Poweradmin Files

✨ Highlights

First patch release of the 4.4 line. Carries every fix from 4.2.6 and 4.3.5 (permission and ownership enforcement, login and session hardening, interface.application_url URL building, LUA restrictions, API backend zone identity) plus 4.4-specific work: dynamic DNS address handling, API routing corrections, PowerDNS metrics URL derivation, and Docker environment variables for the 4.4.0 settings. No database migration.

🐛 Fixes

Users and permission templates

• Permission template assignment is authorized against the caller and the target account on every path: the users form, bulk updates, the API user endpoints, and the template editor. Only the template named in the URL is written, and superuser grants are reserved for administrators.
• API user creation without perm_templ now assigns the minimal template instead of the first template in the table, and an update that repeats the stored template is no longer rejected.
• Empty password on update keeps the stored hash; an empty stored hash is treated as a failed login.
• Deactivated or deleted API key owners can no longer authenticate with their keys.

Zones and records

• Zone name, type and primary changes through the API require the zone metadata permission, like the web edit form. Resending an unchanged value needs no extra permission, so clients that submit every field on update keep working.
• Zone template listing through the API is available to users who may add zones, matching the add-zone form.
• Zone ownership changes authorize the zone being written, and bulk zone deletion requires the delete permission and a CSRF token.
• SOA and NS edit restrictions check the stored record type, and restricted record types are reported instead of failing with a server error.
• Multi-record add reports the rows that were refused (#1409).
• Zone template records are validated against their record type (#560), unquoted TXT values stay accepted, only the missing SOA timers are filled in, and record type restrictions apply when editing templates. Template record views are scoped to the template they belong to.
• Internal zone actions are gated on either zone view permission.
• LUA records need more than client-level editing rights on every surface: the web form, the API, and zone templates. Existing LUA records in zones held by client-level editors are shown locked, like SOA and NS.
• Lua-enabling zone metadata (ENABLE-LUA-RECORDS, LUA-AXFR-SCRIPT) can only be set by administrators.
• TSIG-ALLOW-DNSUPDATE accepts several key names; duplicate SOA-EDIT-API rows are no longer written from the metadata editor (#1437).
• CAA hint for the ; issuer value now says what it does: disallow every CA.

API backend mode

• Zone identity is resolved through one canonical expression everywhere: ownership, visible zone lists, hybrid permissions, the DDNS zone list, cached type and primary reads, and zone creation, which now commits the zones row and its backfill together. Rows that shared an identifier no longer collapse or reach another zone. Direct-SQL installations keep reading domain_id and are unaffected.
• Record reads fetch single RRsets instead of whole zones on PowerDNS 5.0+, with a full-zone fallback on older servers; zone reads are no longer narrowed on servers whose filter omits disabled records.
• Secondary primaries given as a comma-separated list are split for the API (#1429); the edit selector accepts encoded record IDs (#1415).
• Group ownership, extra owners, search, comments, template counts and the consistency check all resolve by the canonical zone id; owner sync no longer wipes the PowerDNS account on a zone it cannot resolve.
• Consumer zones are no longer offered by the add-zone form, which cannot configure them; existing ones keep working.

Dynamic DNS

• Address families are routed by the address itself: a mixed myip list updates both A and AAAA records. A list containing an unparseable address, or a family with no valid address, is refused with dnserr instead of being silently trimmed.
• Accounts without a local password hash (SSO-provisioned) get badauth instead of a server error.

API routing

• Bulk record operations are matched before the single-record lookup, so GET, PUT and DELETE on /records/bulk answer 405 instead of a record lookup.
• RRset type in the path is constrained to letters and digits; the DNSSEC key edit and toggle routes accept only the verbs their pages use.
• Web pages under /api/ render HTML errors again; API paths are matched per segment.

PowerDNS status

• Metrics URL is derived from pdns_api.url, so path prefixes work; the autoprimary probe is bounded to a 3 second budget and reports unchecked hosts as such.

Login, sessions and SSO

• Second-factor verification is rate limited, email codes come from a CSPRNG, and a recovery code is accepted while the second factor is locked out.
• Login timing is equalized for unknown usernames, and API keys, reset tokens and MFA codes are compared in constant time.
• Session key warnings distinguish the shipped default from a key that is merely too short; salts are generated with random_int().
• Emailed login and reset links, IdP redirect URLs and SAML SP URLs are built only from interface.application_url; the dashboard warns when password reset is enabled without it.
• SSO provisioning refuses to run when the default permission template is missing, requires a verified email claim, never links superuser accounts, and matches numeric group keys and claims in the permission template and group mappings.
• Username recovery links are built from interface.application_url.
• LDAP usernames and linked emails are matched without accent folding.

Docker

• Generated config emits valid PHP for boolean env values and escapes secrets, the session key and the PowerDNS API key (#1318).
• OIDC and SAML require PA_APPLICATION_URL, accept the base URL and explicit SP URLs as SAML sources, and default the provisioning template to Guest.
• Healthcheck uses the exec form; the config directory is created before defaults are restored.
• MySQL password is passed through a defaults file instead of the command line, and the psql port argument is built safely.
• 4.4.0 settings as environment variables: PA_DNS_TTL_REVERSE, PA_DNS_DEFAULT_ZONE_TEMPLATE, PA_DNS_ZONE_OWNERSHIP_MODE, PA_DNS_SYNC_ZONE_OWNER_TO_ACCOUNT, PA_FAVICON_PATH, PA_LOGO_PATH, PA_PDNS_API_TIMEOUT; favicon and logo paths are escaped when generating config.

Other

• Installer trusts X-Forwarded-For only from configured proxies; SQLite database files are denied web access in the shipped server configs.
• MariaDB ONLY_FULL_GROUP_BY is read from and cleared in the session SQL mode.
• Email is handed to sendmail -t -i so piped messages are delivered.
• Dynamic DNS client sends the IPv6 address in myip6.
• Dark mode contrast restored for card icons, badges, alerts and inline code (#1427); the footer stays at the viewport bottom in the modern theme and the installer; the 404 page's home button honours the base URL.
• Log output is escaped before being echoed.

📦 Upgrading

Drop-in replacement for v4.4.0, no migration. Check these before rolling out:

• API clients that create users without perm_templ now get a minimal-template user, not an administrator.
• API keys must be able to change zone name, type or primary through the metadata permission (zone_meta_edit_*); content-edit rights alone are refused for a real change.
• API keys whose owner is deactivated stop working.
• Set interface.application_url (Docker: PA_APPLICATION_URL) when password reset, OIDC or SAML is enabled; emailed links are no longer derived from the request host.
• Users see a warning while security.session_key is the shipped default or shorter than the minimum; regenerate it.
• Second-factor codes are rate limited; the recovery code still works during a lockout.
• Zone template records that fail type validation are refused on save.
• Client-level editors (the shipped Editor template) can no longer add, edit or delete LUA records; an administrator or zone manager must handle existing ones.
• Dynamic DNS updates with an unparseable address in the list now return dnserr; the bundled client is unaffected.
• A host-only pdns_api.url no longer forces port 8081 for metrics; include the port if PowerDNS serves metrics elsewhere.
• Bulk zone deletion is all-or-nothing on permission.

PHP 8.2+ required (unchanged).

Full changelog: https://github.com/poweradmin/poweradmin/compare/v4.4.0...v4.4.1