Added

• Ability to override Authorization: Basic header and replace with credentials specified in config.json fixes #243. New config.json option user.overridebasic

Added

• Lookup ip address for hostname in URL, fixes #199 thanks to @zwiy

BREAKING

• Disabled ssh.serverlog.client option, this disables the POC which allowed for logging of the data sent between the client/server to the console.log. Code still exists but is commented out in roughly lines 103-116 of ./app/server/socket.js

Changes

• Removed HTML menu code from ./app/server/socket.js, the menu is now fully laid out in the ./app/client/src/index.html and the option elements are hidden by default. Not sure why it wasn't done this way from the start, but there it is.
• Updated socket.io to v4.1.1
• Build environment changes
  • removed unused xterm-addon-search, xterm-addon-weblinks, standard, postcss-discard-comments
  • added prettier 2.3.0, typescript modules, socket.io-client 4.1.1, airbnb linting tools

CONTRIBUTING

In this release, we're trying our best to conform to the Airbnb Javascript Style Guide. I'm hoping this will make contributions easier and keep the code readable. I love shortcuts more than anyone but I've found when making changes to code I've not looked at in a while, it can take me a few momements to deconstruct what was being done due to readbility issues. While I don't agree with every decision in the style guide (semi-colons, yuk), it is a good base to keep the code consistent.

If you've not used it before, I recommend installing the vscode extensions for that and Prettier and getting familiar. The autocorrections are great (especially if you hate dealing with semi-colons...)

As of 0.4.0-testing-0, the client code is written in TypeScript. It's not that much different from JavaScript, and the introduction strong typing will ultimately help to produce better code. Eventually we want to move the whole project to TypeScript but that make take a bit more time. Take a moment to look at ./app/client/src/js/index.ts to see what TypeScript looks like.

Last legacy supported version

This version should be the last one to support less than node 10. When possible we will continue to update the 0.3.x branch, however it's becoming increasingly difficult to maintain compatibility as most modules are moving past supporting these older versions.

Please note the build environment requires at least node 10 to work properly.

BREAKING

• Ability to configure CORS settings for socket.io see #240 for more information on how this may break existing deployments. Default settings in example config.json are currently permissive http.origins: ["*:*"] please note that if a config.json is not present, the default is `http.origins: ["localhost:2222"]

Added

• Safe Shutdown Feature - thanks to @edgarogh
  • Sending SIGINT or SIGTERM to node process responsible for WebSSH2 or Docker process will result in a "safe" shutdown
  • Timer is configured in config.safeShutdownDuration
• feat: Use docker build to create multi-arch images (#202)

Fixed

• obey host ssh.host in config fixes #190

Changed

• config.json.sample: allowreauth now defaults to false fixes #238
• update ssh2 to 0.8.8 -> 0.8.9 - comparison at ssh2 repo
• update xterm to 4.12.0 comparsion at xtermjs repo
• update read-config-ng to 3.0.2
• update morgan to 1.10.0
• update debug to 4.3.1
• update express-session to 1.17.1
• update validator to 13.6.0
• development tools updates (build environment requires minimum of Node 10, only needed for customization)
  • update @fortawesome/fontawesome-svg-core to 1.2.35
  • update @fortawesome/free-solid-svg-icons to 5.15.3
  • update copy-webpack-plugin to 8.1.1
  • update cross-env to 7.0.3
  • update css-loader to 5.2.4
  • update file-loader to 6.2.0
  • update mini-css-extract-plugin to 1.6.0
  • update postcss-discard-comments to 5.0.0
  • update snazzy to 9.0.0
  • update standard to 16.0.3
  • update standard-version to 9.3.0
  • update style-loader to 2.0.0
  • update terser-webpack-plugin to 5.1.1
  • update url-loader to 4.1.1
  • update webpack to 5.37.0
  • update webpack-cli to 4.7.0
  • update webpack-merge to 5.7.3
  • update webpack-stream to 6.1.2
  • update xterm-addon-fit to 0.5.0
  • update xterm-addon-search to 0.8.0
  • update xterm-addon-web-links to 0.4.0
  • update ssri from 6.0.1 to 6.0.2 #233
  • update hosted-git-info from 2.8.5 to 2.8.9 #237
  • update lodash from 4.17.19 to 4.17.21 #236
  • update handlebars from 4.7.6 to 4.7.7 #235
  • update y18n from 4.0.0 to 4.0.1 #230
  • update elliptic from 6.5.3 to 6.5.4 #228
  • update ini from 1.3.5 to 1.3.8 #217

BREAKING

• Ability to configure CORS settings for socket.io see #240 for more information on how this may break exisiting deployments

Fixed

• obey host ssh.host in config fixes #190

Changed

• config.json.sample: allowreauth now defaults to false fixes #238
• update ssh2 to 0.8.9
• update read-config-ng to 3.0.2
• update morgan to 1.10.0
• update debug to 4.3.1
• update express-session to 1.17.1
• update validator to 13.6.0
• development tools updates
  • update @fortawesome/fontawesome-svg-core to 1.2.35
  • update @fortawesome/free-solid-svg-icons to 5.15.3
  • update copy-webpack-plugin to 8.1.1
  • update cross-env to 7.0.3
  • update css-loader to 5.2.4
  • update file-loader to 6.2.0
  • update mini-css-extract-plugin to 1.6.0
  • update postcss-discard-comments to 5.0.0
  • update snazzy to 9.0.0
  • update standard to 16.0.3
  • update standard-version to 9.3.0
  • update style-loader to 2.0.0
  • update terser-webpack-plugin to 5.1.1
  • update url-loader to 4.1.1
  • update webpack to 5.37.0
  • update webpack-cli to 4.7.0
  • update webpack-merge to 5.7.3
  • update webpack-stream to 6.1.2
  • update xterm to 4.12.0
  • update xterm-addon-fit to 0.5.0
  • update xterm-addon-search to 0.8.0
  • update xterm-addon-web-links to 0.4.0
  • build(deps): bump ssri from 6.0.1 to 6.0.2 in /app (#233)
  • build(deps): bump hosted-git-info from 2.8.5 to 2.8.9 in /app (#237)
  • build(deps): bump lodash from 4.17.19 to 4.17.21 in /app (#236)
  • build(deps): bump handlebars from 4.7.6 to 4.7.7 in /app (#235)
  • build(deps): bump y18n from 4.0.0 to 4.0.1 in /app (#230)
  • build(deps): bump elliptic from 6.5.3 to 6.5.4 in /app (#228)
  • build(deps): bump ini from 1.3.5 to 1.3.8 in /app (#217)

Added

• feat: Use docker build to create multi-arch images (#202)

Added

• Safe Shutdown Feature - thanks to @edgarogh
  • Sending SIGINT or SIGTERM to node process responsible for WebSSH2 or Docker process will result in a "safe" shutdown
  • Timer is configured in config.safeShutdownDuration

Added

• Add configuration option to restrict connections to specified subnets thanks to @Mierdin
• favicon
  • added module serve-favicon to serve favicon from root if pre-fetched by browser
  • added link rel=icon line in client.htm to serve favico.ico out of /ssh/

Changed

• removed express compression feature, added no real value.
• module updates
  • ssh2 to 0.8.6 -> 0.8.8 - comparison at ssh2 repo
  • xterm 4.2.0 -> 4.4.0 - comparison at xtermjs repo
  • read-config-ng 3.0.1 - (taking over abandoned repo)n
• development module updates (does not impact production, only for development and rebuilding)
  • fortawesome/fontawesome-svg-core 1.2.27
  • fortawesome/free-solid-svg-icons 5.12.1
  • standard-version 7.1.0
  • webpack 4.42.0
    • webpack-cli 3.3.11
    • terser-webpack-plugin 2.3.5
    • copy-webpack-plugin 5.1.1
    • cross-env 7.0.2
    • css-loader 3.4.2
    • file-loader 5.1.0
    • style-loader 1.1.3
    • url-loader 3.0.0

Potentially Breaking Changes

• Move all child resources to start from under /ssh
  • /socket.io -> /ssh/socket.io
  • /webssh2.css -> /ssh/webssh2.css
  • /webssh2.bundle.js -> /ssh/webssh2.bundle.js
  • /reauth -> /ssh/reauth
  • perhaps more

Fixes

• Typo in config.json.sample, thanks @wuchihsu, fixes #173

Housekeeping

• Removed irrelavant build scripts from /scripts

Testing for ssh subnet restrictions

Changes

• Missing require('fs') in server/app.js See issue #135
• Patched read-config to mitigate vulnerability in js-yaml
  • issue not exploitable on webssh2 implementation
  • patched anyway
  • sending my patch upstream to read-config, webssh2 package.json points to patched version in my repository https://github.com/billchurch/nodejs-read-config
  • See https://github.com/nodeca/js-yaml/issues/475 for more detail

Changes

• Fixes issue if no password is entered, browser must be closed and restart to attempt to re-auth. See issue #118. Thanks @smilesm2 for the idea.
• fixes broken npm run (build|builddev)
  • update font-awesome fonts to 5.6.3
  • update webpack and dependancies
  • update xterm to 3.8.0

Fixes

• ILX workspace may not always import properly due to symbolic links (specifically ./node_modules/.bin). This is removed from the ILX package