A new organization's folder holds none of the platform's backgrounds, stylesheet or config

FixSecurityService
Shipped
September 12, 2026 at 7:35 AM UTC
Author
Kamo
Commit
6331eb4

Provisioning copied the whole base theme into every new organization's folder, KamoCRM's three sign-in photographs included. They sat at img/bg/1-3.webp under the org's own address until it had uploaded enough of its own to overwrite them, so the first background a new owner saved on Behavior & Labeling was shown as KamoCRM's photograph (the page asked for slot 1 before provisioning had replaced it), and every surface that probes the slots without reading the count showed them all along. The copied stylesheet and config.json were the other half. writeConfigFiles published config.json before the stylesheet, and the creation wizard opens the new workspace as soon as config.json exists, so a new org could open in the template's placeholder brown and olive instead of the colours chosen for it. An org with no saved colours kept those placeholders for good, and one that saved only a primary kept the olive secondary. - copyFolder never seeds img/bg/*, css/globals.css or json/config.json. - writeConfigFiles renders every colour variable from one palette (the org's own; missing shades derived as creation derives them; an unsaved ramp is the one Behavior & Labeling shows), uses it for config.json's colours and the logo overlays too, and writes config.json LAST. - provisionFull no longer abandons the stylesheet and config when favicon generation fails. - ThemeSeedBackfillService (boot, after the stand-ins) deletes seed-identical backgrounds past each org's count and repaints seed-identical stylesheets. On 2026-09-12 that is veraid-insurance and 122-23 (active) plus five voided orgs; 122-23 and popeyes carried the placeholder palette.

All changes

Like what you see shipping?

Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.

Start Free ForeverView Pricing