CWP 2.0.5 (edge) – changes since 2.0.4
Fixes
- User-panel login: fixed sign-in failing right after a logout, and on servers where the PHP
session does not persist. Logging out destroyed the session that held the freshly rendered
login CSRF token, so the next sign-in was rejected with "failed". The token is now also
carried in a short-lived HttpOnly cookie (double-submit), so it survives a destroyed or
non-persistent session while still blocking login CSRF. The login page also returns a proper
error instead of a blank page when a request is refused. (#504017)
- Update reliability: an update interrupted part-way (for example a package-manager or mirror
error mid-run, as seen on CentOS 7 after the SCLo repositories moved to vault) no longer
leaves the panel stuck half-updated with a newer version number than its actual code. The
updater now records the code version it actually applied and, if the stored version is ahead
of it, re-applies the panel code on the next run instead of skipping it.
- Dashboard: fixed a false "MariaDB is stopped" warning (and the matching health-score dip) on
servers where the database runs under a different service name (mysqld/mysql) or outside
systemd; the dashboard now treats its own live database connection as the source of truth and
only falls back to the service check.
- Nginx (php-fpm mode): the "Block malicious requests" HTTPS vhost template was a copy of the
reverse-proxy template, so an unresolved proxy placeholder disabled the SSL vhost and HTTPS
fell back to the self-signed certificate. It is now a proper php-fpm (fastcgi) SSL template
that keeps the bad-robot and xmlrpc blocks. (#402220)