6d4d42b392
Merge pull request #189 from UNITRONIX/release/v3.2.0
...
chore: release version 3.2.0
2026-06-10 03:02:14 +02:00
f7346a4b69
chore: release version 3.2.0 [version-bump]
2026-06-10 01:01:20 +00:00
24b74d1bb7
Release 3.2.0
...
Merge dev → main: security hardening, RBAC, panel update fixes.
2026-06-10 03:01:02 +02:00
58818eb20c
chore: bump version to 3.1.15 [version-bump]
2026-06-09 04:52:07 +00:00
c731c8b8ad
fix(security): address CodeQL findings for release PR #185
...
Harden desktop-mode DOM rendering, branding sanitization, OIDC fetch
guards, API-key log redaction, tag-map allocation, and ws-register-test TLS.
2026-06-09 06:51:50 +02:00
a872da44fb
chore: bump version to 3.1.14 [version-bump]
2026-06-09 04:34:31 +00:00
594ec1bb12
docs(release): prepare 3.2.0 stable release notes in CHANGELOG
...
Consolidate security, RBAC, update, and operator upgrade/verify steps for dev→main release.
2026-06-09 06:34:08 +02:00
d0c456a531
chore: bump version to 3.1.13 [version-bump]
2026-06-09 04:15:24 +00:00
96b8330ee6
fix(i18n): complete update-channel and Docker UI translations for release
...
Add patch-updates-docker-i18n.js, fix commercialization fallbacks, and consolidate CHANGELOG [Unreleased] so i18n:check passes across all 26 locales before dev→main.
2026-06-09 06:12:13 +02:00
b32f414c15
chore: bump version to 3.1.12 [version-bump]
2026-06-09 03:07:36 +00:00
d96efad802
fix(rbac): block deleting last super_admin and clarify org owner label
...
Align Go delete-user guard with update/demotion logic (Discussion #99 ), add tests, fix pro-role docs, and label org owner as Org Admin in all locales.
2026-06-09 05:07:00 +02:00
5c19b89843
chore: bump version to 3.1.12 [version-bump]
2026-06-09 03:55:45 +02:00
17dfbee1bf
chore: bump version to 3.1.11 [version-bump]
2026-06-09 01:22:35 +00:00
f346f891bc
fix(security): phase-E shared Go API proxy, XSS hardening, audit clamp
...
Centralize path-segment validation in goApiProxy for fleet/commercialization/cross-platform routes while preserving RustDesk peer ID compatibility; sanitize panel JS output and cap audit Recent queries.
2026-06-09 03:22:14 +02:00
b337fde0dc
chore: bump version to 3.1.10 [version-bump]
2026-06-09 01:14:18 +00:00
4c9a1f632e
fix(security): phase-D Go API ID guards across all proxy routes
...
Extend assertSafeApiId to organizations, resource-control, permissions,
tokens, and update paths; harden org UI XSS and attachment confinement.
2026-06-09 03:13:53 +02:00
55d8c3502f
chore: bump version to 3.1.9 [version-bump]
2026-06-09 01:01:10 +00:00
9b02f06465
fix(security): phase-C XSS hardening, path confinement, log redaction
...
Harden backup restore, theme/attachment paths, frontend escaping, and
sensitive logging without changing normal operator workflows.
2026-06-09 03:00:43 +02:00
a10757b979
chore: bump version to 3.1.8 [version-bump]
2026-06-09 00:46:38 +00:00
97492d6005
fix(security): validate Go API paths and file browser entries
...
Add goApiPath guard on betterdeskApi axios requests, sanitize org/device
IDs in policy routes, and confine server-management directory listings
with resolveChildPath.
2026-06-09 02:46:22 +02:00
af2ae4bd91
chore: bump version to 3.1.7 [version-bump]
2026-06-09 00:44:57 +00:00
6d7692ea6a
fix(security): phase-A log redaction, font/transfer paths, CI permissions
...
Stop logging generated admin passwords, redact API login usernames,
confine font and file-transfer temp paths with safePath, and scope
GitHub Actions permissions in build.yml.
2026-06-09 02:42:56 +02:00
be56234ade
chore: bump version to 3.1.6 [version-bump]
2026-06-09 00:32:31 +00:00
051b44fa74
fix(update): skip repair download for removed console files
...
After deleting dev-only i18n scripts from the repo, post-update repair
was still trying to fetch them from GitHub (404). Exclude removed paths
from repair seeds and delete root-level script files on removal.
2026-06-09 02:31:54 +02:00
c23c014b1f
chore: bump version to 3.1.5 [version-bump]
2026-06-09 00:25:04 +00:00
65c4e75185
chore(i18n): restore bulk translation toolkit under scripts/dev-i18n
...
Keep apply-i18n-audit and regional patch data for low-cost locale
maintenance without shipping dev scripts to production consoles.
Add collect-gap-keys to regenerate gap-fill input from i18n-check.
2026-06-09 02:24:29 +02:00
7b938d8c7b
fix(security): harden path confinement, SSRF, and shell exec
...
Add shared safePath helper for file browser, i18n, and backup paths;
use validated OIDC discovery URLs; restrict terminal shells and
network monitor HTTP requests. Remove obsolete one-time i18n migration
scripts already merged into lang/*.json.
2026-06-09 02:21:43 +02:00
e841fed349
chore: bump version to 3.1.4 [version-bump]
2026-06-09 00:08:59 +00:00
cf6f70f6cd
fix(ci): correct find precedence in server release checksum step
...
The migrate artifact directory was matched without -type f, causing
sha256sum to fail on tag pushes (e.g. v3.1.3-dev).
2026-06-09 02:08:40 +02:00
b228f2229f
chore: bump version to 3.1.3 [version-bump]
2026-06-09 00:05:39 +00:00
c219f3be68
fix(security): patch CVE-2026-50575 and harden deps, SSRF, shell exec
...
Complete GHSA-3v82-3gf8-fxx8 WebSocket replay fix for soft-deleted peers,
bump vulnerable Go/Rust dependencies, and apply CodeQL-driven hardening
(OIDC URL validation, path confinement, execFileSync, rate limits).
2026-06-09 02:05:17 +02:00
fc29d297d2
chore: bump version to 3.1.2 [version-bump]
2026-06-08 23:47:14 +00:00
d168c31e87
Merge branch 'main' into dev — sync one-line install.sh
...
Brings install.sh and installation docs from main; keep dev 3.1.1 version baseline.
2026-06-09 01:46:49 +02:00
9391367acc
Add one-line Linux installer (install.sh) for Docker and native setup.
...
Ships automated curl|bash installation alongside existing manual install docs; no version bump — uses published 3.1.0 GHCR images by default.
2026-06-09 01:46:28 +02:00
5806d1fd00
docs(rules): add dev→main release workflow for agents
...
Document required Next Updates issues, complete release notes, terminal
steps when needed, and post-merge main→dev sync so releases stay clear.
2026-06-09 01:37:47 +02:00
4e938f5ed2
chore: bump version to 3.1.1 [version-bump]
2026-06-08 23:33:14 +00:00
4acea13584
Merge branch 'main' into dev — sync 3.1.0 baseline and update fixes
...
Brings dev in line with main: v3.1.0 release, update channel hotfix (#180 ),
client-api #138 , and privileged server binary deploy (#183 ).
2026-06-09 01:32:58 +02:00
87b0b21b0b
fix(update): privileged Go server binary deploy from Linux panel
...
Hardened installs could not replace betterdesk-server in /opt/rustdesk
from Settings → Updates. Add a validated sudo deploy helper, extend
console update sudoers, and sync privileges before server deploy.
Fixes #183
2026-06-09 01:09:11 +02:00
a82bcca559
fix(client-api): populate device_group_name for manual groups ( #138 )
...
RustDesk 1.4.x filters Available Devices locally by exact
device_group_name match; only folder names were set before, so manual
panel groups appeared in the sidebar but showed zero peers. Also align
the TOTP login challenge with RustDesk 1.4.7 (email_check/tfa_check).
2026-06-08 00:09:56 +02:00
122973593b
Merge pull request #180 from UNITRONIX/fix/update-channel-ux
...
fix(console): update channel switcher on main
2026-06-07 17:07:25 +02:00
f8139432a2
fix(console): update channel UX and Modal.confirm (main hotfix)
...
Apply channel on select with confirmation, active channel badge,
Modal.confirm instead of nonexistent Modal.open.
2026-06-07 17:07:20 +02:00
899388bc95
chore: bump version to 3.0.5 [version-bump]
2026-06-07 15:07:01 +00:00
b1ec2fa7bb
fix(console): improve update channel UX and fix Modal.confirm on stable
...
Replace broken Modal.open with Modal.confirm, apply channel on select
change with confirmation, show active channel badge, and clarify copy.
2026-06-07 17:06:35 +02:00
9db02e27cb
chore: bump version to 3.0.4 [version-bump]
2026-06-07 15:04:44 +00:00
4a48371d76
fix(console): use Modal.confirm for update channel save dialog
...
saveUpdateChannel called window.Modal.open which does not exist;
use the existing Modal.confirm API like other settings flows.
2026-06-07 17:04:20 +02:00
caf0d8fece
chore: bump version to 3.0.3 [version-bump]
2026-06-07 15:03:44 +00:00
5d8ee6773c
Merge pull request #178 from UNITRONIX/bump/v3.0.2
...
chore: bump version to 3.0.2
2026-06-07 17:03:29 +02:00
8ae17f38ec
fix(ci): restore direct dev version bump after relaxing branch protection
...
GitHub Actions cannot create PRs in this repo; dev no longer requires
pre-push status checks so the bump bot can push [version-bump] commits.
2026-06-07 17:01:03 +02:00
17f33f88ac
chore: bump version to 3.0.2 [version-bump]
2026-06-07 14:59:57 +00:00
ef62317927
fix(ci): dev version bump via PR to satisfy branch protection
...
Direct pushes to protected dev were rejected (GH006). Create bump/vX.Y.Z
PR and admin-merge; skip re-run on bot merge commits to avoid loops.
2026-06-07 16:59:41 +02:00
UNITRONIX