Honor PunchHole Failure=#405 even when relay_server is set; inject /api/health connection snapshot into /remote for timeouts; keep force_relay and bump BetterDesk-Web/1.4.9.
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Prefer verified GitHub Actions or exact Release binaries during native updates, with checksum validation and local compilation fallback. Defer Support Agent source synchronization and rebuild queueing until after the console restart.
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Expose pending LAN and managed enrollment requests in the UX 3.5 notification center, synchronize badges through authenticated panel events with polling fallback, and refresh the registrations view automatically. Also include the pending relay transport fixes already present in the working tree.
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Reject POST/PATCH /api/users before mutating when peer grant or strategy
assignment DB methods are absent; return refreshed scope on PATCH; warn
on unknown peerIds; add facade parity and scope regression tests.
Refs #380
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Keys QR now uses the same Dashboard client-host override, and both modals warn when the payload embeds localhost/loopback/.local so phones are not misled after the encoding fix.
Refs #368
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Match rustdesk://config/ path to Copy deploy string so ServerConfig.decode accepts the QR (#368). Also align MFA otpauth URI with Go (issuer BetterDesk, 20-byte secret) and document Android 1.4.9 deep-link fallback in UI hints.
Refs #368
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Combine LAN + managed enrollment in /api/registrations/count so the sidebar badge works on all pages. Backfill orphan rejected_device_* IP from peers when available.
Refs #351
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Store unattended presets AES-256-GCM in org_peer_credentials (main DB),
admin Set/Clear in Organizations Address Book, runtime inject into
GET /api/ab and Web Remote connect-password auto-fill. Secrets never
persist in shared AB JSON.
Refs #367
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
- Updated PowerShell command invocations to use `-WindowStyle Hidden` to prevent visible console windows during clipboard operations and other commands.
- Implemented GDI-based screenshot capture to eliminate the need for PowerShell, reducing console window spamming during desktop capture.
- Enhanced error handling for missing OpenGL DLLs and ensured complete Mesa DLL set is shipped with the agent to prevent startup issues.
- Updated build scripts to ensure proper installation of required tools and dependencies for Windows builds.
- Implemented logic to reissue incomplete or expired signed Support Agent profiles during rebuilds, preventing operators from getting stuck in retry loops.
- Updated `build.sh` to handle the absence of `branding.pub` more gracefully, ensuring it doesn't fail on fresh workspaces.
- Refactored branding functions to utilize a dedicated support profile service, improving code organization and maintainability.
- Added tests to verify the correct behavior of version injection and support profile validity checks.
LAN/IP bundles can use plaintext HTTP/WS like RustDesk while session crypto stays on the protocol layer; enrollment no longer treats a second same-request proof check as a nonce replay.
- Updated session control mechanisms to ensure proper handling of remote input and clipboard operations.
- Introduced session authorization checks to validate operator permissions before starting desktop sessions.
- Improved input injection logic to prevent unauthorized access during active sessions.
- Added new capabilities for managing session flags and controls, ensuring a more robust and secure desktop experience.
- Enhanced error handling and logging for better traceability of session-related actions.
- Added functionality for safely consolidating legacy auth.db into the selected SQLite database, with options for dry runs and rollbacks.
- Introduced command-line flags for SQLite auth consolidation, including backup directory and rollback options.
- Enhanced admin interface security by requiring a password when the admin port is enabled, preventing unauthorized access.
- Updated related tests to ensure proper handling of admin password requirements and relay authorization logic.
Approved/Rejected filters were empty for Go enrollments because decisions were discarded; reject also left an irreversible lock with no Devices → Banned row when the peer did not exist yet.
- Added support for various remote control features in the Support Agent, including file transfer, in-session chat, remote audio, and control actions (lock/restart).
- Introduced capability flags for incoming session features, allowing for more granular control over permissions.
- Updated documentation to reflect the new Support Agent functionalities and connection resilience improvements, including fallback mechanisms for API endpoints.
- Enhanced the build process with optional branding sealing and improved error handling for Docker configurations.
Restrict GET /api/ab peers/tags to device-group scope and migrate upgraded
SQLite users tables off the pre-Phase-52 role CHECK so console sync works.
Refs #342.
Reject placeholder/invalid id_ed25519.pub values in Dashboard client config, prefer live Go /api/server-key, and set PUB_KEY_PATH in Windows NSSM console env.
Bring stable signal outbound gate hardening (initiator_pending_enrollment),
Web Remote SignedId verify, and open-issue hotfixes onto dev while keeping
the 3.4.13 development version baseline.
Reload id_ed25519.pub per viewer render and verify RelayResponse.pk then SignedId with the correct RustDesk key chain so base64 Keys work; desktop signature-mismatch without Key remains expected config.
Prevent false UI success when Go refuses deleting the last Super Admin on dual-SQLite; mirror before local delete and keep installer admin reset unchanged.
Panel Redirect URLs on :5000/:5443 used to 404, so auth-query never completed. Proxy the callback to Go, validate the path in Settings, and document the fix.
Skip mirrorCreate on shared Postgres, block 409→create recursion, COALESCE totp_secret on Go ListUsers, and return username_exists on DB unique violations.
Store PUBLIC_* on the console-data volume so panel settings survive compose recreate; keep Compose env override and .env mirror for IaC and bare-metal.
Temporary opaque links give guests a minimal Web Remote UI for selected devices only, without Console inventory or add-any-ID paths. Also fix mesh_share desktop tunnel auth for unauthenticated guests.
Default C:\BetterDeskConsole installs no longer treat C:\ as the project root, so installer file writes and SHA tracking succeed; NSSM Access Denied on server restart is non-critical.
- Updated .gitignore to include new binary paths and retain .gitkeep.
- Modified Gitleaks configuration to ignore additional directories.
- Adjusted CI workflows to prevent execution on version bump pushes and improved version bump handling in scripts.
- Bumped BetterDesk Console Manager version to 3.3.136 in betterdesk.sh and related scripts.
Commit web-nodejs lockfile with tar override; CI uses npm ci and moderate npm audit.
Add LOG_LEVEL filtering and log redaction in Node console and Go server.
Validate WS tokens on bd-signal; require single-use token for remote-agent relay.
Limit active relay sessions per IP and block open enrollment without TLS.
- Implemented input validation for `orgId` and `deviceId` in CDAP and organization detail routes using `assertSafeApiId`, returning a 400 error for invalid inputs.
- Added HTML escaping for `deviceId` and `orgId` in views to prevent XSS vulnerabilities.
- Hardened `patch-role-scope-i18n.js` against prototype pollution with a guard for unsafe nested keys.
- Updated CodeQL configuration to include new exclusions and ensure documented exclusions are applied.
Fixes#242. Replace 24h JWT-only client tokens with configurable DB sessions (default 7 days, sliding renewal up to 30 days) and panel settings under Authentication -> RustDesk clients.
- Updated billing contract structure to support multiple target types (organization, device group, folder, device).
- Refactored API handlers to accommodate new billing contract model, including creation, deletion, and listing functionalities.
- Enhanced database interactions for billing contracts, ensuring backward compatibility with legacy billing_org_contracts.
- Added new billing statistics endpoint to provide insights on active sessions and expiring contracts.
- Improved error handling and validation in billing package management.
Stop uppercasing custom IDs in the web console and redirect stale client heartbeats to the panel-assigned successor ID so the Go backend and panel stay in sync after a rename.
- Resolved issues with panel tabs redirecting to the dashboard on 401 errors by allowing browser requests without Bearer tokens to fall through to panel handlers.
- Extended the rate limit whitelist for Devices/Users API endpoints to prevent 429 errors during high load.
- Introduced a new rate limiter for desktop layout preference saves, ensuring session-authenticated writes are managed effectively.
- Implemented staggered loading for API requests on the Devices page to optimize performance and reduce rate limit bursts.
- Updated relevant tests to cover new fallthrough behavior and rate limiting logic.
- Updated server admin navigation to allow access to sidebar pages based on `server.config`, removing reliance on legacy roles.
- Improved error handling for forbidden access by rendering the correct 403 error page.
- Adjusted role checks to include `server_admin` in the admin access requirements.
- Cleared stale desktop mode state on load to improve user experience.
Add folder/direct-device/strategy assignment from User Management, clearer Pro vs Remote Operator labeling, optional restricted device scope mode, and Go/Node scope parity.
Knienartowicz