CWP New Version Released 1.30.2 LTS-Stable - Changelog

[Administrator]

CWP (CentOS Web Panel) - Changelog
Version 1.30.2 (LTS) - changes since version 1.30.1
============================================================
CWP 1.30.2 is a security update of the LTS version. Updating is recommended for every server.

Security
--------
- Database names are always treated as plain names: the nightly backup, New Backup, account transfer, account
  removal, the API and MySQL Manager pass only plain database names on and skip (and log) databases with unusual
  names. MySQL Manager shows database, user and process names as text.
- API (v1): deleting a mailbox checks the address strictly and removes only that mailbox (with its mail folder).

Fixes
-----
- User panel Website Cache (Varnish): the page did not open (it stopped with a script error); it shows the cache state
  of the account's domains and clears the cache again.
- Forms in both panels send their values safely: text with &, + or % (passwords, autoresponder texts, domain and
  certificate fields, package and language settings, backups, migrations) arrives exactly as typed.
- User panel Cron Jobs: commands containing % (e.g. a URL with %2F or a date format) no longer run cut off.
- User panel e-mail accounts: a mailbox password containing +, & or % is set exactly as typed.
- User panel: changing the language or the theme and logging in keep every other setting of the account.
- User panel login: no extra redirect to http:// on the https port after the password check.
- User panel SSL wizard: certificates whose issuer has no organization name can be installed.
- Autoresponders: subjects with ' no longer get a \ in the reply; new autoresponders use UTF-8.
- Admin SSL certificates (PHP : choosing a certificate whose file is missing or invalid no longer breaks the page.
- Admin Custom Sender IP: the domain table loads again.
- Admin dashboard: the live boxes (load, processes, MySQL) show their values right away.
- PHP 8: empty files can be opened in the File Editor, ModSecurity rules editor and during cPanel migrations.
- Admin Languages: only installed languages are accepted for the default user / admin language.
- Firewall rules list (iptables): opens quickly also when the DNS resolver is slow (it looked up every address).
- API (v1): deleting an account answers with plain JSON (the panel's HTML report was appended to it); a login link
  (user_session) is given only for an existing account.
- Admin Console (terminal in the browser): characters outside plain ASCII (accents, the block characters of QR codes)
  are shown correctly, and the backslash key works.
- New Backup: backups run with the lowest CPU and disk priority (like the legacy backup), so websites stay responsive
  while a backup runs.
- Node.js Manager: deleting an application with a domain removes its web server backup file (PHP warnings in the
  logs); small PHP 8 warning in the user panel Node.js page.
- PHP 8.3 panel migration (update_cwpphp83): a broken third-party repository (e.g. an old MariaDB repository) no
  longer stops the panel PHP install; it is retried without the third-party repositories.
- User panel: an account whose panel configuration was first created at login (for example a new reseller account)
  could not use the panel until the next night and returned to the login page; it now gets the full configuration
  at once.
- Mail: the RBL checks (Spamhaus, SpamCop) reject only real listings. A server whose DNS resolver Spamhaus does not
  serve got an error answer for every sender and rejected all incoming mail. Dead lists (SORBS, CBL) were removed
  from the RBL monitor.
- IP NAT: an empty or damaged NAT settings file no longer fills the AutoSSL cron mail with PHP warnings (one per domain).
- Webmail (Roundcube): on servers upgraded from older Roundcube versions some messages could not be opened ("internal error") because a library of the new version was missing; the update now adds missing libraries, also on servers already on 1.6.20. The update always uses the panel PHP, also when another PHP version without mbstring is installed as the system "php".
- /scripts/cwp_update_user works again: it downloads the user panel files of the current release (it fetched a package that no longer exists and failed), checks the download and reports when the server cannot reach the CWP download servers.

Update: sh /scripts/update_cwp (as root) or wait for the nightly automatic update.