Use allowlisted hostname literals with https.get options instead of a
full URL string so request-forgery analysis sees a fixed host.
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow); muopc (@muopc)
Store OIDC discovery retry interval atomically and Close() background
goroutines so TestDiscoveryRetryAfterFailure is race-free. Bump toolchain
to go1.26.9 and golang.org/x/text to v0.41.0 (govulncheck clean). Confine
multer unlink paths; harden guest session ID entropy; stop interpolating
device IDs into console format strings; expand CodeQL query filters for
validated/admin-only paths.
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow); muopc (@muopc)
Move personal TOTP management into Authentication, fix locale metadata, and add validated scheduled full-instance backups with local and mounted network destinations.
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow); muopc (@muopc)
Adds local verification and distribution of signed generic incoming-only agent releases, mobile-friendly QR activation, and the supporting generator interfaces. Includes the current staged console, documentation, localization, and builder changes.\n\nThanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Keep pending managed devices attached to their live signal transport while still blocking sessions until operator approval. Add signal readiness reporting, immediate device-list refresh, and regression coverage for issue #442.
Refs #442
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Build local Linux clients once and package them as portable archives, Debian packages, RPMs, or Arch packages when the host toolchain supports the format. Keep artifact manifests and validation format-aware.
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Delegate generation staging and promotion through the legacy database facade so embedded local builds can promote completed artifacts. Extend facade parity coverage to prevent the regression.
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Resolve embedded artifacts from the validated manifest, expose only targets supported by the local toolchain, and keep per-target failures isolated. Update generator APIs, UI, documentation, and regression coverage.
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Bind guest WebSocket sessions to a single target peer, enforce grant lifecycle and atomic usage, add the guest issuer scope, and document the password-less security boundary.\n\nRefs #440\n\nThanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Add persistent Server Attestation badge title and tier labels with branding-aware rendering, localized fallbacks, and protected configuration endpoints. Include validation, public display sanitization, UI controls, and regression tests.\n\nRefs #394\n\nThanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Allow the split console to read and write the P2P, relay, NAT, and initiator policy through the Go server's shared database API. Apply validated changes atomically at runtime, keep native systemd and compose paths unchanged, and cover the flow with regression tests and Docker image checks.
Refs #432
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Accept valid zero-length BytesCodec frames in the Node and Go raw relay paths while continuing to reject empty protobuf control frames. This keeps native and mixed relay transports compatible with RustDesk peers and empty raw payloads.
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Add automatic mobile codec, FPS, touch, lifecycle, and relay diagnostics while preserving the HTTP H.264 fallback. Avoid opening file-transfer relays during the initial session and document the HTTPS/HTTP behavior.
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Operators can switch a BetterDesk Desktop client between normal and incoming-only. The command is stored per device and delivered only inside the signed telemetry envelope.
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Persist panel-managed NTP settings in the Go server database and apply them without requiring systemd or host Docker access in split image deployments. Keep native restart behavior and make failed restart transactions dismissible in the UI.
Refs #431
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Add allowlisted configuration management, permission diagnostics, safe service control, and repair workflows across native and Docker installers. Integrate panel capability checks with broker-backed writes and rollback, and document/test the lifecycle contract.
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Coordinate restart-required settings changes through authenticated, reversible transactions and synchronize legacy user last-login timestamps. Include the completed locale updates and restart-flow UI/service changes.
Refs #426
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Panel runs as betterdesk and cannot rewrite /etc/systemd/system/*.service.
Write ALLOW_SHARED_NAT_INITIATOR and related flags through the fixed root
broker into a service.d drop-in so Settings no longer fails with EACCES.
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Prefer console-local VERSION/package.json for ldflags so a stale root-owned
/opt/VERSION cannot pin rebuilt binaries to an old semver. Fall back binary
backups to a writable data dir when /opt/rustdesk denies bak writes (EACCES).
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Add opt-in OPERATOR_ONLY_OUTBOUND enforcement for PunchHole and RequestRelay, including live role checks, decision auditing, panel RBAC, settings, documentation, and regression tests.\n\nRefs #425\n\nThanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Remove GitHub prebuilt server binary delivery from panel updates. Fetch only required source subtrees for the selected commit and compile the Go server locally while preserving existing deployment and rollback behavior.
Refs: panel update local build path
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Retry rejected GitHub artifact credentials safely, fall back to one local Go build, and suppress expected panel reconnect noise during console restarts.
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Default tab icon used thin lines; the PNG mark is letterboxed so the B looked tiny in the rail and browser chrome. Prefer a large B favicon and object-fit cover on icon slots.
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Operators can override or hide download.product_* on the public
download page via bundle branding without rebuilding installers.
Refs #386
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Fresh Docker installs without ADMIN_PASSWORD generated two different random
passwords: Go wrote /opt/rustdesk/.admin_credentials while the panel
authenticated against auth.db seeded by Node.js. Pre-bootstrap a shared
password in entrypoints before supervisord / server start.
Refs #385
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Refs #384
setUserStrategyAssignment and getUserStrategyGuid called ensureUserGuid in dbAdapter but the helper was never implemented, causing TypeError and generic Server error on every user create/update. Add SQLite and PostgreSQL helpers plus integration tests.
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Preflight no longer blocks panel updates when the console can install a vendored Go toolchain automatically. Add proactive preflight banners, i18n, and clearer install UX in Settings.
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Prefer verified GitHub Actions or exact Release binaries during native updates, with checksum validation and local compilation fallback. Defer Support Agent source synchronization and rebuild queueing until after the console restart.
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Expose pending LAN and managed enrollment requests in the UX 3.5 notification center, synchronize badges through authenticated panel events with polling fallback, and refresh the registrations view automatically. Also include the pending relay transport fixes already present in the working tree.
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Reject POST/PATCH /api/users before mutating when peer grant or strategy
assignment DB methods are absent; return refreshed scope on PATCH; warn
on unknown peerIds; add facade parity and scope regression tests.
Refs #380
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
POST/PATCH /api/users accepted peerIds but never wrote user_peer_grants
because get/setUserPeerGrants (and strategy helpers) were missing from
the database.js facade. Refs #380
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
UNITRONIX