A guard meant for controlling sessions, applied to a session that never controls.
संक्षिप्त उत्तर
With View Only and Show My Cursor enabled, RustDesk forwards the observer's pointer so the remote side can see it. But those events still went through the peer-control protection check. When the remote user moved their mouse, the check treated the observer as contending for control and stopped sending updates, so the observer cursor froze. The fix skips that check in View Only plus Show My Cursor sessions, and stops local pointer moves from taking over the client-side cursor display in View Only mode. It was merged as PR #15936 and closed issue #15214.
The problem
RustDesk is an open-source, self-hostable remote desktop application. Issue #15214, on RustDesk 1.4.7 between two Windows 11 machines, described the observer cursor freezing "when the remote user starts moving their mouse", and only recovering after moving the local mouse out of the window and back in.
The fix
The change is in the Flutter client:
bool _checkPeerControlProtected(double x, double y) {
if (isViewOnly && showMyCursor) {
lastMousePos = ui.Offset(x, y);
return false;
} void updateLocalCursor(double x, double y) {
if (parent.target?.ffiModel.viewOnly == true) return;By the numbers
- Repository: rustdesk/rustdesk, 128,025 stars (Nov 3, 2026), Rust (change in the Dart/Flutter client), AGPL-3.0
- Files changed: 2
- Lines: +6 / -0
- Commits: 1
- Opened: Aug 21, 2026. Merged: Aug 24, 2026. Time to merge: 2 days, 16 hours
- Review: approved by a maintainer and merged
How the review went
Automated reviewers from CodeRabbit and Greptile commented first. Greptile raised a P1 concern that the early return could also let pointer button events bypass control arbitration. The final diff still contains that early return, and the public review does not establish that the concern was resolved. A maintainer approved the PR, and it was merged without further changes. The PR description states that no regression test was added because the affected logic depends on native bindings.
अक्सर पूछे जाने वाले प्रश्न
Does this affect sessions that control the remote machine?
The arbitration bypass is gated on View Only plus Show My Cursor, while the local cursor-display guard applies to all View Only sessions. The unresolved button-event review concern means the merge alone does not establish that control behavior is safe in every affected path.
Where can I read more?
See the pull request and the original issue.
लक्ष्य
A guard should know which situations it protects. Observer cursor updates need to work without weakening input restrictions. The unresolved review concern needs separate verification before treating this patch as evidence that both goals are met.
