=============================
ThinLinc 4.15.0 Release Notes
=============================

Introduction
============

Cendio are proud to present ThinLinc 4.15.0, with more than 140
enhancements and fixes. The most prominent changes are:

* Managing a ThinLinc cluster from the command line has been made easier
  in various ways, primarily by a first version of a new tool called
  "tlctl". All ThinLinc command-line tools have also gotten man pages,
  and it's now easier to use the tools via sudo.

* Cendio and ThinLinc have refreshed their branding, and as part of
  that, all of ThinLinc has gotten a graphical update. The change is
  primarily visual, so users will be able to find most things in the
  places they are used to.

* Various minor security fixes and improvements in the ThinLinc server.
  Users are encouraged to upgrade at a convenient time.

* The EULA has been updated to allow the ThinLinc server to be more
  easily distributed. This means that it is no longer necessary for
  third-party vendors to instruct their users to download the ThinLinc
  server package directly from Cendio's website.

ThinLinc works on most modern Linux distributions and is supported on
any platform that fulfills our documented requirements.

Changes in this Release
=======================

In the list below, the bug number is given in parentheses. For more
information, visit https://www.cendio.com/bugzilla/.

General
-------

* The appearance and layout of all parts of ThinLinc have been refreshed
  with a new graphical design. (4889, 7902, 7904, 7905, 7906, 7907,
  7908, 7909, 7926, 7960, 7976, 7997, 8179, 8180)

Server
------

* The ThinLinc server now consists of a single RPM or deb package
  instead of several smaller packages. (4885)

* It is now permitted to distribute the ThinLinc server, provided all
  terms of the EULA are followed. (8155)

* Fixed an issue where unauthenticated connections could result in
  incorrect notifications about shadowers being disconnected. This
  could happen even if no shadower was connected to begin with. These
  notifications would appear as popups in user sessions (7830).

* Patched multiple security vulnerabilities where a malicious
  application could cause the X server to crash or execute arbitrary
  code. [CVE-2021-4008, CVE-2021-4009, CVE-2021-4010, CVE-2021-4011,
  CVE-2022-2319, CVE-2022-2320, CVE-2022-3550, CVE-2022-3551,
  CVE-2022-4283, CVE-2022-46340, CVE-2022-46341, CVE-2022-46343,
  CVE-2022-46344, CVE-2023-0494, CVE-2023-1393] (7971, 8085, 8138, 8160)

* The ThinLinc session will now allow access to all applications running
  as the user who started the session, not just applications that have
  access to the Xauthority file. This makes ThinLinc behave more like
  most major distributions and solves compatibility issues with
  restricted environments such as snap applications. (7788)

* All license files must now be issued for the same version to avoid the
  system calculating an incorrect number of valid licenses. The license
  files and the ThinLinc software can still have different versions, as
  long as the software doesn't have a higher version than the license
  files. (4937)

* Administration commands are more easily accessible by automatically
  adding `/opt/thinlinc/sbin` to PATH for all users. As a side effect,
  regular users will see ThinLinc commands that require superuser
  privileges when using tab completion. (7672)

* Fixed an issue where ThinLinc Setup would crash when upgrading from
  ThinLinc 4.9.0 or older (7865)

* The vsmagent service will no longer crash if the content of
  /etc/ssh/sshd_config is in an unexpected encoding. (7847)

* Fixed an issue where sessions could fail to start if another X server
  was using a display number within the range configured for ThinLinc.
  (7930)

* Setting a background image during session startup no longer requires
  the tool "xsri" and will now work correctly on most distributions.
  This image can be set through the parameter
  /sessionstart/background_image. The scaling of the image has also
  changed to better match how background images are scaled by desktop
  environments. (3054, 7906, 7949, 7952)

* Fixed an issue where the session would continue starting even if the
  user clicked "Quit" in the profile chooser. (7917)

Native Client
-------------

* SHA-1 is no longer supported for SSH host keys or SSH public key
  authentication. This means that the ThinLinc server must be running
  OpenSSH 7.2 or later, or other key types than RSA must be used (7535,
  7961)

* The Linux 32-bit x86 ThinLinc client is no longer available. Users are
  advised to switch to the 64-bit client. (7962)

* The ThinLinc client can now connect to Red Hat Enterprise Linux 9
  servers without reconfiguring the SSH server to avoid a bug in the
  server's RSA host key handling. (7933)

* The IGEL and ThinStation packages are now 64-bit for improved
  compatibility and performance. (6185, 7363)

* Fixed an issue where the ThinLinc client would only show a black
  screen when entering full-screen mode on macOS 13. (8046)

* Fixed an issue where the ThinLinc client would lose keyboard focus
  when leaving full-screen mode on macOS 13. (8049)

ThinLinc Web Access
-------------------

* Fixed various issues where Web Access could be tricked into showing a
  page controlled by an attacker by having a user click on a link
  controlled by the attacker. (7986, 7851)

Smart Card Support
------------------

* Fixed a regression in ThinLinc 4.14.0 where some smart card
  applications would not work correctly under ThinLinc because of the
  missing symbol "pcsc_stringify_error". (7946)

Administration
--------------

* The ThinLinc server now comes with a new command-line tool for
  administration, "tlctl". It can list sessions, terminate sessions, and
  display load balancing information. (3707, 425, 7833, 7834)

* When upgrading the ThinLinc server packages, the ThinLinc services
  are now automatically stopped for the full duration of the upgrade.
  This means that users cannot create new sessions or reconnect to
  running sessions during this period. The services are started again
  once ThinLinc Setup finishes. (7163)

* ThinLinc's Web Administration has an overhauled interface where
  configuration details are now displayed in popups, instead of directly
  inside the tables. (8075)

* The agent load information and the list of sessions in ThinLinc's Web
  Administration have been revamped to present the information more
  clearly. (8077, 8083)

* Fixed an issue where tl-config didn't print the folder names when used
  without the recursive flag. (7780)

* Fixed an issue where ThinLinc Web Administration could crash if the
  lpstat command was not available. (8063)

Documentation
-------------

* The ThinLinc Administrator's Guide is now installed with the ThinLinc
  server to make sure the correct documentation is always available.
  Once the server is installed, it can be found under the path
  /opt/thinlinc/share/doc/thinlinc-server/html. (1161)

* man pages are now installed for all ThinLinc server commands. (7049)

* Fixed an issue where it was not possible to search for some words in
  the ThinLinc Administrator's Guide. (7853)

Corrected Issues
================

ThinLinc has also been enhanced in many other ways. The complete list
of corrected issues is::

     425, 1161, 3054, 3707, 3854, 3950, 4382, 4839, 4878, 4885, 4889, 
    4937, 5042, 5064, 5084, 5204, 5267, 5506, 5900, 6010, 6185, 7049, 
    7123, 7163, 7195, 7363, 7460, 7535, 7541, 7623, 7624, 7672, 7780, 
    7788, 7790, 7810, 7827, 7828, 7830, 7833, 7834, 7835, 7841, 7842, 
    7847, 7851, 7852, 7853, 7855, 7857, 7859, 7860, 7862, 7865, 7868, 
    7870, 7878, 7882, 7883, 7886, 7902, 7904, 7905, 7906, 7907, 7908, 
    7909, 7911, 7915, 7917, 7918, 7926, 7930, 7932, 7933, 7935, 7936, 
    7939, 7946, 7947, 7949, 7950, 7951, 7952, 7960, 7961, 7962, 7971, 
    7976, 7986, 7989, 7990, 7995, 7997, 7998, 8000, 8011, 8013, 8022, 
    8023, 8026, 8027, 8046, 8049, 8056, 8057, 8062, 8063, 8064, 8067, 
    8071, 8073, 8075, 8076, 8077, 8080, 8083, 8085, 8087, 8095, 8097, 
    8101, 8102, 8106, 8110, 8111, 8121, 8122, 8124, 8138, 8141, 8146, 
    8149, 8155, 8157, 8158, 8160, 8166, 8169, 8175, 8176, 8177, 8179, 
    8180

| Android is a registered trademark of Google, Inc.
| ARM is a registered trademark of ARM Limited.
| Debian is a registered trademark of Software in the Public Interest, Inc.
| Dell is a registered trademark of Dell Inc.
| eDirectory is a registered trademark of NetIQ Corporation.
| eLux is a registered trademark of UniCon Software GmbH.
| Fedora is a registered trademark of Red Hat, Inc.
| Firefox is a registered trademark of The Mozilla Foundation.
| Google Earth is a registered trademark of Google Inc.
| HP is a registered trademark of Hewlett-Packard Company.
| IGEL is a registered trademark of IGEL Technology GmbH
| Java is a registered trademark of Oracle Corporation.
| Linux is a registered trademark of Linus Torvalds.
| Linux Mint is a trademark of Linux Mark Institute.
| NetWare and Novell are registered trademarks of Novell, Inc.
| OpenGL is a registered trademark of Silicon Graphics, Inc.
| Oracle is a registered trademark of Oracle Corporation.
| macOS and OS X are registered trademarks of Apple Computer, Inc.
| PostScript is a registered trademark of Adobe Systems Inc.
| Red Hat is a registered trademark of Red Hat, Inc.
| SUSE is a registered trademark of SUSE LLC.
| ThinLinc is a registered trademark of Cendio AB.
| Ubuntu is a registered trademark of Canonical Ltd.
| Unicode is a registered trademark of Unicode, Inc.
| UNIX is a registered trademark of The Open Group.
| Windows is a registered trademark of Microsoft, Inc.
| VMware is a registered trademark of VMware, Inc.
| Wyse is a registered trademark of Wyse Technology Inc.
