------------------------------+-----------------------------------------------------------------------------------------------+ -| The amount of time, in milliseconds, before requests to | - System Config path: **Environment > File Storage** | -| Azure Blob Storage time out. | - ``config.json`` setting: ``FileSettings`` > ``AzureRequestTimeoutMilliseconds`` > ``30000`` | -| | - Environment variable: ``MM_FILESETTINGS_AZUREREQUESTTIMEOUTMILLISECONDS`` | -| Default is 30000 (30 seconds). Increase only if your network | | -| needs more time for large objects. | | -+---------------------------------------------------------------+-----------------------------------------------------------------------------------------------+ - .. config:setting:: initial-font :displayname: Initial font (File Storage) :systemconsole: N/A @@ -4994,16 +4788,6 @@ Enable dedicated export filestore target | - ``ExportAmazonS3Trace`` | | | - ``ExportAmazonS3RequestTimeoutMilliseconds`` | | | - ``ExportAmazonS3PresignExpiresSeconds`` | | -| - ``ExportAzureStorageAccount`` | | -| - ``ExportAzureAuthMode`` | | -| - ``ExportAzureAccessKey`` | | -| - ``ExportAzureContainer`` | | -| - ``ExportAzurePathPrefix`` | | -| - ``ExportAzureCloud`` | | -| - ``ExportAzureEndpoint`` | | -| - ``ExportAzureSSL`` | | -| - ``ExportAzureRequestTimeoutMilliseconds`` | | -| - ``ExportAzurePresignExpiresSeconds`` | | | | | | - **False**: (**Default**) Standard | | | :ref:`file storage | | @@ -5014,5 +4798,5 @@ Enable dedicated export filestore target .. note:: - - When an alternate filestore target is configured, Mattermost Cloud admins can generate a presigned download URL for exports using the ``/exportlink [job-id|zip file|latest]`` slash command. On Amazon S3 this is an S3 presigned URL; on Azure Blob Storage it's a Shared Access Signature (SAS) URL. The lifetimes of these URLs are controlled, respectively, by ``ExportAmazonS3PresignExpiresSeconds`` or ``ExportAzurePresignExpiresSeconds``. See the :ref:`Mattermost data migration ` documentation for details. Alternatively, Cloud and self-hosted admins can use the :ref:`mmctl export generate-presigned-url ` command to generate a presigned URL directly from mmctl. - - Generating a presigned URL requires the feature flag ``EnableExportDirectDownload`` to be set to ``true``, the storage must support presigned links (Amazon S3 or Azure Blob Storage), and this experimental configuration setting must be set to ``true``. Presigned URLs for exports aren't supported for systems with shared storage. + - When an alternate filestore target is configured, Mattermost Cloud admins can generate an S3 presigned URL for exports using the ``/exportlink [job-id|zip file|latest]`` slash command. See the :ref:`Mattermost data migration ` documentation for details. Alternatively, Cloud and self-hosted admins can use the :ref:`mmctl export generate-presigned-url ` command to generate a presigned URL directly from mmctl. + - Generating an S3 presigned URL requires the feature flag ``EnableExportDirectDownload`` to be set to ``true``, the storage must be compatible with generating an S3 link, and this experimental configuration setting must be set to ``true``. Presigned URLs for exports aren't supported for systems with shared storage. diff --git a/source/administration-guide/configure/experimental-configuration-settings.rst b/source/administration-guide/configure/experimental-configuration-settings.rst index 632f704aed7..881876d150c 100644 --- a/source/administration-guide/configure/experimental-configuration-settings.rst +++ b/source/administration-guide/configure/experimental-configuration-settings.rst @@ -1520,6 +1520,9 @@ From Mattermost v10.10, when this :ref:`experimental Site Configuration > Users and Teams** using the :ref:`Channel category sorting ` setting (``TeamSettings.EnableChannelCategorySorting``). + .. config:setting:: strict-csrf-token-enforcement :displayname: Strict CSRF token enforcement (Experimental) :systemconsole: N/A diff --git a/source/administration-guide/configure/integrations-configuration-settings.rst b/source/administration-guide/configure/integrations-configuration-settings.rst index a1b62d2b9a2..769a07f6317 100644 --- a/source/administration-guide/configure/integrations-configuration-settings.rst +++ b/source/administration-guide/configure/integrations-configuration-settings.rst @@ -187,18 +187,18 @@ This setting applies only when :ref:`Enable dynamic client registration Integration Management - :configjson: .ServiceSettings.OutgoingIntegrationRequestsDefaultTimeout - :environment: MM_SERVICESETTINGS_OUTGOINGINTEGRATIONREQUESTDEFAULTTIMEOUT - :description: The number of seconds to wait for external integration HTTP requests, before timing out. Default value is **3 seconds**. + :configjson: .ServiceSettings.OutgoingIntegrationRequestsTimeout + :environment: MM_SERVICESETTINGS_OUTGOINGINTEGRATIONREQUESTSTIMEOUT + :description: The number of seconds to wait for external integration HTTP requests before timing out. Default value is **30 seconds**. Integration request timeout ~~~~~~~~~~~~~~~~~~~~~~~~~~~ -The number of seconds to wait for external integration HTTP requests, before timing out, including `custom slash commands `_, `outgoing webhooks `_, `interactive messages `_, and `interactive dialogs `_. Increase this value if you have external integrations that can take some time to generate an HTTP response, or experience delayed responses due to latency. +The number of seconds to wait for external integration HTTP requests before timing out, including `custom slash commands `_, `outgoing webhooks `_, `interactive messages `_, and `interactive dialogs `_. Increase this value if you have external integrations that can take some time to generate an HTTP response, or experience delayed responses due to latency. -+------------------------------------------------------------------------------------------------+ -| This feature's ``config.json`` setting is ``"OutgoingIntegrationRequestsDefaultTimeout": 3``. | -+------------------------------------------------------------------------------------------------+ ++---------------------------------------------------------------------------------------------+ +| This feature's ``config.json`` setting is ``"OutgoingIntegrationRequestsTimeout": 30``. | ++---------------------------------------------------------------------------------------------+ .. config:setting:: enable-integrations-to-override-usernames :displayname: Enable integrations to override usernames (Integrations) diff --git a/source/administration-guide/configure/reporting-configuration-settings.rst b/source/administration-guide/configure/reporting-configuration-settings.rst index ea1aa4df5fb..0c43a5ac052 100644 --- a/source/administration-guide/configure/reporting-configuration-settings.rst +++ b/source/administration-guide/configure/reporting-configuration-settings.rst @@ -6,18 +6,20 @@ Reporting configuration settings View the following statistics for your overall deployment and specific teams, as well as access server logs, in the System Console by selecting the **Product** |product-list| menu, selecting **System Console**, and then selecting **Reporting**: -- `Site statistics <#site-statistics>`__ +- `System statistics <#system-statistics>`__ - `Team statistics <#team-statistics>`__ - `Server logs <#server-logs>`__ - `Statistics configuration settings <#statistics-configuration-settings>`__ ---- -Site statistics +.. _site-statistics: + +System statistics --------------- +----------------------------------------------------------------+---------------------------------------------------------------------+ -| View statistics on a wide variety of activities in Mattermost, | - System Config path: **Reporting > Site Statistics** | +| View statistics on a wide variety of activities in Mattermost, | - System Config path: **Reporting > System Statistics** | | including: users, seats, teams, channels, posts, calls, | - ``config.json setting``: N/A | | sessions, commands, webhooks, websocket and database | - Environment variable: N/A | | connections, and collaborative playbooks. | | diff --git a/source/administration-guide/configure/site-configuration-settings.rst b/source/administration-guide/configure/site-configuration-settings.rst index 0865920b739..12e68c314c8 100644 --- a/source/administration-guide/configure/site-configuration-settings.rst +++ b/source/administration-guide/configure/site-configuration-settings.rst @@ -18,6 +18,7 @@ Review and manage the following site configuration options in the System Console - `Public Links <#public-links>`__ - `Notices <#notices>`__ - `Connected Workspaces <#connected-workspaces>`__ +- `Classification Markings <#classification-markings>`__ .. tip:: @@ -253,7 +254,7 @@ Report a Problem With self-hosted deployments, you can specify how the **Report a Problem** option behaves in the Mattermost app via the **Help** menu: -- **Default link**: Uses the default Mattermost URL to report a problem. Customers with a Mattermost subscription are directed to the `Mattermost Support Portal `_. Community deployments are directed to `create a new issue on the Mattermost GitHub repository `_. +- **Default**: Customers with a Mattermost license can open a support case by email with the Mattermost support team. Unlicensed Mattermost deployments are directed to the `troubleshooting forums `_. - **Email address**: Enables you to :ref:`enter an email address ` that users will be prompted to send a message to when they choose **Report a Problem** in Mattermost. - **Custom link**: Enables you to :ref:`enter a URL ` that users will be directed to when they choose **Report a Problem** in Mattermost. - **Hide link**: Removes the **Report a Problem** option from Mattermost. @@ -282,7 +283,7 @@ Report a Problem link :displayname: Report a Problem email (Customization) :systemconsole: Site Configuration > Customization :configjson: .SupportSettings.ReportAProblemMail - :environment: MM_SUPPORTSETTINGS_REPORTAPROBLMEMAIL + :environment: MM_SUPPORTSETTINGS_REPORTAPROBLEMMAIL :description: Enter the email address that users will be prompted to send a message to when they choose Report a Problem in Mattermost. Report a Problem email address @@ -291,7 +292,7 @@ Report a Problem email address +---------------------------------------------------------------------------------------------------+-------------------------------------------------------------------------+ | This field sets the email address for the **Report a Problem** link in the channel | - System Config path: **Site Configuration > Customization** | | header **Help** menu. | - ``config.json`` setting: ``SupportSettings`` > ``ReportAProblemMail`` | -| | - Environment variable: ``MM_SUPPORTSETTINGS_REPORTAPROBLMEMAIL`` | +| | - Environment variable: ``MM_SUPPORTSETTINGS_REPORTAPROBLEMMAIL`` | | String input. Cannot be left blank. | | +---------------------------------------------------------------------------------------------------+-------------------------------------------------------------------------+ @@ -1098,6 +1099,31 @@ User statistics update time | Default is **00:00**. | | +--------------------------------------------------------------------------------------------+------------------------------------------------------------------------------------------+ +.. config:setting:: channel-category-sorting + :displayname: Channel category sorting (Users and Teams) + :systemconsole: Site Configuration > Users and Teams + :configjson: .TeamSettings.EnableChannelCategorySorting + :environment: MM_TEAMSETTINGS_ENABLECHANNELCATEGORYSORTING + :description: This setting controls whether channel admins can choose a default sidebar category when creating or editing a channel. Default is **true**. + + - **true**: **(Default)** When creating or editing supported channels, channel admins see a **Default category (optional)** field. Members who join the channel see it under that category in their sidebar. + - **false**: The default category selector is hidden. + +Channel category sorting +~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +From Mattermost v11.8, channel category sorting is enabled by default. When enabled, channel admins can choose a default sidebar category when creating or editing a channel. Channel admins can select an existing category, type a new category name, or clear the default category from channel settings. Members who join the channel see it under that category in their sidebar. When disabled, the default category selector is hidden. + +.. list-table:: + :widths: 55 45 + :header-rows: 0 + + * - - **true**: **(Default)** When creating or editing supported channels, channel admins see a **Default category (optional)** field. They can select an existing category, enter a new category name, or clear the default category from channel settings. Members who join the channel see it under that category in their sidebar. + - **false**: The default category selector is hidden when creating or editing channels. + - - System Config path: **Site Configuration > Users and Teams** + - ``config.json`` setting: ``TeamSettings`` > ``EnableChannelCategorySorting`` > ``true`` + - Environment variable: ``MM_TEAMSETTINGS_ENABLECHANNELCATEGORYSORTING`` + ---- Notifications @@ -2589,6 +2615,34 @@ Member sync batch size ---- +Classification Markings +----------------------- + +From Mattermost v11.8, system admins can configure classification markings in the System Console by going to **Site Configuration > Classification Markings**. + +Classification markings define reusable classification levels that can be displayed as global or channel-level banners in the web and desktop apps. Each classification level includes a name, color, and rank order. You can select a preset, such as US DoD, NATO, UK GSCP, Canada, or Australia PSPF, or define custom classification levels. + +.. note:: + + Classification markings are informational only and aren't tied to access control decisions at this time. + +Configure classification markings: + +1. Go to **System Console > Site Configuration > Classification Markings**. +2. Enable **Enable classification markings**. +3. Select a **Classification preset**, or create custom classification levels. +4. Configure classification level names, colors, and rank order. +5. Optionally enable the **Global Classification Banner** under **Global Classification Indicators**. +6. Select the **Banner visibility**: + + - **Top only** + - **Top and bottom** + +7. Select the **Global classification level** to display. +8. Select **Save**. + +---- + config.json-only settings ------------------------- diff --git a/source/administration-guide/manage/admin/abac-channel-access-rules.rst b/source/administration-guide/manage/admin/abac-channel-access-rules.rst index 3497314fce8..db3bcb29d59 100644 --- a/source/administration-guide/manage/admin/abac-channel-access-rules.rst +++ b/source/administration-guide/manage/admin/abac-channel-access-rules.rst @@ -20,7 +20,7 @@ Prerequisites - :doc:`Attribute-Based Access Control (ABAC) ` must be enabled by a System Admin in **System Console > System Attributes > Attribute-Based Access**. - You need Channel Admin permissions and the ``manage_channel_access_rules`` permission. -- Channel access rules are available only for private channels. +- Self-service access rules in the **Access Control** tab of Channel Settings apply only to private channels. Membership policies apply to both public and private channels, with behavior that varies by channel type. See :ref:`Public and private channel behavior `. Access Channel Settings ~~~~~~~~~~~~~~~~~~~~~~~~ @@ -86,6 +86,40 @@ When you save changes that affect membership, a confirmation dialog shows you: - Option to view the specific users affected - Confirmation required before applying changes +Public and private channel behavior +----------------------------------- + +Membership policies behave differently depending on the type of channel they're applied to: + +- **Private channels**: Membership policies are enforced. Users who match the policy's rules are added, and users who don't match the rules are removed during synchronization. +- **Public channels**: Membership policies are advisory. Matching users may be automatically added when auto-add is enabled, but non-matching members are not removed. +- When auto-add is disabled for a public channel, matching channels are surfaced as **recommended** rather than enforcing membership. +- Direct messages and group messages aren't eligible for membership policies. +- Default channels such as **Town Square** and **Off-Topic** are excluded. + +.. note:: + + Public channels with membership policies may appear in **Browse Channels** under **Recommended**, and matching users may be marked **Recommended** in the channel invite flow. See :doc:`Browse channels ` and :doc:`Manage channel members ` for the end-user experience. + +Channel-level permission policies +--------------------------------- + +From Mattermost v11.8.0, channel admins can define channel-level permission rules for file upload and file download based on user attributes and channel role. Applicable roles include **channel admin**, **channel member**, and **channel guest**. + +For system-wide permission policies that restrict file upload and download actions, see :ref:`Permission policies `. + +Simulate access +---------------- + +From Mattermost v11.8.0, admins can use **Simulate access** in Channel Settings to preview whether selected users can perform actions such as uploading files or downloading files before saving policy changes. + +- Simulation can evaluate draft rules before they're saved, so you can confirm the intended scope without affecting live channel access. +- Some denied results may indicate that the decision came from another policy. In that case, Mattermost shows that access was denied by another policy without exposing policy details you aren't authorized to see. + +.. note:: + + Channel-level permission policies and **Simulate access** are gated by the ``PermissionPolicies`` feature flag (``MM_FEATUREFLAGS_PERMISSIONPOLICIES``) and require a Mattermost Enterprise Advanced license. See the Mattermost developer documentation for details on `enabling feature flags in a self-hosted deployment `_. Mattermost Cloud customers can request this feature flag be enabled by contacting their Mattermost Account Manager or by `creating a support ticket `_. + Manage team-scoped membership policies in Team Settings ------------------------------------------------------- diff --git a/source/administration-guide/manage/admin/abac-system-wide-policies.rst b/source/administration-guide/manage/admin/abac-system-wide-policies.rst index 02f3bf520c3..b44cccdadbc 100644 --- a/source/administration-guide/manage/admin/abac-system-wide-policies.rst +++ b/source/administration-guide/manage/admin/abac-system-wide-policies.rst @@ -62,11 +62,25 @@ You can add multiple rules to a single policy, and each rule can include multipl Select the **Validate syntax** bar to check the syntax of your rule. If the syntax is valid, the bar will turn green and display a message indicating that the syntax is valid. If there are any issues, the bar will turn red and display an error message. -Test rules -~~~~~~~~~~ +Simulate access +~~~~~~~~~~~~~~~~ Select **Test access rule** to test the rule against your user base to return how many users would be granted access to the channel based on the current rule. Test your rules to ensure the intended scope and avoid unexpected access changes. +From Mattermost v11.8.0, you can use **Simulate access** to preview allowed and denied outcomes for specific users before saving policy changes: + +1. Open the policy editor in the System Console. +2. Select **Simulate access**. +3. Choose the users you want to test. +4. Review the allowed and denied outcomes by action, such as joining a channel or uploading and downloading files. +5. Adjust the rules before saving. + +Simulation can test draft policy changes before they affect live channel access or file permissions. Detailed rule and attribute information is shown only when the denial comes from the policy or scope you're editing; otherwise, Mattermost may show that access was denied by another policy. + +.. note:: + + **Simulate access** and channel-level permission policies for file upload and file download are gated by the ``PermissionPolicies`` feature flag (``MM_FEATUREFLAGS_PERMISSIONPOLICIES``) and require a Mattermost Enterprise Advanced license. See the Mattermost developer documentation for details on `enabling feature flags in a self-hosted deployment `_. Mattermost Cloud customers can request this feature flag be enabled by contacting their Mattermost Account Manager or by `creating a support ticket `_. + Manage rules ~~~~~~~~~~~~ diff --git a/source/administration-guide/manage/admin/attribute-based-access-control.rst b/source/administration-guide/manage/admin/attribute-based-access-control.rst index 19fb19ca489..1738c3c105d 100644 --- a/source/administration-guide/manage/admin/attribute-based-access-control.rst +++ b/source/administration-guide/manage/admin/attribute-based-access-control.rst @@ -40,11 +40,14 @@ Configure access policies Once enabled, you have multiple ways to configure access policies in Mattermost: +From Mattermost v11.8.0, admins can configure membership policies for both public and private channels, permission policies for file upload and file download, and simulate policy outcomes before saving. + **System Admins can:** -- Create :doc:`system-wide access policies ` that can be assigned across multiple channels in the System Console. +- Create :doc:`system-wide access policies ` that can be assigned across multiple channels in the System Console. Membership policies can be applied to both public and private channels, with :ref:`advisory behavior on public channels `. - Assign :ref:`individual channel policies ` to specific channels in the System Console. - Define :ref:`permission policies ` that restrict actions such as file upload and file download based on user attributes. +- :ref:`Simulate policy outcomes ` to preview whether selected users can perform actions such as joining a channel or uploading and downloading files before saving policy changes. **Team Admins can:** diff --git a/source/administration-guide/manage/admin/content-flagging.rst b/source/administration-guide/manage/admin/content-flagging.rst index 8c2c1956dcf..58738cad245 100644 --- a/source/administration-guide/manage/admin/content-flagging.rst +++ b/source/administration-guide/manage/admin/content-flagging.rst @@ -87,24 +87,108 @@ Reviewers can select **View details** to take action as follows: - **Remove message**: Permanently delete the quarantined message from its original channel for all users. The status of the quarantined message changes to **Removed**. - **Keep message**: Dismiss the quarantine and restore the message if it was hidden. The status of the quarantined message changes to **Retained**. - **Add a comment**: Record the reason for the decision when required. +- **Generate a report**: Download a report of the quarantined message and review activity for record-keeping or incident response. See :ref:`administration-guide/manage/admin/content-flagging:generate a quarantined message report` for details. Once an action is taken, the **Status** field updates automatically. The **Data Spillage Bot** sends follow-up notifications to the reporter, author, and other reviewers based on how Data Spillage Handling is configured. +Generate a quarantined message report +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Reviewers can generate a downloadable report that captures the full context of a quarantined message and the associated review activity. Reports are useful for record-keeping, incident response, and preserving evidence before a message is permanently removed. + +A report can be generated from any of the following entry points: + +- **From the quarantined message details**: Select **Download report** from the message details panel. This option is available regardless of the quarantine's status, including **Pending**, **Reviewer Assigned**, **Removed**, or **Retained**. +- **From the Remove message flow**: When you select **Remove message**, the confirmation dialog includes a **Download quarantined message report** checkbox, selected by default. With the checkbox selected, Mattermost generates and downloads the report before you can permanently remove the message. This safeguard ensures the record is preserved on your device before the message contents are deleted. +- **From the Keep message flow**: When you select **Keep message**, the confirmation dialog includes the same checkbox. With the checkbox selected, Mattermost generates and downloads the report in the background while the keep action completes. + +If you choose to skip the report download from the **Remove message** or **Keep message** flow, Mattermost asks you to confirm that you're proceeding without a report. The skip decision is recorded in the audit log. + +If report generation fails (for example, due to a network interruption or session timeout), the dialog displays an error and offers a retry option. You can also skip the report and proceed with the action, or cancel and download the report later from the message details. + +Each time a reviewer generates a report, the **Data Spillage Bot** notifies all content reviewers so an auditable record exists whenever a copy of the potentially spilled data is obtained. + +.. tip:: + We recommend generating a report before removing a message. Once a message is removed, its content, attachments, and edit history are permanently deleted and can't be recovered. + +Report contents and format +^^^^^^^^^^^^^^^^^^^^^^^^^^ + +Each report is a ZIP archive containing YAML metadata files and the original file attachments. YAML is used because it's both human-readable and machine-parseable, which makes the report suitable for manual review and for ingestion by downstream compliance or incident-response tooling. + +The archive has the following structure: + +.. code-block:: text + + / + ├── report_metadata.yaml + ├── content_review.yaml + ├── post/ + │ ├── post.yaml + │ └── attachments/ + │ └── + └── edit_history/ + └── / + ├── post.yaml + └── attachments/ + └── + +- **report_metadata.yaml**: Identifies the report itself, including the user ID and username of the reviewer who generated the report, the generation timestamp, and the report format version (used for forward compatibility if the report format changes in future releases). +- **content_review.yaml**: Captures the data spillage event, including the reporter's user ID, username, selected reason, and comment; the report timestamp; whether the message was hidden during review; and, once the quarantine is resolved, the reviewer's user ID, username, comment, and action timestamp. For unresolved quarantines, reviewer fields are omitted. +- **post/post.yaml**: Describes the quarantined message, including the post ID, author ID, author name, author email, message content, channel ID, channel display name, team ID, team display name, creation and update timestamps, pinned status, root ID, post properties, post metadata, reply count (for root posts), and the ordered list of edit history post IDs. +- **post/attachments/**: The original files attached to the quarantined message, included verbatim. +- **edit_history//**: One subdirectory per previous version of the message, each containing a ``post.yaml`` and an ``attachments/`` directory in the same format as the base post directory. + +To avoid duplication, attachment files are deduplicated across the entire archive by their file ID. Each unique attachment appears exactly once — under the base post if it exists in the current version of the message, or under the earliest edit-history entry that referenced it. + Deleted messages ~~~~~~~~~~~~~~~~ -When a reviewer permanently removes a quarantined message, the message and all associated data are deleted from the database and can't be recovered, including: +When a reviewer permanently removes a quarantined message, the message and all associated data are deleted from the database and file system and can't be recovered. The deletion covers: + +- **Post record**: The text of the message and any associated post properties. The content is scrubbed before the post is deleted. +- **File attachments**: The files stored in Mattermost's file storage (local, S3, etc.). +- **File attachment records**: The file info database rows for the message, including file names, IDs, and links to storage. +- **Edit history**: Every prior revision of the message, along with file metadata from each revision. +- **Priority metadata**: Any message priority or importance settings. +- **Persistent notifications**: Any recurring notifications attached to the message. +- **Acknowledgements**: Records of users who acknowledged the message. +- **Reminders**: Any reminders created for the message. +- **Thread, replies, and reactions**: The thread record, replies, and reaction data, if any, associated with the message. + +Post deletion report +~~~~~~~~~~~~~~~~~~~~ + +When a reviewer selects **Remove message**, the **Data Spillage Bot** posts a **Post Deletion Report** into the reviewer's content review thread for that quarantined message. The report is delivered to every reviewer who received the original quarantine notification, and is localized to each reviewer's language. Each post includes a short summary rendered inline, and a full report attached as a Markdown file named ``deletion_report_.md``. + +The report records every cleanup step performed against the message and its associated data. The steps map directly to the data scope listed in :ref:`administration-guide/manage/admin/content-flagging:deleted messages`: + +- **File attachments**: Files removed from file storage. +- **File attachment records**: File info database rows for the message. +- **Edit history**: Every prior revision of the message. Each revision is reported as its own sub-step so that reviewers can see exactly which revisions were cleared. +- **Priority metadata**: Message priority and importance settings. +- **Persistent notifications**: Recurring notifications attached to the message. +- **Acknowledgements**: Records of users who acknowledged the message. +- **Reminders**: Reminders set on the message. +- **Thread, replies, and reactions**: The thread record, replies, and reaction data associated with the message. +- **Post record**: The post itself. The content is scrubbed before the post is deleted. + +Each step is assigned one of the following statuses: + +- **Removed** ✅: The data was successfully deleted. +- **Not applicable** ➖: There was no data of this type to delete. +- **Partial** ⚠️: Some items of this type were deleted, but at least one failed. This status most often appears under **Edit history** when one revision can't be deleted. +- **Failed** ❌: The step didn't complete. The report includes an error log so reviewers and System Administrators can inspect what went wrong. + +When every step is **Removed** or **Not applicable**, no further action is required. The report serves as the auditable record of the deletion. + +When any step reports **Partial** or **Failed**, the report displays an *incomplete* warning. Reviewers should escalate to a System Administrator, who can use the attached ``deletion_report_.md`` file - including the full per-step error log - to perform manual remediation and confirm that the data is fully removed. + +.. note:: -- Message content and properties: The text of the message and any associated post properties. -- File metadata: Information about files attached to the message (e.g., file names, IDs, and links to storage). -- File metadata from edit history: Information about files attached to earlier versions of the message. -- Edit history: All previous versions of the message and their timestamps. -- Uploaded files: The actual files stored in Mattermost’s file storage (local, S3, etc.). -- Priority data: Any message priority or importance settings. -- Acknowledgements: Records of users who acknowledged the message. -- Reminders: Any reminders created for the message. + The post deletion report is the single source of truth for post-removal auditing. It isn't stored elsewhere in the System Console, so the reviewer thread containing the report should be retained in line with your organization's audit retention policy. Best practice recommendations ----------------------------- -Before rolling out Data Spillage Handling organization-wide, we recommend communicating that the feature protects both users and the organization from accidental data spillage. Start with a pilot team to validate reviewer notifications and workflows, integrate the process with existing data-handling or incident-response playbooks, and require reporter and reviewer comments to ensure every decision is transparent and auditable. \ No newline at end of file +Before rolling out Data Spillage Handling organization-wide, we recommend communicating that the feature protects both users and the organization from accidental data spillage. Start with a pilot team to validate reviewer notifications and workflows, integrate the process with existing data-handling or incident-response playbooks, and require reporter and reviewer comments to ensure every decision is transparent and auditable. diff --git a/source/administration-guide/manage/admin/installing-license-key.rst b/source/administration-guide/manage/admin/installing-license-key.rst index fcccb145758..5aae1c563e1 100644 --- a/source/administration-guide/manage/admin/installing-license-key.rst +++ b/source/administration-guide/manage/admin/installing-license-key.rst @@ -37,7 +37,7 @@ You don't need to wait for your current license key to expire before replacing i .. tip:: - To review license usage before uploading a new key, go to **System Console > Reporting > Site Statistics**. The **Total Activated Users** field shows the primary paid seat count used for license validation. Review **Single-channel Guests** separately because guests in exactly one channel are tracked outside the primary paid seat count, are free up to a 1:1 ratio with licensed seats, and generate warnings instead of hard enforcement when that allowance is exceeded. + To review license usage before uploading a new key, go to **System Console > Reporting > System Statistics**. The **Total Activated Users** field shows the primary paid seat count used for license validation. Review **Single-channel Guests** separately because guests in exactly one channel are tracked outside the primary paid seat count, are free up to a 1:1 ratio with licensed seats, and generate warnings instead of hard enforcement when that allowance is exceeded. Follow these steps to change your license key: diff --git a/source/administration-guide/manage/admin/user-attributes.rst b/source/administration-guide/manage/admin/user-attributes.rst index d8c881d60c2..1a85f7ab892 100644 --- a/source/administration-guide/manage/admin/user-attributes.rst +++ b/source/administration-guide/manage/admin/user-attributes.rst @@ -83,6 +83,8 @@ Add attributes You can define and manage up to 20 system attributes using the System Console. Each attribute becomes a user profile option users can populate, unless you disable the **Editable by Users** option, available from Mattermost v11. Once you reach the maximum of 20 attributes, you can't create new attributes until you `delete attributes <#manage-attributes>`__ you no longer need. +From Mattermost v11.8, user attributes include both a **Display Name** and a **Name**. The Display Name is the label shown to users and admins in Mattermost. The Name is the internal attribute identifier used in API references and :doc:`attribute-based access control (ABAC) ` policy expressions. When you create a new user attribute, Mattermost can generate the Name from the Display Name, formatted as a CEL-safe identifier. Saved ABAC policies continue to reference the internal name using ``user.attributes.``. + .. note:: When you disable the **Editable by Users** option for an attribute, only admins can set its value using :ref:`mmctl cpa ` commands. @@ -90,7 +92,8 @@ You can define and manage up to 20 system attributes using the System Console. E 1. In the System Console, go to **Site Configuration > System Attributes > User Attributes** and select **Add Attribute**. 2. Enter the following details: - - **Attribute name**: Enter a unique name for the attribute. Attribute names can be up to 40 characters long. + - **Display Name**: Enter a display name for the attribute that will be shown in any user facing UI. + - **Attribute name**: Attribute name will be automatically generated from the provided Display Name. It can be overriden and with a preferred unique name for the attribute. Attribute names can be up to 40 characters long. The attribute name is used as the Common Expression Language (CEL) identifier in access control policies. It must start with a letter or underscore, and can contain only letters, numbers, and underscores. Reserved CEL words aren't allowed, including ``true``, ``false``, ``null``, ``in``, ``as``, ``break``, ``const``, ``continue``, ``else``, ``for``, ``function``, ``if``, ``import``, ``let``, ``loop``, ``package``, ``namespace``, ``return``, ``var``, ``void``, and ``while``. - **Type**: Specify the type of attribute as one of the following: - **Text** for text-based profile attributes. @@ -121,6 +124,9 @@ Manage attributes - **Modify**: Select the attribute fields to make inline changes to the attribute's name, type, or values. Select **More** |more-icon| to change a attribute's visibility. +.. note:: + From Mattermost v11.8, existing user attributes are backfilled so the Display Name initially matches the Name. If the Display Name is empty or unavailable, Mattermost falls back to showing the Name. Duplicate display names are permitted, but internal names remain unique. + - **Order**: Control the order you want attributes to appear in user profiles by dragging and dropping them in the list. - **Delete**: Delete attributes you no longer need or want by selecting **More** |more-icon| and selecting **Delete property**. diff --git a/source/administration-guide/manage/configure-health-check-probes.rst b/source/administration-guide/manage/configure-health-check-probes.rst index 1c394b15cd2..83636cfdfc6 100644 --- a/source/administration-guide/manage/configure-health-check-probes.rst +++ b/source/administration-guide/manage/configure-health-check-probes.rst @@ -31,7 +31,7 @@ This endpoint can also be provided to schedulers like `Kubernetes `. -Site statistics +System statistics --------------- System statistics are viewable under **System Console > Reporting**. The data shown here is a cumulative sum across all teams on the system. @@ -140,12 +140,12 @@ To enable team admins to access their team's statistics: .. image:: ../../images/edit-viewer-system-admin-role.png :alt: Enable team admins to access their team's statistics in the System Console by going to User Management > System Roles, and making changes to the Viewer role. -2. Under **Privileges**, expand the **Reporting** section, set **Team Statistics** to **Read only**, then set **Site Statistics** and **Server Logs** to **No access**. +2. Under **Privileges**, expand the **Reporting** section, set **Team Statistics** to **Read only**, then set **System Statistics** and **Server Logs** to **No access**. 3. Set all other privileges to **No access** to restrict all users with the **Viewer** role to access only the **Team Statistics** page in the System Console. .. image:: ../../images/restrict-role-access.png - :alt: On the Viewer page, restrict user access to the Team Statistics page by expanding the Reporting section, setting Site Statistics and Server Logs to No Access, and setting all other privileges to No Access. + :alt: On the Viewer page, restrict user access to the Team Statistics page by expanding the Reporting section, setting System Statistics and Server Logs to No Access, and setting all other privileges to No Access. 4. Under **Assigned People**, select **Add People** to assign team admins to the **Viewer** role, and enable them to access their team's statistics. diff --git a/source/administration-guide/onboard/advanced-permissions.rst b/source/administration-guide/onboard/advanced-permissions.rst index 198965eb095..2a93b5222a2 100644 --- a/source/administration-guide/onboard/advanced-permissions.rst +++ b/source/administration-guide/onboard/advanced-permissions.rst @@ -203,6 +203,26 @@ Example: As the default for the entire system, only allow users to edit their ow 3. In the **All Members**, **Channel Administrators**, and **Team Administrators** panels, in the **Manage Posts** section, check the box for **Edit Posts**. 4. From any panel, select the gear button to set the global time limit to ``300`` seconds. +Restrict who can edit post attachments +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +From Mattermost v11.8, system admins can use the **Edit Attachments** permission to control whether users can add or remove file attachments when editing posts. + +The **Edit Attachments** permission is separate from **Edit Own Posts**. Users with permission to edit a post can still update the post text, but they can't add or remove file attachments unless **Edit Attachments** is also enabled. + +By default, **Edit Attachments** is granted to users who have permission to edit posts. + +To allow users to edit post text without changing attachments: + +1. Go to **System Console > User Management > Permissions**. +2. Select **Edit Scheme**. +3. In the applicable role panel, go to **Manage Posts**. +4. Enable **Edit Own Posts**. +5. Disable **Edit Attachments**. +6. Select **Save**. + +If a user sees **Post attachments cannot be edited** when editing a post, they don't have permission to add or remove attachments for that post. + Integration management ~~~~~~~~~~~~~~~~~~~~~~ diff --git a/source/administration-guide/onboard/delegated-granular-administration.rst b/source/administration-guide/onboard/delegated-granular-administration.rst index 4067fda93ee..cb02ef6097c 100644 --- a/source/administration-guide/onboard/delegated-granular-administration.rst +++ b/source/administration-guide/onboard/delegated-granular-administration.rst @@ -155,7 +155,7 @@ Privileges | About | - PERMISSION_SYSCONSOLE_READ_ABOUT_EDITION_AND_LICENSE | | | - PERMISSION_SYSCONSOLE_WRITE_ABOUT_EDITION_AND_LICENSE | +------------------------+--------------------------------------------------------------------------+ -| Reporting | **Site Statistics** | +| Reporting | **System Statistics** | | | - PERMISSION_SYSCONSOLE_READ_REPORTING_SITE_STATISTICS | | | - PERMISSION_SYSCONSOLE_WRITE_REPORTING_SITE_STATISTICS | | | | diff --git a/source/administration-guide/onboard/sso-entraid.rst b/source/administration-guide/onboard/sso-entraid.rst index 69a0d6388f8..bdb0f991db1 100644 --- a/source/administration-guide/onboard/sso-entraid.rst +++ b/source/administration-guide/onboard/sso-entraid.rst @@ -77,7 +77,7 @@ Step 3: Configure Mattermost for Entra ID SSO Note about Microsoft Active Directory Tenants ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -A Microsoft Active Directory (AD) tenant is a dedicated instance of Azure Active Directory (Azure AD) that you own and would have received when signing up for a Microsoft cloud service, such as Azure or Entra ID. Tenants are commonly used by organizations who want to store information about their users, such as passwords, user profile data, and permissions. See the Microsoft Entra ID `_ documentation to learn more about getting an Azure AD tenant. +A Microsoft Active Directory (AD) tenant is a dedicated instance of Azure Active Directory (Azure AD) that you own and would have received when signing up for a Microsoft cloud service, such as Azure or Entra ID. Tenants are commonly used by organizations who want to store information about their users, such as passwords, user profile data, and permissions. See the `Microsoft Entra ID `_ documentation to learn more about getting an Azure AD tenant. To allow your Azure AD users to log in to Mattermost using Entra ID SSO, you must register Mattermost in the Microsoft Azure AD tenant that contains the users' information. The registration can be done from the `Microsoft Azure portal `__. The steps to register the Mattermost account in the tenant should be similar to those provided above, and you can find more information about `integrating apps with Azure AD here `_. diff --git a/source/administration-guide/scale/deploy-prometheus-grafana-for-performance-monitoring.rst b/source/administration-guide/scale/deploy-prometheus-grafana-for-performance-monitoring.rst index 7e679c2ef2c..c7f4c541ebf 100644 --- a/source/administration-guide/scale/deploy-prometheus-grafana-for-performance-monitoring.rst +++ b/source/administration-guide/scale/deploy-prometheus-grafana-for-performance-monitoring.rst @@ -122,6 +122,8 @@ What's collected? Mattermost provides :ref:`custom metrics ` and :ref:`standard Go metrics ` that can be used to monitor your system's performance. +When the ``AggregatePluginMetrics`` feature flag is enabled, plugin-provided metrics are included in the same ``/metrics`` scrape target and can be filtered by the ``plugin_id`` label. + Next steps ---------- diff --git a/source/administration-guide/scale/enterprise-search.rst b/source/administration-guide/scale/enterprise-search.rst index a587a01a39f..e060bdf2c72 100644 --- a/source/administration-guide/scale/enterprise-search.rst +++ b/source/administration-guide/scale/enterprise-search.rst @@ -63,7 +63,7 @@ Review the following support paths for enterprise search based on the version yo 1. Disable "compatibility mode" in OpenSearch. 2. Upgrade Mattermost server. - 3. Update the Mattermost ``ElasticsearchSettings.Backend`` configuration setting value from ``elasticsearch`` to ```opensearch``` manually or using :ref:`mmctl `. This value cannot be changed using the System Console. See the Mattermost search :ref:`backend type ` configuration setting documentation for additional details. + 3. Update the Mattermost ``ElasticsearchSettings.Backend`` configuration setting value from ``elasticsearch`` to ``opensearch`` manually or using :ref:`mmctl `. This value cannot be changed using the System Console. See the Mattermost search :ref:`backend type ` configuration setting documentation for additional details. 4. Restart the Mattermost server. Frequently asked questions (FAQ) diff --git a/source/administration-guide/scale/performance-monitoring-metrics.rst b/source/administration-guide/scale/performance-monitoring-metrics.rst index 14e89995d2a..c2a373f8743 100644 --- a/source/administration-guide/scale/performance-monitoring-metrics.rst +++ b/source/administration-guide/scale/performance-monitoring-metrics.rst @@ -176,6 +176,11 @@ Plugin metrics - ``mattermost_plugin_multi_hook_server_time``: Time for the server to execute multiple plugin hook handlers in seconds. - ``mattermost_plugin_multi_hook_time``: Time to execute multiple plugin hook handler in seconds. +The metrics above are measured by the Mattermost server as it executes plugin code. From Mattermost v11.8.0, plugin-provided Prometheus metrics can also be exposed through the standard Mattermost ``/metrics`` endpoint when the ``AggregatePluginMetrics`` feature flag is enabled. Aggregated plugin metrics include a ``plugin_id`` label, based on the plugin's manifest ID, so admins can identify which plugin produced each metric. + +.. note:: + ``AggregatePluginMetrics`` is disabled by default and must be enabled before plugin-provided metrics are included in the ``/metrics`` response. + Shared metrics ~~~~~~~~~~~~~~ diff --git a/source/administration-guide/upgrade/admin-onboarding-tasks.rst b/source/administration-guide/upgrade/admin-onboarding-tasks.rst index 47a9bd79c61..74f7adfd9a1 100644 --- a/source/administration-guide/upgrade/admin-onboarding-tasks.rst +++ b/source/administration-guide/upgrade/admin-onboarding-tasks.rst @@ -39,7 +39,7 @@ Important administration notes **DO NOT manipulate the Mattermost database** - In particular, DO NOT manually delete data from the database directly. Mattermost is designed as a continuous archive and cannot be supported after manual manipulation. -- If you need to permanently delete a team or user, use the :ref:`mmctl user delete ` command or the :ref:`mmctl user deletall ` command. +- If you need to permanently delete a team or user, use the :ref:`mmctl user delete ` command or the :ref:`mmctl user deleteall ` command. Common tasks ------------ diff --git a/source/administration-guide/upgrade/important-upgrade-notes.rst b/source/administration-guide/upgrade/important-upgrade-notes.rst index 87a369ece35..f3466b0aead 100644 --- a/source/administration-guide/upgrade/important-upgrade-notes.rst +++ b/source/administration-guide/upgrade/important-upgrade-notes.rst @@ -12,6 +12,158 @@ We recommend reviewing the `additional upgrade notes <#additional-upgrade-notes> | If you're upgrading | Then... | | from a version earlier than... | | +====================================================+==================================================================================================================================================================+ +| v11.8 | The Custom Profile Attributes property group is renamed from ``custom_profile_attributes`` to ``access_control``, and CPA fields and values are migrated from | +| | the legacy property model to the v2 model. The functionality of the CPA feature is unchanged. Plugin developers that use CPA will need to register against the | +| | new group name. | +| +------------------------------------------------------------------------------------------------------------------------------------------------------------------+ +| | Added a new ``Version`` column to the ``PropertyGroups`` table to distinguish PSAv1 (legacy) groups from PSAv2 groups. Existing groups default to version 1, | +| | preserving current behavior for all legacy callers. ``PropertyGroups`` is a small configuration-like table, and the ``ADD COLUMN ... DEFAULT 1 NOT NULL`` is a | +| | metadata-only operation in PostgreSQL — no table rewrite occurs and the ``AccessExclusiveLock`` on ``PropertyGroups`` is held only for milliseconds. The | +| | migrations are fully backwards-compatible and no database downtime is expected for this upgrade. The SQL queries included are: | +| | | +| | .. code-block:: sql | +| | | +| | -- Pre-upgrade schema changes (Mattermost 11.8). | +| | | +| | ALTER TABLE PropertyGroups ADD COLUMN IF NOT EXISTS Version integer DEFAULT 1 NOT NULL; | +| +------------------------------------------------------------------------------------------------------------------------------------------------------------------+ +| | Raised the PostgreSQL planner statistics target for ``posts.rootid`` and ``posts.channelid`` from the default 100 to 5000, and refreshes planner statistics | +| | with ``ANALYZE posts (rootid, channelid)``. The ``ALTER COLUMN ... SET STATISTICS`` statements are metadata-only operations that acquire only a | +| | ``SHARE UPDATE EXCLUSIVE`` lock — no table rewrite occurs and concurrent SELECT, INSERT, UPDATE, and DELETE on ``posts`` remain unblocked. The ``ANALYZE`` step | +| | may take several minutes on large ``posts`` tables (100M+ rows) due to the larger sample size, but does not block reads or writes. The migrations are fully | +| | backwards-compatible and no database downtime is expected for this upgrade. The SQL queries included are: | +| | | +| | .. code-block:: sql | +| | | +| | ALTER TABLE posts ALTER COLUMN rootid SET STATISTICS 5000; | +| | ALTER TABLE posts ALTER COLUMN channelid SET STATISTICS 5000; | +| | ANALYZE posts (rootid, channelid); | +| +------------------------------------------------------------------------------------------------------------------------------------------------------------------+ +| | Extended the ``channel_type`` enum with two new values: ``'BO'`` and ``'BP'``. The ``ALTER TYPE ... ADD VALUE`` statements acquire a brief | +| | ``AccessExclusiveLock`` on the ``channel_type`` type only — no table rewrite occurs and no row-level locking is applied to the ``channels`` table, making the | +| | operation near-instant. The migrations are fully backwards-compatible and no database downtime is expected for this upgrade. The SQL queries included are: | +| | | +| | .. code-block:: sql | +| | | +| | ALTER TYPE channel_type ADD VALUE IF NOT EXISTS 'BO'; | +| | ALTER TYPE channel_type ADD VALUE IF NOT EXISTS 'BP'; | +| +------------------------------------------------------------------------------------------------------------------------------------------------------------------+ +| | Introduced four schema migrations to the property and attribute system (``PropertyFields``, ``PropertyGroups``, ``AttributeView``) as part of the same release | +| | cycle. Migrations 000168 and 000169 add a nullable ``LinkedFieldID varchar(26)`` column to ``PropertyFields`` and a partial concurrent index over it, enabling | +| | fields to reference another field as a link. Migrations 000176 and 000177 promote the existing Custom Profile Attributes property group to a more general | +| | ``access_control`` group by updating permission columns on ``PropertyFields`` rows, renaming the ``PropertyGroups`` entry from ``custom_profile_attributes`` to | +| | ``access_control``, and narrowing the ``AttributeView`` materialized view to user-scoped attributes only. **Migrations 000176 and 000177 must ship together.** | +| | None of the affected tables are in the large-table list — the property system tables are small. Note: during the rolling-upgrade window, old-ESR nodes | +| | hard-coding ``'custom_profile_attributes'`` as the group lookup key will experience transient failures on CPA profile read/write endpoints and the ABAC | +| | policy-management admin UI; end-user channel access and the membership sync worker are unaffected. The migrations are fully backwards-compatible and no database | +| | downtime is expected for this upgrade. The SQL queries included are: | +| | | +| | .. code-block:: sql | +| | | +| | -- 000168: Add LinkedFieldID column | +| | ALTER TABLE PropertyFields ADD COLUMN IF NOT EXISTS LinkedFieldID varchar(26); | +| | | +| | -- 000169: Create partial index on LinkedFieldID | +| | CREATE INDEX CONCURRENTLY idx_propertyfields_linkedfieldid ON PropertyFields(LinkedFieldID) WHERE LinkedFieldID IS NOT NULL AND DeleteAt = 0; | +| | | +| | -- 000176: Migrate CPA to access_control | +| | UPDATE PropertyFields SET ObjectType = 'user' WHERE GroupID = (SELECT Id FROM PropertyGroups WHERE Name = 'custom_profile_attributes'); | +| | UPDATE PropertyGroups SET Name = 'access_control', Version = 2 WHERE Name = 'custom_profile_attributes'; | +| | | +| | -- 000177: Refresh AttributeView with user-scoped filter | +| | DROP MATERIALIZED VIEW AttributeView; | +| | CREATE MATERIALIZED VIEW AttributeView ... WHERE pf.ObjectType = 'user'; | +| +------------------------------------------------------------------------------------------------------------------------------------------------------------------+ +| | Mattermost v11.8 introduces schema changes to the ``Recaps`` table in the form of a new ``ViewedAt`` column and a new index on ``(UserId, ViewedAt)``. The column| +| | is added as a metadata-only operation, and the index is created using ``CONCURRENTLY``, meaning no table locks are acquired and existing operations on the table | +| | are not impacted. The migrations are fully backwards-compatible and no database downtime is expected for this upgrade. The SQL queries included are: | +| | | +| | .. code-block:: sql | +| | | +| | -- 000172_add_recaps_viewed_at.up.sql | +| | ALTER TABLE Recaps ADD COLUMN IF NOT EXISTS ViewedAt BIGINT NOT NULL DEFAULT 0; | +| | | +| | -- 000172_add_recaps_viewed_at.down.sql | +| | ALTER TABLE Recaps DROP COLUMN IF EXISTS ViewedAt; | +| | | +| | -- 000173_create_recaps_user_id_viewed_at_index.up.sql | +| | -- morph:nontransactional | +| | CREATE INDEX CONCURRENTLY IF NOT EXISTS idx_recaps_user_id_viewed_at ON Recaps(UserId, ViewedAt); | +| | | +| | -- 000173_create_recaps_user_id_viewed_at_index.down.sql | +| | -- morph:nontransactional | +| | DROP INDEX CONCURRENTLY IF EXISTS idx_recaps_user_id_viewed_at; | +| +------------------------------------------------------------------------------------------------------------------------------------------------------------------+ +| | Mattermost v11.8 introduces six schema changes supporting a new channel join request workflow and discoverable private channels. A ``Discoverable`` boolean | +| | column (``DEFAULT FALSE``) is added to the ``Channels`` table as a metadata-only operation that completes instantaneously on PostgreSQL 11+. A new | +| | ``ChannelJoinRequests`` table is created to manage access request workflows, tracking request status, denial reasons, and reviewer information. Four concurrent | +| | indexes are then added: a partial index on ``Channels`` for discoverable team channels (``idx_channels_discoverable_team``), a unique partial index on | +| | ``ChannelJoinRequests`` for pending requests (``idx_channeljoinrequests_pending_unique``), and two composite indexes optimizing queries by channel+status and | +| | user+status respectively. All index operations use ``CONCURRENTLY`` and must be run outside explicit transaction blocks. These migrations are PostgreSQL-only. | +| | The migrations are fully backwards-compatible and no database downtime is expected for this upgrade. The SQL queries included are: | +| | | +| | .. code-block:: sql | +| | | +| | -- Migration 000178: Add Discoverable column | +| | ALTER TABLE Channels ADD COLUMN IF NOT EXISTS Discoverable BOOLEAN NOT NULL DEFAULT FALSE; | +| | | +| | .. code-block:: sql | +| | | +| | -- Migration 000179: Partial index for discoverable channels | +| | -- Run outside a transaction block. | +| | CREATE INDEX CONCURRENTLY IF NOT EXISTS idx_channels_discoverable_team | +| | ON Channels (TeamId) | +| | WHERE Discoverable = TRUE AND Type = 'P' AND DeleteAt = 0; | +| | | +| | .. code-block:: sql | +| | | +| | -- Migration 000180: Create ChannelJoinRequests table | +| | CREATE TABLE IF NOT EXISTS ChannelJoinRequests ( | +| | Id VARCHAR(26) PRIMARY KEY, | +| | ChannelId VARCHAR(26) NOT NULL, | +| | UserId VARCHAR(26) NOT NULL, | +| | Message TEXT NOT NULL DEFAULT '', | +| | Status VARCHAR(16) NOT NULL DEFAULT 'pending', | +| | DenialReason TEXT NOT NULL DEFAULT '', | +| | CreateAt BIGINT NOT NULL, | +| | UpdateAt BIGINT NOT NULL, | +| | ReviewedBy VARCHAR(26) NOT NULL DEFAULT '', | +| | ReviewedAt BIGINT NOT NULL DEFAULT 0 | +| | ); | +| | | +| | .. code-block:: sql | +| | | +| | -- Migration 000181: Unique index for pending requests | +| | -- Run outside a transaction block. | +| | CREATE UNIQUE INDEX CONCURRENTLY IF NOT EXISTS idx_channeljoinrequests_pending_unique | +| | ON ChannelJoinRequests (ChannelId, UserId) | +| | WHERE Status = 'pending'; | +| | | +| | .. code-block:: sql | +| | | +| | -- Migration 000182: Index for channel+status queries | +| | -- Run outside a transaction block. | +| | CREATE INDEX CONCURRENTLY IF NOT EXISTS idx_channeljoinrequests_channel_status_createat | +| | ON ChannelJoinRequests (ChannelId, Status, CreateAt DESC); | +| | | +| | .. code-block:: sql | +| | | +| | -- Migration 000183: Index for user+status queries | +| | -- Run outside a transaction block. | +| | CREATE INDEX CONCURRENTLY IF NOT EXISTS idx_channeljoinrequests_user_status_createat | +| | ON ChannelJoinRequests (UserId, Status, CreateAt DESC); | +| +------------------------------------------------------------------------------------------------------------------------------------------------------------------+ +| | Mattermost v11.8 extends the ``permission_level`` PostgreSQL enum type to include an ``admin`` value alongside the existing ``none``, ``sysadmin``, and | +| | ``member`` values. This is a pure catalog change ``— ALTER TYPE ADD VALUE`` updates only the ``pg_type`` system catalog and does not touch the ``PropertyFields``| +| | table or any other application table. No columns, indexes, or table data are modified by the up migration. The change enables a new admin-level permission tier | +| | in the property field access control model. The migrations are fully backwards-compatible and no database downtime is expected for this upgrade. The SQL queries | +| | included are: | +| | | +| | .. code-block:: sql | +| | | +| | -- 000189_add_admin_to_permission_level.up.sql | +| | ALTER TYPE permission_level ADD VALUE IF NOT EXISTS 'admin'; | ++----------------------------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | v11.7 | FIPS builds require a minimum of 14 characters for passwords, atmos/camo proxy configuration, and shared channel secrets. Shorter passwords for existing users | | | will no longer be valid and require a password reset. Non-FIPS builds are unaffected. | | +------------------------------------------------------------------------------------------------------------------------------------------------------------------+ diff --git a/source/administration-guide/upgrade/open-source-components.rst b/source/administration-guide/upgrade/open-source-components.rst index d4ff8411740..2acb77f5446 100644 --- a/source/administration-guide/upgrade/open-source-components.rst +++ b/source/administration-guide/upgrade/open-source-components.rst @@ -39,6 +39,7 @@ Desktop Mobile ------- +- Mattermost Mobile v2.41.0 - `View Open Source Components `__. - Mattermost Mobile v2.40.0 - `View Open Source Components `__. - Mattermost Mobile v2.39.0 - `View Open Source Components `__. - Mattermost Mobile v2.38.0 - `View Open Source Components `__. @@ -140,6 +141,7 @@ Mobile Server ------------------------------ +- Mattermost Enterprise Edition v11.8.0 - `View Open Source Components `__. - Mattermost Enterprise Edition v11.7.0 - `View Open Source Components `__. - Mattermost Enterprise Edition v11.6.0 - `View Open Source Components `__. - Mattermost Enterprise Edition v11.5.0 - `View Open Source Components `__. diff --git a/source/administration-guide/upgrade/upgrading-postgres.rst b/source/administration-guide/upgrade/upgrading-postgres.rst index 7701ae9f0e6..251c23db5dc 100644 --- a/source/administration-guide/upgrade/upgrading-postgres.rst +++ b/source/administration-guide/upgrade/upgrading-postgres.rst @@ -135,7 +135,7 @@ When running PostgreSQL in Docker, ``pg_dump``/``pg_restore`` is the recommended After the upgrade ------------------ -After upgrading PostgreSQL, run ``ANALYZE VERBOSE`` on the Mattermost database. This re-populates the ``pg_statistics`` table used by PostgreSQL to generate optimal query plans. Skipping this step can result in degraded database performance. +After upgrading PostgreSQL, run ``ANALYZE VERBOSE`` on the Mattermost database. This re-populates the ``pg_statistic`` table used by PostgreSQL to generate optimal query plans. Skipping this step can result in degraded database performance. .. code-block:: sh diff --git a/source/conf.py b/source/conf.py index 856bef9ae59..84429f2a9cc 100644 --- a/source/conf.py +++ b/source/conf.py @@ -526,9 +526,9 @@ def setup(app: Sphinx): # built documents. # # The short X.Y version. -# version = '11.7' +# version = '11.8' # The full version, including alpha/beta/rc tags. -# release = '11.7' +# release = '11.8' # The language for content autogenerated by Sphinx. Refer to documentation # for a list of supported languages. diff --git a/source/deployment-guide/desktop/desktop-msi-installer-and-group-policy-install.rst b/source/deployment-guide/desktop/desktop-msi-installer-and-group-policy-install.rst index dcb1b13539a..4234f8e3591 100644 --- a/source/deployment-guide/desktop/desktop-msi-installer-and-group-policy-install.rst +++ b/source/deployment-guide/desktop/desktop-msi-installer-and-group-policy-install.rst @@ -47,9 +47,9 @@ Download group policy and MSI installer files .. image:: ../../images/desktop/msi_gpo/msi_gpo_installation_test_00002.png :alt: Go to the mattermost/desktop repository on GitHub. -3. Navigate to the release page for `version v6.2.0 `__ and download the appropriate installer for your version of Windows (32-bit vs. 64-bit). +3. Navigate to the release page for `version v6.2.2 `__ and download the appropriate installer for your version of Windows (32-bit vs. 64-bit). -4. Download the `source.zip `__ file as well to extract group policy files. +4. Download the `source.zip `__ file as well to extract group policy files. .. image:: ../../images/desktop/msi_gpo/msi_gpo_installation_test_00003.png :alt: In the mattermost/desktop repository on GitHub, go to the release page for the latest desktop release, then download the installer for your version of Windows. Download the source.zip file as well to extract group policy files. @@ -70,12 +70,12 @@ The following group policies are available supporting a state option of Not Conf | Update Notifications | If disabled, in-app update notifications are not shown. | v5.1 or later | ``EnableAutoUpdates`` | +--------------------------+------------------------------------------------------------+----------------------+----------------------------+ -1. Browse to the folder the above files were downloaded to and unzip the ``desktop-6.2.0.zip`` file in place. +1. Browse to the folder the above files were downloaded to and unzip the ``desktop-6.2.2.zip`` file in place. .. image:: ../../images/desktop/msi_gpo/msi_gpo_installation_test_00004.png :alt: Go to the install download directory on your machine and unzip the ZIP file. -2. Navigate to the unzipped ``desktop-6.2.0\resources\windows\gpo`` folder and copy the contents. +2. Navigate to the unzipped ``desktop-6.2.2\resources\windows\gpo`` folder and copy the contents. .. image:: ../../images/desktop/msi_gpo/msi_gpo_installation_test_00005.png :alt: Go to the \resources\windows\gpo directory and copy its contents. @@ -210,12 +210,12 @@ Perform a silent installation of the MSI by running the following command: Ensure the desktop app is closed before proceeding with a silent installation. Because it's a silent installation, Mattermost won't prompt you to close the desktop app. -**Command Prompt:** ``msiexec /i mattermost-desktop-v6.2.0-x64.msi /qn`` +**Command Prompt:** ``msiexec /i mattermost-desktop-v6.2.2-x64.msi /qn`` -**PowerShell:** ``Start-Process -FilePath "$env:systemroot\system32\msiexec.exe" -ArgumentList '/i mattermost-desktop-v6.2.0-x64.msi /qn'`` +**PowerShell:** ``Start-Process -FilePath "$env:systemroot\system32\msiexec.exe" -ArgumentList '/i mattermost-desktop-v6.2.2-x64.msi /qn'`` .. note:: - - Replace ```` with the actual version number (e.g., ``v6.2.0``). + - Replace ```` with the actual version number (e.g., ``v6.2.2``). - From v6.1.0, the MSI installs per-machine by default, requiring administrator privileges. From version v5.9.0 of the Mattermost desktop app, the following silent MSI installation options are also available. @@ -225,8 +225,8 @@ Specify an install directory Use the ``APPLICATIONFOLDER`` parameter to specify an installation directory for the MSI installation: -- **Command Prompt:** ``msiexec /i mattermost-desktop-v6.2.0-x64.msi APPLICATIONFOLDER=""`` -- **PowerShell:** ``Start-Process -FilePath "$env:systemroot\system32\msiexec.exe" -ArgumentList '/i mattermost-desktop-v6.2.0-x64.msi APPLICATIONFOLDER=""'`` +- **Command Prompt:** ``msiexec /i mattermost-desktop-v6.2.2-x64.msi APPLICATIONFOLDER=""`` +- **PowerShell:** ``Start-Process -FilePath "$env:systemroot\system32\msiexec.exe" -ArgumentList '/i mattermost-desktop-v6.2.2-x64.msi APPLICATIONFOLDER=""'`` Change this command as new versions of the Mattermost Desktop App are released. diff --git a/source/deployment-guide/desktop/linux-desktop-install.rst b/source/deployment-guide/desktop/linux-desktop-install.rst index cb9777c94cc..6e43f01219d 100644 --- a/source/deployment-guide/desktop/linux-desktop-install.rst +++ b/source/deployment-guide/desktop/linux-desktop-install.rst @@ -57,13 +57,13 @@ This page describes how to install the Mattermost desktop app on Linux. Install the Mattermost desktop app ---------------------------------- - 1. Download the latest version of the Mattermost desktop app for 64-bit systems: `mattermost-desktop-6.2.0-linux-x86_64.rpm `_ + 1. Download the latest version of the Mattermost desktop app for 64-bit systems: `mattermost-desktop-6.2.2-linux-x86_64.rpm `_ 2. At the command line, execute the following command: .. code-block:: sh - sudo rpm -i mattermost-desktop-6.2.0-linux-x86_64.rpm + sudo rpm -i mattermost-desktop-6.2.2-linux-x86_64.rpm 3. Run Mattermost as a desktop app. @@ -71,7 +71,7 @@ This page describes how to install the Mattermost desktop app on Linux. .. code-block:: sh - sudo rpm -u mattermost-desktop-6.2.0-linux-x86_64.rpm + sudo rpm -u mattermost-desktop-6.2.2-linux-x86_64.rpm .. tip:: You can review the current version of your desktop app by selecting the **More** |more-icon-vertical| icon located in the top left corner of the desktop app, then selecting **Help > Version...**. @@ -109,7 +109,7 @@ This page describes how to install the Mattermost desktop app on Linux. flatpak install mattermost-desktop-{VERSION}-linux-{ARCH}.flatpak - Replace ``{VERSION}`` with the version number (e.g., ``6.2.0``) and ``{ARCH}`` with your architecture (``x86_64`` or ``aarch64``). + Replace ``{VERSION}`` with the version number (e.g., ``6.2.2``) and ``{ARCH}`` with your architecture (``x86_64`` or ``aarch64``). 4. Run Mattermost as a desktop app: @@ -137,7 +137,7 @@ This page describes how to install the Mattermost desktop app on Linux. Install the Desktop App's compressed tarball --------------------------------------------- - 1. Download the latest version of the Mattermost desktop app for 64-bit systems: `mattermost-desktop-6.2.0-linux-x64.tar.gz `_ + 1. Download the latest version of the Mattermost desktop app for 64-bit systems: `mattermost-desktop-6.2.2-linux-x64.tar.gz `_ 2. Extract the archive to a convenient location, then give ``chrome-sandbox`` in the extracted directory the required ownership and permissions: ``sudo chown root:root chrome-sandbox && sudo chmod 4755 chrome-sandbox`` diff --git a/source/deployment-guide/mobile/mobile-troubleshooting.rst b/source/deployment-guide/mobile/mobile-troubleshooting.rst index 0c510fbaaeb..ae79aadf1e9 100644 --- a/source/deployment-guide/mobile/mobile-troubleshooting.rst +++ b/source/deployment-guide/mobile/mobile-troubleshooting.rst @@ -20,6 +20,24 @@ Login with ADFS/Office365 is not working In line with Microsoft guidance we recommend `configuring intranet forms-based authentication for devices that do not support WIA `_. +How do I attach mobile app logs to a message? +--------------------------------------------- + +Use ``/mobile-logs`` during mobile troubleshooting to let users attach Mattermost mobile app logs to messages. Running ``/mobile-logs on`` shows the **Attach app logs** option in the attachment menu of the message composer, so users can include device-side logs when messaging an administrator or support engineer. Users can also turn this option on or off from the **Report a problem** screen in the mobile app. The command responds with an ephemeral message visible only to the user who ran it. + +.. important:: + + This command requires Mattermost mobile app v2.38 or later. + +- Enable **Attach app logs** for yourself using ``/mobile-logs on``. +- Disable **Attach app logs** for yourself using ``/mobile-logs off``. +- Check whether **Attach app logs** is enabled using ``/mobile-logs status``. +- System admins can manage the setting for another user by appending a username, such as ``/mobile-logs on @username``, ``/mobile-logs off @username``, or ``/mobile-logs status @username``. + +.. important:: + + Non-admin users can only manage their own preference. Attempts to target another account return a neutral **Unable to change mobile log settings for that user** message to avoid username enumeration. Preference changes made through this command are recorded in the audit log. + I see a “Connecting…” bar that does not go away ----------------------------------------------- @@ -147,4 +165,4 @@ If you did not receive a push notification when testing push notifications, use To conserve disk space, once your push notification issue is resolved, go to **System Console > Environment > Logging > File Log Level**, then select **ERROR** to switch your logging detail level from **DEBUG** to **Errors Only**. -If push notifications are not being delivered on the mobile device, confirm that you're logged in to the **Native** mobile app session through **Profile > Security > View and Log Out of Active Sessions**. Otherwise, the `DeviceId` won't get registered in the `Sessions` table and notifications won't be delivered. \ No newline at end of file +If push notifications are not being delivered on the mobile device, confirm that you're logged in to the **Native** mobile app session through **Profile > Security > View and Log Out of Active Sessions**. Otherwise, the ``DeviceId`` won't get registered in the ``Sessions`` table and notifications won't be delivered. diff --git a/source/deployment-guide/reference-architecture/application-architecture.rst b/source/deployment-guide/reference-architecture/application-architecture.rst index aa50cb94fc2..7c7876ab271 100644 --- a/source/deployment-guide/reference-architecture/application-architecture.rst +++ b/source/deployment-guide/reference-architecture/application-architecture.rst @@ -72,7 +72,7 @@ To ensure high availability, database systems can leverage clustering, replicati **File Storage**: Manages all multimedia assets (e.g., file uploads, images, videos) shared across channels. Storage solutions include the following options: -- **Local Storage**: Files stored directly on the server’s filesystem. For high availability, redundancy can be achieved using RAID configurations or backups to recover from disk failures. +- **Local Storage**: Files stored directly on the server's filesystem. For high availability, redundancy can be achieved using RAID configurations or backups to recover from disk failures. - **Network Attached Storage (NAS)**: Common for enterprises centralizing file storage within their network. NAS setups can include fault-tolerant configurations like distributed systems or replication for uninterrupted access. - **S3**: Offers cloud-based scalable storage for larger environments or organizations with distributed deployments. The database and file storage handle scalability, ensuring efficient support for millions of messages and files while guaranteeing data consistency. S3 inherently supports high availability by distributing data across multiple availability zones, ensuring no single point of failure. @@ -141,37 +141,92 @@ If Mattermost is accessible from the open internet with no VPN or MFA set up, we Mattermost services ports ^^^^^^^^^^^^^^^^^^^^^^^^^ -The following table lists the Mattermost services ports for Mattermost Server, push proxy, and mobile app clients. System admins with clients that need to speak to the Mattermost server without a proxy can open specific firewall ports as needed. +The following tables list the Mattermost services ports for Mattermost Server, push proxy, and mobile app clients. System admins with clients that need to speak to the Mattermost server without a proxy can open specific firewall ports as needed. **Mattermost Server** -+-------------------------------------------------------------+---------------------------------------+-----------------------------------+-----------+------------+---------------------------------------------------------------+ -| Service Name | Config Setting | Port (default) | Protocol | Direction | Info | -+=============================================================+=======================================+===================================+===========+============+===============================================================+ -| HTTP/Websocket | ServiceSettings.ListenAddress | 8065/80/443 (TLS) | TCP | Inbound | External (no proxy) / Internal (with proxy) | -+-------------------------------------------------------------+---------------------------------------+-----------------------------------+-----------+------------+ Usually this requires port 80 and 443 when running HTTPS. | -| Cluster | ClusterSettings.GossipPort | 8074 | TCP/UDP | Inbound | Internal | -+-------------------------------------------------------------+---------------------------------------+-----------------------------------+-----------+------------+---------------------------------------------------------------+ -| Metrics | MetricsSettings.ListenAddress | 8067 | TCP | Inbound | External (no proxy) / Internal (with proxy) | -+-------------------------------------------------------------+---------------------------------------+-----------------------------------+-----------+------------+---------------------------------------------------------------+ -| Database | SqlSettings.DataSource | 5432 (PostgreSQL) / 3306 (MySQL) | TCP | Outbound | Usually internal (recommended) | -+-------------------------------------------------------------+---------------------------------------+-----------------------------------+-----------+------------+---------------------------------------------------------------+ -| LDAP | LdapSettings.LdapPort | 389 | TCP/UDP | Outbound | | -+-------------------------------------------------------------+---------------------------------------+-----------------------------------+-----------+------------+---------------------------------------------------------------+ -| S3 Storage | FileSettings.AmazonS3Endpoint | 443 (TLS) | TCP | Outbound | | -+-------------------------------------------------------------+---------------------------------------+-----------------------------------+-----------+------------+---------------------------------------------------------------+ -| SMTP | EmailSettings.SMTPPort | 10025 | TCP/UDP | Outbound | | -+-------------------------------------------------------------+---------------------------------------+-----------------------------------+-----------+------------+---------------------------------------------------------------+ -| Push Notifications | EmailSettings.PushNotificationServer | 443 (TLS) | TCP | Outbound | | -+-------------------------------------------------------------+---------------------------------------+-----------------------------------+-----------+------------+---------------------------------------------------------------+ +*Inbound ports* + +.. list-table:: + :header-rows: 1 + :widths: auto + + * - Service + - Config Setting + - Port (default) + - Protocol + - Notes + * - HTTP/WebSocket + - ``ServiceSettings.ListenAddress`` + - 8065 / 80 / 443 (TLS) + - TCP + - External (no proxy) / Internal (with proxy). Ports 80 and 443 are typically used when running HTTPS. + * - Cluster (HA) + - ``ClusterSettings.GossipPort`` + - 8074 + - TCP/UDP + - Internal only. Must be reachable between all Mattermost Server nodes. Both TCP and UDP must be open. HA only. + * - Metrics + - ``MetricsSettings.ListenAddress`` + - 8067 + - TCP + - Internal only. Restrict access to trusted monitoring hosts (e.g., Prometheus). Must not be exposed to the public internet. Only required when metrics collection is enabled. + +*Outbound ports* + +.. list-table:: + :header-rows: 1 + :widths: auto + + * - Service + - Config Setting + - Port (default) + - Protocol + - Notes + * - Database + - ``SqlSettings.DataSource`` + - 5432 (PostgreSQL) + - TCP + - Usually internal (recommended). + * - LDAP + - ``LdapSettings.LdapPort`` + - 389 + - TCP/UDP + - + * - S3 Storage + - ``FileSettings.AmazonS3Endpoint`` + - 443 (TLS) + - TCP + - + * - SMTP + - ``EmailSettings.SMTPPort`` + - 10025 + - TCP/UDP + - + * - Push Notifications + - ``EmailSettings.PushNotificationServer`` + - 443 (TLS) + - TCP + - **Push Proxy** -+---------------+-----------------+-----------------+-----------+------------+----------------------------------------------+ -| Service Name | Config Setting | Port (default) | Protocol | Direction | Info | -+===============+=================+=================+===========+============+==============================================+ -| Push Proxy | ListenAddress | 8066 | TCP | Inbound | External (no proxy) / Internal (with proxy) | -+---------------+-----------------+-----------------+-----------+------------+----------------------------------------------+ +*Inbound ports* + +.. list-table:: + :header-rows: 1 + :widths: auto + + * - Service + - Config Setting + - Port (default) + - Protocol + - Notes + * - Push Proxy + - ``ListenAddress`` + - 8066 + - TCP + - Internal only. Must be reachable only from Mattermost Server nodes. Required when running a self-hosted push proxy. **Mobile Clients** diff --git a/source/deployment-guide/reference-architecture/deployment-scenarios/air-gapped-deployment.rst b/source/deployment-guide/reference-architecture/deployment-scenarios/air-gapped-deployment.rst index 6eacab55b7e..d2c14490d6f 100644 --- a/source/deployment-guide/reference-architecture/deployment-scenarios/air-gapped-deployment.rst +++ b/source/deployment-guide/reference-architecture/deployment-scenarios/air-gapped-deployment.rst @@ -76,6 +76,28 @@ On an internet connected machine, you must gather all required packages, contain - Load balancer: If you already have a load balancer running in your air-gapped environment you can skip this resource, otherwise we recommend deploying :doc:`NGINX `, using the `NGINX Ingress Controller operator `__. - Desktop app: Download the `required package `_ based on your deployment method. + .. note:: + + **Database readiness check (air-gapped recommendation)** + + If your installed Mattermost Operator supports ``spec.database.readinessCheck.mode``, it can run the database-readiness init container from the same Mattermost image as the main container by setting ``spec.database.readinessCheck.mode: builtin`` on the ``Mattermost`` custom resource. The init container then invokes the in-image ``mattermost db ping`` command instead of pulling ``postgres:13`` and running ``pg_isready``. + + We recommend this mode for air-gapped clusters because it removes the requirement to mirror ``postgres:13`` into your private registry; the only image needed for the readiness check is the Mattermost image you're already mirroring. Before using ``builtin`` mode, confirm that your installed operator version includes the ``readinessCheck.mode`` field in the Mattermost CRD or in the operator release notes. ``builtin`` mode also requires a Mattermost release that ships the ``mattermost db ping`` command (see the `Mattermost server release notes `__ for availability). + + Example: + + .. code-block:: yaml + + spec: + database: + external: + secret: + readinessCheck: + mode: builtin + timeout: 5m # optional; default is 5m + + The legacy ``external`` mode (which uses ``postgres:13`` + ``pg_isready``) remains the default for backward compatibility and is still selectable for users on older Mattermost versions, but it is slated for deprecation in a future operator release. See the `Mattermost CRD reference `__ for the full ``readinessCheck`` field schema. + **(Optional) Supporting Services** Consider downloading these additional resources if you plan to enable these optional components: diff --git a/source/deployment-guide/server/kubernetes/deploy-k8s.rst b/source/deployment-guide/server/kubernetes/deploy-k8s.rst index 7b9fc154472..8722761b76a 100644 --- a/source/deployment-guide/server/kubernetes/deploy-k8s.rst +++ b/source/deployment-guide/server/kubernetes/deploy-k8s.rst @@ -138,6 +138,10 @@ Step 3: Deploy Mattermost name: my-postgres-connection type: Opaque + .. note:: + + The ``DB_CONNECTION_CHECK_URL`` value is consumed by the operator's legacy ``postgres:13`` + ``pg_isready`` readiness init container (the default ``external`` mode of ``spec.database.readinessCheck``). New deployments are encouraged to set ``spec.database.readinessCheck.mode: builtin`` (see Step 5 below), in which case the readiness init container runs the in-image ``mattermost db ping`` command and the ``DB_CONNECTION_CHECK_URL`` field is no longer required. The legacy ``external`` mode remains the default for backward compatibility but is slated for deprecation in a future operator release. + Step 4: Create the Filestore Secret ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ @@ -194,6 +198,22 @@ Step 5: Configure the Mattermost Installation Manifest external: secret: # The name of the database secret (e.g., my-postgres-connection) + b. **(Recommended)** Configure the database-readiness init container to use the in-image ``mattermost db ping`` command instead of the legacy ``postgres:13`` + ``pg_isready`` flow. This avoids the need to pull a separate ``postgres:13`` image (the primary motivation for air-gapped clusters that can't mirror it) and keeps your readiness check in sync with the Mattermost release you're running. + + .. code-block:: yaml + + spec: + database: + external: + secret: + readinessCheck: + mode: builtin + timeout: 5m # optional; default is 5m + + Using ``builtin`` mode requires a Mattermost release that ships the ``mattermost db ping`` command (see the `Mattermost server pull request `__ for availability). + + Omitting ``readinessCheck`` (or setting ``mode: external``) preserves the legacy ``postgres:13`` + ``pg_isready`` behavior. The legacy mode is the current default for backward compatibility and will be deprecated in a future operator release. See the `Mattermost CRD reference `__ for the full ``readinessCheck`` field schema. + 3. Connect to Object Storage: a. Add the following to the ``spec`` section of your manifest: diff --git a/source/deployment-guide/server/linux/deploy-rhel.rst b/source/deployment-guide/server/linux/deploy-rhel.rst index 4c6415467b2..9da3e08a6f1 100644 --- a/source/deployment-guide/server/linux/deploy-rhel.rst +++ b/source/deployment-guide/server/linux/deploy-rhel.rst @@ -44,13 +44,13 @@ In a terminal window, ssh onto the system that will host the Mattermost Server. .. code-block:: sh - wget https://releases.mattermost.com/11.7.3/mattermost-11.7.3-linux-amd64.tar.gz + wget https://releases.mattermost.com/11.8.1/mattermost-11.8.1-linux-amd64.tar.gz .. tab:: Current ESR .. code-block:: sh - wget https://releases.mattermost.com/11.7.3/mattermost-11.7.3-linux-amd64.tar.gz + wget https://releases.mattermost.com/11.7.5/mattermost-11.7.5-linux-amd64.tar.gz .. tab:: Older releases diff --git a/source/deployment-guide/server/linux/deploy-tar.rst b/source/deployment-guide/server/linux/deploy-tar.rst index 2899c7074d6..ebca9d70f3b 100644 --- a/source/deployment-guide/server/linux/deploy-tar.rst +++ b/source/deployment-guide/server/linux/deploy-tar.rst @@ -45,13 +45,13 @@ In a terminal window, ssh onto the system that will host the Mattermost Server. .. code-block:: sh - wget https://releases.mattermost.com/11.7.3/mattermost-11.7.3-linux-amd64.tar.gz + wget https://releases.mattermost.com/11.8.1/mattermost-11.8.1-linux-amd64.tar.gz .. tab:: Current ESR .. code-block:: sh - wget https://releases.mattermost.com/11.7.3/mattermost-11.7.3-linux-amd64.tar.gz + wget https://releases.mattermost.com/11.7.5/mattermost-11.7.5-linux-amd64.tar.gz .. tab:: Older releases @@ -182,7 +182,7 @@ To remove the Mattermost Server for any reason, you must stop the Mattermost Ser .. code-block:: sh - sudo rm - rf /opt/mattermost + sudo rm -rf /opt/mattermost .. note:: diff --git a/source/end-user-guide/collaborate/autotranslate-messages.rst b/source/end-user-guide/collaborate/autotranslate-messages.rst index da539294398..137593445e5 100644 --- a/source/end-user-guide/collaborate/autotranslate-messages.rst +++ b/source/end-user-guide/collaborate/autotranslate-messages.rst @@ -1,4 +1,4 @@ -Auto-translate messages (Beta) +Auto-translate messages ============================== .. include:: ../../_static/badges/ent-adv.rst diff --git a/source/end-user-guide/collaborate/browse-channels.rst b/source/end-user-guide/collaborate/browse-channels.rst index 4be5dee086c..9cb8ba87cb5 100644 --- a/source/end-user-guide/collaborate/browse-channels.rst +++ b/source/end-user-guide/collaborate/browse-channels.rst @@ -15,6 +15,10 @@ Browse channels From Mattermost v9.1, you can filter the list of channels by public, private, or archived channels, and you can hide all channels you're already a member of. + .. note:: + + From Mattermost v11.8.0, if your organization uses membership policies, **Browse Channels** may include a **Recommended** filter. Recommended channels are public channels your attributes match. You can still browse and join public channels according to your organization's normal channel permissions. + .. tab:: Mobile 1. Tap the **Plus** |plus| icon located in the top right corner of the app. diff --git a/source/end-user-guide/collaborate/create-channels.rst b/source/end-user-guide/collaborate/create-channels.rst index 1246d94ec9f..1018ce91332 100644 --- a/source/end-user-guide/collaborate/create-channels.rst +++ b/source/end-user-guide/collaborate/create-channels.rst @@ -21,7 +21,7 @@ Anyone can create public channels, private channels, direct messages, and group 2. Enter a channel name. 3. Choose whether this is a public or private channel. See the :doc:`channel types ` documentation to learn more about public and private channels. 4. (Optional) Describe the channel's focus or purpose. This text is visible to all channel members in the channel header. - 5. (Optional) Assign the channel to a category. If your system admin has enabled :ref:`channel category sorting `, you can assign the new channel to a new or existing channel category. If this option isn't available, you can `customize your channel sidebar `. + 5. (Optional) Assign the channel to a category. When :ref:`channel category sorting ` is enabled (the default from Mattermost v11.8), channel admins see a **Default category (optional)** field when creating or editing a channel. You can select an existing category, type a new category name, or clear the default category from channel settings. Members who join the channel see it under that category in their sidebar. If this option isn't available, you can `customize your channel sidebar `. Start a direct or group message -------------------------------- diff --git a/source/end-user-guide/collaborate/display-channel-banners.rst b/source/end-user-guide/collaborate/display-channel-banners.rst index c522ebc2cf6..699351e0303 100644 --- a/source/end-user-guide/collaborate/display-channel-banners.rst +++ b/source/end-user-guide/collaborate/display-channel-banners.rst @@ -36,3 +36,12 @@ Disable the **Channel Banner** option in the channel settings to remove the bann .. tip:: System admins can grant any user the ability to create and manage channel banners by assigning the **Manage Channel Banners** permission in the System Console. See the :doc:`advanced permissions ` documentation for details. + +Classification markings +----------------------- + +From Mattermost v11.8, system admins can configure classification markings that display as global or channel-level banners in the web and desktop apps. See the :ref:`Classification Markings ` configuration documentation for setup details. + +Classification markings use predefined or custom classification levels, including the classification name and banner color. These markings are informational only and don't control access to channels, messages, files, or other Mattermost resources. + +When a channel classification is applied, Mattermost displays the selected classification as the channel banner. Classification markings take priority over a custom channel banner when both are configured for the same channel. diff --git a/source/end-user-guide/collaborate/join-leave-channels.rst b/source/end-user-guide/collaborate/join-leave-channels.rst index 8c4a15ad21a..f80397d559f 100644 --- a/source/end-user-guide/collaborate/join-leave-channels.rst +++ b/source/end-user-guide/collaborate/join-leave-channels.rst @@ -107,4 +107,14 @@ When you leave a private channel, you must be re-added by another channel member .. image:: ../../images/mobile-confirm-leave-a-channel.jpg :alt: Tap on Leave to confirm your choice. - :scale: 30 \ No newline at end of file + :scale: 30 + +Leave a public channel added by a membership policy +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +From Mattermost v11.8.0, when you leave a public channel you were added to by a membership policy, Mattermost asks you to confirm: + +- Choosing **Leave channel** removes you from the channel. +- Choosing **Mute instead** keeps you in the channel and mutes its notifications. + +If the channel is already muted, Mattermost shows **Cancel** and **Leave channel** instead of **Mute instead**. \ No newline at end of file diff --git a/source/end-user-guide/collaborate/manage-channel-members.rst b/source/end-user-guide/collaborate/manage-channel-members.rst index 58724e2dafd..49731bf84d2 100644 --- a/source/end-user-guide/collaborate/manage-channel-members.rst +++ b/source/end-user-guide/collaborate/manage-channel-members.rst @@ -9,7 +9,10 @@ Add members to a channel Any member of a channel can add other members to public or private channels, unless your system admin has restricted access to do so. -When a channel has :doc:`attribute-based access controls ` enabled, you'll see details about which user attributes are permitted access to the channel. Only users who meet the requirements appear in search results when adding members to that channel. +When a channel has :doc:`attribute-based access controls ` enabled, you'll see details about which user attributes are permitted access to the channel. Behavior when adding members depends on the channel type: + +- **Private channels with membership policies**: Only users who meet the policy requirements are available to add. +- **Public channels with membership policies**: Users who match the policy may be shown with a **Recommended** tag, but the invite list isn't restricted by the policy. .. tab:: Web/Desktop diff --git a/source/end-user-guide/collaborate/organize-using-teams.rst b/source/end-user-guide/collaborate/organize-using-teams.rst index f2556fb20bd..6204556ccb5 100644 --- a/source/end-user-guide/collaborate/organize-using-teams.rst +++ b/source/end-user-guide/collaborate/organize-using-teams.rst @@ -22,7 +22,6 @@ Single team versus multiple teams Mattermost can be deployed both to a single team and to multiple teams. Currently, we recommend deploying to a single team for the following reasons: - Single team deployments promote communication across the organization. When you add multiple teams, groups can become isolated. -- We don't yet support search or channels across teams, which can impact the cross-team user experience. This includes general searches, saved posts, and recent mentions. - Integrations (e.g., webhooks and slash commands) are only persistent across single team deployments. However, some Mattermost customers prefer multiple team deployments for the following reasons: @@ -30,6 +29,7 @@ However, some Mattermost customers prefer multiple team deployments for the foll - Teams are useful when there is a purpose for each of them. For example, one team is used for staff members and another team for external users. - Performance is better when users are scattered across multiple teams instead of all in the same one. With multiple teams, there is less content to load per team or channel switch and database queries are faster. - Creating a shared team for all users, and using advanced permissions to control who can create channels and add members to the shared team, improves cross-team collaboration when using multiple teams. Additionally, an annoucement banner can be used to provide system-wide announcements. +- The platform supports multiple team functionalities including general search, saved posts, and recent mentions across teams. Team sidebar ------------ @@ -118,4 +118,4 @@ When a team is archived, the team will no longer be visible or accessible in the .. note:: - Archiving a team doesn't remove the team data from the Mattermost database. Teams may still be accessible by using the Mattermost API. \ No newline at end of file + Archiving a team doesn't remove the team data from the Mattermost database. Teams may still be accessible by using the Mattermost API. diff --git a/source/end-user-guide/collaborate/react-with-emojis-gifs.rst b/source/end-user-guide/collaborate/react-with-emojis-gifs.rst index a4cbef4f721..204af7396a1 100644 --- a/source/end-user-guide/collaborate/react-with-emojis-gifs.rst +++ b/source/end-user-guide/collaborate/react-with-emojis-gifs.rst @@ -74,7 +74,7 @@ Using Mattermost in a web browser or the desktop app, you can upload new emojis :alt: Select Custom Emoji to upload custom emojis to Mattermost. 2. Enter a name for your custom emoji. This is the name that shows up in the emoji autocomplete. -3. Choose **Select**, then select the image to use for the emoji. Small, square pictures work best when selecting an image to upload. The file can be any JPG, GIF, or PNG that's up to 512 KiB in size. +3. Choose **Select**, then select the image to use for the emoji. Small, square pictures work best when selecting an image to upload. The file can be any JPG, GIF, or PNG that's up to 512 KiB in size. Mattermost limits the number of frames allowed in animated GIF emojis. 4. Select **Save**. Once saved, your emoji is added to the list of custom emoji. .. image:: ../../images/add_custom_emoji.png diff --git a/source/end-user-guide/collaborate/rename-channels.rst b/source/end-user-guide/collaborate/rename-channels.rst index 47901ac8af6..764e9b71cd5 100644 --- a/source/end-user-guide/collaborate/rename-channels.rst +++ b/source/end-user-guide/collaborate/rename-channels.rst @@ -13,7 +13,7 @@ Anyone can rename the channels they belong to, unless the system admin has :doc: - **Channel name:** The channel name that displays in the Mattermost user interface for all users. Enter a different channel name if needed or preferred. - **Channel URL:** The web URL used to access the channel in a web browser. Select **Edit** to change the URL, and select **Done** to save your changes. If your system admin has enabled anonymous team and channel URLs (available in Mattermost Enterprise Advanced from v11.6.0), channel URLs are assigned automatically and do not reflect the channel name. - If your system admin has enabled :ref:`channel category sorting `, you can assign the renamed channel to a new or existing channel category. + When :ref:`channel category sorting ` is enabled (the default from Mattermost v11.8), channel admins can set a **Default category (optional)** for the channel. You can select an existing category, type a new category name, or clear the default category. Members who join the channel see it under that category in their sidebar. For example, a channel could be named ``UX Design`` and have a URL of ``https://community.mattermost.com/core/channels/ux-design`` (or an anonymous URL if enabled by your system admin). diff --git a/source/end-user-guide/preferences/customize-your-channel-sidebar.rst b/source/end-user-guide/preferences/customize-your-channel-sidebar.rst index 656573c09dc..51ef65ac96c 100644 --- a/source/end-user-guide/preferences/customize-your-channel-sidebar.rst +++ b/source/end-user-guide/preferences/customize-your-channel-sidebar.rst @@ -36,7 +36,7 @@ Create custom categories to group channels together for quicker and easier navig To create categories, select the **+** symbol at the top of the sidebar. Or, select the **More options** |more-icon| icon in the sidebar on any category header, then select **Create New Category**. .. note:: - If your system admin has enabled :ref:`channel category sorting `, you can assign channels to new or existing channel categories when :doc:`creating channels ` and :doc:`renaming channels `. + When :ref:`channel category sorting ` is enabled (the default from Mattermost v11.8), you can assign channels to new or existing channel categories when :doc:`creating channels ` and :doc:`renaming channels `. Next, type a category name, select **Create**, then drag any channels or direct messages into this new category. You can also multi-select channels and direct messages to drag them together as a group by pressing :kbd:`Ctrl` or :kbd:`Shift` and selecting on Windows or Linux, or :kbd:`⌘` or :kbd:`⇧` and selecting on Mac. See the section `drag and drop selections <#drag-and-drop-selections>`__ below for details. diff --git a/source/get-help/community-chat.rst b/source/get-help/community-chat.rst index 5c2e21c64c0..c5898f0a382 100644 --- a/source/get-help/community-chat.rst +++ b/source/get-help/community-chat.rst @@ -39,6 +39,6 @@ To familiarize yourself with our community contribution process, start by explor - `QA: Contributors `__ - `Thank you! `__ -There are many channels that specialize in different areas of the Mattermost platform. To find and join them, search “**Developers:**” in the `LHS `__ “🔍 Find channel” search bar on the community server. +There are many channels that specialize in different areas of the Mattermost platform. To find and join them, search for **Developers:** using the `LHS `__ "Find channel" search bar on the community server. We hold a public developer community meeting every Wednesday at 8:30 AM Palo Alto time. ☎️ The meeting is held via an audio call in `Developers: Meeting `__ and everyone is welcome. This weekly meeting is a great opportunity to ask questions about the project and get involved. diff --git a/source/integrations-guide/built-in-slash-commands.rst b/source/integrations-guide/built-in-slash-commands.rst index 7f87e7fe45a..3616eadb521 100644 --- a/source/integrations-guide/built-in-slash-commands.rst +++ b/source/integrations-guide/built-in-slash-commands.rst @@ -63,4 +63,4 @@ More useful slash commands - Open the in-product Marketplace using ``/marketplace``. - Display a list of keyboard shortcuts using ``/shortcuts``. - Open the **Settings** screen using ``/settings``. -- Log out of Mattermost using ``/logout``. \ No newline at end of file +- Log out of Mattermost using ``/logout``. diff --git a/source/integrations-guide/github.rst b/source/integrations-guide/github.rst index 52193cdf63e..cfd80218dcd 100644 --- a/source/integrations-guide/github.rst +++ b/source/integrations-guide/github.rst @@ -68,9 +68,20 @@ You can configure the GitHub integration using either the built-in setup wizard **Create a webhook in GitHub** - Create a webhook in GitHub for each GitHub organization you want to set up. + Create a webhook in GitHub to send events to Mattermost. You can create the webhook at either level: - 1. In GitHub, go to the **Settings** page where you want to send notifications from, then select **Webhooks** in the sidebar. + - **Organization level**: Delivers events for every repository in the organization. + - **Repository level**: One webhook per repository you want to send events from to Mattermost. + + .. important:: + + Make sure only **one** webhook delivers events for any given repository. If a repository is covered by both an organization-level webhook and a repository-level webhook (or by duplicate webhooks), GitHub delivers each event more than once, and Mattermost posts a duplicate notification for every delivery. If notifications appear two or more times, review the webhooks in your GitHub organization and repository settings, and remove the extras so that exactly one webhook delivers each repository's events. + + .. note:: + + When you subscribe a channel to a specific repository using ``/github subscriptions add owner/repository`` while relying on an **organization-level** webhook, the plugin might report ``No webhook was found for this repository or organization`` even though the organization-level webhook is delivering events correctly. This check currently only looks for repository-level webhooks; the message is informational and doesn't mean events are missing, so it's safe to ignore. If you prefer to avoid it, deliver that repository's events through a repository-level webhook *instead of* the organization-level webhook. + + 1. In GitHub, go to the **Settings** page (for your organization or a specific repository) where you want to send notifications from, then select **Webhooks** in the sidebar. 2. Select **Add Webhook**. 3. Set the following values: diff --git a/source/integrations-guide/no-code-automation.rst b/source/integrations-guide/no-code-automation.rst index 506ee9c4af6..68de384d4da 100644 --- a/source/integrations-guide/no-code-automation.rst +++ b/source/integrations-guide/no-code-automation.rst @@ -115,7 +115,7 @@ Choosing the best platform for your team depends on your specific integration re Zapier’s strength is the breadth of integrations. Without coding, you can integrate Mattermost with everything from CRMs to social media. This is perfect for non-technical users who want to automate notifications or routine tasks, such as posting daily reports or sending Mattermost channel messages when forms are submitted. Zapier provides a user-friendly wizard and template library to get started quickly. - Explore building workflows with the `Mattermost Zapier integration `_. + Explore building workflows with the `Mattermost Zapier integration `_. Supported Triggers ------------------- @@ -125,4 +125,4 @@ Choosing the best platform for your team depends on your specific integration re Supported Actions ------------------ - - Compared with the wide range of triggers and actions supported by n8n or Make, Zapier supports only one action: posting a message. \ No newline at end of file + - Compared with the wide range of triggers and actions supported by n8n or Make, Zapier supports only one action: posting a message. diff --git a/source/integrations-guide/servicenow.rst b/source/integrations-guide/servicenow.rst index a7e50c48efb..df0d47aac98 100644 --- a/source/integrations-guide/servicenow.rst +++ b/source/integrations-guide/servicenow.rst @@ -49,7 +49,7 @@ Update the API secret on the change of ServiceNow Webhook Secret ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1. In Mattermost, copy the **Webhook Secret** from your Mattermost instance by going to **System Console > Plugins > ServiceNow**. -2. In your ServiceNow instance, go to **All > x_830655_mm_std_servicenow_for_mattermost_notifications_auth.list**. (**Note**: You must enter the complete name and search.) +2. In your ServiceNow instance, open the auth table's list view by navigating directly to ``https://.service-now.com/x_830655_mm_std_servicenow_for_mattermost_notifications_auth_list.do``, replacing with your ServiceNow instance subdomain. 3. On the page, select the row containing your Mattermost Server URL. If that row doesn't exist, create it manually by selecting **New** located in the top-right corner, and adding your Mattermost Server URL. 4. Update the **API Secret** in the ServiceNow instance with the **Webhook Secret** from Mattermost, and select **Update**. diff --git a/source/product-overview/common-esr-support-rst.rst b/source/product-overview/common-esr-support-rst.rst index dd9efb1dbcb..48f6286cae3 100644 --- a/source/product-overview/common-esr-support-rst.rst +++ b/source/product-overview/common-esr-support-rst.rst @@ -1,3 +1,6 @@ +:orphan: +:nosearch: + .. important:: Support for Mattermost Server v10.11 :ref:`Extended Support Release ` is coming to the end of its life cycle on August 15, 2026. Upgrading to :doc:`Mattermost Server v11.7 or later ` is recommended. diff --git a/source/product-overview/desktop-app-changelog.md b/source/product-overview/desktop-app-changelog.md index 5bdc28f614d..99a31fb33df 100644 --- a/source/product-overview/desktop-app-changelog.md +++ b/source/product-overview/desktop-app-changelog.md @@ -9,9 +9,20 @@ This changelog summarizes updates to Mattermost desktop app releases for [Matter (release-v6-2)= ## Release v6.2 (Extended Support Release) -**Release Day: 2026-05-15** +- **v6.2.2, released 2026-06-23** -**Download Binaries:** [Mattermost Desktop on GitHub](https://github.com/mattermost/desktop/releases/latest) + - Fixed an issue where notifications were dropped when the web app sent empty fields for Direct Messages, Group Messages, or system notifications. + +- **v6.2.1, released 2026-06-17** + + - Mattermost Desktop App v6.2.1 contains medium severity level security fixes. Upgrading is recommended. Details will be posted on our [security updates page](https://mattermost.com/security-updates/) 30 days after release as per the [Mattermost Responsible Disclosure Policy](https://mattermost.com/security-vulnerability-report/). + - Improved robustness of the downloads handler when handling unexpected network responses. + +- **v6.2.0, released 2026-05-15** + + - Original v6.2.0 release + +**Download Binaries:** [Mattermost Desktop on GitHub](https://github.com/mattermost/desktop/releases/v6.2.2) ### Compatibility @@ -264,6 +275,10 @@ Mattermost Desktop App v6.0.0 contains low severity level security fixes. Upgrad (release-v5-13)= ## Release v5.13 (Extended Support Release) +- **v5.13.7, released 2026-06-17** + + - Mattermost Desktop App v5.13.7 contains a medium severity level security fix. Upgrading is recommended. Details will be posted on our [security updates page](https://mattermost.com/security-updates/) 30 days after release as per the [Mattermost Responsible Disclosure Policy](https://mattermost.com/security-vulnerability-report/). + - **v5.13.6, released 2026-05-13** - Mattermost Desktop App v5.13.6 contains medium severity level security fixes. Upgrading is recommended. Details will be posted on our [security updates page](https://mattermost.com/security-updates/) 30 days after release as per the [Mattermost Responsible Disclosure Policy](https://mattermost.com/security-vulnerability-report/). @@ -298,7 +313,7 @@ Mattermost Desktop App v6.0.0 contains low severity level security fixes. Upgrad - Original v5.13.0 release -**Download Binaries:** [Mattermost Desktop on GitHub](https://github.com/mattermost/desktop/releases/v5.13.6) +**Download Binaries:** [Mattermost Desktop on GitHub](https://github.com/mattermost/desktop/releases/v5.13.7) ### Compatibility diff --git a/source/product-overview/mattermost-desktop-releases.md b/source/product-overview/mattermost-desktop-releases.md index f1a8ef38b85..6785bf74da8 100644 --- a/source/product-overview/mattermost-desktop-releases.md +++ b/source/product-overview/mattermost-desktop-releases.md @@ -18,10 +18,10 @@ Mattermost releases a new desktop app version every 4 months, in February, May, | **Release** | **Support** | **Compatible with** | |:---|:---|:---| -| v6.2 [Download](https://github.com/mattermost/desktop/releases/tag/v6.2.0) \| {ref}`Changelog ` \| [SBOM download](https://github.com/mattermost/desktop/releases/download/v6.2.0/sbom-desktop-v6.2.0.json) | Released: 2026-05-15
Support Ends: 2027-05-15 {ref}`EXTENDED ` | {ref}`v11.7 `, {ref}`v11.6 `, {ref}`v11.5 `, {ref}`v10.11 ` | +| v6.2 [Download](https://github.com/mattermost/desktop/releases/tag/v6.2.2) \| {ref}`Changelog ` \| [SBOM download](https://github.com/mattermost/desktop/releases/download/v6.2.2/sbom-desktop-v6.2.2.json) | Released: 2026-05-15
Support Ends: 2027-05-15 {ref}`EXTENDED ` | {ref}`v11.8 `, {ref}`v11.7 `, {ref}`v11.6 `, {ref}`v11.5 `, {ref}`v10.11 ` | | v6.1 [Download](https://github.com/mattermost/desktop/releases/tag/v6.1.2) \| {ref}`Changelog ` \| [SBOM download](https://github.com/mattermost/desktop/releases/download/v6.1.2/sbom-desktop-v6.1.2.json) | Released: 2026-03-02
Support Ends: 2026-05-15 | {ref}`v11.6 `, {ref}`v11.5 `, {ref}`v11.4 `, {ref}`v11.3 `, {ref}`v11.2 `, {ref}`v10.11 ` | | v6.0 [Download](https://github.com/mattermost/desktop/releases/tag/v6.0.4) \| {ref}`Changelog ` \| [SBOM download](https://github.com/mattermost/desktop/releases/download/v6.0.4/sbom-desktop-v6.0.4.json) | Released: 2025-11-14
Support Ends: 2026-03-15 | {ref}`v11.4 `, {ref}`v11.3 `, {ref}`v11.2 `, {ref}`v11.1 `, {ref}`v11.0 `, {ref}`v10.12 `, {ref}`v10.11 ` | -| v5.13 [Download](https://github.com/mattermost/desktop/releases/tag/v5.13.6) \| {ref}`Changelog ` \| [SBOM download](https://github.com/mattermost/desktop/releases/download/v5.13.6/sbom-desktop-v5.13.6.json) | Released: 2025-08-15
Support Ends: 2026-08-15 {ref}`EXTENDED ` | {ref}`v11.0 `, {ref}`v10.12 `, {ref}`v10.11 `, {ref}`v10.10 `, {ref}`v10.9 `, {ref}`v10.5 ` | +| v5.13 [Download](https://github.com/mattermost/desktop/releases/tag/v5.13.7) \| {ref}`Changelog ` \| [SBOM download](https://github.com/mattermost/desktop/releases/download/v5.13.7/sbom-desktop-v5.13.7.json) | Released: 2025-08-15
Support Ends: 2026-08-15 {ref}`EXTENDED ` | {ref}`v11.0 `, {ref}`v10.12 `, {ref}`v10.11 `, {ref}`v10.10 `, {ref}`v10.9 `, {ref}`v10.5 ` | | v5.12 [Download](https://github.com/mattermost/desktop/releases/tag/v5.12.1) \| {ref}`Changelog ` \| [SBOM download](https://github.com/mattermost/desktop/releases/download/v5.12.1/sbom-desktop-v5.12.1.json) | Released: 2025-05-16
Support Ends: 2025-08-15 | {ref}`v10.10 `, {ref}`v10.9 `, {ref}`v10.8 `, {ref}`v10.7 `, {ref}`v10.6 `, {ref}`v10.5 ` | | v5.11 [Download](https://github.com/mattermost/desktop/releases/tag/v5.11.3) \| {ref}`Changelog ` | Released: 2025-02-14
Support Ends: 2025-11-15 | {ref}`v10.7 `, {ref}`v10.6 `, {ref}`v10.5 `, {ref}`v10.4 `, {ref}`v10.3 `, {ref}`v9.11 ` | | v5.10 [Download](https://github.com/mattermost/desktop/releases/tag/v5.10.2) \| {ref}`Changelog ` | Released: 2024-11-15
Support Ends: 2025-02-13 | {ref}`v10.2 `, {ref}`v10.1 `, {ref}`v10.0 `, {ref}`v9.11 `, {ref}`v9.5 ` | diff --git a/source/product-overview/mattermost-mobile-releases.md b/source/product-overview/mattermost-mobile-releases.md index 965a5fa23e3..7e4ba5999f9 100644 --- a/source/product-overview/mattermost-mobile-releases.md +++ b/source/product-overview/mattermost-mobile-releases.md @@ -18,6 +18,7 @@ We strongly recommend using the latest mobile app release available that contain | **Release** | **Support** | **Compatible with** | |:---|:---|:---| +| v2.41 {ref}`FEATURE ` \| [Download](https://github.com/mattermost/mattermost-mobile/releases/tag/v2.41.2) \| {ref}`Changelog ` \| [SBOM download](https://github.com/mattermost/mattermost-mobile/releases/download/v2.41.2/sbom-mattermost-mobile-v2.41.2.json) | Released: 2026-06-16
Support Ends: 2026-07-15 | {ref}`v11.8 `, {ref}`v11.7 `, {ref}`v11.6 `, {ref}`v10.11 ` | | v2.40 {ref}`FEATURE ` \| [Download](https://github.com/mattermost/mattermost-mobile/releases/tag/v2.40.0) \| {ref}`Changelog ` \| [SBOM download](https://github.com/mattermost/mattermost-mobile/releases/download/v2.40.0/sbom-mattermost-mobile-v2.40.0.json) | Released: 2026-05-15
Support Ends: 2026-06-15 | {ref}`v11.7 `, {ref}`v11.6 `, {ref}`v11.5 `, {ref}`v10.11 ` | | v2.39 {ref}`FEATURE ` \| [Download](https://github.com/mattermost/mattermost-mobile/releases/tag/v2.39.0) \| {ref}`Changelog ` \| [SBOM download](https://github.com/mattermost/mattermost-mobile/releases/download/v2.39.0/sbom-mattermost-mobile-v2.39.0.json) | Released: 2026-04-16
Support Ends: 2026-05-15 | {ref}`v11.6 `, {ref}`v11.5 `, {ref}`v11.4 `, {ref}`v10.11 ` | | v2.38 {ref}`FEATURE ` \| [Download](https://github.com/mattermost/mattermost-mobile/releases/tag/v2.38.3) \| {ref}`Changelog ` \| [SBOM download](https://github.com/mattermost/mattermost-mobile/releases/download/v2.38.3/sbom-mattermost-mobile-v2.38.3.json) | Released: 2026-03-16
Support Ends: 2026-04-15 | {ref}`v11.5 `, {ref}`v11.4 `, {ref}`v11.3 `, {ref}`v10.11 ` | @@ -66,9 +67,9 @@ Note that the below versions have not yet been tested. The information below is | **Release** | **Support** | **Compatible with** | |:---|:---|:---| +| v2.47 | Releasing: 2026-12-16
Support Ends: 2027-01-15 | v11.14, v11.13, v11.12, v11.7 | | v2.46 | Releasing: 2026-11-16
Support Ends: 2026-12-15 | v11.13, v11.12, v11.11, v11.7 | | v2.45 | Releasing: 2026-10-16
Support Ends: 2026-11-15 | v11.12, v11.11, v11.10, v11.7 | | v2.44 | Releasing: 2026-09-16
Support Ends: 2026-10-15 | v11.11, v11.10, v11.9, v11.7 | | v2.43 | Releasing: 2026-08-16
Support Ends: 2026-09-15 | v11.10, v11.9, v11.8, v11.7, v10.11 | | v2.42 | Releasing: 2026-07-16
Support Ends: 2026-08-15 | v11.9, v11.8, v11.7, v10.11 | -| v2.41 | Releasing: 2026-06-16
Support Ends: 2026-07-15 | v11.8, v11.7, v11.6, v10.11 | diff --git a/source/product-overview/mattermost-server-releases.md b/source/product-overview/mattermost-server-releases.md index cb7d6424530..05dc74e8829 100644 --- a/source/product-overview/mattermost-server-releases.md +++ b/source/product-overview/mattermost-server-releases.md @@ -19,7 +19,8 @@ Mattermost releases a new server version on the 16th of each month in [binary fo | **Release** | **Released on** | **Support ends** | |:---|:---|:---| -| v11.7 [Download](https://releases.mattermost.com/11.7.3/mattermost-11.7.3-linux-amd64.tar.gz) \| {ref}`Changelog ` \|
SBOM
| 2026-05-15 | 2027-05-15 {ref}`EXTENDED ` | +| v11.8 [Download](https://releases.mattermost.com/11.8.1/mattermost-11.8.1-linux-amd64.tar.gz) \| {ref}`Changelog ` \|
SBOM
| 2026-06-16 | 2026-09-15 | +| v11.7 [Download](https://releases.mattermost.com/11.7.5/mattermost-11.7.5-linux-amd64.tar.gz) \| {ref}`Changelog ` \|
SBOM
| 2026-05-15 | 2027-05-15 {ref}`EXTENDED ` | | v11.6 [Download](https://releases.mattermost.com/11.6.5/mattermost-11.6.5-linux-amd64.tar.gz) \| {ref}`Changelog ` \|
SBOM
| 2026-04-16 | 2026-07-15 | | v11.5 [Download](https://releases.mattermost.com/11.5.7/mattermost-11.5.7-linux-amd64.tar.gz) \| {ref}`Changelog ` \|
SBOM
| 2026-03-16 | 2026-06-15 | | v11.4 [Download](https://releases.mattermost.com/11.4.5/mattermost-11.4.5-linux-amd64.tar.gz) \| {ref}`Changelog ` \|
SBOM
| 2026-02-16 | 2026-05-15 | diff --git a/source/product-overview/mattermost-v11-changelog.md b/source/product-overview/mattermost-v11-changelog.md index f8301dbb2e4..cd9b8139243 100644 --- a/source/product-overview/mattermost-v11-changelog.md +++ b/source/product-overview/mattermost-v11-changelog.md @@ -13,9 +13,182 @@ Platform and OS scope reflects reported and tested environments and may not represent all affected configurations. ``` +(release-v11.8-feature-release)= +## Release v11.8 - [Feature Release](https://docs.mattermost.com/product-overview/release-policy.html#release-types) + +- **11.8.1, released 2026-06-17** + - Mattermost v11.8.1 contains medium severity level security fixes. [Upgrading](https://docs.mattermost.com/upgrade/upgrading-mattermost-server.html) to this release is recommended. Details will be posted on our [security updates page](https://mattermost.com/security-updates/) 30 days after release as per the [Mattermost Responsible Disclosure Policy](https://mattermost.com/security-vulnerability-report/). + - Fixed file moves and copies on S3 file stores failing for files larger than 5GiB (for example, finalizing an mmctl import upload of an import archive over 5GiB), by using a server-side multipart copy. + - Preserved unknown permissions during migrations on downgrade. + - Added a pre-migration setup to fix the incorrect database migration numbers that prevented upgrading Mattermost from v10.11 to v11.7. + - Mattermost v11.8.1 contains the following functional changes: + - Added a new ``FileSettings.ExtractContentTimeout`` setting (default 10 seconds) that limits how long a single uploaded document's content extraction occupies a worker, and moved document content extraction to a dedicated, non-blocking worker pool so it no longer delays file uploads for other users. Added ``FileSettings.ExtractContentTimeout`` configuration setting. +- **11.8.0, released 2026-06-16** + - Original 11.8.0 release. + +```{Attention} +**Breaking Changes** + - The Custom Profile Attributes property group is renamed from ``custom_profile_attributes`` to ``access_control``, and CPA fields and values are migrated from the legacy property model to the v2 model. The functionality of the CPA feature is unchanged. Plugin developers that use CPA will need to register against the new group name. +``` + +### Upgrade Impact + +#### Database Schema Changes + - The following schema changes are included in the v11.8 release. No database downtime is expected for this upgrade. See the [Important Upgrade Notes](https://docs.mattermost.com/upgrade/important-upgrade-notes.html) for more details. + - Added a ``Version`` column (default 1) to the ``PropertyGroups`` table to differentiate PSAv1 legacy groups from PSAv2 groups, with no downtime or table rewrite required. + - Increased the PostgreSQL statistics-sampling target for ``posts.rootid`` and ``posts.channelid`` to 5000 and refreshes planner statistics, improving query plan accuracy for queries that filter or join on those columns with no table rewrite or downtime required. + - Added two new values, ``'BO'`` and ``'BP'``, to the ``channel_type`` enum with no table rewrite or downtime required. + - Added a ``LinkedFieldID`` column and index to ``PropertyFields``, renamed the CPA property group to ``access_control``, and narrowed the ``AttributeView`` materialized view to user-scoped attributes, with no large-table impact or downtime required. + - Added a ``ViewedAt`` column and ``idx_recaps_user_id_viewed_at`` index to ``Recaps`` via metadata-only ``ADD COLUMN`` and ``CREATE INDEX CONCURRENTLY``, with no table locks or downtime required. + - Added a ``Discoverable`` column to ``Channels``, a new ``ChannelJoinRequests`` table, and four concurrent partial/composite indexes to support channel join request workflows, with no downtime required. + - Extended the ``permission_level`` enum to add an ``admin`` value via a non-blocking catalog-only change, with no table locks, no data migration, and no downtime required. + +#### config.json +New setting options were added to ``config.json``. Below is a list of the additions and their default values on install. The settings can be modified in ``config.json``, or the System Console when available. + - **Changes to Enterprise Advanced plan:** + - Under ``MobileEphemeralMode`` in ``config.json``, added a [Mobile Ephemeral Mode](https://docs.mattermost.com/security-guide/mobile-security.html#app-sandboxing-and-secure-data-storage) configuration section under **System Console > Environment > Mobile Security**, allowing admins to configure data persistence and cache management policies for mobile devices. Requires Enterprise Advanced license and ``MobileEphemeralMode`` feature flag. + - **Changes to Enterprise plans:** + - Under ``ElasticsearchSettings`` in ``config.json``, added ``EnableSearchPublicChannelsWithoutMembership`` configuration setting to allow searching in public channels the user isn't a member of. + - Under ``TeamSettings`` in ``config.json``, added ``EnableChannelCategorySorting`` configuration setting to add, edit, and remove managed categories. + +### Improvements + +See [this blog post](https://mattermost.com/blog/mattermost-v11-8-0-is-now-available/) on the highlights in our latest release. + +#### User Interface + - Pre-packaged MS Calendar plugin version [v1.6.1](https://github.com/mattermost/mattermost-plugin-mscalendar/releases/tag/v1.6.1). + - Pre-packaged GitLab plugin version [v1.12.2](https://github.com/mattermost/mattermost-plugin-gitlab/releases/tag/v1.12.2). + - Pre-packaged GitHub plugin version [v2.7.1](https://github.com/mattermost/mattermost-plugin-github/releases/tag/v2.7.1). + - Pre-packaged Playbooks plugin version [v2.9.1](https://github.com/mattermost/mattermost-plugin-playbooks/releases/tag/v2.9.1). + - Pre-packaged Agents plugin version [v2.0.4](https://github.com/mattermost/mattermost-plugin-agents/releases/tag/v2.0.4). + - Pre-packaged Jira plugin version [v4.7.0](https://github.com/mattermost/mattermost-plugin-jira/releases/tag/v4.7.0). + - Pre-packaged Calls plugin version [v1.11.5](https://github.com/mattermost/mattermost-plugin-calls/releases/tag/v1.11.5). + - Pre-packaged Boards plugin version [v9.2.4](https://github.com/mattermost/mattermost-plugin-boards/releases/tag/v9.2.4). + - Added a new keyboard shortcut, ``Shift`` + ``ESC``, that marks all channels, threads, and direct messages as read for a team on webapp / desktop app. + - Added an overflow menu for channel bookmarks when the bookmark bar runs out of space. Bookmarks can be reordered via drag-and-drop between the bar and the overflow menu, or via keyboard (Space to select, arrow keys to move) on webapp. Replaced ``react-beautiful-dnd`` with ``@atlaskit/pragmatic-drag-and-drop``. + - Added an unread badge to Recaps. + - Added managed [channel categories](https://docs.mattermost.com/end-user-guide/preferences/customize-your-channel-sidebar.html) for **Channel Admins** to enforce sidebar organization across teams. + - Added per-channel classification assignment and banner integration for webapp/desktop app. + - Added [support](https://docs.mattermost.com/administration-guide/manage/admin/user-attributes.html) for **CPA Display Name** for user-facing labels of user attributes. + - Changed the **Invite People** modal to allow pasting any text, not only valid email formats. + - Standardized many buttons throughout the app, which may result in minor UX changes. + - Updated the **Enable Testing Commands** user interface to explicitly warn that ``EnableTesting`` must never be used in production. + - Changed the mobile view search box to only autofocus when the search button is pressed (reported on mobile browser). + - Improved the **Default "Report a Problem"** [behavior](https://docs.mattermost.com/administration-guide/configure/site-configuration-settings.html) to open a support ticket via email with metadata for licensed servers, and redirect to the Mattermost forums for free edition in webapp / desktop apps. + - Added support for system-scoped properties — property fields and values that attach to the Mattermost instance itself. + - Added the ability to define a property attribute once and reuse it across different object types (e.g., users, channels). + - Exposed the [``DefaultCategoryName``](https://docs.mattermost.com/administration-guide/configure/site-configuration-settings.html) to the user interface so admins can add, edit, and remove it easily. + - Moved interactive dialog date/datetime properties into ``datetime_config``. + - When a channel is shared or unshared with a remote, a system message will now be shown. + - On new installations using Elasticsearch or OpenSearch, search now includes public channels the user is not a member of by default. + - Added support for incoming webhooks to define a ``root_id`` to create posts in a thread. + - Updated membership policy user interface copy in the System Console and public channel settings to clarify qualifying-user requirements and auto-add behavior. + - Hid redundant "Download Apps" links and onboarding download reminders when Mattermost runs inside the Desktop app. + +#### Plugins/Integrations + - Added [plugin metrics collection](https://docs.mattermost.com/administration-guide/scale/performance-monitoring-metrics.html), namespacing, and serving on the standard ``/metrics`` endpoint. + - Added support for plugins using the Shared Channels APIs to register multiple remote connections by calling ``RegisterPluginForSharedChannels`` with different ``SiteURL`` values, enabling use cases such as multiple outbound transports or bridging to multiple external servers. A new ``UnregisterPluginRemoteForSharedChannels`` method allows removing a single remote without affecting others. Existing single-remote plugins continue to work without changes. + - Added ``client.Audit`` on ``pluginapi.Client`` for plugins to emit audit records via the server audit pipeline (server 10.10+) on Linux, macOS and Windows. + - Introduced a new ``Edit Attachments`` [permission](https://docs.mattermost.com/administration-guide/onboard/advanced-permissions.html#restrict-who-can-edit-post-attachments) for controlling who can edit post attachments when editing a post. By default, the permission is granted to users who have the edit post permission. + - Added new CEL functions ``inCIDR`` and ``versionGT``/``versionGTE``/``versionLT``/``versionLTE``/``versionEQ`` for use in access control policies. + - Included the connection ID in the plugin context. + +#### Administration + - Added support for [classification markings](https://docs.mattermost.com/end-user-guide/collaborate/display-channel-banners.html#classification-markings) for system-wide and channel banners. Enterprise Advanced license is required. + - Removed remaining support for Internet Explorer and pre-Chromium versions of Edge on webapp. + - Added ``server.process_id`` to support packet diagnostics to help correlate support data with OS-level logs and process monitoring tools such as ``ps``, ``top``, and systemd journal. + - Added ``go_version`` to support packet diagnostics, showing the Go runtime version the server binary was compiled with on Linux. + - Added ``open_file_descriptors`` and ``max_file_descriptors`` fields to the ``server`` section of the support packet ``diagnostics.yaml`` to help diagnose file descriptor exhaustion on Linux and macOS. + - Added ``container_cpu_limit`` and ``container_memory_limit_mb`` fields to support packet diagnostics to report cgroup v2 CPU and memory limits on Linux. Fields are omitted for non-containerized or non-Linux deployments. + - Added SMTP and push proxy connectivity probe results to ``diagnostics.yaml`` in the support packet under ``notifications.email`` and ``notifications.push`` for mobile app. + - Added ``started_at`` and ``host_started_at`` fields to the support packet diagnostics to help diagnose server restart loops and container reboots. + - Added [a simplified option](https://docs.mattermost.com/deployment-guide/mobile/mobile-troubleshooting.html) allowing users to enable attaching logs to support packets on mobile apps. + - Added [Membership Policies](https://docs.mattermost.com/administration-guide/manage/admin/abac-channel-access-rules.html) (formerly Access Control Policies) support for public channels with advisory semantics: matching users are auto-added when enabled and surfaced in a new "Recommended" filter in Browse Channels and as a "Recommended" tag in the channel invite modal; non-matching members are never removed. Private channels retain the existing strict gate. The admin UI has been renamed throughout from "Access Control" to "Membership Policy". Requires Enterprise Advanced license. + - Added a [new feature](https://docs.mattermost.com/administration-guide/manage/admin/content-flagging.html) allowing content reviewers to generate a downloadable report for a post quarantined for review as part of Data Spillage handling. + - Tightened session invalidation on the global session revocation path. + - Downgraded Hungarian translations from Beta to Alpha. + - Clarified error messages on potential permission migrations. + - Added support for permission-action rules (file upload, file download) on channel-scope access control policies, with a new "Simulate access" modal in System Console and Channel Settings that previews per-user, per-action decisions before saving. Gated by the existing ``PermissionPolicies`` feature flag and the Enterprise Advanced license. + - Added support for request-provided session attributes (IP address, user agent details) in ABAC permission policy expressions via ``user.session``. + - Added a user setting to experimentally enable concurrent React. + - Added debug logging when a user has experimental support for concurrent React enabled. + +#### Performance + - Benchmarking test results showed no significant difference: a +5.30% increase in the number of supported users for the new release, which lies within the ``[-5%, +5%]`` prediction interval. View the full raw data and methodology in our [Performance Reports repository](https://github.com/mattermost/performance-reports/tree/main/performance-comparisons/v11.8). + - Improved memory usage and performance when processing images (resizing, thumbnails, and orientation correction). + - Improved authorization checks for post info lookups. + - Increased the PostgreSQL column statistics target on ``Posts.rootid`` and ``Posts.channelid`` to 5000, preventing query planner to choose the wrong index, which could cause full-table scans during bulk imports and other thread-heavy operations on large Posts tables. + +### Bug Fixes + - Fixed an issue where read recaps no longer showed the "Mark all channels as read" menu action. + - Fixed an issue where the user profile popover closed automatically when opened for the first time from the channel member list in the RHS. + - Fixed an issue where the sidebar channel icon did not update when a channel's privacy was changed via ``mmctl`` or the API. The ``channel_converted`` WebSocket event now includes the channel type. + - Fixed a webapp issue where clicking composer formatting controls could jump a long scrolled draft back to the top (reported on webapp and desktop app / Chrome). + - Fixed an issue where ``LoadPluginConfiguration`` did not apply default values for plugin settings declared inside sections in the plugin manifest. + - Fixed an issue where clicking a custom user group mention would sometimes fail to load the group members list in the popover. + - Fixed an issue where the reminder confirmation did not appear when setting a reminder on a reply from the thread view. + - Fixed a panic in the ``mmctl`` websocket command when the WebSocket connection failed on startup. + - Fixed [an issue](https://docs.mattermost.com/administration-guide/manage/statistics.html) with the System Console Reporting sidebar label for the system analytics page so it now consistently reads "System Statistics". + - Fixed an issue with the invite modal text input clipping and modal width overflow when typing long text in the "To" field. + - Fixed an issue where the post autocomplete menu could be clipped when the right-hand sidebar was open. + - Fixed an issue with the themed text colors in the Invite Guest modal channel picker so the "Add to channels" section, the typed input text, and the channel suggestion rows follow the active theme. + - Fixed an issue in the Find Channels modal where long channel names could overlap and obscure the team name on the same row. + - Fixed issues with channel bookmarks drag-and-drop edge cases: reordering is now disabled when a bar has only one bookmark, and the trailing add-bookmark button no longer auto-opens the menu when dragging over it without any items in overflow. + - Fixed an issue where the search results "Messages" tab counter was inflated by one for each date group, causing a single matching post to be shown as "2". + - Fixed an issue where consecutive bot replies in the RHS thread view displayed with the message header incorrectly floating inline with the message body when using compact display mode. + - Fixed an issue where the Reviewer field pill on the Data Spillage review card rendered with a white background in dark themes. + - Fixed an issue with the group channels in the Direct Messages modal sometimes displaying incorrectly. + - Fixed a spurious "prop must be a valid URL" warning that was logged when handling slash command responses that had no icon URL configured. + - Fixed a bot import panic when user exists without bot record. + - Fixed an issue where file attachments synced over a shared channel through a plugin (using the ``OnSharedChannelsAttachmentSyncMsg`` / ``ReceiveSharedChannelAttachmentSyncMsg`` plugin API pair) were stored on the receiving server but did not appear in the corresponding post, because the saved FileInfo was given a new ID instead of preserving the sender's file ID referenced by the post. + - Fixed a regression saving various [masked fields](https://docs.mattermost.com/administration-guide/manage/admin/generating-support-packet.html) from the System Console. + - Prevented non-interactive team icons from showing click highlight feedback. + - Fixed an issue with a missing spacing in data spillage report card user interface when opened in the **Threads** view. + - Fixed an issue with misleading cursor and dropdown indicator affordances in data spillage report previews. + - Fixed an issue with the data spillage report right-hand side action buttons overflowing the panel instead of wrapping. + - Fixed an issue with clipped tooltips in the advanced data masking policy expression editor. + - Fixed an issue where retained flagged posts did not re-appear in the channel for other members until they refreshed the browser or clicked the hidden-post banner. + - Fixed an issue where the **Save** button could disappear in **Channel Settings** after switching **Classification Markings** off and back on. + - Guest magic-link ``REST`` login now applies the same authentication criteria checks as the web one-time-link handler and password login. + - Hardened the OAuth server provider's handling of deactivated users. + - Fixed an issue that caused a flagged post to continue being visible for content reviewers until a refresh after deletion. + - Fixed an issue where public channel mention links were shown as an unresolved channel slug instead of the channel name (and were not clickable) for users who were not members of the referenced channel when **Compliance Monitoring** was enabled. + - Fixed an issue where a channel could appear in two sidebar categories when a default category was assigned. + +### API Changes + - Added a new ``GET /api/v4/content_flagging/post//report`` endpoint for generating and downloading a content flagging report for a flagged post. + - Added ``GET /api/v4/teams/{team_id}/channels/recommended`` endpoint and an ``abac_match_only`` query parameter on ``GET /api/v4/users`` to support Membership Policy advisory semantics for public channels. + - Updated ``POST /api/v4/users/{user_id}/demote`` to return ``400`` when ``user_id`` is a bot account; bot accounts cannot be converted to guests. + - Added a new endpoint to fetch users by their auth_data GET ``/api/v4/users/auth_data?value={auth_data}``. Only available to sysadmins. + - Added ``POST /cel/simulate_users`` (``simulatePolicyForUsers``) API endpoint. + +### WebSocket Event Changes + - The ``channel_converted`` WebSocket event now includes the channel type, enabling clients to update the sidebar channel icon when a channel's privacy changes. + +### Audit Log Event Changes + - Added a new audit log ``AuditEventGenerateFlaggedPostReport`` for generating and downloading content flagging report for a flagged post. + - Added a new audit log ``AuditEventMarkRecapsAsViewed`` for adding an unread badge to Recaps. + - Added new audit logs ``AuditEventMarkMessagesRead and AuditEventMarkTeamRead`` for adding a new shortcut to mark all channels as read. + - Added a new audit log ``AuditEventCreateBoard`` for integrated boards. + - ``AuditEventCreateChannelJoinRequest``, ``AuditEventUpdateChannelJoinRequest`` and ``AuditEventWithdrawChannelJoinRequest`` for discoverable private channels. + +### Go Version + - v11.8 is built with Go ``v1.26.3``. + +### Open Source Components + - Added ``x/text``, ``@atlaskit/pragmatic-drag-and-drop``, ``@atlaskit/pragmatic-drag-and-drop-hitbox``, ``@atlaskit/pragmatic-drag-and-drop-react-drop-indicator``, ``prometheus/common``, ``Azure/azure-sdk-for-go``, ``boxes-ltd/imaging`` and ``google/uuid``, and removed ``anthonynsimon/bild`` from https://github.com/mattermost/mattermost/. + (release-v11.7-extended-support-release)= ## Release v11.7 - [Extended Support Release](https://docs.mattermost.com/product-overview/release-policy.html#release-types) +- **11.7.5, released 2026-06-18** + - Fixed custom emoji upload size and GIF frame limits. + - Mattermost v11.7.5 contains no database or functional changes. +- **11.7.4, released 2026-06-17** + - Mattermost v11.7.4 contains medium severity level security fixes. [Upgrading](https://docs.mattermost.com/upgrade/upgrading-mattermost-server.html) to this release is recommended. Details will be posted on our [security updates page](https://mattermost.com/security-updates/) 30 days after release as per the [Mattermost Responsible Disclosure Policy](https://mattermost.com/security-vulnerability-report/). + - Fixed file moves and copies on S3 file stores failing for files larger than 5GiB (for example, finalizing an mmctl import upload of an import archive over 5GiB), by using a server-side multipart copy. + - Mattermost v11.7.4 contains the following functional changes: + - Added a new ``FileSettings.ExtractContentTimeout`` setting (default 10 seconds) that limits how long a single uploaded document's content extraction occupies a worker, and moved document content extraction to a dedicated, non-blocking worker pool so it no longer delays file uploads for other users. Added ``FileSettings.ExtractContentTimeout`` configuration setting. - **11.7.3, released 2026-06-12** - Mattermost v11.7.3 contains low to medium severity level security fixes. [Upgrading](https://docs.mattermost.com/upgrade/upgrading-mattermost-server.html) to this release is recommended. Details will be posted on our [security updates page](https://mattermost.com/security-updates/) 30 days after release as per the [Mattermost Responsible Disclosure Policy](https://mattermost.com/security-vulnerability-report/). - Pre-packaged Playbooks plugin version [v2.9.1](https://github.com/mattermost/mattermost-plugin-playbooks/releases/tag/v2.9.1). diff --git a/source/product-overview/mobile-app-changelog.md b/source/product-overview/mobile-app-changelog.md index 3a52907cc3d..a3e778dcdb2 100644 --- a/source/product-overview/mobile-app-changelog.md +++ b/source/product-overview/mobile-app-changelog.md @@ -10,6 +10,68 @@ This changelog summarizes updates to Mattermost mobile apps releases for [Matter Platform and OS scope reflects reported and tested environments and may not represent all affected configurations. ``` +(release-v2-41-2)= +## 2.41.2 Release + - Release Date: June 23, 2026 + - Server Versions Supported: Server v10.11.0+ is required. Self-Signed SSL certificates are not supported unless the user installs the CA certificate on their device. + +### Compatibility + - **Upgrade to server version v10.11.0 or later is required.** Support for server [Extended Support Release](https://docs.mattermost.com/product-overview/release-policy.html#extended-support-releases) (ESR) v10.5.0 has ended and upgrading to server ESR v10.11.0 or later is required. As we innovate and offer newer versions of our mobile apps, we maintain backwards compatibility only with supported server versions. Users who upgrade to the newest mobile apps while being connected to an unsupported server version can be exposed to compatibility issues, which can cause crashes or severe bugs that break core functionality of the app. + - Android operating system 7+ [is required by Google](https://android-developers.googleblog.com/2017/12/improving-app-security-and-performance.html). + - iPhone 8+ devices and later with iOS 16.0+ are [required](https://support.apple.com/en-il/guide/iphone/iphe3fa5df43/16.0/ios/16.0). + +### Bug Fixes + - Fixed a crash while showing the emoji reaction list. + - Fixed a crash on Android when the application started and also fixed other less common crashes. + +### Known Issues + - Users are unable to adjust the font size via the OS font size setting. + - Some Google Pixel phones on Android 12+ might not continue past the login screen. This is a known issue with the OS, and the current workaround is to restart the device. + +(release-v2-41-1)= +## 2.41.1 Release + - Release Date: June 18, 2026 + - Server Versions Supported: Server v10.11.0+ is required. Self-Signed SSL certificates are not supported unless the user installs the CA certificate on their device. + +### Compatibility + - **Upgrade to server version v10.11.0 or later is required.** Support for server [Extended Support Release](https://docs.mattermost.com/product-overview/release-policy.html#extended-support-releases) (ESR) v10.5.0 has ended and upgrading to server ESR v10.11.0 or later is required. As we innovate and offer newer versions of our mobile apps, we maintain backwards compatibility only with supported server versions. Users who upgrade to the newest mobile apps while being connected to an unsupported server version can be exposed to compatibility issues, which can cause crashes or severe bugs that break core functionality of the app. + - Android operating system 7+ [is required by Google](https://android-developers.googleblog.com/2017/12/improving-app-security-and-performance.html). + - iPhone 8+ devices and later with iOS 16.0+ are [required](https://support.apple.com/en-il/guide/iphone/iphe3fa5df43/16.0/ios/16.0). + +### Bug Fixes + - Fixed an issue where a deleted message could cause a channel to show as blank. + +### Known Issues + - Users are unable to adjust the font size via the OS font size setting. + - Some Google Pixel phones on Android 12+ might not continue past the login screen. This is a known issue with the OS, and the current workaround is to restart the device. + +(release-v2-41-0)= +## 2.41.0 Release + - Release Date: June 16, 2026 + - Server Versions Supported: Server v10.11.0+ is required. Self-Signed SSL certificates are not supported unless the user installs the CA certificate on their device. + +### Compatibility + - **Upgrade to server version v10.11.0 or later is required.** Support for server [Extended Support Release](https://docs.mattermost.com/product-overview/release-policy.html#extended-support-releases) (ESR) v10.5.0 has ended and upgrading to server ESR v10.11.0 or later is required. As we innovate and offer newer versions of our mobile apps, we maintain backwards compatibility only with supported server versions. Users who upgrade to the newest mobile apps while being connected to an unsupported server version can be exposed to compatibility issues, which can cause crashes or severe bugs that break core functionality of the app. + - Android operating system 7+ [is required by Google](https://android-developers.googleblog.com/2017/12/improving-app-security-and-performance.html). + - iPhone 8+ devices and later with iOS 16.0+ are [required](https://support.apple.com/en-il/guide/iphone/iphe3fa5df43/16.0/ios/16.0). + +### Improvements + - Added support for system messages for shared and unshared channels. + - Added mobile support for admin-managed sidebar channel categories. + - Updated the **About Mattermost** screen to show the correct edition or license name (including Enterprise Advanced and Entry). + +### Bug Fixes + - Fixed an issue on mobile where AI agents/bots flooded the at-mention and ``/invite`` autocomplete results regardless of the typed username. + - Fixed several iOS-specific issues in the Mobile Agents View: the input-box buttons no longer get cut off by the home indicator, typed text is no longer hidden by the keyboard, the back arrow now matches the standard iOS chevron used on other subpages, and the keyboard can now be dismissed with the standard swipe-down gesture. + - Fixed an issue with realtime UI updates when changing the settings for attaching logs for debugging functionality. + - Fixed an Android crash in push notification handling when the server returned an unexpected error response format. + - Fixed an issue where system admins could briefly see a join-team affordance when there were no additional teams to join, due to local team membership lagging behind server state. + - Fixed an issue with ``@mentions`` rendering incorrect font sizes when written as part of a heading in the **Threads** screen. + +### Known Issues + - Users are unable to adjust the font size via the OS font size setting. + - Some Google Pixel phones on Android 12+ might not continue past the login screen. This is a known issue with the OS, and the current workaround is to restart the device. + (release-v2-40-0)= ## 2.40.0 Release - Release Date: May 15, 2026 diff --git a/source/product-overview/release-policy.md b/source/product-overview/release-policy.md index 7efc649321b..58a54b18ac7 100644 --- a/source/product-overview/release-policy.md +++ b/source/product-overview/release-policy.md @@ -56,10 +56,11 @@ gantt v11.2 :done, 2025-12-16, 2026-03-15 v11.3 :done, 2026-01-16, 2026-04-15 v11.4 :done, 2026-02-16, 2026-05-15 - v11.5 :active, 2026-03-16, 2026-06-15 + v11.5 :done, 2026-03-16, 2026-06-15 v11.6 :active, 2026-04-16, 2026-07-15 v11.7 & Desktop App v6.2 Extended Support :crit, 2026-05-15, 2027-05-15 v11.8 :active, 2026-06-16, 2026-09-15 + v11.9 :active, 2026-07-16, 2026-10-15 ``` **Timeline Legend:** diff --git a/source/product-overview/self-hosted-subscriptions.rst b/source/product-overview/self-hosted-subscriptions.rst index 191e43749cb..b4df675d39f 100644 --- a/source/product-overview/self-hosted-subscriptions.rst +++ b/source/product-overview/self-hosted-subscriptions.rst @@ -47,7 +47,7 @@ We'll send you an email notice around the end of the quarter reminding you to se If you have more total activated users than you purchased in your annual subscription, your Customer Success Manager will provide you with a true-up quote for the new users added. The additional invoice will be pro-rated based on the number of months left in your subscription term, including the months for the calendar quarter for the time you pull the report. Mattermost won't provide downward adjustments. Mattermost will invoice based on Mattermost’s `current list prices `_. -A system admin must take a screenshot of the **System Console > Reporting > Site Statistics** page and send it to Mattermost in an email. +A system admin must take a screenshot of the **System Console > Reporting > System Statistics** page and send it to Mattermost in an email. - Please ensure your screenshot is taken from the top of the page and includes **Total Activated Users**, **Single-channel Guests**, and **Monthly Active Users**. - Please include the date of the screenshot in the file name. @@ -118,7 +118,7 @@ What happens to my subscription if I don't renew in time? If you don't renew within the 60-day renewal period, a 10-day grace period is provided. During this period your Mattermost installation runs as normal, with full access to commercial features. During the grace period, the notification banner is not dismissable. -When the grace period expires, your Mattermost Enterprise or Professional plan is downgraded to the Free plan and other plan features are disabled. +When the grace period expires, your Mattermost Professional, Enterprise, or Enterprise Advanced plan is downgraded to the Free plan and other plan features are disabled. What happens when my subscription expires? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/source/product-overview/subscription.rst b/source/product-overview/subscription.rst index 6b16c5b0538..22d0e210a56 100644 --- a/source/product-overview/subscription.rst +++ b/source/product-overview/subscription.rst @@ -97,7 +97,7 @@ Guests are billed based on channel access: Bots, deactivated users, and synthetic users in :doc:`Microsoft Teams integrations ` and :doc:`connected workspace ` users aren't counted towards the total number of activated users. -You can review your activated user count in **System Console > Site Statistics** under **Total Activated Users**. Review single-channel guest usage separately under **Single-channel Guests**. +You can review your activated user count in **System Console > System Statistics** under **Total Activated Users**. Review single-channel guest usage separately under **Single-channel Guests**. Do I need to pay for deactivated users? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/source/product-overview/ui-ada-changelog.rst b/source/product-overview/ui-ada-changelog.rst index 17b903bfd59..5905cc0a596 100644 --- a/source/product-overview/ui-ada-changelog.rst +++ b/source/product-overview/ui-ada-changelog.rst @@ -12,6 +12,46 @@ Changelog * - Version - Change Description + * - v11.8 + - (UI) Added a new keyboard shortcut, ``Shift`` + ``ESC``, that marks all channels, threads, and direct messages as read for a team on webapp / desktop app. + * - v11.8 + - (UI) Added an overflow menu for channel bookmarks when the bookmark bar runs out of space. Bookmarks can be reordered via drag-and-drop between the bar and the overflow menu, or via keyboard (Space to select, arrow keys to move) on webapp. Replaced ``react-beautiful-dnd`` with ``@atlaskit/pragmatic-drag-and-drop``. + * - v11.8 + - (UI) Added an unread badge to Recaps. + * - v11.8 + - (UI) Added `managed channel categories `__ for **Channel Admins** to enforce sidebar organization across teams. + * - v11.8 + - (UI) Added per-channel classification assignment and banner integration for webapp/desktop app. + * - v11.8 + - (UI) Added `support `__ for **CPA Display Name** for user-facing labels of user attributes. + * - v11.8 + - (UI) Changed the **Invite People** modal to allow pasting any text, not only valid email formats. + * - v11.8 + - (UI) Standardized many buttons throughout the app, which may result in minor UX changes. + * - v11.8 + - (UI) Updated the **Enable Testing Commands** user interface to explicitly warn that ``EnableTesting`` must never be used in production. + * - v11.8 + - (UI) Changed the mobile view search box to only autofocus when the search button is pressed (reported on mobile browser). + * - v11.8 + - (UI) Improved the **Default "Report a Problem"** `behavior `__ to open a support ticket via email with metadata for licensed servers, and redirect to the Mattermost forums for free edition in webapp / desktop apps. + * - v11.8 + - (UI) Added support for system-scoped properties — property fields and values that attach to the Mattermost instance itself. + * - v11.8 + - (UI) Added the ability to define a property attribute once and reuse it across different object types (e.g., users, channels). + * - v11.8 + - (UI) Exposed the ``DefaultCategoryName`` to the `user interface `__ so admins can add, edit, and remove it easily. + * - v11.8 + - (UI) Moved interactive dialog date/datetime properties into ``datetime_config``. + * - v11.8 + - (UI) When a channel is shared or unshared with a remote, a system message will now be shown. + * - v11.8 + - (UI) On new installations using Elasticsearch or OpenSearch, search now includes public channels the user is not a member of by default. + * - v11.8 + - (UI) Added support for incoming webhooks to define a ``root_id`` to create posts in a thread. + * - v11.8 + - (UI) Updated membership policy user interface copy in the System Console and public channel settings to clarify qualifying-user requirements and auto-add behavior. + * - v11.8 + - (UI) Hid redundant "Download Apps" links and onboarding download reminders when Mattermost runs inside the Desktop app. * - v11.7 - (UI) Message attachment footers now support full Markdown rendering, including bold, italic, links, and emoji. * - v11.7 diff --git a/source/product-overview/version-archive.rst b/source/product-overview/version-archive.rst index 9f72fd0173e..c61ff7799f3 100644 --- a/source/product-overview/version-archive.rst +++ b/source/product-overview/version-archive.rst @@ -11,11 +11,16 @@ If you want to check that the version of Mattermost you are installing is the of .. tab:: Mattermost Enterprise - Mattermost Enterprise Edition v11.7.3 *Extended Support Release (ESR)* - `View Changelog `__ - `Download `__ - - ``https://releases.mattermost.com/11.7.3/mattermost-11.7.3-linux-amd64.tar.gz`` - - SHA-256 Checksum: ``b3e460c8e79d00eeb6c667a2e830bd9f3c123530c7a73e2caf4dd7c86ce2cc0a`` - - GPG Signature: https://releases.mattermost.com/11.7.3/mattermost-11.7.3-linux-amd64.tar.gz.sig - - SBOM Download Link: https://releases.mattermost.com/11.7.3/sbom-enterprise-v11.7.3.json + Mattermost Enterprise Edition v11.8.1 - `View Changelog `__ - `Download `__ + - ``https://releases.mattermost.com/11.8.1/mattermost-11.8.1-linux-amd64.tar.gz`` + - SHA-256 Checksum: ``9b5a02ff905906e4c809fa5cebf17f0c5cdd821e132fbe4571cdae30dd7abba6`` + - GPG Signature: https://releases.mattermost.com/11.8.1/mattermost-11.8.1-linux-amd64.tar.gz.sig + - SBOM Download Link: https://releases.mattermost.com/11.8.1/sbom-enterprise-v11.8.1.json + Mattermost Enterprise Edition v11.7.5 *Extended Support Release (ESR)* - `View Changelog `__ - `Download `__ + - ``https://releases.mattermost.com/11.7.5/mattermost-11.7.5-linux-amd64.tar.gz`` + - SHA-256 Checksum: ``7a2490baad197f43f2a1fe5f9ef3b7355c0754f450a158ab63409f30205cfceb`` + - GPG Signature: https://releases.mattermost.com/11.7.5/mattermost-11.7.5-linux-amd64.tar.gz.sig + - SBOM Download Link: https://releases.mattermost.com/11.7.5/sbom-enterprise-v11.7.5.json Mattermost Enterprise Edition v11.6.5 - `View Changelog `__ - `Download `__ - ``https://releases.mattermost.com/11.6.5/mattermost-11.6.5-linux-amd64.tar.gz`` - SHA-256 Checksum: ``3306af16e8cf922ca914d855e19117b66762347c4ab25c1bd1790cfd3b1354bf`` @@ -484,11 +489,16 @@ If you want to check that the version of Mattermost you are installing is the of We generally recommend installing Enterprise Edition, even if you don't currently need a license. This provides the flexibility to seamlessly unlock Enterprise features should you need them. However, if you only want to install software with a fully open source code base, then Team Edition is the best choice for you. - Mattermost Team Edition v11.7.3 *Extended Support Release (ESR)* - `View Changelog `__ - `Download `__ - - ``https://releases.mattermost.com/11.7.3/mattermost-team-11.7.3-linux-amd64.tar.gz`` - - SHA-256 Checksum: ``fadb2ac6db5ae974f9a2bccd9cc9b781bd583d7258b3a11ae8bbe5ab6159f5e6`` - - GPG Signature: https://releases.mattermost.com/11.7.3/mattermost-team-11.7.3-linux-amd64.tar.gz.sig - - SBOM Download Link: https://github.com/mattermost/mattermost/releases/download/v11.7.3/sbom-mattermost-v11.7.3.json + Mattermost Team Edition v11.8.1 - `View Changelog `__ - `Download `__ + - ``https://releases.mattermost.com/11.8.1/mattermost-team-11.8.1-linux-amd64.tar.gz`` + - SHA-256 Checksum: ``78ab63f1657ff73df375a668ed62e4e9ad4f8ae2d6f1ce6726c69b23ae99bd39`` + - GPG Signature: https://releases.mattermost.com/11.8.1/mattermost-team-11.8.1-linux-amd64.tar.gz.sig + - SBOM Download Link: https://github.com/mattermost/mattermost/releases/download/v11.8.1/sbom-mattermost-v11.8.1.json + Mattermost Team Edition v11.7.5 *Extended Support Release (ESR)* - `View Changelog `__ - `Download `__ + - ``https://releases.mattermost.com/11.7.5/mattermost-team-11.7.5-linux-amd64.tar.gz`` + - SHA-256 Checksum: ``dae515358366a2ac610ae1c424bd40752a0898b971d1517a499898965aaf527d`` + - GPG Signature: https://releases.mattermost.com/11.7.5/mattermost-team-11.7.5-linux-amd64.tar.gz.sig + - SBOM Download Link: https://github.com/mattermost/mattermost/releases/download/v11.7.5/sbom-mattermost-v11.7.5.json Mattermost Team Edition v11.6.5 - `View Changelog `__ - `Download `__ - ``https://releases.mattermost.com/11.6.5/mattermost-team-11.6.5-linux-amd64.tar.gz`` - SHA-256 Checksum: ``20456d40de0ce22b799e7c8d6e9b8f4258fe3cfc0d089838b30cd38f81d129af``