A maintenance release with a couple of security fixes, some bug fixes, and a few new options.
Security
- TOTP codes can no longer be replayed within their validity window at login (#270)
- The system configuration page no longer shows the LDAP admin bind password or SMTP password in clear text (#271)
Fixes
- Adding a description to a group no longer removes its members (#268)
- SSH keys and profile photos can now be added on the "My profile" page (#264)
- Corrected the website customisation docs, and a few smaller UI tidy-ups (#267)
New options
USER_PRIVATE_GROUPS— a proper user-private-group mode, where each account gets a group of its own taking the user's UID as its GID (#272)USERNAME_FORMATnow supports first-N-character placeholders, e.g.{first_name:3}{last_name:5}(#265)PASSWORD_RESET_ALLOWED_HOSTS— let the reset link follow an allowlisted request host (#266)USER_EDITABLE_ATTRIBUTES_DISABLED— turn off self-service attribute editing entirely (#269)
Thanks to @BlueCase, who contributed the user-private-groups work (#272) and reported a good number of the issues fixed here.
Full details in the changelog.
Docker image: wheelybird/luminary:v2.2.1