Poweradmin Files

✨ Highlights

Maintenance release for the 3.x LTS line: permission checks, record validation and output escaping. No database migration.

🐛 Fixes

• User managers can no longer edit or delete superuser accounts.
• Zone permissions - saving records and managing DNSSEC keys check zone edit rights, and assigning a zone to another user needs zone_content_edit_others (#1558).
• Record validation - control characters in names and content are refused.
• Login issues a fresh request token, and a blank LDAP credential is refused.
• Dynamic DNS updates only the matched record.
• Output escaping for flash messages, zone logs and pdnsutil output.
• TLD and public suffix lists refreshed.
• New users can't be given a permission template with rights their creator doesn't have.
• Zone creation refuses a zone inside a zone owned by another user.
• Record comments are copied to the matching A or PTR record only in zones the user can edit.
• Installer IP allow-list handles IPv6 clients and plain addresses correctly.
• Dynamic DNS returns a normal error instead of a server error when the IP is sent in an unexpected format.
• Username rename compares names as plain text when checking for duplicates.

📦 Upgrading

Drop-in replacement for v3.9.12:

• Template assignment on a user needs user_edit_templ_perm.
• Client-level editors can no longer delete NS records or edit LUA records.
• .htaccess now ships in the archive. Merge your own before overwriting.
• $dns_parent_zone_ownership_check is on by default: users can no longer create a zone inside another user's zone. Set it to false for the old behaviour.

PHP 8.1+.

Full changelog: https://github.com/poweradmin/poweradmin/compare/v3.9.12...v3.9.13