enhancement
major
#29487
React view: <form> exposes neither column count nor label position, and there is no <group> element
#29523
<sidebar> exposes two of the five sidebar item kinds ReactSidebarControl renders, and none of the badge
#29529
Stellvertreter als explizite Sicherheitsaktion im Einstellungsdialog der TL Views benennen (mit Passwortbestätigung, auch für die Passwortänderung)
#29530
URL routing in TL Views: model objects in route parameters, drill-down path in the URL, query bindings
#29531
Filterleiste für Tabellen: Presets, Freitextsuche über die sichtbaren Spalten und benutzereigene gespeicherte Filter
#29532
Object navigation in TL Views: display targets, a reveal protocol for containers, and a show-object action
#29542
TL Views: channel-bound value inputs for every primitive and reference type, with a submit hook
#29544
TL Views table: row activation by double-click or Enter, and a grouping UI over the existing table model
#29546
TL Views: colors for enumeration literals and classifier objects rendered as pills, and a progress control
#29548
React view UI: URL, e-mail and phone attributes are edited as typed inputs and displayed as links
#29557
React view commands: the ExecutableState reason of a disabled command never reaches the client, and there is no disabled-if rule beside visible-if
#29575
TL Views: UI-Inspektor – Zustand eines Elements der React-Oberfläche einsehen (z. B. durch Zugriffsrechte ausgeblendete Tabellenzeilen) und als Skript-Zusicherung aufzeichnen
#29596
TL Views: Gestaltungsoptionen für app-spezifische Oberflächen (css-class, Text-Varianten, Layout-Optionen, Anzeigevarianten für Eingaben, Theme-Tokens)
#29597
TL Views: object-list als generischer Repeater (Elemente ohne Container, Raster-Layout, Index für gestaffelte Animation)
#29598
TL Views: image mit URL-/Ressourcen-Quelle, Seitenverhältnis, Füllmodus und überlagerten Inhalten; avatar mit Foto
#29599
TL Views: Wizard-/Stepper-Element für mehrstufige Dialogflüsse (statische und dynamische Schritte, Fortschritt, Übergänge, Auto-Weiter)
#29600
TL Views: Anzeige lang laufender Server-Aufträge (Phasen, Fortschritt, unbestimmter Fortschritt, verstrichene Zeit)
#29601
TL Views: Anzeige von HTML-Inhalten und HTML-Dokumenten (Agenten-Antworten, Exposés) mit Vorschau und Druck/PDF
#29603
Physisches Löschen gelöschter Objekte aus versionierten Tabellen (Purge): Abschlussmenge über Pflichtreferenzen und Inhalte, optionale Verweise werden geleert
#29605
TL Views table filter bar: an initially active preset, and the active preset and search term as channels for query bindings
#29607
TL Views: a display target reveals a tab inside a pushed frame (a <show> is located within the view shown before it)
#29608
TL Views: value-input mit Platzhalter, zugänglicher Name bei verborgenem Label, bedingte Anzeige von Elementen mit visible-if
#29615
TL Views: a <form> spanning a page does not take part in the fill contract, so a split panel or filling panel inside it is sized by its content
#29625
TL Views: a page layout of weighted columns (main 2/3, side 1/3) that reflows to one column on a narrow viewport; the split-panel keeps its sashes and clips the side pane at 400 px
#29629
TL Views: `<show-view>` / `<show-views>` actions reveal a mounted view by name and write its channels from a command chain without a model object
#29630
TL Views: a chunked, transactional job body for <start-job> - scripted init / elements / steps / finish, one transaction per chunk, per-item retry and skip, phases and progress derived from the steps
#29637
Modellbasierte Berechtigungsdefinition: Zugriffselternobjekt (Delegation der Zugriffsentscheidung an Container oder Referenz, Standard für Kompositionsteile, Entscheidungs-Cache je Interaktion), Rollenelternobjekt statt Security-Parent, Vollständigkeitsprüfung und Assistent
#29640
TL Views: Gruppen einer gruppierten Tabelle werden nach dem Komparator der Gruppierungsspalte sortiert, nicht in zufälliger Reihenfolge
#29641
TL Views: Der React-TL-Script-Editor zeigt Hilfetexte zu Funktionen und Modellelementen an (Kontexthilfe zur Vervollständigung, Hover-Tooltips) und springt beim Tippen nicht mehr an den Textanfang
#29643
TL Views: Anpassung der React-Oberfläche an das Corporate Design eines Kunden mit eigener React-Komponentenbibliothek (Leitfaden und fehlende Erweiterungspunkte)
#29671
TL Views: Drag & Drop in Tabellen nach Regeln einschränken, mit Rückmeldung pro Ziel während des Ziehens
minor
#29500
No way to show a master-detail as an overlay: the detail always costs the list half its width
#29506
A dashboard tile cannot be the entry point it looks like: neither <tile> nor <card> carries an action
#29550
React controls do not consume the theme's radius and surface tokens consistently; a flat theme needs per-component CSS overrides
#29553
React view <table>: <column> has no width, every column defaults to 150 px, so a table with more than six columns overflows a 940 px pane
#29611
TL Views: `<notify>` action shows a translated notice in a generic-command chain (snackbar or OK dialog, optionally stopping the chain); `<throw-error>` removed
#29624
SSO-Login ohne registrierten Benutzeraccount: konfigurierbare Hinweisseite (ApplicationPages.unknownAccountPage) statt Login-Maske, mit Standardseiten für die klassische und die React-Oberfläche
#29670
TL-Script: Funktionen trim, trimStart und trimEnd entfernen Leerraum am Anfang und Ende einer Zeichenkette
major
#29438
React view layer displays date attributes in a hard-wired format instead of the annotated one
#29502
<tree> does not follow model changes: a delete never arrives, a create collapses the whole tree
#29509
Die Cookie-Prüfung weist den erneuten Aufruf ihrer eigenen URL ab und meldet dabei die Sitzung ab
#29533
TL Views: executability rules and derived channels must follow changes of the object on a channel, not only of the channel value
#29534
TL Views tile-stack: frames get no definite height, and a frame that is uncovered again is rebuilt from scratch
#29535
TL Views table: a selection channel value that is not among the rows must not be cleared by the table
#29554
React view <table>: Spalten für beliebige Zeilenobjekte – berechnete Spalten, eingebettete Spalten referenzierter Objekte, dynamische Spalten; transiente Zeilen
#29556
react-api/tooltip runs without a TLSubSessionContext: a cell tooltip over a derived attribute using label() answers HTTP 500 (NullPointerException in Label.eval)
#29560
React view <upload-command>: Fehler beim Upload (Ausnahme in der Aktionskette, überschrittenes Größenlimit) erreichen den Benutzer nicht; Upload-Größenlimit konfigurierbar
#29562
security.xml grants for a SecurityScopeService scope are lost on the start that introduces the scope: AccessConfigurationSetupService imports before the scope exists and stores the file hash anyway
#29564
SecurityConfigurationService: an application cannot add a role to a framework type's grant — a <class> grant is keyed by operation and replaces the earlier entry, silently revoking the framework's roles
#29573
TestReactStylesheetTokens fails on master: the pill and progress rules of tlReactControls.css do not keep the theme-token contract
#29574
TL Views: Veto eines verschachtelten Channel-Schreibzugriffs bricht die Benachrichtigung des äußeren Channels ab (Tabelle und Detailbereich bleiben nach "Verwerfen" auf dem alten Objekt)
#29576
React-Controls-Bundle enthält eine zweite React-Instanz (createPortal-Import in TLDropdownSelect)
#29586
tl-layout-react test compilation fails on master: TestSelectValueObservation and TestResourceCellObservation use the DefaultReactContext constructor that #29552 removed
#29590
React view: Mehrwertige String-Werte werden in Tabellenzellen und Anzeigefeldern ohne Trennzeichen aneinandergehängt
#29602
TL Views: a URL adopted into an existing session keeps the slot content of the sidebar item that was active before
#29604
ElementSecurityUpdateManager: quadratic collection diff on commit (AbstractSet.removeAll over a List) makes appending to a large reference take seconds
#29609
TL Views: a `<progress>` (ChannelObjectObserver) evaluates its expression on a deleted object and logs an ERROR when an observed object is deleted
#29610
TL Views: a table on an inactive tab shows stale cell values after the displayed objects changed, until its rows are refreshed
#29613
TL Views: a `<dashboard>` tile gets no definite height, so a table in a tile grows with its rows instead of scrolling
#29619
TL Views: a warning-level configuration constraint is dropped, so the model editor shows nothing
#29620
TL Views: a tree node is never a link to where its object is displayed, although the display targets declare one
#29622
TL Views: a `<flow-diagram selection="ch">` writes its channel but does not follow it, so a node selected elsewhere is not marked in the diagram
#29623
Build: the translate goal re-translates committed German messages after a pull or branch switch when the doclet did not run in the same build
#29626
TL Views: a panel toolbar has no overflow mode; at 400 px width the ticket page's six commands run 908 px wide, three of them unreachable, and the panel title is pushed out
#29627
TL Views table: an I18NString cell wraps its text and is clipped mid-glyph by the 36 px row instead of ending in an ellipsis; header labels are cut without an ellipsis
#29631
TL Views: Escape closes a <window> dialog while a <start-job> it started is still running; the job runs on with nothing left to show or cancel it
#29634
TL Views: the configuration editor builds a text field for a property whose format is parse-only, so selecting a derived attribute in the model editor fails with "There is no normative way to serialize a locator configuration"
#29635
TL Views: a <tree> renders every node as a link, so a click on the label navigates away instead of just selecting the node
#29639
TL-Script objectResolve(id, typeOrTable): resolution via a type including its subtypes or via a table name, objectTable delivers the table of an object, and an object the current user may not read is not resolved
#29648
TL Views: Die über ClientResources ausgelieferten Skripte und Stylesheets tragen keine Version in der URL, der Browser verwendet nach einer Aktualisierung veraltete Client-Dateien
#29649
TL Views: a job's final state is overwritten by a stale "running" snapshot, so <job-status> shows a completed job as running
#29666
TL Views: leaving a frame by breadcrumb, Back, navigate-pop, show-object or logout discards a form's unsaved changes without asking
#29667
TL Views: a form in edit mode keeps showing stale values after a command committed a change to the same object
#29672
TL Views: initial-edit-mode, an object switch and the edit-mode channel enter edit mode without asking <edit-executability>
#29674
TL Views: after a page load, app-bar command labels appear in the browser's language instead of the user's ("Record" in a German session)
#29677
TL Views: a card in a content-sized column stack shrinks below its content; a table beside it takes more height than it reports
#29678
BoundHelper: Einstellung use-default-security-parent entfernen – ohne konfigurierte Security-Parent-Regel hat ein Objekt keinen Security-Parent
minor
#29496
React table: a column resize is rejected with "Integer value expected" and the new width is lost when the client sends a fractional width
#29497
React UI tooltips: clipped table cells and column headers, compact toolbar buttons and attribute descriptions get tooltips; native title attributes replaced by bridge tooltips
#29505
Panel header changes height when its toolbar has no commands, so master-detail headers do not line up
#29552
TLPhotoViewer fetches its image after the control was disposed when a <switch> replaces it (404 on react-api/data, "Command target NOT FOUND" WARN)
#29555
TL-Script label(<constant>) is folded at compile time: the result is fixed to the compiling thread's locale instead of the reading user's
#29558
XMLInstanceImporter silently imports an internationalized attribute given as value="…" as empty, even when the attribute is mandatory
#29561
TL Views: display of a referenced object does not follow a change of its label (table cell, form field)
#29563
Standardgruppe: das persistierte Gruppen-Flag "defaultGroup" wird aus der Konfiguration abgeleitet statt in der Datenbank gespeichert; Semantik der Standardgruppe dokumentiert
#29591
ResKey.decode akzeptiert in #(…)-Literalen nur doppelt gequotete Übersetzungen — #('Travel'@en) schlägt fehl, obwohl TL-Script beide Quote-Arten erlaubt
#29606
TL Views: a `<color token>` naming a token the React theme does not emit renders the pill untinted, silently
#29628
TL Views: "Reset personal settings" clears the stored configuration, but the running session keeps its table state and writes it back; the declared column widths return only after a new login
#29636
TL Views: a click on a <tree> node clears the selection channel before setting it, so every dependent display and command flips to empty and back
#29663
TL Views: a <form> no longer insets itself; a <fields> grid inside a form got the page inset twice
#29664
TL Views: the form's Edit, Save, Cancel and Apply commands are labelled with a trailing period ("Bearbeiten.", "Speichern.")
#29668
TL Views: the rich-text editor's toolbar overflows a narrow field; table and undo/redo buttons are cut off
#29669
A request with a malformed query string ("?q=50%") is answered with an "Internal error" page (HTTP 500) instead of 400
#29673
TL Views: personalization commands ("Layout bearbeiten", "Diesen Filter speichern") are offered to the anonymous session
defect
major
#29564
SecurityConfigurationService: an application cannot add a role to a framework type's grant — a <class> grant is keyed by operation and replaces the earlier entry, silently revoking the framework's roles
Affects 8.0.0-SNAPSHOT (2026-09-11), tl-core (SecurityConfigurationService, AccessRightsConfig).
tl-element grants PersonalProfile the Read operation on tl.accounts:Person (personalProfileSecurity.config.xml). An application whose accountants must read every account (a work list of employees is a table of Person rows, and a TL-Script result is filtered for the reader's read rights) adds
{{{#!xml <class name="tl.accounts:Person">
<grant inherit="true" operation="Read" roles="expenses.accountant"/>
</class> }}}
Grants are a map keyed by the operation (AccessRightsConfig.java:27-36), so the application's entry **replaces** the framework's: PersonalProfile loses its read on the account and an ordinary user can no longer read their own account. Nothing warns. The application has to repeat the framework's roles (roles="PersonalProfile, expenses.accountant") and thereby hard-wires knowledge of another module's security configuration.
Expected: either the role lists of grants for the same operation are merged across configuration layers (additive, in line with the additive combination of type and module grants in section 2.4.2 of the spec), or the typed-configuration list-merge directives (config:operation="add" on the roles) are supported for grants, or the override is at least logged with both role sets.
Lösung
The grants of a target element (<class>, <module>, <part>, <singleton>) are no longer a map keyed by the operation but an ordered list of access rules that is applied in sequence. Because configuration layers append to a list, an application's entries follow the framework's entries and never replace them.
- <grant operation="…" roles="…" inherit="…"/> adds the given roles to the operation (as before; existing configuration files are unchanged).
- <revoke operation="…" roles="…" inherit="…"/> removes the given roles from the operation. Without roles, the whole entry of the operation is removed, whichever rule contributed its roles: for an attribute this means that the attribute no longer restricts the operation and the decision of the class applies; for a type the operation is denied for every role until a later rule grants it again. A later layer can grant again after a revoke.
- Order of application: the module entries of a class (the additive baseline) are applied first, then the class's own entries in configuration order. Classes are evaluated generalization-first: a class starts with the roles its supertypes pass on. A <grant inherit="true"> adds to the roles passed on to specializations, a <revoke inherit="true"> removes from them; with inherit="false" only the exact type is affected. Attributes and singletons have no inheritance and simply apply their sequence.
Technically, AccessRightsConfig#getGrants() is a list of the abstract AccessRule (properties operation, roles, inherit) with the tagged subtypes AccessGrant (grant) and AccessRevoke (revoke). SecurityConfigurationService builds its lookup tables by applying the rules in the order described above. The specification specs/model-based-access-rights.md (sections 2.4.1, 2.4.2) is updated accordingly.
Verification: TestAccessRulesConfig (tl-core) reads two configuration layers and checks that the rules of both survive and that <revoke> is parsed. TestTLScriptSecurity (tl-model-search) runs the service on a second configuration layer that adds roles to the Project read grant, revokes roles on a specialization, revokes an attribute entry without roles, re-grants after a revoke and checks the inherit flag in both directions; the original rights of the first layer are asserted to be unchanged.
Migration
An application that declared a <grant> for an operation that a framework module already grants on the same type relied on replacing the framework's roles. Since grants are now additive, such an application keeps the framework's roles in addition to its own. To remove a framework role, add a <revoke operation="…" roles="…"/> in the application configuration; to replace the whole rule sequence of a type, use config:override="true" on the <class> element.
Code that calls AccessRightsConfig#getGrants() receives a List<AccessRule> instead of a map keyed by CommandGroupReference.