This PR adds masking to remote sources so the passwords are not leaked to the browser. The logic works the same as for TargetURL, where the sensitive fields are replaced by a password placeholder before being transmitted via the endpoints.
When data returns, the masking is removed by looking at the original source and the unmasked value is then encrypted before being stored in the database.
Since the sources is an array and not just a single field, the logic here uses the mount point as a "key" for figuring out which new sources map to the original sources. This is robust in the face of re-ordering, deletions and additions.
If there is just a single remote source (assumed most common) this will match even if the prefix does not, making it possible to change the prefix in this case.
For multi-remote sources, it is not possible to change the prefix without also re-typing all masked properties.
If there is a need later, we could extend the matching to look for how many unique protocols are there, and maybe servers as well to try to match better when the prefixes have been renamed.
There is a guard right before saving a source that rejects it if the source contains the placeholder so we ensure that even faulty logic cannot persist an invalid connection string.
This adds a connection string repo, where connection strings can be stored.
The general idea is that it is possible to store connection strings, say an S3 connection, and then re-use the connection string for multiple backups, editing as needed.
The implementation supports listing connection strings, creating, updating, and deleting them.
The connection strings are masked so sensitive information is not available in the browser, and the logic patches connection strings internally to ensure markers are replaced with the correct values.
The connection string itself is stored in full, such that a Duplicati version roll-back will not make the connectionstring become invalid.
There is also an endpoint that allows updating existing backups using the connection string, so it is easy to rotate keys. The logic for this feature is that it retains: scheme, port, host, path, and any extra settings on the target url.
It does not remove settings from the target, but will overwrite or add settings from the connectionstring.
When updating the server settings, the server would not emit the new settings on save, causing the UI to be inconsistent if websocket is active.
This happened primarily when saving advanced options.
When using the TrayIcon with no hosted server (i.e., connecting to a running server), it is now possible to save the password and url in the secret provider.
There is a checkbox that allows saving the settings, and if checked, will save the settings to the secret provider (using the OS default if none is specifically provided).
This fixes#6379
This PR adds a VACUUM call to the database after encryption has changed. This is done to ensure any non-encrypted data is scrubbed and not present in unused pages after encryption is applied.
Before this PR the Windows Eventlog option was incorrectly typed as a boolean but was intended to be the log name.
This was confusing and caused a warning in the log that the option was incorrectly parsed.
This PR fixes a race during startup, where it was possible for the scheduler to start before the runner was paused, such that tasks could be started, even if the server was supposed to be paused.
This also fixes a more direct issue where the state was not updated during startup, so the UI could look paused, but the runner was active and accepting tasks.
This fixes#6634
This PR adds an option to disable control from the console.
With this option it is possible to keep a connection to the console, but not allow remote administration.
This PR fixes an issue with restore from config that would mask the internal objects passphrase and cause all requests to fail due to invalid passphrase.
This PR adds the option to limit the available modules to just the set of specified choices.
If no option is set, all modules are available (default).
If the option is set, only those in the list are available (whitelisting).
The options are:
- `--allowed-backend-modules`
- `--allowed-encryption-modules`
- `--allowed-compression-modules`
This PR adds settings to choose a Power Mode provider, which will detect if the system is in a paused/suspended state and avoid starting tasks while being suspended.
This currently only works for Windows, where the previous inplementation is named `NET` (for .NET) and the new mode is named `Native` and using the Windows documented approach with a hidden window that listens for `WM_POWERBROADCAST` messages.
The default is `Native` but can now also be disabled by choosing the `None` provider.
This updates the masked password feature to be better at detecting variations of the password mask, such as removing one or more asterisks from the string.
This also updates the "Test destination" endpoints to support a backupId so the call can unmask the target urls.
This PR adds the ability to manage backup configurations outside of the the client.
The implementation ensures that locally created configurations cannot be affected by the remotely managed backups.
If the instance is not connected to a remote console, this has no effect.
This PR updates the local database to add the column `ExternalID` that tracks backups that are managed remotely.
This PR adds a masking function that replaces sensitive parameters with a masking string, such that the passwords are never submitted to the client during edits.
For now, the export feature (both as JSON and as commandline) do not mask the sensitive parameters.
This fixes#2024
This adds a nonce to the refresh token such that each request to obtain a refresh token must now also provide a matching nonce.
When using non-persisted logins, the request to the server is the same, but the "remember me" flag toggles a shorter duration for the refresh token.
The FE can then store the nonce in either local storage for persisted logins or in session storage for non-persisted logins.
The default is currently to always issue refresh tokens with a nonce, but this can be toggled with the JWT configuration.
The ngax client does not have the non-persisted login so it stores the nonce in local storage, using a name that is compatible with ngclient so the user can swap between them without needing to re-login.
The server util was updated to also store the nonce.
This fixes#6451
This PR changes the termination signal to a `CancellationToken` instead of a `ManualResetEvent` as the former works better with async code.
With this change there is no longer a thread being captured during each long poll operation.
This fixes#6452
This PR changs the logic for queued tasks, so they throw if they fail. Without this fix, some tasks may look like the succeeded, when they actually failed.
The default is to report progress every second.
In some cases the report output is stuck at the "Starting backup..." phase.
This PR adds a new `Starting_Operation` enum to indicate that we do not yet know which operation is starting.
Then an additional trigger is added to flush the progress when the pahse changes. This means that as soon as we know which operation is active, this will be flushed to the UI.
This changes the order that backups are queue to better match their intended execution order.
If the machine is off for a day, the next time Duplicati starts, it will find all backups that were supposed to have run and queues these.
Before, the order of backups being queued would depend on the database order, essentially creation order.
This PR changes the logic to keep track of when they were supposed to run (first triggered time if multiple slots were skipped), and then adds the backups into the queue, so the job that was supposed to run first, will now be queued first.
This fixes#1476
