0.1.0-beta.26

Улучшения

• The installer's closing check also tests the panel API, phpMyAdmin, webmail and the WAF. verify.sh now requests the panel API, /phpmyadmin/ and /webmail/ through nginx under the server name and checks that the WAF's shared rule include survived nginx's test; any of them failing is reported as FAIL instead of passing silently.
• Smaller panel language files: 256 unused messages removed from every language. No visible change: messages the panel never shows were removed from all 32 languages, so each page loads a little less text.

Безопасность

• The WAF rule set now loads on Ubuntu 22.04 and on AlmaLinux/Rocky. On Ubuntu 22.04 the packaged ModSecurity 3.0.6 cannot parse one OWASP CRS file (REQUEST-922), so nginx refused the whole rule set; on AlmaLinux/Rocky the module was not detected and the rule set was never included. The WAF page still said Active. The rule set now loads - on ModSecurity older than 3.0.8 without REQUEST-922, which is put back when the engine can read it - and the WAF page shows Inactive with a 'rule set not loaded' note whenever the rules are not actually loaded.

Исправления

• Installs on AlmaLinux, Rocky and CentOS Stream with SELinux enforcing get a working panel. WHost ships no SELinux policy, so in enforcing mode the panel's API was blocked after an otherwise successful install. The installer now switches SELinux to permissive (running system and /etc/selinux/config), says so on screen, in install.log and in the closing summary, and puts the previous mode back if the install is rolled back; a permissive or disabled server is left as it is.
• Account sites on AlmaLinux/Rocky with nginx + Apache no longer answer 403. On RHEL-family servers Apache runs as the apache user, which could not open account homes and PHP-FPM sockets owned by the nginx group, so every account site answered 403. New installations add Apache to that group; on existing servers the agent does it at its next start and reloads Apache.
• Creating or deleting an account on AlmaLinux/Rocky no longer stops PHP-FPM. The RHEL-family PHP packages do not create /run/php, where account pools listen, so the first new pool took that PHP version down for every site using it, and it stayed down after the account was deleted. The folder is now declared for every boot, and the agent starts a PHP-FPM service it finds failed at start-up and after deleting an account.
• Redis starts on AlmaLinux/Rocky installs and is listed on the Services page. The installer treated a failed service start as success, so on RHEL-family servers Redis (unit name redis there) was never started and Rspamd ran without its data store. The installer now reports a failed start and uses the family's unit name, and the admin Services page lists Redis under email.
• Certificate renewal on AlmaLinux/Rocky runs from one scheduler. New installations on RHEL-family servers renewed certificates from both EPEL's certbot-renew.timer and a root cron line. The installer now adds the cron line only when no certbot timer exists and removes the exact line an earlier run added; other cron lines are left alone.
• The installer no longer reports a false Apache configtest failure on AlmaLinux/Rocky. When it enabled the ModSecurity module the installer called httpdctl, which does not exist on RHEL-family servers, printed 'Apache configtest still failing' and skipped the Apache reload. It now runs apachectl configtest on both families.
• The Services page lists only the PHP versions that are installed. A requested PHP version the installer skipped (PHP 5.6 on RHEL-family servers) was recorded as installed and showed as Stopped on the Services page. The installer now tells the agent only the versions it installed, and the page leaves out a PHP version without a service unit.
• phpMyAdmin and webmail open on AlmaLinux/Rocky servers. On RHEL-family servers both answered 500: nginx 1.20 miscomputes the script path under an alias with a capture, and the snippets pointed at a PHP-FPM socket that does not exist there. New installations run each PHP version's shared pool as the web server user on /run/php/php-fpm.sock, as on Debian, and both snippets pass the captured script path. The agent rewrites the webmail snippet at its next start on every system; the phpMyAdmin snippet changes when phpMyAdmin is installed from the panel.
• A scheduled backup cut by an agent restart is no longer taken twice. A scheduled backup now counts as done once its archive is written. If the agent restarts while the archive is being copied to a remote destination or while old backups are being removed, the schedule no longer runs the same backup again at start; the interrupted copy shows on the backup's row as failed. Schedule changes made in the panel while a backup runs are kept.
• The two notification switches on the Updates page now take effect. "Notify when update is available" and "Notify when update is installed" (Updates, Settings tab) were saved but ignored. With the first off, the daily check no longer sends the update-available notice (switching it on again announces the release still on offer at the next check); with the second off, no notice follows an automatic install. A failed automatic install is always reported, and the notification settings still choose panel and e-mail.
• Pre-update archives no longer pile up: the newest three are kept. With "Create backup before update" on, every install attempt left an archive of the previous agent code under /var/whost/backups/update_/ (about 3.6 MB each) and none was ever removed. The update scheduler now keeps the newest three and removes older ones before each daily check; account backups are not touched.
• The Updates page describes the pre-update backup correctly. The "Create backup before update" card promised a snapshot of the agent and its configuration and suggested a whost restore --latest command that does not exist. It now says what is saved (the agent code only, under /var/whost/backups, the newest three kept) and that a failed update puts the previous version back by itself, with no command needed. All 32 panel languages.
• Password reset links work in every panel language. A client whose panel runs in a language other than English (the browser's language, a language chosen earlier in that browser, or the server's default) opened the reset link from the Forgot password e-mail and got 'This reset link is incomplete': the language redirect dropped the link's token, so the password could not be reset by e-mail. The panel now keeps the address's query when it moves a page to the visitor's language, so the reset link, tab links (?tab=) and the two-factor page's e-mail method survive the redirect and the language switcher.
• Notification settings keep an edit made right after the page opens. On Settings > Notifications, a change made in the first moments after the page appeared (the e-mail channel switch, SMTP fields, the event matrix) could be put back silently when the server's host name arrived after the settings, and the page stopped warning about the unsaved change. The form now appears once both are loaded.
• Tab bars no longer overflow the page in long languages. A tab bar wider than its area (for example the five firewall tabs in Russian at 1280 px) pushed past the page edge and cut the last tab's counter. Tab bars now stay inside their area and scroll sideways when they do not fit.
• An administrator's sign-in no longer loses its session right after logging in. An administrator could sign in successfully and be sent back to the sign-in page by the first request, which reported the session as replaced by a newer login: the session and the single-session record were stamped on different seconds when the clock ticked between the two. A sign-in now records the session first and issues it on the same second, with a password and with two-factor authentication. A sign-in in the same second as a sign-out no longer brings back the session that sign-out ended.