ISL Conference Proxy 4.4.2120.54 with modules for Windows and Linux (2021-09-28)

In previous versions username and email weren't properly escaped in ISL Light transfer session window. This was redesigned and data is properly escaped.

The defect was fixed.

In previous versions WebAPI2 utils/login/* and utils/login/dialog/* response descriptions were not escaped correctly. This was redesigned and response descriptions are escaped correctly.

The defect was fixed.

Failed attempts to use a grant code are now throttled in ISL AlwaysOn. Please see also ISLCONFPROXY-2111.

Option --grid-clone was added to pg_tool command when using dump_table and restore. Meta information after the latter command will now configure GRID servers not to recheck restored data as it will be assumed correct.

"Keep backward compatible load balancer wildcard records" option was added to single address GRID setting to allow easier migration from regular wildcard GRID setups. Old clients might still need wildcard addresses.

Added a new webapi2 method integrator/webtoken/secure_redirect/encode/1. This method creates secure redirect webtokens (e.g. Login with redirect). To use this method JWT key right "webtoken_secure_redirect_encode_1" is required.

C++ modules were improved to use Go flag preprocessor for .html, .css, .js, .txt, .xml, .xsl:

• Core
• ISL AlwaysOn
• ISL Groop
• ISL Light
• ISL Pronto
• Reports

Core web pages are now available in html folder, not embedded in binary anymore.

Dev flags were added affecting core and C++ modules:

• "Web content source directory"
• "Web content source directory (core only)"
• "Web content don't keep in memory"

Failed attempts to join a session with a code are now throttled. The new settings in Security:

• Max failed attempts to join a session from IP address (default: 60)
• Max failed attempts to join a session period in seconds (default: 60)
• GRID-wide max failed attempts to join a session (default: yes)

ICP will now filter all program parameters in program web start URLs and MUX channels. By default, parameters that are used by modules, are added automatically to allow list. Three new settings were introduced:

• Programs download unsafe arguments action: allow & log unknown parameters as warning by default, but can be increased to rejected (403 access denied)
• Program download log unsafe argument values (insecure, only for debugging): unsafe arguments will be sanitized by default to prevent credentials leaking into logs, "No" by default
• Programs download safe arguments (SCOPERX;LCWEBNAMERX;ARGRX;VALRX; ...): multiline allow list rules, for example to allow x=y for ISL Light and ISL Light Desk:

  web;isllight(desk)?;x;y;

List of scopes:

• web (used by web browser and ISL Network Start)
• mux-netstart (used by ISL Network Start, ISL Light, ISL Player)
• wa2-customization (used by mobile ISL Light)
• islalwayson-mux-programs-start-2 (used by ISL AlwaysOn)
• islgroop-mux-program-download (used by ISL Groop)
• islpronto-mux-program-download (used by ISL Pronto)

web scope rules will also automatically match ISL Network Start's download in mux-netstart, so there is no need to duplicate rules for mux-netstart when allowing parameters in web start URLs.

Button "Create GRID connection file" in "GRID:Create" will now add a server immediately in GRID. A message "Services not available: <id>" will appear in web administration for servers that have services disabled, this includes newly added servers as they have all services disabled. A new file "offline" in ISL Conference Proxy installation directory now prevents ISL Conference Proxy from opening ports on startup. Then file "offline" will be deleted and file "offline_ready" will appear. PostgreSQL will now be initialized, useful for running "pg_tool restore". When "offline_ready" is deleted, ISL Conference Proxy startup will finish and open ports.

Added a new webapi2 method integrator/utils/filter/validate/1. This method validates strings that define access filters. In case of an invalid filter this method can be used to show a warning to the user. On the contrary, when a valid filter is provided confirm with the user that the filter has been parsed successfully.

Two new columns have been added to "DT Raw Data > user" table:

• setting_count: Contains total number of settings set for user.
• setting_keys: Contains first 10 setting keys.

When a new user is created their setting_count is set to 0. Every setting change triggers a setting recount. This includes changes through /conf as well as through Administration module. For the latter a new webapi2 method had to be registered internal/signal/user/setting/update/1. This method is called on every setting update from administration. Only settings released to administration module are counted.

Log severity for "HTTP Request Error" has been reduced from critical to error in the following cases:

• HTTP Error code 404 "Page not found"
• Outside of intranet
• Referrer matches a domain served by ISL Conference Proxy
• Unknown URL handler path

New setting "Moduleapp test log export env" has been added to "Flags:dev", which enables log export on local TCP port that is stored in moduleapp env var "ISLCP_TEST_LOG_EXPORT". Port requires valid runtime secret key. Feature is used for testing purposes only.

Added "Main User" setting. Main user's "enabled" setting is protected and can not be disabled using administration module (only by system administration). Additionally, main user's settings are protected and can not be changed by other domain admins. They can be changed by system administrator (using conf) or by the main user himself (using administration module). Also added fallback so main users always have all administration permissions granted.

Added new webapi2 method internal/grid/reconnect/1. This method can disable disconnected servers from GRID and disable default reconnect task or run reconnect task and servers should reconnect immediately after the task is run. WebAPI2 call is available if dev flag "test_webapis" is enabled.

Minimum Windows version was raised from NT 6.1.0 to NT 6.1.7601 (from os_version=0x06010000-0x7fffffff to os_version=0x06011db1-0x7fffffff). Windows 7 and Windows Server 2008 R2 will need to have service pack 1. ICP start-up log lines will now include RUNT_OSVERSION key.

Added a new webapi2 method domain/admin/user/list/2. This method is used to return a list of users along with their setting_count and setting_keys.

Added support for new tag "read-only". Settings with this tag are shown in GUI but are locked and can't be modified.

Following settings were released and can now be set by Domain Admins in Administration pages (/users/administration). Settings from "/conf" pages (Old name) were renamed (New name) and now use same layout (Page, Section, Subsection) as Administration settings.
Old Name: Max concurrent usage (hard limit)
New Name: Max license usage (hard limit)
Comment: Setting serves as an upper bound limit for the "Max license usage" setting (see below).
Page: General
Section: Account
Subsection: License Usage

Old Name: Max concurrent usage (per user setting)
New Name: Max license usage
Comment: Setting limits the number of concurrent sessions the user can start. One session counts as one ISL light session or one AlwaysOn session or one ISL Groop meeting with up to 10 participants. If the user tries to start more sessions an error message is shown explaining he has reached his concurrent usage limit
Page: General
Section: Account
Subsection: License Usage

Old Name: Max number of ISL AlwaysOn user connections (hard limit)
New Name: Max number of owned connections (hard limit)
Comment: Setting serves as an upper bound limit for the "Max number of owned connections" setting (see below)
Page: ISL AlwaysOn
Section: ISL AlwaysOn
Subsection: License Usage

Old Name: Max number of ISL AlwaysOn user connections (per user setting)
New Name: Max number of owned connections
Comment: Setting limits the number of AlwaysOn computer connections the user can own. If the user tries to add more than the set number of computers an error message is shown explaining he has reached the maximum number of licensed connections. Computers that are shared with the user do not count towards limit.
Page: ISL AlwaysOn
Section: ISL AlwaysOn
Subsection: License Usage

New webapis were added:

• domain/admin/group/info/1: returns general information about group (computer or user group)
• domain/admin/group/members/list/1: returns list of members of group with their permissions (for computer groups) that match specified filters
• domain/admin/group/members/update/1: can be used to add new members or remove existing (update member by adding with new permission)

New permission was also added (for changing computer groups):

• Create, edit and delete computer groups (domain admin only)

This setting grants access to the "Computer Groups" tab in the Administration Dashboard. There, the user can view a list of computer groups in their domain, create new groups, change their members and delete existing ones. If you disable this permission, the user will not have access to the "Computer Groups" tab. Please note that the user must be a domain admin to access the Administration Dashboard (see the "Domain Admin" setting).

New permission is also used to disable/enable "Change Owner" option in "Computer Groups" together with webapi domain/admin/computergroup/changeowner/1.

ISL Conference Proxy/conf UI improvements include:

• "Web hits" page now uses longer and clearer texts for "Source server" and "Remote server" columns.
• "Logs" page is organized with sections for each subsystem.
• Manual mode in "Online update > Edit update list..." is supported in Safari.
• "Storage Area" type chooser is fixed in Safari
• On successful login after session expires CPSESSID_EXPIRED will no longer be present in the URL

Option to revert PostgreSQL direct tables to VFS (Virtual File System) tables database or file database backend has been removed.

New version "v2100" web pages have been added which are initialised from v440.

Slight design improvements to Administration module dashboard.

"Debug > Server LB XML" now shows webapi2 methods, their registered servers and load servers.

Computer groups are no longer automatically deleted when last user is removed from the group. Empty groups will now be marked as such in Administration module, where Domain Admin can assign new Group Admin to manage the group.

The following webapi2 methods have been added:

• utils/group/info/3
• utils/group/query/4
• utils/group/security/4
• utils/group/update/3

The methods have the same functionality as the previous versions, however, now they also include the owner of the group in their response. Owner is marked in "rights -> all" section of group details, with "owner: 1". New webapi is used to correctly show owners of computer groups on ISL AlwaysOn web pages.

Added dashboard to integrator module where specific users can view, create, update or delete jwt integrations. Additionally, added new permission "User can manage application integrators" ("User Management > Security > System Administration > Application Integrators") which grants access to the new dashboard ("/users/integrations/integrations.html").

Activity log now contains SSO (Single Sign-On) login events. SSO access denied will trigger a webapi2 user error event and will be logged in core_user_login. A new field "LOGIN_USERINPUT_TXT" has been added to all login dialog logs in order to log usernames.

jQuery was updated to version 3.6.

Update Bootstrap version in main template and styles from v3 to v4.6

Added a new webapi2 method system/integrator/jwt/list/1. This method is used by integration dashboard to list existing integrations. User requires "User can manage application integrators " ("User Management > Security > System Administration > Application Integrators") permission to call webapi otherwise "Insufficient permissions" error is returned.

Added a new webapi2 method system/integrator/jwt/add/1. This method is used by integration dashboard to create new integrations. User requires "User can manage application integrators " ("User Management > Security > System Administration > Application Integrators") permission to call webapi otherwise "Insufficient permissions" error is returned.

Added a new webapi2 method system/integrator/jwt/update/1. This method is used by integration dashboard to update existing integrations. Only rights can be changed for existing integrations. User requires "User can manage application integrators " ("User Management > Security > System Administration > Application Integrators") permission to call webapi otherwise "Insufficient permissions" error is returned.

Added a new webapi2 method system/integrator/jwt/remove/1. This method is used by integration dashboard to remove existing integrations. User requires "User can manage application integrators " ("User Management > Security > System Administration > Application Integrators") permission to call webapi otherwise "Insufficient permissions" error is returned.

Expanded test_webapi2.html so it's possible to make integrator or authorized app calls from it. Registered integrator_user_jwt_api_access_public_rsa_keys table ("DT Raw Data > integrator_user_jwt_api_access_public_rsa_keys") where authorized apps are stored. Currently the only way to authorize apps is via webapi2 method integrator/authorize/app/1. It serves as a bridge/cross-reference/association table between integrators and users. With an additional column for granted rights. A new setting has been added "Authorized app RSA key size" ("User Management > Security > System Administration > Application Integrators"). This setting defines the key size for the RSA key pair. When user authorizes an integration application (or an integrator via integrator/authorize/app/1) an RSA key pair is generated which serves a role similar to access tokens in OAuth.

Added new webapi2 method integrator/authorize/app/1. Webapi authorizes selected integrator on behalf of the user. It returns the private key from the RSA key pair generated during authorization.

Moved existing webapi2 method utils/webtoken/debug/1 from "utils" to "internal". Added a new internal webapi2 method internal/ua/throttle/flush/1. This method exposes existing functionality "Flush UA throttle" from conf. Added a new webapi2 method integrator/user/login/1. Integrators can use this method to obtain valid CPSESSIDs which can then be used to login users. Login is performed by making call to internal webapi internal/user/login/1.

The new right required to call this webapi is "user_login".

Secondly user has to authorize the integrator and grant it "read_session_id" app right. (This is done via integrator/authorize/app/1)

Args:

• lang: Optionally override users last used lang with supplied one. Set to empty string to force empty value. Skip arg to used users last used>
• lang_variant: Optionally override users last used lang variant with supplied one. Set to empty string to force empty value. Skip arg to used users last used>
• time_zone: Optionally override users last used with supplied one. Set to empty string to force empty value. Skip arg to used users last used>

New setting "Ignore disable services in load balanced" has been added to "Flags:dev". If enabled when initializing new GRID server with connection file, "setting_lboff" file will be ignored and load balancer will be kept enabled for new server.

Bootstrap was updated to version 4.6 in ISL Reports module pages.

Bootstrap was updated to version 4.6 in ISL Light module pages.

Bootstrap was updated to version 4.6 in ISL AlwaysOn module pages.

Bootstrap was updated to version 4.6 in ISL Pronto module pages.

Bootstrap was updated to version 4.6 in ISL Groop module pages.

Bootstrap was updated to version 4.6 in ISL Administration module pages.

Breadcrumbs were added to Administration pages. They represent the path that the user has traversed from top level tabs and can be used to quickly navigate back to previous locations. Breadcrumbs also store URL arguments so they are restored when navigating back to already visited pages. On direct navigation to page that has shown breadcrumbs (navigating directly to user settings), the breadcrumbs will be partially restored, root tab is added ("Users", "User Groups", "Computer Groups").

Bootstrap was updated to version 4.6 and will be served with new static version v2100.

Updated the webapi2 method internal/utils/grid/servers/get/1 which now supports IP views:

• return_address: Set to 1 to return address. ip_view or client_address must also be passed. client_address will be used if ip_view is not passed.
• client_address: Used with service to get sorted load balanced list of servers. Also used by return_address.
• ip_view: IP view for server address, use: -1 (GRID connection), 0 (public), 1 (intranet), 4 (IPv4), 6 (IPv6), or any other numeric IP view ID
• ip_view_fallback: If client_address does not match an IP view, use fallbacks: 0 (public), 1 (auto intranet), 4 (IPv4), 6 (IPv6), 46 (auto IPv4/IPv6, default)

New group details page was added, where basic group info is shown (name, type, owner). Name and owner can be changed.

User can navigate to this page from "User Groups" or "Computer Groups" table.

Page lists members of the group, users for user group or users and user groups for computer group. Members can be filtered and sorted. Members of group can be removed or their permission for computer group can be changed. Members from other domains can be removed or permission changed, invalid/broken members can be removed.

Members of the group can be edited in sidebar.

icpdevmode web resource sync enables git repository web pages to be synced into extracted ICP modules. Sync is run on each module start.

Added a new webapi2 method utils/password/forgot/users/list/2. This method returns all users along with their "Full name", "Account ID", "Display name" that match the given email.

Added new webapi2 method internal/user/login/1. This method is used by integrator webapi integrator/user/login/1 to retrieve valid CPSESSIDs for users. It works exactly the same as the "Login as user" functionality from conf with the added option of overriding users last used lang, lang variant and time zone.

Some limitations:

• It is NOT possible to obtain CPSESSIDs for admin/conf user.
• It is NOT possible to obtain CPSESSIDs for disabled user.
• User setting must_change_password does not prevent login.
• User setting authenticate_allow_missing_2fa does not prevent login.

Supported args:

• user_id: DBID of user.
• lang: Optionally override users last used lang with supplied one. Set to empy string to force empty value. Skip arg to used users last used val.
• lang_variant: Optionally override users last used lang variant with supplied one. Set to empy string to force empty value. Skip arg to used users last used val.
• time_zone: Optionally override users last used with supplied one. Set to empy string to force empty value. Skip arg to used users last used val.

Added setting "Max failed login attempts from an application integrator's IP address" ("User Management > Security > System Administration > Application Integrators") (default: 120 which is interpreted as 2 per second when using default 60 second interval) which controls address throttling in internal/user/authenticate/throttle/1 when in integrator address mode.

Bootstrap was updated to version 4.6 in ISL Core Login module pages.

ISL Conference Proxy module interface version was raised from 440 to 441. Modules 4.4.2120 will not load anymore on 4.4.2044 or older.

Access to https web pages and mux ssl channels is now recorded in counters and hag logs. The record consists of user's ssl version and potential errors on ssl handshake.

New setting was added "Additional reCAPTCHA protected webapis" where user can list webapis that he would like to protect with recaptcha. Recaptcha was added to "utils/password/forgot/1" webapi by default. Recaptcha check is implemented on "/users/main/forgotpassword.html" page and in Administration pages in Reset Password dialog.

Maximum uncompressed size for .module files has now been increased to 0xfffffff (268435455) bytes, which had previously been 0x7ffffff (134217727) bytes.

In previous versions when clicking "Save" button in /conf, all settings were saved, regardless if they were changed or not. This was now redesigned and only changes are saved. Additionally selected settings are now marked and their background color is changed to light blue. Secure settings such as "Database secret" were updated and now no longer have checkbox next to it as it had no impact.

Added a new webapi2 method utils/webtoken/info/2. This method also returns field missing_2fa along with other webtoken data. The newly added field is "true" when user is required to have 2 Factor Authorization but does not have it configured properly.

Computer groups tab was updated and now uses the new table library with support for ordering columns, resizing columns, hiding/showing columns.

Also checking for invalid/broken members was modified, and now "Group member is not valid." error is no longer marked on group when broken membership belongs to broken owner of this group.

Flag preprocessor is now enabled for static web page resources (js & css) in Backup and Core Login module.

Flag preprocessor now supports build time flags which are automatically passed to modules. "Debug > flags.json" now contains both regular and build time flags rendering flags_static.json unnecessary, hence it was removed. Flags without a corresponding registered flag will be visible in flag setting list, optionally ("Flags:dev" > "Show unreferenced flags") followed by "(unreferenced)" text. To view the full list of unreferenced flags head to "Debug > flags_unreferenced.txt". Init and build time flag mismatches are now correctly reported.

Bootstrap was updated to version 4.6 in ISL Backup module pages.

"Debug > Flags" internal flag export JSON format now supports multiple references per flag.

ISL Conference Proxy now accepts translated strings for tr (Turkish) language and includes them in generated translation files.

Updated GeoIP to use the database GeoLite2-City 2021-09-20T22:57:44Z.

Failed attempts to join a session with a code are now throttled in ISL Groop. Please see also ISLCONFPROXY-2111.

New option to modify the invitation/notification email templates was added. New setting is accessible in /conf pages: ISL Groop -> Other -> Uncategorized -> "Invitation email template".

Failed attempts to join a session with a code are now throttled in ISL Light. Please see also ISLCONFPROXY-2111.

Setting ISL Light installation schema was added to ISL Pronto settings, which affects ISL Pronto application. If not set, the setting ISL Light installation schema, from default server or account customization is used.

Added two settings ("Allow send file in chat" and "Allow receive file in chat") which enable or disable file sending and receiving from ISL Pronto chat.

In previous versions ISL Groop invitation email template strings were not translated. This was redesigned and translations were added.

The defect was fixed.

In previous versions Inpage chat would sometimes cause ISL Conference Proxy to crash. This was now redesigned and should not happen anymore.

The defect was fixed.

In previous versions setting enabled (Account enabled) was present in domain scope. This was redesigned and setting was removed from domain scope.

The defect was fixed.

In previous versions encapsulated settings were added to response before checking the scope. This was redesigned and scope is checked before including encapsulated settings.

The defect was fixed.

In previous versions if session lasted less than 10 seconds, recorded data (bytes transferred and session duration) would be invalid. This was redesigned, task is executed every second first 30 times and data for sessions shorter than 10 seconds should now be correct.

The defect was fixed.

In previous versions ISL Light transfer session tooltip included HTML tags. This was redesigned and HTML tags are no longer present in the tooltip. Other fixes include:

• ISL Light transfer session window is no longer escaped twice.

The defect was fixed.

In previous versions in case of an error (empty title) when creating a meeting, create meeting button was disabled and did not work when title was entered. This was redesigned and create meeting button should be reenabled after error.

The defect was fixed.

In previous versions ISL Conference Proxy would sometimes report error "invalid privilege data in db object during load". This was now redesigned, active session code reading was optimized and issue should not happen anymore.

The defect was fixed.

In previous versions when resizing bulk share dialog in computer list, dialog did not resize correctly. After loading was done, text about loading computers was still shown. This was now redesigned, dialog should resize correctly and loading text should be hidden after loading is done.

The defect was fixed.

In previous versions file downloads in ISL AlwaysOn web interface or ISL Pronto chat failed if download took more than 20 minutes. This was redesigned and slower downloads are supported.

The defect was fixed.

In previous versions of Administration Module some of create, update and delete user group strings were not translated. This was redesigned and translations were added.

The defect was fixed.

In previous versions shared with icon was not shown on computers when only shared with user groups. This was redesigned and icon is shown if computer is shared only with user groups. Other fixes include:

• Icons were updated to match the ones used in ISL Light desktop.

The defect was fixed.

In previous versions redundant webapi calls were made when sharing a computer. This was redesigned and cached computer groups are used when sharing a computer.

The defect was fixed.

In previous versions computer groups tab clarity was hindered. This was redesigned and changed to:

• column "Computers" was renamed to "# Computers"
• "Status" column now shows "Ok" status
• "Owner" column is no longer clickable

The defect was fixed

In previous versions on startup of ISL Conference Proxy error "DT change notify HTTP call failed" was logged. This was now redesigned and should not happen anymore.

The defect was fixed.

In previous versions download bubble was shown on browser Edge. This was redesigned and download bubble is not longer shown on browser Edge.

The defect was fixed.

In previous versions Edge browser would be detected as Chrome and wrongly displayed in Login devices pages. This was redesigned and Edge browser is detected correctly.

The defect was fixed.

In previous versions modules couldn't override flags that were already tagged by ICP. This was redesigned and modules can override ICP flags.

The defect was fixed.

Missing translations for computer group sharing were added: "Edit"

The defect was fixed.

In previous versions alignment of title and image block in Groop survey editor did not work correctly. This was now redesigned and elements should be correctly aligned.

The defect was fixed.

In previous versions when editing layout of meeting survey or registration form placeholders sometimes remained. This was redesigned and placeholders when dragging elements are now removed.

The defect was fixed.

In previous versions it was assumed that server ID is -1 if grid is not enabled, so no settings were found and displayed in Administration module pages when ID was different. This was redesigned and correct server ID is used if grid is not enabled.

The defect was fixed.

In previous versions Administration module reported calculated settings values. This was redesigned and raw DB values are reported.

The defect was fixed.

In previous versions both Webhook URL and JWT private key (PEM file) needed to be set and valid for JWT Webhooks to be considered enabled. This was redesigned and JWT Webhooks are considered enabled as soon as Webhook URL is set. Other fixes include:

• JWT private key (PEM file) now supports absolute paths as well.

The defect was fixed.

In previous versions redundant ">" symbol was shown in join.html page in androidTemplate. This was now redesigned, symbol was removed and should not be shown anymore.

The defect was fixed.

In previous versions date input in Pronto page moved few pixels when focused. This was redesigned and input no longer moves on focus.

The defect was fixed.

In previous versions html template had input field with onload event which was not triggered. This was now redesigned and unused event was removed.

The defect was fixed.

In previous versions computer group name in "Edit group" dialog was not unescaped. When saving such unescaped name, the name of the group was changed although no actual changes were made by user. This was redesigned, name should be unescaped and the current name of computer group should be correctly shown in the input.

The defect was fixed.

"Change Admin" was changed to "Change Owner" on ISL AlwaysOn web page. Order of computer actions was changed, all actions are now shown and unavailable are disabled.

The defect was fixed.

In previous versions "Expand" and "Collapse" words were not translated in Administration Module. This was redesigned and translations were added.

The defect was fixed

In previous versions Internet Explorer browser reported syntax error when opening Administration pages and page was not displayed correctly. This was now redesigned and issue should not happen anymore.

The defect was fixed.

In previous versions rendering large amount of computer groups in computer list was slow. This was redesigned and render should be faster.

The defect was fixed.

In previous versions selecting owner with "enter" key produced "Please select new owner." error. This was fixed and new owner should be selected. Other fixes include

• Sidebar is now also positioned in front with z-index to prevent overlap with customizations.

The defect was fixed.

In previous versions Integrator Module HTTP Server log subsystem was not registered, causing logs to fail. This was redesigned and missing log subsystem was added.

The defect was fixed.