Upgrade Instructions and breaking changes 

ViewHelpers in values that powermail parses with Fluid 

Powermail replaces variables like {firstname} in a couple of configured values by parsing them with Fluid: the mail subject, the receiver name and email, the sender name and email, the reply-to addresses, field titles and the options of select, radio and checkbox fields.

Two things changed there for security reasons:

1. Only allowlisted ViewHelpers are executed in these values. The allowlist is the extension configuration allowedViewHelpersInParsedStrings and contains f:cObject by default, because using it in the receiver name, the receiver mail and the subject is a documented feature. Every other ViewHelper is removed from the output and the removal is written to the TYPO3 log. If your installation uses further ViewHelpers in one of these values, add them to the setting - for example f:cObject,f:if,f:translate or, less restrictive, f:cObject,f:format.*. Variables like {firstname} keep working in any case and need no configuration.
2. Values that a website visitor submitted are no longer parsed at all. The sender name and address of a mail to the receiver, and the receiver name and address of a mail to the sender, come from the submitted form. Fluid in such a value is no longer evaluated, it stays as it was submitted. As a side effect the value that is stored in tx_powermail_domain_model_mail is now the submitted one, and no longer the result of a Fluid rendering.

There is one case that stops working without a replacement: a ViewHelper call inside a TypoScript overwrite.* value of a key that holds submitted data, e.g. plugin.tx_powermail.settings.setup.receiver.overwrite.senderName with a {f:cObject(...)} in it. Use the ViewHelper in a key that is not fed from the submitted data, or resolve the value in TypoScript instead.

Templates and RTE fields are not affected. Arbitrary ViewHelpers and own namespaces keep working there, see Documentation/ForAdministrators/BestPractice/Templates.md.

Breaking Changes 

Breaking Change 

We removed the export and rss functionality completely without any replacement, because there is no reliable security concept behind it and is not easy to fix.

If you need this, please contact in2code for paid assistance or implement it yourself.

Upgrade - Wizards 

Unfortunately the bugfix for https://github.com/in2code-pro/powermail/issues/56 introduced a breaking change. There are now five submodules, instead of a single big one.

That means, permissions for backend usergroups must be changed in order to use the new modules.

The new version provides an upgrade wizard to migrate the old permission to the new submodules. Please visit the upgrade wizard in the backend or run it via cli.

Events 

Many events can now modify the transferred mail object.

If you use events, please check the following ones for changed signatures

• FormControllerCreateActionAfterMailDbSavedEvent got the additional argument hash
• FormControllerOptinConfirmActionBeforeRenderViewEvent uses the mail object instead of the mail uid
• all setters in events do not return the event object (as stated in the official documenation)