CWP 1.30.6 (LTS) – changes since 1.30.5
Fixes
Login & security:
- Admin and user panel login now accept a correct root/user password for every /etc/shadow hash format — including $6$rounds=N$ (written by some hosting panels) and yescrypt ($y$) on EL9/EL10. Before, those formats were mis-parsed and a correct password was refused while SSH still worked.
- PHP Defender: its default rules no longer break WordPress or framework error pages. The extract() rule (which fired on the normal default and broke Laravel/Ignition error pages) was removed, and the CURLOPT_SSL_VERIFYPEER / CURLOPT_SSL_VERIFYHOST rules — which blocked WordPress core loopback requests (wp-cron, Site Health, REST) — now ship only in the opt-in "extreme" profile, not in the default "basic"/"intermediate" presets. Existing servers on the stock rules auto-update; a custom-mode per-site exception is still available for "extreme".
- PHP Defender Custom mode: the rule editor no longer opens empty when switching a PHP version from a preset to "custom"; it prefills with the ruleset currently running for that version.
- Security Audit: a finding is now alerted once per host (not on every run), and the "known malware host" check only fires on a real command context (curl/wget/pipe-to-shell), not on a bare mention — so searching a name as root no longer makes the alert fire forever. Each alert names the exact file:line.
- CSF/LFD contact e-mail saved with a leading space (which then kept the "contact e-mail not set" warning on) is now trimmed on save.
Mail / DNS:
- DKIM & SPF on a subdomain (for example support.example.com) now write the record into the parent zone (example.com) under the correct name, instead of needing — or creating — a separate subdomain zone that BIND does not serve. Before, DKIM was silently not published and SPF failed with "Please create the DNS zone first". A subdomain record no longer removes the parent domain's own SPF.
Backups:
- Scheduled (legacy) backup: the per-account MySQL dump step no longer aborts the whole job on PHP 8 — a failed database listing used to raise a fatal and stop the run with no archive and no error e-mail; it is now handled and reported.
- New Backup to FTP could fail with "login failed" although the Connection Test connected, when the saved FTP user/server had a trailing space/newline; these are now trimmed like the test does.
- Backup Manager FTP restore list is no longer empty on panel PHP 8.1+ (an FTP connection object logged into a string raised a fatal and the list came back empty).
- New Backup temp copy no longer counts toward the account's disk quota — a staging copy on the same quota filesystem could hit "Disk quota exceeded", stall rsync and stop the whole backup; staging is now quota-free and a per-account write error stops only that account and continues.
- A backup temp folder on a dedicated mount (for example /mnt/backups, /data, /srv, /media, /storage) is accepted again instead of aborting with "path not under allowed prefix"; only real system roots are still refused.
- New Backup notification e-mail is now sent even when a recipient is set but no event was ticked, with the full per-account report.
- Backup of SSL: accounts with an older ssl/ layout (no autossl/) no longer skip their SSL in the backup, and the SSL index no longer grows with duplicates on every run.
PHP / web server:
- "No Loader is installed": on a server whose panel PHP is now 8.3, an old path could append a hardcoded old-version ionCube loader to the panel php.ini, so every admin/user panel page and Roundcube showed "No Loader is installed"; the loader now follows the panel PHP version, and the nightly repair removes a stray wrong-version loader line and restarts the panel PHP-FPM so the panel recovers on its own.
- PHP-FPM pools are generated again for every account: a security/quota pre-check that ran a shell transition blocked by the Secure Kernel wrongly reported fine accounts as over quota, so new accounts got no pool and the site returned 503; the quota is now read directly as root with no shell transition and fails open.
- A PHP extension whose .ini exists but whose .so was never built (for example an 8.4/8.5 module that failed to compile) no longer makes every request log "Unable to load dynamic library"; the nightly job disables only that one .ini and reports it.
- Node.js Manager: the npm install log window ends when the install finishes instead of spinning forever, keeps the full log when reopened, and reports fork/nproc failures.
- WebServers per-domain config (Nginx & Apache mode): a custom Nginx/proxy template chosen for a domain is kept after a reload or rebuild, instead of falling back to the global default.
- User panel: FTP accounts can be added again for accounts whose "domain" has no dot (dotless internal names); the add no longer answers with a generic error.
- "Restart CWP" from the panel no longer kills its own request half-way; the restart is detached so it completes.
System / platform:
- SSH port shown in the panel is read from the effective sshd config, so it is correct when the port is set in /etc/ssh/sshd_config.d/*.conf (the EL9/EL10 default) rather than always showing 22.
- IP Manager (NetworkManager mode): "Add IP" now offers an Interface dropdown on servers with more than one NIC (default = the main interface) and adds the IP to the chosen NIC's connection — creating a connection for a never-configured second card without hijacking the default route — with a matching remove path.
- EL9 log rotation: CWP logs under /usr/local are rotated again (the hardened logrotate.service saw /usr read-only); a drop-in grants write access to the CWP log directories.
- Postfix on EL8: a new repair step fixes a Postfix left broken by a distro version change (stale shared-library directory, missing /usr/sbin/sendmail, lost MySQL map support) onto the installed version, without downgrading.
- clamav-freshclam is no longer re-enabled every night: an administrator's disable/mask is now honoured, and the service is not started on servers that use no mail/antivirus.
- Let's Encrypt (acme.sh) daily cron: a fresh install left /root/.acme.sh/cwp_certs uncreated, so the daily hostname-renewal cron mailed "cwp_certs is not a directory"; the folder is now created on install, and the nightly job creates it if missing.
- Monit Monitoring page works again on PHP 8 (it showed "Invalid name" with an empty configuration list); an empty security-limits file is no longer created from an empty username.
Diagnostics:
- The remote API logs the exact function and whether a token was presented on an authentication failure, to pin down third-party integration (e.g. Softaculous) "Invalid Token" reports.
Thank you!