PLEASE UPGRADE URGENTLY TO THIS VERSION, THIS IS A SECURITY UPDATE
THE IS AN ACTIVE EXPLOIT/HACKER ATTACKING MESHCENTRAL SERVERS AND TAKING CONTROL OF IT AND REMOTE CLIENTS
THIS SHOULD HOPEFULLY OF PATCHED THE EXPLOIT
- f436143 version 1.3.1
- 22cc470 fix: don't let a MongoDB ChangeStream error take down the server (#8267)
- 832192e fix: show the login page when an OIDC login fails (#8266)
- 79d6413 Fix and rename probableMainLanIP to use iphlpapi for info (#8264)
- 95812cf agents: let check-releases.js save the default agents for offline images (#8265)
- 0acf255 upload forgotten translation
- 13b8e4a faster file uploads with a percentage!
- d9aa8f1 agents: fix crash when the universal macOS agent is not loaded (#8255)
- 4baeee5 agents: check agents that connected before their default agent loaded (#8254)
- 00329eb agents: let agents download their own update when lockAgentDownload is set (#8253)
- 587c509 agents: stop unsigned Windows agents from updating on every connect (#8256)
- 8b8ef61 agents: stop self update from treating HTTP errors as the agent binary (#8257)
- 8e11342 agents: stop batch upload from saving HTTP error pages as the file (#8258)
- 64d45fd agents: stop batch upload from losing small files (#8259)
- e6f5ae9 Fix device list IP column and update isPrivateIP() (#8261)
- 58db1ed docker: fix the Alpine builds, the latest tag and the Node 20 actions (#8260)
- 1c1392a add backup preparing message in webui
- 9aa802b Fix UDP relay to remote addresses: bind relay socket to all interfaces (#8251)
- 90eefdc fix diagnostic console command
- ed8954e Continued implementation of probableMainLanIP (#7948)
- e7d70c7 agents: lay a custom release manifest over the shipped pins (#8249)
- 9f1bf93 fix: remove expired device shares without leaving array holes (#8182)
- 99c3519 fix: restore desktop notifications after consent (#8248)
- 7e3fb8c authenticode: fix time stamp requests through a proxy (#8247)
- 152bab7 Force Node Update (#8243)
- 89d421d Fix remote desktop freezing when a tile fails to decode (#8195)
- cc341be agents: download agents through npmProxy with a built-in proxy tunnel (#8246)
- f4812a9 Fix UTF-8 decoding for peer JSON messages (#8245)
- 52decb6 agents: accept DNS64 addresses and use HTTPS_PROXY for agent downloads (#8244)
- 9b26baa fix pwa generation
- da3dc5a Pr 7947 reviewed and updated (#8098)
- 2078555 Restrict batch upload when file access is disabled (#8185)
- d14b38a fix: enforce login token allowlist membership consistently (#8183)
- e02866e fix meshagent embedded module update (#8191)
- 1e6d80b Update backup handling logic and improve iframe usage for downloads (#8194)
- e259340 removedevices: save each affected user and user group once per request (#8208)
- 52d796f fix: restore permissions for manually configured plugins (#8239)
- d6aaae5 Device list: apply the name filter on the server when device paging is enabled (#8209)
- 9712a8f add very fast translation
- da8000e Token Event - Actions done by token correctly logged (#8181)
- edec035 Check file rights for basic file transfer (protocol 10) (#8184)
- ac3046f Route runcommands replies back to the requesting session (#8186)
- 14923b2 Prevent server crash on non-numeric TOTP token (#8190)
- 93b1c38 Add Very fast frame rate option to remote desktop (#8196)
- d93757e meshctrl: read login arguments from environment and config file (#8180)
- 5693a3a Add recovery agent connection setting (#8141)
- bf64220 Validate size and offset in recordings playback requests (#8198)
- 5ce3fac Fix server crash when a session closes during getDeviceDetails (#8217)
- 80923a7 Add missing index on eventids.fkid for SQLite and PostgreSQL (#8218)
- ce8b30a add comprehensive PWA manifest customization and configuration options (#8228)
- 3f44199 fix(db): handle errors during record encryption recode (#8231)
- 6ea66b9 fix(db): handle promise rejections in database methods (#8232)
- 82df6c7 fix(db): pass bulk write errors to pending callbacks (#8233)
- 7727771 feat(translate): add support for
.jssources (#8234) - 3874a06 Require valid device group for recovery agents, restrict their commands, validate agent log fields