Release v1.0.0

Hashtopolis v1.0.0

The v1.0.0 release finalizes the split between backend and frontend, graduates the modern REST API (API v2) from tech preview to general availability, adds PostgreSQL as a first-class database, and moves the project to a Docker-first, container-per-component deployment model.

Backend

• The Slim 4 / PSR-7, JSON:API-conformant REST API at /api/v2 is now the primary integration surface, replacing the legacy v1 user API for new work.
• The HASHTOPOLIS_APIV2_ENABLE environment toggle has been removed; API v2 is always activated.
• PostgreSQL is now supported on par with MySQL.
• JWT-based authentication for API v2.
• OAuth2 / OpenID Connect login via JWKS (/api/v2/auth/oauth-token, /keys/jwks.json) for SSO deployments.
• API tokens with scoped permissions for programmatic access to API v2.
• Separate docker-compose.mysql.yml / docker-compose.postgres.yml (with matching env.*.example files) replace the single MySQL-only compose file.
• Backend and frontend now ship as separate containers (hashtopolis/backend, hashtopolis/frontend).
• The legacy PHP install script has been removed in favor of Docker + migrations.

Thanks

Special thanks to all involved people taking part in making 1.0.0 happening:

andreas-oh, coiseiw, correct-horse-battery-bench, cv5ch, eneko-af, Eric-Wasson, gluafamichl, gpascal123, inadequate777, itbf9, jessevz, LuffyNoNika, novasam23, ObsidianOracle, prettyaveragecoder, rixvet, xbenyx, zyronix

Deprecation Notes

With v1.0.0 the following components are deprecated and no longer receive new features. They remain present for compatibility but are scheduled for removal in a future release.

Legacy User API (v1)

• The original JSON User API, served from src/api/user.php and implemented under src/inc/api/, is deprecated.
• It is superseded by API v2 at /api/v2 (Slim 4 / PSR-7, JSON:API), which is now the primary and recommended integration surface.
• New integrations and automations should target API v2. Existing v1 consumers should plan to migrate.

Legacy server-rendered frontend

• The original PHP server-rendered web UI, located in src/templates/, src/static/, and src/lang/, is deprecated.
• It is replaced by the standalone Angular SPA in the hashtopolis/web-ui repository, shipped as the separate hashtopolis/frontend Docker image.
• New deployments should use the frontend container; the server-rendered templates will not receive further UI work.

---

The full list of relevant merged pull requests compared to the last release v0.14.8 is appended below:

Enhancements

• Added helper to retrieve counts of completed tasks and supertasks (#2357)
• Add fallback when checking for public fields in AbstractBaseAPI (#2370)
• Change from meta to data where results are delivered on helper (#2358)
• Added helper to retrieve config for all logged in users (#2366)
• Added aggregation 'cracked' to TaskAPI (#2367)
• Added aggregate to Assignment to retrieve the current chunk an agent is working on (#2371)
• Added skipped states to tasks that are not finshed but are archived(#2381)
• Fixed inconsistent success value (#2368)
• Added migrations generations (#2237)
• Removed environment variable to selectively enable new API (#2275)
• Upgrading to mysql:9.7 and test also upgrades with different versions (#2286)
• Adding initial data insertion into setup script (#2293)
• Removed the legacy install script (#2299)
• Upgraded all composer packages (#2301)
• Removed obselete version attribute from dockerfiles (#2314)
• Updated actions for linting workflow and added npm min age (#2334)
• Replace PECL with PIE (as PECL is deprecated and may be removed in the future) (#2352)
• Also make task status finished when hashlist has been cracked (#2321)
• Aggregation improvements (#2230)
• Added basic contribution guidelines (#2243)
• Attribute useNewBench is made patchable (#2245)
• Refactored queries in order to fetch Chunk and Hash entities at once (#2258)
• Additional unittests and removal of legacy openssl calls (#2259)
• Added documentation for versioning, branch handling and release process (#2263)
• Removed rule splitting (#1992)
• Upgrade composer packages (#2056)
• Configured sendmail in dev/ci environments to return immediately (#2055)
• Removed isChunkingAvilable references (#2075)
• Moved display error handling to dockerfile (#2002)
• Added enhancement backend endpoint for hash heatmap (#2068)
• Added estimated time, timespent, currentspeed and currentprogress to taskwrapper view (#2101)
• Access groups also should be enforced on admin permissions (#2116)
• Update time filter to use one year from current time (#2133)
• Added assigned agents to taskwrapperdisplay (#2154)
• Update the basic install manual according to the latest release (#1946)
• Update of the manual- - fixing style (#1947)
• Large Rework on Codebase (#1929)
• Made CrackerBinaryType.typeName unique (#1950)
• Improve IPv6 handling on about page (#1943)
• Removed taskExtraDetails endpoint (#1945)
• made classpath calls to usort consistent (#1952)
• Added helper for getting available tasks for agent (#1953)
• Api tokens (#1965)
• Removed not working transaction for updating hash length (#1979)
• Made it possible to update a single config (#1981)
• Better error message when login in with invalid user (#1991)
• Fixed class names by removing the package from the name (#1987)
• Updated nginx docs to recent syntax and status code 308 for redirect (#2003)
• Added a flag isActive to tasks api response to show whether a task is active (#2005)
• Check if the total hash count of a hashlist needs to be fixed (#2033)
• Add hashtopolis- prefix to db Docker container name (#1572)
• Made responses smaller by not pretty printing the json (#1733)
• DBA mapping rework (#1762)
• Upgraded deprecated jwt library to maintained jwt library (#1785)
• Added index for timeCracked on Hash table (#1786)
• Added an improved CORS implementation(#1725)
• Implemented sparse fieldsets support on the backend (#1715)
• DBA migrations and postgres support (#1795)
• Made dockerfile smaller by using smaller slim base image (#1826)
• Refactored load.php into different use case startup parts (#1853)
• Added OAUTH authentication to backend (#1859)
• Added helper to retrieve files in the import directory (#1877)
• No hard error when permission is missing from includes (#1627)
• Return cprogress from TaskExtraDetailHelper, required for frontend's Visual Graph component (#1674)

Bugfixes

• Hide ip adress of agent if the config HideIpInfo is set (#2401)
• Fix access group check on get file helper (#2403)
• Set the content-type header to application/json (#2372)
• Fixed sorting to tie breaker key ascend (#2375)
• Fixed small typo in config.php (#2066)
• Fixed include in dba/init (#2272)
• Fixed LikeFilterInsensitive to cast integer columns to text before LIKE (#2285)
• Check for task completion by using task progress (#2290)
• Fixed installation docs: broken download URLs and outdated upgrade guide (#2311)
• Remove encoding of HTML entities by the API (#2296)
• Fix cursor pagination documentation in OpenAPI docs (#2351)
• Removed outdated includes from dba init (#2234)
• Added migration to add backtick to postgres default blacklist charaters (#2236)
• Fixed pagination bug (#2231)
• Setting the default admin email to a valid address (#2244)
• Fixed filter ACL returning duplicate elements for agents (#2250)
• Get correct intersection of legacy api permissions instead of new CRUD (#2067)
• Setting alias properly for right group primary key (#2085)
• Fixed missing color labeling of tasks (#2053)
• Fixed float cast warnings on the old UI for dev builds (#2087)
• Fixed chunk count missing on task details and percentage sign missing (#2099)
• Fixed CORS errors (#2080)
• Fixed file upload metadata handling (#2126)
• Check for existing of array key before accessing it (#2122)
• Fixed pagination with reverse sort on no unique keys (#2127)
• Check for null value before strlen (#2155)
• Correctly use task object to aggregate task information (#2169)
• Fixed URL-encode and shell-escape sqlx migration DSN (#2175)
• Adding migration to fix mysql silently altering table entries on autoincrement (#2192)
• Fixed apitoken permission check by correctly parsing the permissions (#2196)
• Fixed tusFileCleaning error (#1949)
• Catch a migration running error and prevent docker-entrypoint to continue further on failure (#1951)
• Fixed bug where PATCHING and POST was not checked for permissions (#1957)
• Fixed patch current user to change own user without permissions (#1958)
• Fixed bug in content length calculation (#1984)
• Parse comma in filter (#1985)
• Fixed creation of task by using correct parameter for cracker binary (#2012)
• fix user object argument for supertask builder helper (#2032)
• Fixed access issues where users could access chunk and hash info from other access groups they were not member of. Thanks to Mateo Hahn from the Red Team Ops of Bureau Veritas Cybersecurity for finding and reporting this issue. (#2031)
• Fix subtask loading where wrong use statement was used (#2036)
• Correct cracked count of task wrappers if needed (#2037)
• Made a taskwrapperview to be able to properly sort in the task view (#2034)
• Replace random function for random string generation fixing a critical vulnerability (#1944). Thanks to Philipp Tekeser-Glasz from HvS-Consulting GmbH for finding and reporting this vulnerability. See security advisory at GHSA-g82f-3w53-p6x5
• Fixed bug that included errors where not added to response (#1752)
• Fix statement building in DBA on empty filters (#1760)
• Fixed bug in legacy agentbinary update (#1802)
• Added additional check to avoid log entries if a hash just was already cracked (#1858)
• Fixed status calculation in backend (#1716)
• Fixed upgrade of agentbinary to new binaryType (#1722)
• Only use the mask as subtask name in supertask import to avoid too long names (#1681)
• Fixed error in tests by removing deprecated {extension} from new confidence version (#1677)
• Fixed searchHashes helper to return the objects properly (#1662)