Recent Posts
31
Backup / Re: NEW Backup (beta) / Restore Account -> Does not list accounts to restore
« Last post by adrianofnatal on October 11, 2026, 04:09:28 PM »S3 Backup never worked.
It fails to upload in scheduled backup.
Sometimes a manual backup works. In a second try, does not work anymore.
I didnm' use it anymore.
I generate a local backup (which works well unless you not using PostgreSQL because does not backup databases) and got a script to upload backups to somewhere.
Backup is a VERY IMPORTANT, if not the MOST IMPORTANT thing in a server.
After version 0.9.xx this new backup never worked.
It fails to upload in scheduled backup.
Sometimes a manual backup works. In a second try, does not work anymore.
I didnm' use it anymore.
I generate a local backup (which works well unless you not using PostgreSQL because does not backup databases) and got a script to upload backups to somewhere.
Backup is a VERY IMPORTANT, if not the MOST IMPORTANT thing in a server.
After version 0.9.xx this new backup never worked.
32
Aplications / Re: Abnormal fevicon and title in google results
« Last post by overseer on October 11, 2026, 02:27:29 PM »PM me server details if you want me to take a look.
33
Aplications / Re: Abnormal fevicon and title in google results
« Last post by kadybee on October 11, 2026, 12:31:07 PM »This hack has been around a while and mentioned in a number of threads here, search for mod_auth_form.so
There is a fake version that gets loaded and causes the likes of 'googlebot' to get a different page than other browsers.
In the first instance comment out (or remove) the loading of that module in your apache/conf/http.conf;
remove the file from the modules directory and then work on all the other security suggestions in threads here to clean up and lock them out.
There is a fake version that gets loaded and causes the likes of 'googlebot' to get a different page than other browsers.
In the first instance comment out (or remove) the loading of that module in your apache/conf/http.conf;
remove the file from the modules directory and then work on all the other security suggestions in threads here to clean up and lock them out.
34
Information / Re: Possible CWP Security Issue – Malicious JavaScript Injection
« Last post by anandmys on October 11, 2026, 12:09:14 PM »Any step by step guide to check the infection and clean? Looks like atleast 1 of my installation is infected
35
Aplications / Abnormal fevicon and title in google results
« Last post by anandmys on October 11, 2026, 11:46:45 AM »I am using cwp to host this website https://mysorecabs.com
If you search site:mysorecabs.com in Google, you see the icon and title (SPAM) 100% different from what you see in view source or browser
I saw this in few more websites on the same server.
Looks like something hacked at server level.
Please help
If you search site:mysorecabs.com in Google, you see the icon and title (SPAM) 100% different from what you see in view source or browser
I saw this in few more websites on the same server.
Looks like something hacked at server level.
Please help
36
CentOS-WebPanel Bugs / Re: Google Recapcha not work on all CWP servers.
« Last post by comokoko on October 11, 2026, 09:01:39 AM »Website owners use Google reCAPTCHA for site registrations, member logins, form submissions, and the like.
In other words, reCAPTCHA is not used for CWP panel logins or similar access points.
In other words, reCAPTCHA is not used for CWP panel logins or similar access points.
37
CentOS-WebPanel Bugs / User panel DNS Zone Editor: cannot add/edit A/AAAA records - backend rejects wit
« Last post by brishisharma on October 11, 2026, 01:40:47 AM »Version: [fill in, e.g. CWP7 1.x - see admin panel footer]
OS: [e.g. AlmaLinux 9.8]
Repro:
1. User panel > DNS Functions > DNS Zone Editor
2. Select any domain
3. Add Type Record > A
4. Fill Name + IPv4 + TTL > Save record
5. Fails every time with: "Your DNS zone is experiencing errors,
your DNS service has not been update!"
Root cause:
File cwp_theme/original/js/modules/dns_zone_editor.js.twig,
validform() generic branch (used for A/AAAA records). It reads
$("#flag_"+reg).val() / $("#tag_"+reg).val(), but modal-A /
modal-AAAA in modal_tools.html have no flag/tag inputs (those are
CAA-only fields). The missing elements yield JS undefined, so the
request is sent as ...®=A&flag=undefined&tag=undefined.
The backend replies {"result":"error","msj":"invalid field: flag"}
(captured via syscall trace on the php-fpm worker), which the UI
renders as the DNSZONEOFF error. So ALL A/AAAA adds and edits from
the user panel are broken regardless of input.
Suggested fix:
In the generic branch, do not send flag/tag for record types that
have no such fields (A/AAAA) - same as the CNAME/SRV branches
already handle their own params. One-line change, verified working:
var data = "domain="+domainsel+"&namereg="+namereg+"&valuereg="
+valuereg+"&cachereg="+cachereg+"®="+reg;
OS: [e.g. AlmaLinux 9.8]
Repro:
1. User panel > DNS Functions > DNS Zone Editor
2. Select any domain
3. Add Type Record > A
4. Fill Name + IPv4 + TTL > Save record
5. Fails every time with: "Your DNS zone is experiencing errors,
your DNS service has not been update!"
Root cause:
File cwp_theme/original/js/modules/dns_zone_editor.js.twig,
validform() generic branch (used for A/AAAA records). It reads
$("#flag_"+reg).val() / $("#tag_"+reg).val(), but modal-A /
modal-AAAA in modal_tools.html have no flag/tag inputs (those are
CAA-only fields). The missing elements yield JS undefined, so the
request is sent as ...®=A&flag=undefined&tag=undefined.
The backend replies {"result":"error","msj":"invalid field: flag"}
(captured via syscall trace on the php-fpm worker), which the UI
renders as the DNSZONEOFF error. So ALL A/AAAA adds and edits from
the user panel are broken regardless of input.
Suggested fix:
In the generic branch, do not send flag/tag for record types that
have no such fields (A/AAAA) - same as the CNAME/SRV branches
already handle their own params. One-line change, verified working:
var data = "domain="+domainsel+"&namereg="+namereg+"&valuereg="
+valuereg+"&cachereg="+cachereg+"®="+reg;
38
CentOS-WebPanel Bugs / Re: User cpanel URLs and login completely broken since CWP 1.18 update
« Last post by cyberspace on October 10, 2026, 09:48:35 PM »Set the permissions on the ~/.my.cnf file to 640 or 600 to prevent other users from accessing it. The file must be owned by root:root.
Additionally, check the permissions of the /root directory. It must also be owned by root:root, with permissions set to 750 or 550 (no permissions for others).
I suspect that the user files may have been removed by the CWP update process. I'm not sure exactly what CWP does during the upgrade process. However, it may execute some SQL queries, and if some SQL query fails due to incorrect login credentials, this could lead to unexpected behavior during the upgrade. Just a guess.
Additionally, check the permissions of the /root directory. It must also be owned by root:root, with permissions set to 750 or 550 (no permissions for others).
I suspect that the user files may have been removed by the CWP update process. I'm not sure exactly what CWP does during the upgrade process. However, it may execute some SQL queries, and if some SQL query fails due to incorrect login credentials, this could lead to unexpected behavior during the upgrade. Just a guess.
39
CentOS-WebPanel Bugs / Re: Google Recapcha not work on all CWP servers.
« Last post by Starburst on October 10, 2026, 09:10:49 PM »Curious why not use the built in Google Authenticator 2FA?
No editing code that could change with an update.
No editing code that could change with an update.
40
Backup / Re: NEW Backup (beta) / Restore Account -> Does not list accounts to restore
« Last post by DA_MAN on October 10, 2026, 08:47:30 PM »Version CWP1.18 and still the ioncube files are the source of S3 backups not populating the restore window. Can someone take a look at this please? I have no problems saving to S3 storage, but the restore mechanism does not populate the "Frequency" "Backup" or "User Account" fields from the restore module. I'm on the AlmaLinux 9 train for CWP.
