iobroker.mywebui 1.179.0 → 1.180.2

package/README.md

@@ -302,6 +302,15 @@ runtime.html?screenName=screen2
 	Placeholder for next versions:
 	### __WORK IN PROGRESS__
 -->
+### 1.180.2 (2026-10-07)
+* (runtime) a user in no ioBroker group is no longer taken as "administrator" by the browser (startup screen per group, report toolbox); callers read the user's id instead of a missing name field
+
+### 1.180.1 (2026-10-07)
+* (runtime) mywebui sets `local_username` itself after login (the user badge no longer depends on the Global Script); getCurrentUser() called before the connection waits for it instead of failing, and a failure is no longer remembered as user "admin" / group administrator; the state details check runs after the connection is up
+
+### 1.180.0 (2026-10-07)
+* (security) ioBroker rights are told, not silent: group rights (State read/write, sendTo …) and the object ACL (owner/group/everyone, first match as js-controller) are checked before a write/read/sendTo and the server's refusals are caught; a notice in the corner in 5 languages (access.*), write feedback shows denied, read quality marks unreadable states 🔒; subscribed values the user may not read are dropped (ioBroker sends them anyway); IOB.access(id), IOB.accessDenied; secWriteState no longer writes past the ioBroker ACL without a security model
+
 ### 1.178.0 (2026-10-06)
 * (screens) startup screen: right-click a screen → Set as startup screen (everyone) or for a user group; Settings → Startup screen (default + ordered group rules); rename/delete keep the rules in step; no startup screen and no "start" → a message instead of an error, and a link to a missing screen says so