CWP 2.0.4 (edge) – changes since 2.0.3
New
- cwpsapi - CWP's own LSAPI PHP handler with LSCache. An account can be switched
from PHP-FPM to CWP's LiteSpeed-compatible LSAPI handler with one click in the
panel; the handler brings a built-in full-page cache (LSCache). A new user-panel
page shows the cache status for the account and offers a "Clear cache" button
(the page is shown only while the account is served by the LSAPI handler). When
a selected PHP version is missing, an account is never left broken on it - it
falls back cleanly.
- CWP Cage (hardening): per-account isolation improvements for the mount-namespace
/ cgroups cage.
Security (hardening)
This release hardens every code path that handles data coming from a backup, a
cPanel/other-panel import, a server-to-server migration, a cluster peer or the
remote API. In each case the values taken from the archive / migration source /
peer are now strictly validated and safely escaped or quoted before use, so a
malformed or tampered backup or archive can no longer affect anything beyond the
account being restored, and remote/peer input can no longer reach a shell or the
database unescaped.
- Backup restore: the database file names, the domain / subdomain names and
paths, and the e-mail accounts, aliases and webmail (Roundcube) data read from
inside the archive are validated and escaped before use, in both the main
restore and the selective (per-item) restore path.
- cPanel / other-panel import and migration: the archive's top-level folder name,
the old server IP, the FTP accounts (user name, home directory and password)
and the mail data from the archive are validated and quoted before use; the
restored FTP password is now applied in PHP instead of through a shell step.
- cwp->cwp migration and account transfer: the mail, webmail and account values
from the remote source are escaped before they reach the database.
- External migration: imported DNS records are validated.
- Remote API: the classic API action selector only accepts valid action names;
API keys are compared in constant time; the e-mail/account routes validate the
account name.
- DNS cluster: a domain received from a cluster peer is validated before use.
- AutoSSL / SSL and the DNS slave sync: domains, names and paths are validated
and quoted.
- User panel: the File Manager path check now uses a path-component boundary (so
one account can no longer match a sibling account whose name is a prefix) and
refuses archives that try to extract outside the account (zip-slip); the NodeJS
version is validated before an install; and the account name is escaped in the
disk-usage check used across several user-panel pages.
- Varnish vhosts now match the host exactly; Nginx cache responses send
X-Content-Type-Options: nosniff.
- Rspamd: the web-UI password is kept out of the process list.
- Removed a leftover file that contained a hard-coded database password, and a
dead webmail code block that contained a hard-coded address.
Package signing
- CWP now ships and imports its package-signing key, so the packages CWP installs
from its own repository can be verified. (Signature verification is switched on
in a later release, once the key is present on servers everywhere.)
Mail
- The one-click "Login to webmail" link now uses a cryptographically random token
that is valid for 5 minutes (it was valid for 10 hours), so a leaked link can
no longer be reused.
Fixes
- ModSecurity engine updated to 2.9.8, installed from the CWP repository as a
package (cwp-mod_security2) with an up-to-date OWASP Core Rule Set, instead of
being compiled on the server.
- Admin menu: corrected a few label typos ("DNS Functions", "Site.pro Website
Builder", "Features").
- admin/design/img/js.php now returns the correct application/javascript content
type.
- Roundcube updated to 1.6.21.