Art-of-WiFi/UniFi-API-browser v3.1.0

UniFi API Browser 3.1.0

on GitHub

What is New

UniFi Network Application 11.x support

UniFi Network Application 11.x moved all time-series statistics to a new statistics engine and removed several
legacy endpoints. This release adds collections for the new engine to the Stats menu (marked "11.x"):

• statistics source (shows whether a controller uses the LEGACY or MODERN statistics engine)
• statistics schemas
• WAN stats, per site and per gateway
• wireless stats per radio band, per access point, and per SSID and access point
• client counts and wireless client counts per WLAN
• client activity per client device
• system stats per device (CPU, memory, uptime)
• ISP metrics per WAN
• aggregated dashboard (also available on 10.x)

On 11.x the legacy 5-minute/hourly/daily/monthly stats collections return empty results, and the dashboard
metrics, events, alarms and IDS/IPS events collections return an error. Use the new Stats collections and the
system log collections in the Messages menu instead, which gained "all entries" and a per-category example.

Security Fixes

• The AJAX endpoints now require a login whenever config/users.php defines user accounts. Previously only the
  main page was protected.
• Only the collections offered in the menus can be called. Previously any API client method could be invoked
  by name, including ones that change or delete controller configuration.
• Data returned by the controller (client hostnames, site names, SSIDs and similar) is now escaped before it is
  shown, so it can no longer inject markup or scripts into the page.
• config/users.php now accepts bcrypt/argon2 hashes produced by PHP's password_hash(). Legacy SHA-512 hashes
  keep working. The session id is renewed after a successful login.

We recommend updating, especially for installations reachable from untrusted networks.

Changes

• bundled classic API client updated to 2.4.0
• bundled official Network Application API client updated to 1.2.0, which makes the Switching collections work
• Twig updated to 3.30.0, clearing all reported security advisories
• errors are now shown with a clear message instead of a spinner that never stops
• README: supported versions now include Network Application 11.x (11.0.89 confirmed)

Upgrade Notes

No configuration changes are required. To move to the stronger password hashes, generate a new hash per user with
php -r "echo password_hash('your_password', PASSWORD_DEFAULT), PHP_EOL;" and replace the password value in
config/users.php; see config/users-template.php for details. Custom menus in config/config.php keep working;
only methods listed in the menus can be called.