Frontend 2.18.0

What is in this release

	Count	Summary
New	5	Detail panels across Management, linked details, a fuller VM image panel, tiArchive previews, project membership hints when adding VM users
Change	31	Twelve security changes, new permission names, session locking, drive keys for VM co-owners, stricter settings forms, two Vault changes, VNC on service VM power-up
Fix	65	Security and privacy, sign-in, permissions and onboarding, VM co-owners, virtual machines, Slurm, the Vault, video annotations and the Management console

---

New

Detail panels across the Management console

The Management console lists every object in the system in tables: users, VMs, drives, Slurm nodes and so on. Selecting a row and choosing View opens a detail panel. For several tables that panel did not exist: View opened a page reading Not Implemented :(, or was not offered at all.

Detail panels now exist for Slurm > Nodes, Slurm > Partitions, Miscellaneous > External SFTP and Service VMs. Past VMs and Worker VMs open the full VM panel.

Every Management detail panel also shows what its table shows (owners, IDs with a copy button, resources, quotas, usage, expiry, last login and state) and links to related items. For example, a user's panel links to their teams, a realm's panel to its hosts, and an NFS drive's panel to the hardware setups that mount it.

See Management Overview, Slurm Nodes, External SFTP Servers and Service VMs.

A fuller VM image panel

A VM image is the operating system disk that VMs start from. The image panel now shows the operating system, the drive formats it supports, its capabilities, its boot mode and its maximum number of instances. See VM Images.

tiArchive previews

A tiArchive (.tia) bundles files into one archive. Files inside a tiArchive now open in the file preview, as files inside ZIP archives already did. See View Files.

Project membership hints when adding VM users

A VM that belongs to a project can only be used by people with an active membership in that project. Previously, nothing in Add users said who lacked one, so a user could be added and then find they could not reach the VM.

Users with no active membership in the VM's project now show No active membership in this VM's project under their email, both in the suggestions and in the selected list. If selected teams or groups include such users, a warning says how many. They can still be added, but cannot access the VM until they join the project. See Add Users to a Virtual Machine.

---

Changes

Permission names say what each permission allows

A permission lets a user do one thing in tiCrypt, such as share their files or delete a team. You give permissions in a user profile or to a single user. The old names were often written from the system's point of view ("Create file metadata") or used shorthand ("lower-roled"), so it was hard to tell what ticking a box would allow.

Permission names in the permissions editor and in user profile details now say in plain words what each permission allows, and for whose items. For example:

Earlier name	New name
Edit lower-roled users' permissions	Change the permissions of users with a lower role
Create file metadata	Create files (needed to upload)
Create entries in directories	Add items to directories
Escrow own key	Put their own private key in escrow
View drive keys (necessary to share/attach)	Get drive keys (needed to share and attach drives)

The seven "Basic … Interaction" categories have new names too:

Earlier category	New category
Basic Team Interaction	Teams
Basic Key Escrow	Key Escrow
Basic Vault Interaction	Vault Files and Directories
Basic Group Interaction	Groups
Basic Inbox Interaction	Inboxes
Basic Project Interaction	Projects
Basic VM Interaction	Virtual Machines

Only the names shown on screen changed. Saved user profiles and user permissions are not affected, and permission IDs, such as GetFileInfo, are the same. Exported profile files list permissions by ID, so files exported before 2.18.0 still import.

The new Permissions page explains every permission, shows its earlier name, and lists the permissions that only work together, such as the three needed to upload a file.

Sign-in and key files

A key file holds your private key, encrypted with your password. Key files you load are cached in the browser.

• Ten wrong passwords wipe the cached key file. After 10 wrong passwords, the cached key file you used is removed from the browser, on the login page and on the lock screen, and you need your key file to log in again. This limits password guessing on a shared or lost computer. The wipe was intended before, but never happened. See Private Keys.
• New key files are harder to crack. Key files written from now on (at registration, password change and escrow recovery) use at least 300,000 PBKDF2 iterations instead of about 20,000. More iterations make each password guess against a stolen key file slower. Opening a new key file takes a little longer; existing key files keep working unchanged.

Escrow and inbox uploads check keys first

• Escrow keys are verified before use. Key escrow keeps a recoverable copy of each user's private key, encrypted with a Recovery Key whose parts are held by independent escrow groups (see How Escrow Protects Your Key). Before a key is escrowed, or an escrow officer shares a recovery fragment, each escrow key must now be signed by this deployment's site key, which must be signed by the vendor key. If a check fails, nothing is sent and the reason is shown. Key material can only go to escrow keys that belong to your deployment.
• Inbox uploads check the owner's key. An inbox lets people without a tiCrypt account send files to a user's Vault through an upload link. The upload page now checks the inbox owner's public key against the fingerprint in the link, and refuses to upload if they do not match, so files are only ever encrypted for the person who sent the link.

Content is shown, not run

Text that arrives from the server, such as a notification or a file, could carry HTML or script. These changes make sure it is displayed, never run:

• Notifications are plain text. Links, images and other HTML in a message are shown as typed.
• Files without a viewer are not handed to the browser. A file that has no viewer shows This file type cannot be previewed., with a Download button for Vault files that respects download restrictions. The External File Preview (open in new tab) system setting is removed.
• PDF previews use pdf.js 6.0.227 (was 2.2.171), with the PDF's own scripts turned off. The old version was affected by CVE-2024-4367.
• A Content-Security-Policy on the app's pages allows only the app's own scripts.
• The XSS check covers every JSON response, including lists and nested values. Text that would create script-running markup is still replaced with XSS WARNING-content deleted, but this is now logged instead of locking the app, and ordinary text with angle brackets or {{ }} is no longer removed.
• Spreadsheet exports cannot run formulas. In table CSV exports and VM log CSV/TSV exports, a value that starts with =, +, - or @ (other than a plain negative number) is saved with a ' in front, so a spreadsheet opens it as text.
• The browser console no longer gives access to the signed-in session unless the deployment has debug mode on.
• Current libraries. Markdown text, file SHA-256 checksums and the VM terminal use current, supported libraries, and unused third-party packages are removed. Checksums are the same as before.

Session locking

After a period of inactivity, tiCrypt locks the page; the user unlocks it with their password. The Session Timeout in System Settings sets how long a session may stay idle.

• A locked page's session now ends at the Session Timeout. If a page stays locked for as long as the Session Timeout, its session ends, and unlocking signs in again with a new session. Before, a locked page kept its session alive until the page was reloaded. The Session Timeout description in System Settings explains this. See Edit the User Inactivity Period.
• An idle VNC console no longer keeps the session open. An open VNC console counts as activity only while you use it, so an idle console locks and logs out on the normal schedule.
• The lock screen covers everything. While the session is locked, the task tray is hidden and the lock screen stays above every dialog. The tray comes back when you unlock.

Drive keys for VM co-owners

The co-owners listed in a VM configuration are added to its VM with the Co-Owner role, which includes access to the VM's drives (see VM Roles and Permissions). Drives are encrypted, so to mount them a co-owner needs a key to each one. Before this release, nothing kept those keys in step with the list of co-owners, so a co-owner could start a VM and find a drive they could not mount.

• Saving a VM configuration checks drive keys. Every co-owner must have a key to every drive. If not, tiCrypt lists who would get which drive and offers Share and save. See Create and Configure VMs.
• A new drive is shared with co-owners when it is formatted, on launch, Mount all drives, Remount or attach.
• A read-only key counts as missing when the configuration attaches the drive read-write.
• Removing a co-owner offers to remove their keys to the configuration's drives that you own, checked by default.
• The drive Share dialog warns about co-owners. Removing someone's key, or making it read-only, asks first when that person co-owns a VM configuration that uses the drive. The Unshare from everyone else confirmation names the users who lose their key and the VM configurations they co-own that use the drive. See Share Drives.

Settings and Management forms

• Licensing servers take one server. Registering a licensing server takes a single required Server field instead of a list, and at least one port is required. Ports accepts lists and ranges such as 80, 8000-8010, and port errors show under the field. See Create a New Licensing Server.
• Typed lists accept what you type. In System Settings > External Servers and XSS headers, device tags and libvirt host MAC addresses, a valid typed entry counts without clicking Add and is added when you leave the box. Invalid text blocks Save and says why. The lists have a lighter layout.
• External Servers entries must be URLs, such as https://sftp.example.com. Entries already saved are kept.
• No bottom CUI banner option. The CUI Disclosure setting no longer offers Display a banner on the bottom of the page, which never showed a banner. See Enable CUI Disclosure On-Screen.
• Replace allowlist. Manage access for several hardware setups is now named Replace allowlist, says that it replaces each setup's list, and asks before making the setups public. See Manage User Access in VM Hardware Setups.
• Restricted Slurm partitions need a target. A Restricted partition must name at least one team, project or VM configuration before it can be saved. A partition that still lists hardware setups shows a warning with a button to remove them.
• Max Instances is a whole number. Max Instances on a VM image must be from 1 to 1,000,000. When you edit an image that has a limit, the limit can be changed but not cleared. See Add VM Creation Limit in a VM Image.

Vault

• Group folder uploads no longer ask for expiry and restrictions, which were ignored. A confirmation says the files are shared permanently with all members of the group. See Groups.
• Moving an inbox folder asks first. Moving it to the trash or to another tree stops its upload links working, so tiCrypt now confirms.

Service VMs

Power up and Boot from ISO now open the VNC terminal of each service VM once it has started. Before, it had to be opened with Open VNC terminal. See Power Up a Service VM.

---

Fixes

Security and privacy

• Uploaded files get a random initialization vector (IV) for every encrypted chunk. Before, each chunk's IV was derived from the previous one, so all of them could be predicted from the first. Files uploaded before this change still open.
• Failed requests no longer write request bodies, passwords or session secrets to the browser console or to the downloadable logs.
• With debug mode on, VM messages in the browser console hide secrets: passwords, API keys, drive and file keys, session tokens and terminal input. Before, only a few top-level key fields were hidden.
• The password you typed is cleared when you leave the sign-in or escrow sign-in page, for example for Register or Site key. No copy is kept in memory after a failed sign-in, unlock or key password change.
• Copied SFTP commands are safe to paste. The lftp and Mac/Linux SSHFS commands quote every value, and control characters are removed from all copied SFTP values, so a VM name or credentials cannot run commands in your terminal. See Remote File System.
• Names are shown exactly as written in File History and in the confirmation dialogs for recovering a drive, user or file from a backup and for removing users or profiles from a VM or users from a VM group. Before, File History rendered names as HTML, and the dialogs showed link, image or HTML syntax, web addresses and email addresses as links or images.
• The VNC console shows VM names with characters such as & or # in full, and a VM name can no longer change the console's settings, such as which VM it connects to.
• The changed-key warning names the user. When a user's pinned public key has changed, the warning shows their name and email instead of [unknown-user:[object Object]].

Sign-in and sessions

• The login page shows the last failed and last successful login again.
• Logging in to another account in the same tab after a failed login no longer keeps the first account's public key.
• A warning or MFA prompt that opens while the session is locked no longer unlocks it.
• Unlocking a session that needs MFA again finishes after MFA. Previously the MFA step stayed open until the page was reloaded.
• Log out always closes the session in the browser, even when the server cannot be reached.
• Self-registration saves the private key file as soon as the account is created, and a double click on Register no longer reloads the page.
• Dialogs that cannot be dismissed, such as the terms of service, no longer drop your accept, confirm or save after you press Esc or click outside them.
• The Login ID Regular Expression setting saves again. Previously the field then showed [object Object] and self-registration rejected every Login ID. Values saved that way by earlier versions are read correctly. See Set Pre-Defined Login IDs.

Permissions, profiles, onboarding and escrow

• Editing a user's permissions, or applying a role, keeps permissions the web UI has no description for, such as AddUser, SendMessages and ReadVMConfig. They are listed under Discovered from Server.
• A category checkbox changes only the permissions the editing admin holds.
• A collapsed category shows as checked or partly checked when some of its permissions are checked. Before, Project Administration could look unchecked even though some of its permissions were checked.
• Editing a user profile's rank or key escrow policy and applying it updates its users.
• Onboarding several users at once with a profile that restricts a project keeps the restriction for every user.
• Management > Users > Onboard waits until every list is loaded, so a template's VM configurations, teams, projects and certifications are no longer skipped. See Onboard Users with a Template.
• Escrow sharing tasks finish only when every key is shared. On the escrow page, the tasks started by Share all key parts with user in my group and by a user's Share keys with other Escrow users show an error when sharing fails.

VM co-owners and drive keys

• Adding co-owners to a VM shares each drive with its own key. Previously every drive was shared with the last drive's key, so co-owners could not mount the other drives.
• Launching a VM configuration with co-owners and a new drive no longer warns that co-owners are missing drive keys.
• Attaching drives to a running VM with "Add drive(s) to the VM configuration and share drive(s) with co-owners" checked now shares them with the co-owners.
• The Repair card for co-owners' missing drive keys updates when drive keys are shared or removed.
• Remove from VM on a co-owner also removes them from the VM configuration's owners, so the next start no longer gives them access again.
• Saving a co-owner in Update permissions without changes no longer demotes them, and choosing a Co-owner profile makes the user a co-owner. See Edit Permissions in a Virtual Machine.
• On constellation VMs, Update permissions shows Manage VPN and VM Orchestrator as checked when the user has them, no longer removes them on save, and lists SFTP Access once.
• Sync user permissions removes a VM user only when the server reports the user as deleted. Previously active users from other teams could be removed.
• Switching someone between Read-only and Full access to a drive no longer leaves them without a key when the change fails.

Virtual machines

• Opening the Terminal Hub closes the tabs of VMs that have shut down, instead of showing VM not found or no longer accessible. See Open a Virtual Machine's Terminal Hub.
• Downloading a VM's logs always finishes. A page that keeps failing ends the download with the VM's error instead of freezing the tab.
• The VM Logs panel no longer loads forever when the VM has no logs or its logs cannot be loaded. It shows the empty list, or an error such as Failed to load the logs.
• The VM list keeps updating after a VM of a project that is not active in your session stops.
• The Runtime column of VM tables shows how long the VM has been running instead of "3 hours ago".
• Editing a VM image saves only what was changed and reports No changes made when nothing was, and Slurm > VM Accounts shows capability changes.
• Dragging a folder onto itself or one of its subfolders in the VM file explorer is refused with Cannot move ... into itself or one of its subfolders. Before, the move was offered and then failed.
• Configure transfer and Edit open the transfer form again in a VM's Avicenna transfers. Before, clicking them did nothing.

Slurm and hardware setups

• Manage access on a hardware setup starts from the setup's current teams and users, so saving no longer drops entries or makes the setup public.
• A Slurm partition's Allowed VM Configurations lists VM configurations. Previously it listed hardware setups, which matched no VM.
• Saving a Slurm partition as Unrestricted no longer makes every job fail with VM is not whitelisted for the specified partition.

Vault and files

• Extracting a tiArchive keeps its folder structure. Previously files were placed side by side and the task failed.
• Moving or copying a folder into one of its own subfolders is refused. Previously the folder disappeared or was copied over and over.
• Moving an inbox folder within the same tree keeps its upload links. Previously every move deleted them.
• Files opened from ZIP archives preview again instead of showing an endless spinner.
• The file preview frees the memory of a decrypted file when you move to another file or close the preview.
• File History shows the whole history with Load Older. Previously only the 50 newest events were shown. See View File History.
• In the Share dialog, changing a group's expiration keeps its restrictions, such as Cannot download.

Video annotations

• A manager's edit no longer makes them the owner of someone else's annotation; Set pins the player's exact time, typed start and end times are applied, and annotations can start at 0:00.
• Failed saves and imports are reported and your annotation is kept; imports keep tags and annotation types, and time points and global annotations are drawn correctly on the timeline.
• Templates apply only to their own drive and folder, a closed video stops checking for annotation changes, and a video plays even when its template cannot be loaded.
• The template page refuses a category name that is already used (previously that wiped the existing category's tags), removes deleted tags and shows an error when saving fails. The annotation table filters by the user and tag names it shows. See Video Annotation Templates.

Management console and interface

• Management detail panels show correct values. An API key's expiry is no longer labelled Last modified, Slurm job durations are no longer shown as milliseconds, stopped VMs are no longer labelled running, libvirt host state is no longer always green, and a missing size on disk is no longer shown as 0 B.
• Management detail panels show current data. The user panel refreshes, a stopped VM keeps its host and MAC address, and names no longer stay [unknown-...] after they load.
• Detail panels with only a few actions show them again, along with the state button, such as Connect.
• A request that fails once no longer makes an item look deleted for the rest of the session, for example during a backend restart. Detail panels show Could not load with a Retry button.
• Screens update as soon as data arrives, instead of on the next one-second refresh.
• Tables with totals update when only a total changes, such as Teams, Resources by user or by project, and Libvirt hosts.
• CSV and TSV exports no longer shift columns when a value contains quotes, commas or a list.
• A task for a single item shows as failed with its error when it fails, such as removing one VM user. Before, it showed as finished and closed by itself. Successful single-item tasks still close by themselves.
• When a window fails to open, a Failed to open this window error is shown and no empty dialog is left over the page. Before, the click seemed to do nothing.
• The notification panel no longer goes blank after you leave a group that received a share of 4 or more files.

---

Upgrading

The front end ships as a .szip build. In the Connect Application:

• Automatically. Connect runs the latest front-end version by default, and versions update globally unless a user has chosen a specific one. Connect checks for new versions at the Update URL set in System Settings. See Specify a Front-End URL for Automatic Updates.
• By hand. Upload the .szip file, or paste its link, in Connect's Manage versions dialog. See Add a Front-End Version.

There is no migration.

What users and administrators will notice

Most of this release needs nothing from you. These changes are the ones users and administrators will notice, or that may need a look after upgrading:

• Ten wrong passwords now wipe the cached key file. Users who reach the limit need their key file to log in again. Your help desk may hear about this; see Sign-in and key files.
• Permission names are different. Internal guides and screenshots that quote permission names will be out of date. Saved user profiles, user permissions and exported profile files are not affected. See Permission names say what each permission allows.
• Some settings forms are stricter. A Restricted Slurm partition must name at least one team, project or VM configuration; System Settings > External Servers entries must be server URLs; a licensing server is registered one server at a time; Max Instances on a VM image must be a whole number. Existing entries are kept. See Settings and Management forms.
• Two settings are gone. The External File Preview (open in new tab) setting is removed, and the CUI Disclosure setting no longer offers a bottom-of-page banner, which never showed.

Also in this upgrade: 2.17.11 to 2.17.15

If you are upgrading from 2.17.10, 2.18.0 also brings the releases in between:

• 2.17.13 adds Import user profiles in Management > User Profiles, so profiles exported from one tiCrypt system can be created on another, and a Never Escrow column. See Export and Import User Profiles.
• 2.17.15 is an accessibility release: a Skip to main content link, keyboard access to tables, folder trees, menus and panels, names for screen readers, a switch to turn off single-key keyboard shortcuts, and easier-to-read colors in the Dark, Cool Gray, Classic and High Contrast themes. See Accessibility.
• 2.17.11, 2.17.12 and 2.17.14 fix a Windows crash when accepting the terms of service, browsing My Computer in the file explorer, and Connect's Open in browser shortcut, and update third-party packages, including Angular 21.2.

The full notes for every version are on the tiCrypt Version Guide.