Latest News

(J)Wt 4.15.0 is here!

The main focus of this release is performance optimization. Several improvements have been made to significantly reduce the impact of resource messages on Wt’s responsiveness, decrease server-client communication (in both size and frequency), and increase the likelihood of the browser sending an unload signal—which triggers session deletion—when a user closes a tab or browser window.

We have also introduced a new widget: WDateTimeEdit. Combining WDateEdit and WTimeEdit, it allows users to specify both date and time within a single component.

Additionally, a new tutorial on integrating external JavaScript libraries into Wt is now available here, alongside a couple of new examples.

This release also includes several other features, bug fixes, and improvements. Check the release notes for more detailed information.

Here are the links:

Binary builds for Windows are available on the GitHub releases page.

As you may have already seen, (J)Wt 4.15.0 fixed a vulnerability in wt-auth that allowed an attacker to bypass the second step of multi-factor authentication (MFA).

For this exploit to work, an attacker needed to attempt to register with the victim’s username. They would then be able to click a link that prompted them for the password of the user they were trying to register as. Once the correct password was entered, the attacker was logged in without needing to use the secondary authentication method (TOTP by default).

While upgrading (J)Wt to version 4.15.0 solves this issue, we understand that you may want to stay on a stable release such as 4.14.4.

If this applies to you, we recommend disabling registration via the AuthWidget. This is typically disabled by default, but may have been enabled using the AuthWidget::setRegistrationEnabled() method.

If this is not an acceptable solution, you can override AuthWidget::createRegistrationModel() so that it returns a custom RegistrationModel that either prevents the link from appearing or requires the secondary authentication method before logging the user in.

(J)Wt 4.14.4 is out!

It is a patch release that fixes a few issues. Check the release notes for more info.

The main points of attention are:

Here are the links:

Binary builds for Windows are available on the GitHub releases page.

(J)Wt 4.14.3 is out!

This is a small patch release that mostly fixes a compile error for JWt, but also fixes another small bug. Check the release notes for more info.

Here are the links:

Binary builds for Windows are available on the GitHub releases page.