ISL Conference Proxy 4.3.0 with modules for Windows and Linux (2016-06-29)

Default SSL setting on ISL Conference Proxy have been changed in order to improve security.

Updated internal OpenSSL library to latest version 1.0.2h due to security reasons.

ISL Conference Proxy no longer supports Windows 2003 operating system. User can install ISL Conference Proxy on Windows Vista or newer.

ISL Conference Proxy now features a system of tasks in the web administration. The notice for such tasks appears at the top of the page, regardless of the viewed page. There is a new setting for limiting the frequency of updating task statuses, found in "Configuration -> Advanced -> Performance -> Limit GRID task status updates in seconds". The default value is 10 seconds.

Three features were initially implemented to take advantage of this task system.

- Reindex PostgreSQL indexes. The problem is that eventually some indexes might get duplicated, leading to database bloat - reindex combats this. The page "Configuration -> PostgreSQL -> Indexes" features a table of indexes, which has now gained a new left-most column, called "Select". It is possible to select which single indexes should be reindexed, or just select all. There is now a button below the table, labeled "Reindex", which triggers the task

- Reindex PostgreSQL tables. Very similar to reindexing indexes. Featured on the page "Configuration -> PostgreSQL -> Tables", with a column to select tables an a "Reindex" button.

- Vacuum PostgreSQL tables. A form of garbage collection in the database for the selected tables. Also featured on "Configuration -> PostgreSQL -> Tables", with its own "Vacuum" button below the table.

Added support for changing password when in user management the field "User must change password" is set to yes.

Added initial implementation of multifactor authentication to web pages. This can be enabled in Security / External dialog authenticator. Users must set path to script and this script will be used on login page.

Example multifactor authentication script:

use strict;

use utf8;

use IO::File;

use JSON;

use HTML::Entities;

my %params = ();

for(my $i = 1; $i < scalar(@ARGV); $i += 2) {

 $params{$ARGV[$i-1]} = $ARGV[$i];

}

my $step = $params{'arg_step'};

if($step eq 'login') {

 print encode_json({redirect_system=>{args=>{username=>$params{'arg_username'}, password=>$params{'arg_password'}, login=>1}}});

} elsif ($step eq 'btn_cont') {

 print encode_json({challenge=>{interface=>[

                 {type=>'hidden', name=>'step', value=>'login'},

                 {type=>'hidden', name=>'username', value=>$params{'arg_username'}},

                 {type=>'title', text=>"Login for user: " . $params{'arg_username'}},

                 {type=>'input', style=>"password", name=>'password', description=>"Enter password for " . $params{'arg_username'}},

                 {type=>'buttonrow', buttons=>[

                         {name=>'next', text=>'Login'}

                 ]}

         ]}

 });

} else {

 print encode_json({challenge=>{interface=>[

         {type=>'hidden', name=>'step', value=>'btn_cont'},

         {type=>'title', text=>"Login"},

         {type=>'input', description=>'Your username:', name=>'username', value=>$params{'arg_username'}},

         {type=>'buttonrow', buttons=>[

                 {name=>'btn2', text=>'Proceed to next step'}

         ]}

 ]}});

}

The number of concurrent TCP connections that ISL Conference Proxy can accept has been raised from 100000 to 200000.

ISL Conference Proxy now includes support for single address GRID. There are multiple new settings to configure this.

Automatic name servers:

- "DNS Server -> Zones -> <zone ID> -> Enable automatic name servers" - generates necessary NS records.

- "DNS Server -> Zones -> <zone ID> -> Direct mapping of ids" - directly maps server IDs to NS IDs.

- "DNS Server -> Settings -> Member of automatic DNS server set", default is "Yes" - whether the server should participate in the automatic name server generation.

Single address load balancing is also supported. In can be enabled in "DNS Server -> Zones -> <zone ID> -> Enable load balancing -> Single public address with default service". There are basically two modes of single address load balancing, explained on zone example.com:

# All traffic goes through example.com, even HTTP tunnels through reverse proxies (\-0\-.example.com, \-1\-.example.com, etc.). This mode is enabled when load balancing, "Primary zone for load balancing", and the new "Single public address with default service" are enabled. In this mode, the DNS server will automatically enable the single address feature, which overrides the setting "Configuration -> Security -> Use single public address in GRID".

# All traffic except HTTP tunnels goes through example.com. HTTP tunnels go through server0-\*.example.com, server1-\*.example.com, etc. This mode needs to have the same settings enabled as mode 1, but it additionally requires "Enable GRID server names" and "Primary zone for GRID server names". This mode is recommended, because it improves connection speed and compatibility.

Additionally, the setting "Configuration -> Security -> Do not use service public addresses for web pages" is now by default set to "Yes", while "No" is considered deprecated. The default forces websites to have GRID addresses prefixed with "www.".

Instead of one file with debug information, located at "[ISL Conference Proxy install]/debug_info/current_debug_info", the folder "[ISL Conference Proxy install]/debug_info/" now contains multiple files, named "debug_info.X", where X is a number. A lower X indicates a more recent file, with "debug_info.0" being the latest file.

Database API now includes support to access generated executable files directly from modules.

The API for reading and writing the database was updated to version 9.

The changes include:

- Removal of functions, previously declared as deprecated.

- Removal of function data_queue_read_first. The function was usually used as argument "tid" to queue_read_from. The value of this argument should now be an empty string.

- Additional flags (supported by queue_read_from):

 -- ISLDB_DATA_QUEUE_FLAG_DESCENDING

 -- ISLDB_DATA_QUEUE_FLAG_GREATER_THAN

- The modules that use this API were updated accordingly.

- New tests for checking the updated functions and flags.

Added utility script to ISL Conference Proxy installation folder on Linux platform for creating a self contained crash report package with all needed information. Name of this script is pack_core.sh.

In addition to the Write-Ahead Log (WAL) ISL Conference Proxy now adds the option of a Simple WAL (SWAL). There are multiple reasons for choosing SWAL over WAL:

- WAL replay puts a very high load on the DT server because of many writes to the database.

- WAL uses global locking, which tends to drop GRID connections if employed for long periods of time (because of the abovementioned performance issues).

- WAL does support snapshotting as opposed to SWAL, but DT does not, so this potential advantage does not come into play.

- SWAL runs in a separate thread without global locking.

- SWAL is implemented as part of DT GRID backend instead of frontend, further improving performance.

- There is no need to run SWAL replays between DT servers, because DT async already takes care of that.

- SWAL replays are delayed until DT async is done.

- SWAL requires just a single WAL round-robin file instead of one per server, which speeds up startup.

SWAL can be enabled in "Manage Software -> Features -> Database replication method", where there are two new options:

- "Simple write-ahead log and HexHash (swal+hhash)"

- "Simple write-ahead log (swal)"

There are multiple new settings regarding SWAL, found in "GRID -> Settings":

- "Remote buffer database log size (MB)", default 500.

- "Remote buffer database log location cache", default 1000.

- "Database log replay max age in seconds", default 2592000 (exactly 30 days).

- "Direct tables sync blocks SWAL replay", default "Yes".

- "SWAL receiver is considered backlogged in seconds", default 120s.

- "SWAL receiver backlogged penalty", default 10000.

In order to reduce the CPU, memory, and bandwidth load on the ISL Conference Proxy server, TCP keepalive has been turned off.

ISL Conference Proxy now reports the GRID replication status on top of the web administration pages. This is done to to communicate the synchronization of servers in a simpler manner. If there are no replication messages, the status is not shown and the servers are synchronized. After the individual message, the number of the server that reported it is also shown.

Currently, the replication status reports about these events:

- "Direct tables" (send/receive)

- "Simple write-ahead log replay" (send/receive/ receive blocked by direct tables)

- "Write-ahead log replay" (send/receive)

- "Write-ahead log snapshot" (send/receive)

- "File storage" (send/receive)

- "Write-ahead log snapshot" (inactive / send, waiting for remote server)

- "HexHash" (send/receive)

There is also a new setting "Configuration -> Advanced -> Performance -> Limit GRID replication status updates in seconds", default is 10 seconds.

When an object is deleted from a database table, it also needs to check other tables for possible child objects. However, this is mostly done for legacy reasons, as there aren't very many parent-child relationships in the database, and it mostly just slows down the database. In order to optimize performance, the API gained the option to register "child_of" relationships (and modules were updated accordingly), which serve to signal a check for child objects, while object without this relationship don't perform the check anymore.

Many changes have been implemented in order to optimize the performance of the bulk file operations. The major optimizations are:

- Optimized read/write locks when reading files.

- Bulk file upload and download are now parallel tasks.

- Detailed timing of downloads.

- Simplified consistency checking.

Added a new option: "Configuration -> Advanced -> Performance -> Enable indirect customization IDs". The default value is set to "No", which should reduce the cache pressure of the packet generator.

Direct tables converter now supports converting ISL Groop module old database format to direct tabeles format.

Better XML compliance is provided as in several places HTML escaping was replaced with XML escaping due to stricter and safer checking, introducing some unicode filtering.

A new option has been added to the "Debug" menu to dump contents of a database table into a file, using a drop-down list of tables and a button "Dump table content". As opposed to a raw dump, this makes VFS and DT data easier to compare. Clicking the button creates a file named "dump_table_content_<table name>.<id>" in the ISL Conference Proxy installation directory, where <id> is a number beginning with 0 that increases if multiple content dumps of the same table have been made.

Additionally, in "Configuration -> Advanced -> Raw data -> Utility links", "Download object from" has been renamed to "Download object", and it contains a new link "content", which dumps the database content of the server configuration (but not into the ISL Conference Proxy installation directory), with a name like "s-999_0_0.bin".

It is now possible to bulk delete files only on the observed server instead of on all servers in the GRID. The option can be found in "Configuration -> Advanced -> Bulk files", where along the "Delete selected" button there is now also a "Delete selected locally" button. Additionally, some performance optimizations have been implemented, such as removing the lock from these bulk connections and fetching them from a connections pool.

ISL Conference Proxy now contains a tool for observing the Write-Ahead Log (WAL) statistics - it also works with the new SWAL.

Usage: confproxy_server --wal-tool <flags> <command> <log_file> <state> <count>

- <flags> must be either --wal or --swal.

- <command> must be one of: info, dump, stats. If <command> is info, <state> and <count> should not be provided.

- <log_file> can be e.g. "<ISL Conference Proxy installation>/db/\_\_swal\_\_/log" or "<ISL Conference Proxy installation>/db/\_\_writelog\_\_/log".

- <state> specifies which logged event should be the first to be displayed and <count> specifies how many should be displayed. The "info" command does not require these two arguments - instead, running the "info" command outputs "state=<total number of events>" and "first_state=<index of first event>".

The Simple Write-Ahead Log (SWAL) contains two settings for controlling the backlogging functionality, found in "Configuration -> GRID":

- "SWAL receiver is considered backlogged in seconds", default is 120s.

- "SWAL receiver backlogged penalty", default is 10000.

Using the default settings, if the delay between the file "<ISL Conference Proxy installation>/db/\_\_swal\_\_r" and the database exceeds 120s, that server is considered backlogged; the GRID sets 10000 points of load balancing penalty for that server until the file "\_\_swal\_\_r" is empty again.

The packet generator could overload the server by generating many responses for requests that required the same packet. These response are now cached in order to reduce the load on the server.

Added a new option: "Configuration -> Advanced -> Performance -> Cache customizations in memory". The default value is set to "Yes", which removes expensive reading and locking of the database.

If an internal server error occurs, the error report also includes which server was the source ("source server =") and which the destination ("remote server ="), if those servers are not the same as the one that is handling the error. If the current handling server is the same as the source and the destination, this is also reported ("fully local handler").

Webcontext calls handle function in its queued executor. To enable webcontext implementators to use this serial executor, it was exposed in API.

When trying to download ISL Light 4 on Windows XP or Windows Vista (e.g. "icpserver/start/ISLLight"), users would only receive "No software found", because ISL Light 4 is not available on those systems. This has been redesigned so that users should click on a link with added "?on_not_found_name=ISL+Light+Desk", which returns ISL Light Desk, which is available on these systems. The "on_not_found" link handler is also available for other links that would otherwise return "No software found".

When ISL Conference Proxy crashes, a "\*.dmp" file is created in the ISL Conference Proxy installation directory, e.g. "ISLMini5028confproxy_server.dmp". ISL Conference Proxy now expands this by also generating a "\*.dmp.debug_info" file, e.g. "ISLMini5028confproxy_server.dmp.debug_info".

The Linux version of ISL Conference Proxy now supports the jemalloc memory allocator. To enable it, go to "Manage Software -> Features", section "Memory allocator". It is also possible to provide options to the jemalloc allocator - these options correspond to the MALLOC\_CONF jemalloc variable and are stored in "/var/confproxy/jemalloc.conf". If jemalloc is selected as the allocator, a file named "/var/confproxy/feature_malloc" is created, containing the string "jemmaloc".

ISL Conference Proxy running on Linux could encounter excessive virtual memory usage when using the default memory allocator. One step taken to alleviate this is to limit the number of arenas the default memory allocator is allowed to allocate. By default, this number is equal to the number of cores in the server's CPU, but can be overridden by creating/changing the file "/var/confproxy/sysmalloc_arena_max" and setting its contents to the maximum number of allowed allocatable arenas.

An option has been added to log the output of license functions, found under "Configuration -> Logs -> Subsystem license debug log".

In order to reduce memory leaks, two optimizations pertaining to log filtering have been implemented:

- Log filtering is done immediately instead of in the separate thread, responsible for actually dumping the log.

- Log filtering now uses static instead of dynamic memory allocation.

The Linux version of ISL Conference Proxy now supports the mallocspectrum memory allocator. The main feature of mallocspectrum is the ability to log the allocations. To enable it, go to "Manage Software -> Features", section "Memory allocator". If enabled, a file named "feature_malloc" is created in the "/var/confproxy" folder. Allocation is logged into the file "mallocspectrum.<pid>.log", where <pid> denotes the process ID of the running ISL Conference Proxy server.

There are two main options:

- "Log interval on total allocation increase of 2^n bytes" - An unsigned integer _n_, which signifies how much does the total allocation size have to increase in order for the values to be logged. The default _n_ is 20, which means that memory allocation will be logged whenever total allocation increases by 2^20 bytes (1MB). If a value is set, a file named "mallocspectrum_loginterval" is created.

- "Track stacks" - A toggle switch to enable/disable stack tracking and logging. An additional option specifies the initial configuration - if set, a file named "mallocspectrum_trackstacks" is created.

On the "Features" page there is also a link next to the mallocspectrum switch that points to "Activity Monitor -> Mallocspectrum". From there, the track stacks configuration can be changed, or the current allocation state can be logged by clicking on the "Record total state" button.

The raw log file can also be converted into a CSV file with the help of the "mallocspectrum2csv.pl" tool, which is provided in "/var/confproxy". An example of invocation:

perl mallocspectrum2csv.pl mallocspectrum.20278.log

Performance improvement: if activity log is not enabled, ISL Conference Proxy doesn't start empty activity log tasks anymore.

The new "/var/confproxy/pack_core.sh" tool includes the option to not actually pack the core dump, but instead create a debug directory. Additionally, the original core dump file does not get deleted. To enable this, add the command line argument "--no-pack" before the core dump file name.

There was an issue in ISL Conference Proxy where the packet generator would write to a cache file, but at the same time block all other reads and writes (global lock), leading to long response times. A new approach has been implemented, where a small temporary cache file is created and worked on, while the global lock is employed for a much shorter time to copy from the temporary file to the actual cache file.

Error reports - usually sent to the ISL Conference Proxy system email address - now also get reported to the "confproxy_server.log" file. In the log, error reports are prefixed with "Report:".

In the "Debug" page ("Configuration -> General -> Show debugging menu" needs to be enabled) there is now a new debug action, "Report Error Line". It consists of two text fields and a button labeled "Report Error Line". Clicking on the button will cause the line to be logged as if it originated from a module, named in the first text field, that logged an error line, represented by the second text field.

Added the option to toggle the sending of error report emails, found in "Configuration -> Logs -> Report logged errors to system email address(s)".

Join page was completely redesigned and supports mobile devices. If users want to join to the session from mobile device, they will be able to open application (ISL Light or ISL Groop) if application is installed on mobile device, or download application from appropriate store. Join page is also completely responsive and has minimalistic design.

Webapi2 method session/query/2 was introduced. Method accepts two arguments:

- session code ("code")

- user-agent ("userAgent"): <application>(<platform>), e.g. "ISLLight("Win\;)".

Method returns the following fields:

* joinPageURL (join page was redisigned, more info at ISLCONFPROXY-899)

* platformType

* service

* sessionCode

* startProgramButtonCaption

* startProgramURL

* supporterEmail

* supporterName

* supporterUsername

We have implemented HTML frame v2. On ISL Conference Proxy under web server, users can set "Web template" version like 430 and they will have new look of ISL Conference Proxy page. Users can set this new feature also for join page (Join UI version), login page (Login UI version), forgot password page (Forgot password UI version), etc. Users can also set different "Web template" version for different users under User management / <username> / Web server. New frame v2 version is also responsive, which means that page will adapt to different screens/devices.

A new setting has been added to ISL Conference Proxy: "Configuration -> Logs -> Subsystem report debug log", which is enabled by default. It controls whether and how the subsystems are logged - this includes the packet generator, bulk files, and license subsystems. These subsystems normally get logged only if "Log only critical events" is set to "No", but this new setting overrides it and, if enabled, always logs the subsystems. Additionally, if this new setting is enabled, the logged line contains a "*** Report" prefix instead of a "Report" prefix.

It is now possible to enable and disable netbuf counters and cache using the following files, which should be placed in the ISL Conference Proxy installation directory and don't need to contain any content:

- "netbuf_counters" - enables counters.

- "no_netbuf_counters" - disables counters. Overrides "netbuf_counters".

- "netbuf_cache" - enables cache. Overrides "no_netbuf_cache".

- "no_netbuf_cache" - disables cache.

By default, counters are disabled and cache is enabled.

Connections to "/conf" are now always allowed on localhost, regardless of web access filter settings.

In order to prevent accidental server restarts, the "Restart selected" button (found under the table of servers in "Activity Monitor -> Servers") now requires a check to the left of the button to enable it before it can be pressed.

In some cases login cannot be performed using an email address, but ISL Conference Proxy marked this kind of attempt simply as a failure. To improve on this, ISL Conference Proxy now reports "Unable to login with user <email>. Please use full username: \\\username or \\domain\username". There are multiple scenarios that this change affects, based on the number of accounts that match the email address:

- Number of matched accounts is larger than what is allowed ("Configuration -> Security -> Max accounts when authenticating with email matching").

- At least two accounts match the email address and the password.

- More than one external account is matched.

- At least one internal and one external account are matched.

Added a new button to the "Debug" menu, which toggles whether DT sync is enable or disabled. The button label toggles accordingly from "Disable DT sync" to "Enable DT sync". Disabling DT sync may lead to crashes if disabled for a longer time.

ISL Conference Proxy on Linux now supports heap consistency checking with the default system memory allocator. To enable it, the default system memory allocator needs to be enabled - "Manage Software -> Features -> "Memory allocator -> default: system" - and there is also a new checkbox "Enable heap consistency checking". If enabled, the file "/var/confproxy/sysmalloc_check" is created, containing the value "1".

This feature can also be tested with the help of two new buttons in the "Debug" menu. Both should crash ISL Conference Proxy and generate a core file if heap consistency checking is enabled:

- "Double free"

- "Heap overflow"

The metalanguage for logging internal ISL Conference Proxy counters (found in "Configuration -> Logs -> Counter settings") has gained three new features:

- dump=<period> - Logs the counters to the log file periodically.

- average=<source> - Calculates the average of <source> over an interval.

- interval=<period> - Used in connection with average, how long should the averaging interval be.

ISL Conference Proxy now includes a global option to enable/disable group permissions for users, found in "Configuration -> Security". The new settings are:

- "User can create groups", default "Yes".

- "User can edit groups", default "Yes".

- "User can delete groups", default "Yes".

When a license is requested, the request gets logged in the ISL Conference Proxy log. This logging has been redesigned to show more information about obtaining license.

Modules ISL Groop, ISL Light, ISL Pronto, and Reports now update the session webtoken using a central location.

Added support for automatic clearing of expected internal server errors. Setting for expiry time can be found under Configuration -> Advanced -> Web server -> Internal error expires in seconds. Default value is 3600 seconds.

Users can now define custom error message for disabled modules. Settings for custom error message can be found under Security -> Error message for disabled module.

Most webapi2 functions check for logged-in user and modules validity. To ensure better consistency, this checking has been centralized.

ISL Conference Proxy already included the option to return timing information along with the Webapi response("/webapi2?method=<method>&info=true) and it now gained the ability to also log that information. The option is enabled in "Configuration -> Logs -> Subsystem webapi2 times log", but it is disabled by default.

ISL Conference Proxy now includes a HTTP tunnel stress test. It can be activated by creating a file "http_tunnel_stress_test" in the ISL Conference Proxy installation directory - the file needs to contain a number, as that number is used as the byte count for the download channel of HTTP tunnels. The minimum byte count is 100.

The Debug section of ISL Conference Proxy web administration gained the button "Memory leak 1MB", which allocates 1MB of memory, but doesn't free it.

When there were a lots of requests, thread count was rising and then falling. Now, thread count will not fall down.

Improved web template preprocessor. With this improvements, SL and CSL users can customize their ISL Conference Proxy much more and in much more elegant way than in previous version. They can change logo, buttons color, glow of input fields

When using reverse proxy with a GRID, users need to set setting called "Use single public address in GRID" under Security section to Enable so that internal IPs are not exposed to the public. Now, if frontend(s) are enabled, this settings will be automatically set to enabled.

Backward compatibility for reverse proxy binding has been provided for older ISL Pronto modules.

Added support to see internal resources. This function is located under "Debug" panel -> Resources XML

Previous version of ISL Conference Proxy did not support multiline definition in Custom text section under customization. Support for inputting multilines in "Custom texts (Quickstart and Overview)" was added.

If administrator of ISL Conference proxy wants to see which internal resources were accessed, he must follow this steps:

- open command line,

- navigate to ISL Conference Proxy installation folder

- write "echo . > debug_resources_access"

- restart ISL Conference Proxy Service

When user will access internal resources, this will be logged.

When deadlock occurred, server was restarted / disconnected. Now, server just set internal error, but only if this is enabled in "Performance -> Process watchdog sets only internal errors".

During migration from file based database to direct tables database column id is changed from text value to int value.

Added support for logging subsystem for HTTP events. This new feature can be enabled under Logs / Subsystem http event submit debug log

Per user email settings were added. Custom from for e-mails, Custom sender for e-mails and Hide account e-mail for sender settings were added to user General settings, together with Custom e-mail from for sender domains and Hide e-mail sender for domains in General settings.

Added support for reporting web errors. This can be achieved with /users/main/report_web_error following the key-value syntax. For instance:

https://<ICP-SERVER-ADDRESS>/users/main/report_web_error?error=MyError&file=MyFile&line=123

In confproxy_server.log file, there will be entry that will look something like this:

timestamp Web error: client_address=[...] user_agent=[...] logged_in_user=[] error=[MyError] file=[MyFile] line=[123]

Two new features were added to the ISL Conference Proxy Security settings:

- "Hide server version in HTTP response and SMTP headers" adds ISL Conference Proxy server version to the HTTP response and SMTP headers. This setting is disabled by default.

- "Record client address in SMTP headers" adds ISL Conference Proxy clients address in SMTP headers. This setting is disabled by default.

Additional security feature allows disabling sending email per user basis. This setting can be found User management -> <User> -> Security -> "Allow sending emails by authenticated user". By default, sending emails by authenticated users is enabled.

Added support for custom arguments for login dialog in JavaScript. Users can do this if they set "Use custom web template" under "Web server" to "Yes". Then in web template file user must write this:

{{hook|content#begin|{{if|{{eq|/users/main/login.html|{{url_path|{{origin}}}}}}|<script type="text/javascript">

LoginDialogArgs = { 'username' : 'test', 'password' : 'test' };

</script>

}}}}

Added support for two factor sample implementation with normal built-in authentication as first step. Users needs to specify script under Security / External dialog authenticator. So for instance, if user wants to change his email, he also need to enter 4 digit security code, which he can get via SMS or similar. To test this, go to Security section and define "External dialog authenticator". First you need to enter path to perl, and then you need to enter path to your script. For instance:

C:\Perl64\bin\perl.exe;objects/test_multifactor.pl;

Then if you go to your profile, try and change your email. It will also ask you to enter 4-digit code. Open command line and navigate to installation folder of ISL Conference Proxy. There will be a file called code.txt. Open it and inside is this code.

Example of a test_multifactor.pl file:

use strict;

use utf8;

use IO::File;

use JSON;

use HTML::Entities;

my %params = ();

for(my $i = 1; $i < scalar(@ARGV); $i += 2) {

 $params{$ARGV[$i-1]} = $ARGV[$i];

}

if(exists $params{'var_user_id'}) {

 my $code = $params{'arg_code'}; $code = '' unless defined($code);

 my $correctcode = $params{'var_code'}; $correctcode = '' unless defined($correctcode);

 if($correctcode eq '') {

         $correctcode .= int(rand(10)) for ((0..3));

         # send $correctcode to user over secondary channel

         IO::File->new('code.txt', 'w')->write($correctcode);

 }

 my $count = $params{'var_count'}; $count = '0' unless defined($count);

 if($code eq $correctcode) {

         print encode_json({redirect_system=>{multifactor_done=>1}});

 } elsif($count >= 3) {

         print encode_json({challenge=>{interface=>[

                 {type=>'text', style=>'error', text=>'Too many failed attempts'},

                 {type=>'buttonrow', buttons=>[

                         {action=>'cancel', text=>'Retry'}

                 ]}

         ]}});

 } else {

         print encode_json({challenge=>{setvar=>{code=>$correctcode, count=>$count+1}, interface=>[

                 $code eq ''

                         ? {type=>'text', style=>'warning', text=>'Code is required for account '.encode_entities($params{'var_name_nice'}).' with email "'.encode_entities($params{'var_key_email'}).'"'}

                         : {type=>'text', style=>'error', text=>'Incorrect code, please try again'},

                 {type=>'input', description=>'Enter code:', name=>'code', default=>$code},

                 {type=>'buttonrow', buttons=>[

                         {action=>'continue', text=>'Verify'}

                 ]}

         ]}});

 }

} else {

 print encode_json({redirect_system=>{multifactor=>{keys=>['email']}}});

}

Added support for mapping local url reverse proxy to remote hosts. This can be achieved in field "Map path to HTTP backend (PATH=HOST[:PORT][|HTTP_HOST]):" which is located in ISL Conference Proxy configuration page under "Web server" section.

External authenticator binding command and external dialog authenticator now supports usage of non-plaintext password. Password can be encoded with ISL Conference Proxy password tool using the following command:

- Windows: confproxy_server.exe --password-tool encode islstatic1 <password>

- Linux: ./confproxy_server --password-tool encode islstatic1 <password>

Plain-text password can then be replaced with encoded password in your external authenticator binding string or external dialog authenticator string. Encoded passwords stay encoded in configuration and logs and are decoded only for the subprocesses.

With the new version of ISL Conference Proxy the behavior of Join page has been altered. Upon entering the session code on the new Join page (<icp_address>/join/), the URL is no longer redirected to the corresponding module page but instead stays on the <icp_address>/join/<session_code> URL.

Added support for load balancer debug log. There is a field called "Subsystem load balancer debug log" located under Configuration -> Logs  which can be set to Yes or No, depending on user if he want to turn this off or on.

Querying specific matchers for application downloading has been added to ISL Conference Proxy. Matching is achieved using following query string:

changebase\{platform:<win32|mac|linux64>\}=<program_name>

Consider following example of platform matching for ISL Light program download:

http://<sever_address>/users/download?name=ISL+Light&changebase\{platform:win32\}=winlight&changebase\{platform:mac\}=maclight

Using this query on Windows platform (Windows NT platform token in user-agent) will result in downloading Windows .exe named "winlight", whether using the same query on OS X platform (Macintosh platform token in user-agent) will result in downloading .dmg file named "maclight".

Added setting that controls after what time service user objects get generated for web connections. This objects hold information about the connection and get distributed to all servers in GRID environment. Single user (user's browser) can open up to 6 connections, it means every user will get 6 of these and all distributed. To not have to many objects this is controlled by only creating those who persist for a certain amount of time. Default value is 20 (in seconds). -1 means disabled, no objects will be created.

In some cases the packet generator subsystem in ISL Conference Proxy would require a very long time (over 1 minute) to generate a packet, which lead to long waiting times in client applications. This also affected the bulk file subsystem. Multiple steps have been taken to alleviate this:

* Generating packets in chunks is now timed

* The packet generator subsystem and the bulk files subsystem can now be logged. The settings can be enabled in "Configuration -> Logs", where they are exposed under the names "Subsystem packet generator debug log" and "Subsystem bulk files debug log".

* The option to set the cache time limit for the packet generator ("Configuration -> Advanced -> Performance -> Packet generator cache time limit in seconds") has been removed. Instead, the packet cache settings can now change during server runtime.

This defect was fixed.

In some cases, if ISL Conference Proxy was installed on a Windows domain member, the service could not be started - "Error 1069: The service did not start due to a logon failure". The reason was that is was missing access rights due to the domain policy "Log on as service". To mitigate the issue, a new service was created: confproxy_rights. This new service is started automatically before the normal service confproxy, because it is set as a dependency. confproxy_rights is used only to obtain the required rights, then it exits and ISL Conference proxy  is started.

This defect was fixed.

OpenSSL clients version 1.0.2b or higher would refuse connection to ISL Conference Proxy. To mitigate this, newer security algorithms were employed.

This defect was fixed.

In some cases codesign procedure could cause an internal server error.

This defect was fixed

VFS requires checking the maximum serial ID, but when VFS was used alongside Direct Tables (DT), it didn't always get checked, leading to possible data object corruption.

This defect was fixed.

There was an issue in ISL Conference Proxy where too many ACK packets were sent, leading to bandwidth and CPU performance issues when serving many (10000+) clients. The packet queue flushing algorithm has been changed in order to alleviate the issue.

This defect was fixed.

ISL Groop would sometimes enter into a redirection loop when joining a meeting because ISL Conference Proxy used a service public address for the join link. There was a setting on ISL Conference Proxy  under "Configuration -> Security -> Do not use service public addresses for web pages", but wasn't enabled by default due to API backward compatibility issues. The compatibility issues have been resolved by marking some functions deprecated and adding additional redirection checks. The setting "Do not use service public addresses for web pages" is now by default set to "Yes".

This defect was fixed.

When Windows starts the "Update and restart" procedure, it kills the PostgreSQL process of ISL Conference Proxy without allowing it to perform cleanup.

This defect was fixed.

The activity log ("[ICP install]/activity_log/", if enabled) stores a CSV file, where the name consists of numbers for the current year, month, and day - e.g. "2015-09-21.csv". However, the month number was wrong, as it was one less than the actual month - e.g. 09 for October, or 00 for January.

This defect was fixed.

The bulk file downloader would start multiple tasks for downloading a file because it failed to check if the download for the file had already started.

This defect was fixed.

Under certain circumstances, ISL Conference Proxy could encounter a deadlock. There were multiple measures taken against this:

- Fewer locks in HTTPT layer.

- Checking if HTTPT stop called before HTTPT init.

- Limiting bulk migration to 3 concurrent files.

- Making bulk connections synchronous.

This defect was fixed.

ISL Conference Proxy memtag - the option to track memory usage - did not record anything on Linux, but now it does. Note that enabling memtag switches the memory allocator to the default system one (instead of jemalloc or mallocspectrum).

This defect was fixed.

Previously, ISL Conference Proxy would report "connected to server" for a server that connected to GRID, but only if that server had already been connected, got disconnected, and reconnected to GRID. If a server connected to GRID for the first time, this was not reported, which lead to inconsistencies in reporting.

This defect was fixed.

There was a memory leak caused by a web_request object when a connection was broken and the request was not finished. This defect occured on:

- uploading the file through the ISL AlwaysOn files web interface and canceling it before completion

- updating ISL AlwaysOn connection

- uploading file in ISL Groop and ISL Pronto

This defect was fixed.

ISL Conference Proxy would sometimes report a large number of internal server errors to other servers in the GRID, which could have lead to stability issues. To alleviate the issue, multiple user-controllable restrictions on the length and number of errors have been set.

In "Configuration -> Advanced -> Web server":

- "Internal error max length", default is 2048. Maximum length of an internal error message, including the automatic "Module \[module name\]: " prefix.

- "Save max internal errors locally", default is 1000. How many internal errors are stored and reported on the local server. If the number of internal servers exceeds this number, the oldest errors get deleted to make room for newer ones.

- "Save max internal errors remotely per server", default is 10. How many internal errors are pushed from the local server to each other remote server in the GRID.

- "Web server internal error l.b. penalty" has been renamed to "Internal error l.b. penalty" to reflect the fact that all internal servers are now handled this way, not only web server internal ones.

There is also a new setting "Configuration -> Advanced -> Performance -> Limit GRID error status updates in seconds" (default 10s), which limits how often the error reports are synchronized between servers in the GRID.

Additionally, in "Activity Monitor -> Servers", the button "Clear web internal error" has been renamed to "Clear internal errors".

To simplify debugging, four new submission forms have been added to the "Debug" menu. Each one has a text field for the reporting module name, a text field for the error message, and a submission button, as listed below:

- "Set internal error" - creates an internal error.

- "Unset internal error" - removes an internal error.

- "Report error" - reports a non-internal error to the system email address. Includes an additional text field "Subject", which is the subject of the email.

- "Remove error" - removes a non-internal error.

This defect was fixed.

There was an issue where sometimes files would not get replicated across GRID. This occurred with a slow connection or large files (or preferably both), because the connection got broken after 30 seconds. The reason was wrong handling of empty file sender queues.

This defect was fixed.

ISL Conference Proxy on Linux would sometimes crash when a port could not have been bound. The reason was an uninitialized global lock

This defect was fixed.

Modules tried to update session cookies on their own instead of relying on a centralized source. Session cookies are not updated using centralized source.

This defect was fixed.

When calling the Webapi2 help method ("utils/api/help/1"), the returned description and arguments used to get translated, but don't anymore.

Creating and deleting threads after a timeout lead to high memory usage on Windows. Instead, threads are now part of a thread pool which does not delete created threads.

This defect was fixed.

Overriding files in develop_web_content folder did not clear entitiy tag (Etag) and empty Etag was used in ISL Groop overrides instead of file's own Etag. Maximum filename length was also increased from 100 to 1024 characters.

This defect was fixed.

Application name in previous version included the addbase parameter name. This was redesigned and now application inside DMG package no longer include the addbase parameter.

The defect was fixed.

Sending email to invalid address through webapi2 call resulted in non-terminating call. Exception handling for invalid email address was added to fix this issue.

This defect was fixed.

In case users sent an invitation to session with empty subject, that subject was shown incorrectly in the received email. Encoding of subject was redesigned, empty subject is now displayed correctly.

The defect was fixed.

Module pages that are disabled now use secure token. This token can be seen in URL as value of key parameter.

The defect was fixed.

URL parameter later_than was fixed, so that now can accept third parameter to return all results.

For example:

https://<ISLCP-SERVER-ADDRESS>/users/start/?name=ISL+Light+Desk&later_than=2015-06-17%7C4.0.1%7CALL

Support for grouping was added to Remote Access module web page and mimics the main grouping functionalities introduced in ISL Light 4.1.0 application.

Groups provide more intuitive user experience in dealing with multiple computers.

Exposed features for grouping functionality:

- create group

- edit group description

- add computer to group

- search computers in groups

- share group with other users

- delete group

Users can also see other members of groups and other relevant information.

The ISL AlwaysOn program continuously pings the ISL AlwaysOn module to check on the computer status. The ping interval can now be changed using the setting "Ping interval to be used by clients in seconds". A reconnect is required for the setting to take effect. The default setting value is set to -1, which leads to the actual default of 30s, but the value is automatically restricted: it cannot be lower than 10s or higher than 600s.

ISL AlwaysOn now registers the "child_of" relationships for deletion, for the following relationships:

- between ISL Conference Proxy users and AlwaysOn users.

- between connections and files.

This was done implicitly in previous versions, but it is now explicit for better performance.

In several places HTML escaping was replaced with XML escaping due to stricter and safer parsing, introducing some unicode filtering.

When ISL AlwaysOn computers reconnect back to server there is a lot of data ( last online times - ping column ) written to database. In case the the computer goes offline and then online on some other server, the ping time is written to disk. Write is now delayed for one hour, so the computer is allowed to come back online.

Added back-end support for user consent authentication on remote ISL AlwaysOn computer.

Added support for web template frame version 2 in ISL AlwaysOn module.

Added support for session/query/2 webapi functionality to ISL AlwaysOn module.

Added support for per user email settings in ISL AlwaysOn module.

Added support for automatic rule based upgrades of ISL AlwaysOn computers. This rule can be added in ISL Conference Proxy configuration page under "ISL AlwaysOn / Execute following action when computer registers:"

Sample rule:

#upgrade definition - each upgrade line is checked and only first match is used for each computer

#first parameter is key-value list of *EXACT* match to computer attribute

#the value in this pair is normally regexp

#second parameter is program query to be used - also key value pairs

upgrade version=<from_isl_alwayson_version>&custom=<your_customization_name> custom=<your_customization_name>&version=<to_isl_alwayson_version>

#key can be prefixed 'lt:' or 'gt:' or 'supports_protocol:' or 'not:' in order to switch to different match operation

upgrade  not:version=<isl_alwayson_version>&custom=<your_customization_name> custom=<your_customization_name>&version=<to_isl_alwayson_version>

upgrade lt:install=1231231&custom=<your_customization_name> custom=<your_customization_name>&version=<to_isl_alwayson_version>

Added support for email tracking header to ISL AlwaysOn module.

If computer with same id (cloned computer) was connecting to ISL Conference Proxy the connection of the first computer with same id was dropped. This caused endless reconnects of ISL AlwaysOn computer. The functionality was redesigned and all connections of cloned computers are kept alive, which allows users to send clone command to them.

Session code which is entered without dashes in the join page is shown with dashes for easier read in the new step of join page.

When the ISL AlwaysOn download/upload handler failed, that produced an internal error ("Web server internal error occurred: 'request incomplete, but handler already dead'"). This has been changed to only trigger a soft error by writing to the log. Additionally, a few optimizations have been applied to the download handler.

This defect was fixed.

The ISL AlwaysOn Webapi calls used to ignore the setting "Enable ISL AlwaysOn" if it was set to "No". This lead to issues in some parts that rely on these calls, e.g. in ISL Light the "Computers" tab was displayed with a full list of computers instead of hiding it from the user. The calls now consider the setting and if ISL AlwaysOn is disabled the user is informed that "Your user account does not have permission for ISL AlwaysOn. Please contact your administrator." (or a custom message, if set).

This defect was fixed.

The ISL AlwaysOn converter from file based database to direct tables database already ignored some obsolete keys, but still displayed warnings about the keys, e.g. "Converter: *** ERROR: Cannot write key [status]". The warnings are not displayed anymore.

This defect was fixed.

The ISL AlwaysOn file upload handler was not very stable, potentially causing internal server errors. It has been revised to offer better performance and handle errors better.

This defect was fixed.

If ISL AlwaysOn file transfer was terminated during a transfer, the resulting error message was not very helpful, only ":". The new error message is more descriptive ("Connection broken").

This defect was fixed.

The OnDemand feature of ISL AlwaysOn could sometimes lead to slow performance (e.g. when viewing active connections). This has been optimized by indexing the on_demand field in the database.

This defect was fixed.

A certain string did not get translated in the ISL AlwaysOn user web interface: in the list of "My computers", selecting "More..." on a computer and "Change password", the description for the last field, "Retype new password", was not translated.

This defect was fixed.

In some cases ISL Conference Proxy could have crashed, when ISL AlwaysOn file upload was paused and the server got interrupted. This occurred because of improper queue handling and potential race conditions.

This defect was fixed.

Sharing a computer using the ISL AlwaysOn user interface by clicking "More... -> Edit Computer" for a computer and entering something into "Shared with" produced "Computer successfully updated.", but the sharing settings weren't saved. Sharing functionality was redesigned, the computer should be correctly shared.

This defect was fixed.

When an AlwaysOn computer connects, it performs a check whether it needs to read a list of connections. This check has been optimized for better performance by removing some redundant calls.

This defect was fixed.

In some cases ISL AlwaysOn could crash due to improper reference counting when caching user information.

This defect was fixed.

When users clicked on "Bulk actions" in "Remote Access" tab on web interface, there were missing two actions: "Execute" and "Shutdown". This issue was fixed in ISL AlwaysOn Module, and users should now see this two actions under "Bulk actions".

The defect was fixed

When installing a stock ISL AlwaysOn installation over an existing customized one, the database did not get properly updated, indicating a customization was applied when it actually wasn't. Updating of database customization field was redesigned and should now show the correct value.

This defect was fixed.

Users may have experienced inability to move computer from user defined group to All computers group. The issue was that migration procedure could not resolve user thus unable to migrate owner from group back to user. Migrating from group back to user owner was redesigned, user should now be able to move computer from user defined group to All computers group.

The defect was fixed.

In files interface of ISL Alwayson web interface back button was missing. The back button was added to the interface.

The defect was fixed.

There was an issue with sharing computers in bulk share dialog in ISL AlwaysOn web interface. In case computer description included space character, then that computer was not shared. Bulk sharing functionality was redesigned, computers will be shared even if description includes space character.

The defect was fixed.

Users may have experienced broken layout when viewing files for remote computer, if the remote computer had a long computer description. The description now breaks through multiple lines and the layout is shown correctly.

The defect was fixed.

Users may have experienced broken session history layout if the computer had a long computer description. Session history interface was redesigned, long computer description is now broken into multiple lines, thus layout is no longer broken.

The defect was fixed.

If users removed shared user using the list of users ( by unchecking the checkbox next to the username ), then that user was not removed from share. Functionality was redesigned so when users deselect shared users in list of users, those users will no longer have access to that ISL AlwaysOn computer.

This defect was fixed.

When a user requests a multilicense ID, the request gets logged inside ISL Conference Proxy log. This has been expanded to also log the requesting user ID, the client address, and the session ID.

The ISL Light module can now return platform dependent links to an ISL Light session - currently desktop (default), Android, and iOS are supported.

Added support for web template frame version 2 in ISL Light module.

Per user email settings were added. Custom from for e-mails, Custom sender for e-mails and Hide account e-mail for sender settings were added to user General settings, together with Custom e-mail from for sender domains and Hide e-mail sender for domains in General settings.

New setting "Record client address in SMTP headers" enables adding additional tracking in SMTP headers. Per user setting for e-mail sending permission was added.

The setting "Configuration -> ISL Light -> Use text code notify" has been removed from ISL Conference Proxy web administration. The reason is that it is not needed anymore: if a valid connection code hasn't been synchronized across the GRID yet, preventing the client to connect, the new behavior is that instead of immediately throwing an error, ISL Light waits for a while.

There were some issues with XML compliance in XMLMSG.

This defect was fixed.

When SWAL receiver was backlogged, ISL Light Client showed that session with enter code does not exist, even if session code was correct. Problem was in synchronization between servers.

The defect was fixed.

Webapi calls to ISL Light methods used to ignore the setting that disabled ISL Light ("ISL Light enabled: No").

This defect was fixed.

If users input long text into "infoNotes" field in function "isllight/session/info/set/1", webapi2 returned "unhandled exception" error. This function was redesigned and now, if users input long text into this field, webapi2 should not return any error. This webapi2 call is used in ISL Light application and on web interface when users want to edit session informations.

The defect was fixed

If webapi2 returned an error in send email page, this error was not shown. Function that calls webapi2 was redesigned so that now, in case of error, webapi2 error will be shown.

The defect was fixed.

ISL Groop now features a converter from its own file based database to the direct tables format.

ISL Groop gained the ability to download programs.

ISL Groop now registers the "child_of" relationships between sessions and their children (slides, runtimes, users, and files) for deletion. This was done implicitly in previous versions, but it is now explicit for better performance.

Implemented session/query/2 webapi2 function for ISL Groop module

Added support for web template frame version 2 in ISL Groop module.

Added support for per user e-mail setting.

Added support for per user e-mail sending permissions.

Added support for joining to ISL Groop session, without entering dashes on join page, second step of join page will display session code with dashes.

The function for generating HTML code from templates did not consider more than one apostrophe character in the template, leading to errors.

This defect was fixed.

If user wanted to join a meeting before the host started the meeting, Waiting for host to start the meeting dialog was shown. Even if host joined the meeting, ISL Groop did not connect to session. Sending command to join session for waiting clients was redesigned, and users should now automatically join the meeting when host starts the session.

The defect was fixed.

In case users sent an invitation to session with empty subject, that subject was shown incorrectly in the received email. Encoding of subject was redesigned, empty subject is now displayed correctly.

The defect was fixed.

Added support on server side to show offline/online status of chat member or members. This new setting can be found on ISL Conference Proxy configuration page under "ISL Pronto / Show chat member offline/online status".

If ISL Pronto gets forcefully closed, upon reopening any previously joined chats get rejoined.

The ISL Pronto module now supports one-time passwords by informing the ISL Pronto client about it.

ISL Conference Proxy gained the option to disable ISL Pronto InPage Chat using the "dboptions" file. InPage Chat can be disabled using "islpronto_inpage=0" and enabled using "islpronto_inpage=1". By default, InPage Chat is enabled.

Client initialization has been optimized and now uses queued executors.

ISL Pronto now indexes the column "is_client" of the "chat_sessions" table. The index is required when retrieving chats.

In several places HTML escaping was replaced with XML escaping as a stricter and safer option, introducing some unicode filtering

Clients who are just visiting a site with an InPage Chat widget get displayed in ISL Pronto as "Visiting". The ISL Pronto Module has now gained the option to disable this, found under "Configuration -> ISL Pronto -> Track web page visitors". The setting is disabled by default (visitor will not be tracked and will not be displayed as "Visiting").

ISL Pronto has gained the option to display the chat info link in the system default browser instead of opening it within Pronto. This behavior is by default disabled and can be enabled in ISL Conference Proxy web administration under "Configuration -> ISL Pronto -> Open chat info using operating system default browser". Note that "Chat info link" needs to be set first for this new setting to work.

Added support for web template frame version 2.

New Pronto module uses new API for link generation. In case of GRID configuration, where some ISL Conference Proxy servers are still running older Pronto modules (<= 4.2.3) on some servers, usage of deprecated API for link generation is necesary. This setting can be found under ISL Pronto settings on ISL Conference Proxy configuration page.

Per user email settings were added. Custom from for e-mails, Custom sender for e-mails and Hide account e-mail for sender settings were added to user General settings, together with Custom e-mail from for sender domains and Hide e-mail sender for domains in General settings.

New setting "Record client address in SMTP headers" enables adding additional tracking in SMTP headers.

In ISL Pronto there were no messages displayed if another operator joined or left a private chat. These messages are now displayed again, but can also be disabled in ISL Conference Proxy web administration under "Configuration -> ISL Pronto -> Add join/left messages for operator to operator chats".

This defect was fixed.

To optimize throughput when updating user sessions, unnecessary database queries have been removed.

This defect was fixed.

There were many issues with chat object synchronization across a GRID. Many issues were approached, e.g. chat object tracking, chat object merging, data caching, and synchronization of deleted members.

This defect was fixed.

When ISL Pronto was set to auto-assign and auto-open chats ("Open chat with client automatically" set to "Yes" and "Client assignment scheme" set to "Least Busy"), the client entered automatically, but the supporter received a "User <user> would to join chat '<user>'". This message is no longer displayed and the client enters the chat automatically.

This defect was fixed.

In some cases chat objects did not get properly deleted across the GRID, leading to duplicates.

This defect was fixed.

The ISL Pronto Live Dashboard ("<server>/users/islpronto/start.html) failed to load statistics if the number of chats exceeded 100. This was because it did not consider the limit of the Webapi call "islpronto/chat/get/list/1", which can return at most 100 chats.

This defect was fixed.

There were some inconsistency between user chats in dashboard and reports. This was redesigned so that there should not be any inconsistency present.

The defect was fixed.

When a supporter ended a chat with an InPage client and then the client started (and joined) a new chat, the welcome message was not displayed.

This defect was fixed.

If an InPage client started a chat and minimized it before a supporter could join, the text the supporter wrote before the client resumed the chat would be partially hidden behind the InPage Chat header.

This defect was fixed.

If the server a web chat client was connected to got restarted, but the supporter was on a different GRID server, after the server was operational again the client would receive a "Operator is not available" message.

This defect was fixed.

Chats were not displayed in the correct order. Chat sorting has been reworked.

This defect was fixed.

In some cases ISL Pronto could crash the ISL Conference Proxy server. The cause was connected to initialization of InPage chat.

This defect was fixed.

In some cases ISL Pronto would cause the ISL Conference Proxy server to crash due to improper locking of chat objects.

This defect was fixed.

When a web chat client encountered a server redirect or reconnect an alert box was shown informing the client of the event. This has been redesigned to be seamless to the client.

This defect was fixed.

If the server a web chat client was connected to got restarted, but the supporter was on a different GRID server, after the server was operational again the client would see a "Please wait for a free operator" screen and the supporter had to allow the client to rejoin. The rejoin message still appears, but the chat is able to continue without problems. In some cases the client will receive a "Live chat was disconnected because of network failure" message, but after reconnecting the chat is normally resumed.

This defect was fixed.

ISL Pronto used to use the "login::" key, which created a new record in the joined keys table ("islpronto_chat_session"). Instead, ISL Pronto now stores this data into a new column "join_secret" of the "islpronto_chat_member" table.

This defect was fixed.

In some cases after a server reboot or redirection a web chat client may have been unable to see the supporter name and image.

This defect was fixed.

If webclient was redirected from admin console to a server that was not joined to the domain of the client, the client would get stuck in "Waiting for the operator" screen. This was now redesigned so that clients should not get stucked in "Waiting for the operator screen".

The defect was fixed.

Sometimes ISL Pronto client program displayed duplicate chat lines due to an issue on ISL Pronto module.

This defect was fixed.

There was some memory leakage in ISL Pronto caused by improperly terminated tasks.

This defect was fixed.

Supporter tasks were leaking in ISL Pronto module. Leaks were located and eliminated.

The defect was fixed.

Viewing other user chats in a domain permission was not checking the correct ISL Conference Proxy settings. Functionality was redesigned and correct permissions are checked.

The defect was fixed.

When users were connected to different server they sometimes saw incorrect status in the client list and chat tabs. This was redesigned, so users should now see correct status.

The defect was fixed.

In some cases an InPage Chat client was not able to join chat if auto-answer was configured - the widget would only show a connecting monitor image, but would not be able to connect.

This defect was fixed.

When creating an InPage chat, ISL Pronto used to first create the chat and add the users to the chat at a later time. However, that sometimes lead to race conditions, preventing InPage clients to join. This was redesigned so that users are added to the chat at the same time as the the chat is created.

This defect was fixed.

In some cases where auto-answer was enabled and a chat got interrupted by the supporter going offline, but then returning to resume the chat, the client was not visible in the chat list.

This defect was fixed.

Task responsible for updating clients rDNS was blocking supporter executor chain due to time spent waiting for rDNS to resolve the address.

This task is now scheduled into the executor chain only after rDNS lookup is finished.

This defect was fixed.

The ISL Light module could sometimes cause ISL Conference Proxy to crash if it failed to obtain the chat XML template or filter names from ISL Pronto module.

This defect was fixed.

If users on mobile phones visited the live chat, the chat layout was not adopting correctly to the phone screen size, thus some elements were not correctly displayed. Layout was redesigned for mobile phone users, and should now display the chat correctly.

The defect was fixed.

When one of the servers got disconnected another join message was added to the chat. This was redesign that when one servers got disconnected, there will not be another join message.

The defect was fixed.

Button for sending chat transcript did not trigger sending email. HTML marker entities for bi-directional text were replaced with decimal code to make them work in XML.

This defect was fixed.

In previous version, ISL Pronto module reported errors via islonline.com page. Now, ISL Pronto module report errors via /users/main/report_web_error page.

The defect was fixed.

Added support for web template frame version 2 in module Reports.

The table of chats in reports for ISL Pronto would show multiple columns with the same custom field values. This occurred when the user selected to display custom fields, and then changed the page or the number of entries per page.

This defect was fixed.

In the ISL Light or ISL Pronto sections of the Reports module, if the table was set to display fields other than the default ones (using the settings cog icon) and the page was changed or if the number of displayed chats per page was changed, the settings would get lost and the selected fields would not get displayed anymore. Selection is now remembered.

This defect was fixed.

Custom fields in reports for ISL Pronto did not get exported as part of the CSV file.

This defect was fixed.

If an ISL Light session ended with an end-of-session dialog (when a customization had been applied), opening the chat transcript for that session in reports would result in the chat transcript getting stuck at loading.

This defect was fixed.

In the ISL Light part of the Reports module opening a chat transcript that did not fit the height of the window provided no way to display all chat content. The chat transcript view has been reworked to include a scrollbar in those cases.

This defect was fixed.

After ISL Conference Proxy started shutdown, web administration could still be accessed. This has been changed by closing the listen sockets on port 80, 443, 7615, and 7616 when server shutdown starts and also by preventing any new requests.

Expanded code signing to more executables.

In previous versions of ISL Conference Proxy, standard error output was not captured from internally launched processes (like PostgreSQL). Process output capture has been reworked to also capture standard error and report it in the log file, where it is shown as "[<process>] stderr: [<process id>] <output>". This has also been extended to capture standard output of processes (stdout) in the same manner.

Updated GeoIP  to use the January 2016 database.

The GeoIP resolver tester would return a wrong link to Google Maps. Found in "Activity Monitor -> GeoIP status -> See GeoIP resolver tester", if a valid IP address is entered, a table containing geographic information about this address is shown and below the table is a link labeled "Show on Google Maps". Clicking on this link would return an invalid Google Maps query because a comma was missing between the latitude and the longitude.

This defect was fixed.

Additional counters for DNS queries were added to Debug counters:

- netmt_sink

- netmt_transport

- tpc_client_sum

- tcp_request

- tcp_request_sum

- udp_reply_queue

- udp_request

- udp_request_overflow

- udp_request_sum

- udp_request_timeout

The load balancer now reports a meaningful address instead of 0.0.0.0 in the log - "watchdog_address" or "dns_unknown_address".

Upgraded PostgreSQL to version 9.3.10.

If there was a lot of traffic on the ISL Conference Proxy server, PostgreSQL was not able to shutdown in the default 60s timeout period, leading to errors "waiting for server to shut down ... failed". The default timeout has been increased to 600s.

This defect was fixed.

Created a new module, Authentication, which reduces build dependencies and enables faster changes. In the ISL Conference Proxy installation folder, it creates a subfolder "authenticator" with different authenticators (FreeRADIUS, LDAP, ...).

To simplify authentication, a new authenticator has been provided in the folder "<ISL Conference Proxy installation>/authenticator", called "ldap.exe" on Windows and "ldap" on Linux. This is a native LDAP authenticator. It is meant to replace all other authentication scripts, which are now considered legacy, and users are advised to use the new authenticator. Source code is provided in the file "ldap.c", along with examples and explanation of use.

External authenticator LDAP now supports SSO option. The following options for SSO were added to the ldap executable:

SSO_LDAP_SCOPE;base; (LDAP search scope for password-less authentication)

SSO_LDAP_BASE;CN=User,CN=Users,DC=example,DC=com; (LDAP search base for password-less authentication)

SSO_LDAP_FILTER;objectCategory=*; (LDAP search filter for password-less authentication)