Updated CodeQL configuration to exclude additional paths for security checks. Introduced a new file access rate limiter to prevent abuse of file download endpoints. Improved path resolution functions to ensure confined access and added validation in body scalar functions to reject non-scalar types. Enhanced error handling in API endpoint validation to prevent invalid inputs.
Fixes#192 — script and GHCR update flows now drop data/.last_update_result.json
the same way betterdesk.sh already does, so a failed in-panel attempt no longer
sticks around after a successful external update.
- Added functionality to clear stale update results when the local SHA matches the target SHA, preventing unnecessary warnings in the panel.
- Enhanced the update result persistence logic to filter out non-critical failures, ensuring only actionable errors are displayed.
- Updated the update service to handle remote SHA retrieval and integrate with the new result display logic.
- Improved tests for the update result handling to cover new behaviors and ensure reliability.
Add patch-updates-docker-i18n.js, fix commercialization fallbacks, and consolidate CHANGELOG [Unreleased] so i18n:check passes across all 26 locales before dev→main.
Centralize path-segment validation in goApiProxy for fleet/commercialization/cross-platform routes while preserving RustDesk peer ID compatibility; sanitize panel JS output and cap audit Recent queries.
Add goApiPath guard on betterdeskApi axios requests, sanitize org/device
IDs in policy routes, and confine server-management directory listings
with resolveChildPath.
Stop logging generated admin passwords, redact API login usernames,
confine font and file-transfer temp paths with safePath, and scope
GitHub Actions permissions in build.yml.
After deleting dev-only i18n scripts from the repo, post-update repair
was still trying to fetch them from GitHub (404). Exclude removed paths
from repair seeds and delete root-level script files on removal.
Keep apply-i18n-audit and regional patch data for low-cost locale
maintenance without shipping dev scripts to production consoles.
Add collect-gap-keys to regenerate gap-fill input from i18n-check.
Hardened installs could not replace betterdesk-server in /opt/rustdesk
from Settings → Updates. Add a validated sudo deploy helper, extend
console update sudoers, and sync privileges before server deploy.
Fixes#183
RustDesk 1.4.x filters Available Devices locally by exact
device_group_name match; only folder names were set before, so manual
panel groups appeared in the sidebar but showed zero peers. Also align
the TOTP login challenge with RustDesk 1.4.7 (email_check/tfa_check).
UNITRONIX