commit e17239734487b54111a92c88703727c0ccc98c3b
Author: Thomas Lamprecht <t.lamprecht@proxmox.com>
Date: Thu Aug 7 18:39:03 2025 +0200
bump version to 4.0.12-1
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
commit 9cf80dc6db539a45b9160153b96d8d56427ec06e
Author: Christian Ebner <c.ebner@proxmox.com>
Date: Thu Aug 7 17:41:30 2025 +0200
proxy: avoid exiting connection acceptor loop in error case
The proxy waits for incoming connections passed along from the REST
server inside a loop. If the REST server api_service call however
failed with error, the loop was incorrectly exited. Therefore no
further connections could be accepted.
To fix this, handle the error case gracefully and avoid exiting the
loop.
The error case can be easily triggered by a HAProxy health check
using the following backend config.
```
backend pbs
server pbs <PBS-IP>:8007 check ssl verify none
```
Fixes: https://forum.proxmox.com/threads/169313/
Co-Developed-by: Stefan Hanreich <s.hanreich@proxmox.com>
Signed-off-by: Christian Ebner <c.ebner@proxmox.com>
Tested-by: Stefan Hanreich <s.hanreich@proxmox.com>
Link: https://lore.proxmox.com/20250807154130.130646-1-c.ebner@proxmox.com
commit cf22c2415edc544b8577cc63cf3a903848e47348
Author: Shannon Sterz <s.sterz@proxmox.com>
Date: Thu Aug 7 14:03:09 2025 +0200
ui: opt open id authentication flows into the new http only flow
otherwise the cookie would not be properly set, leading to users
potentially getting logged out instantly again.
Analyzed-by: Mira Limbeck <m.limbeck@proxmox.com>
Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
Tested-by: Maximiliano Sandoval <m.sandoval@proxmox.com>
Tested-by: Mira Limbeck <m.limbeck@proxmox.com>
Link: https://lore.proxmox.com/20250807120308.257071-4-s.sterz@proxmox.com
commit f341bff9b7098fb1610bad0e1e88bddcaa2b55de
Author: Shannon Sterz <s.sterz@proxmox.com>
Date: Thu Aug 7 14:03:08 2025 +0200
api: openid: allow users of openid to opt into the HttpOnly cookies
add a `http-only` api parameter that allows users to opt into the the
HttpOnly cookie based authentication flow. here the server will set a
cookie via a `Set-Cookie` header instead of providing it in the
response's body. this protects users better against cookie stealing
attacks and other similar attacks.
note that this has the side effect of always returning extjs-like
responses here.
Analyzed-by: Mira Limbeck <m.limbeck@proxmox.com>
Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
Tested-by: Maximiliano Sandoval <m.sandoval@proxmox.com>
Tested-by: Mira Limbeck <m.limbeck@proxmox.com>
Link: https://lore.proxmox.com/20250807120308.257071-3-s.sterz@proxmox.com
commit 600299ad53a42b6887ae6d835ede233933111f25
Author: Thomas Lamprecht <t.lamprecht@proxmox.com>
Date: Thu Aug 7 14:45:44 2025 +0200
update proxmox-tfa dependency to 0.6.3
To ensure the complete fix for webauthn AND passkeys, both old and
newly registered, is included.
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
commit 7be9d40db7fabcab1283c86777f03c460d2dce04
Author: Thomas Lamprecht <t.lamprecht@proxmox.com>
Date: Wed Aug 6 19:28:55 2025 +0200
require pbs-api-types 1.0.3 or newer
Just to ensure we match latest s3-client changes w.r.t. impl/api-types
feature.
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
commit b7fade6277919a51712d5ecd6f228b2c2c6712be
Author: Fabian Grünbichler <f.gruenbichler@proxmox.com>
Date: Thu Aug 7 12:10:42 2025 +0200
proxmox-backup-proxy: fix typo in warning message
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
commit f77f908b52c79900a6aef9faadd37252c31e6c96
Author: Fabian Grünbichler <f.gruenbichler@proxmox.com>
Date: Thu Aug 7 12:10:16 2025 +0200
proxmox-backup-proxy: fix formatting
too deeply nested within select! for rustfmt to do this on its own..
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
