Back to Changelog
Panel Backend
v1.0.520
File Manager permission-change security fix, bulk permissions API, and a real server-side logout.
New Feature
1- File permissions API: a single call can now target a selection (paths) and give files and directories separate modes (file_permissions, dir_permissions). The response reports how many files and directories were changed and how many entries were skipped. The previous single-path, single-mode contract is unchanged.
Improvements
2- File Manager permission changes are now written to the file audit log; previously they left no trace at all.
- A rejected permission change now returns the reason (invalid mode, world-writable refused for the role, path outside the account) instead of a generic failure message.
Bug Fix
1- Saving the server hostname now publishes the matching DNS A record in the local zone when the panel hosts that zone. It never rewrites a zone's own apex record, does not add a second record when one already exists under a different spelling, and refuses to write when a CNAME already occupies that name (which would make the zone unloadable).
Security Fix
1- A recursive permission change in the File Manager no longer follows symbolic links. Because the backend runs as root and only the requested path was validated, a link inside a customer's own folder could change the permissions of any file on the server; this was reproduced on a test system with a normal user account. The recursive walk now skips links entirely (matching chmod(1)) and leaves platform-owned directories (.ssh, and a domain's mail, ssl, logs and .system folders) untouched. Recursive ownership changes were corrected the same way.