All notable changes, security fixes, database migration updates, and UI improvements for PowerDNS-Admin are documented in this file. Format follows Keep a Changelog.
Comprehensive maintenance, security hardening, database migration idempotency, UI/UX redesign, and Python 3.12+/3.13 compatibility release — built on top of
0.4.2-alsyundawy-fix.
lib/helper.py)
verify = False with dynamic setting Setting().get('verify_ssl_connections').models/user.py & Migration d2e3f4a5b6c7)
otp_last_used tracking; prevents replay attacks within validity windows.decorators.py / routes/api.py)
api_current_user (LocalProxy) resolves strictly to request-scoped credentials; session cookies cannot override API Basic Auth identity.routes/index.py & routes/base.py)
403 errors.routes/domain.py)
HTTP 502); DNSSEC flags only mutate after successful API operations.routes/admin.py)
@operator_role_required guard added to /template/<template>/apply.models/role.py & models/user.py)
Role.get_id_by_name(name) auto-seeds default roles (User, Administrator, Operator) if missing; eliminates AttributeError on fresh deployments.migrations/env.py & versions/787bdba9e147_init_db.py)
787bdba9e147_init_db.py checks table existence before CREATE TABLE account.env.py auto-stamps alembic_version to head (d2e3f4a5b6c7) on pre-created schemas, eliminating table ... already exists deployment errors.powerdnsadmin/__init__.py & models/sessions.py)
SESSION_SQLALCHEMY = models.db bound before Session(app); Sessions model uses extend_existing = True.routes/index.py) — authenticate_user() now correctly redirects to dashboard.dashboard on success.routes/index.py) — Registration skips CAPTCHA when CAPTCHA_ENABLE = False.powerdnsadmin/__init__.py & base.html) — inject_pdns_version registered globally; prevents TypeError across all dashboard sub-menus.base.html & 1base.html) — Updated to Version 0.4.3 Modified By Alsyundawy.lib/utils.py) — fetch_remote no longer drops caller-supplied headers (e.g., X-API-Key).models/domain.py) — isinstance(jdata, dict) guard added on delete_dnssec_key responses.routes/index.py) — Fixed checks to use ascii_lowercase, ascii_uppercase, and punctuation.register.html)
sr-only screen-reader labels for all form controls and a honeypot anti-bot field for improved accessibility and security.auth_method Form Control (login.html)
name="auth_method" from <select> and all Jinja2 conditional hidden inputs. Replaced with a single <input type="hidden" id="auth_method_hidden" name="auth_method"> synced via JS on page-load and change events.login.html & register.html)
#ffffff with rgba(239,68,68,0.20) background, meeting contrast ratio ≥ 4.5:1.safeSrc() Exception Handling (login.html & register.html)
void urlErr; added inside catch (urlErr) to satisfy linter rule “Handle this exception or don’t catch it at all”.distutils with version_tuple/strtobool helpers; deprecated imghdr replaced with magic-byte image type signatures..github/workflows/jekyll-gh-pages.yml for automated documentation site deployment.for-the-badge primary, flat-square secondary), documentation resource table, and full changelog summary.Frontend security and template hardening release by @alsyundawy.
bcbb7660.4.2-alsyundawy...0.4.2-alsyundawy-fix6login.html, 7login.html, 8login.html)
safeSrc logo handling to validate light-theme logo URLs and prevent invalid source attributes.nonce="" to script tags.javascript: / data: URI injection.Comprehensive security release, CodeQL scanning alert remediations, and RFC2317 compliance by @alsyundawy.
789c1850.4.2...0.4.2-alsyundawycryptography: 45.0.5 → 46.0.5 → 48.0.1 → 50.0.0 (#19, #25, #28)pyasn1: 0.6.2 → 0.6.4 (#26)setuptools: 80.9.0 → 83.0.0 (#27)Official upstream release from PowerDNS-Admin.
postgresql:// (not postgres://).