Back to Changelog
Panel Backend
v1.0.522
Fixes a startup routine that deleted the panel's own webmail vhosts on every restart, closes an unauthenticated Roundcube log-file exposure, hardens Roundcube config and update safety, and fixes DNS TXT truncation that hid valid SPF/DKIM/DMARC records.
New Feature
1- The webmail and discovery vhosts are now re-asserted immediately at boot instead of up to five minutes later, and the panel's "fix common problems" action can restore them on demand.
Bug Fixes
5- The startup health sweep deleted the panel's own nginx vhosts on every backend restart. webmail.<domain> and the mail-client autoconfig/autodiscover hosts went down for about five minutes after each restart or update until the mail-SSL scheduler rewrote them. Measured on a production server: 18 vhosts removed per restart, 22 restarts in 14 days.
- Roundcube's config.inc.php is now checked with php -l before and after every write, and restored from backup if the result does not parse. A malformed managed section previously took webmail down permanently, because no package ships that file.
- The Roundcube update health check only looked for files on disk, so a corrupted extraction was reported as healthy and never rolled back. It now parses the PHP entry points and probes the panel's webmail path.
- Applying a Roundcube update left the tree owned by root; ownership is now reset to the web user after each apply.
- The panel's public DNS lookups dropped answers larger than the UDP buffer, so domains with a large apex TXT set were reported as missing SPF, DKIM and DMARC even though all three were published.
Security Fix
1- The panel's webmail path served Roundcube's own data directories. /email/webmail/logs/errors.log returned the live error log (IMAP usernames, client IP addresses and X-Forwarded-For headers) with no authentication. Those paths are now refused, matching the per-domain webmail vhost.