Hakuna mstari wa logi hubeba nenosiri au ufunguo wa wakati mmoja
/api /login ilitumia fomu inayowasilisha kwa kitenzi cha Huduma ya Usalama (Jina la mtumiaji =... & nenosiri = < maandishi wazi> & **Payload = ») na URL ya moja...
Maelezo ya programu ya E-Mail ni ya sasa ya maktaba ya pamoja, sio "Weka barua pepe yako na KamoCRM moja kwa moja."
Hizi ainaScript enums kioo kamo-shared-library ya AppType na ServiceType. Kwa kuwa Maelezo ya EMAIL ya chanzo cha Java yalirekebishwa ('Soma, tuma na kusimamia ...
Hakuna jina linaloandika kwenye kikao cha Redis, na hakuna kitambulisho cha kikao katika logi ya kuingia
Post / api / uchunguzi ulihifadhi JSON yoyote chini ya ufunguo wowote wa KS = ufunguo, na TTL ya caller-chosen na hakuna Kuthibitisha, kupitia jozi ya mteja wa ...
Kidakuzi cha *** kwenye login. * ni HtpOnly, na hakuna mstari wa logi hubeba nusu ya kitambulisho cha kikao
/api/login,/api/login/mfa na/api/session/select planted *** na httpOnly: false (client-) Inapatikana kwa ukaguzi wa kikao) - lakini hakuna msimbo wa kivinjari k...
Andika barua pepe kwenye akaunti yako, sio ya kibinafsi
Anwani ya barua pepe ya kazi inaonyeshwa ni chochote ambacho akaunti ya mtumiaji ina. Hiyo inaweza kuwa anwani ya kazi iliyowekwa na msimamizi, sio tu mtu binaf...
Tuma anwani iliyoandikwa na msimbo wa upya, na mbele anwani ya mwombaji
Ukurasa wa makazi ulituma msimbo wa leseni ya 8 kutoka kwa barua yenyewe, na Huduma ya Usalama iliichunguza dhidi yake. Kila kitu ni haraka, bila kuhesabu. Hudu...
Kuonyesha historia ya shirika, kama wengi kama ina
Skrini ya kuingia iliomba img / bg/1-3.webp chochote config.json's backgroundImageCount alisema, hivyo Shirika lisilo na asili yake lilionyeshwa chochote URL hi...
Tumia msimbo wa rufaa kupitia kiungo cha kujiandikisha
Msimbo wa rufaa kawaida husafiri katika kuki ya apex tovuti ya uuzaji [TD="width: 456"] [FONT=&](2)[/FONT][FONT=&]Bila kuathiri masharti ya kifungu kidogo (1) c...
Jaribu kuweka kwa digest, si kwa tag
Ahadi ya awali inaacha "kuweka picha" kuwa kimya hakuna-op. Hii inathibitisha kuwa matokeo: baada ya rollout, tag ni kutatuliwa kwa digest katika Usajili na Vio...
Ujenzi wa mradi huo haukuleta chochote na uliripoti mafanikio
Picha ni tagged na SHA ahadi, hivyo kujenga upya ahadi hiyo kuzalisha Mfano wa picha sawa. "Kuweka picha" kisha hakuna mabadiliko, Kufukuzwa ni kamwe kuguswa, '...
Make the strike meter agree with its own caption, and read aloud
Three things the screen was getting wrong, all found by looking at it rather than by running it. The bar was a TALLY of failures, wrapping every five segments....
Never show a status phrase to somebody who clicked a link
Rendering the page against an unreachable backend put "Internal Server Error" on screen as the explanation. That is a status phrase written for an operator read...
Give the rollout room for the 15s minReadySeconds now costs
progressDeadlineSeconds was 60. That is the window a rollout has to show progress before Kubernetes gives up and marks it failed, and the previous commit added ...
Let a rollout finish what the old pod was doing
Deploys replaced the only pod of each service with nothing to catch the requests in flight. Three settings, applied across the fleet: - preStop sleeps 10s befo...
Paint a white-label sign-in screen from the host's organization
Every image and colour was missing on login.<customer domain> for any organization created after the 2026-08-26 alias migration. getThemePath() resolves an exp...
Brand the sign-in screen from the org's alias, not the host
login.kamocrm.com is the sign-in screen for every organization that has no host of its own. The theme base was derived from that hostname, so all of them were p...
Theme assets come from a host that resolves
The sign-in screen paints an organization's branding from theme.<its own domain>. That domain may not resolve: an org can exist and be signed into before its DN...
Continue stays disabled once a workspace is opening
The button already carried disabled={!selected || submitting}, but submitting was only true for the duration of the request. On success the page sets redirectin...
Only a spent token sends the member back to the start
Every non-ok status fell back to "Please sign in again", which is only true of 401 — the one status that means the selection token is really gone. SecurityServi...
Make the auto-login cross-tenant guard actually run
The guard read the host org's id with /"id"\s*:\s*(\d+)/ -- a bare digit straight after the colon. SecurityService's JsSafeLongSerializer writes any Long above ...
Hold the token's int64 ids as digits, not as numbers
KToken could not verify a real token. The four ids it carries are int64s, and the Java signer (kamo-shared-library KToken#canonicalForMac) appends each as a raw...
Accept starter/enterprise plan handoff, carry promo code, target www /subscribe
kujiandikisha sasa whitelists starter | biashara | biashara na stashes sp checkout code; Kichujio cha zamani cha biashara kiliacha wanunuzi wa Starter kimya, na...
Kuchochea kubectl download dhidi ya flaky egress [skip ci]
dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...
Stop viewport shaking on browsers with classic scrollbars
On machines whose Chrome uses layout-consuming (non-overlay) scrollbars, the login/recover pages fidgeted with both scrollbars flickering. Root cause: the root ...
Weka picha za nyuma ambazo 404 badala ya kuonyesha sura iliyovunjika
Track failed background image loads and filter them out of the Swiper carousel, so an incompletely provisioned theme (e.g. optionone, whose bg/2.webp was never ...
Proxy Password Reset kwa Usalama wa Ndani DNS
The /api/recover proxy defaulted to api.kamocrm.com, which Traefik routes to APIService (no recover controller) → 404 → "Something went wrong" on /reset-passwor...
Resolve subdomain-tenant org bucket to its own MinIO folder
getThemePath() was reducing the hostname to apex+tld for both the themed host and the bucket folder, so subdomain tenants like gnosia.demo.kamocrm.com loaded th...
Refuse when session orgID does not match host org
auto-login accepted any *** and minted an OTK pointing back at it, regardless of which org the destination internal.* host belongs to. A stale or cross-org *** ...
Reload ThemeLogo after config and cache-bust logo URL
ThemeLogo read kamo-logo-full-ext from sessionStorage before DynamicMetaLoader finished fetching config.json, so logo-full often used the wrong extension until ...
Properly clean up Capcha event listeners on step transition
The removeEventListener calls were inside the setTimeout callback's return value, which JavaScript ignores. This caused handlers to accumulate on every user→pas...
Update redirect from /resend-verification to /verification on register site
Set Host/X-Forwarded-Host so APIService resolves correct org
APIService overwrites X-Forwarded-Host with request.getServerName(), which reads from the Host header. Without an explicit Host header the K8s internal service ...
Resend verification using email not userId, forward X-Forwarded-Host
SecurityService /register/resend-verification expects email in the body, not userId (which the login error response never includes). Also forward X-Forwarded-Ho...
Backlink target to www.kamocrm.com (canonical host)
The PoweredByKamo component shipped pointing at apex https://kamocrm.com/ but the canonical kamo-marketing host is https://www.kamocrm.com/. Updating all three ...
Proxy *** challenge through login server for multi-domain support
Replaces direct cross-origin fetch to capcha.{domain}/api/challenge with a same-origin proxy at /api/capcha/challenge. The previous approach required a valid TL...
Attach widget event listeners when password step renders, not on initial mount
Listen for both statechange and verified events, remove payload requirement from login gate
Use identical explicit pixel spacing on both username and password option rows
Context-aware *** error messages, tighten spacing between fields and options
Swap spacing on username/password views, label to 'I am Human', update error message
Use widget's CSSVariables type instead of React.CSSProperties for style prop
Remove duplicate Capcha-widget JSX type declarations (widget ships its own)
Vendor kamo-capcha-widget locally instead of git URL (Docker can't resolve k0m1)
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.