CWP 1.30.7 (LTS) – changes since 1.30.6
Fixes
Security & update channel:
- Panel update/version checks (the 3rd-party version feed and "Check for updates") and the MySQL upgrade helper now fetch over HTTPS instead of plain HTTP, closing an on-path (man-in-the-middle) tampering surface on root-run downloads.
- New "Ebury" cleanup tool (/scripts/cwp_ebury_clean) plus a Security Audit check that detect and quarantine a tampered libkeyutils (the Ebury SSH credential-stealer) using a static busybox, so the check works even on a compromised host.
- CWP Secure Kernel (/scripts/cwpsecure_kernel): UEFI boot entry handling made consistent (EFI grubenv/saved_entry) and the trial-boot / bootcheck rollback loop no longer stalls, so a Secure Kernel install cannot leave the server unbootable.
Updates & packages:
- The 8.3 PHP updater (/scripts/update_cwpphp83) now works on end-of-life CentOS 8 by pointing yum at the CentOS vault repositories instead of the dead mirrorlist.
- Dashboard "Available updates": the red alert now clears after the updates are installed (it could stay red forever), and the count refreshes correctly.
ModSecurity:
- Enabling ModSecurity on AlmaLinux/EL10 works: it reuses the existing mod_security2 module instead of trying to recompile, and re-enabling is idempotent.
PHP Defender:
- The default rules no longer break WordPress: wp-includes core requests (curl-based loopback/REST) are allowed before the strict SSL-verify drops, so WordPress sites keep working while the protections stay on.
Mail / DNS:
- Webmail now opens on webmail.<domain> with a certificate that matches the name, instead of the shared server IP/hostname that triggered a browser certificate warning.
- PHP mail logging: when it is enabled (/scripts/php_mail_log), PHP-FPM now writes the mail() log per account under /home/<user>/logs/phpmail.log instead of the shared /usr/local/apache/logs/phpmail.log. On EL8/EL9 (and hardened EL7) the PHP-FPM service runs with a read-only /usr, so the old shared path made mail() fail with "Read-only file system" and some frameworks (SMF, Laravel) then sent no mail at all; the per-account path is writable and allowed by the Secure Kernel. Plain PHP (CGI) keeps the shared log.
Backups:
- Legacy (scheduled) backup now includes each account's MongoDB databases, and restores them.
- CWP-to-CWP "Sync again": the account is no longer left with 403 errors after a sync (file/owner permissions are re-applied to every docroot), and mail that was already delivered on the destination is no longer duplicated on each re-sync.
- New Backup Manager: restoring a MONTHLY backup from an FTP destination now works (an internal period check was misspelled and never matched, so the monthly FTP restore did nothing). Daily/weekly and local/SSH restores were unaffected.
Databases (user panel):
- Deleting a database user no longer logs a MySQL "Table mysql Db doesn't exist" error (corrected to the real lowercase grant table), and unlinking a user from a database now reports success (HTTP 200) instead of 403.
- Creating a database with a user now reports the real result: if the database is made but the user cannot be created, the panel says so instead of claiming "created successfully".
File Manager:
- Decompressing a .gz file works on EL7 again (the old extractor used a gzip flag that CentOS 7's gzip does not support). ZIP and tar/tar.gz were unaffected.