Fog

What's Changed

• merge stable - 1.5.10.1826 into dev by @fog-workflows[bot] in https://github.com/FOGProject/fogproject/pull/814
• Stable Release PR For 1.5.10.1826 - 2026-05-15 by @fog-workflows[bot] in https://github.com/FOGProject/fogproject/pull/822
• Stable Release PR For 1.5.10.1870 - 2026-06-15 by @fog-workflows[bot] in https://github.com/FOGProject/fogproject/pull/829

Full Changelog: https://github.com/FOGProject/fogproject/compare/1.5.10.1826...1.5.10.1870

Commits

• feat(api): add token-authenticated DB backup endpoint (abaae49e2)
• docs(contributing): fix broken TOC links and add missing sections (172dc35cd)
• fix(inventory): allowlist writable fields, block mass-assignment (7251c3c6b)
• Should fix issue with inventory mapping. (749d61e99)
• fix(multicast): clear sessions when udp-sender exits on its own (#820) (4b2ce25a2)
• fix(host): PHP 8 safety for mac handling on host creation/check-in (578cf5cfd)
• Should address 067 vuln on dev-branch (53144afdb)
• security(wol): authenticate the inter-node Wake-on-LAN relay (820e99690)
• fix(auth): drop ipxe from the no-auth allowlists (26f37fbbc)
• security(install): protect schema deploy with a per-install token (7a10a8c84)
• security(csp): harden Content-Security-Policy to script-src 'self' (2fd360483)
• fix(hostmanager): early-return getHostByMacAddresses on empty macs (7d7ea75f8)
• Add NULL sentinel to explicitly clear group-general fields on hosts (54334ae3c)
• Preserve per-host fields when updating group-general (fa14632df)
• Revert vuln 009 token check - breaks deployed FOG Client (04ee37464)
• Port /snapin/createwithfile and /storagegroup//uploadsnapinfiles to dev-branch (dd26efb95)
• Make santizeCronField public function (41ba0d882)
• Should switch private santizeCronField to protected (06284ec25)
• Fix vuln 023 again (f70a71470)
• Fix 021 vuln (46dd3ec78)
• Fix 020 vuln at progress insert (efc399b19)
• Fix 009 Vuln with expected (f2cc61b3b)
• Fix issue reported on forums (d7f6fa031)
• Fix 097 vuln (ed1a9d3b2)
• Fix 081 vuln (5123be197)
• Fix 078 vuln (c6b053c60)
• Fix 055 vuln properly (262a8bfa7)
• Fix 055 vuln (edbde2820)
• Fix 029 vuln (dd9c5ca95)
• Fix 023 vuln (dc1dc1c0d)
• Fix 022 vuln (876124eba)
• Fix 021 vuln (8b09fd9a2)
• Address 020 vuln (549b9d1cb)
• Address 020 vuln (fe9267d85)
• Fix 019 vuln (fe0c1938d)
• Remove 010 vuln, though not using proposed patch as we have a different method to obtain this information already baked in (aab1d32f0)
• Fix 137 vuln (6228cad5f)
• Fix security issues (64f7213f9)
• Fix another security thing (117a2722c)
• Should fix multiple noticed issues (e194c5deb)
• Should attempt to fix 3 broken elements at once for security reasons (05403ee09)
• fix(fogcontroller): write 0 for cleared optional *id fields instead of skipping (3ba8b766a)