ISL Conference Proxy 4.4.2240.81 for Windows and Linux (2023-04-17)

New setting "Store online computers to xml file every X seconds" was added to /conf -> ISL AlwaysOn settings. When set (minimum is 300 seconds), the computers xml dump is appended to "islalwayson_computers.xml" file inside ISL Conference Proxy installation folder. This feature is disabled (set to 0) by default.

New webapi2 "islalwayson/computer/history/2" was registered that returns os_nice field of operators machine.

Program settings (Allow program, Use branches for, Order index for) were removed for domain and user level and can now only be set on server level. Previously set settings on domain and user level will now be ignored.

Response code IMPLEMENTATION_ERROR is now reported as severity error (previous severity: critical) with conditions similar to HTTP response 404. Response will now be reported as critical if:

• WebAPI2 request is not made on HTTP transport (MUX, WS, ...) or:
• client is in intranet or:
• hostname in HTTP Referer and Host match and ICP recognizes hostname in HTTP Host

Dev flag "Web log intranet errors are not critical" (web_log_intranet_not_critical) was added, which disables the feature where all unexpected errors on HTTP are reported as critical if the client is in intranet.

IPv6 encoded address support was added to DNS server: X-myizENCODED.example.com.

New setting "Enable client DNS debugging records (whatismydns, whatismyip) [insecure, disable as soon as possible]" was registered in Advanced DNS Zone settings. This setting is mainly used for debugging purposes and having it enabled for longer periods is discouraged. When enabled, whatismyip and whatismyip-* are added to the zone which return client's IP address as seen by load balancer. myip and EDNS Client Subnet is supported. To test if current internet connection DNS server supports EDNS Client Subnet, run:

• "ping whatismyip.icp.example.com", or:
• "nslookup whatismyip.icp.example.com"

Note that if myip was not provided and EDNS Client Subnet is not supported, no record will be returned. Load balancer will fallback to client DNS server IP address in this case, which can be queried with "whatismydns.icp.example.com".

New webapi version isllight/session/info/5 was added that marks sessions with guest operator in response, setting "guestOperator" field to "true". Webapi is used on session list to disable "Invite operator" option for sessions that are not owned by the current user or are used by guest operator.

New setting "Show GeoIP location" was added to /conf -> General settings.
When this setting is set to "Automatic", the location (country, city) will be shown to the users when a custom GeoIP database is being used. When set to "Yes" or "No", the location information will always or never be shown respectively. If the location information is shown to the user, the appropriate license for the GeoIP database used must be acquired. For more details, please refer to the manual.

Session invites are now using constant link (with invite ID) that opens intermediate web page with some basic info and starts appropriate executable download.
Constant link is used in invite link and in invite email body.
Web page also shows warning in case of unsupported platform (mobile) or used/revoked invite.

Support for "{{ attach_url_js}}" and "{{ resume_url_js}}" was removed from mail template.

Session actions are now adjusted based on state of ISL Light session (options that will never be available are removed).
Quick actions in table row are now also based on current session state.
State -> Quick action mapping:

• user is owner and session is active -> Open
• user is owner and session is paused -> Resume
• user is not owner and session is active -> Takeover
• user is not owner and session is paused -> Resume
• waiting for client -> Invite
• waiting for operator -> Invite

Sessions are now also updated when one of the sessions in tree is updated (changed name or email), before only selected one was updated.

Certificate panel was added to web administration (/conf -> Activity Monitor -> Certificates) with information about validity period and certificate details. Additionally, certificates used by HTTPS-POST-CERTPIN method in external authentication will be shown in Certificate panel and checked for expiry. These certificates will be registered when used for login and kept in memory for 7 days unless the certificate files get deleted in the mean time. The source data for the certificate is available in the details:

• source-file: file with the cert
• source-setting: system setting which contains the cert
• source-license-field: field in license file which contains the cert
• source-builtin-default: "yes" if it comes with a predefined built-in default

Registered new internal webapi "internal/domain/user/list/filter/membership/1" which lists users (per requested domain) with a list of ISL Pronto filters they belong to. The call supports filtering and ordering.
Registered new webapi "integrator/domain/user/list/filter/membership/1", which checks "list_user_filter_membership" rights and then uses above described webapi.

Following setting was released and can now be set by Domain Admins in Administration pages (/users/administration). Settings from "/conf" pages (Old name) were renamed (New name) and now use same layout (Page, Section, Subsection) as Administration settings.

Old Name: Show user information
New Name: Show operator's information to remote user
New Desc: This setting exposes the operator's information to the remote side while joining a session. The following values can be set: "username", "fullname", "email" or "none" (to display none).
Page: ISL Light
Section: ISL Light
Subsection: Basic

Smaller design changes were introduced to network status page (/users/main/network_status.html). Borders and alignment were updated, which should result in better readability of page.

ISL AlwaysOn module delays storing computer disconnect times (ping) to db for 1h after a computer disconnects. This delay is now reduced to 30min.
ISL Conference Proxy pages were updated to show current deferred ping count (in /conf -> Debug -> ISL AlwaysOn Computer Deferred Ping) and button to move deferred pings to cache was added in /conf -> Sessions -> Active -> ISL AlwaysOn -> This Server Commands -> Move deferred pings to cache.

New protocol for exposing internal functions to modules was implemented. GJRPC handler is now available on http://127.0.0.1:hport/gjrpc (hport = WebAPI high privilege port). Header "Isl-Gjrpc-Secret" must match runtime secret key. Test web page is available on http://127.0.0.1:7615/users/main/test_gjrpc.html. Values for GJRPC URL and Runtime secret key can be obtained in /conf > Debug > Moduleapp XML.

New internal webapi "internal/utils/counters/query/1" was registered to return current values of counters.
New counter "LIBPQ:execute_nonsilent_error" was added.

The process of checking time limit on ISL Light sessions at start of session was redesigned to reduce number of DB reads.

Reset password token is no longer invalidated on page load (email link can be opened multiple times). Token is no longer deleted from "forgot_password_email_token" table when invalidated but now field "used" is set to "true
New webapi version utils/password/forgot/change/2 was added that invalidates token on successful use.
Old version utils/password/forgot/change/1 is removed.
Recaptcha is now required for utils/password/forgot/change/2 and utils/password/forgot/cancel/1.

OpenSSL was upgraded to 1.1.1t.

Naming of computer fields (description/alias) was unified on computer list page and now matches naming in ISL Light program.
Computer name = actual name of physical computer
Alias = name of connection that is set by the user

Javascript library "moment.js" and "moment-timezone.js" were upgraded. New versions used: moment.js 2.29.4 and moment-timezone.js - 0.5.40.

Application web login (used by Single Sign On) was redesigned and login grant success will be reported using a redirect back argument in local port URL, providing compatibility support for Chrome 113, which is deprecating access to private network endpoints from non-secure websites as part of the Private Network Access specification (please see https://developer.chrome.com/blog/private-network-access-update/ for details).

ISL Light will now use new API for getting nice_os version.

In previous versions every user with full rights could create session invite. This was now redesigned and only session owners are allowed to create session invites.
In previous versions when counting invites all open invites were counted. This was now redesigned and open invites for active sessions are counted.

The defects were fixed.

In previous versions when anonymous user tried to use ISL Light invitation code, but the invitation did not allow anonymous attach, the webapi returned implementation error. This was now redesigned and user error is returned.

The defect was fixed.

In previous versions, when opening Reports page and changing start date, end date automatically changed in usage graph. This was now redesigned and changing start date should not affect end date.

The defect was fixed.

In previous versions modal windows were not scrollable, which resulted that user could not see whole content of chat transcripts in Reports pages. This was now redesigned and modals are now scrollable when to large to display.

The defect was fixed.

In previous versions, when session was moved between servers, email was sent on each transfer of session. This was now redesigned and before sending "remote desktop session stopped email" check is performed that session is not active on grid (on some other server) and issue should not happen anymore.

The defect was fixed.

Texts for filter options were updated to be more grammatically correct:

• Not Starts With -> Does Not Start With
• Include -> Includes
• Not Include -> Does Not Include
• Equal -> Equal to
• Not Equal -> Not Equal to

In previous version some of the tooltips did not show on certain browsers. This was now redesigned and following tooltips should be correctly displayed:

• Password cannot be changed for external users.
• System user modification is forbidden.
• This group is external and can not be deleted.
• Insufficient permissions. (Delete group)
• This group cannot be deleted because it still has members. Please remove them before deleting the group.

The defect was fixed.

In previous versions runtime logger was not set in db layer, which could result in runtime errors in some cases. This was now redesigned and runtime logger is now added to dblayer.

The defect was fixed.

In previous version, when custom logo was used it was not resized and could break the layout. This was now redesigned, icon size is limited to navbar size and issue should not happen anymore.

The defect was fixed.

In previous version search for setting Computer Group owner did not work. This was now redesigned and inplace inputs were fixed to detect change of input value and search should now show correct values.

The defect was fixed.

In previous versions fallback download program query params "on_not_found_" were not cleared after they were used. This was now redesigned and query params are now cleared.

The defect was fixed.

In previous version client timezone was resolved from IP address even when it was not needed. This was now redesigned and timezone should be resolved only when schedule is set. Also handling of exceptions while resolving timezone was redesigned.

The defect was fixed.

In previous versions system timezone was sometimes not detected correctly on Linux operating system. This was now redesigned and Locale module now uses icu4c library to detect system/host timezone. This is used as default when resolving IP to timezone.

The defect was fixed.