#28456 Reference to missing files in subsession.jsp

enhancement

major

#28994

TableComponent: ConfigKey should be customizable

#29055

User-specified CSS classes cannot override default numeric alignment in table columns

#29084

JSON Schema Support for Typed Configuration

#29092

Multi-factor authentication and self-service account management

minor

#29037

Upload/update workflows at application startup

#29095

No fixed reference to tl-build-processor in tl-parent-build

#29204

TreeGrid Modelbuilder API: Node predicate does not get component model

nice-to-have

#29103

Making REST client JSON parser robust against empty content

defect

critical

#29080

Unwanted row objects in tables with changes from other sessions

#29199

XSS vulnerability in /jsp/openapi/server/displayAPISpec.jsp

major

#28674

Security issues in the UMLJS project

#28710

Accounts with reused contact have no authorization

#28993

Filters of dynamic columns ignore the attribute type

#29042

Error in column filter for double values

#29107

StackOverflowError when rolling back in the transaction monitor

#29111

JavaDoc-based I18N generation ignores custom ResKey in I18NConstants

minor

#27850

Modelleditor swallows classification with a less-than sign in the name

#28456

Reference to missing files in subsession.jsp

#28485

Immutable/Disbled Boolean fields accessible/focusable via tab

#28651

Unnecessary space for inline tables

#28725

Pointless scroll bar in the help editor

#29053

TL-Script: format() with null input returns IllegalArgumentException

#29061

Missing replacement of KnowledgeItem by ObjectKey in Collections in Queries

#29066

"SafeHTML not started" error with scripted tests

#29069

A calculated attribute of the type "General search expression" cannot return a closure

#29073

Abstract attributes can be accessed in transient objects

#29074

The form data of a component cannot be accessed in a value transformation of a component channel

#29075

After changing the model, calculated attributes that have become invalid can no longer be edited

#29076

API key in REST interface configuration is not hidden

#29087

Incorrect access to the D&D cache in the browser

#29091

Values of a composition attribute cannot be edited if previously used in the same form

#29106

Error when restarting the KnowledgeBase

#29112

Update minimatch and serialize-javascript to fix CVE-2026-27903, CVE-2026-27904, and GHSA-5c6j-r48x-rmvq

#29197

Eclipse error after dependency update: maven-jar-plugin 3.5.0 causes "outside of a scoping block" error in m2e

update

critical

#29110

Update dependency com.fasterxml.jackson.core:jackson-core to v2.21.1 [SECURITY]

defect

minor

#28456

Reference to missing files in subsession.jsp

Security

The subsession.jsp is used if a new subsession of the application is to be started:

It refers to the file <%=theContext%>/images/login/loginscreen.png. This only exists in the tl-demo, an error occurs in the log in all other applications.
A variable "theEnabledImage" is defined, which nobody uses. Perhaps the translation of the ResKey used here should also be disposed of.

Implementation

The subsession.jsp has been redesigned. The logo "appLogo.svg" is now used.

Test

After logging in, open the URL from the browser in a new tab
- The application logo is displayed with the message "You are opening a new window...".