eCase Platform Release Notes 26.4.2.0

Prev Next

1. Product Enhancements

1.1 Configurable Correspondence Application Configuration

# ID 1576969

A new Configuration page is now available in the eCASE Correspondence application. This page allows administrators to control which correspondence fields are displayed and how they behave, and to rename application terms to match their agency's language - all without requiring a code change or support request.

The Configuration page contains two tabs: Configuration and Terminology. The Configuration tab is selected by default.

  1. Select the Correspondence Configuration from the Configuration

  2. Select Configuration tab

The Correspondence Field Configuration section displays a system-defined list of correspondence fields. Each row shows the field name along with the following configurable settings:

  1. Display in UI? - Controls whether the field is visible on the correspondence entry and edit screens

  2. Is Required? - When enabled, the field must have a value before a correspondence record can be saved

  3. Disable - When enabled, the field appears on the screen but cannot be edited

The field list is system-defined and cannot be modified. Configuration changes take effect immediately after saving. Fields configured as hidden are not displayed, while required fields must be completed before saving. System-required fields cannot be set as hidden or optional. Additionally, the No Date and Date on Correspondence fields are always required, and disabling the Category field automatically disables Sub-Category.

The Terminology tab displays a list of application terms used throughout the Correspondence application. Each row shows a read-only system term alongside an editable text box for a replacement term. The text box is pre-filled with the currently saved replacement term, or the system default if no replacement has been set.

To update a term:

  1. Select the Terminology tab

  2. Enter the replacement text in the editable field for the desired term

  3. Click Save

Replacement terms are applied throughout the application and reflected across correspondence pages, labels, menus, filters, and validation messages. Changes take effect after saving, and clearing a replacement term restores the system's default value. Changes remain unsaved until Save is selected, and all terminology updates are recorded in the audit log for tracking and review.

1.2 Case Type-Level Email Reader Configuration for Correspondence

#ID 1501675

Email intake for the Correspondence application is now configured on the case type itself rather than at the platform level. An Email Reader Settings icon is available in the General section of the Correspondence case type page, and selecting it presents the same Email Reader form already used by the Investigation Email Hotline.

The form accepts a Microsoft (Office 365 / Exchange Online) source type; one or more intake mailbox addresses entered as a comma- or semicolon-separated list, and the Tenant ID, App Key, and App Secret used for authentication. Intake Email Address is always mandatory. Tenant ID, App Key, and App Secret become mandatory once Enable is selected.

A scheduled job request polls the mailbox configured for the Correspondence case type and creates one Correspondence folder for each unread message it finds,

Each folder created this way is populated from the email: the actual email received date, Requestor Name, Requestor Email Address, Email Subject, and the full Email Body, converted to plain text with hyperlink destinations preserved.

Requestor Information Fields on the Correspondence Form

A new Requestor Information group is available on the Correspondence form, positioned below the existing Correspondence group, to hold the sender details captured from an inbound email. The group contains six optional fields, in this order: Email Received, Requestor Name, Requestor Address, Requestor Email Address, Email Subject, and Email Body. Email Received honors the application's configured date format, and Email Body is a multi-line control sized to hold a full email body. Requestor Address is present on the form but is not populated in this release.

1.3 New Correspondence Form Fields: Recommendation, Assigned To, and Exemptions Asserted

ID #1501613

Three optional fields are now available on the Correspondence form so that disposition, ownership, and asserted exemptions can be recorded on the correspondence record instead of being tracked outside the system.

  • Recommendation — a single-select drop-down menu positioned directly below Type and above Date on Correspondence. Its choice list is empty by default, so administrators populate the values that suit their business need. Selecting a value replaces any previous value, and the field can be returned to the default placeholder.

  • Assigned To - a single-select lookup search positioned directly below File Location. Its search control lists the eCase users who hold permission on the Correspondence application.

  • Exemptions Asserted - a multi-select lookup search positioned directly below the new Assigned To, as the last field in the section. It offers the same sort, reorder, and search controls as other multi-select lookups on the form, such as Sub Category, and the same value cannot be selected twice.

2. Security Updates

We’ve addressed the following security updates in this version of eCase Platform:

ID

Description

1554456

Resolved code quality issues and security vulnerabilities identified by Fortify SCA and SonarQube static analysis across eCase Platform and eCaseAdmin application areas including folder creation, popup and open-window functionality, choice list popups, and contact type settings

1554404

Addressed security vulnerabilities identified through Vulnerability Assessment and Penetration Testing (VAPT) across eCase Platform and eCase Admin application areas including broken access control, insecure direct object references (IDOR), stored cross-site scripting (XSS), information disclosure through server version headers, weak account lockout mechanisms, and user enumeration via password reset

1580194

Addressed broken access control vulnerabilities across eCase Platform including cross-application case number modification, insecure direct object references (IDOR) in favorite groups, unauthorized access to discussion threads, fiscal year plans, action/email/delivery logs, and case folder data; fixed stored cross-site scripting (XSS) in eCase Admin scheduled jobs; removed ASP.NET and IIS version information from server response headers

3. Bug Fixes

The following bug fixes have been addressed in this release:

ID

Description

1592249

The checkout lock was not being released for idle files. A new scheduled job now automatically releases the checkout lock on any document that has remained checked out past a configured time threshold, so PDF attachments no longer get stuck as checked out

1602133

The eCase Indexing Service job configuration was changed from in-process to out-of-process, isolating it from the eCase Scheduler. If the indexing job encounters an issue or terminates unexpectedly, the Scheduler and its other jobs continue running unaffected

1603829

The synchronization logic now distinguishes between users added via workflow-role sync, and users added manually to File Access. Manually added users are preserved on save, alongside workflow-synced users, when Synchronize Workflow Roles with Folder is enabled

1605797

A restriction prevented certain permissions from ever being removed from the Folder Owner role. That restriction has been removed, so Folder Owner permissions are now fully configurable and can be deselected or applied like any other role's permissions

1608632

Resolved an issue where the Time Task Detailed Hours Report failed with a database error when run or exported. The report now generates and exports successfully

1619958

The Select Auditor filter on the Time Task Hour Report and Time Task Detailed Hours Report now lists former (inactive) auditors alongside active ones, so time reports can be run for staff whose accounts have since been deactivated. Deleted accounts remain excluded