CWP New Version Released 2.0.5 Edge-Latest - Changelog

[Administrator]

CWP 2.0.5 (edge) – changes since 2.0.4

Fixes

- User-panel login: fixed sign-in failing right after a logout, and on servers where the PHP
  session does not persist. Logging out destroyed the session that held the freshly rendered
  login CSRF token, so the next sign-in was rejected with "failed". The token is now also
  carried in a short-lived HttpOnly cookie (double-submit), so it survives a destroyed or
  non-persistent session while still blocking login CSRF. The login page also returns a proper
  error instead of a blank page when a request is refused. (#504017)

- Update reliability: an update interrupted part-way (for example a package-manager or mirror
  error mid-run, as seen on CentOS 7 after the SCLo repositories moved to vault) no longer
  leaves the panel stuck half-updated with a newer version number than its actual code. The
  updater now records the code version it actually applied and, if the stored version is ahead
  of it, re-applies the panel code on the next run instead of skipping it.

- Dashboard: fixed a false "MariaDB is stopped" warning (and the matching health-score dip) on
  servers where the database runs under a different service name (mysqld/mysql) or outside
  systemd; the dashboard now treats its own live database connection as the source of truth and
  only falls back to the service check.

- Nginx (php-fpm mode): the "Block malicious requests" HTTPS vhost template was a copy of the
  reverse-proxy template, so an unresolved proxy placeholder disabled the SSL vhost and HTTPS
  fell back to the self-signed certificate. It is now a proper php-fpm (fastcgi) SSL template
  that keeps the bad-robot and xmlrpc blocks. (#402220)