CWP New Version Released 2.0.4 Edge-Latest - Changelog

[Administrator]

CWP 2.0.4 (edge) – changes since 2.0.3

New

- cwpsapi - CWP's own LSAPI PHP handler with LSCache. An account can be switched
  from PHP-FPM to CWP's LiteSpeed-compatible LSAPI handler with one click in the
  panel; the handler brings a built-in full-page cache (LSCache). A new user-panel
  page shows the cache status for the account and offers a "Clear cache" button
  (the page is shown only while the account is served by the LSAPI handler). When
  a selected PHP version is missing, an account is never left broken on it - it
  falls back cleanly.

- CWP Cage (hardening): per-account isolation improvements for the mount-namespace
  / cgroups cage.

Security (hardening)

This release hardens every code path that handles data coming from a backup, a
cPanel/other-panel import, a server-to-server migration, a cluster peer or the
remote API. In each case the values taken from the archive / migration source /
peer are now strictly validated and safely escaped or quoted before use, so a
malformed or tampered backup or archive can no longer affect anything beyond the
account being restored, and remote/peer input can no longer reach a shell or the
database unescaped.

- Backup restore: the database file names, the domain / subdomain names and
  paths, and the e-mail accounts, aliases and webmail (Roundcube) data read from
  inside the archive are validated and escaped before use, in both the main
  restore and the selective (per-item) restore path.
- cPanel / other-panel import and migration: the archive's top-level folder name,
  the old server IP, the FTP accounts (user name, home directory and password)
  and the mail data from the archive are validated and quoted before use; the
  restored FTP password is now applied in PHP instead of through a shell step.
- cwp->cwp migration and account transfer: the mail, webmail and account values
  from the remote source are escaped before they reach the database.
- External migration: imported DNS records are validated.
- Remote API: the classic API action selector only accepts valid action names;
  API keys are compared in constant time; the e-mail/account routes validate the
  account name.
- DNS cluster: a domain received from a cluster peer is validated before use.
- AutoSSL / SSL and the DNS slave sync: domains, names and paths are validated
  and quoted.
- User panel: the File Manager path check now uses a path-component boundary (so
  one account can no longer match a sibling account whose name is a prefix) and
  refuses archives that try to extract outside the account (zip-slip); the NodeJS
  version is validated before an install; and the account name is escaped in the
  disk-usage check used across several user-panel pages.
- Varnish vhosts now match the host exactly; Nginx cache responses send
  X-Content-Type-Options: nosniff.
- Rspamd: the web-UI password is kept out of the process list.
- Removed a leftover file that contained a hard-coded database password, and a
  dead webmail code block that contained a hard-coded address.

Package signing

- CWP now ships and imports its package-signing key, so the packages CWP installs
  from its own repository can be verified. (Signature verification is switched on
  in a later release, once the key is present on servers everywhere.)

Mail

- The one-click "Login to webmail" link now uses a cryptographically random token
  that is valid for 5 minutes (it was valid for 10 hours), so a leaked link can
  no longer be reused.

Fixes

- ModSecurity engine updated to 2.9.8, installed from the CWP repository as a
  package (cwp-mod_security2) with an up-to-date OWASP Core Rule Set, instead of
  being compiled on the server.
- Admin menu: corrected a few label typos ("DNS Functions", "Site.pro Website
  Builder", "Features").
- admin/design/img/js.php now returns the correct application/javascript content
  type.
- Roundcube updated to 1.6.21.