Skip to content

Commit 1b8a2f2

Browse files
jaapmarcusjaapmarcus
committed
Merge branch 'main' into release
2 parents 662d7aa + e0ab2dc commit 1b8a2f2

File tree

20 files changed

+152
-100
lines changed

20 files changed

+152
-100
lines changed

‎CHANGELOG.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,15 @@
11
# Changelog
22
All notable changes to this project will be documented in this file.
33

4+
## [1.5.10] - Service release
5+
6+
### Bugfixes
7+
- Fixed an issue where webmail client options were not displayed in the Web UI (#2445)
8+
- Fixed an issue where users where not able to create an backup. (#2448 / #2449)
9+
- Fixed an issue where saving server settings could fail due to an incorrect PHP version check on mod-php servers (#2451)
10+
- Fixed an issue where MariaDB installations were broken when performing a clean install of HestiaCP v1.5.9 (#2452 | 2446)
11+
- Fixed recently discovered XSS vulnerabilities (#2453) [CVE-2022-0838](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0838)
12+
413
## [1.5.9] - Service release
514

615
### Bugfixes

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
[Hestia Control Panel](https://www.hestiacp.com/)
44
==================================================
5-
**Latest stable release:** Version 1.5.9 | [View Changelog](https://github.com/hestiacp/hestiacp/blob/release/CHANGELOG.md) | [![Build Status](https://drone.hestiacp.com/api/badges/hestiacp/hestiacp/status.svg?ref=refs/heads/main)](https://drone.hestiacp.com/hestiacp/hestiacp) <br>
5+
**Latest stable release:** Version 1.5.10 | [View Changelog](https://github.com/hestiacp/hestiacp/blob/release/CHANGELOG.md) | [![Build Status](https://drone.hestiacp.com/api/badges/hestiacp/hestiacp/status.svg?ref=refs/heads/main)](https://drone.hestiacp.com/hestiacp/hestiacp) <br>
66

77
**Web:** [www.hestiacp.com](https://www.hestiacp.com/)<br>
88
**Documentation:** [docs.hestiacp.com](https://docs.hestiacp.com/)<br>

‎install/hst-install-debian.sh‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ HESTIA_INSTALL_DIR="$HESTIA/install/deb"
3131
VERBOSE='no'
3232

3333
# Define software versions
34-
HESTIA_INSTALL_VER='1.5.9'
34+
HESTIA_INSTALL_VER='1.5.10'
3535
# Dependencies
3636
pma_v='5.1.3'
3737
rc_v="1.5.2"
@@ -1526,14 +1526,14 @@ if [ "$mysql" = 'yes' ]; then
15261526

15271527
# Ater root password
15281528
mysql -e "ALTER USER 'root'@'localhost' IDENTIFIED BY '$mpass'; FLUSH PRIVILEGES;"
1529-
# Remove root login from remote servers
1530-
mysql -e "DELETE FROM mysql.global_priv WHERE User='root' AND Host NOT IN ('localhost', '127.0.0.1', '::1');"
1529+
# Allow mysql access via socket for startup
1530+
mysql -e "UPDATE mysql.global_priv SET priv=json_set(priv, '$.password_last_changed', UNIX_TIMESTAMP(), '$.plugin', 'mysql_native_password', '$.authentication_string', 'invalid', '$.auth_or', json_array(json_object(), json_object('plugin', 'unix_socket'))) WHERE User='root';"
15311531
# Disable anonymous users
15321532
mysql -e "DELETE FROM mysql.global_priv WHERE User='';"
15331533
# Drop test database
15341534
mysql -e "DROP DATABASE IF EXISTS test"
15351535
mysql -e "DELETE FROM mysql.db WHERE Db='test' OR Db='test\\_%'"
1536-
1536+
# Flush privileges
15371537
mysql -e "FLUSH PRIVILEGES;"
15381538
fi
15391539

‎install/hst-install-ubuntu.sh‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ HESTIA_INSTALL_DIR="$HESTIA/install/deb"
3131
VERBOSE='no'
3232

3333
# Define software versions
34-
HESTIA_INSTALL_VER='1.5.9'
34+
HESTIA_INSTALL_VER='1.5.10'
3535
# Dependencies
3636
pma_v='5.1.3'
3737
rc_v="1.5.2"
@@ -1545,14 +1545,14 @@ if [ "$mysql" = 'yes' ]; then
15451545

15461546
# Ater root password
15471547
mysql -e "ALTER USER 'root'@'localhost' IDENTIFIED BY '$mpass'; FLUSH PRIVILEGES;"
1548-
# Remove root login from remote servers
1549-
mysql -e "DELETE FROM mysql.global_priv WHERE User='root' AND Host NOT IN ('localhost', '127.0.0.1', '::1');"
1548+
# Allow mysql access via socket for startup
1549+
mysql -e "UPDATE mysql.global_priv SET priv=json_set(priv, '$.password_last_changed', UNIX_TIMESTAMP(), '$.plugin', 'mysql_native_password', '$.authentication_string', 'invalid', '$.auth_or', json_array(json_object(), json_object('plugin', 'unix_socket'))) WHERE User='root';"
15501550
# Disable anonymous users
15511551
mysql -e "DELETE FROM mysql.global_priv WHERE User='';"
15521552
# Drop test database
15531553
mysql -e "DROP DATABASE IF EXISTS test"
15541554
mysql -e "DELETE FROM mysql.db WHERE Db='test' OR Db='test\\_%'"
1555-
1555+
# Flush privileges
15561556
mysql -e "FLUSH PRIVILEGES;"
15571557
fi
15581558

‎install/upgrade/versions/1.5.10.sh‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
#!/bin/bash
2+
3+
# Hestia Control Panel upgrade script for target version 1.5.9
4+
5+
#######################################################################################
6+
####### Place additional commands below. #######
7+
#######################################################################################
8+
####### Pass through information to the end user in case of a issue or problem #######
9+
####### #######
10+
####### Use add_upgrade_message "My message here" to include a message #######
11+
####### in the upgrade notification email. Example: #######
12+
####### #######
13+
####### add_upgrade_message "My message here" #######
14+
####### #######
15+
####### You can use \n within the string to create new lines. #######
16+
#######################################################################################
17+
18+
upgrade_config_set_value 'UPGRADE_UPDATE_WEB_TEMPLATES' 'false'
19+
upgrade_config_set_value 'UPGRADE_UPDATE_DNS_TEMPLATES' 'false'
20+
upgrade_config_set_value 'UPGRADE_UPDATE_MAIL_TEMPLATES' 'false'
21+
upgrade_config_set_value 'UPGRADE_REBUILD_USERS' 'false'
22+
upgrade_config_set_value 'UPGRADE_UPDATE_FILEMANAGER_CONFIG' 'false'
23+
24+
# shellcheck source=/usr/local/hestia/func/db.sh
25+
source $HESTIA/func/db.sh
26+
27+
if [ -n "$(echo $DB_SYSTEM | grep -w mysql)" ]; then
28+
mysql_connect 'localhost'
29+
version=$(mysql --defaults-file=/usr/local/hestia/conf/.mysql.localhost -e 'SELECT VERSION()')
30+
mysql_version=$(echo $version | grep -o -E '[0-9]*.[0-9].[0-9]+' | head -n1);
31+
mysql_version2=$(echo $mysql_version | grep -o -E '[0-9]*.[0-9]' | head -n1 );
32+
33+
if [ "$mysql_version2" = "10.6" ]; then
34+
test=$(mysql -e "select * from mysql.global_priv;" | grep root | grep unix_socket);
35+
if [ -z "$test" ]; then
36+
echo "[ ! ] Updating MariaDB permissions to fix startup issue "
37+
mysql --defaults-file=/usr/local/hestia/conf/.mysql.localhost -e "UPDATE mysql.global_priv SET priv=json_set(priv, '$.password_last_changed', UNIX_TIMESTAMP(), '$.plugin', 'mysql_native_password', '$.authentication_string', 'invalid', '$.auth_or', json_array(json_object(), json_object('plugin', 'unix_socket'))) WHERE User='root';"
38+
fi
39+
fi
40+
fi

‎src/deb/hestia/control‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Source: hestia
22
Package: hestia
33
Priority: optional
4-
Version: 1.5.9
4+
Version: 1.5.10
55
Section: admin
66
Maintainer: HestiaCP <info@hestiacp.com>
77
Homepage: https://www.hestiacp.com

‎web/add/db/index.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -121,7 +121,7 @@
121121

122122
// Flush field values on success
123123
if (empty($_SESSION['error_msg'])) {
124-
$_SESSION['ok_msg'] = sprintf(_('DATABASE_CREATED_OK'), htmlentities($user)."_".htmlentities($_POST['v_database']), htmlentities($user)."_".htmlentities($_POST['v_database']));
124+
$_SESSION['ok_msg'] = sprintf(_('DATABASE_CREATED_OK'), htmlentities($user_plain)."_".htmlentities($_POST['v_database']), htmlentities($user_plain)."_".htmlentities($_POST['v_database']));
125125
$_SESSION['ok_msg'] .= " / <a href=".$db_admin_link." target='_blank'>" . sprintf(_('open %s'), $db_admin) . "</a>";
126126
unset($v_database);
127127
unset($v_dbuser);

‎web/edit/mail/index.php‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,11 @@
2222
// List mail domain
2323
if ((!empty($_GET['domain'])) && (empty($_GET['account']))) {
2424
$v_domain = $_GET['domain'];
25-
25+
26+
exec(HESTIA_CMD."v-list-sys-webmail json", $output, $return_var);
27+
$webmail_clients = json_decode(implode('', $output), true);
28+
unset($output);
29+
2630
exec(HESTIA_CMD."v-list-mail-domain ".$user." ".escapeshellarg($v_domain)." json", $output, $return_var);
2731
$data = json_decode(implode('', $output), true);
2832
check_return_code_redirect($return_var, $output, '/list/mail/');

‎web/edit/server/index.php‎

Lines changed: 38 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -242,47 +242,48 @@
242242
unset($output);
243243
$v_hostname = $_POST['v_hostname'];
244244
}
245-
246-
// Install/remove php versions
247-
if (empty($_SESSION['error_msg'])) {
248-
if (!empty($v_php_versions)) {
249-
$post_php = $_POST['v_php_versions'];
250-
if(empty($post_php)){
251-
$post_php = array();
252-
}
253-
254-
array_map(function ($php_version) use ($post_php) {
255-
if (array_key_exists($php_version->tpl, $post_php)) {
256-
if (!$php_version->installed) {
257-
exec(HESTIA_CMD . "v-add-web-php " . escapeshellarg($php_version->version), $output, $return_var);
258-
check_return_code($return_var, $output);
259-
unset($output);
260-
if (empty($_SESSION['error_msg'])) {
261-
$php_version->installed = true;
245+
246+
if($_SESSION['WEB_BACKEND'] == "php-fpm"){
247+
// Install/remove php versions
248+
if (empty($_SESSION['error_msg'])) {
249+
if (!empty($v_php_versions)) {
250+
$post_php = $_POST['v_php_versions'];
251+
if(empty($post_php)){
252+
$post_php = array();
253+
}
254+
array_map(function ($php_version) use ($post_php) {
255+
if (array_key_exists($php_version->tpl, $post_php)) {
256+
if (!$php_version->installed) {
257+
exec(HESTIA_CMD . "v-add-web-php " . escapeshellarg($php_version->version), $output, $return_var);
258+
check_return_code($return_var, $output);
259+
unset($output);
260+
if (empty($_SESSION['error_msg'])) {
261+
$php_version->installed = true;
262+
}
262263
}
263-
}
264-
} else {
265-
if ($php_version->installed && !$php_version->protected) {
266-
exec(HESTIA_CMD . "v-delete-web-php " . escapeshellarg($php_version->version), $output, $return_var);
267-
check_return_code($return_var, $output);
268-
unset($output);
269-
if (empty($_SESSION['error_msg'])) {
270-
$php_version->installed = false;
264+
} else {
265+
if ($php_version->installed && !$php_version->protected) {
266+
exec(HESTIA_CMD . "v-delete-web-php " . escapeshellarg($php_version->version), $output, $return_var);
267+
check_return_code($return_var, $output);
268+
unset($output);
269+
if (empty($_SESSION['error_msg'])) {
270+
$php_version->installed = false;
271+
}
271272
}
272273
}
273-
}
274-
275-
return $php_version;
276-
}, $v_php_versions);
277-
}
278-
}
279274

280-
if (empty($_SESSION['error_msg'])) {
281-
if($_POST['v_php_default_version'] != DEFAULT_PHP_VERSION) {
282-
exec(HESTIA_CMD . "v-change-sys-php " . escapeshellarg($_POST['v_php_default_version']), $output, $return_var);
283-
check_return_code($return_var, $output);
284-
unset($output);
285-
}
275+
return $php_version;
276+
}, $v_php_versions);
277+
}
278+
}
279+
280+
if (empty($_SESSION['error_msg'])) {
281+
if($_POST['v_php_default_version'] != DEFAULT_PHP_VERSION) {
282+
exec(HESTIA_CMD . "v-change-sys-php " . escapeshellarg($_POST['v_php_default_version']), $output, $return_var);
283+
check_return_code($return_var, $output);
284+
unset($output);
285+
}
286+
}
286287
}
287288

288289
// Change timezone

‎web/js/app.js‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,6 @@ $.fn.scrollTo = function( target, options, callback ){
6363
* The mask defaults to dateFormat.masks.default.
6464
*/
6565

66-
6766
var dateFormat = function () {
6867
var token = /d{1,4}|m{1,4}|yy(?:yy)?|([HhMsTt])\1?|[LloSZ]|"[^"]*"|'[^']*'/g,
6968
timezone = /\b(?:[PMCEA][SDP]T|(?:Pacific|Mountain|Central|Eastern|Atlantic) (?:Standard|Daylight|Prevailing) Time|(?:GMT|UTC)(?:[-+]\d{4})?)\b/g,

0 commit comments

Comments
 (0)