Updated CodeQL configuration to exclude additional paths for security checks. Introduced a new file access rate limiter to prevent abuse of file download endpoints. Improved path resolution functions to ensure confined access and added validation in body scalar functions to reject non-scalar types. Enhanced error handling in API endpoint validation to prevent invalid inputs.
Added detailed instructions for configuring Nginx Proxy Manager and other reverse proxies with Docker for RustDesk WSS endpoints. Included troubleshooting tips and diagnostic commands to assist users in resolving common issues related to WebSocket connections and TLS configurations.
Enhance the update process by ensuring stale results are cleared when the local SHA matches the target SHA, and refine the logic to filter out non-critical failures. This update also improves the update service's remote SHA retrieval and integrates it with the new result display logic.
Fixes#192 — script and GHCR update flows now drop data/.last_update_result.json
the same way betterdesk.sh already does, so a failed in-panel attempt no longer
sticks around after a successful external update.
- Added functionality to clear stale update results when the local SHA matches the target SHA, preventing unnecessary warnings in the panel.
- Enhanced the update result persistence logic to filter out non-critical failures, ensuring only actionable errors are displayed.
- Updated the update service to handle remote SHA retrieval and integrate with the new result display logic.
- Improved tests for the update result handling to cover new behaviors and ensure reliability.
Add patch-updates-docker-i18n.js, fix commercialization fallbacks, and consolidate CHANGELOG [Unreleased] so i18n:check passes across all 26 locales before dev→main.
Centralize path-segment validation in goApiProxy for fleet/commercialization/cross-platform routes while preserving RustDesk peer ID compatibility; sanitize panel JS output and cap audit Recent queries.
Add goApiPath guard on betterdeskApi axios requests, sanitize org/device
IDs in policy routes, and confine server-management directory listings
with resolveChildPath.
Stop logging generated admin passwords, redact API login usernames,
confine font and file-transfer temp paths with safePath, and scope
GitHub Actions permissions in build.yml.
After deleting dev-only i18n scripts from the repo, post-update repair
was still trying to fetch them from GitHub (404). Exclude removed paths
from repair seeds and delete root-level script files on removal.
Keep apply-i18n-audit and regional patch data for low-cost locale
maintenance without shipping dev scripts to production consoles.
Add collect-gap-keys to regenerate gap-fill input from i18n-check.
UNITRONIX