1655cf9296
Assert the redirect URLs sent by the OAuth2 handlers
2 weeks ago
b8e17822b1
Include the email in the OAuth2 user resolution log message
2 weeks ago
a6c28e79b9
Allow an underscore in the mobile app callback url scheme
Mobile apps derive the scheme from their package name, which may contain
an underscore. It cannot introduce an authority, so accepting it keeps
the rule as strong as the RFC 3986 grammar.
2 weeks ago
0730387640
Resolve OAuth2 user within the tenant of the OAuth2 client
The user was looked up by email across the whole platform, so a client
belonging to one tenant could resolve a user of another. New users were also
placed in the tenant named by the provider response rather than in the tenant
that owns the client.
Both now follow the client's own tenant. System clients keep the platform-wide
behaviour they rely on.
2 weeks ago
e6ab6871e9
Log rejected prevUri values and share the mail flow constants
A rejected deep link is otherwise invisible to support. AdminController
reuses the prevUri parameter and cookie names instead of its own copies,
and its redirect target moves into a helper so the read side is covered
by a test.
2 weeks ago
1d60693835
Validate the callback url scheme where the redirect is built
The scheme is restored from the oauth2_auth_request cookie, which the
client can replace, so checking it only while the authorization request
is built still let a forged cookie point the token redirect at any host.
Both handlers now re-check it on read, sharing the rule with
OAuth2AppTokenFactory.
The success handler keeps prevUri out of the base URL as well, so the
error redirect no longer appends /login to an in-app path.
2 weeks ago
a0d9ae32b4
Merge pull request #16103 from thingsboard/rc
Merge rc into master
2 weeks ago
d1e0693636
Merge branch 'lts-4.3' into lts-4.4
2 weeks ago
ee64fa1938
Validate mobile app callback url scheme
2 weeks ago
93b4433e6b
Validate prevUri redirect parameter
2 weeks ago
567a48e429
Merge pull request #15917 from ShvaykaD/fix/entity-aggregation-cf-numeric-result
Fixed timeseries entity aggregation calculated field storing numeric results as strings
2 weeks ago
f872e94e39
Merge pull request #16095 from thingsboard/UNSIGNED_INTEGER-values-encoding-for-LwM2M-multi-resources
Fixed handling of LwM2M unsigned integer resources across downlink and uplink operations
2 weeks ago
67c3e1063a
lwm2m: fix_bug UNSIGNED_INTEGER-values-encoding-for-LwM2M-multi-resources
2 weeks ago
5b643851a6
Merge pull request #16092 from thingsboard/rc
Merge rc into master
3 weeks ago
7f467a61fd
Merge pull request #16086 from AndriiLandiak/fix-compile
EdgeGrpcService sync with lts-4.3
3 weeks ago
d2bfea1e75
Align edge disconnect notification debounce with lts-4.3
3 weeks ago
f4f6900d0e
Fix compile on EdgeConnectionNotificationTest
3 weeks ago
f02ce66150
Merge pull request #16084 from thingsboard/rc
Merge rc into master
3 weeks ago
96794a3206
Merge branch 'lts-4.3' into lts-4.4
3 weeks ago
52feea3326
Merge remote-tracking branch 'origin/lts-4.2' into lts-4.3
3 weeks ago
33e49cb9bf
Merge pull request #16083 from AndriiLandiak/merge-with-lts4.3
Merge with lts4.3
3 weeks ago
c2e7a9f12a
Merge pull request #15910 from ShvaykaD/bugfix/subscription-skip-deleted-tenant
Skip subscription forwarding when tenant no longer exists
3 weeks ago
3b078f44bf
Merge remote-tracking branch 'upstream/lts-4.3' into merge-with-lts4.3
3 weeks ago
b8f7ce262d
Merge remote-tracking branch 'origin/lts-4.2' into lts-4.3
3 weeks ago
66d8af91b1
Merge pull request #16038 from AndriiLandiak/fix/align-on-configuration-update-guard-lts-4.3
Compare edge customer before session state is replaced in onConfigurationUpdate
3 weeks ago
5d7287abd4
Merge pull request #16043 from AndriiLandiak/fix/sync-not-stranded-on-fetcher-failure-lts-4.3
Do not strand edge sync when an event fetcher fails
3 weeks ago
32742a3c38
Merge pull request #16044 from AndriiLandiak/fix/sync-not-stranded-on-fetcher-failure-lts-4.2
Do not strand edge sync when an event fetcher fails
3 weeks ago
0a30dc00d5
Merge pull request #16037 from AndriiLandiak/fix/sync-not-stranded-on-fetcher-failure
Do not strand edge sync when an event fetcher fails
3 weeks ago
db7efabd9d
Merge pull request #15733 from AndriiLandiak/fix-edge-notifications-4.3
Prevent disconnect notification spam from flapping edges
3 weeks ago
5eefbc8215
Merge branch 'lts-4.3' into lts-4.4
3 weeks ago
612b424e0f
Merge remote-tracking branch 'origin/lts-4.2' into lts-4.3
3 weeks ago
d68ba27187
Merge pull request #15962 from thingsboard/lwm2m_fix_bug_Negative_Integer_values
Fixed negative values encoding for LwM2M Integer resources
3 weeks ago
36e818718b
Merge pull request #16026 from MazurenkoNick/fix/edge-uplink-connectivity-gate
Fix uplink stall and off-heap memory growth after cloud disconnect (edge-side copy to CE)
3 weeks ago
5787101beb
Merge pull request #16081 from thingsboard/rc
Merge rc into master
3 weeks ago
55b81b88b7
Merge remote-tracking branch 'origin/lts-4.3' into bump/lts-4.4
# Conflicts:
# application/pom.xml
# common/actor/pom.xml
# common/cache/pom.xml
# common/cluster-api/pom.xml
# common/coap-server/pom.xml
# common/dao-api/pom.xml
# common/data/pom.xml
# common/discovery-api/pom.xml
# common/edge-api/pom.xml
# common/edge-api/src/main/proto/edge.proto
# common/edqs/pom.xml
# common/message/pom.xml
# common/pom.xml
# common/proto/pom.xml
# common/queue/pom.xml
# common/script/pom.xml
# common/script/remote-js-client/pom.xml
# common/script/script-api/pom.xml
# common/stats/pom.xml
# common/transport/coap/pom.xml
# common/transport/http/pom.xml
# common/transport/lwm2m/pom.xml
# common/transport/mqtt/pom.xml
# common/transport/pom.xml
# common/transport/snmp/pom.xml
# common/transport/transport-api/pom.xml
# common/util/pom.xml
# common/version-control/pom.xml
# dao/pom.xml
# edqs/pom.xml
# monitoring/pom.xml
# msa/black-box-tests/pom.xml
# msa/edqs/pom.xml
# msa/js-executor/package.json
# msa/js-executor/pom.xml
# msa/monitoring/pom.xml
# msa/pom.xml
# msa/tb-node/pom.xml
# msa/tb/pom.xml
# msa/transport/coap/pom.xml
# msa/transport/http/pom.xml
# msa/transport/lwm2m/pom.xml
# msa/transport/mqtt/pom.xml
# msa/transport/pom.xml
# msa/transport/snmp/pom.xml
# msa/vc-executor-docker/pom.xml
# msa/vc-executor/pom.xml
# msa/web-ui/package.json
# msa/web-ui/pom.xml
# netty-mqtt/pom.xml
# pom.xml
# rest-client/pom.xml
# rule-engine/pom.xml
# rule-engine/rule-engine-api/pom.xml
# rule-engine/rule-engine-components/pom.xml
# tools/pom.xml
# transport/coap/pom.xml
# transport/http/pom.xml
# transport/lwm2m/pom.xml
# transport/mqtt/pom.xml
# transport/pom.xml
# transport/snmp/pom.xml
# ui-ngx/package.json
# ui-ngx/pom.xml
3 weeks ago
be29e95d84
Version set to 4.3.1.5-SNAPSHOT
3 weeks ago
dee257ad0d
Merge remote-tracking branch 'origin/lts-4.2' into bump/lts-4.3
# Conflicts:
# application/pom.xml
# common/actor/pom.xml
# common/cache/pom.xml
# common/cluster-api/pom.xml
# common/coap-server/pom.xml
# common/dao-api/pom.xml
# common/data/pom.xml
# common/discovery-api/pom.xml
# common/edge-api/pom.xml
# common/edge-api/src/main/proto/edge.proto
# common/edqs/pom.xml
# common/message/pom.xml
# common/pom.xml
# common/proto/pom.xml
# common/queue/pom.xml
# common/script/pom.xml
# common/script/remote-js-client/pom.xml
# common/script/script-api/pom.xml
# common/stats/pom.xml
# common/transport/coap/pom.xml
# common/transport/http/pom.xml
# common/transport/lwm2m/pom.xml
# common/transport/mqtt/pom.xml
# common/transport/pom.xml
# common/transport/snmp/pom.xml
# common/transport/transport-api/pom.xml
# common/util/pom.xml
# common/version-control/pom.xml
# dao/pom.xml
# edqs/pom.xml
# monitoring/pom.xml
# msa/black-box-tests/pom.xml
# msa/edqs/pom.xml
# msa/js-executor/package.json
# msa/js-executor/pom.xml
# msa/monitoring/pom.xml
# msa/pom.xml
# msa/tb-node/pom.xml
# msa/tb/pom.xml
# msa/transport/coap/pom.xml
# msa/transport/http/pom.xml
# msa/transport/lwm2m/pom.xml
# msa/transport/mqtt/pom.xml
# msa/transport/pom.xml
# msa/transport/snmp/pom.xml
# msa/vc-executor-docker/pom.xml
# msa/vc-executor/pom.xml
# msa/web-ui/package.json
# msa/web-ui/pom.xml
# netty-mqtt/pom.xml
# pom.xml
# rest-client/pom.xml
# rule-engine/pom.xml
# rule-engine/rule-engine-api/pom.xml
# rule-engine/rule-engine-components/pom.xml
# tools/pom.xml
# transport/coap/pom.xml
# transport/http/pom.xml
# transport/lwm2m/pom.xml
# transport/mqtt/pom.xml
# transport/pom.xml
# transport/snmp/pom.xml
# ui-ngx/package.json
# ui-ngx/pom.xml
3 weeks ago
0f42f09287
Version set to 4.2.2.5-SNAPSHOT
3 weeks ago
b0d8199dfb
sparkplug: fix_bug NDATA/DDATA metricName is empty if only alias
3 weeks ago
c8e780baa7
Merge pull request #16061 from thingsboard/rc
Merge rc into master
3 weeks ago
daa54744da
Merge branch 'lts-4.3' into lts-4.4
3 weeks ago
895a1145d4
Merge remote-tracking branch 'upstream/lts-4.2' into lts-4.3
3 weeks ago
62d4c017ec
Merge pull request #16058 from thingsboard/fix/cves-lts-4.3
Fixed CVE-2026-59902, CVE-2026-59903, CVE-2026-62243, CVE-2026-63337, CVE-2026-69219, CVE-2026-69220, CVE-2026-75595
3 weeks ago
b8058cfcdb
Merge pull request #16059 from thingsboard/fix/cves-lts-4.4
Fixed CVE-2026-59902, CVE-2026-59903, CVE-2026-62243, CVE-2026-63337, CVE-2026-69219, CVE-2026-69220, CVE-2026-75595
3 weeks ago
00f4c71a62
Merge pull request #16060 from thingsboard/fix/cves-master
Fixed CVE-2026-59902, CVE-2026-59903, CVE-2026-62243, CVE-2026-63337, CVE-2026-69219, CVE-2026-69220, CVE-2026-75595
3 weeks ago
6431a4e4cd
Merge pull request #16057 from thingsboard/fix/cves-lts-4.2
Fixed CVE-2026-59902, CVE-2026-59903, CVE-2026-62243, CVE-2026-63337, CVE-2026-69219, CVE-2026-69220, CVE-2026-75595
3 weeks ago
fa7fb5563e
Merge fix/cves-lts-4.4 into fix/cves-master
3 weeks ago
2658d963d4
Merge fix/cves-lts-4.3 into fix/cves-lts-4.4
3 weeks ago
2a84d64466
Merge fix/cves-lts-4.2 into fix/cves-lts-4.3
3 weeks ago
193fb25ec9
Bump com.rabbitmq:amqp-client from 5.25.0 to 5.33.1 to fix CVE-2026-63337, CVE-2026-69219, and CVE-2026-69220
3 weeks ago
Viacheslav Klimov
nickAS21
Andrii Landiak
Vladyslav Prykhodko
Vladyslav_Prykhodko