CWP (CentOS Web Panel) - Changelog
Version 1.27 - changes since version 1.26
============================================================
PHP Selector, PHP-FPM Selector and PHP Switcher
-----------------------------------------------
- Ready-made PHP packages: the newest version of each PHP with the default CWP build options is installed from CWP
packages (cwp-php-cgiNN, cwp-php-fpmNN, cwp-php-switcherNN) in seconds instead of being compiled; php.ini,
php-fpm.conf and extra php.d settings are kept. Custom build options are still compiled from source, and when a
package is not available the version is compiled as before. The nightly PHP auto-update uses the packages too.
- ionCube: PHP 8.3, 8.4 and 8.5 built with the ionCube option now really get the ionCube loader (the PHP 8.2 loader
was used, so ionCube was missing or failed to load). Rebuild or reinstall the version to fix an existing server.
- php.ini is no longer overwritten when a version is rebuilt or updated (the new default is saved as php.ini.default).
- PHP Switcher: when a build fails, the current PHP keeps its extensions (mbstring, imagick, sodium...); PHP 8.3/8.4/8.5
get the mbstring module again.
- The result check after a build runs again, so the build screen shows whether the version was really installed.
- EL8/EL9 minimal installs: the service command is installed before a build when missing (PHP-FPM versions no longer
show as failed).
- EL9: PHP 7.4 builds again ("GD build test failed").
- PHP 8.4 / 8.5: the zlib build option can be selected again.
- CentOS 7: PHP 8.4 / 8.5 builds no longer stop with "libcurl >= 7.61.0 not met".
Security
--------
- CWP Secure Kernel: rules v59 (newer kernels and libraries, OpenSSL 3, PHP 8.4 ICU libraries, Node.js applications,
cron jobs that need PAM). The rules update remembers the version that was really loaded: rules that were unpacked but
not loaded are loaded on the next run; rule files locked or changed by hand are reported instead of being skipped
silently.
- Dashboard search and FTP Manager validate their input before using it in commands and database queries.
- New Backup archives, database dumps and temporary copies are readable by root only (they were readable by every
shell user); existing backup folders are locked down on the next backup run. The CWP to CWP migration package on the
source server is readable by root only.
- Leftover WordPress one-click login files from older versions are removed automatically, once, as a background job
(log: /var/log/cwp/wp_autologin_cleanup.log).
- Nightly security cleanup: the cloud admin login (centos, almalinux, rocky, ec2-user...) is no longer locked and its
SSH keys are no longer deleted; every change is logged in /var/log/hacker_cleanup.log; MySQL accounts named like
known backdoors are no longer deleted every night - the admin gets one notification per account instead.
- SFTP backups use the current stable phpseclib 2.0.55 (security fixes, PHP 8); about 35 MB of unused development
tools of the old library are removed from the server.
- Roundcube update: all downloads are checked against SHA-256 checksums before anything is installed.
Backups
-------
- New Backup restore no longer stops at the Domains step on the PHP 8 panel: addon domains, subdomains and mail accounts
are restored again; restored sites get the right document root (404) and permissions (403), the backup's own files
are no longer copied into the user's home, hidden files (.bashrc, .ssh...) are restored, and a selective restore of
domains from an SSH backup restores the chosen domains.
- FTP account passwords are restored again (New Backup and CWP to CWP).
- Passwords and keys containing "+" are saved and tested correctly (FTP, SFTP, SSH, Samba, S3); a "+" or "&" in a
server name, user name or path no longer breaks the settings. Re-enter the password of a remote backup that kept
failing with "login failed".
- Scheduled FTP, S3 and Samba backups no longer fail with "login failed" for passwords or secret keys made only of
letters and digits. If you entered the base64 form of your S3 secret as a workaround, enter the real secret again.
- User backup script: the archive no longer includes the backups folder itself; similar user names are no longer mixed
up.
- Daily MySQL backup on AlmaLinux 9: no more "perl(DBD::mysql) is needed by percona-toolkit" error; the grants file and
the MySQL Manager grants view work without Percona Toolkit.
CWP to CWP migration
--------------------
- Roundcube address books, identities and settings are copied again (every migration ended "with errors").
- API Manager: adding an API key also sets up the API service (port 2304) when it is missing, so a new server can be the
source of a migration.
System and web servers
----------------------
- Apache no longer goes down when the nightly cron reloads it right after a restart (busy servers).
- WebServers: nginx is installed from the nginx.org repository for the right EL version; when nginx cannot be installed
nothing is changed (before, Apache was moved to port 8181 anyway and all sites went down).
- Nightly update: stalled downloads time out instead of hanging the update for hours; servers left with old panel code
on the PHP 8.3 runtime get the new code.
- Security Advisor: yum/rpm checks have time limits (a stale RPM lock hung the nightly cron for days).
- AntiSpam (Spamhaus DROP list): the block works again and covers the whole list (CSF blocklist, refreshed every 24 h);
existing Spamhaus cron jobs, which never ran, are updated automatically.
- GoAccess statistics are generated again on EL8/EL9.
- Account removal deletes the account's MySQL databases again.
- No more "sed: can't read .../api.conf" on new installations.
Admin panel modules
-------------------
- Dashboard: the firewall is no longer shown as "Off" while CSF/LFD run (EL8/EL9 minimal installs); CPU, memory and
system details are refreshed after a reboot; Disk Details show used and free space.
- Code Editor: empty files (e.g. authorized_keys) open and can be saved again.
- Node.js Manager: installing NVM works again after a failed install (same fix in the Tomcat Manager).
- DNS Cluster (Cluster CWP) module loads again on the PHP 8 panel.
- Shoutcast / Icecast: the Config button of an Icecast server works again; the AutoDJ (LiquidSoap) install stops with a
clear message when its repository is not available (before, it could break every yum command on EL7).
- API Manager: messages and tooltips follow the panel language.
API (port 2304)
---------------
- Updating an account (/v1/account, action=udp) works with a key that has the account "Update" permission (it
always answered "Unauthorized action"); the reseller preset in API Manager ticks this permission.
- account list, account details and quotalimit return the real disk usage.
:) :) :)
A very nice update; CWP is always a favorite!
Thank you!
Finally some updates and changelogs!
oh my gosh, he looks great!!!!!
Finally... can I migrate my outdated servers (CentOS 7) to AlmaLinux 9?
Yes
What's new in v1.28?
That should be in a separate thread. Hopefully coming soon! ;)
My one complaint about the new UI is that the Server Settings, Service SSH, User Accounts, Security, and Plugins icons are all very faint against the dark background -- they need more contrast.
I've also never understood why Packages has a sub-item also called Packages. It doesn't need to accordion down in my opinion. The top level item could be the clickable link and that's good enough.
Also, a longstanding bug is that many times the accordion doesn't work -- you have to click on Dashboard to reload the home page, then the accordion menu works again.
also there is a bug in file manager in user panel
it does not make compress files whereas the same is working in admin panel filemanager