Back to Changelog
Panel Backend
v1.0.569
Security: only the root account can apply a single package update, and the WordPress Boost cache no longer exposes the shared Redis password. Adds Node.js version updates.
New Feature
1- Node.js: an installed version can be updated to the newest release of the same line (for example 22.23.1 to 22.23.4) from the Node.js > Versions page. The new runtime replaces the old one only after it has been downloaded, checked against nodejs.org's checksum and proven to run, and applications on that line are restarted so they use it. A running process keeps the runtime it started with, so without that restart the fix would not be in use.
Bug Fixes
4- DNS "Start over from defaults" no longer removes the address records of a domain's subdomains. The reset now writes them again, and records lost by an earlier reset are restored once, at startup. Records added by hand, delegations and wildcard records are left alone.
- A server in secondary DNS mode now receives a domain again after it was deleted and re-added on the primary, and gets its copies back after its role was switched away and back. The copies are also removed properly when a domain leaves the primary, and a domain this server mirrors from another server can no longer be added here as well.
- When a licence expires, mail (Postfix and Dovecot), FTP (ProFTPD) and DNS (BIND) are no longer stopped. A licence problem no longer takes a customer's mail, file transfer or name service offline.
- The scheduled task service is now part of this package and of the rescue console's file list, so its security fix reaches every server that applies this update.
Security Fixes
4- Applying a single package update is now restricted to the root account. The request names the file to download and the directory it is unpacked into as root, and an administrator account could reach it, which allowed an administrator to place files on the server with root rights. One-click "Update all", reinstall and rollback are unchanged; the panel has always shown updates to the root account only.
- The WordPress Boost cache no longer writes the panel's shared Redis password into wp-config.php. Each site now gets its own Redis account limited to its own cache keys, so one site can no longer read or clear another site's cache or the panel's own data. Sites that already had Boost enabled are moved over automatically at startup.
- On a server where the Boost cache had been used, the shared Redis password is replaced once at startup, because the old password may have been copied from wp-config.php. The change is made without interrupting the panel: the new password is added first, the services are moved onto it, and only then does the old one stop working.
- The scheduled task runner now reads a job's command and its owner from the database instead of the cache. A job definition altered in the cache can no longer make a task run as another account.