Poweradmin Files

✨ Highlights

A patch release for sign-in, password reset, record validation, zone search and zone ownership. No database migration.

🐛 Fixes

• Sign-in - the second factor is verified against the account logging in, every login starts from a clean session, and MFA no longer asks again right after setup (#1737).
• Password reset - matches the exact email and mails the address on file.
• Account lockout also covers API Basic auth and dynamic DNS logins.
• Disabled accounts are refused at OIDC and SAML login.
• Record types - unknown types and malformed RFC 3597 data, which make PowerDNS fail the zone, are refused.
• Zone search - paging no longer repeats zones, and filters and sorting are kept.
• Zone list - sorting by owner or record count works on PostgreSQL (#1618).
• Zone owners - removing the last owner is refused, and assigning a new zone to another user needs zone_content_edit_others (#1558).
• Record comments are saved together with the record (#1556).
• API backend mode - zones addressed by row id show their records (#1578).
• Mail refuses line breaks in the recipient, subject and headers.
• Plus-addressed emails are accepted (#1674), and IPv6 works on the status page and in login allow and deny lists (#1607).
• Docker passes DB_PORT through (#1653).
• New users can't be given a permission template with rights their creator doesn't have.
• Zone creation refuses a zone inside a zone owned by another user.
• Record comments are copied to the matching A or PTR record only in zones the user can edit.
• Installer IP allow-list handles IPv6 clients and plain addresses correctly.
• Dynamic DNS returns a normal error instead of a server error when the IP is sent in an unexpected format.
• Username rename compares names as plain text when checking for duplicates.

📦 Upgrading

Drop-in replacement for v4.3.5. Check these before rolling out:

• Unknown record types are refused on save.
• API zone rename in SQL backend mode is refused. Rename the zone in PowerDNS instead.
• Zone owners - add another owner before removing the last one.
• Global zone templates can only be created by administrators.
• Self-edit of your own username, LDAP flag or active state needs user_edit_others (#1327).
• Password reset is declined for an email shared by several accounts.
• md5 and md5salt password encryption stops startup. Set bcrypt, argon2i or argon2id.
• Mail with mail.encryption = 'tls' (the default) is not sent if the server offers no STARTTLS.
• New opt-in settings, off by default: security.strict_session_gates, security.password_reset.single_use_claim.
• parent_zone_ownership_check is on by default: users can no longer create a zone inside another user's zone. Set it to false for the old behaviour.

PHP 8.2+.

Full changelog: https://github.com/poweradmin/poweradmin/compare/v4.3.5...v4.3.6