9.3.3

.idea/codeStyles/Project.xml

@@ -7,6 +7,7 @@
       <option name="GROUP_USE_WRAP" value="2" />
       <option name="VARIABLE_NAMING_STYLE" value="CAMEL_CASE" />
       <option name="KEEP_RPAREN_AND_LBRACE_ON_ONE_LINE" value="true" />
+      <option name="SPACE_BEFORE_SHORT_CLOSURE_LEFT_PARENTHESIS" value="true" />
       <option name="FORCE_EMPTY_METHODS_IN_ONE_LINE" value="true" />
     </PHPCodeStyleSettings>
     <codeStyleSettings language="JSON">
@@ -19,6 +20,8 @@
       <option name="KEEP_CONTROL_STATEMENT_IN_ONE_LINE" value="false" />
       <option name="ALIGN_MULTILINE_PARAMETERS" value="false" />
       <option name="ALIGN_MULTILINE_FOR" value="false" />
+      <option name="SPACE_AROUND_UNARY_OPERATOR" value="true" />
+      <option name="SPACE_AFTER_TYPE_CAST" value="true" />
       <option name="METHOD_PARAMETERS_RPAREN_ON_NEXT_LINE" value="true" />
       <option name="METHOD_CALL_CHAIN_WRAP" value="5" />
     </codeStyleSettings>

README.md

@@ -25,6 +25,18 @@ You can try the CRM on an online [demo](https://www.espocrm.com/demo/).
 
 For more information about server configuration, see [this article](https://docs.espocrm.com/administration/server-configuration/).
 
+### Download
+
+[Download](https://www.espocrm.com/download/) the latest release from our website or from GitHub [releases](https://github.com/espocrm/espocrm/releases).
+
+### Release notes
+
+Release notes are available at GitHub [releases](https://github.com/espocrm/espocrm/releases).
+
+### Documentation
+
+See the [documentation](https://docs.espocrm.com) for administrators, users and developers.
+
 ### Why EspoCRM?
 
 * Open-source transparency. EspoCRM's source code is open and accessible, so anyone can inspect it and see how data is being managed within the CRM.
@@ -47,18 +59,6 @@ See installation instructions:
 * [Installation with Docker](https://docs.espocrm.com/administration/docker/installation/)
 * [Installation with Traefik](https://docs.espocrm.com/administration/docker/traefik/)
 
-### Download
-
-[Download](https://www.espocrm.com/download/) the latest release from our website. You can also download the latest and previous release packages from GitHub [releases](https://github.com/espocrm/espocrm/releases).
-
-### Release notes
-
-Release notes are available at GitHub [releases](https://github.com/espocrm/espocrm/releases).
-
-### Documentation
-
-See the [documentation](https://docs.espocrm.com) for administrators, users and developers.
-
 ### Bug reporting
 
 Create a [GitHub issue](https://github.com/espocrm/espocrm/issues/new/choose) or post on our [forum](https://forum.espocrm.com/forum/bug-reports).

application/Espo/Classes/FieldValidators/Common/Host/NotInternal.php

@@ -0,0 +1,62 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2026 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\FieldValidators\Common\Host;
+
+use Espo\Core\FieldValidation\Validator;
+use Espo\Core\FieldValidation\Validator\Data;
+use Espo\Core\FieldValidation\Validator\Failure;
+use Espo\Core\Utils\Security\HostCheck;
+use Espo\ORM\Entity;
+
+/**
+ * @implements Validator<Entity>
+ * @since 9.3.2
+ */
+class NotInternal implements Validator
+{
+    public function __construct(
+        private HostCheck $hostCheck,
+    ) {}
+
+    public function validate(Entity $entity, string $field, Data $data): ?Failure
+    {
+        $value = $entity->get($field);
+
+        if (!$value) {
+            return null;
+        }
+
+        if (!$this->hostCheck->isNotInternalHost($value)) {
+            return Failure::create();
+        }
+
+        return null;
+    }
+}

application/Espo/Classes/FieldValidators/Webhook/Url/NotInternal.php

@@ -0,0 +1,71 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2026 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\FieldValidators\Webhook\Url;
+
+use Espo\Core\FieldValidation\Validator;
+use Espo\Core\FieldValidation\Validator\Data;
+use Espo\Core\FieldValidation\Validator\Failure;
+use Espo\Core\Utils\Security\UrlCheck;
+use Espo\Core\Webhook\AddressUtil;
+use Espo\ORM\Entity;
+
+/**
+ * @implements Validator<Entity>
+ */
+class NotInternal implements Validator
+{
+    public function __construct(
+        private UrlCheck $urlCheck,
+        private AddressUtil $addressUtil,
+    ) {}
+
+    public function validate(Entity $entity, string $field, Data $data): ?Failure
+    {
+        $value = $entity->get($field);
+
+        if (!$value) {
+            return null;
+        }
+
+        if (!$this->urlCheck->isUrl($value)) {
+            return null;
+        }
+
+        if ($this->addressUtil->isAllowedUrl($value)) {
+            return null;
+        }
+
+        if (!$this->urlCheck->isNotInternalUrl($value)) {
+            return Failure::create();
+        }
+
+        return null;
+    }
+}

application/Espo/Classes/FieldValidators/WorkingTimeRange/Calendars/OnlyIfNoUsers.php

@@ -0,0 +1,55 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2026 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\FieldValidators\WorkingTimeRange\Calendars;
+
+use Espo\Core\FieldValidation\Validator;
+use Espo\Core\FieldValidation\Validator\Data;
+use Espo\Core\FieldValidation\Validator\Failure;
+use Espo\Entities\WorkingTimeRange;
+use Espo\ORM\Entity;
+
+/**
+ * @implements Validator<WorkingTimeRange>
+ */
+class OnlyIfNoUsers implements Validator
+{
+    public function validate(Entity $entity, string $field, Data $data): ?Failure
+    {
+        if ($entity->getCalendars()->getCount() === 0) {
+            return null;
+        }
+
+        if ($entity->getUsers()->getCount() === 0) {
+            return null;
+        }
+
+        return Failure::create();
+    }
+}

application/Espo/Classes/FieldValidators/WorkingTimeRange/Calendars/RequiredIfNoUsers.php

@@ -0,0 +1,52 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2026 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\FieldValidators\WorkingTimeRange\Calendars;
+
+use Espo\Core\FieldValidation\Validator;
+use Espo\Core\FieldValidation\Validator\Data;
+use Espo\Core\FieldValidation\Validator\Failure;
+use Espo\Entities\WorkingTimeRange;
+use Espo\ORM\Entity;
+
+/**
+ * @implements Validator<WorkingTimeRange>
+ */
+class RequiredIfNoUsers implements Validator
+{
+
+    public function validate(Entity $entity, string $field, Data $data): ?Failure
+    {
+        if ($entity->getCalendars()->getCount() !== 0 || $entity->getUsers()->getCount() !== 0) {
+            return null;
+        }
+
+        return Failure::create();
+    }
+}

application/Espo/Classes/FieldValidators/WorkingTimeRange/Users/OnlyIfNoCalendars.php

@@ -0,0 +1,55 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2026 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\FieldValidators\WorkingTimeRange\Users;
+
+use Espo\Core\FieldValidation\Validator;
+use Espo\Core\FieldValidation\Validator\Data;
+use Espo\Core\FieldValidation\Validator\Failure;
+use Espo\Entities\WorkingTimeRange;
+use Espo\ORM\Entity;
+
+/**
+ * @implements Validator<WorkingTimeRange>
+ */
+class OnlyIfNoCalendars implements Validator
+{
+    public function validate(Entity $entity, string $field, Data $data): ?Failure
+    {
+        if ($entity->getUsers()->getCount() === 0) {
+            return null;
+        }
+
+        if ($entity->getCalendars()->getCount() === 0) {
+            return null;
+        }
+
+        return Failure::create();
+    }
+}

application/Espo/Classes/RecordHooks/CurrencyRecordRate/AfterDelete.php

@@ -32,6 +32,7 @@ namespace Espo\Classes\RecordHooks\CurrencyRecordRate;
 use Espo\Core\Exceptions\Conflict;
 use Espo\Core\Record\DeleteParams;
 use Espo\Core\Record\Hook\DeleteHook;
+use Espo\Core\Utils\Currency\DatabasePopulator;
 use Espo\Core\WebSocket\Submission;
 use Espo\Entities\CurrencyRecordRate;
 use Espo\ORM\Entity;
@@ -46,6 +47,7 @@ class AfterDelete implements DeleteHook
     public function __construct(
         private SyncManager $syncManager,
         private Submission $submission,
+        private DatabasePopulator $databasePopulator,
     ) {}
 
     public function process(Entity $entity, DeleteParams $params): void
@@ -58,6 +60,7 @@ class AfterDelete implements DeleteHook
             throw new Conflict($e->getMessage(), previous: $e);
         }
 
+        $this->databasePopulator->process();
         $this->submission->submit('appParamsUpdate');
     }
 }

application/Espo/Classes/RecordHooks/CurrencyRecordRate/AfterSave.php

@@ -31,6 +31,7 @@ namespace Espo\Classes\RecordHooks\CurrencyRecordRate;
 
 use Espo\Core\Exceptions\Conflict;
 use Espo\Core\Record\Hook\SaveHook;
+use Espo\Core\Utils\Currency\DatabasePopulator;
 use Espo\Core\WebSocket\Submission;
 use Espo\Entities\CurrencyRecordRate;
 use Espo\ORM\Entity;
@@ -45,6 +46,7 @@ class AfterSave implements SaveHook
     public function __construct(
         private SyncManager $syncManager,
         private Submission $submission,
+        private DatabasePopulator $databasePopulator,
     ) {}
 
     public function process(Entity $entity): void
@@ -57,6 +59,7 @@ class AfterSave implements SaveHook
             throw new Conflict($e->getMessage(), previous: $e);
         }
 
+        $this->databasePopulator->process();
         $this->submission->submit('appParamsUpdate');
     }
 }

application/Espo/Classes/RecordHooks/EmailAccount/BeforeSaveValidateHosts.php

@@ -0,0 +1,120 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2026 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\EmailAccount;
+
+use Espo\Core\Exceptions\Forbidden;
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Core\Utils\Config;
+use Espo\Core\Utils\Security\HostCheck;
+use Espo\Entities\EmailAccount;
+use Espo\Entities\InboundEmail;
+use Espo\ORM\Entity;
+
+/**
+ * @implements SaveHook<EmailAccount|InboundEmail>
+ */
+class BeforeSaveValidateHosts implements SaveHook
+{
+    public function __construct(
+        private Config $config,
+        private HostCheck $hostCheck,
+    ) {}
+
+    public function process(Entity $entity): void
+    {
+        if ($entity->isAttributeChanged('host') || $entity->isAttributeChanged('port')) {
+            $this->validateImap($entity);
+        }
+
+        if ($entity->isAttributeChanged('smtpHost') || $entity->isAttributeChanged('smtpPort')) {
+            $this->validateSmtp($entity);
+        }
+    }
+
+    /**
+     * @throws Forbidden
+     */
+    private function validateImap(EmailAccount|InboundEmail $entity): void
+    {
+        $host = $entity->getHost();
+        $port = $entity->getPort();
+
+        if ($host === null || $port === null) {
+            return;
+        }
+
+        $address = $host . ':' . $port;
+
+        if (in_array($address, $this->getAllowedAddressList())) {
+            return;
+        }
+
+        if (!$this->hostCheck->isNotInternalHost($host)) {
+            $message = $this->composeErrorMessage($host, $address);
+
+            throw new Forbidden($message);
+        }
+    }
+
+    /**
+     * @throws Forbidden
+     */
+    private function validateSmtp(EmailAccount|InboundEmail $entity): void
+    {
+        $host = $entity->getSmtpHost();
+        $port = $entity->getSmtpPort();
+
+        if ($host === null || $port === null) {
+            return;
+        }
+
+        $address = $host . ':' . $port;
+
+        if (!$this->hostCheck->isNotInternalHost($host)) {
+            $message = $this->composeErrorMessage($host, $address);
+
+            throw new Forbidden($message);
+        }
+    }
+
+    /**
+     * @return string[]
+     */
+    private function getAllowedAddressList(): array
+    {
+        return $this->config->get('emailServerAllowedAddressList') ?? [];
+    }
+
+    private function composeErrorMessage(string $host, string $address): string
+    {
+        return "Host '$host' is not allowed as it's internal. " .
+            "To allow, add `$address` to the config parameter `emailServerAllowedAddressList`.";
+    }
+}

application/Espo/Controllers/InboundEmail.php

@@ -30,6 +30,7 @@
 namespace Espo\Controllers;
 
 use Espo\Core\Exceptions\Error;
+use Espo\Core\Exceptions\Forbidden;
 use Espo\Core\Mail\Account\GroupAccount\Service;
 use Espo\Core\Mail\Account\Storage\Params as StorageParams;
 
@@ -48,6 +49,7 @@ class InboundEmail extends Record
      * @return string[]
      * @throws Error
      * @throws ImapError
+     * @throws Forbidden
      */
     public function postActionGetFolders(Request $request): array
     {
@@ -67,6 +69,7 @@ class InboundEmail extends Record
 
     /**
      * @throws Error
+     * @throws Forbidden
      */
     public function postActionTestConnection(Request $request): bool
     {

application/Espo/Controllers/Settings.php

@@ -70,13 +70,6 @@ class Settings
 
     private function getConfigData(): stdClass
     {
-        $data = $this->service->getConfigData();
-        $metadataData = $this->service->getMetadataConfigData();
-
-        foreach (get_object_vars($metadataData) as $key => $value) {
-            $data->$key = $value;
-        }
-
-        return $data;
+        return $this->service->getConfigData();
     }
 }

application/Espo/Core/Currency/CalculatorUtil.php

@@ -33,7 +33,7 @@ use DivisionByZeroError;
 
 class CalculatorUtil
 {
-    private const SCALE = 14;
+    private const int SCALE = 14;
 
     /**
      * @param numeric-string $arg1
@@ -43,16 +43,10 @@ class CalculatorUtil
     public static function add(string $arg1, string $arg2): string
     {
         if (!function_exists('bcadd')) {
-            return (string) (
-                (float) $arg1 + (float) $arg2
-            );
+            return self::floatToString((float) $arg1 + (float) $arg2);
         }
 
-        return bcadd(
-            $arg1,
-            $arg2,
-            self::SCALE
-        );
+        return bcadd($arg1, $arg2, self::SCALE);
     }
 
     /**
@@ -63,56 +57,42 @@ class CalculatorUtil
     public static function subtract(string $arg1, string $arg2): string
     {
         if (!function_exists('bcsub')) {
-            return (string) (
-                (float) $arg1 - (float) $arg2
-            );
+            return self::floatToString((float) $arg1 - (float) $arg2);
         }
 
-        return bcsub(
-            $arg1,
-            $arg2,
-            self::SCALE
-        );
+        return bcsub($arg1, $arg2, self::SCALE);
     }
 
     /**
      * @param numeric-string $arg1
      * @param numeric-string $arg2
      * @return numeric-string
+     *
+     * @todo For the result, trim right zeros. Then, trim dot.
      */
     public static function multiply(string $arg1, string $arg2): string
     {
         if (!function_exists('bcmul')) {
-            return (string) (
-                (float) $arg1 * (float) $arg2
-            );
+            return self::floatToString((float) $arg1 * (float) $arg2);
         }
 
-        return bcmul(
-            $arg1,
-            $arg2,
-            self::SCALE
-        );
+        return bcmul($arg1, $arg2, self::SCALE);
     }
 
     /**
      * @param numeric-string $arg1
      * @param numeric-string $arg2
      * @return numeric-string
+     *
+     * @todo For the result, trim right zeros. Then, trim dot.
      */
     public static function divide(string $arg1, string $arg2): string
     {
         if (!function_exists('bcdiv')) {
-            return (string) (
-                (float) $arg1 / (float) $arg2
-            );
+            return self::floatToString((float) $arg1 / (float) $arg2);
         }
 
-        $result = bcdiv(
-            $arg1,
-            $arg2,
-            self::SCALE
-        );
+        $result = bcdiv($arg1, $arg2, self::SCALE);
 
         if ($result === null) { /** @phpstan-ignore-line  */
             throw new DivisionByZeroError();
@@ -128,7 +108,9 @@ class CalculatorUtil
     public static function round(string $arg, int $precision = 0): string
     {
         if (!function_exists('bcadd')) {
-            return (string) round((float) $arg, $precision);
+            return self::floatToString(
+                round((float) $arg, $precision)
+            );
         }
 
         $addition = '0.' . str_repeat('0', $precision) . '5';
@@ -139,11 +121,7 @@ class CalculatorUtil
 
         assert(is_numeric($addition));
 
-        return bcadd(
-            $arg,
-            $addition,
-            $precision
-        );
+        return bcadd($arg, $addition, $precision);
     }
 
     /**
@@ -156,10 +134,15 @@ class CalculatorUtil
             return (float) $arg1 <=> (float) $arg2;
         }
 
-        return bccomp(
-            $arg1,
-            $arg2,
-            self::SCALE
-        );
+        return bccomp($arg1, $arg2, self::SCALE);
+    }
+
+    /**
+     * @return numeric-string
+     */
+    private static function floatToString(float $amount): string
+    {
+        /** @var numeric-string */
+        return rtrim(rtrim(sprintf('%.' . self::SCALE . 'f', $amount), '0'), '.');
     }
 }

application/Espo/Core/Field/Currency.php

@@ -38,6 +38,8 @@ use InvalidArgumentException;
  */
 class Currency
 {
+    private const int DEFAULT_SCALE = 14;
+
     /** @var numeric-string */
     private string $amount;
     private string $code;
@@ -57,8 +59,10 @@ class Currency
             throw new InvalidArgumentException("Bad currency code.");
         }
 
-        if (is_float($amount) || is_int($amount)) {
+        if (is_int($amount)) {
             $amount = (string) $amount;
+        } else if (is_float($amount)) {
+            $amount = self::floatToString($amount);
         }
 
         $this->amount = $amount;
@@ -136,10 +140,9 @@ class Currency
      */
     public function multiply(float|int|string $multiplier): self
     {
-        $amount = CalculatorUtil::multiply(
-            $this->getAmountAsString(),
-            (string) $multiplier
-        );
+        $multiplier = is_float($multiplier) ? self::floatToString($multiplier) : (string) $multiplier;
+
+        $amount = CalculatorUtil::multiply($this->getAmountAsString(), $multiplier);
 
         return new self($amount, $this->getCode());
     }
@@ -151,10 +154,9 @@ class Currency
      */
     public function divide(float|int|string $divider): self
     {
-        $amount = CalculatorUtil::divide(
-            $this->getAmountAsString(),
-            (string) $divider
-        );
+        $divider = is_float($divider) ? self::floatToString($divider) : (string) $divider;
+
+        $amount = CalculatorUtil::divide($this->getAmountAsString(), $divider);
 
         return new self($amount, $this->getCode());
     }
@@ -208,4 +210,13 @@ class Currency
     {
         return new self($amount, $code);
     }
+
+    /**
+     * @return numeric-string
+     */
+    private static function floatToString(float $amount): string
+    {
+        /** @var numeric-string */
+        return rtrim(rtrim(sprintf('%.' . self::DEFAULT_SCALE . 'f', $amount), '0'), '.');
+    }
 }

application/Espo/Core/FieldProcessing/LinkMultiple/ListLoader.php

@@ -65,7 +65,11 @@ class ListLoader implements LoaderInterface
         foreach ($this->getFieldList($entityType) as $field) {
             if (
                 !in_array($field . 'Ids', $select) &&
-                !in_array($field . 'Names', $select)
+                !in_array($field . 'Names', $select) &&
+                (
+                    !$entity->hasAttribute($field . 'Columns') ||
+                    !in_array($field . 'Columns', $select)
+                )
             ) {
                 continue;
             }

application/Espo/Core/Hook/Hook/AfterRelate.php

@@ -36,7 +36,6 @@ use Espo\ORM\Repository\Option\RelateOptions;
  * An afterRelate hook.
  *
  * @template TEntity of Entity = Entity
- * @template TRelatedEntity of Entity = Entity
  */
 interface AfterRelate
 {
@@ -45,7 +44,6 @@ interface AfterRelate
      *
      * @param TEntity $entity An entity.
      * @param string $relationName A relation name.
-     * @param TRelatedEntity $relatedEntity An entity is being related.
      * @param array<string, mixed> $columnData Middle table role values.
      * @param RelateOptions $options Options.
      */

application/Espo/Core/Hook/Hook/AfterUnrelate.php

@@ -36,7 +36,6 @@ use Espo\ORM\Repository\Option\UnrelateOptions;
  * An afterUnrelate hook.
  *
  * @template TEntity of Entity = Entity
- * @template TRelatedEntity of Entity = Entity
  */
 interface AfterUnrelate
 {
@@ -45,7 +44,6 @@ interface AfterUnrelate
      *
      * @param TEntity $entity An entity.
      * @param string $relationName A relation name.
-     * @param TRelatedEntity $relatedEntity An entity is being unrelated.
      * @param UnrelateOptions $options Options.
      */
     public function afterUnrelate(

application/Espo/Core/Mail/Account/GroupAccount/Service.php

@@ -30,16 +30,19 @@
 namespace Espo\Core\Mail\Account\GroupAccount;
 
 use Espo\Core\Exceptions\ErrorSilent;
+use Espo\Core\Exceptions\Forbidden;
 use Espo\Core\Mail\Account\Account as Account;
 use Espo\Core\Exceptions\Error;
 use Espo\Core\Mail\Account\Fetcher;
 use Espo\Core\Mail\Account\Storage\Params;
 use Espo\Core\Mail\Account\StorageFactory;
+use Espo\Core\Mail\Account\Util\AddressUtil;
 use Espo\Core\Mail\Account\Util\NotificationHelper;
 use Espo\Core\Mail\Exceptions\ImapError;
 use Espo\Core\Mail\Exceptions\NoImap;
 use Espo\Core\Mail\Sender\Message;
 use Espo\Core\Utils\Log;
+use Espo\Core\Utils\Security\HostCheck;
 use Exception;
 
 class Service
@@ -49,7 +52,9 @@ class Service
         private AccountFactory $accountFactory,
         private StorageFactory $storageFactory,
         private Log $log,
-        private NotificationHelper $notificationHelper
+        private NotificationHelper $notificationHelper,
+        private HostCheck $hostCheck,
+        private AddressUtil $addressUtil,
     ) {}
 
     /**
@@ -77,9 +82,18 @@ class Service
      * @return string[]
      * @throws Error
      * @throws ImapError
+     * @throws Forbidden
      */
     public function getFolderList(Params $params): array
     {
+        if (
+            $params->getHost() &&
+            !$this->addressUtil->isAllowedAddress($params) &&
+            !$this->hostCheck->isNotInternalHost($params->getHost())
+        ) {
+            throw new Forbidden("Not allowed internal host.");
+        }
+
         if ($params->getId()) {
             $account = $this->accountFactory->create($params->getId());
 
@@ -95,6 +109,7 @@ class Service
 
     /**
      * @throws Error
+     * @throws Forbidden
      */
     public function testConnection(Params $params): void
     {
@@ -106,6 +121,14 @@ class Service
                 ->withImapHandlerClassName($account->getImapHandlerClassName());
         }
 
+        if (
+            $params->getHost() &&
+            !$this->addressUtil->isAllowedAddress($params) &&
+            !$this->hostCheck->isNotInternalHost($params->getHost())
+        ) {
+            throw new Forbidden("Not allowed internal host.");
+        }
+
         try {
             $storage = $this->storageFactory->createWithParams($params);
             $storage->getFolderNames();

application/Espo/Core/Mail/Account/PersonalAccount/Service.php

@@ -30,9 +30,11 @@
 namespace Espo\Core\Mail\Account\PersonalAccount;
 
 use Espo\Core\Exceptions\ErrorSilent;
+use Espo\Core\Mail\Account\Util\AddressUtil;
 use Espo\Core\Mail\Account\Util\NotificationHelper;
 use Espo\Core\Mail\Exceptions\ImapError;
 use Espo\Core\Mail\Exceptions\NoImap;
+use Espo\Core\Utils\Config;
 use Espo\Core\Utils\Log;
 use Espo\Core\Mail\Account\Account as Account;
 use Espo\Core\Exceptions\Forbidden;
@@ -40,6 +42,7 @@ use Espo\Core\Exceptions\Error;
 use Espo\Core\Mail\Account\Fetcher;
 use Espo\Core\Mail\Account\Storage\Params;
 use Espo\Core\Mail\Account\StorageFactory;
+use Espo\Core\Utils\Security\HostCheck;
 use Espo\Entities\User;
 use Espo\Core\Mail\Sender\Message;
 
@@ -53,7 +56,9 @@ class Service
         private StorageFactory $storageFactory,
         private User $user,
         private Log $log,
-        private NotificationHelper $notificationHelper
+        private NotificationHelper $notificationHelper,
+        private HostCheck $hostCheck,
+        private AddressUtil $addressUtil,
     ) {}
 
     /**
@@ -95,6 +100,14 @@ class Service
             throw new Forbidden();
         }
 
+        if (
+            $params->getHost() &&
+            !$this->addressUtil->isAllowedAddress($params) &&
+            !$this->hostCheck->isNotInternalHost($params->getHost())
+        ) {
+            throw new Forbidden("Not allowed internal host.");
+        }
+
         if ($params->getId()) {
             $account = $this->accountFactory->create($params->getId());
 
@@ -128,6 +141,14 @@ class Service
             throw new Forbidden();
         }
 
+        if (
+            $params->getHost() &&
+            !$this->addressUtil->isAllowedAddress($params) &&
+            !$this->hostCheck->isNotInternalHost($params->getHost())
+        ) {
+            throw new Forbidden("Not allowed host.");
+        }
+
         if ($params->getId()) {
             $account = $this->accountFactory->create($params->getId());
 

application/Espo/Core/Mail/Account/Util/AddressUtil.php

@@ -0,0 +1,69 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2026 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Core\Mail\Account\Util;
+
+use Espo\Core\Mail\Account\Storage\Params;
+use Espo\Core\Mail\SmtpParams;
+use Espo\Core\Utils\Config;
+
+/**
+ * @internal
+ */
+class AddressUtil
+{
+    public function __construct(
+        private Config $config,
+    ) {}
+
+    /**
+     * @internal
+     */
+    public function isAllowedAddress(Params|SmtpParams $params): bool
+    {
+        $host = $params instanceof Params ? $params->getHost() : $params->getServer();
+        $port = $params->getPort();
+
+        if ($port === null || !$host) {
+            return false;
+        }
+
+        $address = $host . ':' . $port;
+
+        return in_array($address, $this->getAllowedAddressList());
+    }
+
+    /**
+     * @return string[]
+     */
+    private function getAllowedAddressList(): array
+    {
+        return $this->config->get('emailServerAllowedAddressList') ?? [];
+    }
+}

application/Espo/Core/Mail/Importer/DefaultImporter.php

@@ -420,8 +420,8 @@ class DefaultImporter implements Importer
             $subject = '(No Subject)';
         }
 
-        if (strlen($subject) > self::SUBJECT_MAX_LENGTH) {
-            $subject = substr($subject, 0, self::SUBJECT_MAX_LENGTH);
+        if (mb_strlen($subject) > self::SUBJECT_MAX_LENGTH) {
+            $subject = mb_substr($subject, 0, self::SUBJECT_MAX_LENGTH);
         }
 
         return $subject;

application/Espo/Core/ORM/QueryComposer/Part/FunctionConverters/CurrencyRate.php

@@ -0,0 +1,96 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2026 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Core\ORM\QueryComposer\Part\FunctionConverters;
+
+use Espo\Core\Currency\ConfigDataProvider;
+use Espo\ORM\Query\Part\Expression;
+use Espo\ORM\QueryComposer\Part\FunctionConverter;
+use Espo\ORM\QueryComposer\Util;
+use RuntimeException;
+
+/**
+ * @noinspection PhpUnused
+ */
+class CurrencyRate implements FunctionConverter
+{
+    private const int PRECISION = 5;
+
+    public function __construct(
+        private ConfigDataProvider $config,
+    ) {}
+
+    public function convert(string ...$argumentList): string
+    {
+        $arg = $argumentList[0] ?? null;
+
+        if (!is_string($arg) || !Util::isArgumentString($arg)) {
+            throw new RuntimeException("CURRENCY_RATE function accepts only literal string argument.");
+        }
+
+        $code = substr($arg, 1, -1);
+
+        if (!in_array($code, $this->config->getCurrencyList())) {
+            return Expression::value(0)->getValue();
+        }
+
+        $baseCurrency = $this->config->getBaseCurrency();
+        $defaultCurrency = $this->config->getDefaultCurrency();
+
+        $rates = $this->config->getCurrencyRates()->toAssoc();
+
+        if ($defaultCurrency !== $baseCurrency) {
+            $rates = $this->exchangeRates($baseCurrency, $defaultCurrency, $rates);
+        }
+
+        $rate = $rates[$code] ?? 1.0;
+
+        return Expression::value($rate)->getValue();
+    }
+
+    /**
+     * @param array<string, float> $currencyRates
+     * @return array<string, float>
+     */
+    private function exchangeRates(string $baseCurrency, string $defaultCurrency, array $currencyRates): array
+    {
+        $defaultCurrencyRate = round(1 / $currencyRates[$defaultCurrency], self::PRECISION);
+
+        $exchangedRates = [];
+        $exchangedRates[$baseCurrency] = $defaultCurrencyRate;
+
+        unset($currencyRates[$baseCurrency], $currencyRates[$defaultCurrency]);
+
+        foreach ($currencyRates as $code => $rate) {
+            $exchangedRates[$code] = round($rate * $defaultCurrencyRate, self::PRECISION);
+        }
+
+        return $exchangedRates;
+    }
+}

application/Espo/Core/Utils/Database/Orm/FieldConverters/Currency.php

@@ -124,12 +124,8 @@ class Currency implements FieldConverter
         $currencyAttribute = $name . 'Currency';
 
         $defaultCurrency = $this->configDataProvider->getDefaultCurrency();
-        $baseCurrency = $this->configDataProvider->getBaseCurrency();
-        $rates = $this->configDataProvider->getCurrencyRates()->toAssoc();
 
-        if ($defaultCurrency !== $baseCurrency) {
-            $rates = $this->exchangeRates($baseCurrency, $defaultCurrency, $rates);
-        }
+        $rates = $this->configDataProvider->getCurrencyList();
 
         $expr = Expr::multiply(
             Expr::column($name),
@@ -216,28 +212,7 @@ class Currency implements FieldConverter
     }
 
     /**
-     * @param array<string, float> $currencyRates
-     * @return array<string, float>
-     */
-    private function exchangeRates(string $baseCurrency, string $defaultCurrency, array $currencyRates): array
-    {
-        $precision = 5;
-        $defaultCurrencyRate = round(1 / $currencyRates[$defaultCurrency], $precision);
-
-        $exchangedRates = [];
-        $exchangedRates[$baseCurrency] = $defaultCurrencyRate;
-
-        unset($currencyRates[$baseCurrency], $currencyRates[$defaultCurrency]);
-
-        foreach ($currencyRates as $currencyName => $rate) {
-            $exchangedRates[$currencyName] = round($rate * $defaultCurrencyRate, $precision);
-        }
-
-        return $exchangedRates;
-    }
-
-    /**
-     * @param array<string, float> $rates
+     * @param string[] $rates
      */
     private function buildExpression(string $currencyAttribute, array $rates): Expr|float
     {
@@ -245,13 +220,11 @@ class Currency implements FieldConverter
             return 0.0;
         }
 
-        $currency = array_key_first($rates);
-        $value = $rates[$currency];
-        unset($rates[$currency]);
+        $currency = array_shift($rates);
 
         return Expr::if(
             Expr::equal(Expr::column($currencyAttribute), $currency),
-            $value,
+            Expr::create("CURRENCY_RATE:('$currency')"),
             $this->buildExpression($currencyAttribute, $rates)
         );
     }

application/Espo/Core/Utils/Security/HostCheck.php

@@ -0,0 +1,75 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2026 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Core\Utils\Security;
+
+use const DNS_A;
+use const FILTER_FLAG_NO_PRIV_RANGE;
+use const FILTER_FLAG_NO_RES_RANGE;
+use const FILTER_VALIDATE_IP;
+
+class HostCheck
+{
+    public function isNotInternalHost(string $host): bool
+    {
+        $records = dns_get_record($host, DNS_A);
+
+        if (filter_var($host, FILTER_VALIDATE_IP)) {
+            return $this->ipAddressIsNotInternal($host);
+        }
+
+        if (!$records) {
+            return true;
+        }
+
+        foreach ($records as $record) {
+            /** @var ?string $idAddress */
+            $idAddress = $record['ip'] ?? null;
+
+            if (!$idAddress) {
+                return false;
+            }
+
+            if (!$this->ipAddressIsNotInternal($idAddress)) {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    private function ipAddressIsNotInternal(string $ipAddress): bool
+    {
+        return (bool) filter_var(
+            $ipAddress,
+            FILTER_VALIDATE_IP,
+            FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE
+        );
+    }
+}

application/Espo/Core/Utils/Security/UrlCheck.php

@@ -29,15 +29,15 @@
 
 namespace Espo\Core\Utils\Security;
 
-use const DNS_A;
-use const FILTER_FLAG_NO_PRIV_RANGE;
-use const FILTER_FLAG_NO_RES_RANGE;
-use const FILTER_VALIDATE_IP;
 use const FILTER_VALIDATE_URL;
 use const PHP_URL_HOST;
 
 class UrlCheck
 {
+    public function __construct(
+        private HostCheck $hostCheck,
+    ) {}
+
     public function isUrl(string $url): bool
     {
         return filter_var($url, FILTER_VALIDATE_URL) !== false;
@@ -58,38 +58,6 @@ class UrlCheck
             return false;
         }
 
-        $records = dns_get_record($host, DNS_A);
-
-        if (filter_var($host, FILTER_VALIDATE_IP)) {
-            return $this->ipAddressIsNotInternal($host);
-        }
-
-        if (!$records) {
-            return false;
-        }
-
-        foreach ($records as $record) {
-            /** @var ?string $idAddress */
-            $idAddress = $record['ip'] ?? null;
-
-            if (!$idAddress) {
-                return false;
-            }
-
-            if (!$this->ipAddressIsNotInternal($idAddress)) {
-                return false;
-            }
-        }
-
-        return true;
-    }
-
-    private function ipAddressIsNotInternal(string $ipAddress): bool
-    {
-        return (bool) filter_var(
-            $ipAddress,
-            FILTER_VALIDATE_IP,
-            FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE
-        );
+        return $this->hostCheck->isNotInternalHost($host);
     }
 }

application/Espo/Core/Webhook/AddressUtil.php

@@ -0,0 +1,79 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2026 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Core\Webhook;
+
+use Espo\Core\Utils\Config;
+
+/**
+ * @internal
+ */
+class AddressUtil
+{
+    public function __construct(
+        private Config $config,
+    ) {}
+
+    /**
+     * @internal
+     */
+    public function isAllowedUrl(string $url): bool
+    {
+        /** @var string[] $allowedAddressList */
+        $allowedAddressList = $this->config->get('webhookAllowedAddressList') ?? [];
+
+        if (!$allowedAddressList) {
+            return false;
+        }
+
+        $host = parse_url($url, PHP_URL_HOST);
+        $port = parse_url($url, PHP_URL_PORT);
+        $scheme = parse_url($url, PHP_URL_SCHEME);
+
+        if (!is_string($host)) {
+            return false;
+        }
+
+        if (!is_int($port)) {
+            if ($scheme === 'https') {
+                $port = 443;
+            } else if ($scheme === 'http') {
+                $port = 80;
+            }
+        }
+
+        if (!is_int($port)) {
+            return false;
+        }
+
+        $address = $host . ':' . $port;
+
+        return in_array($address, $allowedAddressList);
+    }
+}

application/Espo/Core/Webhook/Sender.php

@@ -32,6 +32,7 @@ namespace Espo\Core\Webhook;
 use Espo\Core\Exceptions\Error;
 use Espo\Core\Utils\Config;
 use Espo\Core\Utils\Json;
+use Espo\Core\Utils\Security\UrlCheck;
 use Espo\Entities\Webhook;
 
 /**
@@ -42,8 +43,11 @@ class Sender
     private const CONNECT_TIMEOUT = 5;
     private const TIMEOUT = 10;
 
-    public function __construct(private Config $config)
-    {}
+    public function __construct(
+        private Config $config,
+        private UrlCheck $urlCheck,
+        private AddressUtil $addressUtil,
+    ) {}
 
     /**
      * @param array<int, mixed> $dataList
@@ -85,6 +89,17 @@ class Sender
             throw new Error("Webhook does not have URL.");
         }
 
+        if (!$this->urlCheck->isUrl($url)) {
+            throw new Error("'$url' is not valid URL.");
+        }
+
+        if (
+            !$this->addressUtil->isAllowedUrl($url) &&
+            !$this->urlCheck->isNotInternalUrl($url)
+        ) {
+            throw new Error("URL '$url' points to an internal host, not allowed.");
+        }
+
         $handler = curl_init($url);
 
         if ($handler === false) {

application/Espo/Entities/WorkingTimeRange.php

@@ -128,4 +128,13 @@ class WorkingTimeRange extends Entity
         /** @var LinkMultiple */
         return $this->getValueObject('users');
     }
+
+    /**
+     * @since 9.3.1
+     */
+    public function getCalendars(): LinkMultiple
+    {
+        /** @var LinkMultiple */
+        return $this->getValueObject('calendars');
+    }
 }

application/Espo/EntryPoints/Image.php

@@ -267,8 +267,12 @@ class Image implements EntryPoint
             }
         }
 
-        if ($targetWidth < 1 || $targetHeight < 1) {
-            throw new RuntimeException("No width or height.");
+        if ($targetWidth < 1) {
+            $targetWidth = 1;
+        }
+
+        if ($targetHeight < 1) {
+            $targetHeight = 1;
         }
 
         $targetImage = imagecreatetruecolor($targetWidth, $targetHeight);

application/Espo/Modules/Crm/Resources/metadata/entityDefs/Contact.json

@@ -221,7 +221,8 @@
                 }
             },
             "customizationOptionsDisabled": true,
-            "textFilterDisabled": true
+            "textFilterDisabled": true,
+            "importEnabled": true
         },
         "description": {
             "type": "text"

application/Espo/Resources/i18n/en_US/ApiUser.json

@@ -1,5 +1,6 @@
 {
     "labels": {
-        "Create ApiUser": "Create API User"
+        "Create ApiUser": "Create API User",
+        "OpenAPI spec": "OpenAPI spec"
     }
 }

application/Espo/Resources/layouts/WorkingTimeRange/detail.json

@@ -13,9 +13,13 @@
                 {"name": "timeRanges"},
                 false
             ],
+            [
+                {"name": "users"},
+                false
+            ],
             [
                 {"name": "calendars"},
-                {"name": "users"}
+                false
             ],
             [
                 {"name": "description"}

application/Espo/Resources/layouts/WorkingTimeRange/detailSmall.json

@@ -13,9 +13,13 @@
                 {"name": "timeRanges"},
                 false
             ],
+            [
+                {"name": "users"},
+                false
+            ],
             [
                 {"name": "calendars"},
-                {"name": "users"}
+                false
             ],
             [
                 {"name": "description"}

application/Espo/Resources/metadata/app/orm.json

@@ -4,14 +4,16 @@
             "queryComposerClassName": "Espo\\ORM\\QueryComposer\\MysqlQueryComposer",
             "pdoFactoryClassName": "Espo\\ORM\\PDO\\MysqlPDOFactory",
             "functionConverterClassNameMap": {
-                "ABS": "Espo\\Core\\ORM\\QueryComposer\\Part\\FunctionConverters\\Abs"
+                "ABS": "Espo\\Core\\ORM\\QueryComposer\\Part\\FunctionConverters\\Abs",
+                "CURRENCY_RATE": "Espo\\Core\\ORM\\QueryComposer\\Part\\FunctionConverters\\CurrencyRate"
             }
         },
         "Postgresql": {
             "queryComposerClassName": "Espo\\ORM\\QueryComposer\\PostgresqlQueryComposer",
             "pdoFactoryClassName": "Espo\\ORM\\PDO\\PostgresqlPDOFactory",
             "functionConverterClassNameMap": {
-                "ABS": "Espo\\Core\\ORM\\QueryComposer\\Part\\FunctionConverters\\Abs"
+                "ABS": "Espo\\Core\\ORM\\QueryComposer\\Part\\FunctionConverters\\Abs",
+                "CURRENCY_RATE": "Espo\\Core\\ORM\\QueryComposer\\Part\\FunctionConverters\\CurrencyRate"
             }
         }
     }

application/Espo/Resources/metadata/clientDefs/ApiUser.json

@@ -30,5 +30,18 @@
     },
     "filterList": [
     ],
-    "boolFilterList": []
-}
+    "boolFilterList": [],
+    "menu": {
+        "list": {
+            "dropdown": [
+                {
+                    "name": "openApiSpec",
+                    "label": "OpenAPI spec",
+                    "link": "api/v1/OpenApi",
+                    "handler": "handlers/api-user/open-api-spec-action",
+                    "actionFunction": "process"
+                }
+            ]
+        }
+    }
+}

application/Espo/Resources/metadata/entityDefs/CurrencyRecordRate.json

@@ -23,7 +23,7 @@
             "type": "decimal",
             "decimalPlaces": 6,
             "min": 0.0001,
-            "precision": 15,
+            "precision": 20,
             "scale": 8,
             "required": true,
             "audited": true,

application/Espo/Resources/metadata/entityDefs/EmailAccount.json

@@ -21,14 +21,16 @@
             "default": "Active"
         },
         "host": {
-            "type": "varchar"
+            "type": "varchar",
+            "massUpdateDisabled": true
         },
         "port": {
             "type": "int",
             "min": 0,
             "max": 65535,
             "default": 993,
-            "disableFormatting": true
+            "disableFormatting": true,
+            "massUpdateDisabled": true
         },
         "security": {
             "type": "enum",
@@ -112,14 +114,16 @@
             "tooltip": true
         },
         "smtpHost": {
-            "type": "varchar"
+            "type": "varchar",
+            "massUpdateDisabled": true
         },
         "smtpPort": {
             "type": "int",
             "min": 0,
             "max": 65535,
             "default": 587,
-            "disableFormatting": true
+            "disableFormatting": true,
+            "massUpdateDisabled": true
         },
         "smtpAuth": {
             "type": "bool",

application/Espo/Resources/metadata/entityDefs/InboundEmail.json

@@ -21,14 +21,16 @@
             "default": "Active"
         },
         "host": {
-            "type": "varchar"
+            "type": "varchar",
+            "massUpdateDisabled": true
         },
         "port": {
             "type": "int",
             "min": 0,
             "max": 65535,
             "default": 993,
-            "disableFormatting": true
+            "disableFormatting": true,
+            "massUpdateDisabled": true
         },
         "security": {
             "type": "enum",
@@ -122,14 +124,16 @@
             "tooltip": true
         },
         "smtpHost": {
-            "type": "varchar"
+            "type": "varchar",
+            "massUpdateDisabled": true
         },
         "smtpPort": {
             "type": "int",
             "min": 0,
             "max": 65535,
             "default": 587,
-            "disableFormatting": true
+            "disableFormatting": true,
+            "massUpdateDisabled": true
         },
         "smtpAuth": {
             "type": "bool",

application/Espo/Resources/metadata/entityDefs/Template.json

@@ -119,7 +119,8 @@
         },
         "fontFace": {
             "type": "enum",
-            "view": "views/template/fields/font-face"
+            "view": "views/template/fields/font-face",
+            "isSorted": true
         },
         "title": {
             "type": "varchar"

application/Espo/Resources/metadata/entityDefs/Webhook.json

@@ -10,7 +10,10 @@
             "type": "varchar",
             "maxLength": 512,
             "required": true,
-            "copyToClipboard": true
+            "copyToClipboard": true,
+            "validatorClassNameList": [
+                "Espo\\Classes\\FieldValidators\\Webhook\\Url\\NotInternal"
+            ]
         },
         "isActive": {
             "type": "bool",

application/Espo/Resources/metadata/entityDefs/WorkingTimeRange.json

@@ -34,12 +34,20 @@
         },
         "calendars": {
             "type": "linkMultiple",
-            "tooltip": true
+            "tooltip": true,
+            "validatorClassNameList": [
+                "Espo\\Classes\\FieldValidators\\WorkingTimeRange\\Calendars\\OnlyIfNoUsers",
+                "Espo\\Classes\\FieldValidators\\WorkingTimeRange\\Calendars\\RequiredIfNoUsers"
+            ],
+            "autocompleteOnEmpty": true
         },
         "users": {
             "type": "linkMultiple",
             "view": "views/working-time-range/fields/users",
-            "tooltip": true
+            "tooltip": true,
+            "validatorClassNameList": [
+                "Espo\\Classes\\FieldValidators\\WorkingTimeRange\\Users\\OnlyIfNoCalendars"
+            ]
         },
         "createdAt": {
             "type": "datetime",

application/Espo/Resources/metadata/logicDefs/WorkingTimeRange.json

@@ -11,7 +11,7 @@
                 ]
             }
         },
-        "users": {
+        "calendars": {
             "visible": {
                 "conditionGroup": [
                     {
@@ -19,8 +19,36 @@
                         "value": [
                             {
                                 "type": "isNotEmpty",
-                                "attribute": "id"
+                                "attribute": "calendarsIds"
                             },
+                            {
+                                "type": "isEmpty",
+                                "attribute": "usersIds"
+                            }
+                        ]
+                    }
+                ]
+            }
+        },
+        "users": {
+            "required": {
+                "conditionGroup": [
+                    {
+                        "type": "or",
+                        "value": [
+                            {
+                                "type": "isEmpty",
+                                "attribute": "calendarsIds"
+                            }
+                        ]
+                    }
+                ]
+            },
+            "visible": {
+                "conditionGroup": [
+                    {
+                        "type": "or",
+                        "value": [
                             {
                                 "type": "isNotEmpty",
                                 "attribute": "usersIds"

application/Espo/Resources/metadata/recordDefs/EmailAccount.json

@@ -15,9 +15,11 @@
     ],
     "beforeCreateHookClassNameList": [
         "Espo\\Classes\\RecordHooks\\EmailAccount\\BeforeCreate",
-        "Espo\\Classes\\RecordHooks\\EmailAccount\\BeforeSave"
+        "Espo\\Classes\\RecordHooks\\EmailAccount\\BeforeSave",
+        "Espo\\Classes\\RecordHooks\\EmailAccount\\BeforeSaveValidateHosts"
     ],
     "beforeUpdateHookClassNameList": [
-        "Espo\\Classes\\RecordHooks\\EmailAccount\\BeforeSave"
+        "Espo\\Classes\\RecordHooks\\EmailAccount\\BeforeSave",
+        "Espo\\Classes\\RecordHooks\\EmailAccount\\BeforeSaveValidateHosts"
     ]
 }

application/Espo/Resources/metadata/recordDefs/InboundEmail.json

@@ -18,5 +18,11 @@
     ],
     "listLoaderClassNameList": [
         "Espo\\Classes\\FieldProcessing\\InboundEmail\\IsSystemLoader"
+    ],
+    "beforeCreateHookClassNameList": [
+        "Espo\\Classes\\RecordHooks\\EmailAccount\\BeforeSaveValidateHosts"
+    ],
+    "beforeUpdateHookClassNameList": [
+        "Espo\\Classes\\RecordHooks\\EmailAccount\\BeforeSaveValidateHosts"
     ]
 }

application/Espo/Tools/App/SettingsService.php

@@ -56,6 +56,15 @@ use stdClass;
 
 class SettingsService
 {
+    /**
+     * @var string[]
+     * @todo Do not use when these parameters moved away from the settings.
+     */
+    private array $ignoreUpdateParamList = [
+        'loginView',
+        'loginData',
+    ];
+
     public function __construct(
         private ApplicationState $applicationState,
         private Config $config,
@@ -87,11 +96,22 @@ class SettingsService
         $this->filterData($data);
         $this->loadAdditionalParams($data);
 
+        /** @noinspection PhpDeprecationInspection */
+        $metadataData = $this->getMetadataConfigData();
+
+        foreach (get_object_vars($metadataData) as $key => $value) {
+            $data->$key = $value;
+        }
+
         return $data;
     }
 
     /**
      * Get metadata to be used in config.
+     *
+     * @todo Make private in v9.4.0.
+     * @todo Move away from settings. Use some different approach.
+     * @deprecated Since v9.3.2.
      */
     public function getMetadataConfigData(): stdClass
     {
@@ -208,6 +228,7 @@ class SettingsService
         }
 
         $ignoreItemList = array_merge(
+            $this->ignoreUpdateParamList,
             $this->access->getSystemParamList(),
             $this->access->getReadOnlyParamList(),
             $this->isRestrictedMode() && !$user->isSuperAdmin() ?

application/Espo/Tools/Email/Api/PostSendTest.php

@@ -38,8 +38,10 @@ use Espo\Core\Exceptions\BadRequest;
 use Espo\Core\Exceptions\Error;
 use Espo\Core\Exceptions\Forbidden;
 use Espo\Core\Exceptions\NotFound;
+use Espo\Core\Mail\Account\Util\AddressUtil;
 use Espo\Core\Mail\Exceptions\NoSmtp;
 use Espo\Core\Mail\SmtpParams;
+use Espo\Core\Utils\Security\HostCheck;
 use Espo\Entities\Email;
 use Espo\Tools\Email\SendService;
 use Espo\Tools\Email\TestSendData;
@@ -51,7 +53,9 @@ class PostSendTest implements Action
 {
     public function __construct(
         private SendService $sendService,
-        private Acl $acl
+        private Acl $acl,
+        private HostCheck $hostCheck,
+        private AddressUtil $addressUtil,
     ) {}
 
     /**
@@ -109,6 +113,13 @@ class PostSendTest implements Action
                 ->withAuthMechanism($authMechanism);
         }
 
+        if (
+            !$this->addressUtil->isAllowedAddress($smtpParams) &&
+            !$this->hostCheck->isNotInternalHost($server)
+        ) {
+            throw new Forbidden("Not allowed internal host.");
+        }
+
         $data = new TestSendData($emailAddress, $type, $id, $userId);
 
         $this->sendService->sendTestEmail($smtpParams, $data);

application/Espo/Tools/EntityManager/EntityManager.php

@@ -724,6 +724,7 @@ class EntityManager
             'collection.order',
             'collection.textFilterFields',
             'collection.fullTextSearch',
+            'collection.countDisabled',
         ]);
 
         foreach ($this->getAdditionalParamLocationMap($name) as $it) {

application/Espo/Tools/GlobalSearch/Service.php

@@ -113,7 +113,7 @@ class Service
             $builder->order('relevance', Order::DESC);
         }
 
-        $builder->order('order', Order::DESC);
+        $builder->order('order');
         $builder->order(Field::NAME);
 
         $unionQuery = $builder->build();

application/Espo/Tools/LeadCapture/Service.php

@@ -84,6 +84,7 @@ class Service
 
         $this->entityManager->saveEntity($entity);
 
+        $service->loadAdditionalFields($entity);
         $service->prepareEntityForOutput($entity);
 
         return $entity;
@@ -108,6 +109,7 @@ class Service
 
         $this->entityManager->saveEntity($entity);
 
+        $service->loadAdditionalFields($entity);
         $service->prepareEntityForOutput($entity);
 
         return $entity;

application/Espo/Tools/LinkManager/LinkManager.php

@@ -855,7 +855,9 @@ class LinkManager
                 "links.$link",
             ]);
 
-            $this->metadata->delete('clientDefs', $entity, ["dynamicLogic.fields.$link"]);
+            $this->metadata->delete('logicDefs', $entity, [
+                "fields.$link",
+            ]);
 
             $this->metadata->save();
 
@@ -907,8 +909,13 @@ class LinkManager
                 ->build();
         }
 
-        $this->metadata->delete('clientDefs', $entity, ["dynamicLogic.fields.$link"]);
-        $this->metadata->delete('clientDefs', $entityForeign, ["dynamicLogic.fields.$linkForeign"]);
+        $this->metadata->delete('logicDefs', $entity, [
+            "fields.$link",
+        ]);
+
+        $this->metadata->delete('logicDefs', $entityForeign, [
+            "fields.$linkForeign",
+        ]);
 
         $this->metadata->delete('entityDefs', $entity, [
             "fields.$link",

application/Espo/Tools/Notification/RecordService.php

@@ -472,12 +472,15 @@ class RecordService
 
     private function prepareSetFields(Notification $entity): void
     {
-        if ($entity->getRelated() && $entity->getData()?->relatedName) {
-            $entity->set('relatedName', $entity->getData()->relatedName);
+        $relatedName = $entity->getData()->relatedName ?? null;
+        $createdByName = $entity->getData()->createdByName ?? null;
+
+        if ($entity->getRelated() && $relatedName !== null) {
+            $entity->set('relatedName', $relatedName);
         }
 
-        if ($entity->getCreatedBy() && $entity->getData()?->createdByName) {
-            $entity->set('createdByName', $entity->getData()->createdByName);
+        if ($entity->getCreatedBy() && $createdByName !== null) {
+            $entity->set('createdByName', $createdByName);
         }
     }
 }

application/Espo/Tools/Pdf/Dompdf/DompdfInitializer.php

@@ -30,33 +30,61 @@
 namespace Espo\Tools\Pdf\Dompdf;
 
 use Dompdf\Dompdf;
+use Dompdf\FontMetrics;
 use Dompdf\Options;
 use Espo\Core\Utils\Config;
+use Espo\Core\Utils\File\Manager as FileManager;
+use Espo\Core\Utils\Metadata;
 use Espo\Tools\Pdf\Params;
 use Espo\Tools\Pdf\Template;
 
 class DompdfInitializer
 {
     private string $defaultFontFace = 'DejaVu Sans';
+    private string $cacheDir = 'data/cache/application/dompdf';
+    private string $pdfaCacheDir = 'data/cache/application/pdfa-dompdf';
 
     private const PT = 2.83465;
 
+    /** @var array<string, string> */
+    private array $standardFontMapping = [
+        'courier' => 'DejaVu Sans Mono',
+        'fixed' => 'DejaVu Sans Mono',
+        'helvetica' => 'DejaVu Sans',
+        'monospace' => 'DejaVu Sans Mono',
+        'sans-serif' => 'DejaVu Sans',
+        'serif' => 'DejaVu Serif',
+        'times' => 'DejaVu Serif',
+        'times-roman' => 'DejaVu Serif',
+    ];
+
     public function __construct(
         private Config $config,
+        private Metadata $metadata,
+        private FileManager $fileManager,
     ) {}
 
     public function initialize(Template $template, Params $params): Dompdf
     {
         $options = new Options();
 
-        $options->setIsPdfAEnabled($params->isPdfA());
-        $options->setDefaultFont($this->getFontFace($template));
+        $options
+            ->setIsPdfAEnabled($params->isPdfA())
+            ->setDefaultFont($this->getFontFace($template))
+            ->setIsJavascriptEnabled(false);
+
+        $dir = $params->isPdfA() ? $this->pdfaCacheDir : $this->cacheDir;
+
+        $options->setFontDir($dir);
+        $options->setFontCache($dir);
+
+        if (!$this->fileManager->isDir($dir)) {
+            $this->fileManager->mkdir($dir);
+        }
 
         $pdf = new Dompdf($options);
 
-        if ($params->isPdfA()) {
-            $this->mapFonts($pdf);
-        }
+        $this->mapFonts($pdf, $params->isPdfA(), $dir);
 
         $size = $template->getPageFormat() === Template::PAGE_FORMAT_CUSTOM ?
             [0.0, 0.0, $template->getPageWidth() * self::PT, $template->getPageHeight() * self::PT] :
@@ -79,18 +107,36 @@ class DompdfInitializer
             $this->defaultFontFace;
     }
 
-    private function mapFonts(Dompdf $pdf): void
+    private function mapFonts(Dompdf $pdf, bool $isPdfA, string $dir): void
     {
-        // Fonts are included in PDF/A. Map standard fonts to open source analogues.
+        $file = $dir . '/' . FontMetrics::USER_FONTS_FILE;
+
+        if ($this->fileManager->exists($file)) {
+            return;
+        }
+
+        // When fonts are included in PDF/A, we need to map standard fonts to open source analogues.
+        // Also need to support popular fonts specified in CSS styles.
         $fontMetrics = $pdf->getFontMetrics();
 
-        $fontMetrics->setFontFamily('courier', $fontMetrics->getFamily('DejaVu Sans Mono'));
-        $fontMetrics->setFontFamily('fixed', $fontMetrics->getFamily('DejaVu Sans Mono'));
-        $fontMetrics->setFontFamily('helvetica', $fontMetrics->getFamily('DejaVu Sans'));
-        $fontMetrics->setFontFamily('monospace', $fontMetrics->getFamily('DejaVu Sans Mono'));
-        $fontMetrics->setFontFamily('sans-serif', $fontMetrics->getFamily('DejaVu Sans'));
-        $fontMetrics->setFontFamily('serif', $fontMetrics->getFamily('DejaVu Serif'));
-        $fontMetrics->setFontFamily('times', $fontMetrics->getFamily('DejaVu Serif'));
-        $fontMetrics->setFontFamily('times-roman', $fontMetrics->getFamily('DejaVu Serif'));
+        if ($isPdfA) {
+            foreach ($this->standardFontMapping as $key => $value) {
+                $fontMetrics->setFontFamily($key, $fontMetrics->getFamily($value));
+            }
+
+            return;
+        }
+
+        /** @var string[] $fontList */
+        $fontList = $this->metadata->get('app.pdfEngines.Dompdf.fontFaceList') ?? [];
+        $fontList = array_map(fn ($it) => strtolower($it), $fontList);
+
+        foreach ($this->standardFontMapping as $key => $value) {
+            if (in_array(strtolower($key), $fontList)) {
+                continue;
+            }
+
+            $fontMetrics->setFontFamily($key, $fontMetrics->getFamily($value));
+        }
     }
 }

application/Espo/Tools/Stream/RecordService.php

@@ -141,7 +141,7 @@ class RecordService
         ];
 
         if ($this->user->isPortal()) {
-            $where[] = ['isInternal' => true];
+            $where[] = ['isInternal' => false];
         }
 
         $this->applyPortalAccess($builder, $where);

client/src/handlers/api-user/open-api-spec-action.js

@@ -0,0 +1,46 @@
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2026 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+import ActionHandler from 'action-handler';
+import {inject} from 'di';
+import Router from 'router';
+
+// noinspection JSUnusedGlobalSymbols
+export default class extends ActionHandler {
+
+    /**
+     * @type {Router}
+     * @private
+     */
+    @inject(Router)
+    router
+
+    process() {
+        window.open('api/v1/OpenApi', '_blank');
+    }
+}

client/src/helpers/field/link-icon.js

@@ -0,0 +1,112 @@
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2026 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+/**
+ * @since 9.3.1
+ */
+export default class LinkFieldIconHelper {
+
+    /**
+     * @param {import('views/fields/link').default} view
+     * @param {{
+     *     iconClass: string,
+     *     getIconClass: function(): string|null,
+     *     getColor: function(): string,
+     * }} options
+     */
+    constructor(view, options) {
+        this.view = view;
+        this.options = options;
+
+        view.listenTo(view, 'after:render', () => {
+            if (view.isEditMode()) {
+                this.control();
+            }
+        });
+
+        view.addHandler('keydown', `input[data-name="${view.nameName}"]`, (/** KeyboardEvent */e, target) => {
+            if (e.code === 'Enter') {
+                return;
+            }
+
+            target.classList.add('being-typed');
+        });
+
+        view.addHandler('change', `input[data-name="${view.nameName}"]`, (e, target) => {
+            setTimeout(() => target.classList.remove('being-typed'), 200);
+        });
+
+        view.addHandler('blur', `input[data-name="${view.nameName}"]`, (e, target) => {
+            target.classList.remove('being-typed');
+        });
+
+        view.on('change', () => {
+            if (!view.isEditMode()) {
+                return;
+            }
+
+            const span = view.element.querySelector('span.icon-in-input');
+
+            if (span) {
+                span.parentNode.removeChild(span);
+            }
+
+            setTimeout(() => this.control(), 0);
+        });
+    }
+
+    /**
+     * @private
+     */
+    control() {
+        const view = this.view;
+
+        const nameElement = view.element.querySelector(`input[data-name="${view.nameName}"]`);
+        nameElement.classList.remove('being-typed');
+
+        const icon = document.createElement('span');
+        icon.className = 'icon-in-input ' + this.options.iconClass;
+        icon.style.color = this.options.getColor();
+
+        const iconClass = this.options.getIconClass();
+
+        if (!iconClass) {
+            return;
+        }
+
+        icon.className += ' ' + iconClass;
+
+        const input = view.element.querySelector('.input-group > input');
+
+        if (!input) {
+            return;
+        }
+
+        input.after(icon);
+    }
+}

client/src/views/admin/layouts/filters.js

@@ -118,6 +118,16 @@ class LayoutFiltersView extends LayoutRowsView {
             return false;
         }
 
+        /** @type {string[]|null} */
+        const layoutList = model.getFieldParam(name, 'layoutAvailabilityList');
+
+        if (
+            layoutList &&
+            !layoutList.includes(this.type)
+        ) {
+            return false;
+        }
+
         return !model.getFieldParam(name, 'disabled') &&
             !model.getFieldParam(name, 'utility') &&
             !model.getFieldParam(name, 'layoutFiltersDisabled');

client/src/views/dashlets/fields/records/expanded-layout.js

@@ -108,8 +108,14 @@ class ExpandedLayoutDashletFieldView extends BaseFieldView {
 
         this.addActionHandler('editItem', (event, target) => this.editItem(target.dataset.name));
 
-        this.targetEntityType = this.model.get('entityType') ||
+        this.targetEntityType = this.model.attributes.entityType ??
             this.getMetadata().get(['dashlets', this.dataObject.dashletName, 'entityType']);
+
+        this.listenTo(this.model, 'change:entityType', () => {
+            if (this.model.attributes.entityType) {
+                this.targetEntityType = this.model.attributes.entityType;
+            }
+        });
     }
 
     /**

client/src/views/modals/detail.js

@@ -223,8 +223,7 @@ class DetailModalView extends ModalView {
                 return;
             }
 
-            this.model = this.sourceModel.clone();
-            this.model.collection = this.sourceModel.collection.clone();
+            this.cloneSourceModel();
 
             this.setupAfterModelCreated();
 
@@ -259,6 +258,23 @@ class DetailModalView extends ModalView {
         }
     }
 
+    /**
+     * @private
+     */
+    cloneSourceModel() {
+        this.model = this.sourceModel.clone();
+
+        const sourceCollection = this.sourceModel.collection;
+
+        if (!sourceCollection) {
+            return;
+        }
+
+        this.model.collection = sourceCollection.clone();
+
+        this.listenTo(this.model.collection, 'update-source', () => sourceCollection.fetch())
+    }
+
     /**
      * Additional setup with the model ready.
      *
@@ -502,7 +518,7 @@ class DetailModalView extends ModalView {
         if (nextButtonEnabled) {
             this.enableButton('next');
         } else {
-             this.disableButton('next');
+            this.disableButton('next');
         }
     }
 
@@ -512,6 +528,7 @@ class DetailModalView extends ModalView {
         }
 
         const previousModel = this.model;
+        const previousCollection = this.model.collection;
 
         this.sourceModel = this.model.collection.at(indexOfRecord);
 
@@ -524,12 +541,15 @@ class DetailModalView extends ModalView {
         this.id = this.sourceModel.id;
         this.scope = this.sourceModel.entityType;
 
-        this.model = this.sourceModel.clone();
-        this.model.collection = this.sourceModel.collection.clone();
+        this.cloneSourceModel();
 
         this.stopListening(previousModel, 'change');
         this.stopListening(previousModel, 'sync');
 
+        if (previousCollection) {
+            this.stopListening(previousCollection, 'update-source');
+        }
+
         this.listenTo(this.model, 'change', () => {
             this.sourceModel.set(this.model.getClonedAttributes());
         });

client/src/views/record/detail.js

@@ -846,7 +846,8 @@ class DetailRecordView extends BaseRecordView {
         if (this.duplicateAction) {
             if (
                 this.getAcl().check(this.entityType, 'create') &&
-                !this.getMetadata().get(['clientDefs', this.scope, 'duplicateDisabled'])
+                !this.getMetadata().get(['clientDefs', this.scope, 'duplicateDisabled']) &&
+                !this.getMetadata().get(['clientDefs', this.scope, 'createDisabled'])
             ) {
                 this.addDropdownItem({
                     label: 'Duplicate',

client/src/views/role/record/edit.js

@@ -56,7 +56,7 @@ class RoleEditRecordView extends EditRecordView {
             this.listenTo(view, 'change', () => {
                 const data = this.fetch();
 
-                this.model.set(data);
+                this.model.setMultiple(data, {ui: true});
             });
         });
     }

client/src/views/role/record/table.js

@@ -115,6 +115,22 @@ class RoleRecordTableView extends View {
      */
     acl
 
+    /**
+     * @private
+     * @type {({
+     *     list: {
+     *         level: string|false,
+     *         name: string,
+     *         action: string,
+     *         levelList: string[]|null,
+     *     }[],
+     *     name: string,
+     *     type: 'boolean'|'record',
+     *     access: 'not-set'|'enabled'|'disabled',
+     * }|false)[]}
+     */
+    tableDataList
+
     /**
      * @private
      * @type {
@@ -126,6 +142,7 @@ class RoleRecordTableView extends View {
      *                 action: 'read'|'edit',
      *                 value: 'yes'|'no',
      *                 name: string,
+     *                 levelList: string[]|null,
      *            }[],
      *          }[],
      *     }[]
@@ -143,7 +160,7 @@ class RoleRecordTableView extends View {
         data.fieldActionList = this.fieldActionList;
         data.fieldLevelList = this.fieldLevelList;
 
-        data.tableDataList = this.getTableDataList();
+        data.tableDataList = this.tableDataList;
         data.fieldTableDataList = this.fieldTableDataList;
 
         let hasFieldLevelData = false;
@@ -375,7 +392,7 @@ class RoleRecordTableView extends View {
 
         const promises = [];
 
-        this.getTableDataList().forEach(scopeItem => {
+        this.tableDataList.forEach(scopeItem => {
             if (!scopeItem) {
                 return;
             }
@@ -529,7 +546,7 @@ class RoleRecordTableView extends View {
 
             if (actionItem.action === 'read') {
                 this.listenTo(this.formModel, `change:${scope}-${field}-read`, (m, value) => {
-                    this.controlFieldEditSelect(scope, field, value, true);
+                    this.controlFieldEditSelect(scope, field, value);
                 });
             }
         });
@@ -538,7 +555,7 @@ class RoleRecordTableView extends View {
             const readLevel = this.formModel.attributes[`${scope}-${field}-read`];
 
             if (readLevel) {
-                this.controlFieldEditSelect(scope, field, readLevel);
+                this.controlFieldEditSelect(scope, field, readLevel, true);
             }
         }
 
@@ -564,6 +581,7 @@ class RoleRecordTableView extends View {
         }
 
         this.setupScopeList();
+        this.tableDataList = this.getTableDataList();
         this.setupFieldTableDataList();
     }
 
@@ -679,6 +697,7 @@ class RoleRecordTableView extends View {
                         name: `${scope}-${field}-${action}`,
                         action: action,
                         value: scopeData[field][action] || 'yes',
+                        levelList: [...this.fieldLevelList],
                     })
                 });
 
@@ -826,7 +845,7 @@ class RoleRecordTableView extends View {
         const options = this.fieldLevelList
             .filter(item => this.levelList.indexOf(item) >= this.levelList.indexOf(limitValue));
 
-        if (!dontChange) {
+        if (!dontChange && this.hasFieldAction(scope, field, 'edit')) {
             this.formModel.set(attribute, value);
         }
 
@@ -861,7 +880,7 @@ class RoleRecordTableView extends View {
         const options = this.getLevelList(scope, action)
             .filter(item => this.levelList.indexOf(item) >= this.levelList.indexOf(limitValue));
 
-        if (!dontChange) {
+        if (!dontChange && this.hasAction(scope, action)) {
             setTimeout(() => this.formModel.set(attribute, value), 0);
         }
 
@@ -874,6 +893,43 @@ class RoleRecordTableView extends View {
         }
     }
 
+    /**
+     * @private
+     * @param {string} scope
+     * @param {string} action
+     * @return {boolean}
+     */
+    hasAction(scope, action) {
+        if (this.tableDataList === false) {
+            return false;
+        }
+
+        return !!this.tableDataList
+            ?.find(it => it.name === scope)
+            ?.list
+            .find(it => it.action === action)
+            ?.levelList
+            ?.length;
+    }
+
+    /**
+     * @private
+     * @param {string} scope
+     * @param {string} field
+     * @param {string} action
+     * @return {boolean}
+     */
+    hasFieldAction(scope, field, action) {
+        return !!this.fieldTableDataList
+            ?.find(it => it.name === scope)
+            ?.list
+            ?.find(it => it.name === field)
+            ?.list
+            .find(it => it.action === action)
+            ?.levelList
+            ?.length;
+    }
+
     /**
      * @private
      * @param {string} scope
@@ -908,11 +964,13 @@ class RoleRecordTableView extends View {
                                     name: `${scope}-${field}-read`,
                                     action: 'read',
                                     value: 'no',
+                                    levelList: [...this.fieldLevelList],
                                 },
                                 {
                                     name: `${scope}-${field}-edit`,
                                     action: 'edit',
                                     value: 'no',
+                                    levelList: [...this.fieldLevelList],
                                 },
                             ]
                         };

client/src/views/template/fields/style.js

@@ -179,7 +179,7 @@ class TemplateStyleFieldView extends TextFieldView {
     fetch() {
         const data = {};
 
-        data[this.name] = this.editor.getValue();
+        data[this.name] = this.editor.getValue() || null;
 
         return data;
     }

frontend/less/espo/custom.less

@@ -2364,24 +2364,41 @@ td.cell {
     }
 }
 
-div:has(.avatar-in-input):not(:has(.being-typed)) {
-    > .input-group > input {
-        padding-left: var(--33px);
+div:has(.avatar-in-input),
+div:has(.icon-in-input) {
+    &:not(:has(.being-typed)) {
+        > .input-group > input {
+            padding-left: var(--33px);
+        }
+
+        &:has(.color-icon) {
+            > .input-group > input {
+                padding-left: var(--21px);
+            }
+        }
+
+        > .icon-in-input,
+        > .avatar-in-input {
+            display: inline-block;
+            position: absolute;
+            z-index: 3;
+            user-select: none;
+            pointer-events: none;
+        }
+
+        > .avatar-in-input {
+            top: var(--9px);
+            left: var(--10px);
+        }
+
+        > .icon-in-input {
+            top: var(--11px);
+            left: var(--10px);
+        }
     }
 
-    > .avatar-in-input {
-        display: inline-block;
-        position: absolute;
-        top: var(--9px);
-        left: var(--10px);
-        z-index: 3;
-        user-select: none;
-        pointer-events: none;
-    }
-}
-
-div:has(.avatar-in-input) {
-    > .avatar-in-input {
+    > .avatar-in-input,
+    > .icon-in-input {
         display: none;
     }
 }

frontend/less/espo/elements/form.less

@@ -590,6 +590,9 @@ select.form-control.native-select {
         appearance: base-select;
     }
 
+    // Otherwise, the picker displayed in a wrong place.
+    display: inline-flex;
+
     &:open {
         border-color: var(--input-border-focus);
         outline: 0;

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "espocrm",
-  "version": "9.3.0",
+  "version": "9.3.3",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "espocrm",
-      "version": "9.3.0",
+      "version": "9.3.3",
       "hasInstallScript": true,
       "license": "AGPL-3.0-or-later",
       "dependencies": {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "espocrm",
-  "version": "9.3.0",
+  "version": "9.3.3",
   "description": "Open-source CRM.",
   "repository": {
     "type": "git",

schema/metadata/app/pdfEngines.json

@@ -33,6 +33,11 @@
                         }
                     ]
                 }
+            },
+            "additionalParams": {
+                "type": "object",
+                "additionalProperties": true,
+                "description": "Additional engine-wise parameters."
             }
         }
     }

schema/metadata/entityDefs.json

@@ -433,6 +433,27 @@
                         }
                     }
                 },
+                {
+                    "if": {
+                        "properties": {
+                            "type": {
+                                "anyOf": [
+                                    {"const": "enum"},
+                                    {"const": "multiEnum"},
+                                    {"const": "checklist"}
+                                ]
+                            }
+                        }
+                    },
+                    "then": {
+                        "properties": {
+                            "isSorted": {
+                                "type": "boolean",
+                                "description": "Sort the dropdown options alphabetically."
+                            }
+                        }
+                    }
+                },
                 {
                     "if": {
                         "properties": {

tests/integration/Espo/Currency/CurrencyTest.php

@@ -33,6 +33,7 @@ use Espo\Core\Exceptions\Error;
 use Espo\Core\Field\Date;
 use Espo\Core\Formula\Manager as FormulaManager;
 use Espo\Modules\Crm\Entities\Lead;
+use Espo\Modules\Crm\Entities\Opportunity;
 use Espo\Tools\Currency\RateEntryProvider;
 use Espo\Tools\Currency\RateService;
 use Espo\Core\Currency\Rates;
@@ -178,4 +179,88 @@ class CurrencyTest extends BaseTestCase
         $value = $formulaManager->run($script);
         $this->assertEquals(1.0, (float) $value);
     }
+
+    /**
+     * @noinspection PhpUnhandledExceptionInspection
+     */
+    public function testDefaultCurrencyJoinMode(): void
+    {
+        $configWriter = $this->getInjectableFactory()->create(ConfigWriter::class);
+
+        $configWriter->set('currencyNoJoinMode', false);
+        $configWriter->set('currencyList', ['USD', 'EUR']);
+        $configWriter->set('defaultCurrency', 'USD');
+        $configWriter->set('baseCurrency', 'EUR');
+        $configWriter->save();
+
+        $this->getInjectableFactory()->create(SyncManager::class)->sync();
+
+        $rateService = $this->getInjectableFactory()->create(RateService::class);
+        $rateService->set(Rates::fromAssoc([
+            'USD' => 0.5,
+        ], 'EUR'));
+
+        $this->getDataManager()->rebuild();
+        $this->reCreateApplication();
+
+        $em = $this->getEntityManager();
+
+        $opp = $em->getRDBRepositoryByClass(Opportunity::class)->getNew();
+        $opp->setAmount(Currency::create('10.0', 'USD'));
+        $em->saveEntity($opp);
+        $em->refreshEntity($opp);
+
+        $this->assertEquals(10, $opp->get('amountConverted'));
+
+        //
+
+        $opp = $em->getRDBRepositoryByClass(Opportunity::class)->getNew();
+        $opp->setAmount(Currency::create('10.0', 'EUR'));
+        $em->saveEntity($opp);
+        $em->refreshEntity($opp);
+
+        $this->assertEquals(20, $opp->get('amountConverted'));
+    }
+
+    /**
+     * @noinspection PhpUnhandledExceptionInspection
+     */
+    public function testDefaultCurrencyNoJoinMode(): void
+    {
+        $configWriter = $this->getInjectableFactory()->create(ConfigWriter::class);
+
+        $configWriter->set('currencyNoJoinMode', true);
+        $configWriter->set('currencyList', ['USD', 'EUR']);
+        $configWriter->set('defaultCurrency', 'USD');
+        $configWriter->set('baseCurrency', 'EUR');
+        $configWriter->save();
+
+        $this->getInjectableFactory()->create(SyncManager::class)->sync();
+
+        $rateService = $this->getInjectableFactory()->create(RateService::class);
+        $rateService->set(Rates::fromAssoc([
+            'USD' => 0.5,
+        ], 'EUR'));
+
+        $this->getDataManager()->rebuild();
+        $this->reCreateApplication();
+
+        $em = $this->getEntityManager();
+
+        $opp = $em->getRDBRepositoryByClass(Opportunity::class)->getNew();
+        $opp->setAmount(Currency::create('10.0', 'USD'));
+        $em->saveEntity($opp);
+        $em->refreshEntity($opp);
+
+        $this->assertEquals(10, $opp->get('amountConverted'));
+
+        //
+
+        $opp = $em->getRDBRepositoryByClass(Opportunity::class)->getNew();
+        $opp->setAmount(Currency::create('10.0', 'EUR'));
+        $em->saveEntity($opp);
+        $em->refreshEntity($opp);
+
+        $this->assertEquals(20, $opp->get('amountConverted'));
+    }
 }

tests/integration/Espo/Webhook/AclTest.php

@@ -88,7 +88,7 @@ class AclTest extends \tests\integration\Core\BaseTestCase
                 'Content-Type' => 'application/json',
                 'X-Api-Key' => 'test-key',
             ],
-            '{"event":"Account.create", "url": "https://test"}'
+            '{"event":"Account.create", "url": "https://test.com"}'
         );
 
         $this->auth(null, null, null, 'ApiKey', $request);
@@ -126,7 +126,7 @@ class AclTest extends \tests\integration\Core\BaseTestCase
                 'Content-Type' => 'application/json',
                 'X-Api-Key' => 'test-key',
             ],
-            '{"event":"Account.create", "url": "https://test"}'
+            '{"event":"Account.create", "url": "https://test.com"}'
         );
 
         $this->auth(null, null, null, 'ApiKey', $request);
@@ -164,7 +164,7 @@ class AclTest extends \tests\integration\Core\BaseTestCase
                 'Content-Type' => 'application/json',
                 'X-Api-Key' => 'test-key',
             ],
-            '{"event":"Account.create", "url": "https://test"}'
+            '{"event":"Account.create", "url": "https://test.com"}'
         );
 
         $this->auth(null, null, null, 'ApiKey', $request);
@@ -204,7 +204,7 @@ class AclTest extends \tests\integration\Core\BaseTestCase
 
         $webhook = $em->createEntity('Webhook', [
             'event' => 'Account.create',
-            'url' => 'https://test',
+            'url' => 'https://test.com',
             'userId' => $user->getId(),
         ]);
 

tests/integration/Espo/Webhook/ProcessingTest.php

@@ -63,14 +63,14 @@ class ProcessingTest extends BaseTestCase
         $em->createEntity(Webhook::ENTITY_TYPE, [
             'event' => 'Account.create',
             'userId' => $user->getId(),
-            'url' => 'https://test',
+            'url' => 'https://test.com',
             'skipOwn' => true,
         ]);
 
         $em->createEntity(Webhook::ENTITY_TYPE, [
             'event' => 'Account.update',
             'userId' => $user->getId(),
-            'url' => 'https://test',
+            'url' => 'https://test.com',
             'skipOwn' => true,
         ]);
 
@@ -203,7 +203,7 @@ class ProcessingTest extends BaseTestCase
         $em->createEntity(Webhook::ENTITY_TYPE, [
             'event' => 'Account.delete',
             'userId' => $user->getId(),
-            'url' => 'https://test',
+            'url' => 'https://test.com',
             'skipOwn' => true,
         ]);
 
@@ -289,7 +289,7 @@ class ProcessingTest extends BaseTestCase
         $em->createEntity(Webhook::ENTITY_TYPE, [
             'event' => 'Account.fieldUpdate.name',
             'userId' => $user->getId(),
-            'url' => 'https://test',
+            'url' => 'https://test.com',
         ]);
 
         $app = $this->createApplication();

tests/unit/Espo/Core/Field/Currency/CurrencyTest.php

@@ -39,7 +39,7 @@ use InvalidArgumentException;
 
 class CurrencyTest extends TestCase
 {
-    public function testValue()
+    public function testValue1()
     {
         $value = Currency::create(2.0, 'USD');
 
@@ -47,6 +47,14 @@ class CurrencyTest extends TestCase
         $this->assertEquals('USD', $value->getCode());
     }
 
+    public function testValue()
+    {
+        $value = Currency::create(0.5, 'USD');
+
+        $this->assertEquals('0.5', $value->getAmountAsString());
+        $this->assertEquals('USD', $value->getCode());
+    }
+
     public function testAdd()
     {
         $value = (new Currency(2.0, 'USD'))->add(
@@ -67,7 +75,7 @@ class CurrencyTest extends TestCase
         $this->assertEquals('USD', $value->getCode());
     }
 
-    public function testMultiply()
+    public function testMultiply1()
     {
         $value = (new Currency(2.0, 'USD'))->multiply(3.0);
 
@@ -75,7 +83,15 @@ class CurrencyTest extends TestCase
         $this->assertEquals('USD', $value->getCode());
     }
 
-    public function testDivide()
+    public function testMultiply2()
+    {
+        $value = (new Currency(2.0, 'USD'))->multiply(0.5);
+
+        $this->assertEquals('1.00000000000000', $value->getAmountAsString());
+        $this->assertEquals('USD', $value->getCode());
+    }
+
+    public function testDivide1()
     {
         $value = (new Currency(6.0, 'USD'))->divide(3.0);
 
@@ -83,6 +99,14 @@ class CurrencyTest extends TestCase
         $this->assertEquals('USD', $value->getCode());
     }
 
+    public function testDivide2()
+    {
+        $value = (new Currency(6.0, 'USD'))->divide(0.5);
+
+        $this->assertEquals('12.00000000000000', $value->getAmount());
+        $this->assertEquals('USD', $value->getCode());
+    }
+
     public function testRound1()
     {
         $value = (new Currency(2.306, 'USD'))->round(2);

tests/unit/Espo/ORM/MysqlQueryComposerTest.php

@@ -2414,6 +2414,15 @@ class MysqlQueryComposerTest extends TestCase
         $this->assertEquals(['test'], $list);
     }
 
+    public function testGetAllAttributesFromComplexExpression4()
+    {
+        $expression = "SUM:('тестван', test1, 'тест', test2, link.test3)";
+
+        $list = Util::getAllAttributesFromComplexExpression($expression);
+
+        $this->assertEquals(['test1', 'test2', 'link.test3'], $list);
+    }
+
     public function testComplexExpressionString1(): void
     {
         $queryBuilder = new QueryBuilder();