v0.8.4-alpha

This release is the result of an audit of the app's own code, verified finding by finding. Everything it turned up that was real is closed here. Five of the six are about a credential going somewhere it was never meant to go; the sixth is about one disappearing without anyone saying so.

Fixed: the web tab trusted every certificate it was shown

The intent was a self-signed certificate on a LAN device. The effect was that no certificate could ever fail — expired, self-signed, issued by anybody, on any host — while the same view types the connection's username and password into the page.

The system's verdict decides again. The exception is offered only for the host the connection actually names, only when the system refuses it, and only through a dialog showing the certificate's SHA-256 fingerprint. Trusting one remembers that exact certificate for that host, and you are asked again if it ever changes. It is the same bargain the SSH side of the app already makes with StrictHostKeyChecking=accept-new. Everything else the page loads — a CDN, a font, an embedded frame — goes through ordinary validation, as it should have all along.

Fixed: autofill had no idea which host it was on

It filled in credentials on any navigation that finished. A redirect to a different domain carried the connection's username and password with it, typed into whatever login form was waiting there, with a retry loop that kept trying for eighteen seconds.

Forms are filled only on the host the connection names. HTTP Basic, Digest and NTLM answer only to that host too.

Fixed: the SSH password travelled in the command line

sshpass -p <password> puts the password in the process arguments, where ps shows it to every other process running as you, for as long as the session lasts. It now goes through a pipe — sshpass -d takes a file descriptor, and a descriptor is inherited by the child process and by nobody else.

Fixed: external tools pasted connection fields straight into a shell

Macros were substituted into the command line as raw text and handed to /bin/sh. A connection named x; reboot was two commands, not one — and confCons.xml files are routinely passed around between people, which is what this app is for.

Values are shell-quoted now. %Password% is not substituted at all: it expands to a reference, and the password travels in the environment instead of the command line. One consequence worth knowing: quote a macro yourself and you now nest quotes. Write ping %Host%, not ping "%Host%". The three tools that ship with the app were already in that form.

Fixed: changing the master password could lose passwords silently

Any password that would not decrypt with the old passphrase was skipped, and the change carried on to rewrite the file's marker anyway — leaving those entries sealed under a key the file no longer claimed to use. Unrecoverable after the next save, and nothing said so.

The whole document is converted in memory first, and one failure abandons the change with the file untouched, saying how many entries could not be read. A file carrying undecryptable leftovers from an old import now refuses the change until it is cleaned up, which is the direction that does not lose anything.

Fixed: a failed encryption could erase a password

Encryption returned an empty string on failure, which callers stored — indistinguishable from "no password set". It returns nothing at all now, and every caller keeps what it already had.

French

A fourth interface language, complete: all 222 strings, alongside English, Polish and Romanian. Switchable in Settings without a restart.

The automatic setting learned to read while it was there. It tested for Romanian and fell back to English, so a Polish system got English with the Polish translation sitting in the bundle right next to it. It now follows the system language whenever the app has it.