1 Product Enhancements
1.1 Change Scheduler Processing Path from OS Drive to Data Drive ID
We have enhanced scheduler configuration to use a dedicated data drive for file processing instead of the operating system drive, thereby preventing the operating system drive, (typically the C: drive) from being filled up during large data operations. This ensures system uptime is maintained, consistent configurations across servers, and optimal scaling.
1.2 Enable Key Bulk Actions on Requests
With this feature, we have provided the option to perform key bulk actions on requests like closing a request and stopping the clock/ putting a request on hold. This will enable you to process similar requests quickly and efficiently.
Security Updates
We’ve made the following security updates in this version of FOIAXpress:
ID | Description |
|---|---|
1337635 | Implemented a solution so that deleting a request in FOIAXpress will hide corresponding Request for Documents (RFDs) in the Collaboration Portal to prevent any further action while the request is the Request Recycle Bin. Once the request is permanently deleted from the system, the RFDs will be automatically deleted from the Collaboration Portal. |
1336305 | Fixed an error causing the Middle Name and the Last Name to be same when submitted PAL requests are received in FOIAXpress. |
1332858 | Resolved slow document delivery to PAL post USDA Production environment upgrade. |
1331504 | Implemented restrictions to prevent unauthorized access to FOIAXpress and Collaboration Portal. |
1323896 | Implemented rate limiting for the password reset functionality in both PAL and PAL Configuration to prevent abuse by limiting the number of password reset attempts, thereby improving security and protecting against brute-force attacks. |
1335839 | Introduced an automated flow in FOIAXpress and Collaboration Portal to unlock users who are locked due to multiple failed login attempts after 15 minutes. This enhancement improves user accessibility by reducing manual intervention to unlock the user manually from the backend. |
1325716 | Enforced MFA, applied rate-limiting, secured session tokens, and adopted robust password policies. Introduced output encoding (e.g., HTML entity encoding), input validation, and Content Security Policy (CSP) headers. |
ID | Description |
|---|---|
Sanitized all user inputs rendered into HTML, used templating engines with auto-escaping, and limited rendering of untrusted content. |