Show Posts
This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.
Pages: [1]
1
CentOS-WebPanel Bugs / Re: Bug in new CWP Update: Yum Manager stuck on "Checking for updates..." due to 404
« on: Today at 06:05:25 AM »
The 404 and the stuck module are two independent bugs. zakrpa spotted the 404
in the Alma 9 / 1.3 thread and noted that fixing it doesn't resolve the stuck
modules — correct, because the hang has a different cause.
Root cause of the hang: jQuery is loaded twice, in two different versions.
design/img/js.php (head) -> jQuery 1.7.1
design/js/libs/jquery-2.1.1.min.js (footer) -> jQuery 2.1.1
DataTables is injected mid-body (design/3rdparty/datatables/js/
jquery.dataTables.min.js, HTTP 200, loads fine) and registers on the jQuery
active at that moment: 1.7.1. The footer script then replaces window.jQuery and
$ with a fresh 2.1.1 instance. When document.ready fires, $ resolves to 2.1.1,
which has no .dataTable.
Verified in console on a stuck mod_security page:
$.fn.jquery -> "2.1.1"
typeof $.fn.dataTable -> "undefined"
and the module dies at:
Uncaught TypeError: Cannot read properties of undefined (reading 'ext')
at $.fn.dataTable.ext.search.push(...)
That handler is what calls initModSecModule(), so the spinner never resolves
and no XHR is ever sent — the server never receives a module request at all.
The backend is fine; the page renders correct data (cwp_pro, modsec_installed,
domains_list are all populated).
Affected on my server, all with the same console error: mod_security,
yum_manager, php_switch_v2, firewallv2, csf. Modules whose plugins load after
the footer jQuery work normally — list_accounts renders its DataTable fine.
The separate 404: the template requests
design/charts/sparklines/jquery.sparkline.js
while the file ships at
design/plugins/charts/sparklines/jquery.sparkline.js
That only breaks the sparklines in blank.js.
For anyone thinking of symlinking around it: /usr/local/cwpsrv/htdocs/admin/
and all of design/ are chattr +i, so it can't be worked around locally. Both
issues need a vendor fix.
Environment: AlmaLinux 8.10, cwpsrv-1.24.0-2, cwpphp-7.2.30-3.
in the Alma 9 / 1.3 thread and noted that fixing it doesn't resolve the stuck
modules — correct, because the hang has a different cause.
Root cause of the hang: jQuery is loaded twice, in two different versions.
design/img/js.php (head) -> jQuery 1.7.1
design/js/libs/jquery-2.1.1.min.js (footer) -> jQuery 2.1.1
DataTables is injected mid-body (design/3rdparty/datatables/js/
jquery.dataTables.min.js, HTTP 200, loads fine) and registers on the jQuery
active at that moment: 1.7.1. The footer script then replaces window.jQuery and
$ with a fresh 2.1.1 instance. When document.ready fires, $ resolves to 2.1.1,
which has no .dataTable.
Verified in console on a stuck mod_security page:
$.fn.jquery -> "2.1.1"
typeof $.fn.dataTable -> "undefined"
and the module dies at:
Uncaught TypeError: Cannot read properties of undefined (reading 'ext')
at $.fn.dataTable.ext.search.push(...)
That handler is what calls initModSecModule(), so the spinner never resolves
and no XHR is ever sent — the server never receives a module request at all.
The backend is fine; the page renders correct data (cwp_pro, modsec_installed,
domains_list are all populated).
Affected on my server, all with the same console error: mod_security,
yum_manager, php_switch_v2, firewallv2, csf. Modules whose plugins load after
the footer jQuery work normally — list_accounts renders its DataTable fine.
The separate 404: the template requests
design/charts/sparklines/jquery.sparkline.js
while the file ships at
design/plugins/charts/sparklines/jquery.sparkline.js
That only breaks the sparklines in blank.js.
For anyone thinking of symlinking around it: /usr/local/cwpsrv/htdocs/admin/
and all of design/ are chattr +i, so it can't be worked around locally. Both
issues need a vendor fix.
Environment: AlmaLinux 8.10, cwpsrv-1.24.0-2, cwpphp-7.2.30-3.
2
Updates / Re: cwpsrv 1.24.0-2 overwrites cwpsrv.conf — service fails to start (missing hostnam
« on: Today at 06:04:35 AM »
Confirming this on another server: AlmaLinux 8.10, cwpsrv-1.24.0-2 installed
2026-07-28 03:37. Same failure, but it stayed latent until a reboot the next
morning — worth adding, because others may only hit this weeks from now.
Two findings:
1) hostname.crt is a dead artifact — hostname.bundle is canonical.
The only script that writes hostname.crt is /scripts/generate_hostname_ssl
(line 137), and that runs only on install or hostname change. The renewal
chain is:
/etc/cron.daily/cwp_acme.sh -> acme.sh -> /scripts/hostname_ssl_restart_services
and that works exclusively with hostname.bundle (deriving hostname.pem from it
for postfix/dovecot/pure-ftpd). So after any AutoSSL renewal, .key/.cert/.bundle
are fresh while .crt is stale — key/cert mismatch at the next cwpsrv start.
Note that CWP's own generate_hostname_ssl (lines 171-184) sets all four cwpsrv
confs to hostname.bundle, and conf.d/api.conf already ships that way. The RPM
templates contradict CWP's own script.
2) The failure is silent until reboot.
hostname_ssl_restart_services runs "service cwpsrv reload". With a broken config
the reload fails, the exit code is ignored, and the running master keeps serving
the old certificate from memory. On my server the cert renewed on 11 July and
the panel kept working until a kernel update rebooted the box on 29 July —
then ERR_CONNECTION_REFUSED, restart counter at 602.
On the workarounds circulating in the other thread: symlinking or copying
hostname.cert gives you the leaf only, without the intermediate chain. Browsers
often mask this by caching intermediates, but API clients and curl will fail.
Use the bundle instead:
cp -a /etc/pki/tls/certs/hostname.bundle /etc/pki/tls/certs/hostname.crt
Or point the confs at hostname.bundle directly:
sed -i 's#/etc/pki/tls/certs/hostname\.crt#/etc/pki/tls/certs/hostname.bundle#g' \
/usr/local/cwpsrv/conf/cwpsrv.conf \
/usr/local/cwpsrv/conf.d/{user-api,users,webmail}.conf
/usr/local/cwpsrv/bin/cwpsrv -t && systemctl reload cwpsrv
Always verify before starting:
openssl rsa -noout -modulus -in /etc/pki/tls/private/hostname.key | openssl md5
openssl x509 -noout -modulus -in /etc/pki/tls/certs/hostname.bundle | openssl md5
And a warning: do NOT run generate_hostname_ssl as a fix. It replaces a valid
Let's Encrypt hostname certificate with a CWP self-signed one and restarts
postfix, dovecot, cwpsrv, httpd, nginx and pure-ftpd in sequence.
Requests for CWP:
- Ship the cwpsrv conf templates pointing to hostname.bundle, matching
generate_hostname_ssl.
- Mark the conf files %config(noreplace), or at minimum write .rpmsave.
- Have hostname_ssl_restart_services check the exit code of "cwpsrv -t" and
log a failure, instead of leaving a reload that silently did nothing.
2026-07-28 03:37. Same failure, but it stayed latent until a reboot the next
morning — worth adding, because others may only hit this weeks from now.
Two findings:
1) hostname.crt is a dead artifact — hostname.bundle is canonical.
The only script that writes hostname.crt is /scripts/generate_hostname_ssl
(line 137), and that runs only on install or hostname change. The renewal
chain is:
/etc/cron.daily/cwp_acme.sh -> acme.sh -> /scripts/hostname_ssl_restart_services
and that works exclusively with hostname.bundle (deriving hostname.pem from it
for postfix/dovecot/pure-ftpd). So after any AutoSSL renewal, .key/.cert/.bundle
are fresh while .crt is stale — key/cert mismatch at the next cwpsrv start.
Note that CWP's own generate_hostname_ssl (lines 171-184) sets all four cwpsrv
confs to hostname.bundle, and conf.d/api.conf already ships that way. The RPM
templates contradict CWP's own script.
2) The failure is silent until reboot.
hostname_ssl_restart_services runs "service cwpsrv reload". With a broken config
the reload fails, the exit code is ignored, and the running master keeps serving
the old certificate from memory. On my server the cert renewed on 11 July and
the panel kept working until a kernel update rebooted the box on 29 July —
then ERR_CONNECTION_REFUSED, restart counter at 602.
On the workarounds circulating in the other thread: symlinking or copying
hostname.cert gives you the leaf only, without the intermediate chain. Browsers
often mask this by caching intermediates, but API clients and curl will fail.
Use the bundle instead:
cp -a /etc/pki/tls/certs/hostname.bundle /etc/pki/tls/certs/hostname.crt
Or point the confs at hostname.bundle directly:
sed -i 's#/etc/pki/tls/certs/hostname\.crt#/etc/pki/tls/certs/hostname.bundle#g' \
/usr/local/cwpsrv/conf/cwpsrv.conf \
/usr/local/cwpsrv/conf.d/{user-api,users,webmail}.conf
/usr/local/cwpsrv/bin/cwpsrv -t && systemctl reload cwpsrv
Always verify before starting:
openssl rsa -noout -modulus -in /etc/pki/tls/private/hostname.key | openssl md5
openssl x509 -noout -modulus -in /etc/pki/tls/certs/hostname.bundle | openssl md5
And a warning: do NOT run generate_hostname_ssl as a fix. It replaces a valid
Let's Encrypt hostname certificate with a CWP self-signed one and restarts
postfix, dovecot, cwpsrv, httpd, nginx and pure-ftpd in sequence.
Requests for CWP:
- Ship the cwpsrv conf templates pointing to hostname.bundle, matching
generate_hostname_ssl.
- Mark the conf files %config(noreplace), or at minimum write .rpmsave.
- Have hostname_ssl_restart_services check the exit code of "cwpsrv -t" and
log a failure, instead of leaving a reload that silently did nothing.
Pages: [1]
