Poweradmin Files

✨ Highlights

Patch release for the 4.3.x line. Carries every fix from 4.2.6 (permission and ownership enforcement, login and session hardening, interface.application_url URL building, Docker configuration) plus 4.3-specific work: zone identity resolution in the API backend mode, per-RRset reads, and LUA record restrictions. No database migration.

🐛 Fixes

Users and permission templates

• Permission template assignment is authorized against the caller and the target account on every path: the users form, bulk updates, the API user endpoints, and the template editor. Only the template named in the URL is written, and superuser grants are reserved for administrators.
• API user creation without perm_templ now assigns the minimal template instead of the first template in the table, and an update that repeats the stored template is no longer rejected.
• Empty password on update keeps the stored hash; an empty stored hash is treated as a failed login.
• Deactivated or deleted API key owners can no longer authenticate with their keys.

Zones and records

• Zone name, type and primary changes through the API require the zone metadata permission, like the web edit form. Resending an unchanged value needs no extra permission, so clients that submit every field on update keep working.
• Zone template listing through the API is available to users who may add zones, matching the add-zone form.
• Zone ownership changes authorize the zone being written, and bulk zone deletion requires the delete permission and a CSRF token.
• SOA and NS edit restrictions check the stored record type, and restricted record types are reported instead of failing with a server error.
• Multi-record add reports the rows that were refused (#1409).
• Zone template records are validated against their record type (#560), unquoted TXT values stay accepted, only the missing SOA timers are filled in, and record type restrictions apply when editing templates. Template record views are scoped to the template they belong to.
• Internal zone actions are gated on either zone view permission.
• LUA records need more than client-level editing rights on every surface: the web form, the API, and zone templates. Existing LUA records in zones held by client-level editors are shown locked, like SOA and NS.
• Lua-enabling zone metadata (ENABLE-LUA-RECORDS, LUA-AXFR-SCRIPT) can only be set by administrators.
• TSIG-ALLOW-DNSUPDATE accepts several key names; duplicate SOA-EDIT-API rows are no longer written from the metadata editor (#1437).
• CAA hint for the ; issuer value now says what it does: disallow every CA.

API backend mode

• Zone identity is resolved through one canonical expression everywhere: ownership, visible zone lists, hybrid permissions, the DDNS zone list, cached type and primary reads, and zone creation, which now commits the zones row and its backfill together. Rows that shared an identifier no longer collapse or reach another zone. Direct-SQL installations keep reading domain_id and are unaffected.
• Record reads fetch single RRsets instead of whole zones on PowerDNS 5.0+, with a full-zone fallback on older servers; zone reads are no longer narrowed on servers whose filter omits disabled records.
• Secondary primaries given as a comma-separated list are split for the API (#1429); the edit selector accepts encoded record IDs (#1415).

Login, sessions and SSO

• Second-factor verification is rate limited, email codes come from a CSPRNG, and a recovery code is accepted while the second factor is locked out.
• Login timing is equalized for unknown usernames, and API keys, reset tokens and MFA codes are compared in constant time.
• Session key warnings distinguish the shipped default from a key that is merely too short; salts are generated with random_int().
• Emailed login and reset links, IdP redirect URLs and SAML SP URLs are built only from interface.application_url; the dashboard warns when password reset is enabled without it.
• SSO provisioning refuses to run when the default permission template is missing, requires a verified email claim, never links superuser accounts, and matches numeric group keys in the permission template mapping.
• LDAP usernames and linked emails are matched without accent folding.

Docker

• Generated config emits valid PHP for boolean env values and escapes secrets, the session key and the PowerDNS API key (#1318).
• OIDC and SAML require PA_APPLICATION_URL, accept the base URL and explicit SP URLs as SAML sources, and default the provisioning template to Guest.
• Healthcheck uses the exec form; the config directory is created before defaults are restored.
• MySQL password is passed through a defaults file instead of the command line, and the psql port argument is built safely.
• stable image tag follows v4.3.x release tags automatically; pre-release tags do not move it.

Other

• Installer trusts X-Forwarded-For only from configured proxies; SQLite database files are denied web access in the shipped server configs.
• MariaDB ONLY_FULL_GROUP_BY is read from and cleared in the session SQL mode.
• Email is handed to sendmail -t -i so piped messages are delivered.
• Dynamic DNS client sends the IPv6 address in myip6.
• Dark mode contrast restored for card icons, badges, alerts and inline code (#1427); the footer stays at the viewport bottom on short pages.
• Log output is escaped before being echoed.

📦 Upgrading

Drop-in replacement for v4.3.4, no migration. Check these before rolling out:

• API clients that create users without perm_templ now get a minimal-template user, not an administrator.
• API keys must be able to change zone name, type or primary through the metadata permission (zone_meta_edit_*); content-edit rights alone are refused for a real change.
• API keys whose owner is deactivated stop working.
• Set interface.application_url (Docker: PA_APPLICATION_URL) when password reset, OIDC or SAML is enabled; emailed links are no longer derived from the request host.
• Users see a warning while security.session_key is the shipped default or shorter than the minimum; regenerate it.
• Second-factor codes are rate limited; the recovery code still works during a lockout.
• Zone template records that fail type validation are refused on save.
• Client-level editors (the shipped Editor template) can no longer add, edit or delete LUA records; an administrator or zone manager must handle existing ones.

PHP 8.2+ required (unchanged).

Full changelog: https://github.com/poweradmin/poweradmin/compare/v4.3.4...v4.3.5