X2Go Client (4.1.2.2) released

Dear all

The X2Go project is proud to announce a new release of the X2Go component ,,x2goclient''.

New gains of this version of ,,x2goclient'' are:

o more client-broker interaction (new events sent to the broker side) o experimental X2Go KDrive support o crash fix for the automount feature o failing to spawn PulseAudio on Windows does not spawn a warning message any longer if sound support has been globally deactivated o compatibility with Qt 5.11+ o cleanly build with newer libssh versions (libssh_threads removal) o automatic UNIX helper bypass when starting X2Go Client with command line parameters that will let it (almost) immediately exit. No more killing of subprocesses when running x2goclient --help, yay! o new options --libssh-debug (info/protocol log level) and --libssh-packetlog (debug/packet loglevel). BOTH OF THEM MIGHT REVEAL PASSWORDS, SO USE WITH EXTREME CARE! o new option --bypass-cleanup-helper - can be used to completely bypass the UNIX cleanup helper o fix sftp-server location scanning for Gentoo 17.1 profiles without a compat symlink o accept direct IPv6 addresses in proxy fields. Previously such input was parsed as "host:port:" and failed miserably. o stop reacting twice to tray icon button clicks on macOS. Every tray icon click is registered as a left click on that platform and a right click can't be distinguished. No other application tries to differentiate (because it isn't possible), so X2Go Client was actually buggy in this regard. o make internal scp calls compatible with newer libssh versions and those with fixes for CVE-2019-14889 backported. This has the drawback that we can't scp files into other user's home directories easily any longer, but libssh will keep interpreting the path literally so there's nothing sensible we could do about this (other than looking up home directories in a complicated manner via other tools). Since we don't need to do this (currently), just live with that limitation. o fix an image corruption bug (seen upon resizing etc.) in custom SVGFrame widgets o disable PulseAudio autospawning in X2Go config file, thanks to Ville Salmela. Less spam in system logs for disconnected sessions! o in the Qt5 code path, actually search for "sftp-server", not "sftp-binary". Oops. o updated translations o updated macOS builds to use PulseAudio 13.0 o updated copyright notices o now requires pkgconfig as a build dependency o add sftp-server binary path support for the default NixOS location o renamed shadow session type label to "X2Go/X11 Desktop Sharing" o document --broker-name in man page o rename XFreeRDP radio button labels to more accurate pre-2.0 and post-2.0 versions o new Czech translation thanks to Tom Ruzicka o correctly close channels on failures during checkLogin () thanks to Ulrich Sibiller o specifying an exclamation character ("!") at the start of host specifications will make X2Go Client skip login/interaction checks completely thanks to Ulrich Sibiller. "!" was chosen because it is not a valid DNS or alias name part. Can be used for both proxies and host endpoints.

Known issues:

o The X2Go KDrive support will currently work on Debian-based systems that include packages for x2gokdriveclient. No RPM-based distributions, no Windows support, no macOS support yet. o Our upstream builds are STILL fully Qt4-based. There will be no release builds for Debian Bullseye due to this.

X2Go Component: x2goclient Version: 4.1.2.2 Status: RELEASE Timestamp: 1581543720 Date: Wed, 12 Feb 2020 22:42:00 +0100 Fixes these bug report(s): 1307 1320 1393 1418 1425 1428 Changes: x2goclient (4.1.2.2) RELEASED; urgency=medium . [ Oleksandr Shneyder ]

• New upstream version (4.1.2.2):
  • Add SSH instruction to list of errors if keyboard-interactive auth has failed.
  • Add new brocker feature. Broker can send to client some configuration in the section START_CLIENT_CONFIG - END_CLIENT_CONFIG. For the moment is supported option events=bool. If true, client sending to broker events: CONNECTING, CONNECTED, SUSPENDING, TERMINATING, FINISHED. It's not a real session state, but rather the state of X2Go Client.
  • Save session command in resumingSession.command.
  • Send in broker event the duration of session on client.
  • If client is configured to send events, the broker can ask client to send ALIVE events. To do this, broker should send config option "liveevent" (int). It means, if liveevent=10, client will send ALIVE event to broker every 10 seconds when the client connected to X2Go Session.
  • Broker can send to client command to suspend or terminate the session as an answer to the client event message. For this broker should send to client SUSPEND ID or TERMINATE ID.
  • Client now sends "login" parameter to the broker when executing task "selectsession". Before client just sent a username on the broker and it was imposiible to find out user name on X2Go server, which is not always the same as broker username. This won't break a compatibility with previous broker as they just will ignore this parameter.
  • X2Gokdrive support for X2GoClient.
  • Fix authentification on http broker when sending event.
  • Fix resuming sessions on multiple servers.
  • Initializing sessionId, command and display for direct RDP to complay with standard sessions.
  • Direct RDP sesion send to broker event CONNECTED instead of CONNECTING at start of RDP client.
  • Fixing setting correct session command when resuming the session.
  • Don't exit if sending event to http broker has failed.
  • If using x2go broker and ssh proxy check for the option "usebrokeruserforproxy" in the session file. If it's "true", use the same username for the proxy as broker login.
  • Broker can send to client the number of suspended and running sessions for each session type. Client will display this information to user on session button.
  • update copyright years in about dialog.
  • Do not show password in debug output of HTTP broker.
  • Fix crashing if the path for automount in the session config file in wrong format. Supporting both Windows and Linux path in automount format. Check if path exists before mounting.
  • Do not show Pulseaudio warning on Windows, if Pulseaudio is disabled in settings or by command line.
  • Improve request handling in HTTP broker.
  • Add possibility to suspend and terminate sessions from session selection dialog in broker mode.
  • Do not delete session from list if terminating of session is canceled. . [ Mihai Moldovan ]
• New upstream version (4.1.2.2):
  • src/printwidget.cpp: add QButtonGroup include, fixes compile errors with Qt 5.11+. Fixes: #1307.
  • macbuild.sh: switch to bundling PulseAudio 12.1 since it's now available in MacPorts.
  • x2goclient.pro: detect libssh and libssh_threads via pkgconfig on UNIX-based platforms. libssh_threads is optional if the libssh version is high enough.
  • x2goclient.pro: let static Linux configuration override the new pkgconfig-based libssh usage.
  • x2goclient.pro: make system a non-variable call.
  • x2goclient.pro: fix qmake control flow for libssh logic, we really wanted to use else if for the Windows section and have the general else section being the general fallback.
  • x2goclient.pro: fix quoting issue in system() call. Qmake's quoting rules are really weird.
  • macbuild.sh: switch to bundling PulseAudio 12.2 since it's now available in MacPorts.
  • res/i18n/x2goclient_cs.ts: whitespace and other fixups.
  • src/x2goclient.cpp: change HTTP to HTTPS links where needed.
  • src/x2goclient.cpp: do not spawn UNIX cleanup helper if arguments that let X2Go Client terminate right away have been passed. More work is needed here, but that should cover the most basic bits.
  • src/onmainwindow.{cpp,h}: remove left-over references to agentCheckTimer and slotCheckAgentProcess ().
  • src/onmainwindow.cpp: fix various broken qCritical () calls.
  • src/{onmainwindow.{cpp,h},{sshmasterconnection,help}.cpp}: let users control libssh debugging via the new parameters --libssh-debug and --libssh-packetlog. Properly document the new switches and their implications.
  • src/sshmasterconnection.cpp: drop DEBUG preprocessor conditional blocks. We have never actually disabled it and x2goDebug () will not write out anything if debugging has not been requested, so we already have a soft condition check for every x2goDebug () call.
  • src/x2goclient.cpp: do not use std::array since that's a C++11 feature, just live with plain C arrays for now.
  • x2goclient.pro: fix libssh_threads logic again. Ubuntu Bionic/18.04 ships a pre-release version of 0.8.0, which is tagged as that version, but really based upon 0.7.x and still has/needs a libssh_threads library. Big "Wat?" to you, Canonical. Fixes: #1320.
  • src/x2goclient.cpp: fix array length calculation.
  • Windows: Update PuTTY from 0.70 to 0.71. Fixes quite a list of issues discovered through the EU-funded bug bounty programme. Not all are relevant to X2Go Client.
  • Windows: upgrade bundled VcXsrv to 1.20.1.4.
  • src/sshmasterconnection.cpp: use info (protocol) log level with --libssh-debug and debug (packet) log level with --libssh-packetlog.
  • src/sshmasterconnection.cpp: fix compiler warning due to mismatching argument with older libssh versions.
  • Makefile: clear out LDFLAGS, add new (cleared) LIBS variable and pass down as QMAKE_LIBS. The previous behavior was leading to compile failures on arm64 machines (albeit only old distro versions, apparently), because QMAKE_LFLAGS is being put on the command line *before* the actual object files to be included/linked, which is an error for system libraries. Builds will still fail after this commit, but that's okay.
  • x2goclient.pro: add libraries that we always want to use on Linux correctly to LIBS and use a bigger catch clause. That should work much better, since linux-g++ and linux-g++-64 are x86-specific, while there are way more potentially useful targets like linux-aarch64-gnu-g++, clang, llvm, icc etc.
  • x2goclient.pro: while a linux scope seems to work fine with Qt5, Qt4 doesn't recognize that, so add another linux-* catch.
  • Windows: add support for x3270-fonts, including adding a pretty nasty but necessary fonts.* file regeneration hook.
  • {x2goclient,help,onmainwindow}.cpp: implement new --bypass-cleanup-helper parameter.
  • src/onmainwindow.cpp: fix building with Qt 4.6, currently the latest version available in EPEL 6.
  • src/onmainwindow.cpp: unbreak builds by fixing syntax error.
  • src/onmainwindow.cpp: also unbreak old EPEL 6 builds.
  • src/onmainwindow.cpp: add (and prefer) non-compat-symlink scp server location for 64-bit-based Gentoo distros (17.1+ profiles). Fixes: #1393.
  • res/i18n/x2goclient_*.ts: replace changed source strings, no retranslations required.
  • src/httpbrokerclient.cpp: do not leak password length in debug output either.
  • src/sessionwidget.cpp: stop parsing proxy address as "host:port: if the address contains a colon. Fixes: #1418. We don't do this for the "normal" host address and this behavior clashes with IPv6 addresses. We COULD, theoretically, keep it, but that would require writing an arbitrary address parser. Too much effort for little gain.
  • src/onmainwindow.cpp: also remove proxy "host:port" parsing at connect time. Fixes: #1418.
  • macbuild.sh: switch to bundling PulseAudio 13.0 since it's now available in MacPorts.
  • src/onmainwindow.cpp: disable "left click" action on OS X/macOS. This platform always gets a left click event, even when right clicked. May sound weird first, but this behavior is consistent between all applications - tray icons can be clicked via either button and will always trigger a context menu. Let X2Go Client behave the same way.
  • src/sshprocess.cpp: strip ~/, ~user{,/}, ${HOME}{,/} and $HOME{,/} from destination paths in scp mode. Fixes: #1428. This was already necessary for pascp (PuTTY-based Windows solution for Kerberos support), but newer libssh versions with the CVE-2019-14889 also interpret paths as literal strings.
  • src/SVGFrame.cpp: simplify implementation a lot. Only paint data onto the widget in the paintEvent () function. Drop setting a palette based upon the rendered SVG image, which has been very wrong to do from the beginning and only lead to visual glitches. Correctly repaint single-frame SVG files.
  • src/sshmasterconnection.cpp: work around lupdate warning by adding another block in the #else preprocessor branch.
  • res/i18n/x2goclient_*.ts: update translation files.
  • Windows: Update PuTTY from 0.71 to 0.73. Fixes another round of issues discovered through the EU-funded bug bounty programme and other security problems.
  • src/onmainwindow.cpp: stop PulseAudio from spamming logs after a client disconnects. Fixes: #1425. Patch based on one submitted by Ville Salmela.
  • src/onmainwindow.cpp: instead of searching for "sftp-binary", try to look for "sftp-server" in the Qt 5.x code path. Luckily this only affects cases where we bundle sftp-server (which we don't) or where sftp-server is actually part of $PATH (which it usually shouldn't be).
  • Windows: upgrade bundled VcXsrv to 1.20.6.0.
  • Windows: upgrade PulseAudio from 7.1 to 13.0.
  • Windows: remove libz. Was previously used by libzip, which has not been shipped for quite some time.
  • Windows: Update Win32 OpenSSL from 1.0.2n to 1.0.2u. Implicit.
  • Windows: Upgrade libssh from 0.7.4 to 0.9.3 (while maintaining Pageant support). Drop libssh_threads library not provided (or used) any longer.
  • x2goclient.pro: update comment mentioning that libssh does not provide pkgconfig files on non-UNIX/Windows platforms any longer and drop libssh_thread linkage.
  • res/i18n/x2goclient_nl.ts: add missing singular form to a multi-form entry.
  • res/i18n/x2goclient_cs.ts: fix up whitespace and mark actually finished translation string as such, also removing my previous comment.
  • res/i18n/x2goclient_nb_no.ts: fix up whitespace and typos.
  • res/i18n/x2goclient_de.ts: better translate UNIX cleanup helper and fix "X2Go Client" as "X2GoClient" globally.
  • misc: pre-release copyright update.
  • src/onmainwindow.cpp: update in-code copyright notice.
  • res/i18n/x2goclient_*.ts: update copyright notice in about dialog manually.
  • src/onmainwindow.cpp: add comment for translators encouraging them to add themselves to copyright notice.
  • res/i18n/x2goclient_*.ts: update after source code changes and comment addition.
  • res/i18n/x2goclient_*.ts: mark copyright translation string as unfinished for already translated languages (but Finnish) to alert translators of the new comment.
  • man/man1/x2goclient.1: pre-release date update.
• debian/control:
  • Add build-depend on pkg-config.
• x2goclient.spec:
  • Build-depend on pkg-config.
  • EPEL packages need to depend upon pkgconfig for now, not pkg-config.
  • Pull in redhat-rpm-config manually. This should probably be done by something else, like... gcc or qmake or qt(4)-dev, but it isn't.
  • Try to ignore gettext-tools-mini on *SuSE to force installation of the new/renamed gettext-runtime-mini package.
  • It's %endif, not %fi.
  • Revert the gettext-tools-mini change, was caused by an outdated obs-build version. . [ Mike Gabriel ]
• New upstream version (4.1.2.2):
  • Add support for Nix OS for common_sftp_dirs's hard-coded sftp-server paths.
  • src/sessionwidget.cpp: Rename shadowing sessiontype to 'X2Go/X11 Desktop Sharing'.
  • man/man1/x2goclient.1: Add explanation for the --broker-name option.
  • res/resources.qrc: Add Czech translation file.
  • Update qt_<lang>.qm files from Qt5 v5.11.2.
  • Rename radion button lables for xfreerdp options' style.
• debian/control:
  • In x2goclient R, prefer freerdp2-x11 over rdesktop over freerdp-x11 (which is broken these days anyway).
  • In x2goclient D, add x2gokdriveclient.
  • In x2goclient D, add hello as an alternative to x2gokdriveclient. Works around non-available x2gokdriveclient on Debian jessie. . [ Tom Ruzicka ]
• New upstream release (4.1.2.2):
  • Add new translation: Czech.
  • Second update round of Czech translation + enable it in x2goclient.pro. . [ Ulrich Sibiller ]
• New upstream release (4.1.2.2):
  • src/sshmasterconnection.cpp: close channel on failure in checkLogin ().
  • src/sshmasterconnection.{cpp,h}: skip checkLogin() if hostname starts with "!". Some special ssh proxies will not allow arbitrary commands. checkLogin() will break these sessions because it tries to run the echo command on the proxy. By specifying a "!" as the first character of the (proxy) hostname you can instruct x2goclient ot skip the checkLogin() call altogether. Note that this will break proxies that require you to change you password or some other type of interaction. As this is added to SshMasterConnection it is also valid to specify that for the server hostname although this is not very useful. . [ Jos Wolfkamp ]
• New upstream version (4.1.2.2):
  • res/i18n/x2goclient_nl.ts: update Dutch translation file. . [ Sébastien Ducoulombier ]
• New upstream version (4.1.2.2):
  • res/i18n/x2goclient_fr.ts: update French translation file.
  • res/i18n/x2goclient_fr.ts: add missing sentence and UTF-8-ize entries. . [ Ruda Vallo ]
• New upstream version (4.1.2.2):
  • res/i18n/x2goclient_cs.ts: update Czech translation file. . [ Klaus Ade Johnstad ]
• New upstream version (4.1.2.2):
  • res/i18n/x2goclient_nb_no.ts: update Bokmål (Norway) translation file.
  • res/i18n/x2goclient_nb_no.ts: update Bokmål (Norway) translation file. . [ Stefan Baur ]
• New upstream release (4.1.2.2):
  • res/i18n/x2goclient_de.ts: update German translation file.

Regards,

Mihai Moldovan