- Updated session control mechanisms to ensure proper handling of remote input and clipboard operations.
- Introduced session authorization checks to validate operator permissions before starting desktop sessions.
- Improved input injection logic to prevent unauthorized access during active sessions.
- Added new capabilities for managing session flags and controls, ensuring a more robust and secure desktop experience.
- Enhanced error handling and logging for better traceability of session-related actions.
- Introduced a new step in the CI workflow to check browser JavaScript syntax using the `npm run check:frontend` command.
- Updated package version to 3.5.14 and bumped dependencies: nodemailer to 9.0.4 and ws to 8.21.2.
- Enhanced logging configuration to use NODE_ENV for determining log level.
- Improved accessibility styles for UX 3.5 and added focus outlines for help panel elements.
Add FindAllByIP method to retrieve all peers sharing the same public IP, enabling safe fallback for authorization when exact ip:port is unavailable. Update related logic in requireAuthorizedInitiator to handle single live peer scenarios and prevent identity inheritance in ambiguous cases. Adjust tests to cover new functionality and edge cases.
Authorize PunchHole/RequestRelay by exact ip:port, TCP session, token, or panel proxy — not bare FindByIP — so unapproved enrollment clients cannot inherit an approved peer identity. Refs #302
Move Docker/CI/installers to Node 24 and Go 1.26 images, bump Alpine server runtime, apply safe npm/Go patch updates, migrate SNMP to pysnmp, and document deferred majors.
Prevent set -e abort on sqlite3 API-key sync so betterdesk-console is always started after Online GitHub update; fail the update loudly when Console stays inactive. Hotfix PRs on main use patch bumps (3.4.x).
- Updated .gitignore to include new binary paths and retain .gitkeep.
- Modified Gitleaks configuration to ignore additional directories.
- Adjusted CI workflows to prevent execution on version bump pushes and improved version bump handling in scripts.
- Bumped BetterDesk Console Manager version to 3.3.136 in betterdesk.sh and related scripts.
- Bumped `vitest` and `vite` versions in both root and agent-client lockfiles.
- Added `web-nodejs` overrides for `@babel/core` and `js-yaml` to address Dependabot alerts.
- Implemented `NewConnLimiterFromInt` for relay per-IP limits in the Go server, removing the deprecated `deepSet` function from the patch-role-scope-i18n script.
- Extended CodeQL coverage to include new query filters and improved npm audit configurations.
Commit web-nodejs lockfile with tar override; CI uses npm ci and moderate npm audit.
Add LOG_LEVEL filtering and log redaction in Node console and Go server.
Validate WS tokens on bd-signal; require single-use token for remote-agent relay.
Limit active relay sessions per IP and block open enrollment without TLS.
- Implemented input validation for `orgId` and `deviceId` in CDAP and organization detail routes using `assertSafeApiId`, returning a 400 error for invalid inputs.
- Added HTML escaping for `deviceId` and `orgId` in views to prevent XSS vulnerabilities.
- Hardened `patch-role-scope-i18n.js` against prototype pollution with a guard for unsafe nested keys.
- Updated CodeQL configuration to include new exclusions and ensure documented exclusions are applied.
- Added support for an official all-in-one Docker image (`ghcr.io/unitronix/betterdesk`) as the default installation method.
- Updated installation scripts and documentation to reflect the new single container layout.
- Retained legacy two-container layout option for backward compatibility.
- Adjusted API port from `21114` to `21121` for the new layout.
- Enhanced Docker-related scripts and configuration files to support the new structure.
- Updated various language files to ensure consistency in messaging regarding Docker deployment.
Add inline CodeQL suppressions for MeshAgent TLS pin and EJS layout body, and exclude those files from analysis so alerts #280 and #281 clear on the next scan.
Bump support-agent Go deps, harden relay recording paths and clipboard HTML stripping, update agent-client Rust lockfile, and extend CodeQL/Dependabot config for known upstream limits.
Remove internal LAN IP, SSH user, and developer paths from docs and examples; move deploy runbook to gitignored docs/private with a public template; drop Cursor debug logging leftovers; add CI checks to prevent regression.
Co-authored-by: Cursor <cursoragent@cursor.com>
Added a compatibility layer for MeshCentral, including a native Go implementation of key endpoints and a unified inventory for mesh agents. Enhanced the UI with new actions for mesh agents, such as terminal access and file management. Updated localization for mesh features and introduced new styles for mesh terminal overlays. Integrated interop testing for simulated and live MeshAgent connections.
Deleted the obsolete build workflow for BetterDesk and made adjustments to the CI configurations across multiple workflows. This includes changing permissions from write to read in the release-client and secret-scan workflows, updating the Node.js setup in the web-nodejs CI, and enhancing the rate limiting for RdClient pages. Additionally, improved the handling of return URLs in the auth middleware and added new utility functions for better security and logging.
Batch peer status writes, skip heartbeat rate limits for known peers, CDAP session cleanup on disconnect, relay WS conn limits, Postgres query timeouts, org login throttling, and CI with go test -race.
Document safePath consumers, escaped chat/cdap DOM updates, test harness,
and dev-only i18n audit script in codeql-config.yml for PR gate parity.
Refs #196
Use plainBodyObject() for device file read API to avoid array .length
tampering; rate-limit ticket DELETE; document intentional sanitizers in
codeql-config.yml for branding, fonts, network monitor, and server paths.
Refs #196
Updated CodeQL configuration to exclude additional paths for security checks. Introduced a new file access rate limiter to prevent abuse of file download endpoints. Improved path resolution functions to ensure confined access and added validation in body scalar functions to reject non-scalar types. Enhanced error handling in API endpoint validation to prevent invalid inputs.
Stop logging generated admin passwords, redact API login usernames,
confine font and file-transfer temp paths with safePath, and scope
GitHub Actions permissions in build.yml.
Introduce bump-version.js with CI workflows for patch bumps on dev and
stable releases on main, plus panel and installer UI to choose stable vs
development GitHub update branches.
Existing Docker volumes crashed at startup because ensureAuthTables indexed
token_hash before the column existed on upgraded auth.db files. Bump images to 3.0.0.
Use npm install without a lockfile in CI, treat root-owned installer scripts as non-critical update failures, and skip privileged H-7 hooks when betterdesk already exists without sudo.
Hash RustDesk access tokens at rest (phase 1), add SSRF guards for admin network tools with LAN monitoring support, run dedicated console service user on Linux, and hook post-update verification plus service patching into both betterdesk.sh and the in-app updater.
The panel updater assumed a native install with Go source on disk. In
Compose/GHCR mode it now uses the embedded image commit, clears stale
binary markers, and directs operators to pull new container images instead.
- Implemented a conditional staging process for the Go support-agent source during updates, creating a rebuild flag for generator bundles.
- Added functions to handle the requeuing of builds and marking rebuilds as pending, improving the update workflow.
- Updated the update service to stage support-agent files and trigger rebuilds after in-app updates.
- Removed the obsolete GitHub Actions workflow for the support agent, streamlining CI/CD processes.
- Added audio stream handling to the agent, including support for audio start and stop messages.
- Introduced lifecycle callbacks for consent and session management in the agent configuration.
- Updated desktop handling to utilize new consent handler and session start/end callbacks.
- Improved UI to reflect enrollment status and consent requests, enhancing user experience.
- Refactored branding structure to include additional color properties for better theming.
Desktop client is still in development. Version tags (v*) now only
trigger Docker image publish (server, console, all-in-one). Desktop
builds remain available via manual workflow_dispatch.
Co-authored-by: Cursor <cursoragent@cursor.com>
Wire docker-publish to git tags v*, workflow_dispatch tag input, and
semver prereleases; pin quick-start compose to 3.0.0-alpha by default.
Co-authored-by: Cursor <cursoragent@cursor.com>
updateService.js: distinguish critical vs non-critical failures in SHA tracking. Server binary compile/download failures are non-critical — SHA is saved so the same update is not shown again on restart. update-cli.js: match same logic, non-critical failures don't set exit code 1. betterdesk.sh: new update_from_github() with git clone + tarball fallback, 3-method menu. betterdesk.ps1: new Update-FromGitHub with git clone + ZIP fallback, 3-method menu. betterdesk-docker.sh: new update_docker_from_github() with 2-method menu.
This commit was made possible thanks to Insolve.
Add mandatory commit convention to .github/copilot-instructions.md so future AI-generated commits always include the 'This commit was made possible thanks to Insolve.' footer.
This commit was made possible thanks to Insolve.
- deployServerBinary: use rename(2) for atomic replace, fixes ETXTBSY
when target Go binary is busy (Linux kernel handles inode swap).
Falls back to copyFileSync on cross-device rename or non-Linux.
Windows: rename target out of the way first, then move new in.
- settings.js: mark 'server' phase as error when build succeeded but
deploy failed (was incorrectly marking 'done' from build alone).
- settings.js: completion modal now shows error title, error message
and pre-formatted stderr when serverDeploy.success === false.
- i18n: added complete_with_errors, modal_done_with_errors_title in
en/pl.
Use the layout-provided CSRF token (window.BetterDesk?.csrfToken) instead of a non-existent meta tag. This fixes failing PUT requests for organization policy saves (Issue #112), and resolves attestation verify/revoke failures. Also replace toolkit's cached meta lookup with a getCsrfToken() helper so API calls always read the current token. Updated .github/copilot-instructions.md to document the Phase 53 CSRF fixes.
Adds a full Phase-52 RBAC implementation and multiple server/frontend fixes. Key changes: new auth/permissions.go with 28 granular permissions and DefaultRolePermissions, expanded 7-role hierarchy and helpers in auth/roles.go, JWT org context and GenerateOrgToken, requirePermission/requireOrgMembership middlewares (Go + Node.js), DB schema & adapter changes for role_permissions and is_server_admin, org role boundary checks and peer org scoping, and guards for last-admin demotion and self-demotion. Also: TCP EOF/connection-reset log filtering in signal/relay servers, improved startup banner port display, KEYS_PATH auto-detect warning, CSS hover/transition layout fixes, admin password race mitigation, ID-change ghost peer cleanup, added Tauri ACL schema files, and a new RBAC_PHASE52.md doc. Misc: numerous web-nodejs i18n, CSS, JS and route updates and an updated .github/copilot-instructions.md timestamp/summary.
UNITRONIX