CWP New Version Released 1.30.13 LTS-Stable - Changelog

[Administrator]

CWP 1.30.13 (LTS) - changes since 1.30.10

Security

- Security Audit - credential-stealer detection. An unowned shared library (one no package owns) loaded into a
  credential-handling daemon - SSH, the Dovecot/Postfix mail stack, OpenDKIM or saslauthd - is now reported as a
  CRITICAL credential-stealer finding, and the alert lists every process that loads it (it previously named only the
  one service being scanned, hiding that SSH and the mail daemons were the real carriers). This detection does not rely
  on the standard package-verify check, which a tampered package db can make look clean. (#905352)
- Security Audit - the anti-rootkit library scan no longer looks broken. The dedicated scan needs a statically-linked
  helper (a rootkit that tampers with the system libraries cannot fool a static tool). The audit no longer prints a
  failure-looking line when none is present: it now also uses a system static helper when one is installed, and
  otherwise prints a clear note that this optional scan was skipped (nothing was flagged, the general check still runs)
  with how to enable it. (forum 15331)
- PHP Defender. The hardening rules no longer break a site that legitimately writes a debug log file (for example
  WordPress debug logging is now allowed), while only the malicious case (a log sent to a script path) is still
  blocked. The incidents viewer also reads the attacker address from the web-server log when the site runs behind the
  nginx-to-Apache proxy. (#127406)
- ModSecurity manager (user panel) - hardening. Values built from a domain name are now fully quoted when used
  (defense in depth; access was already restricted to the account's own domains).
- Statistics (user panel) - hardening. The domain and file names shown on the page are now safely escaped.

Fixes

- Admin menu language reliably follows your panel language (LANGADMIN). Two problems are fixed. First, one special
  character in any value of the panel config file could make the whole file unreadable, so the admin language was lost
  and the menu fell back to English; the language is now read directly. Second, the menu translations were looked up in
  files that were not shipped in the LTS build, so every lookup fell back to English even when the translation existed -
  those translation files (34 languages) are now shipped, and the menu follows your chosen language. (forum 15315)
- User panel speed. The panel rebuilt every page template from source on every request (about 280 KB of templates per
  page), adding 100+ ms of pure compilation per page. Compiled templates are now cached per account (inside the
  account's own home, isolated, refreshed when a template changes; it falls back safely if the cache cannot be
  created). (#447329)
- Varnish cache purge. The user-panel purge could silently do nothing on servers with a non-standard Varnish admin
  port or secret: the Varnish admin tool was called without the admin address and secret, and its auto-detect failed.
  CWP now detects those from the running Varnish, then from the Varnish config, then from the standard default.
  (#127406)
- WordPress Manager - db clone / staging. Cloning or staging a site could silently produce a near-empty db
  (only the first table restored). The account's own limited db user could not replay the default db
  export; the export is now taken with options that work with that limited user, so it restores completely. Also fixed:
  the install registry could fail to write (a doubled config path) and the module could stop with a PHP error for any
  account that already had a stored install. The WordPress command tool now runs with a per-request time limit, and
  installing from a web address is restricted to the official WordPress.org source.
- Softaculous / Fantastico installs. Installs no longer fail with a MySQL-connection or invalid-token message: the
  1.30.6 single-use local token broke installers that reuse one token across several API calls. The token is now
  accepted for the length of its own short expiry instead of being used up on the first call, with the local-caller
  restriction kept. (#787928)
- CWP-to-CWP Migration. The migration page no longer opens blank with an undefined-function error; the per-module
  language helper is now present in the LTS code. (#841893)
- Nightly AutoSSL on a server with no domains. The nightly AutoSSL job no longer emails a missing-file error and a
  related warning on a fresh server with no accounts or certificates yet. (forum 15314)
- Nightly no longer starts disabled PHP-FPM versions. The maintenance job added a monitor for every installed PHP-FPM
  version and then started the ones switched off; it now monitors only versions that are enabled. (#460699)
- PHP extensions self-heal. The nightly job now decides per scan directory across all installed PHP versions, so a
  shared settings file is no longer disabled because one command-line PHP cannot load a module that the account's web
  PHP loads fine (which had broken WordPress with a 500). A genuinely missing module is still disabled. (#151688)
- Spam Annihilator. Removed a dead link in the user panel that opened a "module does not exist" page - Spam Annihilator
  is a server-wide admin module and has no user-panel page. (forum 334369)

Improvements

- Apache Builder. Added Apache 2.4.71 to the version list (source on the CWP CDN). (forum 15326)
- ModSecurity rule set. The "OWASP latest" option is now labelled "OWASP CRS 3 (auto-updated to the latest 3.x
  release)" so it is clear it tracks the OWASP CRS 3.x line (the option still auto-updates within 3.x). (forum 15328)