CWP New Version Released 1.30.5 LTS-Stable - Changelog

[Administrator]

CWP 1.30.5 (LTS) – changes since 1.30.4

Fixes
- PHP Defender install: after turning it on for a PHP version, CWP now checks that PHP still starts with it enabled and rolls the change back if it does not, instead of leaving every PHP page of that version blank (empty 200) when the Snuffleupagus configuration is rejected.
- Legacy backup (cron_backup.php, the nightly backup from /etc/cron.daily/cwp): on PHP 8 the Remote MySQL backup step crashed with a fatal error (mysqli_fetch_object on a failed query) and the databases were not backed up remotely; it is now guarded so the MySQL step completes.
- PHP extensions self-heal: if a PHP build was left with an extension .ini but no matching .so (an old selector/switcher bug, e.g. mbstring/imagick after a failed build), every request of that PHP died with "Unable to load dynamic library". The nightly job now disables such an orphan .ini so sites run again and logs which extension to rebuild in the PHP Selector; it also warns if a third-party oniguruma5 package is installed.
- PHP Defender install: on servers using the ready-made RPM PHP builds the Snuffleupagus compile failed with a missing PCRE2 header (pcre2.h / pcre2-config); the installer now installs pcre2-devel with the other build tools.
- PHP Selector / PHP-FPM Selector: on EL9/EL10 the install list no longer offers PHP versions that have no build recipe for that OS (e.g. 5.x, 7.0-7.2), which previously failed with "Build options ... missing or invalid - update CWP". Only versions that can actually be built are offered; already-installed versions stay listed.
- Monit page on PHP 8: the page showed "Invalid name" with an empty "Configuration Available" list and the service list could 500 (array_multisort error). Both are fixed: the available/enabled monit config lists load, and the service list no longer errors.
- DNS: if a zone file was ever left with an unreplaced {IPSERVER} placeholder (from an older migration/restore), named refused to start and ALL zones on the server went down. The nightly job now repairs such a zone with the server's shared IP and brings named back, so one bad zone can no longer take DNS down.
- Node.js Manager: apps could all show as "stopped" with Start/Stop doing nothing when the account's configured Node.js version folder existed but had no pm2 (for example a version symlinked to another). The panel now looks for a Node.js build that actually has pm2.
- Account resource limits: setting limits with an empty user name no longer creates a stray /etc/security/limits.d/.conf file; an invalid user name is ignored.
- CSF/LFD contact e-mail (Settings): the address is trimmed and validated before saving, so a leading space is no longer stored (which had kept the "contact e-mail not set" warning on) and only a valid e-mail is written.
- ClamAV signature updates: the nightly job used to re-enable the clamav-freshclam service every night, so an admin who stopped/disabled it saw it switched back on; it is now started only once and a later disable (or mask) is honoured.
- Backup Manager (account SSL): accounts whose home already had an older ssl/ folder (without the autossl/ subfolders) had their SSL certificates left out of the backup ("No such file or directory"); the backup now always creates the needed folders. The autossl list also no longer accumulates duplicate domain entries on every run.
- User panel FTP accounts: adding or changing an FTP user failed on accounts whose "domain" has no dot (some setups create such accounts), because the FTP user/domain was required to contain a dot. Dotless account domains are accepted now (ownership is still checked against the account).
- Login (admin panel and user panel): a correct password was refused when the account's system password hash used the $6$rounds=N$ form (written by some providers' panels, e.g. Hostinger), and on newer systems yescrypt hashes could not log in at all. Login now checks the password against the whole stored hash, so all current hash formats ($1$/$5$/$6$, $6$rounds=N$, yescrypt, bcrypt) work.
- Backup Manager: on panel PHP 8.1+ the FTP restore account list came up empty because an internal log line tried to print the FTP connection object (fatal error); the list loads again.
- New accounts on servers running CWP Secure Kernel: a newly created account could end up without its PHP-FPM pool, so the website returned 503 (no PHP) until the pool was rebuilt by hand. The disk-quota safety check that gates pool creation no longer switches into the account's own shell (which the secure kernel blocks); it reads the disk quota directly as the panel, so the pool is written reliably and an account is only skipped when it is genuinely over its hard disk quota.
- External API log: when a remote app that signs in without an API key (for example Softaculous / Fantastico) is refused, the log now records which API action failed and whether a token was sent, instead of a bare "Invalid Token", so these integration problems can be diagnosed from the log.
- User panel Node.js Manager: the "npm install" log window kept spinning after the install had already finished, and a window reopened later showed nothing. The window now ends when the install actually ends, keeps the whole log (it is no longer emptied as it is read), and if the install cannot start because the account reached its process (nproc) limit it says so instead of running forever.
- User panel login on EL7: after a system update of the TLS libraries (nss, openssl, curl, ca-certificates) the login could fail ("failed", 77) until the panel PHP was restarted; CWP now restarts it by itself after such updates (also right after an update from Yum Manager).
- CWP Secure Kernel: if the kernel rules were not installed on a fresh server, they are now installed automatically at the first boot of the secure kernel.
- CWP Secure Kernel module: cleaner status wording when the secure kernel is not running.
- Security audit: a service that starts a self-built program (for example ntpd compiled by hand) is now reported as a warning to check, not as a known cryptominer. Hidden processes and the known miner file names are still reported as critical.
- User panel File Manager: uploading over an existing file failed with "500" when the old file could not be overwritten (for example a file left by a restore); it is now replaced, or a clear message says why not. Extracting archives works again on servers where it did nothing, and extract errors are shown.
- "Fix mail permissions" (API and account tools): on servers whose Postfix delivers as vmail, the mailbox records now match the file owners again, so the mailboxes stay readable.
- Server host name: the SSL vhost of the host name (hostname-ssl.conf) was never written on servers that did not have it (new EL9 / EL10 servers), because Change Hostname writes the vhosts before the new certificate exists; https on the host name then showed another site's certificate and /roundcube/ went to /webmail/. It is now written as soon as the host name certificate is installed, and the nightly job adds it when it is missing.
- PHP builds started from a terminal (for example /scripts/cwp_php build fpm 5.6 on EL8) no longer stop at the dependency step waiting for input.
- PHP Defender: on servers with CWP Secure Kernel whose rules do not yet let PHP read the PHP Defender rules, turning PHP Defender on is refused with a clear message instead of leaving every PHP page of the chosen versions empty.
- The unfinished DNS Cluster page (reachable only by its address) no longer runs its test actions; it points to Slave DNS Manager, which replicates the zones.
- Nightly security cleanup: if /root/.ssh or root's authorized_keys belongs to another user (which would let that user add a root login key), it is set back to root.
- CWP to CWP migration: the calls to the other server's API use https (port 2031) instead of plain http (2030), so the API key and the temporary account passwords are no longer sent unencrypted; migrating to servers that redirect port 2030 to 2031 works again.
- Panel PHP 8.3 update (update_cwpphp83): a damaged file in /etc/yum.repos.d (for example NUL bytes or a bare URL line) no longer stops the install; the damaged files are skipped for this install and named in the output.
- WebServer template editor: templates saved with %-sequences (for example %20 in rewrite rules), + or & were changed on save; the content is now saved exactly as typed, and only template files can be opened, saved or deleted from it.
- Security: account restores from cPanel archives (cPanel migration, cPanel backup restore) and the account backup restore now accept mail accounts, forwarders and auto-replies only for the restored account's own domains and with valid names, read the archive's mail data without the shell, and copy each domain's mail separately. Please update before migrating accounts from other servers.
- Admin web terminal: logging out of the admin panel now also ends the terminal access of that session (the session's terminal token stopped working only when the terminal was opened again).
- Cgroups resource limits page: on EL8/EL9/EL10 (cgroups v2, which has no cgrules.conf) the rules box no longer shows an error, and the rules are displayed safely.

[bablil]

The issue regarding the editing of empty files has not been fixed: "Fatal error: Uncaught ValueError: fread(): Argument #2 ($length) must be greater than 0 in /usr/local/cwpsrv/var/services/users/codeEditor.php:0 Stack trace: #0 /usr/local/cwpsrv/var/services/users/codeEditor.php(0): fread() #1 {main} thrown in /usr/local/cwpsrv/var/services/users/codeEditor.php on line 0"