ISL Conference Proxy 4.4.2018.48 with modules for Windows and Linux (2020-07-20)

New minimal OS requirements for ISL Conference Proxy are: - Windows Server 2008 R2 (NT 6.1) - Linux 2.6.32, glibc 2.12 (RHEL/CentOS 6.0 equivalent)

HTTP compression was disabled on all dynamic URLs to prevent BREACH attack. Static resources will be still served compressed:

• /static
• /core
• /files
• /webspace

Please see ISLCONFPROXY-2010.

Added support for /staticpool/ID/ to ISL AlwaysOn. Please see ISLCONFPROXY-2012 for more information.

"Move to Group" action is now removed from Remote Access web pages if user does not have access to any groups. This applies for both single computer and bulk action menus.

When connecting to remote ISL AlwaysOn computer through webapi islalwayson/computer/connect/2, the connection id now uses also webapi2 cnid identifier. This allows us to connect to remote computer when different programs simultaneously use existing webtoken.

New logs were added to track logins in old versions of ISL AlwaysOn and XMLMSG.

Bulk files download now uses API service load balancer. If load balancer does not find an appropriate server, disabled but connected servers will be searched in network distance order. Debug log lines for files that were downloaded from disabled servers will now have key "BLKF_FALLBACK_N" set to disabled server from which file was downloaded.

Direct tables garbage collector will now collect rows with empty data:

• joined keys (empty value)
• sets and joined sets (insert is false or null)
• lists (position is null or negative)

Deleted row indexes will be recreated to include empty row expression, upgrade might take a while.

New logs:

• (on first run) direct table rows initial garbage collection long execution time
  • 120s: critical
  • 30s: warning
• (on subsequent runs) direct table rows garbage collection long execution time
  • 20s: critical
  • 5s: warning

Webutils include was added to template, so it is not necessary anymore in the web pages and was removed.

Static web resources (/core and /static) are now served on URLs prefixed with /staticpool/ID/. ID is calculated at init time from installed module list (including ICP) by using name, version and platform. The feature ensures that all dependencies of a web page are served from a server with the same set of installed software. "/staticpool/ID" is passed to SDK modules with the environment variable ISLCP_WEB_STATICPOOL. "{{staticpool}}" was added to XPP which resolves to "/staticpool/ID". The changes are limited to latest/default version of web pages, not classic.

Added support for /staticpool/ID/ to Module Core Login. Please see ISLCONFPROXY-2012 for more information.

Added support for /staticpool/ID/ to Module Backup. Please see ISLCONFPROXY-2012 for more information.

Added support for /staticpool/ID/ to Module Reports. Please see ISLCONFPROXY-2012 for more information.

Columns were added to "setting_group_info" table:

• tr_mod (translation module)
• tr_ctx (translation context)
• tr_ver (translation version)

Code refactoring.

All flags from 4.4.1721 branch were deleted. These flags are now considered as enabled and can not be disabled by user anymore. Deleted flags:

• 2017-02-07 ISLCONFPROXY-1170 external dialog authenticator default core login
• 2017-02-08 ISLCONFPROXY-1170 external dialog authenticator $system override
• 2017-02-08 ISLCONFPROXY-1170 external dialog authenticator reject old login
• 2017-02-08 ISLCONFPROXY-1170 non-local login dialog method server redirect
• 2017-02-08 ISLCONFPROXY-1170 register webapi2 utils/login/dialog only when core login
• 2017-02-17 ISLCONFPROXY-1170 external dialog authenticator custom method hint
• 2017-02-24 ISLCONFPROXY-1186 software policy XPP element
• 2017-02-24 ISLCONFPROXY-1186 use webTemplateElement from software policy
• 2017-02-27 ISLCONFPROXY-1284 register profile and usage as product pages
• 2017-02-27 ISLCONFPROXY-1284 remove profile and usage from web template
• 2017-02-28 ISLCONFPROXY-1186 xpp context software policy scope cache
• 2017-03-01 ISLLIGHT-4514 revoke invitation menu
• 2017-03-02 ISLCONFPROXY-1296 set CP-PUBLIC-URL HTTP header on webapp calls
• 2017-03-03 ISLCONFPROXY-1228 login.html v2 GUI elements
• 2017-03-06 ISLALWAYSON-1188 provide MAC for access filter
• 2017-03-08 ISLCONFPROXY-1228 login.html restore original title
• 2017-03-08 ISLCONFPROXY-1228 system login dialog use v2 elements
• 2017-03-09 ISLCONFPROXY-1305 webapi2 utils/grid/info/get/1
• 2017-03-10 ISLCONFPROXY-1305 trim whitespace installation name
• 2017-03-13 ISLGROOP-964 call destructor of groop_rtp_client outside lock
• 2017-03-13 ISLGROOP-964 call destructor of islgroop_client outside lock
• 2017-03-13 ISLGROOP-964 make BULK_LOCK statically safe because of bulk transfer destructor
• 2017-03-13 ISLGROOP-964 make user_clients_lock statically safe because of DB reads
• 2017-03-17 ISLCONFPROXY-1324 system login dialog remember me hint
• 2017-03-20 ISLALWAYSON-1196 correct TCP ports API usage
• 2017-03-20 ISLLIGHT-4556 correct TCP ports API usage
• 2017-03-21 ISLCONFPROXY-1238 json translation of webcall responses
• 2017-03-23 ISLLIGHT-4564 invite.js redirect after invite
• 2017-03-24 ISLCONFPROXY-1353 configure minidump level
• 2017-03-27 ISLCONFPROXY-1246 translate HTML files
• 2017-03-28 ISLCONFPROXY-1246 CP-GEOIP headers
• 2017-03-28 ISLCONFPROXY-1246 ensure valid language code request header
• 2017-03-28 ISLCONFPROXY-1246 webapi privileged pack headers
• 2017-03-28 ISLCONFPROXY-1246 webapp remove XPP step
• 2017-03-28 ISLCONFPROXY-1246 webapp reverse proxy pack headers
• 2017-03-28 ISLCONFPROXY-1246 webapp webcall pack headers
• 2017-03-30 ISLPRONTO-1018 Show setting 'pronto::reconnect_operator_on_setting_change' in /conf
• 2017-03-30 ISLPRONTO-1018 Use setting 'pronto::reconnect_operator_on_setting_change'
• 2017-03-31 ISLPRONTO-1019 fix default for unmatched client display
• 2017-04-03 ISLPRONTO-1019 Changed default for 'pronto::user::show_unmatched_clients' to Yes
• 2017-04-06 ISLCONFPROXY-1391 htmlattr strict error checking
• 2017-04-06 ISLCONFPROXY-1391 htmlattr translation output
• 2017-04-11 ISLCONFPROXY-1392 translate language tag
• 2017-04-11 ISLCONFPROXY-1399 transfer support flags to multifactor backend
• 2017-04-13 ISLPRONTO-1040 Fix crash in inpage chat func_chat_member_leave function
• 2017-04-14 ISLCONFPROXY-1405 webapi2 error code return
• 2017-04-18 ISLCONFPROXY-1414 LIB-765 add output to translation unique id
• 2017-04-19 ISLCONFPROXY-1169 prevent login dialog replay attack
• 2017-04-20 ISLCONFPROXY-1299 record multifactor attempt failed in throttler
• 2017-04-20 ISLCONFPROXY-1299 report throttle fail in user interface
• 2017-02-02 ISLCONFPROXY-1260 join page v1 uses reverse proxy instead of client redirect
• 2017-02-16 ISLCONFPROXY-1275 join page url version check
• 2017-02-16 ISLLIGHT-4482 enable RPC and webapi2 handlers for invite operator
• 2017-03-10 ISLCONFPROXY-1307 GRID network queue overflow core dump
• 2017-03-10 ISLCONFPROXY-1307 GRID network queue overflow core dump setting
• 2017-03-10 ISLCONFPROXY-1307 GRID network queue report in 1MB increments
• 2017-04-03 ISLPRONTO-1030 Add setting 'pronto::view_other_public_chats_content'
• 2017-04-03 ISLPRONTO-1030 Use setting 'pronto::view_other_public_chats_content' (requires operator reconnect)
• 2017-03-20 ISLCONFPROXY-1275 /users/main/join2 cookies not needed
• 2017-04-04 ISLCONFPROXY-1381 improve crash reports log
• 2017-05-15 ISLCONFPROXY-1433 akv1 log lines for moduleapps
• 2017-05-15 ISLCONFPROXY-1433 disable log level setting
• 2017-05-23 ISLCONFPROXY-1455 show signup hint
• 2017-04-19 ISLCONFPROXY-1169 prevent login dialog replay attack runtime check
• 2017-06-12 ISLALWAYSON-1221 add fid to file upload form in html
• 2017-08-03 ISLCONFPROXY-1504 mux returns 500 in reduced mode
• 2017-02-22 ISLCONFPROXY-1269 dbtask analyze
• 2017-02-22 ISLCONFPROXY-1269 dbtask reindex analyze
• 2017-02-22 ISLCONFPROXY-1269 load pg_managed3 API
• 2017-04-28 ISLCONFPROXY-1269 check PostgreSQL identifiers
• 2017-07-12 ISLCONFPROXY-1493 send client_address to external webapi
• 2017-05-31 ISLCONFPROXY-1467 support ipv4
• 2017-05-31 ISLCONFPROXY-1467 try ipv4/ipv6
• 2017-05-31 ISLCONFPROXY-1467 always open privileged webapi port

Support was added for JSON response translator format in setting description or comment.

Translation XML parser was fixed to reject "<" character in XML attribute values and HTML5 attributes without value.

Support was added for recursive "__tr__" translation JSON structures.

ISL Conference Proxy memory buffers and caches were replaced with system allocator. On Linux, GLIBCXX_FORCE_NEW is now set by default. On Windows, default TCP minimum allocation was reduced from 8192 to 32 bytes. The changes reduce virtual memory usage by 10% without having bad effect on performance.

Support for templating version 1 was removed from Backup Module.

Webapi handler on edge server (server that is connected to a computer) now adds connection id "cnid" to webapi2 parameters. In hag logs cnid shows as WA_CNID.

New setting "GRID server public address template" was added to Configuration -> Grid -> Settings, which sets redirect and tunnel addresses for autotransport (desktop and mobile applications). Web (URL) addresses will not be affected.

In previous versions directory of file server could be listed. This was now redesigned and server will respond with HTTP 404 error. Directory can not be listed anymore.

HTTP Server header response was added to /webaccess/wstun. Feature has no impact on client software behaviour, but enables easier debugging.

Files that are no longer present in DB are now skipped when performing periodic check.

If bulk file that is being downloaded is missing on local server, then "recheck" is requested so the file is copied from other servers if possible. The request is also redirected to other server that has the requested file.

Setting "Blocked file extensions for user upload (.exe ...):" was extended. New extensions that will now also be blocked: .appx, .appxbundle, .msix, .msixbundle, .iso, .ps1.

New logs were added to track logins in old web pages in ISL Conference Proxy.

Internal HTTP path rewrites will now not be passed to remote GRID servers over reverse proxy. Internal rewrites will still take effect when the remote target is not ICP.

Support for data domain ID and data user ID was added to associated delete lifecycle policy. This will now enable tracking and automatic delete of data linked to user or domain.

New API for sanitizing group after owner was deleted was added. Not in use yet.

Session events were moved to separate queued executor. This removes blocking between unrelated tasks.

Support for tracking hefa_locks was added.

"[Core] GRID message analytics" log was updated. "Min", "max" and "avg" times of messages with long execution times are now displayed. Before timing was implicit based on severity level.

HTTP remote proxy for /staticpool/ will now also use servers sorted by network distance, that are disabled in load balancer. Disabled servers will be used only when there are no enabled servers.

Webapi2 method "islalwayson/actions/info/1" will now have field "preview" with resulting std out when available.

Query for action info with webapi redirect islalwayson/actions/info/1 is now handled by server that started action.

New setting "Enable TCP keep alive in case of frequent TCP connection timeouts" was added to Features in web administration. Setting is disabled by default.

DT GC threshold version will be now calculated based on both local and remote table state to prevent changing the currently syncing rows.

Log severity of "client session not found" message was lowered from "severity" to "notice".

Two new replication status messages were added to web administration pages:

• "Bulk files (receive)" (bulk files are copied to this server)
• "Bulk files (recheck)" (bulk files are checked for replication status on this server)

Support was added for user customization in software policy.

Web hits in web administration now show URLs in original form (before rewrite) and handler URLs (after rewrite). Log line will now use HTTP_REQURL for original URLs and HTTP_HANDLERURL for rewritten URLs.

Go was upgraded to version 1.14.

The new setting was added to Security > "SAML identity provider initiated login" and it defaults to "Yes" to have the same behaviour as older versions. When set to "No" ISL Conference Proxy will not allow identity provider initiated logins.

Updated GeoIP to use the database GeoLite2-City 2020-07-07T21:35:52Z

Added support for /staticpool/ID/ to ISL Groop. Please see ISLCONFPROXY-2012 for more information.

New logs were added to track 1FA logins in ISL Groop.

Please see ISLCONFPROXY-2010.

Added support for /staticpool/ID/ to ISL Light. Please see ISLCONFPROXY-2012 for more information.

Library jHtmlArea was updated to version 0.8.0 in module ISL Light.

RPC handling in ISL Light Module stack was improved.

New logs were added to track logins in old versions of ISL Light Desk.

Please see ISLCONFPROXY-2010.

Added support for /staticpool/ID/ to ISL Pronto. Please see ISLCONFPROXY-2012 for more information.

New logs were added to track logins in old versions of ISL Pronto.

In previous versions when user tried to change admin of computer in Remote Access web pages, but he did not have permission to list users, this caused exception with no feedback. This was now redesigned and user should see feedback about no users found.

The defect was fixed.

In previous versions when "Change Admin" bulk action in Remote Access web pages failed, only shared computers were shown in list of errors, while owned were missing. This was now redesigned and all computers are listed in error message.

The defect was fixed.

In previous versions when user clicked "Change Admin" in Remote Access web pages, computer list was not updated. This was now redesigned and no longer accessible computer are removed from list and group and computer counts are updated.

The defect was fixed.

In previous versions "Bulk actions" menu dropdown in Remote Access pages was not completely shown due to overflow. This was now redesigned and Bulk actions dropdown now matches single computer action dropdown and is positioned inside window.

The defect was fixed.

In previous versions when user searched for computers in Remote Access web pages and then cleared search, some of the computers were missing and some were duplicated. This was now redesigned and "Clear" is matching empty search, returning all results.

The defect was fixed.

In previous versions when quickly clicking between groups in Remote Access webpages returned list of computers could contain computers from multiple groups. This was now redesigned and computers that no longer match current search are discarded.

The defect was fixed.

In previous versions progress of file upload from web interface to ISL AlwaysOn remote computer was not displayed because aon_min.js file could not be loaded. This was now redesigned and progress of upload should be shown correctly.

The defect was fixed.

In previous versions unescape html function was using incorrect replace order, which could in some cases return distorted strings. This was now redesigned and correct order of replacements should be used.

The defect was fixed.

In previous versions method availability check used to be performed before executing 2FA bypass (when user had selected "Don't ask again on this device."). In cases when default 2FA method was not available this could cause that user was prompted to select alternative login method. This was now redesigned so 2FA bypass is performed before checking login method availability.

The defect was fixed.

In previous versions user was not able to click on link inside tooltips in settings in /conf pages because tooltip was closed when mouse moved. This was now redesigned and tooltip stays open when mouse goes over the content.

The defect was fixed.

In previous versions when bulk file was removed on one server when other server in GRID was offline or reconnecting in GRID, exception would be thrown. This was now redesigned and when deleting bulk files, exception will no longer be thrown in case of empty "hex_id" of the file or if the file was already removed from the DB (_index_b and _data_b).

The defect was fixed.

In previous versions in "callwebapi" functions data argument was not passed to error handler which would throw "Uncaught ReferenceError". This was now redesigned and data is correctly passed to error handler.

The defect was fixed.

In previous versions bulk files were not copied to another server in grid once after remote read had failed, because exception was not correctly propagated. This was now redesigned and execution of rechecking files should now continue.

The defect was fixed.

In previous versions it was possible that the task will complete and delete itself which would then result in ISL Conference Proxy crash. This was now redesigned and should not happen anymore.

The defect was fixed.

In previous versions when querying action events parameter "events_after" was ignored. This was now redesigned and "events_after" is used.

The defect was fixed.

In previous versions app web login did not finish when using older versions of Edge browser. This was now redesigned and version check was added to local port method for Edge. Minimum required version is now EdgeHTML 18.17763 for full support.

The defect was fixed.

In previous versions counting number of associated data, that will be deleted with user or domain, failed when no server with module that had access to associated data was available. This was now redesigned and error is returned instead of count is such cases.

The defect was fixed.

In previous versions ISL Pronto file upload page was not responsive on mobile devices. This was now redesigned and page on mobile devices should be responsive.

The defect was fixed.

In previous versions software policy scope resolver did not return expected network start version based on software policy when using customizations and /start or /download links. This was now redesigned and should be working correctly.

The defect was fixed.

In previous versions catch argument in try-catch block was not specified, which is not supported by Internet Explorer and Edge browsers. This caused that web administration page could not be opened in that browsers. This was now redesigned and catch argument was added.

The defect was fixed.

In previous versions clicking on some styling icons in invitation to ISL Groop meeting would throw errors. Library "jHtmlArea" was updated to version 0.8.0 and this should not happen anymore.

The defect was fixed.

In previous versions when sending email invitation to ISL Groop meeting with multiple recipients, email's content was duplicated. This was now redesigned and content should be added to email only once.

The defect was fixed.

In previous versions ISL Pronto client sent a "close" cmd via a synchronous XMLHTTPRequest. This has now been disallowed since Chrome 80 which resulted that "close" cmd was never sent to ISL Conference Proxy and clients appeared to be "waiting" after closing window. This was now redesigned and synchronous XMLHttpRequest was replaced with a call to navigator.sendBeacon(). Message that client has left chat should now be shown immediately when client closes chat.

The defect was fixed.