Skip to main content

Release Note v1.11.15

· One min read
moonrailgun
  • Added per-IP rate limiting for account registration (guest registration included) to curb bulk sign-ups.
    • Defaults to 3 attempts per hour and 10 per day for each IP, configurable via the REGISTER_IP_LIMIT_PER_HOUR and REGISTER_IP_LIMIT_PER_DAY environment variables.
    • Quotas are shared across all instances through Redis. If you run behind a reverse proxy, make sure it forwards the real client IP, see the environment variables documentation for details.
  • Socket.IO connections now record the client IP with the same rules as HTTP requests, so IP-based features such as login IP history behave consistently regardless of how a client connects.
  • Improved the new admin panel:
    • The sidebar can be collapsed into an icon-only mode.
    • User search supports the nickname#discriminator format.
    • Table columns can be resized by dragging.
    • Fixed image URLs that failed to resolve against the backend, and fixed misaligned items in the user action menu.
  • Security: friend.buildFriendRelation is now an internal-only action and can no longer be called directly through HTTP or Socket.IO. Friend relations must go through the request / accept flow.
  • Removed the com.msgbyte.ai-assistant plugin.
  • The Docker image now uses a multi-stage build, which noticeably shrinks the runtime image.