CWP (CentOS Web Panel) - Changelog
Version 1.30.3 (LTS) - changes since version 1.30.2
============================================================
CWP 1.30.3 is a security and bug-fix update of the LTS version. Updating is recommended for every server.
Security
--------
- Security audit (daily): detects a cryptominer that hides as system programs and kernel threads, scripts downloaded
and run directly as root (curl | bash), and warns when the remote API port 2304 is open to every IP but not used.
- Shoutcast: the streaming servers run as the shoutcast user (they ran as root); existing servers are switched during the update and keep running.
- User panel: the theme switch and the streaming sound preview accept only an existing theme and the account's own sound files.
- PHP 8.3 panel migration: a server that got the PHP 8.3 panel code this way is brought to the current release at
once (it kept the older panel code until the next update).
- Admin DNS Zone Editor: only zone files of the DNS server can be opened and changed; record values and the zone name
are passed safely to the system commands, and the page shows them as text.
- Admin Languages: the language file list accepts only an installed language folder.
- Admin PHP PECL: the PHP version and the package name are checked before any command runs.
- Legacy backup (nightly): the MySQL credentials are no longer passed on the command line of the database dumps.
- /scripts/mysql_pwd_reset and the policyd installer pass passwords to MySQL on standard input instead of the command line.
- Admin FTP Manager and the panel's internal FTP account API set FTP passwords without putting them on a command line.
- Panel self-check: a missing domains table is restored from a file in a root-only folder, not from a fixed name in /tmp.
- Account transfer from another server (password login): the remote server password is no longer passed on a command line during the copy.
- Root password, account password and CWP Cluster password changes (admin and user panel) set the system password without putting it on a command line (and work where the passwd command is missing).
- New accounts (panel, API, free hosting script, old migration page) and their MySQL users get their passwords without putting them on a command line, where other accounts could read them in the process list.
- Account unsuspend: the cleanup of the account's .htaccess works only on the account's own regular file.
- New Backup: SSH destination settings (host, user, port, key, folder) are checked before the nightly backup uses them in system commands.
Fixes
-----
- User panel: on some servers no button worked (Add cron job, Log out, ...): an experimental script compression was
on by default and broke the page scripts. It is now off by default.
- EL7: the Memcached extension can be installed for PHP 8.1 - 8.5 (PHP Selector) and 8.4 / 8.5 (PHP-FPM Selector,
PHP Switcher); the install script for these versions was missing.
- MongoDB Manager: with "authorization" turned on in its settings the page showed no databases and could not create
any ("Invalid database data"); the panel now uses its own MongoDB administrator (created when authorization is
turned on) and lists all databases, including admin, config and local.
- CWP->CWP migration: e-mail clients of migrated domains get the domain's own certificate again (mail.<domain>,
webmail.<domain>); after a migration Postfix and Dovecot served the server's hostname certificate for them.
- User panel login: nobody could log in after the system /tmp cleanup removed the folder of the one-time login codes;
the folder is now kept and recreated by the panel.
- User panel login: on servers where the panel's shell has no full search path, every login ended at the login page
again ("whoami: command not found"); the panel now checks the account without a shell command.
- User panel Cron Jobs: the usual endings ">/dev/null 2>&1" or ">> file 2>&1" are accepted again (such jobs could not
be added or changed); "Run now" works again.
- API (v1): the account list no longer fails when an account is over its disk quota.
- Admin DNS Zone Editor: editing a record so that its length stays the same (e.g. an IP 192.0.2.10 -> 192.0.2.20)
showed "saved" but the change was not written; deleting or editing records one after another could hit a different
record - the record is now checked before it is changed and the list reloads. Values with quotes no longer break
the record. Long TXT/DKIM records are split correctly.
- User panel: the Log out link of the default theme works again.
- PHP PECL, Shoutcast and Node.js: no more PHP warnings / shell messages in the logs on servers without PHP Selector builds,
without Shoutcast servers or without Node.js (NVM) installed.
- New Backup to an SSH server: backups with an SSH key never used the saved key (the upload failed unless the server accepted root's own key) and a failed upload was still reported as done; the key is used again, a failed upload is logged and mailed as an error, and browsing the folders of the SSH server works with the key. Incremental backups to an SSH server no longer fail with "Host key verification failed" on the first connection, and their failed uploads are reported too. The account list for restoring from an SSH backup server uses the key too.
- User panel Redirects: "Redirect with or without www" (the default) and "Only redirect with www." never redirected, and "Do Not Redirect www." redirected www. too; all three now work as named. Existing redirects are not changed: delete and add them again to get the corrected behaviour.
- User panel Email Accounts: adding or removing a forwarder on the page could switch the "Add mailbox" button off or on (it followed the forwarder limit instead of the mailbox limit).
- EL9 / EL10: DNS zone changes no longer print "egrep: warning: egrep is obsolescent" (into cron mails and logs).
- User panel DNS Zone Editor: SRV records work: adding one wrote a wrong name ("__sip" for "_sip", and the domain twice), editing one dropped the leading underscore, and a protocol entered as "_tcp" was refused.
- /scripts/fix_local_pcre2 also repairs the panel PHP when LD_LIBRARY_PATH is set in the environment (it took the system library for its check and skipped the repair).
- User panel DNS Zone Editor: TXT records longer than 255 characters (a 2048-bit DKIM key, a long SPF) can be added and edited (they were refused), and quotes inside a TXT value are kept (they split the value). The list shows TXT values made of several strings as one text.
- User panel file manager (old version, fileManager2.php): no PHP 8 error when the account has no quota data.
- User panel Backups: restoring a database from a MySQL backup also restores its database users again (the users file had a wrong name in MySQL backups), and the main account's wildcard grant is no longer saved as an empty database file.
- User panel dashboard: the MongoDB tile opens MongoDB Manager (it opened Node.js Manager).
- The AutoSSL cron no longer sends an empty e-mail every run (a stray space in a panel file was printed); the same stray spaces or empty lines were removed from 31 more panel files (API, ajax and module pages).
- Security audit: on a server with a damaged RPM database it reported system libraries as "not owned by any package" and updated services as suspicious processes; it now detects the damaged database, reports it (repair: rpm --rebuilddb) and skips the package-ownership checks.
- Firewall, Services Monitor and PHP-FPM Selector pages: no more PHP 8 notices and shell error messages in the panel log (EL9/EL10 without chkconfig, no monitor configured yet).
- User panel Reseller > Accounts: the used bandwidth of an account is shown with its unit (it was a bare MB number next to the limit in GB).
- Netdata (Admin > Netdata): installs the netdata package from EPEL on EL7, EL8 and EL9 (the old installer built Netdata from source, which fails on current versions, and used repositories that are gone); the page shows why when no package is available (EL10). Uninstall: yum -y remove netdata.
- Security Advisor and /scripts/mysql_pwd_reset recognise every EL7-EL10 system (AlmaLinux, Rocky Linux, ...) by its EL version; they looked only for CentOS / Red Hat / Oracle / CloudLinux release packages.
- Change Hostname: an account's subdomain can no longer be set as the server hostname (the hostname SSL step deleted that subdomain's certificate files); the existing check covered only domains.
- Legacy backup report mail: a short transfer summary per account instead of the list of every file (the daily mail repeated thousands of lines).
- Admin panel: on OpenVZ and other servers without /proc/kallsyms every page wrote "grep: /proc/kallsyms: No such file or directory" to the panel log; fewer PHP warnings and shell messages on the Mail accounts, Packages, Quota, PHP addons, cgroups and Services Monitor pages.
- Disk Quota setup, the Postfix DKIM & SPF installer and the Apache h264 option run their setup scripts only when they were downloaded completely from the CWP CDN (a CDN error page was run as a shell script, and DKIM & SPF was marked installed after a failed download).
- Cgroups (Resource Limits): changing the cgroups policy of a package now applies it to every account of that package (before only new accounts got it), and a second account in the same request no longer stops with a PHP error; new command /scripts/cwp_cgroups_reapply <package id | name | all> applies the package policies again; deleting an account removes only its own cgred rule; cgred no longer stops when all limit switches are off (rules without controllers); /scripts/cwp_api reports an unknown module or action with exit code 2.
- cPanel migration and cPanel account restore: the databases of the archive are imported with a temporary MySQL user that has rights only on that database - they ran as MySQL root before, only databases and MySQL users named after the account are created, and from the archive grants only those for the account's own users and databases are applied.
- Installers and updates that download from the CWP CDN (Apache rebuild, FFmpeg, PostgreSQL, Varnish, ModSecurity rules, Tomcat, TeamSpeak, SHOUTcast, mail server, httpd service files, autoresponder): the file is used only when its content is of the expected kind, a file that is already there is replaced only by a good download, and Varnish is no longer installed with "curl ... | sh". The ModSecurity rule update keeps the old rules when the download fails (they were deleted first).
- The old PHP Switcher and PHP Selector pages (not in the menu any more) are retired and point to the current pages.
- TeamSpeak 3 page: no "su: user ts3 does not exist" in the panel log when TeamSpeak is not installed.
- Security Advisor: no false "MySQL root login with any password is possible" alarm on MariaDB 10.4+ (the system root logs in through the socket by design); the check now tests a password login over the network port.
- Security Audit: an enabled mod_auth_form whose module file is the unchanged one of the CWP Apache package is reported as information (unused module, disabling recommended) instead of a malware warning; a changed or suspicious module file still raises the alarm.
- FTP Accounts (admin): a refused new FTP user now says why (user name, FTP path outside the account home, already exists) instead of a general "Please try again" error; spaces around the values are ignored, and success is shown only when the user was really added.
- Tomcat / proxied apps: a site proxied to an app path (Tomcat "port/app") got an unfinished web server config that was disabled on rebuild, and sessions did not work because the app cookie path (/app) did not match the site (/); the app path is kept and the cookie path is rewritten (ProxyPassReverseCookiePath). Also fixed a PHP 8 fatal error in a web server settings helper.
- Nginx / Varnish in front of Apache: the real visitor IP config (mod_rpaf, or mod_remoteip when mod_rpaf is missing) is now added by the daily panel job when it is missing, e.g. when the web servers were chosen in the installer; Apache logs and ModSecurity saw the proxy address before.
- Admin: the old Nginx Proxy page (not in the menu) is retired and points to Select WebServers - just opening it on EL7-EL10 stopped Apache and installed an old init.d script (on EL9 and newer Apache then stayed down).
- Admin DNS zone editor: a TXT value pasted with its quotes got a space in front (" v=DMARC1"), and invisible characters copied from web pages (no-break / zero-width space) went into the zone file and broke the record list, edit and delete; both are cleaned now (Mantis 242).
- Firewall page: it showed "Disabled" whenever LFD was stopped although CSF was filtering; the state now comes from CSF itself, with a warning when LFD is not running or CSF is in TESTING mode (Mantis 305).
- User panel File Manager: downloading a big file (e.g. a 1 GB backup) failed with HTTP 500 - files are now streamed in pieces; a download path outside the home folder is refused (the check only set an error code); the old file manager download no longer adds a number to the end of the file.
- Account limits: an open-files (nofile) limit above what the server or container allows is lowered to that maximum, so cron no longer logs "pam_limits: Could not set limit for nofile" for every job (Mantis 282).
Update: sh /scripts/update_cwp (as root) or wait for the nightly automatic update.