Security
-
An operator restricted to certain sites could run command templates and install scripts on any device in the system. The two template actions — Execute and Deploy — took their target list from the request without checking it against the user's sites, so a restricted operator able to name a device could act on it, including devices at sites they have no access to. Both actions now refuse targets outside the caller's sites, and narrow a mixed selection down to the devices they may touch. This affects only installations that use per-site restrictions; if every user is unrestricted, nothing changed for you. Present since per-site access shipped in v1.33.0.
-
Live updates for commands, templates, scans and device logs reached users who should not have seen them. v1.54.0 fixed this for upgrades and backups and noted these were still open — this completes it. Nothing was ever displayed to the wrong user, but the underlying data — device names, command output, script results, discovered hosts and log lines — was being sent to every signed-in browser. Command runs, template runs and scans are now delivered only to the user who started them; device logs only to users whose sites the device belongs to. Log lines from an unrecognised source stay visible to administrators only.
Fixed
- The Security page never refreshed itself when an attack was detected or an address was blocked. IDS events were sent under the wrong name and never reached the page, so it only updated when you reloaded it. The page now updates live, as intended since IDS shipped.
- Users restricted to certain sites got no results from "Check for updates". The check showed "Checking…" against each device and then never reported back. Introduced in v1.54.0.
- The Active Tasks bar stayed in the corner of every page forever. Once anything had run, the bar sat over the interface permanently and survived restarts. It now shows what is running plus anything that finished in the last minute, then disappears on its own. If you have a task's log open, it stays put until you close it.
Added
- Config exports, update checks and network scans now show in the Active Tasks tray. Until now only upgrades appeared there, so anything else you started vanished from view if you reloaded or changed page. Scans show progress by address and, like every task with no devices of its own, are visible only to the person who started them.