Security fixes
GHSA-fjgc-484v-j6mf - missing permission check on update_user_role API endpoint
Suggested action: update immediately if using scoped admin accounts without AccessRolesAssign permission.
An scoped admin user without the AccessRolesAssign permission was able to re-enable existing expired or revoked access role assignments due to a missing permission check, allowing them to reinstate target access for a user that used to have it in the past.
Changes
- Added SQLite CLI to the Docker image to make database backups more convenient
- Improved RDP web client performance
Fixes
- fixed #2485 - fixed-resolution RDP clients not passing resolution by @Eugeny in #2486
- #2489 - remove locking from SessionRecordings by @Eugeny in #2490
- fixed #2487 - RDP - handle unstable bitmap parse order in Chromium by @Eugeny in #2491
Full Changelog: v0.28.3...v0.28.4
Contributors
Eugeny