Open Source Projects

Security and hardening release.

SECURITY (GHSA-mcpc-fxm3-3973, reported by nullsleuth): the setup wizard staged three files for privileged sudo cp in world-writable /tmp under fixed names. A local unprivileged user could pre-create the path as a symlink and have the root cp copy a root-only file into a world-readable destination. All staging moves to /var/lib/inetpanel/staging (owner-only 0700) with unlink-then-O_EXCL writes. Affects fresh installs only; the wizard is locked after setup.

FIXED (#24): MultiPHP could never install any PHP version. The installer pins every version except the panel's own to Pin-Priority -1, which in APT means 'never install' — so 'apt-get install php8.3-fpm' returned 'has no installation candidate' on every fresh install. MultiPHP now lifts the block for the requested version only, for the duration of the run, leaving the pin's real job (stopping phpmyadmin dragging in a second PHP stack) intact.

FIXED: panel_update deleted its own Apache origin config on every nightly run. /etc/cron.d entries do not inherit PATH from /etc/crontab, so apache2ctl and the a2* helpers were unreachable and a failed configtest was misread as 'my config is broken'.

FIXED: per-domain PHP version switching was broken — its pool copy and removal matched no sudoers rule, so the vhost was repointed at an FPM socket that was never created. Now delegated to multiphp_manage.

HARDENING: hosted sites no longer serve dot-files (.git, .env) or directory listings, existing vhosts included. Static-asset cache headers added (conservative: fonts 30d, images 7d, CSS/JS 1h, HTML untouched). Both sudoers writers now validate with visudo before installing, and four unrestricted root grants (sed, usermod, dpkg, apt-get) were removed after verifying each unused. mod_remoteip is configured at install instead of up to a week later. Backup-restore no longer generates shell scripts to run through a wildcard sudo grant.

Hotfix: the weekly Cloudflare RemoteIP refresh deleted its own Apache config every Monday. /etc/cron.d files do not inherit PATH from /etc/crontab, so apache2ctl and the a2* helpers (all in /usr/sbin) were unreachable under cron; the script read that as its own config being invalid and removed it, leaving a dangling symlink. After the next Apache reload mod_remoteip went inert, every tunnelled request appeared to come from 127.0.0.1, and because fail2ban's ignoreip covers 127.0.0.1/8 that made all tunnelled traffic invisible to every jail. The script now sets PATH itself, verifies its tools before writing anything, checks install's exit status, and no longer assumes a failing configtest is its own fault. Recommended for every install behind a Cloudflare Tunnel.

Hotfix: restores admin hook scripts, which 1.27.1 silently disabled. 1.27.1 repointed the hook sudoers grant out of /tmp but left three callers creating their script there, so the sudo invocation no longer matched and every add_domain/delete_domain hook failed to run. Fails closed, so there is no security impact, and installs with no hook script enabled are unaffected. Upgrade immediately if you use hook scripts.