The server can list this deployment's site signing keys: GET /escrow/site-keys returns the current site key and the previous site keys it still accepts, to anyone with the permission to read escrow public keys
The server tells the web app that it supports VM access rules, so the web app can offer them
A Libvirt host can keep a list of MAC addresses and whether that list is exclusive. The host's details show them, and editing the host keeps them unless they are changed
A VM configuration's MAC address can be removed; before, once set it could only be replaced
Libvirt images can record their clock offset and OS type next to the disk bus type, and deep clones of an image keep all three
Anyone who can see a user now also sees that user's last login; before, only admins and the user saw it
Only Super-admins skip permission checks. Admins now need the matching permission to manage teams and their members, change a group's owner, members or member permissions, list all groups, send, read or delete VM messages, manage the Slurm accounts of VM configurations, list a storage pool's contents, see every SFTP server and remove a user's expiration date; before, the Admin role alone was enough
Deactivating an account ends all of the user's sessions at once and logs out their open web app tabs, including the sessions of their VMs and inbox uploads. This applies when an admin deactivates the account, to temporary deactivations, to accounts locked by the expiry or inactivity checks or for HTML injection, and to accounts disabled with an API token. Before, a deactivated user kept working until they logged out
Changing a user's role, permissions or account state, or deleting the account, ends the user's open sessions, so they log in again with their new rights. Inbox upload sessions are kept when only the role or permissions change, and removing a user from a project takes that project out of their open sessions. Before, open sessions kept the old rights until they expired
VMs, temporary sessions and inbox uploads can no longer log in for an account that is inactive or temporarily deactivated, and a login that is under way when the account is locked fails
A sub-session or a downgraded session can no longer be Super-admin or have a higher role than the session it comes from, and a Super-admin's sub-session is Admin unless a lower role is asked for. Before, any session allowed to create sub-sessions could create a Super-admin one
An API token stops working once it expires, or once its owner is deleted, deactivated or no longer a Super-admin; before, it kept working
Only Super-admins can read the authentication service's configuration file, as with the other services; before, any logged-in user could
Changing a user's expiration date, external-user flag or settings needs the permission to modify users and a higher role than that user, and changing "never escrow" needs the permission to require escrow. Super-admins can change anyone
Changing or removing a project member needs the same rights as adding one: an Admin, or a Sub-admin who manages the project or a parent project. Project managers whose role is User can no longer change or remove members, as they already could not add them
Sub-admins can create sub-projects only under projects they manage, and delete only the projects and teams they manage
A team's vault usage is shown only to users who may see every team, or who may see teams and belong to that team; before, any logged-in user could read any team's usage
Only a file's owner can change its flags or resize it; before, anyone with access to its project could
Reading a directory's details, entries or key owners, or listing it recursively, needs read access to the directory, and to the project for project directories. A group's root directory is found or created only for members of the group, and linking or moving into a directory needs read access to it. Before, the permission to see directory info was enough
A VM's history is shown only to people who can see or manage the VM, and to Admins and Super-admins. A VM configuration's history is shown only to people who can see the configuration, to Super-admins and to those allowed to list every VM configuration. Before, the history permissions alone opened every VM's and configuration's history
Notifications whose text contains HTML markup are refused
Searching notifications by sender or recipient matches the text as typed; before, it was read as a regular expression
The leftovers of the backup and storage services, retired in 3.9.9, are removed: the backup routes, their status, configuration and restart entries, and the backup and file transfer cleanup tasks. Their sections in ticrypt-maintenance.conf are no longer read
Upgrading ticrypt-common stops, disables and removes the retired ticrypt-backup and ticrypt-storage packages if they are still installed; before, they stayed installed and kept Java 8 required
The unused route that converted a drive to another disk format is removed
Moving a drive to another storage pool with the TICP copier finishes and shows its progress in the transfer list, instead of staying "Transferring" forever. Copy requests sent in a large burst are retried instead of dropped
A VM configuration's "Last launched" date is updated every time a VM is started from it
The web app receives task progress and task finished updates again, so it reports when a VM image deep clone finishes or fails
Task and notification updates sent while the web app is reconnecting are delivered when it reconnects, instead of being lost
If the notifications service's worker stops, the service restarts instead of silently dropping notifications
The server no longer keeps a notification connection for every user, VM or device that ever connected, which slowed notifications down the longer it ran
Ending a sub-session no longer logs the browser out of its own session
Setting file flags and file key flags works when the web app is served from another address than the server
The login error for a temporarily deactivated account shows the real end date instead of 2017-01-23
A drive tagged with a project can no longer be attached read-write to a VM that has no project
An expired project membership no longer counts when checking who may manage a project or request its declassification
A VM can send, read and delete only its own messages, not those of its owner's other VMs
Reading a VM configuration's Slurm account needs access to the configuration, and refreshing every host's storage pools needs the permission to update storage pools; before, any logged-in user could do both
Sub-admins and users who may see all vault usage no longer get every user's usage when they name no users; they get their managed users, or only themselves
Text with an unclosed "<" or "{{" no longer slows the server's HTML check down; a long crafted request could tie up the server's CPU
Turning on "never escrow" deletes the user's escrowed keys only once the change is saved, and a failure to delete them is reported
Expired escrow recovery keys are now pruned on schedule; the prune always failed before, and one failed removal no longer stops the others
"Shared with me" lists the files others shared even when the user has many files of their own; before, the user's own files could fill the list's limit
A realm check no longer detaches the drives of VMs it did not check, and a drive with several readers becomes ready only after its last reader is removed
Moving bricks to another Libvirt image in bulk applies the new image's disk bus type, so a VirtIO setting left over from the old image no longer keeps a SCSI image from booting. The image's clock offset and OS type are applied when it sets them
Deleting a team after an earlier attempt failed halfway removes its leftover memberships
The server status reports a service that is not running as down, instead of failing to load
The HTML sanitizer library is updated to a version that fixes CVE-2021-42575
