ISL Conference Proxy 4.4.2210.45 for Windows and Linux (2022-06-07)

Support for Automatic Certificate Management Environment (ACME) protocol was added to ISL Conference Proxy with new SSL Module. GUI is accessible at: /users/ssl/ssl.html, showing current status and providing option to install, renew or revoke SSL certificate. User needs to have rights to access page (setting: "Allowed IP addresses for administration" in /conf -> Security). 3 new webapi2 methods are installed:

• "system/ssl/tos/get/1" retrieves link to certificate authority's terms of service.
• "system/ssl/certificate/get/1" creates private key with elliptic P-256 curve, creates CSR and sends it to Certificate Authority. Domain is validated via provisioning HTTP resource under /.well-known/acme-challenge URI on ICP server or by creating temporary TXT record in ICP's DNS zone (see also ISLCONFPROXY-2574).
• "system/ssl/certificate/revoke/1" reads cert and private key and sends revoke request to Certificate Authority.

Certificates created by SSL Module are stored in "ssl_certificate_history" DT table.

Registered new webapi "system/ssl/certificate/info/1" to retrieve current certificate info. Existing functionality to dump certificates via /conf -> Debug -> Cryptography ZIP was now extended to also report certificates managed by SSL Module.

New setting "User can create SSL certificates" was added to /conf -> Security, that will enable permissions for ICP SSL module pages and webapis.

OpenSSL was upgraded to 1.1.1LTS, support for TLS1.3 and new ciphers was added, not used cipher TLS_RSA_WITH_IDEA_CBC_SHA was removed.

Existing setting "HTTPT use SSL" in /conf -> General was extended with new option: "Managed by SSL module". When new certificate is obtained via SSL module, certificate is then tested, installed to ICP and "HTTPT use SSL" setting will be automatically set to "Managed by SSL module", meaning ICP will use this new cert.

Settings to support IP/DNS views were added to ICP:

• "Security > Address to view numeric ID mapping (MATCH=ID ...)"
  • multiple lines of IP match to view numeric ID like "192.168.0.0/16=10", matches are done line by line and stop on first match
  • settings "Security > Force networks to public internet (view 0) address" and "Security > Force networks to private intranet (view 1) address" are appended to the IP match list
  • use IDs 10 and greater for custom private networks
  • built-in fallback IDs, if "Security > Address to view numeric ID mapping (MATCH=ID ...)" does not match any ID:
    • 0: default fallback, also used by "Security > Force networks to public internet (view 0) address"
    • 1: compatibility, used by "Security > Force networks to private intranet (view 1) address"
    • 4: fallback for DNS A records using server_address_ipv4 and TCP/HTTP connect hints when client is on IPv4 network
    • 6: fallback for DNS AAAA records using server_address_ipv6 and TCP/HTTP connect hints when client is on IPv6 network
• "GRID > Settings > GRID view numeric ID to address mapping (ID=ADDR&...) on server X"
  • maps view numeric ID to address like "6=ffff::11"
  • mapping will be automatically used in DNS records: name servers, load balancing, server names
• "GRID > Settings > GRID address (view 0) on server X"
  • DNS names may now be used and DNS records will automatically use CNAME instead of A/AAAA: name servers, load balancing, server names

Changes to DNS zones:

• view DNS action (pairs of view numeric ID and record value are matched based of DNS client's IP, optional fallback is used if nothing matches)
  {view|VIEW1|VALUE1|VIEW2|VALUE2|FALLBACK}
  • view will match view 0 if none of the IP rules match
  • advanced rules, mostly provided for completeness to cover entire internal IP view API:
    • view_auto_intranet: same as view, but will match view 1 if DNS client's IP is in private IP range and none of the IP rules match and it will match view 0 if DNS client's IP is NOT in private IP range and none of the IP rules match
    • view_ipv4: same as view, but will match view 4 if none of the IP rules match
    • view_ipv6: same as view, but will match view 6 if none of the IP rules match
    • view_auto_ipv46: same as view, but will match view 4 or 6 if DNS client's IP is IPv4 or IPv6 and none of the IP rules match
• setting "Enable client DNS debugging records (whatismydns)" adds whatismydns and ^whatismydns-[^.-]+$ that resolve to client's DNS resolver IP using A/AAAA records

New functionality that allows domain admins to export settings of domain users was added to Administration pages -> Users tab under "Export CSV" button. Only one export can be active at once. If you want to create newer export, you have to first clear previous one. Export is currently available in 3 formats: CSV (semicolon), CSV (comma) and JSON.

Advanced DNS zone settings were redesigned. New settings are backwards compatible with old states and will be shown correctly in GUI. There is now one new option: "Use wildcard records for services" that will use and show wildcard records for load balancer.

Support for selecting custom certificate Subject Alternative Names was added to GUI. First "system/ssl/dns/names/get/1" is called to return list of default dns names. User can edit the list, entering custom values, separated by comma. When custom values are used, same values will then be used when renewing certificate.

Registered new internal webapi2 method "internal/dns/ssl/names/1". Method returns a list of DNS domains configured for SSL cert. Domains which are configured for wildcard grids start with *. Added new setting "Enable managed SSL certificate" in Advanced section of DNS zone settings. When enabled (enabled by default), this zone will be included in result of webapi call "internal/dns/ssl/names/1".

Registered new webapi2 method "system/ssl/dns/names/get/1", which returns list of domains that will be included in SSL certificate.

Registered "internal/dns/zone/record/add/1" webapi method, to add temporary records to DNS zone. Delete task is run every 5 minutes and will remove expired records.

Support for "dns-01" challenges was added, which are used to obtain wildcard certificates. Temporary DNS records for responding to "dns-01" challenges are then added to domain resolvers. Wildcard domain names are added to Subject Alternative Names in certificate.

Settings "HTTPT SSL protocol", "Application MUX SSL protocol", "GRID SSL protocol" now support hex code format as a replacement for deprecated "ALL -PROTOVER1 -PROTOVER2" format. Default value is now "0x0301-0x10000" in TLS 1.0 profile (default) and "0x0303-0x10000" in TLS 1.2 profile. 3-byte hex code "0x10000" is interpreted as no bound.

SSL cipher suites can now be specified using a simple numeric hex code list. New default value for "HTTPT SSL cipher suite", "Application MUX SSL cipher suite", "GRID SSL cipher suite":

• in TLS 1.0 profile (default): 0x1302 0x1301 0x1303 0xc02c 0xc02b 0xcca9 0xc030 0xc02f 0xcca8 0xc024 0xc023 0xc028 0xc027 0xc00a 0xc009 0xc014 0xc013 0x9d 0x9c 0x3d 0x3c 0x35 0x2f 0xa
• in TLS 1.1 profile: same as TLS 1.0
• in TLS 1.2 profile: 0x1302 0x1301 0x1303 0xc02c 0xc02b 0xcca9 0xc030 0xc02f 0xcca8 0xc024 0xc023 0xc028 0xc027 0x9d 0x9c 0x3d 0x3c

New setting was added to switch all protocol versions and cipher suites "Security > Default SSL profile":

• TLS 1.0 (default)
• TLS 1.1
• TLS 1.2

Following settings were released and can now be set by Domain Admins in Administration pages (/users/administration). Settings from "/conf" pages (Old name) were renamed (New name) and now use same layout (Page, Section, Subsection) as Administration settings.

Old Name: Allow send file in chat
New Name: Send files in chat
New Desc: If this setting is disabled, the operator won't be able to send any files to the client. The operator will still be able to receive files (if the \"Receive Files in chat\" setting is enabled).
Page: ISL Pronto
Section: Operator
Subsection: File Transfer

Old Name: Allow receive file in chat
New Name: Receive files in chat
New Desc: If this setting is disabled, the operator won't be able to receive any files from the client. The operator will still be able to send files (if the \"Send Files in chat\" setting is enabled).
Page: ISL Pronto
Section: Operator
Subsection: File Transfer

Load balancing "Service settings" feature "Test run" was improved with IP view logs.

"web setting page does not exist" init error was improved and will now contain page id, scope and key.

A new setting named "External authenticator maximum sync group" was added to /conf -> Security. The default value is 300. Previous maximum was 100 groups.

History data lifecycle settings > Allow automatic delete is now enabled by default for Administration: Reports.

In previous versions when turning 2FA on ICP would always show "Restore 2FA devices" UI if the user had any stored devices. This has been redesigned and the user is now prompted to choose whether he wants to add a new device or restore older devices if any are stored.

Added option to provide SSL Administrator email, which will be then set as contact info during acme client registration process.

Previously MALLOC_ARENA_MAX was calculated by counting cpus found in /proc/cpuinfo. This has been redesigned to use "nproc" instead.

Dev flags moduleapp_testing_json_env, moduleapp_test_autotransport, moduleapp_test_log_export, test_webapis were merged into integration_test. Dev flag moduleapp_expose_testing_json_env was renamed to integration_test_expose_env.

Support for product modules was added to ISL Conference Proxy.

DT table "setting_info" in ICP contained only domain and user settings. This has been changed to contain all settings.

All flags from 4.4.1837 branch were deleted. These flags are now considered as enabled and can not be disabled by user anymore. Deleted flags:

• 2017-12-06 ISLCONFPROXY-1611 dt table default configuration
• 2018-06-27 ISLCONFPROXY-1735 user agent stats
• 2018-09-21 ISLCONFPROXY-1780 LIB-936 custom_filter user agent geoip country
• 2018-09-21 ISLCONFPROXY-1780 custom_filter geoipcc callback
• 2018-09-21 ISLCONFPROXY-1780 external login dialog ctx_connua
• 2018-09-21 ISLCONFPROXY-1780 geoip country code webapi filter
• 2018-09-21 ISLCONFPROXY-1780 store user agent in webapi params
• 2018-09-21 ISLCONFPROXY-1780 user agent http filter
• 2018-09-21 ISLCONFPROXY-1780 user agent webapi filter
• 2018-09-21 ISLCONFPROXY-1780 webapi filter ip to IP
• 2018-07-05 ISLLIGHT-5078 assume light_external_id is always set
• 2018-08-08 ISLCONFPROXY-1760 use confproxy_proc moduleapp
• 2018-08-09 ISLCONFPROXY-1760 require ready signal
• 2018-08-13 ISLCONFPROXY-1760 moduleapp conf gui
• 2018-08-14 ISLCONFPROXY-1766 ISLCP_MAINDIR
• 2018-08-16 ISLCONFPROXY-1766 moduleapps flags
• 2018-08-16 ISLCONFPROXY-1766 moduleapps flags conf gui
• 2018-08-16 ISLCONFPROXY-1766 use ISLCP_MAINDIR for reading server ID in core_login
• 2018-08-17 ISLCONFPROXY-1766 restartable moduleapps in GRID
• 2018-08-19 ISLCONFPROXY-1766 module load internal error
• 2018-08-19 ISLCONFPROXY-1766 moduleapps track down time
• 2018-08-22 ISLCONFPROXY-1770 execute html templates for flags before parsing them in core_admin
• 2018-08-22 ISLCONFPROXY-1770 execute html templates for flags before parsing them in core_login
• 2018-08-22 ISLCONFPROXY-1774 LIB-926 always run html2attr
• 2018-08-22 ISLCONFPROXY-1774 LIB-926 escape quotes html2attr
• 2018-06-15 ISLCONFPROXY-1743 ISLCP_DBDIR
• 2018-08-29 ISLCONFPROXY-1778 moduleapp dev mode
• 2018-08-30 ISLCONFPROXY-1778 moduleapp reload signal
• 2018-08-23 ISLCONFPROXY-1775 remove register_translations_changed_webapp
• 2018-08-23 ISLCONFPROXY-1775 remove register_translations_changed_webapp core_admin
• 2018-08-23 ISLCONFPROXY-1775 remove register_translations_changed_webapp core_login
• 2018-08-23 ISLCONFPROXY-1775 retranslate moduleapp dependencies
• 2018-08-23 ISLCONFPROXY-1775 static retranslate
• 2018-08-27 ISLCONFPROXY-1775 retranslate cache
• 2018-08-29 ISLCONFPROXY-1775 translations changed per module
• 2018-07-28 ISLALWAYSON-1358 add domain id to islalwayson tables
• 2018-07-28 ISLALWAYSON-1358 check for valid domain in grant
• 2018-07-28 ISLALWAYSON-1337 add limit number of granted connections to settings
• 2018-07-28 ISLALWAYSON-1337 limit number of granted connections in grant
• 2018-07-28 ISLALWAYSON-1337 limit number of granted connections in migrate
• 2018-07-25 ISLCONFPROXY-1761 handle null in json_to_ul
• 2018-08-02 ISLALWAYSON-1357 register webapi2 islalwayson/usage/1
• 2018-08-02 ISLALWAYSON-1357 return nulls in islalwayson/usage/1
• 2017-09-19 ISLCONFPROXY-1531 insert row with initial data
• 2018-10-31 ISLCONFPROXY-1809 block swf by default
• 2018-07-13 ISLCONFPROXY-1745 web request ctx user_missing_2fa state
• 2018-07-17 ISLCONFPROXY-1745 user_authenticate_web return ISLDB_USER_AUTHENTICATE_WEB_MISSING_2FA
• 2018-07-18 ISLCONFPROXY-1745 external login dialog missing_2fa
• 2018-07-18 ISLCONFPROXY-1745 webapi2 login dialog missing_2fa
• 2018-07-19 ISLCONFPROXY-1745 xpp logged_in_user missing_2fa
• 2018-07-26 ISLCONFPROXY-1745 xpp setup_2fa_link
• 2018-07-19 ISLCONFPROXY-1745 user_missing_2fa in map_path_to_http_backend
• 2018-07-16 ISLCONFPROXY-1745 setup2fa default url
• 2018-07-16 ISLCONFPROXY-1745 setup2fa handler
• 2018-07-18 ISLCONFPROXY-1757 core login webapi2 allow missing 2fa
• 2018-07-19 ISLCONFPROXY-1757 core login pages missing_2fa
• 2018-07-23 ISLCONFPROXY-1757 Add 'Enforce 2FA' setting
• 2018-07-24 ISLCONFPROXY-1757 Use 'Enforce 2FA' setting
• 2018-10-23 ISLCONFPROXY-1805 clear session code if form value changes
• 2018-07-03 ISLALWAYSON-1346 store tags when granting access
• 2017-09-11 ISLCONFPROXY-1523 test api x-islcp-header
• 2018-09-18 ISLPRONTO-1228 use 8 byte random ID for client ID
• 2018-09-19 ISLPRONTO-1228 remove session instance support
• 2017-06-19 ISLPRONTO-1058 Do not use 'joined_users' to determine user was active in chat
• 2017-06-19 ISLPRONTO-1058 update pronto_chat_members table with 'first_joined' and 'role' index
• 2017-09-12 ISLCONFPROXY-1524 webapi2 internal/utils/grid/servers/get/1
• 2017-07-04 ISLPRONTO-1062 do not run user_authenticate with empty username
• 2018-10-17 ISLCONFPROXY-1793 register webapi2 method backup/list/servers/1
• 2018-11-30 ISLCONFPROXY-1824 increase webapi client timeout to 30 in core_login
• 2018-10-31 ISLCONFPROXY-1808 allow untrusted setting
• 2018-10-31 ISLCONFPROXY-1808 force download all untrusted files
• 2018-11-22 ISLCONFPROXY-1820 netfilter net spec cache
• 2018-11-21 ISLCONFPROXY-1820 show system webapi2 only on /conf IPs
• 2018-11-22 ISLCONFPROXY-1820 restrict webapi2 system/ calls
• 2018-11-23 ISLCONFPROXY-1823 use static_web_filter_allow
• 2018-12-05 ISLGROOP-1021 read current db value in db change callback
• 2018-12-12 ISLCONFPROXY-1760 report start timeout
• 2018-08-22 ISLCONFPROXY-1770 execute html templates for flags before parsing them in backup module
• 2018-08-23 ISLCONFPROXY-1775 remove register_translations_changed_webapp backup
• 2018-10-16 ISLCONFPROXY-1789 register webapi2 method backup/location/add/1
• 2018-10-16 ISLCONFPROXY-1790 register webapi2 method backup/location/edit/1
• 2018-10-17 ISLCONFPROXY-1791 register webapi2 method backup/location/remove/1
• 2018-10-18 ISLCONFPROXY-1796 register webapi2 method backup/status/1
• 2018-10-18 ISLCONFPROXY-1797 register webapi2 method backup/list/active/1
• 2018-10-18 ISLCONFPROXY-1798 register webapi2 method backup/list/history/1
• 2018-10-17 ISLCONFPROXY-1792 register webapi2 method backup/location/list/1
• 2018-10-18 ISLCONFPROXY-1794 register webapi2 method backup/location/get/1
• 2018-10-18 ISLCONFPROXY-1799 backup module enable GUI
• 2018-11-22 ISLCONFPROXY-1823 /users/backup conf filter
• 2018-12-21 ISLCONFPROXY-1842 disable legacy login after login method restore
• 2018-09-03 ISLALWAYSON-1393 add report webhook setting
• 2018-09-03 ISLALWAYSON-1393 computer count webhook
• 2018-10-18 ISLCONFPROXY-1795 register webapi2 method backup/make/1
• 2018-11-30 ISLCONFPROXY-1826 increase webapi client timeout to 30 in backup module
• 2018-12-06 ISLCONFPROXY-1828 backup module missing spinner
• 2017-08-21 ISLGROOP-816 Enable webtoken refresh for ISL Groop clients
• 2017-12-28 ISLCONFPROXY-1626 moduleapp activity log
• 2017-08-23 ISLCONFPROXY-1512 login.html reverse login dialog buttons
• 2018-12-07 ISLCONFPROXY-1829 backup module fix ui glitches
• 2017-07-04 ISLCONFPROXY-1484 report file access
• 2018-08-02 ISLPRONTO-1153 Decode 'pronto::user::light::desk_password' before sending to pronto
• 2017-10-18 ISLCONFPROXY-1565 LIB-826 enable range ip matcher
• 2017-10-23 ISLCONFPROXY-1566 LIB-832 fix parser order
• 2018-02-02 ISLALWAYSON-1307 obsolete invalid name webapis
• 2018-08-07 ISLPRONTO-1151 Truncate client nickname to 100 characters
• 2017-10-06 ISLPRONTO-919 Permit supporter to retrieve information about his chats
• 2017-02-10 ISLCONFPROXY-1271 http 1.0 connection close write
• 2018-04-23 ISLCONFPROXY-1716 reorder permissions prio
• 2018-04-23 ISLCONFPROXY-1716 web admin local override
• 2018-02-05 ISLGROOP-985 correct permission inheritance
• 2017-09-19 ISLCONFPROXY-1532 detect timezone in javascript
• 2018-03-20 ISLALWAYSON-1325 add simple key wol_group to computers
• 2018-03-20 ISLALWAYSON-1325 store wol_group to computers
• 2018-03-20 ISLALWAYSON-1325 use wol_group when sending wol packet
• 2018-05-14 ISLALWAYSON-1329 use also secure_on when sending remote wols
• 2019-01-08 ISLALWAYSON-1421 use deleted objects when reporting webhook
• 2019-01-18 ISLCONFPROXY-1854 DNS COOKIE
• 2019-01-18 ISLCONFPROXY-1854 EDNS0 support
• 2019-01-18 ISLCONFPROXY-1854 RD response
• 2019-01-18 ISLCONFPROXY-1854 add OPT record type
• 2019-01-19 ISLCONFPROXY-1855 ECS
• 2019-01-19 ISLCONFPROXY-1855 init dns action api
• 2018-04-03 ISLCONFPROXY-1684 add user_admin_domain, user_admin_domain_edit_users and user_admin_domain_edit_groups settings
• 2019-01-16 ISLCONFPROXY-1703 register webapi2 method admin/domain/user/permission/list/1
• 2019-01-16 ISLCONFPROXY-1707 register webapi2 method admin/domain/user/list/1
• 2019-01-16 ISLCONFPROXY-1758 enable user management view
• 2019-01-29 ISLCONFPROXY-1868 expose var_user_id
• 2019-01-29 ISLCONFPROXY-1868 login dialog 1 with scode
• 2019-01-30 ISLCONFPROXY-1868 read origin tags
• 2019-01-30 ISLCONFPROXY-1868 send origin tags
• 2018-02-05 ISLPRONTO-1109 correct permission inheritance
• 2018-02-05 ISLCONFPROXY-1649 correct permission inheritance
• 2018-05-18 ISLCONFPROXY-1729 filter out users without domain
• 2018-10-31 ISLPRONTO-1245 untrusted chat transcript conf
• 2018-10-31 ISLCONFPROXY-1807 fix server file names
• 2018-10-31 ISLCONFPROXY-1807 untrusted dump db object
• 2018-10-31 ISLCONFPROXY-1807 untrusted file storage
• 2018-10-31 ISLCONFPROXY-1807 untrusted module files
• 2018-10-31 ISLCONFPROXY-1807 untrusted server files
• 2018-10-31 ISLCONFPROXY-1807 untrusted tmp serve
• 2018-10-25 ISLGROOP-994 register webapi2 method islgroop/sessions/email/send/2
• 2018-10-25 ISLGROOP-994 use webapi2 method islgroop/sessions/email/send/2 to send email invite
• 2017-12-04 ISLCONFPROXY-1607 LIB-846 reject remote ipc clients
• 2018-01-15 ISLCONFPROXY-1640 login settings mapper setting
• 2018-01-15 ISLCONFPROXY-1640 login settings mapper
• 2018-01-15 ISLCONFPROXY-1640 multi key write settings
• 2019-01-29 ISLCONFPROXY-1867 add captcha cache
• 2019-01-29 ISLCONFPROXY-1867 add captcha settings ver2
• 2019-02-04 ISLCONFPROXY-1867 recaptcha language map
• 2019-01-29 ISLCONFPROXY-1867 enable reCAPTCHA in GUI ver2
• 2019-01-29 ISLCONFPROXY-1867 handle captcha in webapi2 ver2
• 2019-01-29 ISLCONFPROXY-1867 mark webapi handler type
• 2019-01-28 ISLALWAYSON-1429 skip limitation check on migrate
• 2018-09-25 ISLLIGHT-5148 add half-connected sessions timeout setting
• 2018-09-25 ISLLIGHT-5148 close half-connected sessions after timeout
• 2019-01-25 ISLCONFPROXY-1866 DiG log EDNS0
• 2018-02-02 ISLCONFPROXY-1637 enable ua throttle admin login
• 2018-02-02 ISLCONFPROXY-1637 register admin throttling scope
• 2018-02-02 ISLCONFPROXY-1637 skip non-admin_rights accounts for onlyadmin flag
• 2018-09-11 ISLCONFPROXY-644 /sso/saml/sp web handler
• 2018-09-13 ISLCONFPROXY-644 moduleapp init error
• 2018-09-26 ISLCONFPROXY-644 SAML settings
• 2018-09-26 ISLCONFPROXY-644 sso login internal webapi2
• 2018-09-27 ISLCONFPROXY-644 core_login restart settings
• 2018-09-28 ISLCONFPROXY-644 /users/main/loginsso
• 2018-09-29 ISLCONFPROXY-644 logout URL setting
• 2018-09-27 ISLCONFPROXY-644 db setting read omit unused levels in SQL
• 2018-09-27 ISLCONFPROXY-644 admin/domain/user/create/1 user level password check
• 2018-09-28 ISLCONFPROXY-644 full url for login redirect
• 2018-09-29 ISLCONFPROXY-644 logout URL
• 2018-10-26 ISLCONFPROXY-644 define LoginDialogLang
• 2018-10-26 ISLCONFPROXY-644 handle address_context_host in internal/ webapis
• 2018-11-12 ISLCONFPROXY-644 disable legacy login when SAML is enabled
• 2018-12-27 ISLCONFPROXY-1839 disable core_login pages when sso is enabled
• 2018-11-07 ISLCONFPROXY-1812 register_log_subsystem corelogin_app_web_login
• 2018-11-07 ISLCONFPROXY-1812 register_translate_html_file
• 2018-11-07 ISLCONFPROXY-1812 register_webapp_handler /users/appweblogin
• 2018-11-09 ISLCONFPROXY-1812 ISLCONFPROXY-1815 internal webtoken encode/decode webapis
• 2018-11-16 ISLCONFPROXY-1812 force appweblogin setting
• 2018-11-09 ISLCONFPROXY-1812 ld_external user_id response
• 2018-11-09 ISLCONFPROXY-1812 login dialog app web login
• 2018-11-10 ISLCONFPROXY-1812 LIB-954 hidden element link filter
• 2018-11-15 ISLCONFPROXY-1812 ld_external ctx_address_context
• 2018-11-26 ISLCONFPROXY-1812 disable legacy login when appweblogin_force is enabled
• 2017-10-26 ISLCONFPROXY-1572 enforce mmdb info update order

All flags from 4.4.1917 branch were deleted. These flags are now considered as enabled and can not be disabled by user anymore. Deleted flags:

• 2019-01-11 ISLCONFPROXY-1846 ISLCP_MAINDIR in main
• 2019-01-16 ISLCONFPROXY-1852 display disable 2fa buttons in same row
• 2019-02-06 ISLCONFPROXY-1873 forgot password check setting
• 2019-02-06 ISLCONFPROXY-1873 forgot password setting
• 2019-02-04 ISLCONFPROXY-1869 check for empty file hex id
• 2018-07-13 ISLCONFPROXY-1755 remove HTTP Server header
• 2018-07-13 ISLCONFPROXY-1755 remove HTTP Server header exception
• 2018-07-13 ISLCONFPROXY-1755 remove HTTP Server header setting
• 2019-02-07 ISLCONFPROXY-1876 encrypt login args
• 2019-02-11 ISLCONFPROXY-1876 use_public_code_for handler
• 2019-03-14 ISLCONFPROXY-1890 skip captcha with trusted args
• 2019-01-07 ISLPRONTO-1269 use 'pcatch' to prevent client object leak
• 2019-03-11 ISLPRONTO-1266 clear islpronto cookie in case new session/user id
• 2019-01-15 ISLPRONTO-1273 retain client session id to prevent duplicate chat members
• 2019-02-08 ISLPRONTO-1275 secure cookie attribute
• 2017-09-13 ISLLIGHT-4739 disable request code with old programs
• 2017-09-13 ISLLIGHT-4739 disable resolve port with old programs
• 2019-03-13 ISLCONFPROXY-1722 pass args on stdin
• 2019-02-15 ISLCONFPROXY-1882 POST change_language
• 2019-02-15 ISLCONFPROXY-1882 POST logout
• 2019-02-06 ISLCONFPROXY-1875 permission to show downloads
• 2019-02-06 ISLCONFPROXY-1875 use permission to show downloads
• 2019-03-28 ISLALWAYSON-1438 report error on maximum time span
• 2019-03-13 ISLCONFPROXY-1892 permission to disable Remember me on this device
• 2018-05-21 ISLCONFPROXY-1730 HTTPS-POST-CERTPIN method
• 2017-03-10 ISLCONFPROXY-1306 SSL no-store exceptions
• 2017-03-10 ISLCONFPROXY-1306 register SSL no-store exceptions /core /static /files /webspace
• 2019-02-11 ISLCONFPROXY-1879 allow empty timezone in utils/account/property/set/1
• 2019-02-06 ISLCONFPROXY-1059 recode profile page to use webapi
• 2019-02-20 ISLCONFPROXY-1059 register utils/timezone/time/string/2
• 2019-04-09 ISLCONFPROXY-1059 fix warning/error
• 2019-03-08 ISLCONFPROXY-1887 add chaptcha keys to webapi2 result
• 2019-03-08 ISLCONFPROXY-1887 improve cache reader
• 2019-03-08 ISLCONFPROXY-1887 read google error codes
• 2019-03-08 ISLCONFPROXY-1887 read reCAPTCHA keys from result
• 2019-03-08 ISLCONFPROXY-1887 reimplement reCAPTCHA in GUI
• 2019-03-08 ISLCONFPROXY-1887 use post to verify captcha
• 2019-03-08 ISLCONFPROXY-1889 add ignore captcha errors setting
• 2019-03-08 ISLCONFPROXY-1889 ignore specific captcha errors
• 2019-03-14 ISLCONFPROXY-1893 add application rights table
• 2019-03-29 ISLALWAYSON-1442 update infinite scroll computer loading when there are more groups than computers
• 2017-03-17 ISLCONFPROXY-1319 enforce https for webapi when https redirect enabled
• 2017-03-17 ISLCONFPROXY-1319 enforce https for webapi2 when https redirect enabled
• 2017-03-17 ISLCONFPROXY-1319 enforce https for websockets when https redirect enabled
• 2017-03-17 ISLCONFPROXY-1319 redirect users to https when available
• 2017-03-17 ISLCONFPROXY-1319 simplify public link https exception rule
• 2019-04-19 ISLCONFPROXY-1319 webapi myip exception
• 2019-04-19 ISLCONFPROXY-1319 webapi2 myip exception
• 2019-04-19 ISLCONFPROXY-1319 websockets myip exception
• 2019-02-21 ISLCONFPROXY-1885 support /conf/action/restart
• 2019-04-10 ISLCONFPROXY-1897 convert full-width numbers to half-width
• 2019-03-15 ISLCONFPROXY-1895 check app_id in webapi2 web handler
• 2019-01-11 ISLCONFPROXY-1849 backup module add table headers in GUI
• 2019-03-21 ISLCONFPROXY-1896 backup module align header with row data
• 2019-01-07 ISLCONFPROXY-1831 backup module handle tar errors
• 2018-10-18 ISLCONFPROXY-1800 backup module show scheduler
• 2018-11-22 ISLCONFPROXY-1804 enable backup scheduler
• 2019-01-11 ISLCONFPROXY-1848 destination and add server selection box
• 2019-01-11 ISLCONFPROXY-1850 provide user feedback on location create failure
• 2019-02-25 ISLCONFPROXY-1884 rename _ISL_ONLINE_BACKUP_CONTROLLED_DIRECTORY_
• 2019-03-21 ISLCONFPROXY-1900 change representation of job meta_data in database
• 2019-04-04 ISLCONFPROXY-1907 change format of next backup time
• 2019-04-26 ISLCONFPROXY-1851 return_address return_server_datacenter
• 2018-12-20 ISLCONFPROXY-1787 innosetup restore backup
• 2019-04-09 ISLCONFPROXY-1912 restorebackup command
• 2019-04-26 ISLCONFPROXY-1871 rawObject in generic db update
• 2019-04-04 ISLCONFPROXY-1906 restore backup failed error
• 2019-04-04 ISLCONFPROXY-1906 restore database
• 2019-04-04 ISLCONFPROXY-1906 restore database message
• 2019-04-04 ISLCONFPROXY-1906 restore database web admin
• 2019-04-11 ISLCONFPROXY-1906 keep features_dt if no pg
• 2019-04-12 ISLCONFPROXY-1913 remove dbs web admin
• 2019-04-15 ISLCONFPROXY-1915 store updater_filelist
• 2019-04-15 ISLCONFPROXY-1915 use updater_filelist in online update
• 2019-04-16 ISLCONFPROXY-1915 web admin updater
• 2019-04-17 ISLCONFPROXY-1917 icpbackup use installer_files
• 2019-04-30 ISLCONFPROXY-1847 can_create_backup setting
• 2019-04-30 ISLCONFPROXY-1847 convert can_create_backup to permission setting
• 2018-10-30 ISLPRONTO-1244 Use islpronto/client/chat/transcript/send/1 to send chat transcript after chat ends
• 2018-10-30 ISLPRONTO-1244 register webapi islpronto/client/chat/transcript/send/1
• 2019-05-07 ISLPRONTO-1277 use blank target for download link
• 2018-11-22 ISLCONFPROXY-1821 replace usage of getwd with new api
• 2019-04-12 ISLCONFPROXY-1914 remove dtwalhash
• 2019-04-12 ISLCONFPROXY-1914 remove pg2pg
• 2019-05-13 ISLCONFPROXY-1933 systemd service
• 2019-05-21 ISLPRONTO-1278 stop using ICPs common.js
• 2019-05-22 ISLCONFPROXY-1948 /opt/confproxy
• 2019-05-30 ISLCONFPROXY-1958 update javascript to support IE9
• 2019-05-08 ISLCONFPROXY-1926 add chaptcha to utils/login/2
• 2019-05-08 ISLCONFPROXY-1926 add user agent to util/login/2 webapi2
• 2019-05-08 ISLCONFPROXY-1926 register util/login/2 webapi2
• 2018-10-25 ISLPRONTO-1230 use callback with fetch data
• 2019-06-18 ISLPRONTO-1230 add missing return to matches cb
• 2019-05-16 ISLCONFPROXY-1921 optimize domain name
• 2019-04-19 ISLCONFPROXY-1922 reimplement load balance
• 2019-05-16 ISLCONFPROXY-1940 optimize destringify
• 2019-05-20 ISLCONFPROXY-1941 optimize geoip_resolve function
• 2019-05-20 ISLCONFPROXY-1941 register geoip_resolve_lb api
• 2019-05-20 ISLCONFPROXY-1941 use geoip_resolve_lb api
• 2019-06-12 ISLCONFPROXY-1967 fix local already installed matches
• 2019-06-13 ISLCONFPROXY-1970 sanitize webhit URLs
• 2019-06-13 ISLCONFPROXY-1970 webhit ignore paths
• 2019-05-30 ISLPRONTO-1279 fix bug preventing csid clear
• 2019-05-30 ISLPRONTO-1279 prepand chat script with flags
• 2018-12-13 ISLCONFPROXY-1836 add CP-POST-TOKEN
• 2018-12-14 ISLCONFPROXY-1836 handle webapi2 panic
• 2018-12-17 ISLCONFPROXY-1835 perform post request with post token to logout
• 2018-12-17 ISLCONFPROXY-1834 Add done view when restoring 2FA methods
• 2018-12-17 ISLCONFPROXY-1834 move login link to button
• 2019-06-21 ISLALWAYSON-1476 missing computer hag
• 2018-08-10 ISLALWAYSON-1374 resolving user unhadled exception fix
• 2019-06-03 ISLCONFPROXY-1959 remove invalid html from web pages
• 2019-06-04 ISLCONFPROXY-1962 handle/log all errors
• 2019-06-14 ISLCONFPROXY-1969 finish backup jobs on startup
• 2019-06-17 ISLCONFPROXY-1974 handle negative url parameters
• 2019-01-23 ISLLIGHT-5242 expose hostname and mac addresses to session meta data
• 2019-01-25 ISLLIGHT-5242 expose hostname and mac addresses to http events
• 2019-01-24 ISLLIGHT-5247 register webapi isllight/session/info/3
• 2017-05-02 ISLCONFPROXY-1361 HTTP header Public-Key-Pins
• 2017-05-02 ISLCONFPROXY-1361 HTTP header Public-Key-Pins setting
• 2017-05-02 ISLCONFPROXY-1361 HTTP header Referrer-Policy: same-origin
• 2017-05-02 ISLCONFPROXY-1361 HTTP header Strict-Transport-Security
• 2017-05-02 ISLCONFPROXY-1361 HTTP header Strict-Transport-Security setting
• 2017-05-02 ISLCONFPROXY-1361 HTTP header X-Content-Type-Options: nosniff
• 2017-05-02 ISLCONFPROXY-1361 HTTP header X-XSS-Protection: 0
• 2019-05-29 ISLCONFPROXY-1960 LIB-1024 report real os info on windows
• 2019-03-05 ISLLIGHT-5271 change kill_session messages
• 2018-11-05 ISLPRONTO-1186 Pass static_core_path_min_430 to template interpreter
• 2018-08-22 ISLPRONTO-1214 check for empty chat content
• 2018-07-31 ISLCONFPROXY-1763 akv counters dump
• 2018-07-31 ISLCONFPROXY-1763 counters setting is not legacy
• 2019-07-29 ISLCONFPROXY-1992 sanitize packet dctx
• 2019-07-29 ISLCONFPROXY-1992 sanitize packet logctx
• 2019-07-29 ISLCONFPROXY-1992 sanitize programs urls
• 2019-07-29 ISLCONFPROXY-1992 sanitize webhit referrer
• 2019-06-14 ISLGROOP-1045 remove /users/programs list-json
• 2019-06-12 ISLCONFPROXY-1968 /users/programs download URLs
• 2019-06-14 ISLCONFPROXY-1973 404 if _output in /users/programs
• 2018-06-22 ISLCONFPROXY-1748 remove programs HTMLs from web server
• 2018-06-25 ISLCONFPROXY-1748 permission to show program list
• 2018-06-25 ISLCONFPROXY-1748 use permission to show program list
• 2019-04-23 ISLCONFPROXY-1748 optional web session
• 2019-04-23 ISLCONFPROXY-1748 simpler select os
• 2019-04-23 ISLCONFPROXY-1748 use app_not_found.html
• 2019-04-24 ISLCONFPROXY-1865 Add columns for MAC address and computer hostname to ISL Light ICP reports
• 2018-09-28 ISLCONFPROXY-1782 report web errors by default
• 2019-05-28 ISLCONFPROXY-1957 fix send wol through gateway
• 2019-08-09 ISLCONFPROXY-1992 sanitize netstart logctx
• 2018-03-26 ISLCONFPROXY-1680 LIB-891 check tar setup folder exists
• 2018-03-26 ISLCONFPROXY-1680 LIB-891 limit lock directory retries
• 2018-05-09 ISLPRONTO-1081 Use 'object_update_cb' to prevent json patch feedback loop
• 2019-06-07 ISLPRONTO-1281 store clients timezone in database
• 2018-10-01 ISLCONFPROXY-1784 dump grid calls and signals to xml
• 2019-06-18 ISLCONFPROXY-1977 LIB-1031 parse json utf16 surrogates
• 2018-12-21 ISLPRONTO-1267 add confirm_client_chat_close setting
• 2019-06-09 ISLALWAYSON-1474 add simple key os_version to computers
• 2019-06-09 ISLALWAYSON-1474 check os_version when starting actions
• 2019-06-09 ISLCONFPROXY-1975 raise action interface
• 
  

Previously ISL Conference Proxy would update each connection individually when a computer object would change. This has been changed to a single update that handles all connections.

A new setting "HTTP header Referrer-Policy" was added to /conf -> Security, which controls the value of the header returned in all HTTP responses. The default value is "same-origin" (no changes from before).

In case of ICP module failing to load properly detailed exception text will be reported.

Priority of invalid WebSocket /UUID requests was lowered from "critical" to "error".

A new alert log line has been added to notify that an incorrect column index has been used.

flags_nondefault.txt and flags_nondefault_category.txt were added to Debug in web admin. Flags are listed that do not have the same effective value as the default calculated from ICP version and flag tag.

Log severity for migrated bulk file was changed from "Debug" to "Info".

ISL Conference Proxy uses cookies to improve user experience. These include CPLB and CPLBF cookies, which are used for load balancing. Previously they did not have "Secure" flag enabled on https. This flag is now enabled for both cookies on https. However, sharing of these cookies between http and https will no longer be possible.

SAML response "urn:oasis:names:tc:SAML:2.0:status:Responder" by AD FS is now handled as access denied. Log line "failed to parse identity provider response" severity is now lowered from "critical" to "notice".

Added new webapi2 method "isllight/session/post/2". This method marks a session as dead even if the session is not currently active meaning it is either paused or clients are disconnected.

GRID health logs have now lowered severity (warning) for failed checks when server that performed check has load off.

Additional logs were inserted into GRID connection establishing procedure. Logs are created in main steps of procedure (tcp, ssl, handshake). New logs were also added to connection drop.

Setting "Security > SAML sign authentication request method" was added with possible values:

• None: (never sign requests)
• (default) Automatic: (sign requests with RSA-SHA256 if IdP requires signing)
• RSA-SHA1
• RSA-SHA256
• RSA-SHA512

When sequence is created and "integration_test" dev flag is enabled, start value of sequence is set to random value. New function "isldt_nextval_random" was added, which increases sequence for a random value in range [1-10]

Internal server error from DB cache will now be reported with a detailed exception text.

OpenSSL was updated to 1.1.1o.

Updated GeoIP to use the database GeoLite2-City 2022-05-23T23:12:17Z

When an error occurs when clicking "Apply policy" in History data lifecycle reports, it will be reported in web administration, not just in the log. Additionally, when data lifecycle tasks are in progress, the exception will be reported to web administration, but not logged.

In previous versions during serialization of custom fields data was URL encoded twice. However, the parser only performed a single URL decoding resulting in url encoded entities used in chat transcript emails. The missing decoding step has been added and the issue should not happen anymore.

The defect was fixed.

In previous version ICP would not specify a character set when serving "text/plain" files resulting in US-ASCII being used. As a result the UTF-8 encoded files were not rendered properly. To fix this issue "text/plain" has been removed from setting "Allow inline download of user uploaded files".

The defect was fixed.

In previous versions when user had 2FA disabled but had some 2FA devices stored he could access login devices. This has been redesigned to first check if 2FA is enabled and in case it is disabled the user is redirected to "configure2fa/configure.html."

The defect was fixed.

Password description texts were updated to match ISL Light. "Global password" was renamed to "Main access password". Default action for "Change" is set to "Main access password".

In previous versions the email plain text format was incorrect as it was generated from HTML. This has been redesigned to use a jHtmlArea and generate the plain text format from there. Invitation text has also been updated to contain the whole link instead of a hyperlink.

The defect was fixed.

In previous versions when default customization was set, it was not used in program download. This was now redesigned and selected customization will be applied when set as default customization.

The defect was fixed.

In previous versions there was a bug with our Javascript templating function where a DOM object was returned in certain scenarios instead of a jQuery object. The Javascript templating function has been changed to always return a jQuery object.

The defect was fixed.

Validation for setting "Scheduled access (in UTC)" was added and invalid values will now be rejected.

The defect was fixed.

In previous versions hover was not displayed due to missing a missing class in HTML. The missing class has been added and hover should now be visible.

The defect was fixed.

In previous versions there was little information when search was used in Administration pages. This was now redesigned and blue border was added when filter is in use and in case of no match "No results found" text is displayed.

The defect was fixed.

In previous versions ICP's version parser did not sort branches with invalid names consistently. This has been changed and the sort is now consistent.

The defect was fixed.

Idle time of a session was not correctly calculated until session "end" time was updated, which is done periodically (default 5 minutes). In this time idle time could be negative in some cases which broke the GUI. This was now redesigned and "end" time is updated together with idle timestamps and idle time should no longer be negative.

The defect was fixed.

In previous versions Reports Groop Details page on ICP allowed the elements to be dragged around. This behavior has been disabled and the issue should not happen anymore.

The defect was fixed.

In previous versions ISL Conference proxy would sometimes fail to start on selected platforms, because systemd kills shared resources of normal user on logout. This was now redesigned, and during installation of ISL Conference Proxy, "islcp" user will now be created as system account.

The defect was fixed.

In previous versions when client sent multiple "connect" command, error was reported. This was now redesigned, multiple same commands are ignored and error should no longer be reported.

The defect was fixed.

In previous versions Schedule access settings in Administration -> Settings -> ISL AlwaysOn were not validated on page load. This was now redesigned and settings are validated when rendered, so invalid setting is immediately marked with error message.

The defect was fixed.

In previous versions ISL AlwaysOn computer sent all its mac addresses when it registered with ICP, which could cause errors when number was large. This was now redesigned and only first 10 are stored.

The defect was fixed.

In previous versions when more than one task type for History data lifecycle was enabled, only the shortest one would be executed and not all data was deleted. Scheduling of tasks was now redesigned and all tasks should be run.

The defect was fixed.