CWP New Version Released 1.30.10 LTS-Stable - Changelog

[Administrator]

CWP 1.30.10 (LTS) – changes since 1.30.9

Security (hardening)

This release hardens every code path that handles data coming from a backup, a
cPanel/other-panel import, a server-to-server migration, a cluster peer or the
remote API. In each case the values taken from the archive / migration source /
peer are now strictly validated and safely escaped or quoted before they are
used, so a malformed or tampered backup or archive can no longer affect anything
beyond the account being restored, and remote/peer input can no longer reach a
shell or the database unescaped.

- Backup restore: the database file names, the domain / subdomain names and
  paths, and the e-mail accounts, aliases and webmail (Roundcube) data read from
  inside the archive are validated and escaped before use - in both the main
  restore and the selective (per-item) restore path.
- cPanel / other-panel import and migration: the archive's top-level folder
  name, the old server IP, the FTP accounts (user name, home directory and
  password) and the mail data from the archive are validated and quoted before
  use; the restored FTP password is now applied in PHP instead of through a
  shell step.
- cwp->cwp migration and account transfer: the mail, webmail and account values
  from the remote source are escaped before they reach the database.
- Remote API: the classic API action selector only accepts valid action names;
  API keys are compared in constant time; the e-mail/account routes validate the
  account name.
- DNS cluster: a domain received from a cluster peer is validated before it is
  used.
- AutoSSL / SSL and the DNS slave sync: domains, names and paths are validated
  and quoted.
- User panel: the File Manager path check now uses a path-component boundary (so
  one account can no longer match a sibling account whose name is a prefix) and
  refuses archives that try to extract outside the account (zip-slip); the
  NodeJS version is validated before an install; and the account name is escaped
  in the disk-usage check used across several user-panel pages.
- Removed a leftover file that contained a hard-coded database password, and a
  dead webmail code block that contained a hard-coded address.

Package signing

- CWP now ships and imports its package-signing key, so the packages CWP installs
  from its own repository can be verified. (Signature verification is switched on
  in a later release, once the key is present on servers everywhere.)

Mail

- The one-click "Login to webmail" link now uses a cryptographically random token
  that is valid for 5 minutes (it was valid for 10 hours), so a leaked link can
  no longer be reused.

Fixes

- ModSecurity is now installed from the CWP repository as a package
  (cwp-mod_security2) with an up-to-date OWASP Core Rule Set, instead of being
  compiled on the server.
- Admin menu: corrected a few label typos ("DNS Functions", "Site.pro Website
  Builder", "Features").
- admin/design/img/js.php now returns the correct application/javascript content
  type.
- Roundcube updated to 1.6.21.