We have upgraded to the Build 8524 to solve an issue with CalDAV not connecting on macOS/iOS and with the upgrade we introduced new problems. I'm not seeing a significant difference in resource usage, though this is a rather new server in the cluster and is not having more than 1000 users yet.
But, there are some issues with the angularJS, which make the webmail interface unusable. The New e-mail window pops-up blank (the same happens when you click on Reply). The message heading is not visible (sender, recipient, date and other info). There is no download attachment option/button.
From what I see in the browser console, angular.js is blocked - due to Content Security Policy, and this results in getting 404 errors on some files, eg /interface/app/email/message-view-components/message-header.component.html. I tried to add headers with 'unsafe-eval', but this didn't solve the issue, but caused more errors.
I'm pasting error from the Chrome console:
Content Security Policy of your site blocks the use of 'eval' in JavaScript`
The Content Security Policy (CSP) prevents the evaluation of arbitrary strings as JavaScript to make it more difficult for an attacker to inject unathorized code on your site.
To solve this issue, avoid using eval(), new Function(), setTimeout([string], ...) and setInterval([string], ...) for evaluating strings.
If you absolutely must: you can enable string evaluation by adding unsafe-eval as an allowed source in a script-src directive.
⚠️ Allowing string evaluation comes at the risk of inline script injection.
1 directive
Source Location Directive Status
angular-v-100.0.8524…cc579df4200.js:1295 script-src blocked
I opened a ticket with the support yesterday, but I am not getting any answers yet. This is a major issue for us since lots of our customers use web interface exclusively.