Changelog > Infoserver > Version 6.4.0.4 Release 13.02.2025

This version contains the following components

•Cordaware bestinformed Web Interface (Version 6.2.3.1)

•Cordaware bestinformed Infoserver (Version 6.5.2)

•Cordaware bestinformed Infoclient (Version 6.3.8.1)

•Cordaware bestinformed Database (Version 6.3.3.5 (CouchDB 3.3.3))

•Cordaware bestinformed Migration 5 to 6 (Version 1.0.2.0)

CVE-2025-0422, CVE-2025-0423, CVE-2025-0424 is fixed with Cordaware bestinformed web interface version 6.2.2.5.

The HttpOnly cookie is also fixed as of Cordaware bestinformed web interface version 6.2.2.5.

Due to the use of new internal versions and the associated enhanced security mechanisms the SSL option "[{verify, verify_none}]" is now mandatory when using domains, as soon as your access takes place via SSL!

The same applies to the use of Info2Mail scripts.

If you use the setting "{secure, tls}" or "{secure, ssl}", you must also specify the setting "{sslopts, [{verify, verify_none}]}" so that access continues to work!

You can also find more details on this in our official online documentation & help in the chapter Interfaces > Info2Mail.

General improvements of the software performance

•New session logic with enhanced security mechanisms through the use of the two attributes “Secure” and “HttpOnly”.

oA cookie with the secure attribute is only sent to the server with an encrypted request via the HTTPS protocol. It is never sent with unsecured HTTP (except on localhost), which means that man-in-the-middle attackers cannot easily access it. Insecure websites (with http: in the URL) cannot set cookies with the secure attribute.

oA cookie with the HttpOnly attribute cannot be retrieved by JavaScript, e.g. by using document.cookie.

•Several points of attack for cross-site scripting (XSS) have been fixed.

•Some database views were previously managed in a separate module, which meant that installation on Unix-based operating systems was usually more complicated than necessary. These are now managed internally, thus reducing the complexity of the installation.

•From this version onwards, your existing installation is automatically uninstalled before an update, this no longer needs to be done manually.

New functions in the web interface

•Voice output functionality, whereby Infos are read aloud using the operating system's own output.

New Info

•There are new options in the "Sound" tab that allow you to have the Info on the client read out automatically when it is received.

Infos

•The Info details now show whether automatic reading of the Info to the client is active.

StatusInfo

•For status details, the automatic voice output of the current status to the client can be activated.

Templates

•ScriptVars of type "Script" have been removed.

Channels

•Channels of type "Bot" have been removed.

Clients

•Externally registered users and mobile registered devices can now be exported as JSON.

Team

•New permission "Allow voice output for Infos" to control whether your users within a role are allowed to send an info with voice output function.

Alarm

•The initial maximum loading time of the Alarm Location Manager app has been increased to avoid timeouts with large amounts of data.

Fixed bugs in the web interface

•When using the Rest API, the "Advanced recipient settings" (extended_filteropts) were not handled correctly when creating an info, this has been fixed.

Filters

•An error when using the filter operator "doesn't contain text" has been fixed.

Alerting

•A rare error in connection with the system (global) settings during the initial setup of alerting has been fixed, whereby no alert messages were sent to the connected info clients.

•The description of a newly added computer to the Alarm app could not be edited under certain circumstances, this has been fixed.

•Fixed the incorrect import of an organization in the Alarm Location Manager app when it had a capital letter in its OID.

•The incorrect display of data records in the Alarm Location Manager app when using the Events app at the same time has been fixed.

System

•The incorrect display when transfering a specified user's data records has been fixed.

New Infoserver functions

•Support for the new voice output feature has been added..