Uh oh!
There was an error while loading. Please reload this page.
chore: merge upstream BetterDesk v3.4.2 - #2
Merged
Conversation
Maintain user-facing wiki pages in docs/wiki/ with updated BetterDesk URLs, AGPL licensing, RBAC/org coverage, and eight new operator guides. Add sync scripts and point docker helper TLS docs to the BetterDesk wiki.
Commit web-nodejs lockfile with tar override; CI uses npm ci and moderate npm audit. Add LOG_LEVEL filtering and log redaction in Node console and Go server. Validate WS tokens on bd-signal; require single-use token for remote-agent relay. Limit active relay sessions per IP and block open enrollment without TLS.
…ation Require auth_token or api_key before connecting; remove device_id token fallback.
…s and icon handling Added support for `allow-supports-multiple-windows` and `deny-supports-multiple-windows` permissions in the Windows schema. Updated existing permissions to include `allow-set-icon-with-as-template` and its denial counterpart.
- Bumped `vitest` and `vite` versions in both root and agent-client lockfiles. - Added `web-nodejs` overrides for `@babel/core` and `js-yaml` to address Dependabot alerts. - Implemented `NewConnLimiterFromInt` for relay per-IP limits in the Go server, removing the deprecated `deepSet` function from the patch-role-scope-i18n script. - Extended CodeQL coverage to include new query filters and improved npm audit configurations.
- Removed outdated binary files for Windows and Linux from the binaries directory. - Added a new documentation file for GitHub Actions CI troubleshooting, outlining common failures and local commands to mirror branch protection checks.
…lows - Updated .gitignore to include new binary paths and retain .gitkeep. - Modified Gitleaks configuration to ignore additional directories. - Adjusted CI workflows to prevent execution on version bump pushes and improved version bump handling in scripts. - Bumped BetterDesk Console Manager version to 3.3.136 in betterdesk.sh and related scripts.
Populate CHANGELOG [Unreleased] for dev→main merge (LDAP desktop login UNITRONIX#218, pre-3.4 security hardening, session and Web Remote fixes). Add docs/wiki/LDAP-AD.md and cross-links for directory authentication setup. Refs UNITRONIX#260
Revert [Unreleased] release draft and LDAP-AD wording that implied a committed stable 3.4 timeline. LDAP desktop login remains on the development channel only until the operator schedules a main release. Refs UNITRONIX#260
Document Caddy/Nginx TLS termination, TRUST_PROXY, and WSS routing (UNITRONIX#267). Extend betterdesk.sh with External reverse proxy mode and snippet generation.
Ask whether Caddy/Nginx runs on the same server; set HOST=0.0.0.0 and LAN upstream in snippets when the proxy is on another host.
…UNITRONIX#269) After Keycloak/IdP callback on the Go API port, the browser now lands on the Node panel session endpoint instead of hitting Go auth middleware. Adds Panel URL setting, return-url preservation, login error UX, and docs.
Updated the OIDC callback handler to retrieve the configuration from the database instead of the provider. This change enhances the flexibility of the OIDC setup.
…ONIX#301) Skip mirrorCreate on shared Postgres, block 409→create recursion, COALESCE totp_secret on Go ListUsers, and return username_exists on DB unique violations.
Require a live registered initiator on PunchHole/RequestRelay, and an approved DB peer in managed/locked modes, so pending enrollment cannot bypass quarantine. Refs UNITRONIX#302
…ITRONIX#299) Sync install.sh image pin with VERSION, fix split DB_PATH/SQLITE_READONLY, resolve AIO container for password reset, and write bootstrap files as betterdesk under cap_drop.
Populate CHANGELOG [Unreleased] with curated operator highlights since main 3.3.39, and remove illegal const password reassignment in ensureDefaultAdmin.
Guest /ws upgrades must pass Go access-link validation; RustDesk OIDC auth-query rejects omitted id/uuid when pending has them; bump tar and golang.org/x/text for audit/govulncheck.
…n-bump] Keep operator-facing release summary under Unreleased so merge to main promotes it to 3.4.0; slim 3.3.174 to the security patch bullets.
Release: BetterDesk 3.4.0 (stable)
Manual stable bump after version-bump-main could not push to protected main.
chore: release version 3.4.0 [version-bump]
…#306) Prevent set -e abort on sqlite3 API-key sync so betterdesk-console is always started after Online GitHub update; fail the update loudly when Console stays inactive. Hotfix PRs on main use patch bumps (3.4.x).
…art-after-update Hotfix: start Console after betterdesk.sh GitHub update (UNITRONIX#306)
Stable hotfix for betterdesk.sh Console start after GitHub update (Refs UNITRONIX#306).
chore: release version 3.4.1 [version-bump]
…NITRONIX#313) Accept PunchHole/RequestRelay from PANEL_SIGNAL_PROXY_CIDRS (default loopback) so panel-proxied Web Remote works again without weakening UNITRONIX#302.
GHSA-mh99-v99m-4gvg requires brace-expansion >=5.0.8; previous ^1.1.16 still failed Web Console CI audit on stable.
…-panel-proxy Hotfix: restore Web Remote after enrollment outbound gate (UNITRONIX#313)
Stable hotfix: restore Web Remote after enrollment outbound gate (Refs UNITRONIX#313).
chore: release version 3.4.2 [version-bump]
Brings the fork from the 3.3.x base up to upstream v3.4.2 (111 commits). All of our org-tenant-isolation work is preserved and verified still wired after the merge (OIDC org claim -> org-scoped JWT, org-scoped peers, CDAP, user list, audit, chat, per-org enrollment token). Conflict resolutions: - VERSION / betterdesk-server/VERSION / internal/productversion/VERSION / web-nodejs/package.json: take upstream 3.4.2 (our 3.3.134 fork patch numbering ends here). - auth/oidc.go, api/oidc_handlers.go: both sides additive — upstream's PanelURL/panel-redirect helpers next to our ClaimOrg/ClaimOrgName and ensureOIDCOrg/ensureOrgMembership. Restored the db import the textual merge dropped. Upstream v3.4.2's new guest access links let any caller with PermDeviceConnect mint a login-free link for an arbitrary peer id, which would hand a foreign tenant's device to whoever holds the link. Gate POST /api/guest/access-links with the existing peerOrgScopeCheck and cover it with a test. Side effect worth noting: upstream's new stock-client OIDC flow (POST /api/oidc/auth) routes through the shared callback, so it inherits our org-scoped token for free.
Uh oh!
There was an error while loading. Please reload this page.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merges upstream
UNITRONIX/BetterDesktagv3.4.2(111 commits) into our fork. Our org-tenant-isolation work stays intact and verified still wired after the merge.Conflicts (6) and how they were resolved
VERSION,betterdesk-server/VERSION,internal/productversion/VERSION,web-nodejs/package.json3.4.2— our3.3.134fork patch numbering ends herebetterdesk-server/auth/oidc.goPanelURL+ ourClaimOrg/ClaimOrgNamebetterdesk-server/api/oidc_handlers.goensureOIDCOrg/ensureOrgMembership; restored thedbimport the textual merge droppedSecurity fix included
Upstream 3.4.2 adds guest access links (
POST /api/guest/access-links) — a login-free, time-limited link to a peer, gated only byPermDeviceConnect. An org-scoped caller could pass an arbitrarypeer_ids, i.e. hand a foreign tenant's device to whoever holds the link. Now gated with the existingpeerOrgScopeCheck, covered byTestGuestAccessCreateOrgScope(verified failing before the guard, passing after).Org isolation re-verified post-merge
api/oidc_handlers.go:474GenerateOrgToken(..., result.OrgID, ...)/api/cdap/devices/{id}/*routes still wrapped inrequireDeviceOrgScopeListPeersForOrgwhen org context is presentPOST /api/oidc/auth) goes through the same callback, so it inherits org scoping for freeVerification
gofmtclean on touched files,go build ./...,go vet ./...,go test ./...— 23 packages ok, exit 0 (GOWORK=off).Not covered: Node console build (
web-nodejs) was not built/run; upstream touched it heavily, no conflicts there beyond the version string.Known leak, not fixed here
api/rustdesk_peers.go:555aggregates address-book tags via a globalListPeers— leaks tag names across orgs. Pre-existing, unrelated to this merge; worth its own PR.