Go toolchain downloads and sumdb checks also use $HOME/go even when
GOMODCACHE is set. Point HOME at the console data directory during
server auto-rebuilds.
Point GOMODCACHE and GOCACHE at data/go-cache when auto-rebuilding the
server binary. The betterdesk service user often has HOME=/var/lib/betterdesk
which may not be writable, causing "could not create module cache" on update.
Add Go LDAP verify endpoint and probe it from the console when a local
user's password fails, so valid domain credentials return HTTP 409 with a
clear collision message instead of a misleading password mismatch. Includes
i18n for auth.username_collision across all console locales.
Existing Docker volumes crashed at startup because ensureAuthTables indexed
token_hash before the column existed on upgraded auth.db files. Bump images to 3.0.0.
After RustDesk→BetterDesk migration, HTTP heartbeats can update last seen while
UDP signal registration is still missing. Show a distinct "No signal" badge,
document the two-channel presence model, and publish peer_online on registration.
Sync console file ownership before the dedicated service user starts, add
ExecStartPre permission repair on systemd, and skip in-app restart when
permissions are not verified so the panel does not die with Bad Gateway.
Use npm install without a lockfile in CI, treat root-owned installer scripts as non-critical update failures, and skip privileged H-7 hooks when betterdesk already exists without sudo.
Hash RustDesk access tokens at rest (phase 1), add SSRF guards for admin network tools with LAN monitoring support, run dedicated console service user on Linux, and hook post-update verification plus service patching into both betterdesk.sh and the in-app updater.
The panel updater assumed a native install with Go source on disk. In
Compose/GHCR mode it now uses the embedded image commit, clears stale
binary markers, and directs operators to pull new container images instead.
- Added a new database table to track read notifications per user, enhancing the notification system's functionality.
- Updated the API routes to utilize the new read state, allowing users to mark notifications as read and retrieve their read status.
- Refactored related functions to improve code clarity and maintainability, ensuring that read states are efficiently managed and persisted.
- Reintroduced the creation of a unique index on the slug column in the agent_bundles table, ensuring that slugs are unique and not null or empty.
- Added a check to create the slug column if it does not exist, enhancing the database schema integrity during the adapter setup.
- Introduced new localization strings for short download links and their hints in various languages.
- Added validation messages for short link requirements, including character restrictions and length constraints.
- Updated existing download link hints to inform users that old hex links will continue to function after changes to short links.
- Ensured consistency across all language files to enhance user experience and clarity in the interface.
Sync all 26 locale files to the EN+PL baseline (3432 keys), add OBSIDIAN tier strings, and ship i18n apply/audit tooling. Improve server attestation UX and convert orphaned node:test scripts to Jest so the full test suite passes.
- Swapped the descriptions for the 'platinum' and 'titanium' tiers in both English and Polish localization files to accurately reflect their connection capacities.
- Updated the tier descriptions to enhance clarity regarding server performance and infrastructure capabilities.
- Introduced server attestation functionality with performance benchmarking capabilities.
- Added new localization strings for server attestation in English and Polish.
- Updated authentication routes to include server attestation data on login.
- Enhanced desktop and standard login views to display attestation badge.
- Integrated server attestation link in the sidebar for easy access.
This feature provides users with insights into server performance and connection capacity.
Do not auto-convert an existing local account if Go authenticates the same
username via LDAP/OIDC. Treat it as a collision and require admin action,
preventing potential privilege confusion when names overlap.
Repair the Node.js panel auth path so LDAP/OIDC users get the correct
provider and role from Go: forward authProvider in the database facade,
export syncUserFromGo, enforce provider-bound login, use unusable hashes
for external accounts, block panel edits of IdP-managed users, and
reconcile provider/role via Go API on PostgreSQL.
- Improved logging in the device registration process to capture detailed enrollment information.
- Updated the enrollment token handling to ensure each device registers independently, eliminating the use of shared tokens.
- Introduced new API endpoints for managing help requests, allowing operators to acknowledge and resolve requests through the panel.
- Enhanced the generator routes to support the new help request functionality, improving overall API integration and user experience.
- Refactored the branding process to remove legacy enrollment token references, streamlining the support agent's configuration.
- Added a new API endpoint for enrolled devices to raise help requests via REST when not connected to CDAP.
- Improved the device enrollment process by issuing a device token during status polls, allowing for seamless recovery of CDAP authentication.
- Enhanced error handling for device token validation and ensured proper responses for various failure scenarios.
- Updated the build process to support dual UI binaries for Linux (X11 and Wayland) and included a session-aware launcher.
- Refactored the installation script to accommodate the new Linux UI bundle structure, improving deployment flexibility.
- Updated the system tray icon setup to use a platform-appropriate resource method, improving compatibility across operating systems.
- Introduced a new function to provide a tray icon resource based on the platform, ensuring proper icon display on Windows.
- Enhanced the installation process to include copying the Mesa OpenGL library for better GUI support on Windows, particularly in virtual environments.
- Updated the build worker to stage the OpenGL library alongside the application, improving user experience for GUI operations.
- Refactored command-line options to clarify GUI usage and improve overall application behavior in headless environments.
- Added a new method to check if the agent has an active CDAP session, improving connection status reporting.
- Updated the SendHelpRequest function to utilize the engine for sending help requests, enhancing the request handling process.
- Refactored health check methods to include the Go management API, replacing the console health checks for better integration.
- Improved branding logo handling by introducing a PNG validation function, ensuring only valid images are used.
- Updated UI elements and localization strings to reflect changes in API endpoints and improve user experience.
- Updated the UI to utilize a new status handling method, enhancing the display of connection and enrollment statuses.
- Introduced a status dot indicator for better visual feedback on connection state.
- Refactored the Go toolchain installation script to verify the presence of the JSON package instead of PNG, improving compatibility checks.
- Enhanced error handling in the agent build worker to streamline the build process and ensure proper environment setup.
- Added new UI components and functionality for managing client builds, including a section for displaying build statuses and a button to rebuild all platform installers.
- Enhanced the generator routes to support rebuilding of bundles, including error handling for revoked bundles.
- Updated the agent build worker to facilitate the rebuilding process for platform builds associated with a specific bundle.
- Improved localization by adding relevant strings for build management in English and Polish language files.
- Introduced CSS styles for the new builds section to enhance visual presentation and user experience.
- Simplified the health check for the Go binary in agentBuildWorker by utilizing a new method from updateService to verify the standard library.
- Enhanced the installation process of the Go toolchain to handle concurrent requests and added an option to limit the maximum version during installation.
- Improved error handling and cleanup in the goStdlibHealthy function to ensure temporary files are removed after checks.
- Updated the resolveGoRelease function to support version constraints, ensuring compatibility with specified maximum versions.
- Updated the agentBuildWorker to return null if no healthy Go binary is found, improving error handling.
- Enhanced the updateService with a new function to verify the integrity of the Go standard library, ensuring a complete installation.
- Implemented additional checks during Go toolchain installation to handle incomplete standard library scenarios, improving reliability and user feedback.
- Added a new function to install the Go toolchain if it's missing or broken, ensuring proper setup for support-agent Generator builds.
- Enhanced the agentBuildWorker to check for a healthy Go binary and requeue builds that failed due to a broken Go installation.
- Updated the build environment configuration to prioritize a working Go toolchain, improving the reliability of the build process.
- Added functionality to track the remote SHA of the agent source, improving consistency during updates.
- Implemented a new method to sync the full support-agent source from GitHub, ensuring all necessary files are staged for rebuilds.
- Introduced a mechanism to check for agent source drift, allowing for automatic repairs when discrepancies are detected.
- Updated the update service to trigger agent source synchronization and rebuilds based on specific file changes, streamlining the update workflow.
- Implemented a conditional staging process for the Go support-agent source during updates, creating a rebuild flag for generator bundles.
- Added functions to handle the requeuing of builds and marking rebuilds as pending, improving the update workflow.
- Updated the update service to stage support-agent files and trigger rebuilds after in-app updates.
- Removed the obsolete GitHub Actions workflow for the support agent, streamlining CI/CD processes.
- Added a new function to stage the Go support-agent source for Generator builds, ensuring proper setup without a full git checkout.
- Refactored connection handling to improve TLS configuration, allowing for insecure connections based on environment variables.
- Updated UI elements for better user experience, including resizing and wrapping labels for status messages.
- Enhanced the enrollment process with improved error handling and status updates.
- Introduced new environment variables and command-line options for running the agent without a GUI, catering to environments like VMs or RDP.
- Updated README and build scripts to reflect new features and requirements.
- Added audio stream handling to the agent, including support for audio start and stop messages.
- Introduced lifecycle callbacks for consent and session management in the agent configuration.
- Updated desktop handling to utilize new consent handler and session start/end callbacks.
- Improved UI to reflect enrollment status and consent requests, enhancing user experience.
- Refactored branding structure to include additional color properties for better theming.
Restore POST /api/peers/{id}/restore removed in a9e217c, add signal tests
that managed mode queues pending_device_* while locked does not, and move
RustDesk enrollment controls to Settings with full approval (folder, groups,
tag picker) wired through the registrations flow.
Expose global connection strategy in the web panel with systemd/Docker persistence, extend server health diagnostics, enforce org network policy in the signal handler, and document when relay fallback is expected vs misconfiguration.
Merge .env keys instead of replacing files, patch systemd/NSSM in place,
block panel updates when the server cannot be rebuilt, and stop routine
updates from syncing admin passwords from .env into auth.db/PostgreSQL.
Implement new functions to list, acknowledge, and resolve help requests via the API. The listHelpRequests function supports filtering by status and device ID, while acknowledgeHelpRequest and resolveHelpRequest handle acknowledgment and resolution of specific requests. These additions enhance the help request management capabilities in the application.
Utils.api already unwraps API data, so the file list was always empty.
Add fixed paths for session secret, audit log, build.env, and Docker files.
Co-authored-by: Cursor <cursoragent@cursor.com>
Let server.config admins edit .env, blocklist, and systemd units from the
panel with backups on save and service restart via the existing updater.
Co-authored-by: Cursor <cursoragent@cursor.com>
Node now persists auth_provider on SSO provisioning and re-syncs role/provider after Go login success, including SQLite auth.db backfill. Go login returns auth_provider; LDAP group mapping accepts CN keys and newlines. Default agent build cache under dataDir to avoid EACCES.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add auth_provider attribute (local/ldap/oidc) to User model across SQLite and PostgreSQL with automatic migration (existing accounts default to local). Rewrite login to be provider-bound: LDAP-backed accounts never fall through to local password verification, OIDC accounts reject password login, and LDAP/OIDC provisioning stores an unusable random local password instead of the provider password. LDAP/OIDC accounts always re-apply provider role mapping on every login so a matching local account can no longer override AD-mapped permissions. Guard handleUpdateUser against setting a local password on non-local accounts. Propagate auth_provider through the Node.js sync layer and panel API, add a Provider column with badges in the users table, hide local password reset for provider-managed accounts, and add EN/PL i18n keys.
This commit was made possible thanks to Insolve.
Redesign the console backup into a complete .tar.gz disaster-recovery bundle that can be restored on a fresh machine to bring the entire server back online. Adds zero-dependency tar.gz writer/reader (backupArchive.js), logical dumpAllTables/importAllTables for SQLite and PostgreSQL, and packs the console database, auth.db, .env, .session_secret, branding uploads, and Go server identity (Ed25519 keys, .api_key, db_v2.sqlite3) plus a recovery README. Restore auto-detects archive vs legacy JSON snapshot, supports per-component selection (database/uploads/secrets/.env/Go DB) with restart-required signaling, and warns that the archive contains secrets. EN/PL/ZH i18n added.
This commit was made possible thanks to Insolve.
Add console wallpaper, login page branding (title/subtitle/background/footer), global agent download page branding, footer/copyright with 'Powered by BetterDesk' toggle, and custom CSS injection. Includes background image upload route (8MB), sanitization for colors/gradients/CSS, dynamic theme CSS for app and login pages, sidebar attribution, and EN/PL/ZH i18n keys.
This commit was made possible thanks to Insolve.
Issue #148 reporter @Kreol13 confirmed LDAP test connection works but
actual login fails with 'user not found in database'. Root cause: the
Node.js console only delegates unknown-user logins to the Go server when
BETTERDESK_AUTH_AUTOCREATE=true is set explicitly (security audit fix
H-01). When LDAP/OIDC is configured via the UI, that env var is not set,
so LDAP/OIDC users who don't have a local account are rejected before
Go gets a chance to authenticate them.
Go server:
- New public endpoint GET /api/auth/sso/status returning
{ldap_enabled, oidc_enabled, any_enabled}.
- Restored missing POST /api/auth/oidc/exchange route registration and
authMiddleware whitelist (regression from earlier OIDC hardening).
Node.js console:
- authService.getGoSSOStatus() — cached 60s lookup of Go SSO state.
- authenticate() now auto-provisions LDAP/OIDC-authenticated users when
any SSO provider is enabled on Go, in addition to the existing
BETTERDESK_AUTH_AUTOCREATE opt-in. Default role drops from 'admin' to
'viewer' for safer first-login provisioning when Go does not return
an explicit role mapping. Logs name which provider triggered
provisioning for audit clarity.
The H-01 concern (compromised Go server auto-provisioning admins) is
mitigated because enabling LDAP/OIDC requires an admin with the
server.config permission to explicitly opt in via the Authentication
settings tab.
This commit was made possible thanks to Insolve.
The in-app updater computed changed files via the GitHub compare API, whose 'files' array is capped at 300 entries. Large updates were truncated, so changed Go callee files (codec/ws.go, peer/map.go, auth/ldap.go, auth/oidc.go) were never downloaded, leaving inconsistent on-disk source that failed 'go build' with 'undefined' errors. ensureServerSource() also short-circuited whenever go.mod existed, so the full-resync safety net never ran.
Fixes: ensureServerSource() gains a force option that performs a full, consistent source resync (git clone / tree API) regardless of go.mod presence; called with force from applyUpdate's server block and from rebuildServerBinary (the 'Rebuild server binary' button).
Installer parity (same #158 class): betterdesk.sh, betterdesk.ps1 and betterdesk-docker.sh copied the source *directory* into the destination, which nested the new tree inside the stale dir when the pre-update rename/mv failed on a locked file. They now copy *contents* into a guaranteed-existing dir while preserving data/ and node_modules/.
This commit was made possible thanks to Insolve.
Bump golang.org/x/crypto to v0.52.0 and x/sys to v0.45.0 in betterdesk-server, x/sys to v0.45.0 in betterdesk-agent, and aiohttp to >=3.10.11 in the rest-webhook bridge. Validated clean via govulncheck.
Add an explicit Go server rebuild path to the in-app updater so security/library updates actually reach the running binary: updateService now marks the server binary stale when the source changed but a non-critical rebuild/deploy step failed, exposes getServerBinaryStatus() and rebuildServerBinary(), and surfaces a warning banner plus a Rebuild button in the settings update panel. New REST endpoints GET/POST /api/settings/updates/server-binary/{status,rebuild} guarded by server.config permission. i18n keys added across all locales.
This commit was made possible thanks to Insolve.
Add a device verification/enrollment workflow so new registrations are
held for operator review instead of connecting silently.
Go server (signal + api):
- Signal-mode pending: in 'managed' mode, unknown stock RustDesk clients
are queued (pending_device_<id>) instead of being silently rejected.
- Rich approve: handleApproveDevice accepts display_name, sync_mode and
normalized tags; handleRejectDevice supports an optional ban.
Node.js console:
- registrations.ejs approve modal (name, sync mode, tags, folder) and
reject modal with ban option; betterdeskApi + routes wire display_name,
sync_mode, tags and folder assignment through to the Go server.
- EN/PL/ZH i18n for all new strings.
Installers (managed default for FRESH installs only; existing installs
stay on the Go default 'open' or their DB-persisted mode):
- betterdesk.sh / betterdesk.ps1 write ENROLLMENT_MODE=managed to the
server env only when no existing database is detected (FRESH_INSTALL).
- Docker single + multi container entrypoints detect fresh volumes via a
sentinel plus id_ed25519/db_v2.sqlite3 presence and default to managed;
ENROLLMENT_MODE is now passed through supervisord and all compose files.
This commit was made possible thanks to Insolve.
Privilege separation across all installers so the long-running services no longer run with full administrative rights:
betterdesk.sh: installer keeps root but systemd units now run as a dedicated unprivileged 'betterdesk' system account by default (auto-created via ensure_service_user). Added full systemd hardening for the Go server (NoNewPrivileges, ProtectSystem=strict, ProtectHome, PrivateTmp, ReadWritePaths) and light hardening for the Node.js console. chown migrates existing root-owned data to the service account on update. Opt-out via --run-as-root / BETTERDESK_RUN_AS_ROOT=1; custom account via BETTERDESK_SERVICE_USER. Minimal mode covered too.
betterdesk.ps1: NSSM services now run under their per-service low-privilege virtual accounts (NT SERVICE\<service>) instead of LocalSystem, with scoped icacls grants on the install/data dirs (Set-ServiceLeastPrivilege helper). Applied to the Go server, Node.js console and minimal-mode service. Opt-out via -RunAsRoot / BETTERDESK_RUN_AS_ROOT=1.
Docker: verified already privilege-separated (supervisord drops both programs to user=betterdesk; multi-container images drop via su-exec).
Also bundles in-progress changes to the Go server API, Node.js console services and Docker compose/Dockerfiles.
This commit was made possible thanks to Insolve.
Go server:
- mergeAdminTagsIntoAB: strip banned/deleted peers from AB data
- handleClientGroupList: exclude banned peers from tag groups
- handleClientPeersList: add device_name fallback to peer ID, add online field
- handleGetPeer/handleListPeers: return status as int (1/0) with status_text
- handleUsersWithClientFallback: only return users with assigned devices
Node.js console:
- mergeAddressBookData: filter banned devices from AB merge
- buildSyncedAddressBook: set includeDevices=false to prevent ghost AB entries
- normalisePeer: use status_text fallback for status_tier
This commit was made possible thanks to Insolve.
The SSO commit (188991d) changed authenticate() to delegate auth to the Go server first, falling back to local-only for admin roles in 'emergency mode'. This broke login for all users whose accounts exist only in auth.db (Node.js) but not in Go server's database — which is the default for ALL-IN-ONE installs. Go server returned 401 for unknown users, and the new code treated that as a hard rejection with no local fallback. Restored the original local-first flow: check auth.db first, verify password locally, use Go server only as a fallback when local password fails (LDAP/password change sync) or when user doesn't exist locally (opt-in auto-create).
This commit was made possible thanks to Insolve.
auth.routes.js: strip trailing /api segment from BETTERDESK_API_URL when building the absolute OIDC authorize redirect, otherwise the env value (which intentionally ends with /api for axios baseURL) caused doubled /api/api/auth/oidc/authorize URLs.
betterdeskApi.js: testLDAPConnection and testOIDCDiscovery now extract e.response.data.error from axios failures, so the Settings -> SSO test buttons show real Go-side messages (e.g. 'LDAP host is required', DNS errors) instead of the generic 'Request failed with status code 400'.
This commit was made possible thanks to Insolve.
UNITRONIX