b5b6425520
Merge remote-tracking branch 'origin/lts-4.3' into rc
7 months ago
628defac14
Merge pull request #15308 from irynamatveieva/lts-4.3-fix/cf-cache-tenant-filtering
Fix calculated field cache to filter by tenant
7 months ago
0e8995eb93
revert tenant filtering except for type-based lookup
7 months ago
663fded846
Merge branch 'lts-4.2-fix/cf-cache-tenant-filtering' into lts-4.3-fix/cf-cache-tenant-filtering
7 months ago
5b94f14096
Fix calculated field cache to filter by tenant
7 months ago
2469d97e0d
Merge remote-tracking branch 'upstream/lts-4.3' into rc
7 months ago
697a31af7a
Merge remote-tracking branch 'upstream/lts-4.2' into lts-4.3
# Conflicts:
# ui-ngx/src/app/shared/components/string-items-list.component.html
# ui-ngx/src/app/shared/components/string-items-list.component.ts
7 months ago
411b600183
Merge pull request #15273 from vvlladd28/fix/string-items-list-autocomplete
Fixed string-items-list autocomplete selection and blur handling
7 months ago
00e35f745e
Fix proxy error handling for 502/503/504 HTTP status codes
Move 504 handling from interceptor to parseHttpErrorMessage, add
user-friendly messages for 502/503/504 via httpStatusMessageMap,
and scope isProxyError to only match proxy status codes to avoid
breaking error handling for other HTTP errors.
7 months ago
46ef7c51a0
Fixed CVE-2026-33228
7 months ago
7c6fa8e99b
Merge pull request #15267 from mtsymbarov-del/fix/timeseries-tab-styles
Fixed time series table widgets tab style
7 months ago
d6e71eb913
Merge remote-tracking branch 'origin/lts-4.3' into rc
7 months ago
1e8927164c
Merge remote-tracking branch 'origin/lts-4.2' into lts-4.3
7 months ago
665887c517
Merge pull request #15278 from thingsboard/fix/cves
Fixed CVE-2026-22731, CVE-2026-22732, CVE-2026-22733, CVE-2026-22737 + Spring Boot 3.5
7 months ago
0b72297916
Restore lombok.version property required by maven-compiler-plugin annotationProcessorPaths
7 months ago
9dcb6d53bf
Update lombok from 1.18.38 to 1.18.44 managed by Spring Boot 3.5.12
7 months ago
caffeb7ce8
Update jedis from 5.1.5 to 6.0.0 and snakeyaml from 2.2 to 2.4 for Spring Boot 3.5.12 compatibility
7 months ago
7646f79cfe
Implement addBundleRegisterHandler for Spring Boot 3.5 SslBundles compatibility
7 months ago
0eabe6ce46
Fix CVE-2026-22731, CVE-2026-22732, CVE-2026-22733, CVE-2026-22737
7 months ago
93bc81e5b8
UI: Use explicit null check in onOptionSelected to handle falsy values
Truthiness check on event.option.value would incorrectly route to
clear() for valid falsy values like 0 or "". Use != null instead.
7 months ago
66d263f81b
UI: Fix string-items-list autocomplete selection and blur handling
Replace addOnBlur with matChipInputAddOnBlur directive and dedicated onOptionSelected handler for proper autocomplete behavior. Prevent mousedown default on options to avoid premature blur, and conditionally hide "not found" when user values are allowed.
7 months ago
b3a6eab79e
Additional fixes
7 months ago
da23c7c777
Improved styles fot time series table bars
7 months ago
2ed9ed2ff5
Merge remote-tracking branch 'origin/lts-4.3' into rc
7 months ago
59873373cc
Merge remote-tracking branch 'origin/lts-4.2' into lts-4.3
7 months ago
95d2e77c82
UI: Fixed yarn.lock
7 months ago
c2ff92772e
Merge pull request #15266 from thingsboard/fix-csp-example
Set default value for Content-Security-Policy
7 months ago
02529029c5
Update default CSP value covering core ThingsBoard functionality
7 months ago
628fe04032
Make SsrfProtectionValidator-dependent tests more stable
7 months ago
de0c2850f7
Fix CSP example value to include img-src and font-src directives
8 months ago
061b997457
Fixed resetting of validation on storeLink property
8 months ago
a69e5f0132
Merge remote-tracking branch 'origin/lts-4.3' into rc
8 months ago
b984cf16c9
Merge remote-tracking branch 'origin/lts-4.2' into lts-4.3
# Conflicts:
# application/src/main/java/org/thingsboard/server/exception/ThingsboardErrorResponseHandler.java
8 months ago
5f93a5a0a2
Merge pull request #15262 from thingsboard/fix/verbose-error-messages
Sanitize database error messages
8 months ago
688a1d52b3
Sanitize database error messages
Route DataAccessException and PersistenceException (including bare
ConstraintViolationException) to a unified handler that extracts the
constraint name and returns "Constraint violation: <name>" instead of
the raw PSQLException message. Other DB errors continue to return the
generic "Database error" response.
Adds DaoUtil.extractConstraintViolation helper and an integration test
that verifies no SQL details leak when an FK constraint is violated.
8 months ago
934d742cc6
Fix missing translation for Polylines toggle in map settings
Replace hardcoded "Polylines" text with existing i18n key
widgets.maps.overlays.polylines to match other overlay toggles.
Fixes #15234
8 months ago
a8ac27f17b
Merge remote-tracking branch 'origin/lts-4.3' into rc
8 months ago
c057da1734
Merge remote-tracking branch 'origin/lts-4.2' into lts-4.3
# Conflicts:
# application/src/main/java/org/thingsboard/server/config/ThingsboardSecurityConfiguration.java
8 months ago
4f7e232ee7
Merge pull request #15251 from vvlladd28/fix/vulnerability/16-03-26
Fixed CVE-2026-24281, CVE-2026-24308, CVE-2026-24400, CVE-2026-29063, CVE-2026-29087, CVE-2026-29786, CVE-2026-30827, CVE-2026-31802, CVE-2026-32141, CVE-2026-32635, CVE-2026-27904
8 months ago
2a3ac2972b
Merge pull request #15219 from vvlladd28/fix/ws-reconnect-backoff-rate-limit
Fixed WS reconnect loop and notification spam when session limit is reached
8 months ago
5f56345722
Merge pull request #15253 from thingsboard/fix/ssrf
Fixed SSRF DNS rebinding bypass, added allow-list
8 months ago
d83a28beaa
Optimize SsrfSafeAddressResolverGroup, remove dead isEnabled checks
Replace stream().filter().collect() in resolveAll with single-pass loop
to avoid allocations on the common path (nothing blocked). Remove
redundant isEnabled() checks inside the resolver since it is only wired
when SSRF protection is enabled. Add resolveAll test coverage.
8 months ago
959a1a84a4
Make SSRF resolver conditional, sanitize error messages, improve test coverage
Wire SsrfSafeAddressResolverGroup only when SSRF protection is enabled.
Remove "SSRF protection" prefix from error messages to avoid exposing
internal security mechanisms to users. Add 11 new tests covering
isHostnameAllowed, one-arg validateUri, allow-list case-insensitivity,
cloud metadata/loopback overrides, CIDR boundaries, IPv6 unique local,
whitespace parsing, allow-list replacement, and blocked hostname override.
8 months ago
3747553527
Improve SSRF validator test coverage
Add tests for: isHostnameAllowed API, one-arg validateUri overload,
allow-list case-insensitivity, allow-list overriding cloud metadata and
loopback ranges, CIDR boundary conditions, IPv6 unique local (fc00::/7),
whitespace/blank entry parsing, allow-list replacement, and allow-listing
blocked hostnames like localhost.
8 months ago
5d7bfe4ee1
Merge pull request #15254 from thingsboard/fix/cors
Added configurable security headers and env-var-backed CORS configuration
8 months ago
61bccb005a
Restore runtime SSRF validation in CustomOAuth2ClientMapper
Keep both save-time validation (Oauth2ClientDataValidator) and runtime
re-validation as defense-in-depth: DNS records can change between config
save and OAuth2 login, creating a TOCTOU gap.
8 months ago
014c612bf1
Fix boolean/string comparison for env var overrides in web-ui security headers
8 months ago
493140f1b2
Remove dead else branch in web-ui security headers config
8 months ago
c1dd327b47
Add description comments for security headers properties in thingsboard.yml
8 months ago
3a765209ff
Address PR review comments
- Use kebab-case 'report-only' in web-ui configs to match thingsboard.yml
- Add log.warn for unrecognized X-Frame-Options values in customizer
- Replace @Configuration with @Component on HttpSecurityHeadersProperties
- Add comment explaining '!== false' vs truthiness pattern in server.ts
8 months ago
Viacheslav Klimov
IrynaMatveieva
Vladyslav Prykhodko
Vladyslav Prykhodko
Maksym Tsymbarov