=============================
ThinLinc 4.20.0 release notes
=============================

Introduction
============

Cendio is proud to present ThinLinc 4.20.0, with more than 100
enhancements and fixes. The most prominent changes are:

* ThinLinc's web-based services, Web Access and web administration, have
  both been overhauled to make sure they work well behind reverse HTTP
  proxies, even in complex cluster configurations. This includes making
  sure that the correct client IP address is used in logs and when
  authenticating.

  Some configuration is still required in the HTTP proxy. See the
  ThinLinc Administrator's Guide for details.

* The ThinLinc client now remembers previously used servers and will
  offer suggestions in the server name field, making it easier to switch
  between multiple ThinLinc installations.

* ThinLinc Web Access can now be customized with a custom logo, page
  title, and background image, to give end users a familiar experience
  when accessing the system. The settings can also be conveniently
  configured and previewed through the ThinLinc web administration
  interface.

* 32-bit applications are no longer fully supported in a ThinLinc
  session. Base functionality will be available on a "best effort"
  basis, but full functionality requires upgrading to 64-bit
  applications.

* The ThinLinc client no longer supports 32-bit Windows. A 64-bit
  Windows installation is now required. The ThinLinc server remains
  backwards compatible with older clients, for those users who cannot
  upgrade in the near future.

ThinLinc works on most modern Linux distributions and is supported on
any platform that fulfills our documented requirements.

Changes in this release
=======================

In the list below, the bug number is given in parentheses. For more
information, visit https://bugzilla.cendio.com.

Server
------

* ThinLinc web administration and Web Access are now easier to deploy
  behind a reverse proxy. (5394, 8700, 8701, 8702, 8719, 8721)

* ThinLinc web administration and Web Access can now be configured to
  handle the X-Forwarded-For header to get the correct client IP
  address when using a reverse proxy. (7466)

* 32-bit applications are no longer fully supported in a ThinLinc
  session. (8565)

* Users can now hide the currently configured profile chooser
  introduction for future logins. An updated introduction will reset
  this user preference. The system administrator can also force the
  introduction to be shown on every login. (7072)

* The profile chooser now pre-selects the previously used profile.
  (3510)

* Session profiles for the COSMIC, i3, and LXQt desktop environments
  are now provided. (7340, 7570, 8410)

* The ThinLinc server installer will now look for installed licenses,
  and present a warning if none of the found licenses will be valid
  after the upgrade. (2541)

* Fixed multiple vulnerabilities where a malicious application could
  cause the X server to crash or execute arbitrary code.
  [CVE-2025-49175, CVE-2025-49176, CVE-2025-49177, CVE-2025-49178,
  CVE-2025-49179, CVE-2025-49180,
  https://gitlab.freedesktop.org/xorg/xserver/-/commit/4fc4d76b]
  (8613)

* The ThinLinc server setup will now remember and suggest the
  previously chosen alternatives for SELinux, AppArmor, printers,
  and firewall settings on subsequent runs. (8615, 8664)

* The ThinLinc server installer now allows the choice of which ThinLinc
  services to enable in the local firewall. (4467)

* The server installer now offers a clear exit path when the latest
  version of the ThinLinc server is already installed. (7941)

Native client
-------------

* The ThinLinc client now shows a list of recently used servers. It is
  also possible to search the suggestions while typing the server name.
  (5503)

* The ThinLinc client has an updated layout in the Options window.
  (8662)

* The installer for the ThinLinc client on Windows is now translated to
  Russian and Turkish. These translations were previously disabled
  because of incompatibilities with some systems. (7447)

* The ThinLinc client for macOS is now packaged using the DMG format
  instead of the ISO format, for increased compatibility. (4329)

* The ThinLinc client no longer supports 32-bit Windows. A 64-bit
  Windows installation is now required. (8611)

* The ThinLinc client for Windows no longer leaks process handles when
  connected to a session. (8673)

ThinLinc Web Access
-------------------

* Custom branding can now be applied to the Web Access login page. This
  includes setting a custom logo, page title, and background image.
  (5085, 8712)

* It is now easier to navigate the ThinLinc Web Access log file. There
  are no longer any HTTP requests logged in the default log level.
  (8409)

* The ThinLinc Web Access login can now handle larger passwords and
  tokens. (8262)

* Added protection to prevent accidentally closing a ThinLinc Web Access
  session window. (8519)

* A Caps Lock indicator and password visibility toggle have been added
  for the password field on the Web Access login page. (8707, 8514)

Smart card support
------------------

* The ThinLinc client now supports authenticating using YubiKeys with
  4096-bit RSA keys. (8602)

* The ThinLinc server has improved compatibility with smart card
  applications that rely on undocumented behavior. This could previously
  result in smart card applications becoming unresponsive and using
  excessive CPU resources. (8295)

Administration
--------------

* The ThinLinc command-line tool "tlctl" now has the possibility to
  refresh the session database when listing sessions and load. (8549)

* The ThinLinc command-line tool "tlctl" now uses colors to emphasize
  the most important parts of the output. (8708)

* The appearance of the license usage graphs in the ThinLinc web
  administration has been improved. (3850, 8275, 8634)

* Fixed an issue where the license usage graphs in the ThinLinc web
  administration would be displayed using the system language rather
  than in English. (8004)

* Load and Sessions tables in the ThinLinc web administration can now be
  sorted by pressing the column headers. (8583)

* Profile icons and screenshots can now be previewed in the ThinLinc web
  administration interface. (8715)

* The ThinLinc server can now be configured to send system administrator
  notifications, such as license warnings, to more than one email
  address. (7436)

* The ThinLinc Administrator's Guide is now available through the web
  administration interface. This guide always targets the same version
  as the installed ThinLinc server, and can be used without internet
  access. (8657, 8666)

* It is now easier to navigate the ThinLinc web administration log file.
  There are no longer any HTTP requests logged in the default log level.
  (8409)


Configuration changes
=====================

New
---

* New parameter: `/profiles/force_intro`. Controls whether users are
  allowed to hide the profile chooser introduction.

* New configuration folder: `/webaccess/branding/`. Holds settings
  relating to custom branding of the Web Access login page.

Modified
--------

* The `/vsmserver/admin_email` parameter now accepts multiple email
  addresses.

* The `/profiles/default` parameter is now only the preselected choice
  for first time users. Subsequent logins prioritize the user's selected
  profile.

* Default profiles for COSMIC, LXQt and i3 have been added under
  `/profiles` and to the `/profiles/order` parameter.

A complete configuration reference can be found in the ThinLinc
Administrator's Guide.

Corrected issues
================

ThinLinc has also been enhanced in many other ways. The complete list
of corrected issues is::

    1210, 2349, 2541, 2652, 3308, 3510, 3513, 3850, 4329, 4396, 4467,
    4852, 5085, 5394, 5503, 5636, 5658, 5673, 7072, 7340, 7436, 7447,
    7466, 7570, 7757, 7768, 7817, 7941, 7981, 8004, 8079, 8165, 8190,
    8262, 8275, 8295, 8341, 8361, 8367, 8407, 8409, 8410, 8419, 8487,
    8514, 8519, 8541, 8549, 8565, 8583, 8589, 8591, 8593, 8602, 8607,
    8608, 8609, 8610, 8611, 8613, 8615, 8619, 8624, 8627, 8631, 8632,
    8633, 8634, 8636, 8638, 8641, 8643, 8644, 8645, 8647, 8657, 8658,
    8662, 8664, 8666, 8667, 8668, 8669, 8672, 8673, 8676, 8677, 8678,
    8679, 8680, 8694, 8695, 8696, 8700, 8701, 8702, 8707, 8708, 8709,
    8712, 8714, 8715, 8719, 8720, 8721, 8722, 8723, 8728, 8736, 8741,
    8743

| COSMIC is a registered trademark of System76, Inc.
| Linux is a registered trademark of Linus Torvalds.
| macOS and OS X are registered trademarks of Apple Computer, Inc.
| ThinLinc is a registered trademark of Cendio AB.
| Windows is a registered trademark of Microsoft, Inc.
