6 Commits

Author	SHA1	Message	Date
UNITRONIX	04fcf1524a	fix(signal): wire MASK into LAN peer subnet detection ... MASK/-mask was loaded and documented but never used; LAN checks always compared the first three IPv4 octets. Parse the CIDR once and use it in isSameNetwork and LAN-relay reachability, keeping /24 when MASK is empty or invalid. Refs #404 Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)	2026-09-05 21:01:49 +02:00
UNITRONIX	cef2ab7c8e	fix(signal): close shared-NAT RelayResponse gaps and add opt-in initiator ... Correlate RelayResponse via pending UUID/initiator store and panel CIDRs; stop FindByIP ticket misdelivery. Opt-in ALLOW_SHARED_NAT_INITIATOR for stock multi-device CGNAT without peer identity inheritance. Refs #399 Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)	2026-09-03 21:25:50 +02:00
UNITRONIX	ed96e94806	refactor(agent): enhance session management and input handling ... - Updated session control mechanisms to ensure proper handling of remote input and clipboard operations. - Introduced session authorization checks to validate operator permissions before starting desktop sessions. - Improved input injection logic to prevent unauthorized access during active sessions. - Added new capabilities for managing session flags and controls, ensuring a more robust and secure desktop experience. - Enhanced error handling and logging for better traceability of session-related actions.	2026-08-06 00:50:02 +02:00
UNITRONIX	667664cd47	fix(peer): implement FindAllByIP for outbound initiator authorization ... Add FindAllByIP method to retrieve all peers sharing the same public IP, enabling safe fallback for authorization when exact ip:port is unavailable. Update related logic in requireAuthorizedInitiator to handle single live peer scenarios and prevent identity inheritance in ambiguous cases. Adjust tests to cover new functionality and edge cases.	2026-08-05 22:42:22 +02:00
UNITRONIX	cace557dfc	fix(signal): block same-NAT pending outbound initiator impersonation ... Authorize PunchHole/RequestRelay by exact ip:port, TCP session, token, or panel proxy — not bare FindByIP — so unapproved enrollment clients cannot inherit an approved peer identity. Refs #302	2026-08-03 23:15:22 +02:00
UNITRONIX	e855f5786d	Add Go server and security audit; update web console ... Add a new betterdesk-server Go codebase (server, api, auth, db, relay, signal, metrics, audit, ratelimit, proto, tools, tests) and related deployment/migration scripts. Add a comprehensive SECURITY_AUDIT_2026-03-01 report and .gitattributes; update copilot-instructions (ALL-IN-ONE v2.4.0), README, VERSION, Dockerfiles, scripts, docker-compose and entrypoint. Large updates to web-nodejs (translations, routes, services, frontend assets and middleware) and numerous new utilities; remove legacy Flask web files and archive hbbs-patch-v2 artifacts. Prepares repository for PostgreSQL support, DB migration tooling and the new Go server as the production backend.	2026-03-02 00:43:04 +01:00