ISL Conference Proxy 4.4.1947.98 and 4.4.1947.101 with modules for Windows and Linux (2020-04-23)

Dynamic /return handler was fixed to return static data only.

Patch was added for jQuery 1.12.4 vulnerability CVE-2019-11358

In previous versions passing of arguments to ISL Pronto API was handled incorrectly, thus XSS HTML injection was possible. Handling of parameters was redesigned, all user input is now correctly escaped.

Support for domain based queries on ISL AlwaysOn connection table was added. User facing connection queries should now be faster.

New webapi method that can optimize ISL AlwaysOn connections table was added. The method is accessible in configuration pages under Active Sessions, ISL AlwaysOn tab, section "DB Optimize". There are two modes on operation:

• optimize all connections (Search All button)
• per domain optimize (Search Domain Users and Search Connections)

jQuery was updated to v1.12, fixed modal and menu css.

Webapi islalwayson/computer/connect/2 logs now include more information about new created connection and target computer.

SSO SAML cookies with v2 key and SameSite=None were added to /sso/saml/sp/. Existing cookies on /sso/saml/sp are kept the same for compatibility with older browsers. Cookie CPSSOID will be now deleted when browser finishes login by visiting /users/main/loginsso.

Functions isldt_* in PostgreSQL database were optimized for better performance.

Settings "Security / External authenticator login settings rules" and "Security / SAML login settings rules" were extended with access permission check rules:

• ["check-key", "KEY", "VALUE"] - KEY must match VALUE exactly (empty VALUE will also match non-existing KEY)
• ["check-attr", "SAMLATTR", "VALUE"] - SAML attribute must match VALUE exactly (attributes are a list of values, so the first match is considered success)
• ["check-in-group", "GROUPEXPR"] - user must be in GROUPEXPR

If the checks fail, user will get access permission error.

Support for multi-column ORDER BY in direct tables mode was added to DB API VFS/DT compat layer.

Host field was added to public web watchdog requests.

HTTP remote proxy handling and reporting was improved.

Translation file change for ISL Conference Proxy will now flag all module apps for restart, because the list of installed languages might change.

Current installed languages list is exported into languages.json when ICP translations are initialized or changed.

ISL Conference Proxy now sets Message-ID in every email for better compatibility with MSAs (mail submission agents) that do not add it themselves.

New setting "HTTP header X-XSS-Protection" was added to configuration pages, Security section. Value of "X-XSS-Protection" header can now be adjusted using the setting. The default value is 0.

Support for storage location on network share location was added. Users can now setup storage location on network share locations on Windows. User can provide username and password used when authenticating to access network share location.

Support was added for DNS records containing underscores.

Bootstrap was updated to version v3.4.1.

jQuery UI was updated to v1.12 in reports.

Core Login module was updated to use Bootstrap v3.4.1.

Backup module was updated to use Bootstrap v3.4.1.

Web internal server errors were improved and now contain also timestamp in web administration, more detailed errors when handler terminated prematurely and handler list.

Css was updated so widgets jquery ui dialogs looks the same in v1.9 and 1.12

DISABLEREFERRALS option was added to ldap authenticator executable: "DISABLEREFERRALS;1; (disable referrals)" The option disables LDAP chase referrals if it causes speed issues.

"[Core] GRID message analytics" was added to logs with two messages that are logged every 15min:

• handled messages with expected execution time (info)
• handled messages with long execution time (warning, critical)

Levels for regular message handling:

• critical >= 1s
• warning >= 100ms

Levels for file message handling (certain object-* messages, direct-upload):

• critical >= 20s
• warning >= 10s

PostgreSQL bloat panel was removed from web admin. The information was not accurate or useful.

PostgreSQL activities panel was added to web admin. It is accessible in configuration pages, section "PostgreSQL", "Activities".

Origin tags support was added to session query backend protocol.

HEFA_LOCK was replaced with a custom lock in expire_task, hhash_task was removed when not needed.

Callback events that were created during init will not be present in logs anymore.

Updated jQuery UI to version v1.12 and updated dependencies.

Updated jquery ui to v1.12 and fixed style changes (ui-menu and dialogs).

Handling of remote procedure calls was improved.

Webapi2 method isllight/session/resolve/1 now stores databaseId and auxId in log.

New log key LIGHTRPC_TIMING_TXT was added.

New origin tags when requesting session info were added.

iPad 13 Safari User-Agent is using Mac desktop format by default. Two changes were made to make it easier to spot potential iOS devices:

• Safari version reports GUI version, not engine version anymore
• " / iOS" is added to desktop OS version

In previous versions owned computer count was not updated after performing the change admin action. This was now redesigned and correct computer count should be shown after migrating computers.

The defect was fixed.

In previous versions when content of chat was deleted, islpronto/chat/content/get/single/1 webapi returned null which caused javascript error on chat_transcript.html page. This was now redesigned and should not happen anymore.

The defect was fixed.

In previous versions backup module contained reference to other modules and module pages would not work correctly if other modules were missing. This was redesigned and references to other modules should now be removed.

The defect was fixed.

In previous versions when sending 2FA confirmation code failed, user did not get any details of error. This was now redesigned and user should now see Twilio error code in such cases. Logs were improved and now contain also "user_id", "ip_address" and "reason".

The defect was fixed.

In previous versions when storage area was deleted, it was still kept in memory and file operations still worked. This was now redesigned and file operations will now fail immediately after delete.

The defect was fixed.

In previous versions backup of database on Windows 32bit machines would fail. This was now redesigned and should not happen anymore.

The defect was fixed.

In previous versions when accessing Security pages on device with slow network, text was flashing on screen, until page was completely loaded. This was now redesigned and issue should not happen anymore.

The defect was fixed.

In previous versions ICP responded with internal error on URLs that use resource loader (for example /users/main/*) when invalid path was provided. This was now redesigned and ICP will now return HTTP 404 error code in such cases.

The defect was fixed.

In previous versions dropdown menu was not fully visible. This was now redesigned and position of dropdown menu on collisions was fixed.

The defect was fixed.

When using login from rpc (old ISL Light Desk and slow external authentication) this can cause significant delays to other rpc calls. This was now redesigned and should not happen anymore.

The defect was fixed.