User cpanel URLs and login completely broken since CWP 1.18 update

Since the CWP update to 1.18 my user panels are completely broken. I see a message in the admin that I should stop and start the firewall. This did not make any difference.

The links from the admin panel all produce 404 errors, and if I try to manually login then I get a 500 error. I took a log in the apache logs but cannot find anywhere where the hostname access is logged.

I don't know if this is a reoccurrence of the problem described here: https://forum.centos-webpanel.com/centos-webpanel-bugs/fix-user-panel-login-is-not-working/, or something new?

CWP stores access and error logs of the panel in:

/usr/local/cwpsrv/logs/
/usr/local/cwp/php71/var/log

Many thanks. This reveals a whole stack of unexpected errors. I'm lost!

Code: [Select]

2026/10/07 10:53:33 [error] 1932162#0: *1902 FastCGI sent in stderr: "PHP message: PHP Warning:  main(): open_basedir restriction in effect. File(/usr/local/cwpsrv/var/services/user_files/modules/cwp_framework/CWPUserIndex.php) is not within the allowed path(s): (/home/username:/tmp:/usr/local/cwpsrv/var/services/users:/usr/local/cwpsrv/var/services/twig/:) in /usr/local/cwpsrv/var/services/users/index.php on line 0
PHP message: PHP Warning:  main(/usr/local/cwpsrv/var/services/user_files/modules/cwp_framework/CWPUserIndex.php): failed to open stream: Operation not permitted in /usr/local/cwpsrv/var/services/users/index.php on line 0
PHP message: PHP Warning:  main(): open_basedir restriction in effect. File(/usr/local/cwpsrv/var/services/user_files/modules/cwp_framework/classes/CWPAuth.php) is not within the allowed path(s): (/home/username:/tmp:/usr/local/cwpsrv/var/services/users:/usr/local/cwpsrv/var/services/twig/:) in /usr/local/cwpsrv/var/services/user_files/modules/cwp_framework/CWPUserIndex.php on line 0
PHP message: PHP Warning:  main(/usr/local/cwpsrv/var/services/user_files/modules/cwp_framework/classes/CWPAuth.php): failed to open stream: Operation not permitted in /usr/local/cwpsrv/var/services/user_files/modules/cwp_framework/CWPUserIndex.php on line 0
PHP message: PHP Fatal error:  main(): Failed opening required '/usr/local/cwpsrv/var/services/user_files/modules/cwp_framework/classes/CWPAuth.php' (include_path='.:/usr/local/cwp/php71/lib/php') in /usr/local/cwpsrv/var/services/user_files/modules/cwp_framework/CWPUserIndex.php on line 0" while reading response header from upstream, client: 80.113.2.130, server: localhost, request: "POST /username/ HTTP/1.1", upstream: "fastcgi://unix:/usr/local/cwp/php71/var/sockets/username.sock:", host: "hostname.com:2083", referrer: "https://hostname.com:2031/"

(I replaced my server hostname and the user in question with generic text above)

According to the error, PHP open_basedir blocks access to the files of the panel:

What kind of URL do you use to access the panel ? Is it something like:
https://cpanel.domain.com ?

If so, try:
https://domain.com:2031/

Did you change PHP settings recently ?

Can confirm user panel logs in fine on version 1.18

No I didn't change any PHP settings. And I can't access the panels via either URL format.

I did deal with a similar hacking exploit to the one you described, I wonder if I accidentally locked something down.

Did you try disabling mod_secutity?

1. Open the file:

/usr/local/cwpsrv/conf.d/users.conf

and check all lines that contains "open_basedir ...".

Make sure the open_basedir is configured at listed below:

Code: [Select]

fastcgi_param   PHP_ADMIN_VALUE "open_basedir = /tmp/:/usr/local/cwpsrv/var/services/users/login/:/usr/local/cwpsrv/var/services/users/cwp_theme/:/usr/local/cwpsrv/var/services/twig/";

You should see 4 absolutely identical lines there.

Make backup and fix the lines if they have different values.


2. Open the file:
/usr/local/cwpsrv/conf.d/users/USERNAME.conf
(USERNAME is the username of some regular (not root) problematic account)

Check the line with open_basedir there. It should be:

Code: [Select]

fastcgi_param   PHP_ADMIN_VALUE "open_basedir =/home/USERNAME:/home/jail/USERNAME/./home/USERNAME:/tmp:/var/softtmp:/usr/local/cwpsrv/var/services/users:/usr/local/cwpsrv/var/services/user_files/modules:/usr/local/cwpsrv/var/services/twig:";


!!! Make backup of the file before any modifications and fix values.

3. Restart cwp if you modified some files:

Code: [Select]

service cwp-phpfpm restart
service cwpsrv restart
service cwpsrv-phpfpm restart


Many thanks. I checked this and the value in /usr/local/cwpsrv/conf.d/users/USERNAME.conf was vary marginally different (identical to the values in /usr/local/cwpsrv/conf.d/users.conf) but correcting it as per your suggestion has not solved the problem.

Also, I don't know if it is significant, but the directory /usr/local/cwpsrv/conf.d/users/ was empty apart from the one user I had used to test the login (I have 12 clients hosted on the server)

I am seeing multiple issues as follows:

 1. When trying to auto-login to a user's control from the admin panel, I get 404 errors on the format https://server.name:2083/username (forwarded from the cp link https://server.name:2083/token=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx)

 2. If I go to the URL  https://server.name:2083/ and enter a username and password, I get the "succesfully logged in" message briefly, then the browser forwards me back to the login page

This is the same for all user accounts on the server.

I am wondering if I should run the apache vhost rebuild script as suggested in the older thread about this problem.

Any thoughts?

CWP 1.18 Admin (:2031) and User (:2083) interfaces are working fine on AL9.

What OS are you running?

The folder:
 /usr/local/cwpsrv/conf.d/users/
contains identical config files with minor changes for each user.

Just generate other config fiels for other users using the config file of the test user.

Additionally, make sure the folder:
/usr/local/cwpsrv/var/services/users
contains symlinks to /usr/local/cwpsrv/var/services/users for each user: