0.1.0-beta.25

Nieuwe functies

• The admin panel links to the WHost documentation site. The account menu at the top right of the admin panel has a Documentation entry that opens https://whost.wisecp.com/ in a new tab. It is hidden while white-label branding is active, so a white-labelled panel does not name WHost; the client panel is unchanged.

Verbeteringen

• The phpMyAdmin single sign-on bridge no longer carries an unused line. Opening phpMyAdmin from the panel behaves as before; a line the bridge wrote into the sign-on session that phpMyAdmin never read was removed. The bridge is refreshed at the agent's next start.
• The agent declares the packaging library it uses. No change in behaviour: the library the update checker uses for version ordering is now named in the agent's requirements; the pinned lock already carried it, so nothing new is installed.
• Server-wide spam lists keep sender entries in lower case. An entry typed with capitals on the Spam Filter page is stored in lower case, a second spelling of the same sender adds nothing, and removing an entry matches it whatever case it was saved with.

Beveiliging

• A new account that reuses a deleted account's username no longer sees its notifications. Deleting an account now also removes its panel notifications; an account created later with the same username starts with an empty notification list.
• An idempotency key's stored answer is no longer returned to another API key or endpoint. A stored X-Idempotency-Key answer is now kept per credential, method and path. Before, another API key sending the same key and body received the stored answer, including a newly created API key's secret; the same key on another endpoint now answers 409.
• Deleting the Default API Key retires it; it no longer answers through agent.conf. Deleting the installer's Default API Key under Settings > API Access now retires it for good: it no longer signs requests through the agent.conf copy and is not copied back at the next start. A key pair written by a later installer run keeps working until it is managed the same way.
• Webhook deliveries connect to the address that was checked. Each delivery attempt now connects to the addresses the destination check approved instead of looking the hostname up again, so a DNS answer that changes after the check can no longer send a retry to a private or loopback address. The Host header and the TLS certificate check still use the hostname; subscribers see no difference.
• The installer checks the ionCube Loader download against a pinned checksum. New installations take ionCube Loader 15.5.1 and unpack it only when the archive matches the SHA-256 pinned in the installer; a mismatch or a failed download stops the installation. Before, the installer took ionCube's unversioned latest archive with no checksum and loaded it into every PHP process. Servers already installed keep their loader.
• A replayed request no longer returns a secret that is shown once. Answers kept for X-Idempotency-Key replays store API key and webhook secrets, 2FA setup material and backup codes, one-time sign-in links and OAuth tokens as "***". The first answer still carries the secret; a replay within 24 hours repeats the outcome without it and the action still runs once. Before, the stored answer kept the secret on the server for 24 hours and a replay with the same key returned it again.
• A spent admin backup code stays spent after the agent restarts. A two-factor backup code used at admin sign-in, and the TOTP step accepted there, are now kept on disk, so they stay used after an agent restart.
• Client sign-in identifier handling tightened. The client sign-in accepts an account user name or an e-mail address and matches nothing else.
• An API key always carries at least one scope. Creating or updating an API key with an empty scope list answers 422; a key created without scopes keeps the full-access default.
• FTP and SFTP backup destinations connect to the address that was checked. An FTP, FTPS or SFTP backup destination is connected through the addresses its host name resolved to when the destination check ran; the name is not looked up again in between.
• Outbound destination checks cover more non-public address ranges. Webhook and remote backup destinations in reserved, multicast and benchmarking ranges are refused, and a NAT64 or 6to4 address is checked as the IPv4 address it carries.
• An account's own backup destination cannot use the server's Google Drive service account. The client backup destination routes answer 422 to a service-account file; service-account files stay an administrator feature.
• Backup destinations check the FTP server's certificate and remember the SFTP server's key. An FTP backup destination now verifies the server's TLS certificate for the host you entered before your password is sent. For a server with a self-signed certificate or one issued for another name, enter the certificate's name as the host or turn on 'Accept an unverified certificate': the certificate of the first successful connection is then remembered and a different one is refused. An SFTP destination remembers the server's host key at its first successful connection and refuses a different key. The edit form shows what is remembered and can forget it. After updating, an existing FTP destination whose server presents a self-signed certificate - the FTP server of another WHost server included - stops copying until the switch is turned on.
• The agent's port is reserved to root, also while the agent restarts. Ports below 2001 can now only be opened by root on a WHost server, so no process of a hosting account can listen on the agent's port, not even while the agent restarts. Processes that do not run as root can no longer listen on ports 1024-2000.
• An account's primary domain cannot be changed to a name another account serves. Changing an account's primary domain to a name another account already serves - as its primary domain, an addon, a parked domain or a subdomain - is now refused with 409, as creating such an account already was; nothing is changed then.
• A site folder is always a folder inside the account's home. Creating a subdomain or addon domain, or moving one to another folder, now refuses a folder name that is a link to a place outside the account's home directory (422) instead of taking that place over. Links that stay inside the home, such as www to public_html, still work, and the folders the panel creates on the way to a new site folder now belong to the account.
• Certificate files are written only into the account's own certificate folder. Installing a certificate, uploaded or from Let's Encrypt, now refuses an account whose certificate folder, or whose site's .well-known / acme-challenge folder, is a link (422). Certificate files are written as new files (key 0600, certificate and chain 0640), so an entry left in the folder beforehand is replaced instead of written through.
• A reseller's ACL plan applies to its API key requests whatever cookie comes along. A request signed with a reseller's account-bound API key is governed by that reseller's ACL plan even when it also carries an invalid client session cookie; before, such a cookie next to the signature skipped the plan check.
• A failed sign-in is always one line in the agent log. The sign-in name of a failed admin or client sign-in is written to the agent log as one escaped field, so it can no longer add lines of its own and fail2ban counts the address the attempt really came from. The answer to the sign-in (401) is unchanged.
• An FTP backup destination that used TLS does not fall back to plain FTP. Once a remote FTP destination has connected over TLS, a server that later refuses TLS is refused before the password is sent, so the password and the archive never travel unencrypted to that destination. A destination whose server never offered TLS keeps working over plain FTP. If a server really dropped TLS, remove the destination and add it again.
• Per-mailbox spam whitelists and blacklists are applied by the mail filter. The sender lists a mailbox keeps on the Spam Filter page now reach Rspamd: a blacklisted sender is refused at delivery, a whitelisted sender is delivered without spam scoring, and a mailbox with filtering switched off receives its mail unscored (the server-wide blacklist still applies); entries are checked (an address or a domain, up to 100 per list) and lists of a deleted mailbox are removed. A host that stored lists earlier gets the rule at the agent's next start.
• A client's mailbox quota fits the plan's disk. In the client panel a mailbox quota is between 1 MB and the plan's disk, and the quotas of the account's mailboxes together cannot exceed it; the dialog shows what is still free and the unlimited option is no longer offered there. The administrator's dialog is unchanged.
• The agent's Python dependencies are pinned with their digests. The installer and the update pipeline install the agent's Python packages from agent/requirements.lock in pip's hash-checking mode: every distribution at an exact version, a file served with another digest is refused. An update that adds no package still needs no network.
• Certificate renewals, the expiry check and FTP folders keep to the account's own folders. A Let's Encrypt renewal now runs the agent's own hook, which writes the renewed files into the account's certificate folder through directory handles and reloads the web server (lineages set up earlier are moved to it at the agent's next start); the certificate expiry warning reads plain files only; an FTP directory is created and cleaned up the same way. A link an account places in those folders is replaced or refused, never followed.
• A reseller plan's email permission also covers the mailboxes' spam settings. A reseller whose ACL plan withholds email management can no longer list its mailboxes' spam settings or change them through the client API (403 with the permission named); with the permission on, nothing changes.
• Let's Encrypt validation moves to the panel's own challenge folder. Certificate orders and renewals are validated from /var/www/letsencrypt, which every site now serves at /.well-known/acme-challenge/; nothing is written into an account's site folders any more. On the first start after the update the agent renders every site's configuration once from the current templates (previous files are kept under /var/lib/whost/vhost-rerender-/) and points certbot's renewal configurations at that folder.
• Backup restores write the account's folders through directory handles. A restore now creates and fills the restored folders through directory handles as the account's user. A link the account placed at one of those folder names is replaced by a plain folder, and a name that turns into a link while the restore runs makes the restore fail instead of being written through.
• Imports from another WHost server write the account's files through directory handles. An import from another WHost server writes the account's public_html (replaced) and mail (merged) through directory handles as the account's user, also when the account already exists here; a link the account placed at public_html is replaced by a plain folder and a link at mail makes that account's import fail. Restored mail files now belong to the account.
• Backup restores and migrations import each database dump as the account's own import user. A restored or migrated database dump is applied by a locked, per-account database user that can write to that one database only; a dump that names another database fails at that statement and the restore reports it. Views, triggers, routines and events in the dump are re-created under that user (whost_imp_), which is hidden from the panel's user lists and removed with the account.

Opgeloste fouten

• Updates wait for running backups, and the agent answers at once after a restart. An update is no longer installed while a backup, a restore or a scheduled backup is running: the Updates page names the running backup and when it started, automatic updates wait and try again 30 minutes later, and a backup or restore started during an update is refused until it ends. After a restart the agent serves immediately and removes the working folders of an interrupted backup in the background, instead of staying unreachable for minutes.
• A remote backup copy cut short is shown as failed. If the server stops while a backup is being copied to a remote destination, the backup's row now says the remote copy did not finish instead of showing it as copied.
• Changes to a suspended account keep it suspended. Changing the PHP version, SSL, redirects, WAF or custom configuration of a suspended account no longer brings its sites back online; the change is kept and applies when the account is unsuspended (before, it was lost on unsuspend and PHP pages could answer 502). A domain can no longer be added to a suspended account.
• New addon and parked domains use the account's PHP version. An addon domain added to an account whose PHP version differs from the server default, and a parked domain after the account's PHP version changes, no longer answer 502 on PHP pages: new addon domains take the account's version, parked domains follow the domain they point at.
• The firewall's rate-limit rules are described by what they count. The rule form, its preview and its list now say the threshold is the number of new connections one address may open in the window, which is what the rule counts; the security log explains that a rate-limit entry comes from too many requests to an API endpoint or from a firewall rate-limit rule. Available in all panel languages.
• Disk quota warnings are sent again. When an account's home directory reaches 90% of its plan's disk allowance, the account holder is warned in the panel and by e-mail, and the operator according to the notification settings (at most once a day). The check read the allowance from the wrong place, so it never fired.
• Installer stops at the apache and LiteSpeed modes that left the panel without HTTPS. New installations take --webserver=nginx_apache (the default) or nginx. The apache mode served the admin login over plain HTTP and the LiteSpeed modes set up no panel site; they now stop before anything changes, and OpenLiteSpeed / LiteSpeed Enterprise are switched on under Plugins.
• Migration no longer reports a restore from an uploaded backup that did not happen. The Migration page's Upload tab reported an uploaded cPanel/DirectAdmin/Plesk backup as restored, but nothing was restored. The tab is gone and the upload endpoints answer 409 MIGRATION_UPLOAD_RESTORE_UNAVAILABLE; migrate accounts over SSH.
• Sign-in codes and password-reset e-mails reach an authenticated SMTP relay. With a relay that needs a user name and password in the two-factor SMTP settings of agent.conf, the e-mailed sign-in code, the e-mail codes of the admin profile and the client password-reset e-mail were sent without the password and the relay refused them; they now sign in to the relay. Servers using the default local relay were not affected.
• systemctl reload no longer ends the agent abruptly. Running systemctl reload whost-agent stopped the agent without its shutdown steps and systemd restarted it five seconds later, while reporting a successful reload. The command is now refused with a clear message; use systemctl restart whost-agent to apply changes. Nothing in the panel reloads the agent.
• The rate limits set in agent.conf apply. The read, write, delete, heavy and auth values of the rate_limit block in agent.conf now limit their endpoint classes; before, the built-in values applied whatever the file said. The default value now reaches the few endpoints without a class of their own (phpMyAdmin and webmail sign-on, deployment and update progress streams), which had no limit on current installations. With the shipped values the limits of the classed endpoints do not change.
• Account creation no longer writes an unused PHP-FPM drop-in. Creating or terminating an account no longer writes or removes a systemd drop-in for the shared PHP-FPM service. The file was written where systemd does not read it, so nothing changes for sites; an old copy left on a server stays inert.
• Suspending a reseller also stops its sub-accounts' FTP, mail and apps. When a reseller is suspended, each of its active sub-accounts is now suspended the way a direct suspension does it: FTP logins, mailboxes (IMAP/POP3, sending, delivery) and hosted Python / Node.js apps stop together with the sites, and the reseller's unsuspend brings back exactly what it switched off. Before, those stayed on for sub-accounts suspended with their reseller.
• The Services page lists every installed PHP version and the right unit names on RHEL. The Services page shows one PHP-FPM row per installed PHP version (the default one marked) and names the units as the server does: httpd and php84-php-fpm on AlmaLinux / Rocky / CentOS Stream, apache2 and php8.4-fpm on Debian / Ubuntu. Before, it always showed apache2 and a single php8.4-fpm row, so on RHEL servers those rows read as Stopped and could not be managed. Apache is listed where it is installed or the installation mode runs it.
• An SSL certificate no longer stops every site on Nginx + Apache servers. On servers set up with Nginx + Apache (the installer's default), installing a certificate on one site made every site on the server answer 400 Bad Request. TLS now ends at Nginx as intended, sites with and without certificates keep working, and PHP sees HTTPS=on for HTTPS requests.
• Terminating an account with a certificate no longer blocks new accounts on Apache servers. On Nginx + Apache and Apache servers, terminating an account whose site had a certificate left its HTTPS configuration behind; Apache's configuration test then failed and every later account creation answered 500 until the file was removed by hand. Termination now removes it.
• Suspended sites show the suspension page on new installations. On servers installed recently, a suspended site answered 403 Forbidden instead of the suspension notice because its page could not be read by the web server. The page is now shown (HTTP 503 with the notice) on Nginx, Nginx + Apache, Apache and OpenLiteSpeed.
• Suspension also closes the HTTPS site on Apache servers. On servers that run Apache alone, suspending an account turned off the site's HTTP virtual host only, and nothing on AlmaLinux / Rocky / CentOS Stream. Both HTTP and HTTPS now answer with the suspension page on every supported OS, and unsuspending restores both.
• Choosing Apache for an account on an Nginx server no longer creates a site nobody answers. On servers where Nginx serves the sites (Nginx and Nginx + Apache, the installer's default), an account created with the Apache web server got a site that no server answered, while the panel reported success. Such a request now gets Apache behind Nginx; the panel lists Apache alone only on servers installed that way, and the server-wide default can no longer be switched to it elsewhere.
• A remote database access host ending in a line break is refused. Adding a host for remote database access now refuses a value that ends with a line break; such a value used to be saved and could never connect. Every other host value behaves as before.
• Saving a mailbox's spam settings no longer holds up the agent. While a mailbox's spam lists were being saved, the agent answered no other request until the mail filter had reloaded; the save now runs beside the request loop, so other panel and API calls keep flowing.
• The security settings page returns to the sign-in page of the panel's language. After a change to the admin IP whitelist signs everyone out, the page opens the sign-in page for the language in use instead of reading the language from the address bar.
• A backup destination that has used TLS can be told to forget it. In the destination's edit dialog a server that has used TLS is shown as a remembered identity with the same 'Forget it on save' box a remembered host key or certificate has; ticking it lets the destination connect again to a server that no longer offers TLS.
• Let's Encrypt orders work again with the agent's renewal hook. A certificate order was refused by certbot as soon as it started, because the renewal hook command the agent passes began with an environment setting instead of a program. The command now starts with env, so orders go through; renewals were not affected.