Skip to content

2.31

Choose a tag to compare

View all tags
@hbenali hbenali released this 10 Oct 16:03
· 37 commits to master since this release
2.31
8e7c096
This commit was signed with the committer’s verified signature.
hbenali Houssem Ben Ali
SSH Key Fingerprint: xOCXKkxuU9SZpWrXxETWsXX5MldLDAehWb5cedtWMHk
Verified
Learn about vigilant mode.

Fixes

  • Log colorizing and indentation were off by default since 2.28 (a side effect of the commander upgrade inverted --ui-no-colors / --ui-no-indent handling). Colors are on again by default; the flags work as documented. Upgrading is recommended for anyone on 2.28–2.30.
  • tail child processes and process exit listeners are released on close; in-flight full-log reads are cancelled when the client disconnects.
  • CodeQL findings: ReDoS-safe logfmt rule; credential comparison no longer hashes the password.

Security

  • Cross-site WebSocket protection: browsers may only open the log socket from the page's own host. Behind a reverse proxy that rewrites Host, allow the public address with the new repeatable --allowed-origin <origin> option (also forwarded in daemon mode).
  • Content-Security-Policy (script-src 'self', same-origin connections, frame-ancestors 'self'); the page bootstrap moved from an inline script to init.js.

Upgrade note

If frontail sits behind a reverse proxy that changes the Host header and the log view stops updating, add --allowed-origin https://your-public-host.

Full Changelog: 2.30...2.31

Assets 7
Loading