Recent posts
#11
Updates / Re: CWP New Version Released 1...
Last post by sETu - Today at 05:36:01 AMmine yum update not working after update. 73 updates are available. when i click update all packages its taking 1 min max then again showing 73 updates are available.
#12
Updates / Re: New terminal not dealing w...
Last post by overseer - Today at 04:03:21 AMNow largely fixed for your purposes and workable? Or are there still some deal-breaker bugs present?
#13
Updates / Re: CWP New Version Released 1...
Last post by overseer - Today at 04:02:11 AMNot sarcasm, a genuine question: Is everything in the 1.30.x channel LTS? Or is the end goal that the last version of 1.30.xx will become the set LTS?
#14
Updates / Re: CWP New Version Released 1...
Last post by Starburst - Today at 01:07:17 AMYup. CWP is at 1.30.3 already.
#15
Updates / CWP New Version Released 1.30....
Last post by Administrator - November 03, 2026, 10:55:13 PMCWP (CentOS Web Panel) - Changelog
Version 1.30.2 (LTS) - changes since version 1.30.1
============================================================
CWP 1.30.2 is a security update of the LTS version. Updating is recommended for every server.
Security
--------
- Database names are always treated as plain names: the nightly backup, New Backup, account transfer, account
removal, the API and MySQL Manager pass only plain database names on and skip (and log) databases with unusual
names. MySQL Manager shows database, user and process names as text.
- API (v1): deleting a mailbox checks the address strictly and removes only that mailbox (with its mail folder).
Fixes
-----
- User panel Website Cache (Varnish): the page did not open (it stopped with a script error); it shows the cache state
of the account's domains and clears the cache again.
- Forms in both panels send their values safely: text with &, + or % (passwords, autoresponder texts, domain and
certificate fields, package and language settings, backups, migrations) arrives exactly as typed.
- User panel Cron Jobs: commands containing % (e.g. a URL with %2F or a date format) no longer run cut off.
- User panel e-mail accounts: a mailbox password containing +, & or % is set exactly as typed.
- User panel: changing the language or the theme and logging in keep every other setting of the account.
- User panel login: no extra redirect to http:// on the https port after the password check.
- User panel SSL wizard: certificates whose issuer has no organization name can be installed.
- Autoresponders: subjects with ' no longer get a \ in the reply; new autoresponders use UTF-8.
- Admin SSL certificates (PHP
: choosing a certificate whose file is missing or invalid no longer breaks the page.
- Admin Custom Sender IP: the domain table loads again.
- Admin dashboard: the live boxes (load, processes, MySQL) show their values right away.
- PHP 8: empty files can be opened in the File Editor, ModSecurity rules editor and during cPanel migrations.
- Admin Languages: only installed languages are accepted for the default user / admin language.
- Firewall rules list (iptables): opens quickly also when the DNS resolver is slow (it looked up every address).
- API (v1): deleting an account answers with plain JSON (the panel's HTML report was appended to it); a login link
(user_session) is given only for an existing account.
- Admin Console (terminal in the browser): characters outside plain ASCII (accents, the block characters of QR codes)
are shown correctly, and the backslash key works.
- New Backup: backups run with the lowest CPU and disk priority (like the legacy backup), so websites stay responsive
while a backup runs.
- Node.js Manager: deleting an application with a domain removes its web server backup file (PHP warnings in the
logs); small PHP 8 warning in the user panel Node.js page.
- PHP 8.3 panel migration (update_cwpphp83): a broken third-party repository (e.g. an old MariaDB repository) no
longer stops the panel PHP install; it is retried without the third-party repositories.
- User panel: an account whose panel configuration was first created at login (for example a new reseller account)
could not use the panel until the next night and returned to the login page; it now gets the full configuration
at once.
- Mail: the RBL checks (Spamhaus, SpamCop) reject only real listings. A server whose DNS resolver Spamhaus does not
serve got an error answer for every sender and rejected all incoming mail. Dead lists (SORBS, CBL) were removed
from the RBL monitor.
- IP NAT: an empty or damaged NAT settings file no longer fills the AutoSSL cron mail with PHP warnings (one per domain).
- Webmail (Roundcube): on servers upgraded from older Roundcube versions some messages could not be opened ("internal error") because a library of the new version was missing; the update now adds missing libraries, also on servers already on 1.6.20. The update always uses the panel PHP, also when another PHP version without mbstring is installed as the system "php".
- /scripts/cwp_update_user works again: it downloads the user panel files of the current release (it fetched a package that no longer exists and failed), checks the download and reports when the server cannot reach the CWP download servers.
Update: sh /scripts/update_cwp (as root) or wait for the nightly automatic update.
Version 1.30.2 (LTS) - changes since version 1.30.1
============================================================
CWP 1.30.2 is a security update of the LTS version. Updating is recommended for every server.
Security
--------
- Database names are always treated as plain names: the nightly backup, New Backup, account transfer, account
removal, the API and MySQL Manager pass only plain database names on and skip (and log) databases with unusual
names. MySQL Manager shows database, user and process names as text.
- API (v1): deleting a mailbox checks the address strictly and removes only that mailbox (with its mail folder).
Fixes
-----
- User panel Website Cache (Varnish): the page did not open (it stopped with a script error); it shows the cache state
of the account's domains and clears the cache again.
- Forms in both panels send their values safely: text with &, + or % (passwords, autoresponder texts, domain and
certificate fields, package and language settings, backups, migrations) arrives exactly as typed.
- User panel Cron Jobs: commands containing % (e.g. a URL with %2F or a date format) no longer run cut off.
- User panel e-mail accounts: a mailbox password containing +, & or % is set exactly as typed.
- User panel: changing the language or the theme and logging in keep every other setting of the account.
- User panel login: no extra redirect to http:// on the https port after the password check.
- User panel SSL wizard: certificates whose issuer has no organization name can be installed.
- Autoresponders: subjects with ' no longer get a \ in the reply; new autoresponders use UTF-8.
- Admin SSL certificates (PHP
: choosing a certificate whose file is missing or invalid no longer breaks the page.- Admin Custom Sender IP: the domain table loads again.
- Admin dashboard: the live boxes (load, processes, MySQL) show their values right away.
- PHP 8: empty files can be opened in the File Editor, ModSecurity rules editor and during cPanel migrations.
- Admin Languages: only installed languages are accepted for the default user / admin language.
- Firewall rules list (iptables): opens quickly also when the DNS resolver is slow (it looked up every address).
- API (v1): deleting an account answers with plain JSON (the panel's HTML report was appended to it); a login link
(user_session) is given only for an existing account.
- Admin Console (terminal in the browser): characters outside plain ASCII (accents, the block characters of QR codes)
are shown correctly, and the backslash key works.
- New Backup: backups run with the lowest CPU and disk priority (like the legacy backup), so websites stay responsive
while a backup runs.
- Node.js Manager: deleting an application with a domain removes its web server backup file (PHP warnings in the
logs); small PHP 8 warning in the user panel Node.js page.
- PHP 8.3 panel migration (update_cwpphp83): a broken third-party repository (e.g. an old MariaDB repository) no
longer stops the panel PHP install; it is retried without the third-party repositories.
- User panel: an account whose panel configuration was first created at login (for example a new reseller account)
could not use the panel until the next night and returned to the login page; it now gets the full configuration
at once.
- Mail: the RBL checks (Spamhaus, SpamCop) reject only real listings. A server whose DNS resolver Spamhaus does not
serve got an error answer for every sender and rejected all incoming mail. Dead lists (SORBS, CBL) were removed
from the RBL monitor.
- IP NAT: an empty or damaged NAT settings file no longer fills the AutoSSL cron mail with PHP warnings (one per domain).
- Webmail (Roundcube): on servers upgraded from older Roundcube versions some messages could not be opened ("internal error") because a library of the new version was missing; the update now adds missing libraries, also on servers already on 1.6.20. The update always uses the panel PHP, also when another PHP version without mbstring is installed as the system "php".
- /scripts/cwp_update_user works again: it downloads the user panel files of the current release (it fetched a package that no longer exists and failed), checks the download and reports when the server cannot reach the CWP download servers.
Update: sh /scripts/update_cwp (as root) or wait for the nightly automatic update.
#16
Updates / Re: CWP New Version Released 1...
Last post by cyberspace - November 03, 2026, 10:46:56 PMThanks guys! Seems like you have been saving up all the updates for the whole year instead of rolling them out one by one 
Now we're getting updates every day. Nice!
Keep up the good work !
Now we're getting updates every day. Nice!
Keep up the good work !
#17
Updates / Re: CWP New Version Released 1...
Last post by 6Sense - November 03, 2026, 08:39:20 PMIt fixed some issues in the CWP terminal. Correctly outputs UTF-8 characters again & user can now type \,$,^ into it from the keyboard.
Tnx CWP devs
Tnx CWP devs
#18
Updates / Re: CWP New Version Released 1...
Last post by Starburst - November 03, 2026, 01:26:45 PMCurious what 1.30.2 fixed/updated?
Thanks for all the work on CWP!
Thanks for all the work on CWP!
#19
Installation / Re: AlmaLinux 8 or 9?
Last post by Wonder - November 03, 2026, 07:20:02 AMQuote from: Starburst on November 02, 2026, 05:28:23 PMQuote from: Wonder on November 02, 2026, 05:18:53 PMI'm testing AL10 and it seems to be working correctly.
The only problem I've found also occurs with AL9 (I don't know why, but it doesn't generate the virtual host for the hostname).
That is an odd bug.
All of the AL9 servers have been online since before CWP 1.0, so they all generated OK.
Install CWP with AL10 on a test box and it seemed to work well.
When I installed AL9, I don't remember exactly when or what version of CWP I had, but it didn't generate a virtual host for the hostname. Right now, I don't have an AL9 installation. I installed AL10 to test it, and if it works, I'll keep it. You say everything works fine for you, but did it generate the virtual host for the hostname?
It didn't generate one for me.
I'm thinking of trying another installation.
#20
Updates / Re: CWP New Version Released 1...
Last post by overseer - November 03, 2026, 02:13:00 AMThanks for the fixes. Hooray -- the e-mail accounts list works again!