CWP edge 2.0.7 - changes since 2.0.6
Naming
- CWP's own PHP handler and its built-in full-page cache are now called "cwpsapi (lsphp)" and "LSAPI-Cache". CWP's
per-account isolation is "CWP Cage". Nominative references to the real LiteSpeed Cache WordPress plugin and the
CloudLinux products are unchanged.
- The per-account WordPress feature is consistently called "WordPress Manager" throughout the panels.
WordPress Manager
- The user-panel WordPress Manager is now an assignable module in the admin Feature manager and is shown to accounts
whose package includes it (it was missing from the module list, so it only appeared for accounts with all features).
- The admin "WordPress Manager" (server-wide fleet view) moved to the Script Installers menu group so it is easy to
find.
- Database clone / staging: the account's own limited database user could not replay the default database export, so a
clone could restore only the first table; the export now uses options that work with that limited user, so it
restores completely. The install registry write (a doubled config path) and a PHP error for accounts with a stored
install are also fixed, the WordPress command tool runs with a per-request time limit, and installing from a web
address is restricted to the official WordPress.org source.
Security
- Security Audit: an unowned library loaded into a credential daemon (SSH, mail stack, OpenDKIM, saslauthd) is reported
as a CRITICAL credential-stealer finding, listing every process that loads it; the dedicated anti-rootkit library
scan now also uses a system static helper and no longer looks like an error when none is present (the CDN copy is
restored). (forum 15331)
- PHP Defender: a site that legitimately writes a debug log file (for example WordPress debug logging) is now allowed;
only the malicious case (a log sent to a script path) is blocked. The incidents viewer reads the attacker address
from the web-server log behind the nginx-to-Apache proxy. (#127406)
- ModSecurity manager (user panel): values built from a domain name are fully quoted when used (defense in depth).
- Statistics (user panel): the domain and file names shown on the page are safely escaped.
Fixes
- Admin menu language reliably follows your panel language (LANGADMIN): it is now read directly, so one special
character in another config value can no longer make it fall back to English. (forum 15315)
- Error Log Viewer (user panel): the domain drop-down could be empty when the page loaded via in-panel navigation; it
now reads its data safely and fetches the domain list directly if needed. (forum 15335)
- Varnish cache purge works on servers with a non-standard Varnish admin port or secret (the admin address and secret
are auto-detected). (#127406)
- Spam Annihilator: removed a dead user-panel link that opened a "module does not exist" page. (forum 334369)
Improvements
- Apache Builder: added Apache 2.4.71. (forum 15326)
- ModSecurity: the "OWASP latest" option is labelled "OWASP CRS 3 (auto-updated to the latest 3.x release)". (forum
15328)
- CWP Cage / CWP Cage LIVE: the pages make clear that caging applies to accounts served by lsphp (cwpsapi) or PHP-FPM;
suPHP and php-cgi accounts have no PHP pool and are not caged.