Poweradmin Files

✨ Highlights

Maintenance release for the 3.x LTS line. Focus is permission enforcement on template, user and zone changes, login hardening, and output escaping. No database migration.

🐛 Fixes

Users and permission templates

• Permission template assignment is authorized on the users form, the bulk update path and the create path; only the template named in the URL is written, its id is quoted, and superuser grants are reserved for administrators.
• Changing another user's password requires the password permission; a superuser account is reported as uneditable instead of blaming the template.

Zones and templates

• Zone type, primary and owner changes require meta-edit rights; applying a template, signing or unsigning a zone requires edit rights.
• Template, supermaster and DNSSEC key changes require a confirmed POST; zone template record views and writes are scoped to the authorised template, and publishing a global template requires administrator rights.
• Record type restrictions apply when editing zone templates, and SOA and NS edit denials check the stored record type.
• Deleting a secondary zone with no primary set no longer fails on a null value.
• Dynamic DNS requests without a user agent are rejected.

Login and sessions

• Login timing is equalized for unknown usernames; salts are generated with random_int().
• Session key warnings distinguish the shipped default from a key that is merely too short.
• LDAP usernames are matched without accent folding.

Output and errors

• Log, pdnsutil debug output and error messages are escaped before rendering, record names are no longer double-encoded, and record validation errors are wrapped consistently.

Other

• Installer trusts X-Forwarded-For only from configured proxies.
• MariaDB ONLY_FULL_GROUP_BY is read from and cleared in the session SQL mode.
• Docker runs the runtime user by numeric uid.
• Data files refreshed: public suffix list and IANA TLD list.
• Localization: installer default username hint translated in every catalogue; Polish diacritics corrected.
• Footer stays at the viewport bottom on short pages.

📦 Upgrading

Drop-in replacement for v3.9.11, no migration. Users see a warning while the session key is the shipped default or too short; regenerate it. PHP 8.1+ required (unchanged).

Full changelog: https://github.com/poweradmin/poweradmin/compare/v3.9.11...v3.9.12