Poweradmin Files

✨ Highlights

A patch release for sign-in, password reset, record validation and zone search. No database migration.

🐛 Fixes

• Sign-in - the second factor is verified against the account logging in, every login starts from a clean session, and MFA no longer asks again right after setup (#1737).
• Password reset - matches the exact email and mails the address on file.
• Account lockout also covers API Basic auth and dynamic DNS logins.
• Disabled accounts are refused at OIDC and SAML login.
• Record types - unknown types and malformed RFC 3597 data, which make PowerDNS fail the zone, are refused.
• Zone search - paging no longer repeats zones, and filters and sorting are kept.
• Zone list - sorting by owner or record count works on PostgreSQL (#1618).
• Record comments are saved together with the record (#1556).
• API backend mode - zones addressed by row id show their records (#1578), and the PowerDNS version is detected again after the cache expires (#1564).
• Mail refuses line breaks in the recipient, subject and headers.
• User preferences equal to the site default are no longer saved, so settings.php keeps applying (#1739).
• Plus-addressed emails are accepted (#1674), and IPv6 works on the status page (#1607).
• Docker - the container waits for the database before schema setup, and DB_PORT is passed through (#1653).
• New users can't be given a permission template with rights their creator doesn't have.
• Zone creation refuses a zone inside a zone owned by another user.
• Record comments are copied to the matching A or PTR record only in zones the user can edit.
• Installer IP allow-list handles IPv6 clients and plain addresses correctly.
• Dynamic DNS returns a normal error instead of a server error when the IP is sent in an unexpected format.
• Username rename compares names as plain text when checking for duplicates.
• Zone type labels stay Primary/Secondary when the PowerDNS API cannot be reached.

📦 Upgrading

Drop-in replacement for v4.4.1. Check these before rolling out:

• Docker waits up to DB_WAIT_TIMEOUT seconds (default 30) for the database. Raise it if yours starts slower.
• Unknown record types are refused on save.
• API zone rename in SQL backend mode is refused. Rename the zone in PowerDNS instead.
• md5 and md5salt password encryption stops startup. Set bcrypt, argon2i or argon2id.
• Mail with mail.encryption = 'tls' (the default) is not sent if the server offers no STARTTLS.
• New opt-in settings, off by default: security.strict_session_gates, security.password_reset.single_use_claim.
• parent_zone_ownership_check is on by default: users can no longer create a zone inside another user's zone. Set it to false for the old behaviour.

PHP 8.2+.

Full changelog: https://github.com/poweradmin/poweradmin/compare/v4.4.1...v4.4.2