Add patch-updates-docker-i18n.js, fix commercialization fallbacks, and consolidate CHANGELOG [Unreleased] so i18n:check passes across all 26 locales before dev→main.
Introduce bump-version.js with CI workflows for patch bumps on dev and
stable releases on main, plus panel and installer UI to choose stable vs
development GitHub update branches.
Added a new billing service and time synchronization functionality to the server. This includes the creation of billing packages, contracts, and sessions, along with necessary database migrations. Updated API endpoints for billing management and integrated billing checks into signal handling. Enhanced configuration options for billing parameters and added localization support for billing-related messages.
Added new localization strings for group membership actions, including "added to group" and "removed from group," across various language files. This enhancement improves user experience by providing clear feedback on group membership changes in the user's preferred language.
Added support for chat messages in the agent, including a new handler for processing incoming chat messages. Updated the configuration to include a chat message handler and integrated chat functionality into the UI, allowing users to send and receive messages seamlessly. Enhanced the user experience with a dedicated chat window and improved layout for better interaction.
Introduced a new pagination feature allowing users to select the number of devices displayed per page. Added a context menu for device actions, enhancing user interaction with device management. Updated the CSS for better layout and usability, including a floating horizontal scrollbar for improved navigation. This update aims to streamline the device management experience.
Add Go LDAP verify endpoint and probe it from the console when a local
user's password fails, so valid domain credentials return HTTP 409 with a
clear collision message instead of a misleading password mismatch. Includes
i18n for auth.username_collision across all console locales.
After RustDesk→BetterDesk migration, HTTP heartbeats can update last seen while
UDP signal registration is still missing. Show a distinct "No signal" badge,
document the two-channel presence model, and publish peer_online on registration.
The panel updater assumed a native install with Go source on disk. In
Compose/GHCR mode it now uses the embedded image commit, clears stale
binary markers, and directs operators to pull new container images instead.
- Introduced new localization strings for short download links and their hints in various languages.
- Added validation messages for short link requirements, including character restrictions and length constraints.
- Updated existing download link hints to inform users that old hex links will continue to function after changes to short links.
- Ensured consistency across all language files to enhance user experience and clarity in the interface.
Sync all 26 locale files to the EN+PL baseline (3432 keys), add OBSIDIAN tier strings, and ship i18n apply/audit tooling. Improve server attestation UX and convert orphaned node:test scripts to Jest so the full test suite passes.
- Introduced a new permission for server attestation, allowing users to run and view server performance attestations.
- Updated localization files in English and Polish to include descriptions for the new permission.
- Modified authentication middleware and various UI components to integrate the server attestation feature, ensuring proper access control and visibility in the sidebar.
- Enhanced the server attestation page to handle rendering and error management effectively.
- Swapped the descriptions for the 'platinum' and 'titanium' tiers in both English and Polish localization files to accurately reflect their connection capacities.
- Updated the tier descriptions to enhance clarity regarding server performance and infrastructure capabilities.
- Introduced server attestation functionality with performance benchmarking capabilities.
- Added new localization strings for server attestation in English and Polish.
- Updated authentication routes to include server attestation data on login.
- Enhanced desktop and standard login views to display attestation badge.
- Integrated server attestation link in the sidebar for easy access.
This feature provides users with insights into server performance and connection capacity.
- Improved logging in the device registration process to capture detailed enrollment information.
- Updated the enrollment token handling to ensure each device registers independently, eliminating the use of shared tokens.
- Introduced new API endpoints for managing help requests, allowing operators to acknowledge and resolve requests through the panel.
- Enhanced the generator routes to support the new help request functionality, improving overall API integration and user experience.
- Refactored the branding process to remove legacy enrollment token references, streamlining the support agent's configuration.
- Added new UI components and functionality for managing client builds, including a section for displaying build statuses and a button to rebuild all platform installers.
- Enhanced the generator routes to support rebuilding of bundles, including error handling for revoked bundles.
- Updated the agent build worker to facilitate the rebuilding process for platform builds associated with a specific bundle.
- Improved localization by adding relevant strings for build management in English and Polish language files.
- Introduced CSS styles for the new builds section to enhance visual presentation and user experience.
- Added audio stream handling to the agent, including support for audio start and stop messages.
- Introduced lifecycle callbacks for consent and session management in the agent configuration.
- Updated desktop handling to utilize new consent handler and session start/end callbacks.
- Improved UI to reflect enrollment status and consent requests, enhancing user experience.
- Refactored branding structure to include additional color properties for better theming.
Restore POST /api/peers/{id}/restore removed in a9e217c, add signal tests
that managed mode queues pending_device_* while locked does not, and move
RustDesk enrollment controls to Settings with full approval (folder, groups,
tag picker) wired through the registrations flow.
Expose global connection strategy in the web panel with systemd/Docker persistence, extend server health diagnostics, enforce org network policy in the signal handler, and document when relay fallback is expected vs misconfiguration.
Utils.api already unwraps API data, so the file list was always empty.
Add fixed paths for session secret, audit log, build.env, and Docker files.
Co-authored-by: Cursor <cursoragent@cursor.com>
Let server.config admins edit .env, blocklist, and systemd units from the
panel with backups on save and service restart via the existing updater.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add auth_provider attribute (local/ldap/oidc) to User model across SQLite and PostgreSQL with automatic migration (existing accounts default to local). Rewrite login to be provider-bound: LDAP-backed accounts never fall through to local password verification, OIDC accounts reject password login, and LDAP/OIDC provisioning stores an unusable random local password instead of the provider password. LDAP/OIDC accounts always re-apply provider role mapping on every login so a matching local account can no longer override AD-mapped permissions. Guard handleUpdateUser against setting a local password on non-local accounts. Propagate auth_provider through the Node.js sync layer and panel API, add a Provider column with badges in the users table, hide local password reset for provider-managed accounts, and add EN/PL i18n keys.
This commit was made possible thanks to Insolve.
Redesign the console backup into a complete .tar.gz disaster-recovery bundle that can be restored on a fresh machine to bring the entire server back online. Adds zero-dependency tar.gz writer/reader (backupArchive.js), logical dumpAllTables/importAllTables for SQLite and PostgreSQL, and packs the console database, auth.db, .env, .session_secret, branding uploads, and Go server identity (Ed25519 keys, .api_key, db_v2.sqlite3) plus a recovery README. Restore auto-detects archive vs legacy JSON snapshot, supports per-component selection (database/uploads/secrets/.env/Go DB) with restart-required signaling, and warns that the archive contains secrets. EN/PL/ZH i18n added.
This commit was made possible thanks to Insolve.
Add console wallpaper, login page branding (title/subtitle/background/footer), global agent download page branding, footer/copyright with 'Powered by BetterDesk' toggle, and custom CSS injection. Includes background image upload route (8MB), sanitization for colors/gradients/CSS, dynamic theme CSS for app and login pages, sidebar attribution, and EN/PL/ZH i18n keys.
This commit was made possible thanks to Insolve.
Implement RustDesk-desktop-style display switching and virtual display management in the web remote client.
- client.js: rewrite switchMonitor to send SwitchDisplay + CaptureDisplays messages with keyframe refresh; getMonitors marks primary (origin 0,0) and current display; add getCurrentDisplay, _processPeerInfo, _parseVirtualDisplaySupport, getVirtualDisplaySupport, toggleVirtualDisplay; switchDisplay receive handler tracks current display.
- remote.js: add i18n helper, peer_info/display_switched/virtual_display_toggled listeners, refreshMonitorButton; rewrite updateMonitorMenu with monitor list plus rustdesk_idd (4 checkboxes) and amyuni_idd (+/- counter) virtual display controls and plug-out-all.
- remote.css: styles for divider, active monitor/virtual items, counter controls.
- i18n: add virtual_displays, virtual_display, plug_out_all keys to en/pl/zh.
This commit was made possible thanks to Insolve.
Redesign the web remote toolbar into a RustDesk-style floating pill. The compact handle (move / fullscreen / expand) is always visible and the action pill no longer auto-opens on hover - it expands only on an explicit click of the expand button. The left handle drags the toolbar horizontally along one axis. The 'back to devices' control is now a button that closes the script-opened rdclient tab (re-focusing the opener) instead of navigating this tab to /devices, which previously spawned duplicate web-panel tabs. closeSession uses the same returnToDevices() helper. Adds move_toolbar/toggle_menu i18n keys (EN/PL/ZH) and an updated cross-platform feature matrix.
This commit was made possible thanks to Insolve.
Complete the web console locale set so all 26 language files share the EN/PL baseline with no missing keys, extra keys, empty values, or English fallback values.
Keep strict i18n audit behavior and disabled auto-fix flow so incomplete translations are surfaced for manual review instead of being filled with English fallback text.
Validated with the strict web-nodejs i18n audit, JSON parsing for all locale files, placeholder preservation checks, and VS Code diagnostics.
This commit was made possible thanks to Insolve.
Bump golang.org/x/crypto to v0.52.0 and x/sys to v0.45.0 in betterdesk-server, x/sys to v0.45.0 in betterdesk-agent, and aiohttp to >=3.10.11 in the rest-webhook bridge. Validated clean via govulncheck.
Add an explicit Go server rebuild path to the in-app updater so security/library updates actually reach the running binary: updateService now marks the server binary stale when the source changed but a non-critical rebuild/deploy step failed, exposes getServerBinaryStatus() and rebuildServerBinary(), and surfaces a warning banner plus a Rebuild button in the settings update panel. New REST endpoints GET/POST /api/settings/updates/server-binary/{status,rebuild} guarded by server.config permission. i18n keys added across all locales.
This commit was made possible thanks to Insolve.
Add a codec selector (Auto/VP9/AV1/H264/VP8/H265) to the remote viewer display menu so users can request a GPU-friendly codec from the peer. setCodec() re-advertises SupportedDecoding abilities with the chosen prefer codec via OptionMessage and forces a fresh keyframe. Browser decode abilities are probed (VideoDecoder.isConfigSupported) and unsupported codecs are disabled in the menu and advertised honestly at login. Raise default image quality from Balanced to Best at both client-creation sites and pause adaptive auto-quality once the user makes a manual quality/codec choice so it no longer overrides them.
This commit was made possible thanks to Insolve.
Add a device verification/enrollment workflow so new registrations are
held for operator review instead of connecting silently.
Go server (signal + api):
- Signal-mode pending: in 'managed' mode, unknown stock RustDesk clients
are queued (pending_device_<id>) instead of being silently rejected.
- Rich approve: handleApproveDevice accepts display_name, sync_mode and
normalized tags; handleRejectDevice supports an optional ban.
Node.js console:
- registrations.ejs approve modal (name, sync mode, tags, folder) and
reject modal with ban option; betterdeskApi + routes wire display_name,
sync_mode, tags and folder assignment through to the Go server.
- EN/PL/ZH i18n for all new strings.
Installers (managed default for FRESH installs only; existing installs
stay on the Go default 'open' or their DB-persisted mode):
- betterdesk.sh / betterdesk.ps1 write ENROLLMENT_MODE=managed to the
server env only when no existing database is detected (FRESH_INSTALL).
- Docker single + multi container entrypoints detect fresh volumes via a
sentinel plus id_ed25519/db_v2.sqlite3 presence and default to managed;
ENROLLMENT_MODE is now passed through supervisord and all compose files.
This commit was made possible thanks to Insolve.
Privilege separation across all installers so the long-running services no longer run with full administrative rights:
betterdesk.sh: installer keeps root but systemd units now run as a dedicated unprivileged 'betterdesk' system account by default (auto-created via ensure_service_user). Added full systemd hardening for the Go server (NoNewPrivileges, ProtectSystem=strict, ProtectHome, PrivateTmp, ReadWritePaths) and light hardening for the Node.js console. chown migrates existing root-owned data to the service account on update. Opt-out via --run-as-root / BETTERDESK_RUN_AS_ROOT=1; custom account via BETTERDESK_SERVICE_USER. Minimal mode covered too.
betterdesk.ps1: NSSM services now run under their per-service low-privilege virtual accounts (NT SERVICE\<service>) instead of LocalSystem, with scoped icacls grants on the install/data dirs (Set-ServiceLeastPrivilege helper). Applied to the Go server, Node.js console and minimal-mode service. Opt-out via -RunAsRoot / BETTERDESK_RUN_AS_ROOT=1.
Docker: verified already privilege-separated (supervisord drops both programs to user=betterdesk; multi-container images drop via su-exec).
Also bundles in-progress changes to the Go server API, Node.js console services and Docker compose/Dockerfiles.
This commit was made possible thanks to Insolve.
- Updated Polish and Chinese language files to reflect changes in update descriptions and confirmations.
- Modified settings.js to automatically include server updates in the update process.
- Simplified the update installation API to automatically handle server updates without user intervention.
- Improved updateService.js to ensure all supported components are updated together, enhancing reliability.
- Added logic to check and install the Go toolchain as needed during updates, ensuring compatibility.
- Enhanced error handling and logging during the update process for better visibility of issues.
Make device group edit/delete actions visible, add direct user-group management entry points from the device group ACL modal, and allow device group editors to load user groups for ACL assignment.
Refs #140.
- Implemented user groups creation, editing, and deletion features.
- Added API endpoints for managing user groups: create, update, and delete.
- Enhanced user interface with a dedicated user groups manager section.
- Updated translations for user groups related strings in multiple languages.
- Improved CSS styles for user groups display and actions.
- Added tests for user groups API functionality.
- Added user group membership functionality, allowing users to be assigned to groups.
- Introduced validation for group GUIDs and enhanced error handling in user routes.
- Updated device group routes to support allowed user groups, enabling better access control for devices.
- Enhanced database schema to include user group memberships and device group user group access.
- Updated services and database adapters to handle user group data and relationships.
- Modified front-end views to display and manage user groups effectively.
- Added tests to ensure proper functionality of user group assignments and device access control.
Address the follow-up feedback on #136 about the user-management UX
feeling disjointed and using non-standard role labels:
- Rename the base organization role from "Viewer"/"User" to
"Member" across all 26 locales. This removes the vocabulary
collision with the server-wide "Viewer" role and makes the
two-axis role model (server role vs per-org role) clearer.
- Add an Organizations column to the System > Users table so
admins can see each user's org memberships at a glance without
opening a modal. Badges are clickable and reopen the existing
Organizations modal for that user.
- Clarify the Add/Edit User form: the role dropdown is now
labelled "Server Role" with a hint that per-organization roles
are configured separately under each user's Organizations.
- The Organizations modal now has an explicit section heading and
a short hint, and uses i18n labels for the role dropdown with
an aria-label so the org role is visually distinct from the
server role.
Backend role values are unchanged ("user"/"operator"/"admin"/
"owner" for orgs, existing 7 server roles), so this is a pure
UX/i18n change with no schema or API impact.
Refs: #136
Suggested-by: Sterlyn Kong <68391309+SterlynKong@users.noreply.github.com>
Complete Czech console translation from PR #133, update Docker quick-start admin credential lookup from PR #134, and fix live device-status updates found while reviewing PR #35.
Refs: #133, #134, #35
Co-authored-by: Karel Lowprize K <lowprize@gmail.com>
Suggested-by: Rafael Monteiro <96262868+rafaelgm@users.noreply.github.com>
- Implemented server management service providing resource snapshots, file browser, service control, and audit logging.
- Added terminal proxy for WebSocket-backed PTY, allowing browser-based shell access with user authentication and role-based access control.
- Created server management view with tabs for overview, terminal, file management, and services, including UI elements for displaying system metrics and managing files/services.
Co-authored-by: Copilot <copilot@github.com>
UNITRONIX