A new control panel update has been pushed to the servers incorporating a “Learning Mode” to Fortification available under Web > Web Apps. Learning bridges the gap between known and unknown web apps by taking a filesystem snapshot, opening permissions, then taking another snapshot after a predetermined amount of time (60 minutes). Changes are calculated three ways: creation time, modification time, and size to determine what files the web application has modified during this window. Once a changeset has been calculated, the control panel locks down all files except those files (or directories) required by the web server.

Learning Mode is only available on unknown apps. Common apps (WordPress, Joomla!, Drupal, and Magento) have prescribed Fortification Modes available to each (and Web App Write Mode is always available to allow 100% write access for 10 minutes). Learning Mode is relevant only when an application is installed that does not fit into the big four.

learning-mode

Other changes

Beyond Fortification enhancements, there is a new API call for unattended commands, pman_schedule_api_cmd(), which powers a significant share of new CP enhancements; scheduled task tagging to prevent duplicate tasks; initial webhook framework; localization (Account > Change Information); and 125 miscellaneous changes and fixes to the control panel!

Changelog

  • NEW: NO_WAIT flag, send command to backend without waiting for response (DataStream)
  • NEW: localization. Feature does not affect CP language at this time, only one-clicks if support
  • NEW: Joomla! one-click, still need to implement update + extension management (Web Apps)
  • NEW: Web App Write Mode, a fortification mode that temporarily grants write-access to the web server for 10 minutes, then seizes those files created rendering it secure from future modification (Web Apps)
  • NEW: add support for non-numeric array keys (Error Reporter)
  • NEW: add umask support to Util_Process::Sudo()
  • NEW: schedule_api_cmd_admin()- run an api command as any arbitrary account and any user under that account (Pman)
  • NEW: schedule_api_cmd()- run an apnscp command as the current user at a given time (Pman)
  • NEW: add duplicate atd process detection with ID tags (Util_Process::Schedule)
  • NEW: Magento 1.x one-click
  • NEW: $.ajaxWait()- add ajax spinner icon + disable button on interaction (apnscp)
  • NEW: Drupal one-click
  • NEW: set_acls()- glob() support (File)
  • NEW: renew()- renew LE certificates (LetsEncrypt)
  • NEW: add WordPress install option to Add Subdomain/Addon Domains
  • NEW: include recommended preloaded WP stacks
  • NEW: WordPress one-click module (WordPress)
  • NEW: normalize_path()- take a hostname + optional path component and return its corresponding docroot (Web)
  • NEW: support array data types using the format [item1,item2,…] or key-value as [item1:val1,…] (cmd)
  • NEW: empty_mysql_database() – retain schema structure, but purge all records in db (SQL)
  • NEW: export databases (MySQL Manager)
  • NEW: EOL selector on file edit (File Manager)
  • NEW: Let’s Encrypt multi-domain (SAN) support (SSL)
  • FIX: typo on path to log files (File Manager)
  • FIX: allow deletion of directories (File Manager)
  • FIX: fortify(max) called immediately after web app write mode enabled (Web Apps)
  • FIX: truncated parameters include markup language (DNS)
  • FIX: strip quotes if key passed to CLI quoted (cmd)
  • FIX: bring back addon domain editor (Addon Domains)
  • FIX: error once if domain -> site mapping fails instead of on each record (tabulateBandwidth)
  • FIX: email on v4 platforms delivered using LF EOL, parser expects CRLF (parseTicket.php)
  • FIX: trim randomly generated name if name + prefix exceeds user column max length (Module_Support::Webapps)
  • FIX: get_directory_contents()- call stat() instead of stat_backend() to take advantage of stat cache (File)
  • FIX: killing shellinabox left behind children (Service::Terminal)
  • FIX: encode seen server cookie to prevent cookie spanning multiple lines that would break the Set-Cookie header (Auth::Redirect)
  • FIX: get_acls()- incorrect caching (File)
  • FIX: when changing domain, on logout, force an internal proxy redirect to the server. Logging out will clear the temporary proxy location cookie rendering the client unable to login following a domain change (Change Information)
  • FIX: extract inline attachments (parseTicket)
  • FIX: get_user_settings() must return array at all times (Manage Users)
  • FIX: require domains to be selected when creating a subdomain (Subdomains)
  • FIX: get_address_from_domain()- handle addon domains (Admin)
  • FIX: heredoc syntax on v6.5+ platforms (WordPress)
  • FIX: global subdomain url formatting fails (Web Apps)
  • FIX: PHP 5.3 compatibility, using self within a closure (Pman)
  • FIX: match foo.domain-name.com (Regex)
  • FIX: set_acls()- parser fixes (File)
  • FIX: reorder su parameters (Util_Process::Sudo)
  • FIX: new directory form control injection (FileTree)
  • FIX: Uncaught Error: Syntax error, unrecognized expression: option[value=] (Manage Mailboxes)
  • FIX: mysql_database_exists()- if mysql database exists, is not located under site root, and has privileges by dbaseadmin, return true (SQL)
  • FIX: only directories in xferlist are copied (Transfer)
  • FIX: missing __state variable (PostgreSQL Manager)
  • FIX: AJAX indicator does not show (CSS)
  • FIX: multiple stale cache bugs relating to recently-deleted files (File)
  • FIX: TypeError: g.load is not a function (Dashboard)
  • FIX: preserve custom mailbox on user rename (Mail)
  • FIX: unable to remove GA key (Change Information)
  • FIX: fallthrough subdomain improperly configured (Subdomains)
  • FIX: add_virtual_transport()- accessing dns_get_records() as if non-multidimensional array, doh (Email)
  • FIX: broken mailbox editor
  • FIX: escape chroot argument (Util_Process::Chroot)
  • FIX: hostname param missing on user edit when remote hosts not displayed (MySQL Manager)
  • FIX: login option alignment on smaller screens
  • FIX: row improperly cleared (Summary)
  • FIX: support TXT records > 255 characters (DNS)
  • FIX: destination not set on edit (Manage Mailboxes)
  • FIX: install()- SSLCertificateChainFile is not set when replacing a certificate if custom HTTP config present from previous SSL install (SSL)
  • FIX: build CSS assets under subdirectories
  • FIX: get_processes() – Fatal error: Cannot access self:: when no class scope is active on PHP 5.3 (Pman)
  • CHG: add .htaccess to minimum fortification (wordpress)
  • CHG: tag active fortification mode (Web Apps)
  • CHG: load page with database/user list expanded upon deletion (MySQL Manager)
  • CHG: add system status to login page (Login)
  • CHG: chown()- use optimized shadow assertions, ~70x speed up (file)
  • CHG: chown()- prefer tomcat_system_user() for proper Tomcat user (file)
  • CHG: set_acls()- always treat flags as array (file)
  • CHG: renewals that fail due to zero valid hostnames (account moved on) should not elicit a renewal failure (Letsencrypt)
  • CHG: trim parameter before ajax callback (DNS Manager)
  • CHG: auto-install Composer on 4.5+ platforms if missing (php)
  • CHG: cap Magento to 1.x if MySQL < 5.6 (magento)
  • CHG: kick out Magento 2 for now…
  • CHG: on func cache miss, expire func table (apnscpFunctionInterceptor)
  • CHG: db_config()- export table prefix (Web Apps)
  • CHG: remove no recalc mask (n) flag to default ACL settings (file)
  • CHG: proper Magento version tracking (Magento)
  • CHG: add uid support to -u (Auth::CLI)
  • CHG: Add DNS form formatting (DNS Manager)
  • CHG: avoid globbing non-existent paths (File)
  • CHG: set_acls()- retain effective rights mask on acl adjustment (file)
  • CHG: run()- force umask to override system default (0002) for site admins (pman)
  • CHG: fail request if error produced (letsencrypt)
  • CHG: delay HTTP reload for SSL installation by 2 minutes, reload when load permits, and tag by ID to prevent duplicate reload requests (SSL)
  • CHG: fully implement automated Let’s Encrypt SSL renewal
  • CHG: consolidate Util_Process::Batch into Util_Process::Schedule
  • CHG: escape the parameter rather than the components (Util_Account::Editor)
  • CHG: unconditionally enable openssl on certificate install (SSL)
  • CHG: force SSL if certificate setup OK (Magento)
  • CHG: get_acls()- only pull ACL information from shadow layer where appropriate (File)
  • CHG: require fortify()/unfortify() implementations; reflection will not pick these methods up unless explicitly defined in the derived class (WordPress, Drupal)
  • CHG: set trusted_host_patterns on 8.x+ Drupal installations (Drupal)
  • CHG: limit ticket data height to at most 650px (Trouble Tickets)
  • CHG: strip reply from Outlook-generated messages that merge reply + original message in one mime part (parseTicket)
  • CHG: add bypass support for changing primary domain on an account (Change Information)
  • CHG: if detection fails, ensure map entry is removed (Webapps)
  • CHG: get_docroot()- truncate www. if present (Web)
  • CHG: stat()- return empty array instead of null if stat path does not exist (File)
  • CHG: breakout webapp common function to separate support structure (Module_Support::Webapps)
  • CHG: create docroot directory if it does not already exist (WordPress)
  • CHG: open some method privileges to administrator (SSL)
  • CHG: take ceil used, floor free in calculating storage/bandwidth usage (UCard)
  • CHG: take ceil used, floor free in calculating storage/bandwidth usage (UCard)
  • CHG: integrate htaccess manager + app manager into Addon Domains and Subdomains
  • CHG: enable recovery mode
  • CHG: perform correct redirection if account resides on proxy endpoint and is suspended (Auth::Redirect)
  • CHG: add namespace autoloading (apnscpFunctionInterceptor)
  • CHG: support flushing user preferences if preferences written through common_save_preferences() instead of UCard::setPref()
  • CHG: create_temp_mysql_user()- MariaDB 10.1 no longer implicitly creates user on GRANT (SQL)
  • CHG: handle case where all_domains/ exists and is directory gracefully
  • CHG: reject record if its hostname contains spaces (DNS)
  • CHG: add support methods getParameterByName(), getUrl, allow ucwords to extend String object (apnscp)
  • CHG: verify proc pid exists before performing stat (Pman)
  • CHG: move()- only perform symlink chown if uid >= minimum uid or apache; excludes changing to root if symlink was root:root, e.g. mainwebsite_html (File)
  • CHG: bypass systemd when reloading (and config rebuilding) HTTP server (Web)
  • CHG: only invoke g.load if it is really loaded (Dashboard)
  • CHG: mysql_schema_column_maxlen()- cache results (SQL)
  • CHG: set_mysql_privileges()- add support for $privileges to be a two-element array consisting of “read” and “write” privilege simplification (SQL)
  • CHG: purge page cache on file upload on v6.5+ platforms (File Manager)
  • CHG: disable button + replace with “Processing” on account wipe (Change Information)
  • CHG: initialize_download()- remove fifo deletion callback on fork, since code can never logically reach (File)
  • CHG: make recursive directory deletion implied (File Manager)
  • CHG: flush page template buffer before app logic evaluation (Page Template)
  • CHG: unoptimized codepath if calling stat() from UI (File)
  • CHG: remove .php exposure on soap endpoint (Net_WSDL)
  • CHG: display amnesty request if storage within 98.5% capacity, instead of 99.5% (Dashboard)
  • CHG: modify_mailbox() make parameter list less cumbersome, drop catchall ability entirely (Email)
  • CHG: cache payments for only 24 hours (Billing)
  • CHG: send HUP, not USR2 to flush Dovecot auth cache on user creation (User)
  • CHG: move auth flush from user to user creation hook in email module
  • CHG: record_exists() drop timeout from 5 to 1 second (DNS)
  • CHG: expand upload block if previous action is upload (File Manager)
  • CHG: copy()- use non-shadow path on copy for overlayfs-backed platforms, which have issues invalidating the page cache on direct branc manipulation without performing a costly remount (File)
  • CHG: convert backup routines to Util_Process (backup DBs)
  • CHG: install()- ensure http config is rebuilt (SSL)
  • CHG: make postcss available on v6.5+ platforms
  • CHG: use postcss for CSS minification
  • CHG: switch JS build from YUI to UglifyJS
  • CHG: upgrade TinyMCE to 4.3.2
  • CHG: add PEAR5.php compatibility library for Util_HTML_BBCode
  • CHG: split_host()- include hostname that failed splitting (Web)
  • CHG: general JS fixups (DNS Manager)
  • CHG: jail_user()- use the referent if jailed path is a symlink (FTP)
  • CHG: kill SIGUSR2 dovecot/auth on v6.5+ platforms to flush dovecot auth cache (User)
  • CHG: minor analytics appearance tweaks
  • CHG: move open ticket position for admin (Trouble Tickets)
  • CHG: Dovecot on 6.5+ platforms use systemd, which lacks non-LSB commands. Instead of dovecot flush/reload send SIGUSR2 directly to auth process to flush cache on user addition (User)
  • CHG: delete_user()- remove user-specific subdomain during user deletion if only subdomain present (User)
  • CHG: include server name in X-Server header
  • REM: tomcat4/tomcat name conversion from get_service_value() (Module_Skeleton)
  • REM: jquery.ui.css dependency (Terminal)
apnscp Update + New Fortification Mode: Learning