- Added a dedicated login page for the Remote Desktop client, allowing operators to sign in when their session expires.
- Implemented safe return URL handling for the login process.
- Updated authentication middleware to support RdClient-specific routes and permissions.
- Enhanced localization support for the new login feature across multiple languages.
- Improved user experience by redirecting to the appropriate pages based on authentication status.
- Introduced a new glass surface effect for cards, modals, and forms, enhancing the UI with a frosted glass appearance.
- Added localization strings for the glass surface feature in multiple languages.
- Implemented settings for enabling/disabling the glass effect, adjusting color, blur, and opacity through the settings interface.
- Updated CSS variables to support the new glass surface styling.
- Added a modular studio layout with a live preview panel, autosave, server-side appearance profiles, and a built-in theme gallery.
- Expanded Google Fonts picker and enabled custom font uploads (woff2/ttf).
- Updated the appearance tab for real-time changes without full page reloads and introduced a read-only mode for users without edit permissions.
- Improved localization by updating language files with new strings for branding and appearance features.
- Added session management features to synchronize media capture and input handling across active tabs.
- Updated audio handling to respect session activity and mute states.
- Improved clipboard functionality to only allow copying to local clipboard from the active session.
- Refactored input capture logic to ensure it only activates for the active viewer tab.
- Introduced a new `syncSessionMediaCapture` function to manage media input across sessions.
- Introduced email notifications for help requests, allowing operators assigned to device folders or groups to receive alerts.
- Moved SMTP configuration to **Settings → Email**, including options for host, credentials, and alert email.
- Updated console layout for better usability and removed legacy SMTP automation tab.
- Added `nodemailer` as a dependency for email handling.
Use plainBodyObject() for device file read API to avoid array .length
tampering; rate-limit ticket DELETE; document intentional sanitizers in
codeql-config.yml for branding, fonts, network monitor, and server paths.
Refs #196
Translate Organizations device-groups UI across all locales, consolidate [Unreleased] notes for 3.3.0, and copy VERSION into native console paths (#192).
Updated CodeQL configuration to exclude additional paths for security checks. Introduced a new file access rate limiter to prevent abuse of file download endpoints. Improved path resolution functions to ensure confined access and added validation in body scalar functions to reject non-scalar types. Enhanced error handling in API endpoint validation to prevent invalid inputs.
Fixes#192 — script and GHCR update flows now drop data/.last_update_result.json
the same way betterdesk.sh already does, so a failed in-panel attempt no longer
sticks around after a successful external update.
- Added functionality to clear stale update results when the local SHA matches the target SHA, preventing unnecessary warnings in the panel.
- Enhanced the update result persistence logic to filter out non-critical failures, ensuring only actionable errors are displayed.
- Updated the update service to handle remote SHA retrieval and integrate with the new result display logic.
- Improved tests for the update result handling to cover new behaviors and ensure reliability.
Centralize path-segment validation in goApiProxy for fleet/commercialization/cross-platform routes while preserving RustDesk peer ID compatibility; sanitize panel JS output and cap audit Recent queries.
Add goApiPath guard on betterdeskApi axios requests, sanitize org/device
IDs in policy routes, and confine server-management directory listings
with resolveChildPath.
Stop logging generated admin passwords, redact API login usernames,
confine font and file-transfer temp paths with safePath, and scope
GitHub Actions permissions in build.yml.
After deleting dev-only i18n scripts from the repo, post-update repair
was still trying to fetch them from GitHub (404). Exclude removed paths
from repair seeds and delete root-level script files on removal.
Hardened installs could not replace betterdesk-server in /opt/rustdesk
from Settings → Updates. Add a validated sudo deploy helper, extend
console update sudoers, and sync privileges before server deploy.
Fixes#183
RustDesk 1.4.x filters Available Devices locally by exact
device_group_name match; only folder names were set before, so manual
panel groups appeared in the sidebar but showed zero peers. Also align
the TOTP login challenge with RustDesk 1.4.7 (email_check/tfa_check).
Introduce bump-version.js with CI workflows for patch bumps on dev and
stable releases on main, plus panel and installer UI to choose stable vs
development GitHub update branches.
Security update H-7 runs the console as User=betterdesk, which cannot bind
ports below 1024 without CAP_NET_BIND_SERVICE. Fall back to high ports at
startup, add the capability to systemd when .env uses :443/:80, and handle
EACCES on listen without an unhandled process crash.
Added a new API endpoint to retrieve the last update result, enhancing the user interface by displaying detailed error messages for failed updates. Improved the update completion modal to reflect the status of services and console restarts, ensuring users are informed of any issues. Updated the settings JavaScript to load and display the last update result dynamically, improving overall user experience during updates.
Introduced a new function, isResolvedByIndexModule, to determine if a local path is resolved by an index module. This enhancement allows the repair process to skip phantom routes when an index.js file exists, improving the accuracy of the console file repair logic. Added corresponding tests to validate this behavior.
Enhanced the update process to better manage console restarts by checking for blocked permissions before attempting a restart. Added logic to handle cases where console service user permissions are not verified, ensuring that appropriate messages are logged and the update phase is accurately reflected. Updated the console restart scheduling to occur after the response is sent, improving overall reliability. Additionally, modified the comment handling in the dependency scanning process to ignore requires within comments.
GitHub compare returns at most 300 changed files, so in-app panel updates could
deploy updated routes without new service modules (e.g. serverAttestation.js).
Add full web-nodejs tree sync on truncated diffs and repair missing local require
targets after incremental console updates.
Add Go LDAP verify endpoint and probe it from the console when a local
user's password fails, so valid domain credentials return HTTP 409 with a
clear collision message instead of a misleading password mismatch. Includes
i18n for auth.username_collision across all console locales.
Existing Docker volumes crashed at startup because ensureAuthTables indexed
token_hash before the column existed on upgraded auth.db files. Bump images to 3.0.0.
RustDesk 1.4.7 stops AB init when POST /api/ab/personal returns 400 on the
legacy probe; respond with 404, tolerate empty POST bodies, raise proxy AB
limits to 512KB, and accept POST /api/peers/list.
Fixes#167, #169
Web remote was encoding Auth2FA under auth2Fa, which protobuf.js drops as an
empty message, so RustDesk peers never received the TOTP code after Verify.
Use npm install without a lockfile in CI, treat root-owned installer scripts as non-critical update failures, and skip privileged H-7 hooks when betterdesk already exists without sudo.
Hash RustDesk access tokens at rest (phase 1), add SSRF guards for admin network tools with LAN monitoring support, run dedicated console service user on Linux, and hook post-update verification plus service patching into both betterdesk.sh and the in-app updater.
The panel updater assumed a native install with Go source on disk. In
Compose/GHCR mode it now uses the embedded image commit, clears stale
binary markers, and directs operators to pull new container images instead.
- Introduced new localization strings for short download links and their hints in various languages.
- Added validation messages for short link requirements, including character restrictions and length constraints.
- Updated existing download link hints to inform users that old hex links will continue to function after changes to short links.
- Ensured consistency across all language files to enhance user experience and clarity in the interface.
Sync all 26 locale files to the EN+PL baseline (3432 keys), add OBSIDIAN tier strings, and ship i18n apply/audit tooling. Improve server attestation UX and convert orphaned node:test scripts to Jest so the full test suite passes.
Do not auto-convert an existing local account if Go authenticates the same
username via LDAP/OIDC. Treat it as a collision and require admin action,
preventing potential privilege confusion when names overlap.
Repair the Node.js panel auth path so LDAP/OIDC users get the correct
provider and role from Go: forward authProvider in the database facade,
export syncUserFromGo, enforce provider-bound login, use unusable hashes
for external accounts, block panel edits of IdP-managed users, and
reconcile provider/role via Go API on PostgreSQL.
- Added a new method to check if the agent has an active CDAP session, improving connection status reporting.
- Updated the SendHelpRequest function to utilize the engine for sending help requests, enhancing the request handling process.
- Refactored health check methods to include the Go management API, replacing the console health checks for better integration.
- Improved branding logo handling by introducing a PNG validation function, ensuring only valid images are used.
- Updated UI elements and localization strings to reflect changes in API endpoints and improve user experience.
- Added functionality to track the remote SHA of the agent source, improving consistency during updates.
- Implemented a new method to sync the full support-agent source from GitHub, ensuring all necessary files are staged for rebuilds.
- Introduced a mechanism to check for agent source drift, allowing for automatic repairs when discrepancies are detected.
- Updated the update service to trigger agent source synchronization and rebuilds based on specific file changes, streamlining the update workflow.
- Implemented a conditional staging process for the Go support-agent source during updates, creating a rebuild flag for generator bundles.
- Added functions to handle the requeuing of builds and marking rebuilds as pending, improving the update workflow.
- Updated the update service to stage support-agent files and trigger rebuilds after in-app updates.
- Removed the obsolete GitHub Actions workflow for the support agent, streamlining CI/CD processes.
- Added a new function to stage the Go support-agent source for Generator builds, ensuring proper setup without a full git checkout.
- Refactored connection handling to improve TLS configuration, allowing for insecure connections based on environment variables.
- Updated UI elements for better user experience, including resizing and wrapping labels for status messages.
- Enhanced the enrollment process with improved error handling and status updates.
- Introduced new environment variables and command-line options for running the agent without a GUI, catering to environments like VMs or RDP.
- Updated README and build scripts to reflect new features and requirements.
- Added audio stream handling to the agent, including support for audio start and stop messages.
- Introduced lifecycle callbacks for consent and session management in the agent configuration.
- Updated desktop handling to utilize new consent handler and session start/end callbacks.
- Improved UI to reflect enrollment status and consent requests, enhancing user experience.
- Refactored branding structure to include additional color properties for better theming.
Expose global connection strategy in the web panel with systemd/Docker persistence, extend server health diagnostics, enforce org network policy in the signal handler, and document when relay fallback is expected vs misconfiguration.
Merge .env keys instead of replacing files, patch systemd/NSSM in place,
block panel updates when the server cannot be rebuilt, and stop routine
updates from syncing admin passwords from .env into auth.db/PostgreSQL.
Node now persists auth_provider on SSO provisioning and re-syncs role/provider after Go login success, including SQLite auth.db backfill. Go login returns auth_provider; LDAP group mapping accepts CN keys and newlines. Default agent build cache under dataDir to avoid EACCES.
Co-authored-by: Cursor <cursoragent@cursor.com>
Privilege separation across all installers so the long-running services no longer run with full administrative rights:
betterdesk.sh: installer keeps root but systemd units now run as a dedicated unprivileged 'betterdesk' system account by default (auto-created via ensure_service_user). Added full systemd hardening for the Go server (NoNewPrivileges, ProtectSystem=strict, ProtectHome, PrivateTmp, ReadWritePaths) and light hardening for the Node.js console. chown migrates existing root-owned data to the service account on update. Opt-out via --run-as-root / BETTERDESK_RUN_AS_ROOT=1; custom account via BETTERDESK_SERVICE_USER. Minimal mode covered too.
betterdesk.ps1: NSSM services now run under their per-service low-privilege virtual accounts (NT SERVICE\<service>) instead of LocalSystem, with scoped icacls grants on the install/data dirs (Set-ServiceLeastPrivilege helper). Applied to the Go server, Node.js console and minimal-mode service. Opt-out via -RunAsRoot / BETTERDESK_RUN_AS_ROOT=1.
Docker: verified already privilege-separated (supervisord drops both programs to user=betterdesk; multi-container images drop via su-exec).
Also bundles in-progress changes to the Go server API, Node.js console services and Docker compose/Dockerfiles.
This commit was made possible thanks to Insolve.
UNITRONIX