marcpope/cortendesk v1.14.0 on GitHub

New

Two-factor authentication in the RustDesk client. A user with TOTP who signs in to the client with a password now gets the client's own code dialog, and the console issues a token only for a correct code. With emailed sign-in codes on, the client gets the email-code dialog instead. A user who must enrol but has not is refused until they set it up in the console. No client change is needed.
Disable password sign-in covers the RustDesk client. With SSO enforced, the client API refused nothing: a password still got a token and skipped the identity provider's MFA. It now answers with an error, with the same automatic fallback as the console when SSO is unconfigured or switched off. (#102)
Client URL scheme (Settings → Server, or CORTENDESK_CLIENT_URL_SCHEME). Device links now open rustdesk://connection/new/<id>: the old rustdesk://<id> lost the capitals in custom IDs, which opened as "ID not found". A client built with rdgen under another name registers its own scheme; set it here. (#105)
Backups in the console log, with notifications. Every run, scheduled or manual, writes one line with its result to Console audit, under "system" for the scheduler. Two new notification events: "Backup completed" and "Backup or off-site copy failed". (#104)

Rate limits no longer share one counter. Every throttle keyed on the address alone, so device heartbeats from an office behind one NAT spent the budget for client sign-in, password reset, invites and downloads, and client sign-in counted each request twice (10 a minute instead of 20). Each limit now has its own counter, and heartbeats are limited per device (120 a minute) with a 6,000 ceiling per address. The old shared 240 cut off about 60 idle devices behind one address.
Docker: artisan run as root. docker compose exec cortendesk php artisan ... runs as root, and a backup run that way made every later Back up now fail with a permission error and left archives the console listed as "v? unknown". Artisan in the image now switches to www-data by itself, and the container returns storage and the backups folder to www-data on every start, which repairs installs that already hit this.
Backups on hosts with open_basedir. PHP's archive code checked dotted path components such as a domain-named site folder, which open_basedir rejects, so backup and restore failed. Thanks @madito. (#106)
SSO with the provider unreachable gave a 500 on the console's SSO button and the client's Continue with SSO. Both now say the provider could not be reached.
Back up now had no space between the icon and the label. (#103)
Linked SSO accounts still waiting for approval can no longer sign in to the RustDesk client with a password, as on the console.

No database migrations in this release.
Clients already signed in keep their tokens. The second factor applies at the next password sign-in.
Recovery codes work on the console only; the client's code field takes 6 digits.
With emailed sign-in codes on, the client asks for a code at every password sign-in, and refuses it while mail cannot be sent. The console still lets an administrator in to repair mail.
Wiki: Two-Factor Authentication, Backups, Notifications.

docker pull marcpope/cortendesk:1.14.0
docker pull ghcr.io/marcpope/cortendesk:1.14.0