Skip to content

v0.4.41

Choose a tag to compare

View all tags
@github-actions github-actions released this 04 Sep 13:20
· 1 commit to main since this release
v0.4.41
140574b 
curl -fsSL https://github.com/inkly/CasaOS-Install/releases/latest/download/install.sh | sudo bash

Running it on an existing install upgrades it.

Security

The file manager API (/v1/file, /v1/folder, /v1/batch, /v1/image) required no token when the request came from loopback, and loopback is not the same as root: any unprivileged local process, or a store app running with network_mode: host, could read, write and delete any file on the host as root. It is now behind the same token as the rest, like the Samba and package routes since v0.4.40.

Reported upstream as CasaOS #2566. Its "path traversal" framing does not hold — the paths are absolute by design — and its sanitizer is not adopted: confining the file manager to a fixed set of roots would break browsing /mnt and /media, i.e. every USB drive and every cloud mount.

Added

  • A share can be marked as a Time Machine destination. It gets Apple's SMB extensions and smbd advertises it over mDNS, so Macs on the network offer it as a backup disk. Only that share is touched, and a host missing Samba's vfs_fruit module is told so instead of getting a share that refuses every connection (#1030).
  • The gateway can bind its public port to one address (address= in /etc/casaos/gateway.ini) instead of every interface (Gateway #56).

Fixed

  • A $ in an environment variable no longer doubles on every save: $2a$12$… became $$2a$$12$$… then $$$$2a$$$$…, breaking password hashes (#1988).
  • journald no longer receives an access-log line for the internal status posts the services exchange every 5 seconds — about 17 000 lines a day. The telemetry rate is unchanged, so the dashboard graphs keep updating (#2211).
  • The App Store no longer stops rendering when no category has any app, which happened with only a third-party store registered (#2537, UI #274).
  • App Store entries declaring an empty architecture list are shown rather than hidden, and category counts match the apps actually listed on the host.
  • The updater panel printed the version twice over (vv0.4.40).

Components

CasaOS v0.4.41, CasaOS-UI v0.4.32, AppManagement v0.4.21, Gateway v0.4.19, MessageBus v0.4.19, UserService v0.4.18, LocalStorage v0.4.29. The exact commits are in components.lock; every package the installer downloads is verified against a digest taken from the component's own release.

Assets 9
Loading