CWP (CentOS Web Panel) - Changelog
Version 1.30.1 (LTS) - changes since version 1.30
============================================================
CWP 1.30.1 is a security and stability update of the LTS version. Updating is recommended for every server.
The panel look and features are the same as in 1.30.
Security
--------
Stricter checks of every value before it is used (names, domains, IPs, paths, numbers), escaping of everything shown
in the panels, actions on an account's files done as that account instead of the system, and security tokens on
action links. Hardened in particular:
- API v1 (port 2304): every call needs an API key (switch: /usr/local/cwp/.conf/api_strict_guard_off); internal
migration routes accept calls only from the server itself; strict checks of all fixed-format parameters; reseller
API keys work only on the reseller's own accounts; passwords are set without a shell and are no longer logged.
- User panel login links (password login, admin "log in as user", reseller login, API autologin): every link carries
a random one-time code and expires.
- User panel internal API: sign-in codes, account details and account management only for the account's own panel
and the system; unused WebDisk and e-mail import calls removed.
- User panel: MySQL, Email Filters, Email Importer, Email Routing, Webmail auto-login, Autoresponders, DNS Zone Editor,
Subdomains, PHP settings, Disk Usage, Backups, Notifications, SSL / SSL Wizard, AutoSSL, Tomcat, Git Manager,
Streaming (ServerCast/AutoDJ), Varnish cache, ModSecurity editor, Statistics, Antivirus, Log Viewer, Cron Jobs,
Addons installer, Fix Account Issues, sign-out.
- User panel two-factor login: the QR code is drawn in the browser (nothing is sent to an outside service).
- Reseller panel: actions work only on the reseller's own accounts and packages; values are escaped.
- Admin panel: List Accounts / Edit / New Account, Packages, Mail Explorer, Mail Queue, Autoresponders, Cron Jobs,
Crontab for root, Logged-in users, Log Viewer, File Manager, Disk Usage, File Editor, Restore Backups, Backup
Manager, DNS functions and zone list, SSL Generator / SSL Certificates, IP Manager, IP NAT, Firewall, Process List,
Shell Access, System Statistics, Email Statistics, Services Monitor, Date & Time, Yum Manager, Cgroups, Security
Center, PHP Selector / PHP-FPM Selector / PHP Switcher, Apache builder, Tomcat, Shoutcast / Icecast, Features /
Themes / Languages, DNS Cluster, CWP Messenger, SiteProBuilder, PHP PECL, Monit, DKIM, Maldet, RBL check,
Bandwidth monitor, WebServers config editor, Simple Apache editor, dashboard notifications.
- Migrations and restores (CWP->CWP, cPanel->CWP, account transfer, cPanel account restore, cluster sync): values,
file names, certificates and DNS zones from the source are checked and written by the panel itself; passwords and
API keys are no longer logged.
- Panel output (process lists, logs, journal, installer output) is always shown as text.
- Passwords with special characters are set exactly as typed everywhere (accounts, root, MySQL, PostgreSQL, MongoDB,
mailboxes, FTP, migrations, API).
- CWP update: update check and update are downloaded only over verified https.
- Downloads used by the panel (mod_rpaf, ModSecurity, Shoutcast, Icecast) come from the CWP CDN with a fixed checksum;
installers from other vendors (acme.sh, Softaculous, SitePad, LiteSpeed, Maldet) over verified https; the cluster API
"dev" update option is removed.
- Mail server: the default trusted networks are limited to the server itself (127.0.0.0/8). Existing servers change
only if they still use the exact old default (10.0.0.0/8, 127.0.0.0/8, 192.168.0.0/16). Applications on other
machines of your private network must log in (SMTP authentication) to send mail.
Fixes
-----
- The CWP cron no longer restarts Apache every 4 hours (502 errors behind nginx) or the panel web service without a
reason.
- CWP update: servers on the old panel PHP 7.2 can update again; minimal EL9/EL10 installs get the "service" command;
ionCube loaders are replaced only after a complete download; the PHP 8.3 migration script no longer unpacks old
panel code over a newer one.
- Mail Policyd (cbpolicyd) on EL9: installs its Perl modules (Postfix answered "451 Server configuration problem" for
every message), and Postfix uses policyd only when it really runs.
- New Backup: S3 secret keys and FTP / Samba passwords of letters and digits work for scheduled full and incremental
backups and restores.
- PHP Defender (Snuffleupagus) installs on PHP 8.x, and failed versions are shown with the reason.
- MariaDB 11.x: user panel backups make clean dumps; the right MariaDB version is shown.
- Admin List Accounts no longer fails (HTTP 500) when the panel settings cannot be read or the list is loaded without
filters; editing a reseller's account keeps its reseller.
- ModSecurity: the installer enables it only when the module was built and Apache accepts the configuration; EL10
gets ModSecurity 2.9.8 (PCRE2).
- MongoDB Manager works with mongosh (EL8 and newer); PostgreSQL and MySQL Manager accept passwords with any
characters.
- Node.js Manager works when the panel's Node.js 14.15.3 is missing.
- Shoutcast installs on EL9 and EL10.
- cPanel migration: the free-space check checks the chosen backup file.
- ClamAV virus definitions are updated automatically; memcached builds against the system libmemcached; Monit
templates for PHP-FPM 8.3 - 8.5.
- Admin Policyd page: the page script no longer stops with an error after the table is drawn.
- User panel Streaming: uploading songs to a playlist works (the upload library was not loaded on that page).
Thanks for the fixes. Hooray -- the e-mail accounts list works again!
Curious what 1.30.2 fixed/updated?
Thanks for all the work on CWP!