# Release Notes for MultiPortal 1.2.1 **Release Version:** 1.2.1 **Release Date:** July 21, 2026 MultiPortal 1.2.1 is a patch release that resolves several issues identified after the 1.2.0 release. It also closes a stored cross-site scripting vulnerability, so we recommend upgrading at the next available maintenance window for all environments, and particularly for those using custom-domain branding and SSL, LDAP or Active Directory authentication, or the REST API for usage reporting. ## Security and Access - **Stored cross-site scripting in user and resource names is closed.** Names entered by users, and names given to resources such as virtual data centres, virtual machines, and networks, are now consistently encoded wherever they are displayed, including user lists and global search results. Names on the profile form are also validated when they are saved, and names arriving from single sign-on or LDAP are sanitised so logins continue to work. This closes a path where a crafted name could run script in another operator's browser, including across tenant boundaries. See MultiPortal Security Advisory [MPSA-2026-001](https://docs.multiportal.io/security-advisories/mpsa-2026-001/). Existing stored names are made safe when they are displayed, so no data cleanup is required after upgrade. - **LDAP configuration screen hardened.** The Active Directory and LDAP connection-test screen no longer lets a value entered in the username field inject markup into the test-result message, and query handling for Active Directory configurations has been improved. - **Reseller global search scoped to owned tenants.** Global search performed by a reseller now returns only the resources within the tenants that reseller owns. - **Cross-tenant status leak in the VDC virtual machine list closed.** The virtual machine list on the VDC page now filters by ownership, so a reseller or tenant only sees the status of machines that belong to them. Reseller access to the VDCs they manage has also been corrected, so managing resellers can again read a VDC's storage policies and convert virtual machines to templates. - **Usage API scoping tightened.** The raw usage endpoint now always reports on the virtual data centre named in the request path. An identifier supplied in the query string can no longer override the resource that access was checked against. - **Less internal detail in branding error messages.** Custom-domain and SSL certificate errors shown to resellers and tenants no longer include internal server addresses or file paths. The full technical detail is still written to the server log for support diagnostics. ## Reliability and Performance - **Faster virtual machine and VDC pages.** The virtual machine view and the VDC virtual machine list now render from cached data first and refresh live details in place, so the first view typically appears in under two seconds instead of ten or more. A guest agent that is enabled but not running inside a virtual machine no longer blocks the page while it waits. - **Scheduled backup log sync restored.** A regression in 1.2.0 stopped scheduled-backup task logs from syncing and caused each data centre to log repeated task-fetch failures. Task logs are now fetched per node and sync correctly again. ## Bug Fixes - **Global search works again.** Running a search from the search bar no longer returns an error. - **"Ghost" virtual machines can be removed.** A virtual machine that still exists in MultiPortal but no longer exists in Proxmox can now be removed. - **Storage policy values display correctly.** A virtual machine's storage policy and its value now show correctly in Resource Allocation, in Reports Allocation, and when editing VM hardware. - **Opening a virtual machine no longer errors.** Viewing a virtual machine no longer produces an error, and snapshot fetch failures are now handled and reported clearly rather than surfacing as an unexpected error. - **Virtual machines created in Proxmox appear reliably.** Virtual machines created successfully in Proxmox now appear in MultiPortal as expected. - **Snapshot times shown in your timezone.** Snapshot timestamps now display in the configured timezone rather than always in UTC. - **Proxmox Backup Server timestamps corrected.** Backup timestamps from Proxmox Backup Server now display correctly. - **Backup storage usage chart renders.** The "Backup Storage usage over time" chart on the VDC Usage tab now shows data across all VDCs. - **Cloud-init applied to the correct node after cloning.** After a clone, cloud-init settings are now applied to the node the virtual machine actually runs on, rather than the node chosen when the clone started. - **Custom-domain SSL certificate upload fixed on hardened installs.** Uploading a custom-domain SSL certificate no longer fails on installations that run PHP under systemd sandboxing. Certificate installation now runs a preflight check and gives a clear message when the web server is not yet configured for custom domains. - **Custom-domain and cleanup cron errors resolved.** Fixed cron dispatcher errors affecting custom-domain verification and stale-task cleanup. - **Reseller external networks and QinQ handling restored.** Resellers can again see and manage the external networks assigned to them, and imported QinQ zones are re-validated against the live Proxmox configuration. ## API and Integrations - **Raw usage endpoint fixed.** `GET /virtual-data-center/{id}/usage-raw` no longer returns an HTTP 500 error and now returns raw per-machine usage data as expected. - **Virtual machine rename over the API.** Renaming a virtual machine through the API no longer raises a spurious "name differs from Proxmox" alert; the Proxmox name is kept in sync with the change. - **Network creation over the API.** The REST API now supports creating internal and external networks. ## Upgrade Notes - This patch release includes database migrations. Please take a backup of your database prior to upgrading; the migrations run as part of the standard upgrade procedure. - No breaking API changes. The raw usage endpoint now always scopes to the virtual data centre in the request path; if you previously passed an identifier in the query string it is now ignored in favour of the path. - **Permission changes on upgrade.** The updater applies permission route removals that were intended some time ago but had not run on existing databases. On older databases this removes some previously granted Reseller access to update and delete VDCs, and a leftover Tenant Administrator wildcard over virtual data centre routes. New installations already behave this way. We recommend reviewing reseller and tenant administrator permissions after upgrade and adjusting roles if your operation relies on the previous behaviour. - **Scheduled task dependency.** The faster virtual machine and VDC pages read status from a cache populated by the `vm/sync` scheduled task. Ensure `vm/sync` is scheduled so pages show live status rather than "Pending" until the first refresh. - A new display-timezone setting controls how snapshot and backup times are shown. Set it to your preferred timezone after upgrade if you do not want times shown in the server default. - The stored cross-site scripting fix requires no data cleanup: existing names are made safe when displayed. We still recommend upgrading promptly. See [MPSA-2026-001](https://docs.multiportal.io/security-advisories/mpsa-2026-001/). Using the Community edition? Join the conversation on the [MultiPortal community forum](//forum.multiportal.io). It is the best place to ask questions, share feedback, and get support from the MultiPortal team and other operators. For full details on everything in this release, see the [1.2.1 release notes](//docs.multiportal.io/release-notes/v1.2.1/). Thank you for choosing MultiPortal.