CWP 1.30.10 (LTS) – changes since 1.30.9
Security (hardening)
This release hardens every code path that handles data coming from a backup, a
cPanel/other-panel import, a server-to-server migration, a cluster peer or the
remote API. In each case the values taken from the archive / migration source /
peer are now strictly validated and safely escaped or quoted before they are
used, so a malformed or tampered backup or archive can no longer affect anything
beyond the account being restored, and remote/peer input can no longer reach a
shell or the database unescaped.
- Backup restore: the database file names, the domain / subdomain names and
paths, and the e-mail accounts, aliases and webmail (Roundcube) data read from
inside the archive are validated and escaped before use - in both the main
restore and the selective (per-item) restore path.
- cPanel / other-panel import and migration: the archive's top-level folder
name, the old server IP, the FTP accounts (user name, home directory and
password) and the mail data from the archive are validated and quoted before
use; the restored FTP password is now applied in PHP instead of through a
shell step.
- cwp->cwp migration and account transfer: the mail, webmail and account values
from the remote source are escaped before they reach the database.
- Remote API: the classic API action selector only accepts valid action names;
API keys are compared in constant time; the e-mail/account routes validate the
account name.
- DNS cluster: a domain received from a cluster peer is validated before it is
used.
- AutoSSL / SSL and the DNS slave sync: domains, names and paths are validated
and quoted.
- User panel: the File Manager path check now uses a path-component boundary (so
one account can no longer match a sibling account whose name is a prefix) and
refuses archives that try to extract outside the account (zip-slip); the
NodeJS version is validated before an install; and the account name is escaped
in the disk-usage check used across several user-panel pages.
- Removed a leftover file that contained a hard-coded database password, and a
dead webmail code block that contained a hard-coded address.
Package signing
- CWP now ships and imports its package-signing key, so the packages CWP installs
from its own repository can be verified. (Signature verification is switched on
in a later release, once the key is present on servers everywhere.)
Mail
- The one-click "Login to webmail" link now uses a cryptographically random token
that is valid for 5 minutes (it was valid for 10 hours), so a leaked link can
no longer be reused.
Fixes
- ModSecurity is now installed from the CWP repository as a package
(cwp-mod_security2) with an up-to-date OWASP Core Rule Set, instead of being
compiled on the server.
- Admin menu: corrected a few label typos ("DNS Functions", "Site.pro Website
Builder", "Features").
- admin/design/img/js.php now returns the correct application/javascript content
type.
- Roundcube updated to 1.6.21.