Skip to content

v1.0.0

Choose a tag to compare

View all tags
@borexola borexola released this 07 Aug 04:56
· 35 commits to main since this release
v1.0.0
9fa63a8

Neolink.NET 1.0.0 brings the detection-zone editor, opt-in sign-in protection, and a security-review sweep across the server and desktop app.

Added

  • Detection-zone editor. Edit a camera's detection zone from the camera dialog: the camera's own cell grid painted over its latest snapshot, rectangle drags with an explicit Block/Watch toggle, per-type tabs on cameras that keep separate AI zones, and doorbell (legacy firmware) support. Also scriptable via GET/POST /api/cameras/{name}/detectionzone.
  • Sign-in protection (opt-in). Account lockouts and intrusion blocking for the web sign-in, with an address-blocked log line fail2ban can watch.
  • Recording from server settings. Recording switches on and off from the server settings dialog, and disabling it preserves the camera's recording configuration.
  • Sturdier sessions. A dropped browser connection (closed tab, network blip, reconnect) no longer tears the page down mid-edit, and Esc closes the event playback dialog.

Changed

  • Enter signs in from either sign-in field, and a held key no longer spends several sign-in attempts.
  • A tile whose codec the browser cannot decode (H.265 without hardware decoding) falls back to the camera's sub stream and says why - per device, without touching the saved layout.
  • Recording and playback are cheaper: lower CPU per recording camera, quicker timeline scrubbing over older footage, faster exports.
  • The sidebar's battery-camera badge dropped its BETA; the UDP transport pill stays.

Fixed

  • A crafted camera link could run script in the web UI on the app's own origin; the camera name is escaped now.
  • An unreadable users.json looked like a fresh install and turned authentication off; the server now refuses sign-ins, says so, and preserves the file for repair.
  • Visiting a camera with a full wall permanently evicted a tile; tiles are now borrowed and put back, surviving chained visits and page reloads.
  • The server log could be forged through newlines in camera or sign-in text - including the address-blocked line fail2ban watches; control characters are neutralised centrally.
  • A UDP battery-camera session accepted datagrams from any device that found the port; sessions are pinned to the camera's address and the reordering buffer is bounded.
  • H.265 streams could be declared ready without the parameter set that makes them playable, producing decoder configurations browsers reject.
  • The desktop app handed any URL scheme to the shell; only http and https are passed on now. Clicking a notification also no longer opens a duplicate browser window next to the app.
  • A snapshot URL could request arbitrarily old footage; freshness and staleness are capped at an hour.
  • Smaller hardening from the same review: SMTP header injection refused in email addresses, secret files owner-only from creation, stricter forwarded-for parsing, and near-duplicate camera names warn at startup.

Full detail in CHANGELOG.md.

Assets 3
Loading