CWP 1.30.9 (LTS) – changes since 1.30.8
Fixes
Installers:
- Softaculous and Fantastico installs (WordPress and others) no longer fail with "The MySQL Connection could not be established" / "Invalid Token". The 1.30.6 security change made the local integration token single-use, but Softaculous reuses one token across the several API calls of a single install, so every call after the first was rejected. The token is now accepted for the length of its own short expiry instead of being consumed on the first call, and the path stays restricted to local callers, so installs work again with no loss of the 1.30.6 protection. (#787928)
Nightly maintenance:
- The nightly job no longer starts PHP-FPM versions you keep disabled. It was adding a monit watch for every installed PHP-FPM version, and monit then started the ones that were switched off; it now watches only the versions that are enabled in systemd. (#460699)
- The nightly AutoSSL renewal no longer emails a "cat: /usr/local/cwp/.conf/vhosts-ssl.json: No such file or directory" error (and a foreach() warning) on a fresh server that has no accounts or SSL certificates yet. A missing/empty list is now treated as "nothing to do".
- PHP extensions self-heal (follow-up to #151688): the decision is now made per scan directory across all installed PHPs, not per single binary, so a shared .ini is kept when any PHP sharing that directory can use the module (e.g. the account's web PHP loads sodium while a stray CLI php cannot). A module that no PHP can provide anywhere is still disabled.
Admin panel:
- The admin sidebar menu now shows your admin language even when another value in cwp.ini contains a special character. The menu read the whole cwp.ini with parse_ini_file(), which returns nothing for the entire file if any single value has an unquoted special character, so the language was lost and the menu fell back to English although the translation existed. The language is now read directly. (forum)
- The "CWP -> CWP Migration" page no longer opens blank with a "Call to undefined function cwp_admin_module_lang()" error. The helper the page uses was missing from the LTS function library; it is now defined. (#841893)
- "Available updates" indicator is now update-channel aware: on servers that follow the edge channel it compares against the edge version list as well, so the indicator is correct for them. Servers on the normal (LTS) channel are unaffected. (#504017)
Security (hardening):
- User-panel Cron: the account name is now escaped where it is passed to the lsattr check, as defence in depth.