mirror of
https://github.com/rustdesk/rustdesk.git
synced 2026-11-04 08:34:12 +00:00
b44b71cfabe9898d5eada9b07cb583fe995ed45e
5160
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 fufesou
|
b44b71cfab |
Fix/download path validation (#16601)
* fix: validate download destinations and peer filename rules Reject unsafe or linked download destinations and validate empty-directory paths before creating them. Bind overwrite approval to accepted transfer entries and propagate receiver errors to the UI. Validate remote listings using the peer's filename rules so Unix names remain browsable on Windows. Reject locally unsafe basenames before starting downloads from either the Flutter or legacy UI. Finish the previous file before validating the next digest so rejecting the next destination preserves the file already received. Require confirmation before restarting interrupted downloads with stale staging files. Preserve matching resumes and cover receiver recovery. Retain explicit overwrite rejection for peers older than 1.1.10 that cannot negotiate confirmation. Signed-off-by: fufesou <linlong1266@gmail.com> * comments Signed-off-by: fufesou <linlong1266@gmail.com> * fix: use async I/O for download preparation and resume Use Tokio filesystem APIs for download setup and resume metadata checks. Run the Windows link-count query on the blocking pool and flush digest writes before returning. Signed-off-by: fufesou <linlong1266@gmail.com> --------- Signed-off-by: fufesou <linlong1266@gmail.com> |
||
|
mvtbh
|
eef1096395 | Update fa.rs (#16587) | ||
|
|
8b61033178 |
Update pl.rs (#16588)
* Update pl.rs Update Polish language (shortcuts screen). * Update src/lang/pl.rs Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> * Update src/lang/pl.rs Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> * Update pl.rs * Update pl.rs Corrected typo. --------- Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> Co-authored-by: RustDesk <71636191+rustdesk@users.noreply.github.com> |
||
|
Alex Rijckaert
|
c29bef18bb | Update Dutch translations for keyboard shortcuts (#16625) | ||
|
fathur
|
c6258f4166 |
Fix typo in Indonesian translation (#16630)
* docs(id): translate misuse disclaimer section * docs(id): add Flathub download badge * i18n(id): fix typo in Indonesian translation * fix broken translation tuple in id.rs * i18n(id): fix typo in Indonesian translation |
||
|
bovirus
|
989beee17f | Update Italian language (#16633) | ||
|
Ricardo Simõesandgreptile-apps[bot]
|
4b1821d1ff |
Update pt pt translation + README.md to include Portuguese (Portugal) (docs/README-PTPT.md) (#16634)
* Update pt_PT.rs
* Add files via upload
* Update README-PTPT.md
* Update README-PTPT.md
* Update README.md to include new pt-PT (docs/README-PTPT.md)
* Update docs/README-PTPT.md
Corrected link libs/base
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
* Update docs/README-PTPT.md
Corrected "área de trabalho" to "área de transferência"
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
* Update pt_PT.rs
Fix api_server_connection_tip and api_server_empty_tip: translate from en.rs source
* Fix relative links in README-PTPT.md (remove extra docs/ prefix)
* Fix section anchors in README-PTPT.md to match PT-PT headings
* Fix typos and gender agreement in README-PTPT.md disclaimer
* Use European Portuguese terms in README-PTPT.md screenshot alt text
* Translate shortcut instructions from en.rs source
* Update pt_PT.rs
Align shortcut and API server strings with en.rs source (keep {} placeholders)
* Revert JumpLink to original value (out of scope for this PR
* Replace remaining Brazilian Portuguese terms in README-PTPT.md
Replaces leftover Brazilian Portuguese wording with European Portuguese
equivalents (e.g. "conosco" -> "connosco", "controle" -> "controlo",
"conexão" -> "ligação", "Você tem" -> "Tem", "amigável" -> "acessível",
"desktop" -> "ambiente de trabalho"), consistent with the terminology
already used in src/lang/pt_PT.rs.
---------
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
|
||
|
fufesou
|
c7f212df2c |
fix: warn about insecure custom API server connections (#16616)
* fix: warn about insecure custom API server connections Signed-off-by: fufesou <linlong1266@gmail.com> * fix: limit API server warning to HTTP addresses Signed-off-by: fufesou <linlong1266@gmail.com> * fix: resolve API warnings against effective server configuration Signed-off-by: fufesou <linlong1266@gmail.com> * fix: reuse common sync for API server previews Signed-off-by: fufesou <linlong1266@gmail.com> * fix: keep server settings usable on API preview errors Signed-off-by: fufesou <linlong1266@gmail.com> --------- Signed-off-by: fufesou <linlong1266@gmail.com> |
||
|
Leo Camus
|
bbffc1de5a |
fix: bracket a bare IPv6 ID server when deriving the API server (#16624)
With the API server field empty, get_api_server_ builds the URL from the ID server as "http://{host}:21114". For an ID server entered as a bare IPv6 address such as 2001:db8::1, which test_if_valid_server accepts, increase_port leaves it unchanged and the result is http://2001:db8::1:21114. That does not parse as a URL (InvalidPort), so login and every other API request fail. Wrap the address in brackets in that branch only. Hostnames, IPv4 and "[addr]:port" take the same path as before. |
||
|
Chris21xandchg
|
0cbeb04730 |
Forward audio latency environment to Linux user server (#16597)
* Forward audio latency environment to Linux user server Preserve PULSE_LATENCY_MSEC and PIPEWIRE_LATENCY when the root service spawns the per-user RustDesk server. The systemd service defines these variables, but they were not included in the explicit environment passed to run_as_user(), causing the user server and connection manager to fall back to higher audio latency. Forward the existing values without changing their defaults. * Add regression test for Linux audio latency forwarding --------- Co-authored-by: chg <chg@vis-ag.ch> |
||
|
solokot
|
53996e3c40 | Update ru.rs (#16570) | ||
|
21pages
|
392188596c |
fix(video): improve clarity after scrolling by re-encoding static frames (#16128)
* fix(video): re-encode static frames for up to 10 seconds to improve clarity Signed-off-by: 21pages <sunboeasy@gmail.com> fix(video): limit static re-encoding to 300 frames instead of 10 seconds Signed-off-by: 21pages <sunboeasy@gmail.com> refactor(video): move static frame refresh into a dedicated module Signed-off-by: 21pages <sunboeasy@gmail.com> fix(video): preserve stuck-encoder detection state across static repeats test(video): cover cached texture lifetime across capture restarts fix(video): reduce static re-encoding limit to 100 frames fix(qos): lower qos_trace logging to trace level Signed-off-by: 21pages <sunboeasy@gmail.com> fix(video): skip static frame re-encoding for AV1 perf(video): reuse VRAM encoder input for static refresh Remove the DXGI repeat texture cache and use hwcodec's repeat entry point to avoid copying each captured frame. Isolate static refresh failures, pause after three errors, and resume after a real frame is sent successfully. Cover cached input ownership, repeat failure recovery, refresh limits, and normal encoder failover with regression tests. fix(vram): ignore cached SDK codec backends chore(deps): temporarily use hwcodec re-encode branch perf(video): wait 200ms before starting static refresh chore(deps): update hwcodec for FFI exception handling chore(deps): update hwcodec to 0.8.0 perf(video): start static refresh after 100ms chore(deps): update hwcodec for exception-safe cleanup chore(deps): update hwcodec for device-loss handling and noexcept FFI chore(deps): update hwcodec to bbfc306 chore(qos): remove verbose diagnostics while retaining trace logs * update hwcodec Signed-off-by: 21pages <sunboeasy@gmail.com> * refactor(scrap): keep repeat encoding in the vram module * perf(vram): avoid intermediate frame vectors - Drain normal and repeated encode output into protobuf messages. - Cover null-texture encoding failures. - Clarify the count-based static refresh budget. - Update hwcodec to fix RAM decode buffers on resolution changes. Signed-off-by: 21pages <sunboeasy@gmail.com> * fix(scrap): preserve hardware encoder error codes * test(video): remove uptime dependency from static refresh tests * feat(video): configure static repeat limits by codec and quality * fix(video): exempt VPx and AV1 from static repeat failure limit * fix(video): count only successful static repeat frames * fix(video): refine static repeat scheduling and VPx frame handling Allow static refinement after a VP8/VP9 captured frame produces no output without enabling it after a genuine encoding error. Carry this distinction alongside the send result so the latest cached frame can still be sent when capture becomes idle. Keep VP8/VP9 repeats at a minimum of 100ms. Other codecs wait at least 100ms initially, then follow the QoS frame interval aligned with the capture loop. Use four quality bands, with VP8/VP9 limits of 30/20/20/0 and the tuned H264/H265 limits. Include only production behavior and regression tests. Validation: 16 static_refresh tests passed with hwcodec,vram,flutter enabled, covering latest-frame recovery, genuine errors, timing, and repeat budgets. * fix(video): tune static repeat limits by codec and backend Use the measured obvious-improvement checkpoints for VP8/VP9 and separate NVENC, QSV, and AMF H.264/HEVC limits for each quality tier. The checkpoints recover 80% of the observed error improvement across the tested inputs. Resolve the hardware backend from EncoderCfg during StaticRefresh construction, including the VRAM adapter vendor. Keep the existing limits for other hardware backends. Validation: 19 static_refresh tests passed with hwcodec,vram,flutter. The repeat measurements cover 192 series with no encode/decode errors. * fix(video): refine static refresh budgets and cap repeat FPS Add VideoToolbox HEVC budgets and tune quality bands from repeat-frame comparisons. Cap static refresh at 30 FPS and use the speed preset consistently at quality 0.5. * remove unused variables Signed-off-by: 21pages <sunboeasy@gmail.com> * fix(video): repair static refresh tests and throttle repeat logs --------- Signed-off-by: 21pages <sunboeasy@gmail.com> |
||
|
RustDeskandClaude Opus 5.5
|
c0750fb50c |
fix(client): report one error when both WebRTC race legs fail (#16563)
Both legs of race_transports_prefer_webrtc send their own punch request to the same rendezvous server for the same peer, so a refusal there (offline, unknown ID, key mismatch, a server-supplied other_failure) fails both with the same text. Joining them as "WebRTC failed: X; fallback failed: X" showed it twice and broke the UI's whole-string matching: the offline auto-retry needs exactly "Remote desktop is offline", the message box translates the text as one string, and check_if_retry hides the retry button for any text containing "failed". Return the error of the leg that failed last, as select_ok did before the race existed, and log the other one once. Claude-Session: https://claude.ai/code/session_01WS1HTjp6UQuG43KEcQPq1R Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
fufesou
|
f705902ec3 |
fix(windows): move installer scripts into protected temp directories (#16554)
* fix(windows): move installer scripts into protected temp directories Create a private directory under Windows Temp with its final DACL in CreateDirectoryW. Grant Administrators and SYSTEM full access and use OWNER RIGHTS to suppress the ordinary creator's implicit WRITE_DAC. Keep the existing elevated system-cmd copy and SHA-256 verification flow. Keep auxiliary files in the same directory, report cleanup failures, and check command length before creating the directory. This avoids PowerShell, helper executables, and application startup or DLL linking changes. The Windows Temp parent must retain its standard protection against deletion by unprivileged users. UAC cancellation can leave an empty protected directory; the error reports its path. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(windows): preserve installer results when cleanup fails Keep the original installer exit code and report remaining temporary directories or inspection errors as warnings with their paths. Include the directory path in creation errors. Restore the existing handoff assertions in a separate test module, add a locked-directory regression for successful and failed installers, and remove the unrelated ERRORLEVEL environment change. Validation: scoped formatting and whitespace checks passed. Native cmd probes reproduced the failure before the fix and preserved both exit codes afterwards. No project build or Rust test execution was performed. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(windows): clarify installer cleanup warnings Describe protected directories as possibly remaining when cleanup cannot be verified. Remove the cleanup-only test added during review while retaining existing handoff coverage. Signed-off-by: fufesou <linlong1266@gmail.com> * test(windows): keep installer handoff tests inline Restore the inline test module and original helper order to reduce the diff against master. Keep the directory cleanup assertions and original bootstrap checks. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(windows): include paths in installer directory check errors Signed-off-by: fufesou <linlong1266@gmail.com> * fix(windows): clear inherited ERRORLEVEL before installation Signed-off-by: fufesou <linlong1266@gmail.com> * fix(windows): avoid duplicate directory error messages Signed-off-by: fufesou <linlong1266@gmail.com> * test(windows): verify installer directory permissions Signed-off-by: fufesou <linlong1266@gmail.com> --------- Signed-off-by: fufesou <linlong1266@gmail.com> |
||
|
Maison da Silva
|
538126d42c | Update Portuguese translations for keyboard shortcuts (#16555) | ||
|
bovirus
|
9c6d3fcb4f |
Update Italian language (#16551)
* Update Italian language * Update Italian language |
||
|
Alex Rijckaert
|
c230c57139 | Update Dutch translation (#16540) | ||
|
Leo Camus
|
e614de83fc |
fix: read host= from an exe path with non-ASCII characters (#16556)
get_custom_server_from_string located "host=" in s.to_lowercase() and
sliced s with that byte index. Lowercasing can change a character's byte
length ("İ" is 2 bytes, "i̇" is 3), and on Windows the string is the full
exe path, so a profile such as C:\Users\İsmail shifted the slice past the
"h" and host came back empty. The client then fell back to the default
rendezvous server.
"host=" is ASCII, so search s.to_ascii_lowercase(), which keeps byte
offsets.
|
||
|
21pages
|
e910029f51 |
feat: use the configured proxy for WebSocket connections (#16386)
* feat: add opt-in WebSocket proxy support Add a WebSocket proxy option to the proxy dialog and custom client settings. Keep WebSocket connections direct by default and use the configured proxy without direct fallback when enabled. Preserve relay targets regardless of the proxy address family and restart connections when the option changes. Update hbb_common for proxy support. Signed-off-by: 21pages <sunboeasy@gmail.com> * update hbb_common Signed-off-by: 21pages <sunboeasy@gmail.com> * fix: remove WebSocket proxy opt-in * chore: restore proxy settings UI and translations * fix: update hbb_common for proxy read progress * fix: update hbb_common proxy connections and IPv6 parsing * fix: update hbb_common WebSocket local address * update to rustdesk/hbb_common Signed-off-by: 21pages <sunboeasy@gmail.com> --------- Signed-off-by: 21pages <sunboeasy@gmail.com> |
||
|
Mariano Abad
|
d011aa3ea6 |
fix(wayland): a pending portal request no longer stalls the server (#16542)
* fix(wayland): a pending portal request no longer stalls the server The screencast portal waits for the user while its picker is open, up to three minutes. check_init waited under the CAP_DISPLAY_INFO write lock on a tokio worker and get_capturables under RDP_SESSION_INFO. Every desktop login read the display state on a worker behind them, and the session close when the last connection went waited for the slot on a worker too. With the server on 4 cpus a second login was enough: new connections were accepted by the kernel and not served until the request ended (#15973). The locks keep their role: the write lock still serializes inits and orders them with clear(), and the slot still orders the session close calls after a pending request. What changes is where the waiting happens. The part of check_init under the write lock moves, as is, to init_displays(), run in spawn_blocking. is_inited and the first look in check_init use try_read; when a writer holds the lock, is_inited answers not inited yet and check_init redoes its look in spawn_blocking, then goes on as before. get_displays_and_primary takes its read guard in spawn_blocking, is_rdp_session_hold uses try_lock, close_session from the ipc listener runs in spawn_blocking, and try_close_session from AuthedConnID::drop on its own thread. * fix(wayland): throttle the log when the session close thread cannot start A peer can drop connections at any rate, so the error logged when AuthedConnID::drop cannot spawn the thread for try_close_session goes through throttled_log!, once a minute, like the auto-login logs of this file (greptile on #16542). * fix(wayland): count the remote connections again in the close thread The session close moved to its own thread in this pr, so a remote that comes in after the count and before the thread runs could have the session it reuses closed under it. The thread counts the remote connections again right before try_close_session, which brings the window back to the one the close had on the dropping thread (coderabbit on #16542). * fix(wayland): one portal session close at a time, for remote and camera connections only The close that AuthedConnID::drop runs off the dropping thread spawned one OS thread per drop that left no remote connection, whatever the connection type, and while a portal request waits for the user each of those threads waited for the session slot. Now only a remote or view camera connection leaving asks for the close (their video service is the one that opens the portal session), no thread starts when the slot is free and empty (drm, x11, nothing left to close), and one close runs at a time: a close asked while one runs is left to it. The logic moves to wayland.rs; connection.rs keeps a hook. |
||
|
RustDeskandClaude Opus 5.5
|
9997b7a3b8 |
test: remove tests that do not pin user-visible behavior (#16539)
* test: remove tests that do not pin user-visible behavior Apply the AGENTS.md test rules to the existing Rust and Flutter suites. A test is kept when it is the only coverage of user- or API-visible behavior, the regression test of a reported or fixed bug, a security boundary (one test per rejection class), or a check against an external reference. Tests that assert private state or the order of internal steps, pin review-round corner cases, or repeat what a kept test already covers are removed. Rust: 679 -> 298 tests. Dart: 118 -> 45 tests. Test-only helpers left without callers go with them (applyLastOnlineStateForTesting, terminalKeyboardRowWidth, debugBufferedInputCount, tokio's test-util dev feature), and cfg gates and visibility that existed only for the deleted tests are narrowed. Runtime behavior is unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WS1HTjp6UQuG43KEcQPq1R * test: keep tests that pin security and user-visible behavior Restore six tests that review showed are the only coverage of their behavior: - update metadata rejects an artifact file name with path components; - ICE candidates from another session are dropped; - KCP delivers every multi-segment frame queued before a close; - set_files rejects an empty name in a multi-file transfer; - a lopsided elongated cursor keeps its centre hotspot (#16242); - toggling Show hidden during a pending same-path read issues a new read. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WS1HTjp6UQuG43KEcQPq1R * test: keep offline update and key-exchange downgrade rejections Restore three tests that are the only coverage of their rejection class: - offline update metadata rejects a signed artifact with an http or credential-bearing URL; - offline verification rejects a renamed local file and a version that does not match the release; - a key-exchange pick lowered in transit leaves both sides unable to decrypt, so a v0 fallback after a failed v1 decrypt cannot pass unnoticed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WS1HTjp6UQuG43KEcQPq1R * test: keep the decomposed-grapheme and reconnect-cancel tests Each catches a plausible wrong change that passes every kept test: mapping the first scalar under a locked Ctrl turns é into \x05, and a reconnect that does not fail pending reads leaves them hanging until the 30 s timeout. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WS1HTjp6UQuG43KEcQPq1R --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
Leo Camus
|
76ab280ae9 |
fix(terminal): trim the replay buffer when output has no newline (#16545)
* fix(terminal): trim the replay buffer when output has no newline OutputBuffer::append returned early when the last line was incomplete and the new chunk had no newline, so the trim loop never ran. A program that writes without newlines (a minified file through cat, a \r progress bar) grew the replay buffer past MAX_OUTPUT_BUFFER_SIZE without bound, one 4 KiB PTY read at a time, until a newline arrived. Signed-off-by: leoca <leo.camus23@gmail.com> * fix(terminal): keep recent output when trimming a line without newline Trimming popped the whole incomplete line once it passed MAX_OUTPUT_BUFFER_SIZE, so the reconnect replay could come back empty. Newline-free output now goes into a new chunk once the incomplete one holds DEFAULT_RECONNECT_BUFFER_BYTES, and trimming drops the oldest chunks while the newest bytes stay. The test checks get_recent. Signed-off-by: leoca <leo.camus23@gmail.com> * fix(terminal): trim an oversized incomplete line to its newest half Splitting the incomplete line into chunks made get_recent return whole chunks only, so a reconnect could replay as little as the newest read. Keep one line and, when it alone is over MAX_OUTPUT_BUFFER_SIZE, drop its oldest bytes down to half the cap. The copy then happens once per half buffer instead of on every append, and the replay keeps the newest DEFAULT_RECONNECT_BUFFER_BYTES. Signed-off-by: leoca <leo.camus23@gmail.com> --------- Signed-off-by: leoca <leo.camus23@gmail.com> |
||
|
Mariano Abad
|
49a9574f97 |
fix(drm): pace the producer to the rate the encoder takes, with the panel refresh as floor (#16423)
* fix(drm): pace the producer to the rate the encoder takes, with the panel refresh as floor The root producer slept a fixed 33 ms after every grab, so every DRM stream topped out at 30 fps whatever the client asked (rustdesk#16175). Measured on a 1920x1080@60 i915 box with the client at Custom 60 and QoS settled at 60: 30 grabs, 30 converted, 29.8 sent. A shorter fixed interval reaches the rate but oversamples: at 8 ms the same box grabbed and converted 117/s for 60 sent. The consumer now tells the producer the rate it encodes at, in the ack byte it already sends per converted frame: 0x01 as before, or 0x80|fps. Every producer counts ack bytes and never read their value, so an older service sees exactly the same credit and keeps its 33 ms; the JSON handshake and the ack count and timing do not change. The rate is the encoder's spf (what frame() is called with), lowered to what the encoder achieves when it is busy longer than spf per frame: the time from one frame() call to the next, less what the call spent waiting for a frame, so a late producer cannot talk its own demand down. The producer replaces the post-work sleep with a deadline: the encoder's period above 30 fps, the old 33 ms from 30 down to 15, and half the encoder's period below 15, never faster than the panel (the exact CRTC refresh from libdrmtap 0.5.9's drmtap_crtc_refresh, re-read once a second; with an older library the whole-hertz refresh the enumeration already read, so no extra connector probe). The worker still wakes at least every 33 ms, because each tick also reads the cursor and a slow frame rate must not slow the cursor down. Without a demand (an older consumer, or before the first frame() call) the old 33 ms sleep stays. MAX_STALLED and the WouldBlock retry keep their 5 s budget, pinned by a const assertion. Tests: the ack byte round trip and that it is one byte on the wire, the drain (seeded byte streams: every byte one credit, the newest demand wins), the pacing interval table (panel floor, below 30 and below 15, a 23.976 Hz panel), the panel period rounded up, the deadline and its overrun, the wake that keeps the cursor at 33 ms, the demand from spf and from a busy encoder, the busy time without the wait (pure and through frame()), the demand log once per connection, the whole-hertz fallback, and the reader's refresh answer. Each rule has a mutation that turns its test red. * ci: run the drm pacing tests in the drm step drm_pacing_tests (src/ipc/drm.rs) and crtc_refresh_tests (libs/scrap drm_reader.rs) match none of the existing filters. * test(drm): keep three tests, on outputs and not on internal state Per AGENTS.md (Tests), keep one to three tests, on outputs and not on internal state: the demand ack as it goes on the wire, the producer interval for a demand and a panel, and the exact refresh the reader returns. * test(drm): the ack test goes through the producer drain Per review: send_frame_ack(60) read back through drain_frame_acks gives one credit and a demand of 60, so dropping the demand read in the producer turns the test red. The interval test also pins drm_panel_period(148352, 2475) to 16_683_294 ns. * fix(drm): time the encoder only after a frame() call that returned a frame Since #16450 frame() drops a repeat as WouldBlock. The time after such a call is video_service sleeping out its spf, and after a timeout it is about zero once the wait is subtracted. Neither follows an encode, so neither is a sample of the encoder pace now. Uses returned_at from #16450; no new state. * fix(drm): ask for the old 33 ms tick while the screen is still Since #16450 a still screen is grabbed at the demand and dropped in frame(), twice as often as master at 60. After 100 ms without a new frame the demand is capped at 30, the old producer tick, and the next new frame lifts it. 100 ms is three of those ticks, so a producer paced at 30 in motion never reads as still. Uses returned_at; no new state. * test(drm): a dropped repeat or timeout is no encoder time; a still screen asks for the old tick Per review: the demand frame() reports stays with a 50 ms encoder through a still screen of repeats and timeouts, and a still screen asks for 30 after STILL_AFTER until a new frame brings back 60. * fix(drm): start the encoder average over when the rate goes up Per review: the samples hold the sleep video_service paces itself with, so after a rate increase (custom fps 1 -> 60, or QoS recovering) an average taken at the old rate kept the demand low and the producer slow. A shorter spf than the last now starts the average over and drops the sample that spans the change. The demand is computed in one method that takes its time as input, the still cap included. * test(drm): drop the two pacing tests of the last round Per review: they read shared.demand_fps and slept for real. The three tests stay. * build: pin libdrmtap 0.5.12 (rustdesk-org/libdrmtap 5936a7a88) The panel floor of the pacing reads drmtap_crtc_refresh(), added in libdrmtap 0.5.9. The mirror carries v0.5.12 since 2026-10-13, so the pin moves there. The rest of the range from 0.5.8 changes no struct in drmtap.h: 0.5.10 reads its environment through secure_getenv and loads no GL in a setuid, setgid or file-capability process, which rustdesk does not run; 0.5.11 makes drmtap_deswizzle, also the CPU fallback of a tiled grab, refuse a destination stride narrower than its rows instead of writing past it, and exports drmtap_frame_owns_data, unused here; 0.5.12 changes only docs and the version. |
||
|
|
0740063863 |
Keyboard shortcuts (#14933)
* fix web break introduced in
|
||
|
RustDeskandClaude Opus 5.5
|
13e1278b4c |
fix: auto-login types the OS password only at the logon or lock screen (#16520)
* fix: auto-login types the OS password only at the logon or lock screen A remote-control login on Windows and macOS now reports is_logon_screen in platform_additions, and the client skips auto-login when the peer reports false. Peers that don't report it (older ones, Linux) keep today's behaviour, so this narrows the leak into the focused window without closing it: the value is a snapshot taken at login. Windows 7 and Server 2008 R2 report the WTS lock flag reversed, so there only LogonUI.exe tells the lock screen apart. Refs #16510, #15261 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P1grQ39ByRWPUtTBdTzEBF * windows: drop the LogonUI.exe check from is_logon_screen LogonUI.exe can outlive the unlock and is matched by name only, so its presence reported a lock screen on an unlocked desktop and let the password through. Only the WTS lock flag decides now; on Windows 7 and Server 2008 R2, which report it reversed, the result is inverted. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P1grQ39ByRWPUtTBdTzEBF * windows: count only a confirmed logon or lock screen for auto-login is_prelogin() reads a failed WTS user-name query as no user signed in, and on Windows 7 the inverted is_locked() read a failed lock-flag query as locked, so either failure let the password through. is_logon_screen now uses its own queries that keep a failed read apart, and reads LOCK and UNLOCK the other way round on Windows 7 and Server 2008 R2. The existing functions stay as they are for their callers. If the check task itself fails, the server reports false instead of leaving the key out, which old clients' peers would mean. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P1grQ39ByRWPUtTBdTzEBF * auto-login: ask the peer with a protobuf field instead of a JSON key The client sets the new LoginRequest.auto_login only when Auto Login would type the OS password, and the server runs the logon-screen check only then, so nothing new runs for any other login. The answer is the new PeerInfo.skip_auto_login: its default, false, is what an old or Linux server means, so those peers keep typing as before, and neither field is encoded unless set. The is_logon_screen key in platform_additions is gone. Windows is_locked() now reads the lock flag through is_session_locked_flag(), which handles the reversed LOCK/UNLOCK of Windows 7 and Server 2008 R2. Its only caller is the allow-logon-screen-password check, which on those systems accepted the permanent password on an unlocked desktop. Windows 8 and later read the same as before. The C is_session_locked() is removed and its WTS_CURRENT_SESSION guard moves into get_session_flags(). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P1grQ39ByRWPUtTBdTzEBF * auto-login: let the peer type the password, after checking its screen The login-time check left the whole time until the password arrived open: the screen could be unlocked during the click, the 1.2 s wait and two network trips, a second client's password landed on the desktop the first one had just unlocked, and turning Auto Login on mid-login skipped the check. Now the client still clicks and waits, then sends the password in a new Message.os_login (reusing OSLogin) to a Windows or macOS peer from 1.5.1. The peer checks for its logon or lock screen right then and types the password and Return only if it finds one; otherwise it drops them. Other peers get the keys as before, and the OS Password menu item is unchanged. The password goes out only after login, never in the login request. LoginRequest.auto_login and PeerInfo.skip_auto_login are removed, so nothing new runs unless os_login arrives. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P1grQ39ByRWPUtTBdTzEBF * server: name os_login in scope-violation logs A rejected os_login was logged as message.other. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P1grQ39ByRWPUtTBdTzEBF --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
Mariano Abad
|
109c39bccb |
fix(drm): drop a frame equal to the previous one, as the other capturers do (#16450)
* fix(drm): drop a frame equal to the previous one, as the other capturers do The producer grabs on a timer, so a still screen reached the encoder as the same frame every tick and the client decoded about 30 frames per second of nothing new (rustdesk#16449). The x11, pipewire and quartz capturers drop a repeat with would_block_if_equal; the drm capturer now does the same. A regression test checks that a repeat is not encoded again and that the next new frame is. The frame helper of the tests now differs per call, and the 180 test forgets the frame its last case repeats on purpose. * fix(drm): a frame whose encode failed is not dropped as a repeat The capturer marked a frame as seen when it returned it, so when its encode failed and the screen then stayed still, every later grab compared equal to it and it was never sent: the client kept the previous image, and a hardware encoder never reached its failure count to switch away. handle_one_frame now also says whether the frame was encoded, and when it was not the loop calls TraitCapturer::forget_last_frame(), a new method whose default does nothing. The DRM capturer then returns the next repeat instead of dropping it. The DRM capturer also stops keeping a copy of the last frame: it compares the new buffer with the one it returned last before replacing it, and a turned frame is turned into a spare buffer first. * fix(linux): x11 and pipewire do not drop a failed frame as a repeat either Both capturers drop a frame equal to the one they returned last, so they had the same hole as the drm one: a frame whose encode failed was not sent again while the screen stayed still. They now forget it when the loop says so. * fix(linux): every video run starts by forgetting the last frame A pipewire recorder outlives a restarted run while another display keeps the session open, and so did the frame it returned last. A run restarted by an encoder switch or a new subscriber then dropped the first repeat and sent nothing until the screen changed. The capturers of the other paths are built fresh for each run, so for them the call does nothing. * fix(drm): keep the repeat drop in the drm capturer, with one repeat a second The shared part of the three commits before is reverted: TraitCapturer, the video_service loop, x11 and pipewire are as on master again. So is the restructure of frame() from the second commit: the drop is again the one of the first commit, would_block_if_equal on the frame returned last, as the other capturers do. A repeat is dropped until a second has passed since frame() last returned a frame, so a frame whose encode failed reaches the encoder again a second later even if the screen stays still. The tests check the drop, the repeat a second later, and that the second starts over after it. * fix(drm): a frame is a repeat only when its format matches too The same bytes as BGRA and as RGBA are two pictures when red and blue differ, and the convert path can return either, so a change of format clears the saved frame and the new one goes out. The 180 test no longer checks a turned repeat: nothing reported asked for it. * fix(drm): compare a frame with cur before replacing it, without a copy saved_raw_data copied every changed frame (8 MB at 1080p). The previous frame is still in cur when a new one arrives, so the bytes and the format are compared with it before the swap; a rotated output turns the frame into a spare buffer first. The 180 test checks the turned repeat again, since that path compares on its own now. |
||
|
Henrik Fransson
|
ccfa714d2e |
Fix Swedish translation typo (#16529)
Signed-off-by: Henrik Fransson <hmf.hmf.hmf@gmail.com> |
||
|
fufesou
|
0921a7432f |
feat(update): verify signed update metadata (#15914)
* feat(update): verify signed update metadata * fix(update): harden metadata publishing and app names - share strict app-name validation across Windows and macOS - preserve published sidecars until replacements are ready - select macOS test features by target architecture - update the signing dependency and URL validation coverage Signed-off-by: fufesou <linlong1266@gmail.com> * fix(update): prevent replacing published release assets - block reruns after signed update metadata is published - clarify the security rationale for app-name validation Signed-off-by: fufesou <linlong1266@gmail.com> * fix(update): cache TLS responses and avoid double translations Signed-off-by: fufesou <linlong1266@gmail.com> * refact: reduce the diffs Signed-off-by: fufesou <linlong1266@gmail.com> * refact(update): remove obsolete update paths - remove unused FFI update branches - delete legacy Windows and macOS update helpers - simplify macOS daemon updates and redundant gating Signed-off-by: fufesou <linlong1266@gmail.com> * feat(update): secure same-identity macOS offline updates - verify DMGs using signed metadata, size, and SHA-256 - enforce package and bundle identity plus macOS signature checks - support custom release policies and propagate manual update failures Signed-off-by: fufesou <linlong1266@gmail.com> * fix(update): verify Windows installers with Authenticode Reject unsigned or untrusted EXE/MSI updates before elevation, clean up failed verified copies, and fix the macOS manual updater logging import. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(update): clear stale URL on response body errors Keep body-read failures in the common cleanup path and document the cache-only Authenticode verification policy. Signed-off-by: fufesou <linlong1266@gmail.com> * refactor(update): remove OS signature sanity checks Remove Windows Authenticode and macOS codesign/Gatekeeper verification. Keep metadata, artifact integrity, bundle identity, and transaction checks. Signed-off-by: fufesou <linlong1266@gmail.com> * refact(update): move update scripts into res/update Signed-off-by: fufesou <linlong1266@gmail.com> * fix(update): secure Windows MSI handoff against junction races Signed-off-by: fufesou <linlong1266@gmail.com> * fix(update): secure Windows EXE handoff against junction races Signed-off-by: fufesou <linlong1266@gmail.com> * fix(update): preserve legacy custom client app names - allow names starting with digits or underscores - preserve leading hyphens on Windows for compatibility - reject leading hyphens on macOS to avoid pgrep option parsing Signed-off-by: fufesou <linlong1266@gmail.com> * refact(update): remove some simple wrappers Signed-off-by: fufesou <linlong1266@gmail.com> * refact(update): simple refactor * refact(update): comments on update.scpt Signed-off-by: fufesou <linlong1266@gmail.com> * refact(update): comments Signed-off-by: fufesou <linlong1266@gmail.com> * fix(update): create download destinations exclusively Signed-off-by: fufesou <linlong1266@gmail.com> * fix(macos): roll back updates when final readiness checks fail Signed-off-by: fufesou <linlong1266@gmail.com> * fix(msi): propagate MSI installation failures Signed-off-by: fufesou <linlong1266@gmail.com> * chore Signed-off-by: fufesou <linlong1266@gmail.com> * fix(macos): reject stale IPC sockets during updates Require open IPC sockets in addition to launchd running state before committing the privileged update transaction. Inspect sockets with lsof to avoid triggering IPC authentication. Add native socket regression coverage to macOS CI. Remove the unused Windows helper, combine offline metadata exports, and restore unrelated formatting changed by the PR. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(macos): allow offline updates without an installed bundle Validate app-only updates against the running client's bundle identifier and check the destination identity when it exists. Replace source-text assertions with behavioral identity tests and run the macOS update tests in CI. Signed-off-by: fufesou <linlong1266@gmail.com> * ci, gate test with PUBLISH_UPDATE_METADATA == 'true' Signed-off-by: fufesou <linlong1266@gmail.com> --------- Signed-off-by: fufesou <linlong1266@gmail.com> |
||
|
RustDeskandClaude Opus 5.5
|
4411d10f45 |
fix(linux): report the process user as the active user under Flatpak (#16519)
File transfer to a Flatpak peer always failed with "No active console user logged on", because PeerInfo.username came from loginctl, which the sandbox cannot reach: Flathub builds lack the org.freedesktop.Flatpak talk-name, so `flatpak-spawn --host` fails. A Flatpak instance only runs inside the logged-in user's own session, so that user is the active one. Fixes #16506 Claude-Session: https://claude.ai/code/session_01WS1HTjp6UQuG43KEcQPq1R Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
|
67090d3aa1 |
fix: a refused privacy-mode request no longer turns off another connection's (#16507)
* fix: a refused privacy-mode request no longer turns off another connection's `Connection::turn_on_privacy`'s error arm tore down whatever privacy mode was active, whoever owned it. With connection A in privacy mode, connection B's request is correctly refused with OCCUPIED, and the error arm then called `turn_off_privacy_to_msg(INVALID_PRIVACY_MODE_CONN_ID, ..)`. That id bypasses the ownership check in `check_off_conn_id`, so A's privacy mode went away: the screen was un-blanked and local input un-hooked. The call passes `state: None`, so no `set_privacy_mode_state` goes out either and A was never told, leaving its client showing privacy mode as on. `check_privacy_mode_changed` doesn't cover it, as it only sends PrvOnByOther while a privacy mode is still active. Pass `self.inner.id`, as the sibling error path above already does. `check_off_conn_id` then cleans up after this connection when it owns privacy mode, and refuses when another connection does. The bypass itself stays: `ipc::Data::Close`, `reset_all` and `TurnOnGuard` need an unconditional teardown. Its contract is now noted on `check_off_conn_id`, since that is what the buggy call site got wrong. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Steven Storie <sstangle73@gmail.com> * fix: disconnect other remote sessions when privacy mode starts Signed-off-by: fufesou <linlong1266@gmail.com> * fix: exclude privacy disconnect hook from iOS builds Signed-off-by: fufesou <linlong1266@gmail.com> * fix: validate privacy mode before disconnecting other sessions Signed-off-by: fufesou <linlong1266@gmail.com> * chore Signed-off-by: fufesou <linlong1266@gmail.com> --------- Signed-off-by: Steven Storie <sstangle73@gmail.com> Signed-off-by: fufesou <linlong1266@gmail.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: fufesou <linlong1266@gmail.com> |
||
|
fufesou
|
001b0e9617 |
Fix/preserve deleted printer (#16500)
* fix(windows): preserve manually deleted printers Signed-off-by: fufesou <linlong1266@gmail.com> * fix(windows): distinguish printer detection failures Signed-off-by: fufesou <linlong1266@gmail.com> * fix(windows): skip printer detection when disabled Signed-off-by: fufesou <linlong1266@gmail.com> * fix(flutter): load printer status asynchronously Signed-off-by: fufesou <linlong1266@gmail.com> * refactor(flutter): remove printer status mounted checks Signed-off-by: fufesou <linlong1266@gmail.com> * fix(msi): preserve deleted printers in direct upgrades Signed-off-by: fufesou <linlong1266@gmail.com> * fix(windows): preserve deleted printers in silent EXE installs Signed-off-by: fufesou <linlong1266@gmail.com> * fix(windows): skip printer installation when detection fails Signed-off-by: fufesou <linlong1266@gmail.com> * fix(installer): default printer off when detection fails Signed-off-by: fufesou <linlong1266@gmail.com> * fix(printer): limit checked enumeration to presence queries Signed-off-by: fufesou <linlong1266@gmail.com> * fix(installer): allow cancellation during printer detection Inline MSI update command construction without changing its arguments. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(flutter): time out installer printer detection Signed-off-by: fufesou <linlong1266@gmail.com> * chore Signed-off-by: fufesou <linlong1266@gmail.com> * test(windows): cover multilingual install app names Signed-off-by: fufesou <linlong1266@gmail.com> --------- Signed-off-by: fufesou <linlong1266@gmail.com> |
||
|
Hintay
|
0bc2473ffe | fix(drm): size a plane-rotated scanout as the mode transposed (#16444) | ||
|
fufesou
|
3f4bfe535e |
Fix/wayland input keyboard layout (#16462)
* fix(linux): respect Wayland keyboard layouts for uinput Resolve printable keys from GNOME input sources or the Wayland keymap and KDE active layout group. Refresh layout metadata on input at most once per second, and preserve the keycode and owned modifiers until release. Preserve the original Legacy character on client key release and handle Caps Lock shortcuts without introducing an unwanted Shift modifier. Validated with GNOME/KDE full-service input and disconnect checks, plus Windows/Linux native keyboard capture and release checks. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(linux): harden Wayland keyboard layout detection Keep the last usable map on transient discovery failures and preserve the legacy character path when no map is available, with explicit warnings. Retain each injected key representation through release and handle IBus default layout and variant metadata without compiling a layout named default. Use native GNOME and Plasma sources, including KWin sessions without the optional layout service. Read the Xwayland keymap and effective group from the same keyboard on other desktops. Load XCB/XKB libraries dynamically and accept the unix/:N local display spelling. Validation: 24/24 temporary Linux production-module and IPC checks passed, including an actual read-only Xwayland query. The two latest routing/display regressions failed before their fixes. Rustfmt and git diff --check passed. No Cargo/Flutter commands or full remote application tests were rerun. Xwayland state freshness and synchronous desktop I/O remain known limits. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(linux): bound input waits for layout refresh Run throttled Wayland layout discovery in a single background worker and give the triggering input a 25 ms wait budget. Later input uses the existing map without waiting or queuing more queries. Preserve source error handling and skip known Legacy clipboard-only text. Document Xwayland freshness and per-character modifier ownership limits. Desktop calls remain uncancelled; the budget bounds input waiting, subject to OS scheduling. Validation: Linux module compilation with cached dependencies, 23 existing temporary module/IPC checks, and stalled-XCB timing probes passed. Rechecked cache/error/release cases after the final lock-scope change. No permanent regression tests or Cargo/Flutter commands. Signed-off-by: fufesou <linlong1266@gmail.com> * docs(linux): record layout query latency measurements Signed-off-by: fufesou <linlong1266@gmail.com> * fix(linux): reply to failed uinput key state queries Signed-off-by: fufesou <linlong1266@gmail.com> * fix(linux): prefer non-keypad character mappings Signed-off-by: fufesou <linlong1266@gmail.com> * fix(linux): preserve text after unmappable uinput characters Continue processing a text sequence when one character cannot be resolved in the host layout. Return the first mapping error after the supported characters are injected, so the existing throttled log still reports failure. Keep modifier-query, injection and release errors fail-fast. This fixes German a^bc losing bc without adding clipboard or fixed-US fallback. The unsupported caret remains an explicit mapping error. Validation: three temporary Linux checks (nine inputs) passed using the production resolver and sequence methods, real framed IPC and native XKB decoding. The suffix check failed before the fix. Formatting and diff checks passed; no permanent tests, Cargo/Flutter commands or full app build added. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(linux): preserve Latin shortcuts on non-Latin layouts Detect Ctrl/Alt/Meta independently of CapsLock. If the active XKB map lacks an ASCII shortcut letter, reuse the existing physical letter mapping while preserving explicit Shift and the press-time key for release. Existing layout mappings and unsupported ordinary text retain their behavior. Honor disable-uinput-layout-fallback and log this compatibility path with the existing throttle. Validation: 12 temporary Linux production-module/IPC checks passed, including 43 non-Latin shortcut/layout/lock/Shift cases. The new checks failed before the fix. Formatting and git diff --check passed. No real mobile/compositor session or Cargo/Flutter build was run. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(linux): preserve missing punctuation shortcuts Allow missing ASCII graphic shortcuts to reuse the existing physical key table when Ctrl, Alt or Meta is active. This restores Ctrl+[ and Ctrl+] with a valid Russian layout instead of discarding their character events. Retain the table's Shift requirement for punctuation and use existing modifier ownership and press-time release tracking. Uppercase letters do not synthesize Shift. Active-layout mappings, ordinary text errors and disable-uinput-layout-fallback retain their behavior. Validation: 14 temporary Linux production-module/IPC checks passed after recompiling the final source with rustc and cached dependencies. Includes 19 punctuation/lock/Shift combinations and 43 existing Latin-shortcut cases. The two new checks failed before the fix. Formatting and git diff --check passed. No Cargo/Flutter build or real mobile/native Wayland session was run. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(linux): respect held Shift when resolving shortcuts Derive Shift-held candidates from the same XKB keymap and query the caller's Shift state for character shortcuts. On US layouts, Ctrl+Shift+< now uses the comma key instead of the extra ISO key that produces >. Keep caller-held Shift out of synthesized modifier ownership. Preserve ordinary input and letter-shortcut identity, and do not replace an ordinary shortcut with a keypad alias to satisfy the held-Shift lookup. Validation: 16 temporary Linux production-module/IPC checks passed with native XKB event replay and cached dependencies via rustc. Includes 30 US text/shortcut cases and 40 UK/DE/FR character/lock cases. The new Ctrl+Shift+< check failed before the fix. Changed sections pass formatting and git diff --check. No Cargo/Flutter build or real mobile/native Wayland session was run; device-state and packet-modifier handling use fixtures. Signed-off-by: fufesou <linlong1266@gmail.com> * docs(android): document paired-punctuation input limitation Signed-off-by: fufesou <linlong1266@gmail.com> * docs(linux): explain Xwayland layout synchronization limits Document the focus-scoped modifier updates observed on GNOME and KWin. Core and physical X11 keyboards can retain an old layout group while native Wayland windows have focus; reconnecting or waiting cannot request the missing update. Validation: 16 existing module/IPC probes and the live GNOME mapping probe passed. Live KDE queries reproduced native French versus stale Xwayland US. Formatting and diff checks passed. This is a comment-only change; strict Xwayland-only behavior is preserved. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(linux): query native Sway and Hyprland keyboard layouts Read the uinput keyboard's active layout through compositor IPC and validate its group against the native Wayland keymap. Match the IPC server to the Wayland session, and accept numbered Hyprland device names while rejecting ambiguous keyboard selections. Validation: 21 temporary production-module and framed-IPC checks passed. Live Sway US/FR group and a/q mapping checks passed with Xwayland disabled; the GNOME French layout probe also passed. Formatting checks passed. A live Hyprland session and a full application build were not tested. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(linux): defer unverified native compositor layout queries Remove the Sway/Hyprland adapter that paired a uinput device's layout group with a seat keymap based only on matching layout names. Different device options can make a synthesized AltGr key toggle CapsLock instead. Restore the existing best-effort Xwayland source for other desktops and document the device-keymap information missing from the examined native queries. GNOME/KDE discovery and injection/cache behavior are unchanged. Validation: 16 temporary production-module/IPC checks passed after the removal, plus read-only GNOME French and Xwayland mapping checks. Rust formatting and diff checks passed. No full application build or mobile end-to-end test was run for this follow-up. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(linux): reject unreliable GNOME per-window layout sources GNOME restores per-window layouts without persisting MRU. Reject MRU selection when per-window input sources are enabled with multiple sources, and invalidate the cached map and source identity for this typed error. Transient discovery failures still retain the last valid mapping. Reuse the existing logged/disableable compatibility policy. This contains stale-map acceptance; it does not add effective per-window layout discovery. Single-source and global-source GNOME configurations retain their path. Validation: the old code failed the temporary stale-cache regression. All 3 focused production-module checks pass after the fix, covering cache invalidation/recovery, compatibility modes, single/default source mapping, UK punctuation, and last-good retention after an IBus connection failure. Compiled with rustc and cached Linux dependencies; formatting/diff checks passed. No permanent tests, Cargo/Flutter build or mobile session added. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(linux): reject inactive IBus layout sources Read the current GlobalEngine description instead of looking up the persisted MRU engine by name. GNOME can suppress IBus for password entry without updating MRU, leaving the old engine's layout valid but inactive. Report an engine-ID mismatch as UnreliableSource so the existing cache invalidation path drops that mapping. Keep transient query-error handling and layout/variant normalization. Do not infer a US compositor layout from GNOME's xkb:us::eng echo engine. Validation: the old code failed the inactive-engine cache and default-layout checks. All 3 temporary production-module/D-Bus checks pass with this fix, covering invalidation/recovery, compatibility policies, metadata sentinels, query failures and ordinary French XKB selection. Compiled with rustc and cached Linux dependencies; formatting/diff checks pass. No permanent tests, Cargo/Flutter build or live password/mobile session added. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(linux): prewarm uinput layout discovery at startup Start the existing layout worker when the uinput keyboard client connects, before the server accepts remote input. Reuse its throttle and single-worker logic; keep the existing 25 ms input wait and background completion policy. Prewarming reduces cold-start fallback without introducing input queues or promising readiness while a desktop query remains outstanding. Verified with three temporary Linux production-module checks using cached dependencies: a 125 ms query resolves UK @ before first input, a 200 ms outstanding query stays nonblocking and publishes its map, and a failed startup query retries successfully. All three fail their startup assertions before the change. No permanent tests or Cargo/Flutter builds were added. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(linux): preserve first input wait during layout prewarming Keep the startup query's completion receiver until the first relevant input takes it. That input can wait for the already-running query within the existing 25 ms deadline, without holding the receiver handoff lock. Later input remains nonblocking and the existing single-worker guard is unchanged. Prefer a due refresh to an old completed startup notification. Verified with four temporary Linux production-module checks compiled with rustc -C opt-level=3 and cached dependencies: joining a pending UK query, one bounded wait followed by nonblocking input, due refresh after prewarm, and recovery after query failure. Both lost-wait checks fail before the fix. Formatting and git diff --check pass. No permanent tests or full build added. An unoptimized delayed-query probe still exceeded 25 ms and used fallback; this restores the wait opportunity, not an initial-readiness guarantee. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(uinput): remove unnecessary change Signed-off-by: fufesou <linlong1266@gmail.com> * refactor(linux): simplify uinput character releases Release the mapping stored for the same character. Linux character input already pairs down/up events, so opposite-case matching is unnecessary. Validation: git diff --check passed. Static comparisons confirmed that Map-mode dispatch, raw-key injection and keycode offsets match the PR base. No Cargo/Flutter commands or live-session tests were run. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(linux): normalize Unicode CapsLock shortcuts Normalize single-scalar Unicode lowercase for CapsLock shortcuts without adding Shift. For lowercase expansions, resolve the original symbol with the actual CapsLock state instead of truncating it. Document the existing first-seat discovery limitation. Validation: two temporary Rust context checks against lookup fixtures failed before the fix and passed afterward. No Cargo/Flutter build or end-to-end input test was run. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(linux): derive CapsLock shortcut keys from XKB Keep the actual CapsLock state when resolving shortcut characters. Use the existing Caps-off and Caps+Shift mappings to omit generated Shift only when XKB confirms the same physical key and remaining modifiers, preserving the Turkish I/ı and İ/i key identities. Validation: three temporary production-module checks passed on 192.168.5.32 with native libxkbcommon; two failed before this fix. Covered Turkish, German, Cyrillic and ASCII shortcuts, explicit Shift, ordinary text and UK punctuation. No full application build, IPC or end-to-end input test was run. Signed-off-by: fufesou <linlong1266@gmail.com> * refactor(linux): remove CapsLock shortcut special cases Use the existing lock-state synchronization and ordinary XKB mappings for mobile soft-keyboard input. Remove CapsLock-specific shortcut remapping and compatibility-path lowercasing while retaining held-Shift punctuation handling. Validation: rebuilt the Linux Rust library and reused the unchanged Flutter UI. Actual Android Gboard input matched UK punctuation on GNOME and KDE; French/German switching on KDE passed after the refresh interval. The user confirmed real iPad input on both hosts, including smart quotes. Formatting and whitespace checks passed. The optional Ctrl/Shift toolbar automation was inconclusive and is not counted as passing coverage. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(linux): press Level3 before Shift for uinput characters Preserve mapping candidate preference while storing generated modifiers in Level3-before-Shift order. This avoids activating Compose with lv3:ralt_switch_multikey; releases retain their existing reverse order. Verified on Linux with temporary production-mapper/libxkbcommon tests: Lithuanian ! fails before this change and passes afterward; all 24 UK punctuation/lock-state cases pass with released modifiers and unchanged lock state. Formatting and diff checks pass. No full application build or mobile end-to-end test was run for this change. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(linux): preserve legacy uinput IPC without a keymap Send sequences and character clicks through their original IPC messages when the layout cache is unavailable, avoiding unnecessary synchronous key-state queries. Keep throttled fallback warnings and leave layout discovery, retry policy, and key-down/up pairing unchanged. Verified with three temporary production-method checks on Linux using a recording transport and injected query errors. The unavailable-map routing check fails before the fix and passes afterward; raw-click routing and available-map query-error handling remain unchanged. Changed-code formatting and diff checks pass. No full application build or end-to-end input test was run. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(linux): skip layout queries for legacy uinput fallback When no keymap is available, single-character input must use the legacy KeyDown/KeyUp path without querying lock or modifier state first. Retain the legacy key in the existing press record so discovery completing before a repeat or release cannot change the selected representation. Validated with four temporary production-method checks on Linux using a controlled cache/resolver and recording transport: missing-map fallback with query failures, press/release across cache transitions, unchanged raw-key dispatch, and Ctrl+C without extra Shift or queries. The initial fallback check failed before this change. Valid-map errors still surface. Changed-code formatting and git diff --check pass. No full Cargo/Flutter build or live service/mobile test was run for this change. Signed-off-by: fufesou <linlong1266@gmail.com> --------- Signed-off-by: fufesou <linlong1266@gmail.com> |
||
|
NetViperandRustDesk
|
6da7977a94 |
fix(video): defer refresh teardown until hw encoder warms up (#16459)
* fix(video): defer refresh teardown until hw encoder warms up
On macOS, hevc_videotoolbox (the only encoder there reporting
!latency_free()) can return no packet for its first encode call. The
OPTION_REFRESH check in run() tore the encoder down with
bail!("SWITCH") inside that window, so each new encoder was destroyed
before producing a frame and rebuilt about once a second. With H265
selected on macOS 27 / Apple silicon, the picture froze or the session
dropped every 1-3 minutes.
On macOS, once the encoder has been fed a frame, defer the refresh
until it emits its first packet. Before that there is no warm-up to
lose, so a refresh can still restart a stalled capturer. Other
platforms and every latency-free encoder behave as before. An encoder
that never emits is still switched away from by the unchanged
max_fail_times path. The only new state is one flag.
Verified on macOS 27.0 / 27.0.1, M5 Pro, 2560x1440 H265. Soaked for two
weeks on a 1.4.9-based build carrying this deferral:
- before: ~40 "no valid frame" and ~27 refresh teardowns per 60s
- after: 37 sessions, every "no valid frame" at times:1, so
max_fail_times was never approached; H265 never lost
Fixes #16457
Signed-off-by: David Riding <48262524+dmriding@users.noreply.github.com>
* Update video_service.rs
---------
Signed-off-by: David Riding <48262524+dmriding@users.noreply.github.com>
Co-authored-by: RustDesk <71636191+rustdesk@users.noreply.github.com>
|
||
|
fufesou
|
25d2c6db55 |
log key-up and text injection failures (#16455)
* fix(macos): log key-up and text injection failures Report failed key releases through the rdev input path and missing sources, mappings, or events in the Enigo keyboard path. Throttle repeated failures without logging text contents or changing input behavior. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(macos): refine keyboard failure diagnostics Remove key identities from virtual-input and Enigo failure logs while preserving operation and failure details. Also report key-down event creation failures in key_click with the existing throttle, without changing event posting or error propagation. Signed-off-by: fufesou <linlong1266@gmail.com> * refact(logs): update rdev, add diagnostic logs Signed-off-by: fufesou <linlong1266@gmail.com> --------- Signed-off-by: fufesou <linlong1266@gmail.com> |
||
|
Stephan Paternotte
|
f0bd880fe7 |
Update nl.rs (#16485)
lang: Dutch language file updated - various consistency fixes - ... -> … - empty values translated |
||
|
Ricardo Simões
|
a916af8f00 | Translate voice call audio capture prompt to pt-PT (#16482) | ||
|
rustdeskandClaude Fable 5.1
|
9f9585ce15 |
Remove ConfigUpdate handling
Clients no longer apply a rendezvous-server list pushed by the rendezvous server. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PkpVy2ufxgEjKd3SjXPnJ8 |
||
|
Andrzej Rudnik
|
e8a865924b | Updated Polish translation (#16456) | ||
|
memory_clearandfufesou
|
c9c0b5d0ef |
Fix translation for voice call audio capture prompt (#16433)
* Fix translation for voice call audio capture prompt * fix: translation, audio capture prompt, wrong "Share screen" Signed-off-by: fufesou <linlong1266@gmail.com> --------- Signed-off-by: fufesou <linlong1266@gmail.com> Co-authored-by: fufesou <linlong1266@gmail.com> |
||
|
Mariano Abad
|
685fa2e4a1 |
fix(drm): the startup cache warm does not wake sleeping displays (#16437)
* fix(drm): the startup cache warm does not wake sleeping displays
Every `_drm` connection ran the display wake before the service answered with
its list, so the cache warm that each --server start runs (the service restarts
the --server every hour) woke displays that had idled off, with no client
connected (rustdesk#16356).
The --server now opens the handshake with DrmHello{wake}, and the service wakes
and settles only when asked. The warm asks without a wake; the availability
probes, the login refresh and the capture stream keep it, since a client is
waiting for them. Without a wake the service still clears the wake latch of a
connector it sees lit, as the warm did.
A warm that finds nothing lit leaves the cache without a verdict, where its own
wake used to make it Available. So a login that the DRM path can serve now
probes on a missing verdict before anything reads the cache (the greeter check,
the PipeWire prompt, the display list). That probe wakes the displays as the
warm did, but only when a client logs in.
* fix(drm): throttle the log of a peer that does not open with DrmHello
AGENTS.md: a log call that can fire at a rate a peer controls must not use
debug or higher unthrottled. Same 5 s interval as the rejected-IPC logs in
ipc/auth.rs.
* fix(drm): the startup warm keeps a list a login published while it queried
Per review: the warm samples the state generation before its query and
publishes only if no other probe published since, the check the two
background refreshes and the login refresh already use.
* fix(drm): log a failed login settlement task instead of dropping its error
Per review: the JoinError of the blocking task was discarded with `let _ =`.
|
||
|
berce
|
40a4aa34c8 |
Don't retry the _pa ipc at a Linux login screen (#16390)
At a greeter the cm is not started, so the `_pa` socket never exists and the audio service fails to connect and logs an error once per second for as long as a client is connected. Wait in `pa_impl::run` while `is_prelogin()` is true; audio starts once a user logs in. Fixes #16012 |
||
|
|
b6b11fd9b1 |
fix(drm): apply the uinput range on one thread instead of holding a lock across the await (#16362)
* drm: apply the uinput range on one thread instead of holding a lock across the await #16122 serialized the three paths that apply a uinput range in a DRM session (the layout poll, `update_uinput_resolution` and `check_init`) with a tokio Mutex held over the awaited `update_mouse_resolution`, which AGENTS.md rules out ("Do not hold locks across `.await`"; greptile on #16122). The serialization itself has to stay: the uinput service keeps the range of whichever request reached it last and each apply sends it over its own connection, so two overlapping applies can leave the device on one range while the other one is recorded. The check, the apply and what it records now run as one job on a dedicated thread (`run_uinput_apply`), one job at a time in the order asked, with the runtime of that thread for the IPC and its 3 s timeout. The async paths await the answer and the display service loop blocks on it; nothing holds a lock while it waits. The poll publishes its drift flag inside its job, as it did under the lock. A thread that failed to start or died is started again for a later job, so one failure does not stop every later apply (the poll used to build a runtime per attempt and retry). The drm-off build keeps the code it had. Tests (in `input_map_tests`, which CI runs): uinput_applies_run_one_at_a_time_in_the_order_asked, a_uinput_apply_job_can_bound_its_ipc_with_a_timeout, a_uinput_apply_thread_that_died_is_started_again. Mutations: every job on its own thread, the apply runtime without timers, the answer never sent, a dead thread not started again; each turns a test red. The call sites run IPC and are covered by reading. * drm: log a layout poll whose uinput apply job got no answer The layout poll dropped the result of its job with let _ =, so a poll whose job was dropped (the apply thread failed to start or went away) left no trace, while update_uinput_resolution and check_init log it (greptile and CodeRabbit on #16362). It logs now. The drift flag keeps what the last poll that ran published; a later poll starts the thread again and publishes it. * drm: throttle the uinput apply thread failure logs The layout poll hands the apply thread a job every 1.5s, so a thread that cannot start logged two errors per poll for as long as a session lasted. Keep one line per site every 10 minutes, with the count of the rest. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: rustdesk <71636191+rustdesk@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
Cipher Professor
|
d1722c5d6d |
fix(linux): use BUS_VIRTUAL for the virtual mouse device (#16382)
The uinput virtual mouse RustDesk creates on Linux reported bustype BUS_USB. libinput's evdev_tag_external_mouse() tags any BUS_USB or BUS_BLUETOOTH pointer device as an external mouse, so desktop environments' "disable touchpad when an external mouse is present" setting suspends the user's real touchpad whenever RustDesk creates this device, even though nothing is physically plugged in. Changed the constant to BUS_VIRTUAL (0x06, verified against the current upstream kernel's include/uapi/linux/input.h), which correctly identifies this as the software-only device it is. Fixes #16318. Signed-off-by: Mohsin Manzoor Bhat <mohsinmanzoor1913@gmail.com> |
||
|
Mariano Abad
|
0d49ead0c3 |
fix(drm): turn a captured frame only when the plane did not rotate it (#16345)
* fix(drm): turn a captured frame only when the plane did not rotate it A compositor rotates an output either in hardware, setting the primary plane's `rotation` property, or in software, drawing the scanout already turned. `wl_output` cannot tell the two apart, and `frame_transform` guessed: 90/270 turned, 180 left alone, which is right for i915 + mutter (rotate-180 in hardware, scanout upright) and wrong wherever the compositor drew the scanout turned, where 180 comes out upside down. Measured before changing it. virtio-gpu (no rotation property, mutter 46): the scanout dump at 180 is the desktop upside down, at 90 and 270 the logical desktop turned inside the native mode framebuffer. i915 + mutter (GNOME 50) at 180: the plane reports rotate-180 and the dump is upright, identical to the unrotated one. amdgpu + KWin 6 at 180: the plane stays at rotate-0 and the dump is upside down. The producer reads `drmtap_plane_rotation()` (libdrmtap 0.5.8, optional symbol) right after each grab and stamps it on the frame, in the dma-buf descriptor and in the CPU frame header, both `serde(default)` so an older producer still parses. A plane that rotated scans out the logical desktop whatever the output transform says: the compositor programs it from the CRTC transform, which also folds in the connector's panel orientation that `wl_output` never carries, so the consumer leaves such a frame alone. A plane at rotate-0 scanned out what the compositor drew, and the frame is turned by the whole output transform. `None` (a library before 0.5.8, or nothing it could read) keeps the previous rule, so nothing changes until the library says otherwise. The session is still sized from the output transform: a plane that rotated 90 in hardware hands over the portrait scanout those dims already name. * build: pin libdrmtap 0.5.8 (rustdesk-org/libdrmtap 95d4d7454) The rotation fix reads drmtap_plane_rotation(), added in libdrmtap 0.5.8. The mirror carries that commit since 2026-09-25, so the pin moves there. * drm: pin the decoding of a frame from a producer older than the plane rotation The root service and the --server are upgraded separately, so a frame header or a dma-buf descriptor without `plane_rotation` must still decode, as None, which keeps the previous rule. The tests built both messages with the field set to None; this one decodes payloads that omit it, and one that carries it (greptile on #16345). Serde already reads a missing Option as None, so what the test pins is the wire name and the None on absence, for both messages. Mutation: renaming the field on the wire, in either message, turns it red. * drm: take the plane rotation right after the grab, not after the copies `drmtap_plane_rotation()` reads the rotation property of the plane the last grab came from at the moment it is called. The cpu path asked only after `DrmReader::grab()` had copied the frame into its buffer and the producer had copied it again into the message, so on a large frame the compositor had time to change the plane and the frame went out with the rotation of the next one; `frame_transform` turns that frame by it with nothing to absorb the skew (zhou, review of 26-sep). `DrmReader` now reads the rotation right after a successful `drmtap_grab_mapped` or `drmtap_grab_desc`, before any copy or release, and `plane_rotation()` returns that snapshot, so both paths stamp a frame with the rotation its own grab saw. Test: a_frame_keeps_the_rotation_its_plane_had_when_it_was_grabbed, in `plane_rotation_tests` (which CI already runs), drives the reader through a fake library whose frame release turns the plane: the rotation read at the grab survives on the cpu grab and on the dma-buf export. Mutations: no snapshot on the cpu grab, none on the export, and the cpu snapshot taken after the release, each turn it red. |
||
|
flusheDData
|
be9b96cf65 | Translate voice call instruction to Spanish (#16358) | ||
|
Winston
|
b5d8b979d8 |
i18n(tw): use the Screen Share page label in the voice call hint (#16355)
The hint referenced the "Screen share" page as 「螢幕分享」, but the actual Traditional Chinese label of that page is 「僅分享螢幕畫面」 (the value of the "Screen Share" key). Match it, as zh-CN does with "仅共享屏幕". Signed-off-by: Mosquito1123 <zhangwentong1123@icloud.com> |
||
|
Mariano Abad
|
50258e21e9 |
fix(drm): measure the cursor hotspot on drivers without HOTSPOT_X/Y, confirm before publishing (#16122)
* drm: carry the cursor plane position on the frame header
CursorSnapshot gains the plane position x/y. It rides DmabufDesc.cursor_pos
and Data::DrmFrame.cursor_pos as a serde-default Option, so a producer that
predates the field reads as None on the consumer, and a consumer that predates
it ignores the key. The producer reads the cursor once per delivered frame,
after the grab, so a WouldBlock retry does no cursor work; the position is a
few ms newer than the frame, which the consumer tolerates because it only
counts consecutive identical positions. The consumer destructures the field
and does not use it yet.
* input: remember the last absolute peer move and forget it on any other move
The DRM cursor calibration subtracts a cursor plane origin from the point this
process injected, so the point has to be the post-remap uinput one and nothing
else: LATEST_PEER_INPUT_CURSOR stores an X-server coordinate on the relative
arm. The new sample carries an Instant, a sequence number (two measurements
against one sample are not independent) and the layout generation it was
mapped against. A relative delta and a move this process makes itself forget
it. display_service exposes the existing drift flag to readers.
* drm: resolve the cursor calibration context once, with the capturer
CalContext { rect, physical_size, built_gen } is computed in
IpcDrmCapturer::new from the same wayland snapshot the transform comes from,
and only when the snapshot is complete, the output is an identity match, the
unfolded transform is 0 (180 included) and the geometry is valid. It is
stored in Shared before the transform's Release store, so a receive thread
that has seen the transform sees the context. Nothing reads it yet.
* drm: measure the cursor hotspot and confirm it before publishing
On a driver without HOTSPOT_X/Y the wire carries infer_hotspot's guess, which
the bitmap cannot get right for a shape whose click point the theme put where
the alpha does not mark it. This process injects the tip and the plane origin
rides every frame: once both are still, tip - origin is the hotspot.
Only a guessed shape is measured. The first measurement is a candidate and
changes nothing visible. A second measurement confirms it only from another
stable plane position and another peer sample, and then the retained
candidate is the one value that reaches the cache, the served hotspot, the id
remix and the delivery. Near what is served, nothing changes, even when the
value is also near the wire, so a correction a few px from the wire does not
flap; near the wire otherwise, the wire is served and the cached correction is
dropped. A stable position is measured at most once, a layout generation
change stops measurement once the display service's poll has seen it, and the
cache is read only behind the context gate, so a correction measured upright
never reaches a rotated output.
Each of these gates has a test that goes red with the check removed or
altered (file restored byte for byte afterwards):
publish the first measurement -> retained candidate, same sample, still plane, local nudge
same sample confirms -> same sample never confirms, local nudge
confirm with the new value -> retained candidate, near wire, in band
drop the near-wire arm -> near wire serves the wire
drop the in-band arm -> in band changes nothing visible
drop the re-store after clear-on-cap -> in band stays cached
measure a kernel-measured hotspot -> never calibrated at the origin
read the cache without a context -> not served without a context
drop the once-per-position flag -> still plane measured once
drop the transform gate -> context only for an upright output
swap phys and extent -> the arithmetic, the scaled context
drop the clear-on-cap -> cache bounded
drop the partial-snapshot gate -> context only for an identity match
drop the generation check -> closed intervals
compare the wire before the served -> in band with both keeps the served correction
* drm: a cached hotspot correction is served only under the generation it was confirmed in
The calibration cache mapped a wire cursor id to its confirmed hotspot
and nothing else. A pair of stops taken inside the layout poll window,
after a monitor moved and before the poll saw it, could confirm a value
measured against the old layout; the generation gate then stopped that
stream, but the capturer rebuilt after the promotion seeded its served
hotspot from the cache and replayed the value under the new layout, until
another pair of its own replaced it (zhou, review of 25-sep).
Each entry now carries the layout generation it was confirmed under, and
a stream reads the cache under its own `built_gen` only: a value from
another generation is not served, the wire hotspot is, until a pair on
this generation confirms one. Checked at the read rather than by clearing
on promotion, and an entry is replaced or dropped only by its own
generation or a newer one, the bound included (at the cap the cache
clears what the writer's generation or an older one confirmed, and
caches nothing if only newer entries are left), so a receive thread
still running on the old layout can neither serve its value to the
rebuilt stream nor undo the value that stream confirmed.
Tests: a_correction_confirmed_under_an_older_generation_is_not_served (two
stops under one generation, the stream rebuilt under the next, its own
pair, then the old stream writing late),
the_bound_never_drops_an_entry_from_a_newer_generation. Mutations:
reading without the generation filter, replacing or dropping a newer
entry from an older generation, and at the cap either clearing
everything or caching when only newer entries are left, each turn one
of them red.
* drm: calibrate only against samples injected under the layout's adopted uinput range
`usable_sample` took the remap flag being clear as "the input mapping is
ready". It is not: the display service bumps the layout generation and
promotes the baseline before the uinput range update completes, and a
failed or pending update leaves the device mapping absolute coordinates
with the range of the previous layout. Every sample then carries the new
generation while its point lands scaled by the old range; two stops share
that error and agreement confirms it (zhou, review of 25-sep: a desktop
narrowed from 4000 to 3800 px puts a hotx of 4 at 54, inside the bitmap).
The display service now keeps the layout generation whose uinput range
the device runs, and a count, raised when an apply starts and again when
the device acknowledges it. Both move when `update_mouse_resolution`
returns Ok, on the DRM session-init path (also run by the hotplug
worker) and in the layout poll; the session-init path labels the range
with the generation read before it computed the rect, and the raw DRM
union it falls back to when the compositor cannot be asked with no
generation, so no stream measures on it until the poll applies or finds
a compositor range. A range that already fits the layout moves the
generation only, so the samples injected under it stay valid. From the
moment an apply starts, on any path, no generation is ready, the count
is raised and the recorded rect is forgotten, so an apply that fails or
times out (the device may still take the range late) leaves nothing
ready, and only an acknowledged apply records a generation again. The
poll and `update_uinput_resolution` run on different threads; they
check, apply and record under one lock. `check_init`, which a display
falling back to PipeWire runs inside a DRM session, records its apply
the same way (cfg(feature = "drm") lines only; the drm-off build is
unchanged). It has no fits check and applies on every run, as before, so
each run moves the count. A path that read its generation before the
poll bumped it records under the older one; no stream measures then
until a later layout check records the current one. A sample is stamped
under the ENIGO guard of its move, which an adoption also needs for its
refresh, so a move stamped with the count of an adoption was injected
after that adoption's refresh. The count is raised before the generation
is published and read after it. A stream measures only while that
generation is its own; each peer sample carries the count at injection
and is a reference only under the current one; a candidate measured
under one count starts over instead of confirming under the next. The
remap flag is untouched.
Tests: a_stale_input_mapping_publishes_nothing_until_fresh_samples_follow_the_adoption
(generations equal, no drift, the device on the previous range: two
stops publish and cache nothing; after the adoption a sample from before
it does not count, and fresh ones confirm),
a_sample_is_a_reference_only_under_the_adopted_input_mapping,
a_candidate_does_not_confirm_across_an_input_mapping_change,
an_acknowledged_range_is_an_adoption_and_a_fitting_one_is_not,
the_raw_drm_union_labels_a_range_with_no_generation,
an_apply_leaves_no_range_ready_until_it_is_acknowledged; the drm CI step runs
input_map_tests. Mutations: dropping the adopted-generation gate,
dropping the count gate, confirming across counts, an adoption that does
not count, a fitting range that counts, the union labelled with the
generation, and an apply that keeps the recorded rect or leaves a
generation ready, each turn one of them red. The call sites (the lock,
the calls before and after each apply on the three paths, the range-fits
branches) run IPC and are covered by reading.
* drm: forget the peer sample under the mouse lock on a move of this process
The temporary-move thread (the display probe `fill_displays` runs in the
PipeWire init, `check_init`) forgot the last absolute peer sample before
it took ENIGO. A peer move holding ENIGO at that moment moved the pointer
and recorded its sample after the forget, and the temporary move then
landed on top: the pointer somewhere else, the sample still the peer
point, with the current generation, count and a fresh sequence, so two
such overlaps could confirm a wrong hotspot (zhou, review of
|
||
|
Winston
|
47a2a3c83d |
i18n(tw): fill missing Traditional Chinese translations (#16353)
Fill the three empty entries in src/lang/tw.rs, mirroring the existing zh-CN (cn.rs) translations and reusing the terminology already used elsewhere in the file: - terminal-clipboard-write-tip - Allow terminal apps to copy to clipboard - To start a voice call, enable "Audio capture" on the "Screen share" page. Signed-off-by: Mosquito1123 <zhangwentong1123@icloud.com> |
||
|
RustDeskandClaude Opus 5.5
|
08affc69c4 |
Fix clipboard range overflow (#16329)
* fix(clipboard): unix file server, bound range reads The Range request fields nPositionLow and cbRequested are UINT32s carried in i32 fields, but were sign-extended to u64. A negative cbRequested became a near-u64::MAX length, `offset + length` wrapped past the clamp, and the server tried to allocate a u64::MAX buffer, aborting the process. Sign-extending nPositionLow also rejected offsets whose low word is >= 2 GiB, breaking reads past 2 GiB in large files. - decode nPositionLow and cbRequested as u32 - clamp with `length > file.size - offset` (offset <= size is checked above) - allocate the read buffer fallibly and return an error instead of aborting Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(enigo): win, scale absolute mouse moves without overflow mouse_move_to multiplied the peer-supplied coordinate by 65535 in i32, which overflows for large values, and divided by the virtual screen size, which panics if the metrics come back as 0. Scale in i64, clamp to i32, and skip the move when the virtual screen size is unavailable. Results for inputs that did not overflow are unchanged. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * docs(agents): avoid unthrottled high-frequency debug logs Debug output is written to the log file, so per-packet / per-event log sites must use trace or hbb_common's throttled_log!. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(clipboard): unix file server, reject range reads over the frame limit A response larger than MAX_FRAME_LENGTH (1 GiB) cannot be encoded for sending, yet the server allocated and read it first, then failed the send. Reject such requests before allocating, so a peer can no longer make the server allocate more than 1 GiB per request. Requests that work today are unaffected. Drop the extra allocation-failure log; the caller already logs the error. Tests cover the wire decoding through read_file_contents (negative cbRequested, nPositionLow past 2 GiB) and the frame-limit rejection. Tests that use the global CLIP_FILES now take a shared lock. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(clipboard): keep file transfers on the file list they started from A file-contents request names a file only by its index, and the side that owns the files resolved it against whatever it held at that moment. On Windows 10+ Explorer's clipboard also offers FileContents, which the owner re-read from the live clipboard for every chunk, so copying another file mid-transfer spliced the new file into the one being pasted (#16332). A second paste, or another connection's paste, replaced the list the same way, and on macOS/Linux sync_files replaced CLIP_FILES on every host copy. Each request now names its list in the existing clip_data_id field: an FNV-1a hash of the file-descriptor PDU, which both sides already hold. Owners keep the last 4 lists they sent and serve a request from the list it names; an unknown id fails instead of reading another file. Peers that send no id read the list last sent to their connection, and a Windows owner stops reading the live clipboard once it has changed since the list was built. Tests cover a host copy and a second paste during a transfer, a list id sent to another connection, and the hash's reference vectors. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(clipboard): unix file server, cap a single range read at 16 MiB A peer could still make the server allocate and read up to the 1 GiB frame limit per request. Cap the data a single range read returns at 16 MiB. The read is clamped to the rest of the file first, and a larger one is refused rather than shortened: a short response reads as end of file to IStream callers on Windows and would silently truncate the copy. macOS requests 4 MiB per range (BLOCK_SIZE) and FUSE reads are smaller. A Windows client forwards the application's IStream::Read size, so only an application reading more than 16 MiB in one call is affected. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(enigo): win, warn (throttled) when a mouse move is skipped A missing virtual screen size is a fault that should show up in a user's log, but mouse_move_to runs per input event. Log it at warn at most once a minute via throttled_log! instead of at trace. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(clipboard): review fixes for the file lists kept per transfer unix owner: - A retired list closes its files and 8 MiB read buffers; they reopen, from offset 0, on the next read. - The new list is built aside and swapped in only on success, so a failed rebuild leaves the current list in place. - A rebuild with an unchanged id keeps its peers on the new list instead of retiring a duplicate, so re-copying a directory no longer pushes out a list that a transfer is still reading. Windows: - One served-list slot per list, recording every connection it was sent to, so pastes of the same list do not use up slots. - A request for an earlier list is served before OleGetClipboard, so a busy clipboard cannot fail it. - An IStream read over 16 MiB is split into requests the unix file server accepts. Reads up to 16 MiB take the unchanged path. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(clipboard): give each copied file list its own id The list id hashed only the descriptors, so two copies with identical names, sizes and times (the same file in two folders) shared an id and a transfer could read the other copy's files. Each owner now writes a random nonce into the first descriptor's clsid, inside the reserved bytes every peer skips; no owner sets FD_CLSID. The paste side hashes what it received, so it needs no change, and older peers ignore the bytes. Re-sending the same paths with the same descriptors keeps the nonce, and the id. Windows owner: - Serve a request from its list before the ownership check when the list is no longer current or the host clipboard now holds files from a peer, so another controller copying onto the host no longer fails in-flight transfers. Only lists sent to that connection are served. - Evict the list sent least recently instead of in insertion order. unix owner: take everything from the crate in one use block. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(clipboard,enigo): bound served-list reads, clamp absolute moves wf_cliprdr: the served-list branch runs before the ownership check, yet it allocated the peer's cbRequested (up to 4 GiB) before looking the list up. Accept only FILECONTENTS_SIZE or a range of at most 16 MiB there, which is all that clients sending an id ever request, and fail anything else before allocating. enigo: clamp the scaled absolute coordinate to 0..=65535, the range MOUSEEVENTF_ABSOLUTE takes, instead of to the i32 range. Coordinates on the virtual desktop give the same result as before; off-desktop ones now land on its edge. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(clipboard): keep a file list while it is being read, throttle read errors A unix paste side fetches every new file list as soon as the host copies, so each copy retires the previous list, and four copies during one long transfer evicted the list it was still reading. A kept list that serves a read now becomes the most recent (unix: back of the retired queue, Windows: last_served), so the next eviction takes a list nobody is reading. A failed file-contents read logged an error per request, and peers can now trigger new ones (an unknown list id, an over-limit range). Log it through throttled_log! instead. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(clipboard): unix, keep retired lists in the order they were sent A peer that sends no list id is served the list last sent to its connection, found by searching the retired queue from the back. That only holds while the queue stays in retirement order, which is the order lists were sent. The previous commit moved a list to the back on every read, so another connection reading an older list could make a peer's next chunk come from that list: a transfer of B continued with A's bytes. Keep the queue in retirement order and track recency in a separate last_used stamp, set on retirement and on each read. A full queue evicts the list with the lowest stamp, so a list still being read is kept. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(clipboard): unix, keep files being read open when their list is retired Retiring a list closed every file handle, so the next read of a file part-way through reopened it by path. If that path had been replaced meanwhile (an editor saving over it), the rest of the transfer came from the replacement: AAAABBBB arrived as AAAADDDD. Close only files that are not being read, such as the preloaded next file; a file part-way through keeps its handle and offset, and so its identity. Tests read two files of one list alternately, retire the list, replace both paths by rename, and check each file continues with its original bytes. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(clipboard): cap Windows ranges, expire idle kept lists, check file identity Windows owner: refuse every FILECONTENTS_RANGE over 16 MiB before allocating. Only the served-list branch was capped; requests without an id still allocated whatever the peer asked for, up to 4 GiB. Both owners: a kept (retired / non-current) file list that nobody has read for 5 minutes is dropped, with its open files; its transfer is over or its peer gone. The current list never expires, as before. On Windows, reads of the current list through the existing path now also refresh its kept copy, so a long transfer does not lose its list once a newer one is sent. Windows owner: old-list reads compare the file's size and last-write time with the descriptor that was sent, on the handle they read from, and fail on a mismatch instead of reading whatever file now has that path. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * test(clipboard): unix, check list expiry without backdating an Instant an_idle_retired_list_expires backdated a timestamp with Instant::now().checked_sub(TTL + 1s), which is None while the monotonic clock is under about five minutes, as on a freshly booted CI machine; the list then never expired and the test failed. expire_retired now takes the current time, and the test passes a later one instead. Callers pass Instant::now(), so behavior is unchanged. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(clipboard): drop read-time refresh, idle expiry and rebuild reuse; tighten checks Remove the read-time recency and the 5-minute idle expiry on both owners, and the unix reuse of an unchanged rebuild (has_same_files). They covered corner cases, added state, and each brought regressions of its own. Kept lists are again evicted oldest first (unix) or least recently sent (Windows), 4 at most; a transfer that outlives 4 newer lists fails cleanly. Windows: serve kept lists after the existing ownership check again, so a request carrying a list id no longer bypasses it while the host clipboard holds files from another session. Refuse request types other than size or range before allocating. unix: a retired list's file must still match the size and modified time it was listed with, checked on the handle the read uses; a file replaced at its path before its read now fails instead of being served. Tests: drop the four tests of the removed behavior, add a_retired_list_refuses_a_file_replaced_before_its_read. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * docs(agents): handle corner cases raised in review with small fixes or docs A refactor added to cover a corner case rarely converges: new counters, timestamps and expiry rules interact with state existing code relies on, and the next review round finds the problems they introduced. Fix a corner case when the fix is a few lines with no new state; otherwise document it as a known limit, and ask before anything larger. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> |