Poweradmin

✨ Highlights

Patch release for the stable 4.2.x line. Focus is hardened proxy header handling, group-owned zone visibility, and PostgreSQL compatibility fixes.

🐛 Fixes

• Forwarded-IP headers (X-Forwarded-For, X-Real-IP, Client-IP) are now only honored when the peer (REMOTE_ADDR) is a private or loopback address. Direct-internet deployments stop trusting client-supplied headers, preventing audit-log spoofing and per-IP rate-limit bypass. Same hardening cherry-picked to 4.3.x, master, and develop.
• Group-owned zones show the correct edit/delete controls in zone search and zone lists (#1200, #1194).
• PostgreSQL strict typing on record_comment_links no longer breaks zone editing or record search (#1192). Both sides of the join are now cast so it works regardless of whether the linking column is INTEGER or VARCHAR.
• Bulk record add correctly handles CSV escaping (#1199).
• CNAME validation accepts numeric-string record IDs from the GUI (#1202).
• API record edits honor the zone_content_edit_own_as_client permission (#1203).
• Users API keeps auth_method in sync when use_ldap is toggled (#1195).
• Zone templates: sync uses zones.id instead of domain_id (#1210); consecutive spaces are preserved in template content listings (#1212).
• 404 page now fits the viewport without scrolling.
• Bulk registration template links to group/user management (refs #1201).

📦 Upgrading

Drop-in replacement for v4.2.2. PHP 8.2+ required (unchanged).

Full changelog: https://github.com/poweradmin/poweradmin/compare/v4.2.2...v4.2.3

🐛 Bug Fixes

⚙️ config:

• surface clear error when settings.defaults.php is missing (closes #1158) (927fcd1)

📥 installer:

• correct MySQL backfill query in 4.3.0 upgrade script (closes #1159) (7a8122b)