v4.3.4

✨ Highlights

Patch release for the 4.3.x line. Focus is user management and SSO account hardening, large-form handling around PHP's max_input_vars, and binding records, log entries, and template records to the zone or template they actually belong to - plus 4.3-specific fixes for the API backend mode and MariaDB 11.6+. A small MySQL migration is included.

✨ Features

• Per-zone logs button on the zone edit page (#1331).

🐛 Fixes

Users and permissions

• Changing another user's password requires the user_passwd_edit_others permission in both the web UI and the API.
• Delegated admins can no longer modify superuser accounts, and untouched superuser rows are skipped when saving the users list.
• Template assignment through the API PATCH endpoint is authorized against the target user and rejects group templates.
• Profile self-edit no longer accepts username or LDAP flag changes (#1327).
• Duplicate emails are rejected when creating or editing users - compared case-insensitively, and only checked when the address was actually changed.
• Renaming a permission template no longer wipes its permissions.
• Generated passwords respect the misc.show_generated_passwords setting again.

OIDC and SAML

• Account matching compares subject identifiers byte-for-byte when linking accounts (MySQL migration included).
• Session ID is regenerated after OIDC and SAML login.
• OIDC logout uses the standard post_logout_redirect_uri parameter (#1367) and sends id_token_hint for providers that require it (#1382).

Large forms and max_input_vars

• Zone saves that exceed max_input_vars no longer silently drop records - affected rows are skipped with a warning (#1334), and the SOA serial stays unchanged when nothing was saved.
• Group member selection, group zone selection (#1386), and zone ownership decisions on user deletion are submitted as a single field, so large user or zone lists no longer hit the limit; the user deletion page also renders the owner list once to avoid memory exhaustion.

Records and zones

• Record edits and their log entries are bound to the zone the record actually belongs to, and deleting a non-existent record ID is rejected.
• Zone template record edits are bound to the template they belong to.
• Record searches work on MariaDB 11.6+ by casting the record ID with an explicit charset (#1350).
• Record names are qualified with the zone name only on a dot boundary.
• Zone log events no longer double the record name (#1332).
• Reverse zones - entering a network like 192.168.1.0/24 creates the proper in-addr.arpa zone instead of a literal forward zone (#1323).
• Zone deletion requires the delete permission, and bulk deletion requires a CSRF token.
• Punycode zone names that cannot be decoded to UTF-8 fall back to the original name instead of failing.

API backend mode

• Record editing no longer logs null-record warnings (#1326).

Templates

• Updating zones from a template no longer fails with a duplicate sync row error on MySQL, and stale template-record mappings are cleared on all database backends during re-sync.

Search and logs

• Search results are restricted for users without zone view permission.
• Zone and group log event details and log viewer modal text are escaped before rendering.

Interface

• Non-admin users get a simpler flat dashboard layout.

Docker

• Version tag pushes no longer move the :latest tag - it follows the master branch only.

Localization

• Missing translations added for recent UI strings.

📦 Upgrading

Run the MySQL migration before upgrading: sql/poweradmin-mysql-update-to-4.3.4.sql (PostgreSQL and SQLite need no migration this time). If you run a custom theme with a forked edit.html, re-sync it - zone saves now depend on new hidden marker fields, and an outdated fork will save no records. PHP 8.2+ required (unchanged).

Full changelog: v4.3.3...v4.3.4