From 1c2c3a65dc6b1213d3d17ef46a48a3914bcc400c Mon Sep 17 00:00:00 2001 From: "QUALISYSTEMS\\nahum-t" Date: Thu, 10 Sep 2026 09:41:42 +0300 Subject: [PATCH] Tier 3 of the post-2026.1.0.52 sweep: diagram layout key, Linux ES resilience, SAML XXE, bug fixes Closes out the catch-up for everything that landed on 2026.1 after 2026.1.0.52. PreserveDiagramLayoutOnViewStyleChange (CS 189995/189996/190004, ticket 67465 / WI 19310). Documented as a customer key on the Portal - it is declared AppSettingVisibility.Customer, unlike the ES/Server keys below - with the overlap caveat taken from the setting's own description. The three unconditional coordinate fixes (Arrange, drag-to-move, sticky-note resize) are noted separately, since they apply whether or not the key is set. Linux/Mono ES resilience (CS 189890/189891, ticket 67293). Described by behavior rather than by key: MinThreadPoolWorkerThreads (200), BeginExecutionMaxRetryCount (10) and BeginExecutionRetryIntervalSec (6) all take the AppSetting constructor default of AppSettingVisibility.Support, so they do not belong in the customer configuration keys repository. The user-visible facts are the wedged agent under driver-spawn bursts, the ~100s dispatch tolerance, and the Linux venv bin-vs-Scripts path fix. SAML ACS XXE (CS 189894, CWE-611) added to Security Updates - the endpoint is reachable unauthenticated, so it is called out for SSO/SAML deployments. Bug fixes: diagram duplicate resource alias (CS 189961, release note), 'Blueprint not found' loop on domain switch (CS 189991), 500 downloading a shell or provisioning script with an extensionless stored file name (CS 189989), Properties dialog end time for a non-admin on an extended sandbox (CS 190005). Deliberately not documented: the Docker ES get-pip curl/wget change (CS 189983/189984/189986) is image build plumbing whose failing builds never shipped, plus Dotfuscator, TCL/XmlToHtml generation, nightly-red and CI-only changesets. ExportBlueprintPackage/ImportBlueprintPackage (CS 189912/189917/189921) are also omitted: CS 189940 replaced them with the ExportBlueprint/ImportBlueprint pair documented in #22. Co-Authored-By: Claude Opus 5 (1M context) --- .wordlist.txt | 3 ++ .../blueprint-workspace.md | 35 +++++++++++++++++++ docs/release-notes/whats-new.md | 16 +++++++++ 3 files changed, 54 insertions(+) diff --git a/.wordlist.txt b/.wordlist.txt index ea931cfdde..5ef0feb606 100644 --- a/.wordlist.txt +++ b/.wordlist.txt @@ -1657,3 +1657,6 @@ featureCompatibilityVersion Telnet sharded CPython +XXE +CWE +Mono diff --git a/docs/admin/setting-up-cloudshell/cloudshell-configuration-options/customer-configuration-keys-repository/blueprint-workspace.md b/docs/admin/setting-up-cloudshell/cloudshell-configuration-options/customer-configuration-keys-repository/blueprint-workspace.md index ca03980015..d4e3ea2232 100644 --- a/docs/admin/setting-up-cloudshell/cloudshell-configuration-options/customer-configuration-keys-repository/blueprint-workspace.md +++ b/docs/admin/setting-up-cloudshell/cloudshell-configuration-options/customer-configuration-keys-repository/blueprint-workspace.md @@ -274,6 +274,41 @@ sidebar_position: 6 +## Preserve the diagram arrangement when the View Style changes +When enabled, changing the diagram **View Style** resizes the resource cards in place and keeps the saved arrangement. When disabled (the default), the legacy per-axis resize is applied (Large ×2/×3, Small ÷2.7 and ×1.3), which is non-uniform and visibly displaces resources and link endpoints. + +:::note +Enabling this may cause Large cards to overlap on a diagram that was arranged in a smaller View Style. +::: + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Key``
Possible valuesTrue/False
Where to add/change`customer.config` CloudShell Portal installation directory
Default valueFalse
Affected CloudShell ComponentCloudShell Portal
Version2026.1 and above
+ ## Keep global inputs when saving a sandbox as a blueprint When saving a sandbox as a blueprint, keep global inputs that were linked to a resource requirement, even when that resource is saved as a concrete resource. Set to `False` to drop them instead, restoring the behavior of earlier versions. diff --git a/docs/release-notes/whats-new.md b/docs/release-notes/whats-new.md index a03e87c6ab..cd2c82da94 100644 --- a/docs/release-notes/whats-new.md +++ b/docs/release-notes/whats-new.md @@ -26,6 +26,8 @@ Updated bundled third-party components: Node.js 24 dropped 32-bit (x86) Windows support. The x86 Node.js prerequisite has been removed from the installer. ::: +Also fixed: an XML External Entity (XXE) vulnerability (CWE-611) on the Portal's SAML assertion consumer service endpoint, which could be reached without authentication. Deployments using SSO/SAML should upgrade. + ### Export Diagram as PNG Export sandbox diagrams as PNG images directly from the browser. Available in the diagram toolbar under Export → PNG. @@ -60,6 +62,16 @@ New TestShell API method that returns the list of reservations (current and hist ### Improved Abstract Resource Resolution Diagnostics When a blueprint reservation fails due to unresolvable abstract resources or route conflicts, the error message now includes detailed diagnostics — showing which resources could not be resolved, which routes failed, and the specific conflicts that prevented resolution. +### Preserve the Diagram Arrangement When the View Style Changes +Changing a diagram's **View Style** can now resize the resource cards in place and keep the saved arrangement, instead of applying the legacy per-axis resize (Large ×2/×3, Small ÷2.7 and ×1.3) that visibly displaces resources and link endpoints. This is opt-in — set `PreserveDiagramLayoutOnViewStyleChange` to `True` in the Portal's `customer.config`; the default is unchanged behavior. + +Independently of that setting, three flows that could move or persist diagram coordinates incorrectly were fixed: **Arrange**, dragging resources to new positions, and resizing a sticky note. + +### Execution Server Resilience on Linux +Execution Servers running on Linux/Mono handle bursts of driver launches more reliably. Under a burst, reads from driver child processes could starve the socket-completion callbacks that service the Execution Server's messaging channel, wedging the agent until it was restarted. The Execution Server now reserves a floor of thread-pool worker threads at startup so the two cannot compete, and CloudShell Server tolerates a much longer transient stall — up to roughly 100 seconds — when dispatching an execution request to an Execution Server, instead of giving up after a few seconds. + +Also fixed: virtual environments on Linux Execution Servers were resolved using the Windows interpreter path layout (`Scripts` rather than `bin`). + ### Driver Command Queue Inspection and Recovery API New system-administrator Automation API methods for seeing which resource driver commands are queued or running, and cancelling them. They address a resource left blocked by a command belonging to a previous — possibly already ended — sandbox, which a new sandbox could not previously see or cancel: @@ -106,6 +118,10 @@ Importing a blueprint that references a category that does not exist in the targ - Fixed the Sandbox API crashing on the Node.js 24 runtime when handling conditional (cache-revalidation) requests to the explore endpoints. - Restored the full Ansible package (with bundled collections) in the Docker Execution Server image, fixing playbooks that failed with missing-module errors. - The About dialog now shows the full four-part product version, including the build number (for example, `2026.1.0.52`). +- Fixed a resource placed directly into a blueprint being labeled with its own name twice on the sandbox diagram — for example `server1 (server1)` instead of `server1`. A resource that does resolve an abstract still shows that abstract's alias, and where an abstract's alias is identical to the resource name the diagram now shows the name once, matching the resource side pane. +- Fixed a **Blueprint not found** message repeating indefinitely when the active domain was switched with a blueprint open, which prevented the redirect from completing. The message is now shown once and the redirect proceeds. +- Fixed a server error (HTTP 500) when downloading a shell or provisioning script whose stored file name has no extension. +- Fixed the sandbox **Properties** dialog showing a non-admin user an end time the sandbox does not have, for a sandbox that had been extended beyond the duration cap of its blueprint or user group. The dialog now shows the sandbox's real schedule, and opening it no longer silently shortens the sandbox. ---