The proper database IDs must be populated in the current user's
ModeledUser for other parts of the database extension to work
correctly, including saving of user attributes.
As activeTunnels is a live map which may change while
getActiveConnections() is running, it is possible for an initial call
to activeTunnels.isEmpty() to pass yet for the set of connection
identifiers produced to be empty.
If expected fields are deleted rather than reset to empty, those fields
will not be resubmitted in future requests, resulting in the content of
those requests not accurately representing true client-side login state.
For example, if a user receives an insufficient credentials error due to
their password expiring, failing to provide any new password should
result in at least the following fields:
1. Their original username (part of the initial login attempt)
2. Their original password (part of the initial login attempt)
3. Their new password (empty)
If fields are incorrectly reset to null, those fields will not be
submitted, resulting instead in a request containing only:
1. Their original username (part of the initial login attempt)
2. Their original password (part of the initial login attempt)
which is indistinguishable from a normal login attempt.
By definition, a client error is not an internal error, but an
intentional refusal of the server to handle a malformed or otherwise
invalid request. These should not be handled in the same way as server
errors which unexpectedly block processing of a request and should be
corrected by an administrator.
In the case of GUACAMOLE-1152, client errors should not be ignored even
if failures are explicitly configured as tolerated for the associated
authentication provider.
Older versions of the MySQL / MariaDB driver do not support the same level of granular SSL/TLS control, and the legacy "useSSL" parameter cannot be specified without breaking the behavior of "sslMode".
The improvements from commit ed7e7bbb84 were supposed to go to `staging/1.2.0` and then get merged back to `master`, not directly to `master`. The same changes are now being redone against `staging/1.2.0` (to be merged back in again) so that things can be put back in proper sync.
Throwing GuacamoleInvalidCredentialsException breaks separation of
concerns (bindAs() shouldn't assume that it's being used during login
and that credentials given are the Guacamole user's credentials), and
has unintended side effects (throwing subclasses of
GuacamoleUnauthorizedException causes implicit session invalidation).
The AudioContext is paused by default in Google Chrome as a defense
against autoplay. It can be explicitly resumed with resume() as long as
there has been enough interaction with the page.
Some browsers suffer from a memory leak when reading image data
repeatedly using the Image object. Reading from Blobs does not exhibit
the same behavior. While reading from Blobs has previously been seen to
perform poorly compared to data URIs, this was observed when reading
using createObjectURL(). The createImageBitmap() function appears to
perform identically to reading data URIs using Image.
Firefox, and perhaps other browsers, does not fire a keyup event for
keys involved in submitting a form. This results in the enter key being
stuck in a pressed state if it is used to submit Guacamole's login
form.
Keyboard state should be reset whenever keyboard state cannot be
reliably maintained. This is already done for loss of window focus, but
should also be done for form submission (this specific case) and
navigation to a different page (generic catch-all).
As described in the discussion surrounding the original pull request:
* An extension throws `GuacamoleInsufficientCredentialsException`
specifically to indicate tentative acceptance of the credentials
passed thus far.
* Just as such an extension that fully accepts credentials takes
priority over an extension that refuses to accept the same, it makes
sense to allow an extension that *tentatively* accepts those credentials
to also take priority.
With the above perspective, authentication result priorities are as
follows, with ties broken by the inherent order of the auth providers:
1. Acceptance (returning an `AuthenticedUser` instance).
2. Tentative acceptance (throwing
`GuacamoleInvalidCredentialsException`).
3. Complete refusal (any other subclass of
`GuacamoleCredentialsException`).
4. Neither refusal nor acceptance (returning `null`).
See: https://github.com/apache/guacamole-client/pull/352
Creating a new injector re-initializes services and providers within
its modules. If those services or providers rely on being singletons
(as colorPickerService does), this produces unexpected behavior.
Mike Jumper