some big beautiful update

application/Espo/Tools/App/SettingsService.php

@@ -56,6 +56,15 @@ use stdClass;
 
 class SettingsService
 {
+    /**
+     * @var string[]
+     * @todo Do not use when these parameters moved away from the settings.
+     */
+    private array $ignoreUpdateParamList = [
+        'loginView',
+        'loginData',
+    ];
+
     public function __construct(
         private ApplicationState $applicationState,
         private Config $config,
@@ -87,11 +96,22 @@ class SettingsService
         $this->filterData($data);
         $this->loadAdditionalParams($data);
 
+        /** @noinspection PhpDeprecationInspection */
+        $metadataData = $this->getMetadataConfigData();
+
+        foreach (get_object_vars($metadataData) as $key => $value) {
+            $data->$key = $value;
+        }
+
         return $data;
     }
 
     /**
      * Get metadata to be used in config.
+     *
+     * @todo Make private in v9.4.0.
+     * @todo Move away from settings. Use some different approach.
+     * @deprecated Since v9.3.2.
      */
     public function getMetadataConfigData(): stdClass
     {
@@ -208,6 +228,7 @@ class SettingsService
         }
 
         $ignoreItemList = array_merge(
+            $this->ignoreUpdateParamList,
             $this->access->getSystemParamList(),
             $this->access->getReadOnlyParamList(),
             $this->isRestrictedMode() && !$user->isSuperAdmin() ?

application/Espo/Tools/Email/Api/PostSendTest.php

@@ -38,8 +38,10 @@ use Espo\Core\Exceptions\BadRequest;
 use Espo\Core\Exceptions\Error;
 use Espo\Core\Exceptions\Forbidden;
 use Espo\Core\Exceptions\NotFound;
+use Espo\Core\Mail\Account\Util\AddressUtil;
 use Espo\Core\Mail\Exceptions\NoSmtp;
 use Espo\Core\Mail\SmtpParams;
+use Espo\Core\Utils\Security\HostCheck;
 use Espo\Entities\Email;
 use Espo\Tools\Email\SendService;
 use Espo\Tools\Email\TestSendData;
@@ -51,7 +53,9 @@ class PostSendTest implements Action
 {
     public function __construct(
         private SendService $sendService,
-        private Acl $acl
+        private Acl $acl,
+        private HostCheck $hostCheck,
+        private AddressUtil $addressUtil,
     ) {}
 
     /**
@@ -109,6 +113,13 @@ class PostSendTest implements Action
                 ->withAuthMechanism($authMechanism);
         }
 
+        if (
+            !$this->addressUtil->isAllowedAddress($smtpParams) &&
+            !$this->hostCheck->isNotInternalHost($server)
+        ) {
+            throw new Forbidden("Not allowed internal host.");
+        }
+
         $data = new TestSendData($emailAddress, $type, $id, $userId);
 
         $this->sendService->sendTestEmail($smtpParams, $data);

application/Espo/Tools/GlobalSearch/Service.php

@@ -113,7 +113,7 @@ class Service
             $builder->order('relevance', Order::DESC);
         }
 
-        $builder->order('order', Order::DESC);
+        $builder->order('order');
         $builder->order(Field::NAME);
 
         $unionQuery = $builder->build();

application/Espo/Tools/LinkManager/LinkManager.php

@@ -855,7 +855,9 @@ class LinkManager
                 "links.$link",
             ]);
 
-            $this->metadata->delete('clientDefs', $entity, ["dynamicLogic.fields.$link"]);
+            $this->metadata->delete('logicDefs', $entity, [
+                "fields.$link",
+            ]);
 
             $this->metadata->save();
 
@@ -907,8 +909,13 @@ class LinkManager
                 ->build();
         }
 
-        $this->metadata->delete('clientDefs', $entity, ["dynamicLogic.fields.$link"]);
-        $this->metadata->delete('clientDefs', $entityForeign, ["dynamicLogic.fields.$linkForeign"]);
+        $this->metadata->delete('logicDefs', $entity, [
+            "fields.$link",
+        ]);
+
+        $this->metadata->delete('logicDefs', $entityForeign, [
+            "fields.$linkForeign",
+        ]);
 
         $this->metadata->delete('entityDefs', $entity, [
             "fields.$link",