Poweradmin Files

✨ Highlights

Patch release for the 4.2.x line. Focus is permission and ownership enforcement across the web UI and the API, login and session hardening, correct URL building from interface.application_url, and a set of Docker configuration fixes. No database migration.

🐛 Fixes

Users and permission templates

• Permission template assignment is authorized against the caller and the target account on every path: the users form, bulk updates, the API user endpoints, and the template editor. Only the template named in the URL is written, and superuser grants are reserved for administrators.
• API user creation without perm_templ now assigns the minimal template instead of the first template in the table, and an update that repeats the stored template is no longer rejected.
• Empty password on update keeps the stored hash; an empty stored hash is treated as a failed login.
• Deactivated or deleted API key owners can no longer authenticate with their keys.

Zones and records

• Zone name, type and primary changes through the API require the zone metadata permission, like the web edit form. Resending an unchanged value needs no extra permission, so clients that submit every field on update keep working.
• Zone template listing through the API is available to users who may add zones, matching the add-zone form.
• Zone ownership changes authorize the zone being written, and bulk zone deletion requires the delete permission and a CSRF token.
• SOA and NS edit restrictions check the stored record type, and restricted record types are reported instead of failing with a server error.
• Multi-record add reports the rows that were refused (#1409).
• Zone template records are validated against their record type (#560), unquoted TXT values stay accepted, only the missing SOA timers are filled in, and record type restrictions apply when editing templates. Template record views are scoped to the template they belong to.
• Internal zone actions are gated on either zone view permission.
• CAA hint for the ; issuer value now says what it does: disallow every CA.

Login, sessions and SSO

• Second-factor verification is rate limited, email codes come from a CSPRNG, and a recovery code is accepted while the second factor is locked out.
• Login timing is equalized for unknown usernames, and API keys, reset tokens and MFA codes are compared in constant time.
• Session key warnings distinguish the shipped default from a key that is merely too short; salts are generated with random_int().
• Emailed login and reset links, IdP redirect URLs and SAML SP URLs are built only from interface.application_url; the dashboard warns when password reset is enabled without it.
• SSO provisioning refuses to run when the default permission template is missing, requires a verified email claim, never links superuser accounts, and matches numeric group keys in the permission template mapping.
• LDAP usernames and linked emails are matched without accent folding.

Docker

• Generated config emits valid PHP for boolean env values and escapes secrets, the session key and the PowerDNS API key (#1318).
• OIDC and SAML require PA_APPLICATION_URL, accept the base URL and explicit SP URLs as SAML sources, and default the provisioning template to Guest.
• Healthcheck uses the exec form; the config directory is created before defaults are restored.

Other

• Installer trusts X-Forwarded-For only from configured proxies; SQLite database files are denied web access in the shipped server configs.
• MariaDB ONLY_FULL_GROUP_BY is read from and cleared in the session SQL mode.
• Email is handed to sendmail -t -i so piped messages are delivered.
• Dynamic DNS client sends the IPv6 address in myip6.
• Dark mode contrast restored for card icons, badges, alerts and inline code (#1427); the footer stays at the viewport bottom on short pages.
• Log output is escaped before being echoed.

📦 Upgrading

Drop-in replacement for v4.2.5, no migration. Check these before rolling out:

• API clients that create users without perm_templ now get a minimal-template user, not an administrator.
• API keys must be able to change zone name, type or primary through the metadata permission (zone_meta_edit_*); content-edit rights alone are refused for a real change.
• API keys whose owner is deactivated stop working.
• Set interface.application_url (Docker: PA_APPLICATION_URL) when password reset, OIDC or SAML is enabled; emailed links are no longer derived from the request host.
• Users see a warning while security.session_key is the shipped default or shorter than the minimum; regenerate it.
• Second-factor codes are rate limited; the recovery code still works during a lockout.
• Zone template records that fail type validation are refused on save.

PHP 8.2+ required (unchanged).

Full changelog: https://github.com/poweradmin/poweradmin/compare/v4.2.5...v4.2.6