Release notes - Scalelite - Version 1.8.7
⚠️ Action required: stop BigBlueButton servers from serving recordings
If your BigBlueButton servers transfer recordings to Scalelite, each BBB server still keeps its own published copy of every recording. By default, it continues to serve that copy publicly. Anyone with a recording's ID can fetch it straight from the BBB server, bypassing Scalelite. As a result, recordings that are protected, unpublished or deleted in Scalelite stay publicly readable from the BigBlueButton server.
This is fixed in the BigBlueButton server's configuration, not in Scalelite itself, so upgrading Scalelite doesn't apply it. On each BigBlueButton server behind Scalelite, run:
for f in notes-playback podcast presentation presentation-legacy recording-screenshare slides playback-video playback; do
dpkg-divert --add --rename /usr/share/bigbluebutton/nginx/$f.nginx
done
nginx -t && systemctl reload nginxThis disables BigBlueButton's recording playback configuration in a way that package upgrades won't undo. It's safe to run even if some of these playback formats aren't installed. It doesn't affect live meetings.
See Disable recording playback on BigBlueButton in the recording transfer instructions. New installs following those instructions get this step as part of setup.
Security Fix:
- contains multiple low and medium security fixes that will not be be made public before November 26, 2026
Notes:
Release tested by contributors [ @farhatahmad ] composer deployment