v2.2.13

Commits

• Security fix: More checks on headers. (kiarn)
• Security fix: Cache isolation and time limited. (kiarn)

v2.2.12

Documentation

• Update install page to set the venv installation as mandatory

Commits

• Fix gevent and zope.event versions to avoid conflicts
• Update socketio and engineio
• Replace deprecated method of distro lib
• Replace standart cgi with legacy-cgi for debian >=13
• Support for ntpsec-ntpdate for debian >= 13
• Check for existing usernames before trying to log in
• [core] Harden TOTP auth with secret key
• [core] Fix sortable view empty array bug
• [network] Refactor ip manager to avoid injection (thanks @RinZ27)

v2.2.11

Documentation

• config.rst: Add instructions on how to hash password manually #1491 (Alireza Alavi)

Commits

• Fix installation problem due to missing packaging (thanks @jaden78)
• Update requirements for gevent and gipc
• Fix ajenti SSL generation
• Fix PUT requests without query parameters
• Fix buffer in stream
• [Settings] Add tab to handle 2FA secrets

v2.2.10

• Fix dependency problem under Python 3.11.

v2.2.9

• Harden security
• Add bad request method
• Bump cryptography und PyOpenSSL
• Fix ajenti-upgrade script path in venv
• Split interceptors of security errors and server errors

v2.2.8

• Update cryptography, gipc and gevent versions
• Catch gipc errors
• Use escape from html module
• Fix TFA config not loaded properly
• [core] Upgrade to FontAwesome 6.4.2
• [power] Fix power requests

v2.2.7

• Update cryptography library
• Harden base url for password reset email
• Only allow same origin in cors policy
• [Core] Fix sudo elevation
• [Dns api] Add sharing id for gandi provider

v2.2.6

• Update cryptography, pyopenssl and socketio
• Migrate to http.cookies for Py >= 3.11

v2.2.5

• Update gevent to 22.10.2
• Update gipc to 1.5.0
• [Core] Add input type to messagebox (useful for passwords)
• [Core] Update Angular
• [Dashboard] Fix loadavg on systems without /proc/loadavg
• [DNS API] Add new plugin to manage external DNS
• [Iptables] Add new plugin to list chains and rules

v2.2.4

• Fix empty smtp config load. See #1422.
• Accept more http requests.
• Allow XML bodies and responses.
• Prevent cgi bug with binary content.
• Support for http basic auth.
• Upgrade cryptography and pyOpenSSL versions.
• Ignore plugins with wrong yml syntax.
• Avoid unwanted redirections.
• [Services] Fix missing enabled attribute.
• [Filesystem] Rename files.
• [Network] Fix loading wrong config files in /etc/netplan.