Skip to content

Commit 662d7aa

Browse files
jaapmarcusjaapmarcus
committed
Merge branch 'main' into release
2 parents 229fddb + 74f3400 commit 662d7aa

File tree

119 files changed

+1378
-1760
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

119 files changed

+1378
-1760
lines changed

‎.drone.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -160,7 +160,7 @@ steps:
160160
port: 22
161161
command_timeout: 2m
162162
script:
163-
- freight-add ./hestia/*.deb apt/bionic apt/focal apt/strech apt/buster apt/bullseye
163+
- freight-add ./hestia/*.deb apt/bionic apt/focal apt/stretch apt/buster apt/bullseye
164164
- freight-cache
165165
- rm -fr ./hestia/
166166

@@ -169,4 +169,4 @@ trigger:
169169

170170
---
171171
kind: signature
172-
hmac: 31806a1e5357c43d17d24ef797995fb9952a1d883ad282fd152d7d0378112213
172+
hmac: 07f845f902f859c97c78a346d340f7fb8d4b1242581a242e592b149c13428f50

‎CHANGELOG.md‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,20 @@
11
# Changelog
22
All notable changes to this project will be documented in this file.
33

4+
## [1.5.9] - Service release
5+
6+
### Bugfixes
7+
8+
- Fixed multiple XSS vulnerabilities in the web user interface. [CVE-2022-0752](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0752) / [CVE-2022-0753](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0753)
9+
- Fixed an issues with mariadb.sys user didn't work properly on MariaDB 10.6.x installs #2427
10+
- Change ipverse.net urls to new format hosted on Github #2429 and forum
11+
- Allow PTR to be used on domain.com
12+
13+
### Dependencies
14+
15+
- Update PHPMailer to 6.6.0 (https://github.com/PHPMailer/PHPMailer/releases/tag/v6.6.0)
16+
- Update Filegator to 7.7.2 (https://github.com/filegator/filegator/releases/tag/v7.7.2)
17+
418
## [1.5.8] - Service release
519

620
### Features

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
[Hestia Control Panel](https://www.hestiacp.com/)
44
==================================================
5-
**Latest stable release:** Version 1.5.8 | [View Changelog](https://github.com/hestiacp/hestiacp/blob/release/CHANGELOG.md) | [![Build Status](https://drone.hestiacp.com/api/badges/hestiacp/hestiacp/status.svg?ref=refs/heads/main)](https://drone.hestiacp.com/hestiacp/hestiacp) <br>
5+
**Latest stable release:** Version 1.5.9 | [View Changelog](https://github.com/hestiacp/hestiacp/blob/release/CHANGELOG.md) | [![Build Status](https://drone.hestiacp.com/api/badges/hestiacp/hestiacp/status.svg?ref=refs/heads/main)](https://drone.hestiacp.com/hestiacp/hestiacp) <br>
66

77
**Web:** [www.hestiacp.com](https://www.hestiacp.com/)<br>
88
**Documentation:** [docs.hestiacp.com](https://docs.hestiacp.com/)<br>

‎bin/v-list-sys-services‎

Lines changed: 15 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -230,19 +230,24 @@ if [ -n "$DB_SYSTEM" ] && [ "$DB_SYSTEM" != 'remote' ]; then
230230
service="$db"
231231
proc_name=''
232232
if [ "$service" = 'mysql' ]; then
233-
if [ -d "/etc/sysconfig" ]; then
233+
mysql_version=$(mysql -V)
234+
mariadb_string="MariaDB"
235+
if [[ ! $mysql_version =~ $mariadb_string ]]; then
236+
# MySQL
234237
service='mysqld'
235238
proc_name='mysqld'
236-
fi
237-
if [ -e "/lib/systemd/system/mariadb.service" ]; then
238-
service='mariadb'
239-
proc_name='mysqld'
240-
fi
241-
if [ -f /usr/bin/mysql ]; then
242-
mariadb_v=`mysql -V | awk 'NR==1{print $5}' | head -c 4`
243-
if [ $mariadb_v = "10.5" ] || [ $mariadb_v = "10.6" ]; then
239+
else
240+
# MariaDB
241+
if [ -e "/lib/systemd/system/mariadb.service" ]; then
244242
service='mariadb'
245-
proc_name='mariadbd'
243+
proc_name='mysqld'
244+
fi
245+
if [ -f /usr/bin/mysql ]; then
246+
mariadb_v=`mysql -V | awk 'NR==1{print $5}' | head -c 4`
247+
if [ $mariadb_v = "10.5" ] || [ $mariadb_v = "10.6" ]; then
248+
service='mariadb'
249+
proc_name='mariadbd'
250+
fi
246251
fi
247252
fi
248253
fi

‎func/domain.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -584,7 +584,7 @@ is_dns_fqnd() {
584584
r=$2
585585
fqdn_type=$(echo $t | grep "NS\|CNAME\|MX\|PTR\|SRV")
586586
tree_length=3
587-
if [[ $t = 'CNAME' || $t = 'MX' ]]; then
587+
if [[ $t = 'CNAME' || $t = 'MX' || $t = 'PTR' ]]; then
588588
tree_length=2
589589
fi
590590

‎func/upgrade.sh‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -556,7 +556,7 @@ upgrade_b2_tool(){
556556
if version_ge "$b2_version" "$b2_v"; then
557557
echo "[ * ] Backblaze CLI tool is up to date ($b2_v)..."
558558
else
559-
echo "[ * ] Upgrading Backblaze CLI tool to version v$b2_v..."
559+
echo "[ * ] Upgrading Backblaze CLI tool to version $b2_v..."
560560
rm $b2cli
561561
wget -O $b2cli $b2lnk > /dev/null 2>&1
562562
chmod +x $b2cli > /dev/null 2>&1
@@ -581,7 +581,7 @@ upgrade_phpmyadmin() {
581581
fi
582582
else
583583
# Display upgrade information
584-
echo "[ * ] Upgrading phpMyAdmin to version v$pma_v..."
584+
echo "[ * ] Upgrading phpMyAdmin to version $pma_v..."
585585
[ -d /usr/share/phpmyadmin ] || mkdir -p /usr/share/phpmyadmin
586586

587587
# Download latest phpMyAdmin release
@@ -629,7 +629,7 @@ upgrade_filemanager() {
629629
fm_version="1.0.0"
630630
fi
631631
if [ "$fm_version" != "$fm_v" ]; then
632-
echo "[ ! ] Updating File Manager..."
632+
echo "[ ! ] Upgrading File Manager to version $fm_v..."
633633
# Reinstall the File Manager
634634
$HESTIA/bin/v-delete-sys-filemanager quiet yes
635635
$HESTIA/bin/v-add-sys-filemanager quiet
@@ -657,7 +657,7 @@ upgrade_roundcube(){
657657
else
658658
rc_version=$(cat /var/lib/roundcube/index.php | grep -o -E '[0-9].[0-9].[0-9]+' | head -1);
659659
if [ "$rc_version" != "$rc_v" ]; then
660-
echo "[ ! ] Upgrading Roundcube to version v$rc_v..."
660+
echo "[ ! ] Upgrading Roundcube to version $rc_v..."
661661
$HESTIA/bin/v-add-sys-roundcube
662662
else
663663
echo "[ * ] Roundcube is up to date ($rc_v)..."
@@ -670,7 +670,7 @@ upgrade_rainloop(){
670670
if [ -n "$(echo "$WEBMAIL_SYSTEM" | grep -w 'rainloop')" ]; then
671671
rl_version=$(cat /var/lib/rainloop/data/VERSION);
672672
if [ "$rl_version" != "$rl_v" ]; then
673-
echo "[ ! ] Upgrading Rainloop to version v$rl_v..."
673+
echo "[ ! ] Upgrading Rainloop to version $rl_v..."
674674
$HESTIA/bin/v-add-sys-rainloop
675675
else
676676
echo "[ * ] Rainloop is up to date ($rl_v)..."
@@ -685,7 +685,7 @@ upgrade_phpmailer(){
685685
fi
686686
phpm_version=$(cat $HESTIA/web/inc/vendor/phpmailer/phpmailer/VERSION);
687687
if [ "$phpm_version" != "$pm_v" ]; then
688-
echo "[ ! ] Upgrading PHPmailer..."
688+
echo "[ ! ] Upgrading PHPmailer to version $pm_v..."
689689
$HESTIA/bin/v-add-sys-phpmailer
690690
else
691691
echo "[ * ] PHPmailer is up to date ($pm_v)..."

‎install/deb/phpmyadmin/hestia-sso.php‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -147,7 +147,11 @@ function session_invalid()
147147
$user = $_GET['user'];
148148
$host = 'localhost';
149149
$token = $_GET['hestia_token'];
150-
$time = $_GET['exp'];
150+
if(is_numeric($_GET['exp'])){
151+
$time = $_GET['exp'];
152+
}else{
153+
$time = 0;
154+
}
151155

152156
if ($time + 60 > time()) {
153157
//note: Possible issues with cloudflare due to ip obfuscation

‎install/hst-install-debian.sh‎

Lines changed: 13 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ HESTIA_INSTALL_DIR="$HESTIA/install/deb"
3131
VERBOSE='no'
3232

3333
# Define software versions
34-
HESTIA_INSTALL_VER='1.5.8'
34+
HESTIA_INSTALL_VER='1.5.9'
3535
# Dependencies
3636
pma_v='5.1.3'
3737
rc_v="1.5.2"
@@ -1508,6 +1508,7 @@ if [ "$mysql" = 'yes' ]; then
15081508
mycnf="my-large.cnf"
15091509
fi
15101510

1511+
# Run mysql_install_db
15111512
mysql_install_db >> $LOG
15121513
# Remove symbolic link
15131514
rm -f /etc/mysql/my.cnf
@@ -1520,16 +1521,20 @@ if [ "$mysql" = 'yes' ]; then
15201521

15211522
# Securing MariaDB installation
15221523
mpass=$(gen_pass)
1523-
mysqladmin -u root password $mpass >> $LOG
15241524
echo -e "[client]\npassword='$mpass'\n" > /root/.my.cnf
15251525
chmod 600 /root/.my.cnf
1526-
1527-
# Clear MariaDB Test Users and Databases
1528-
mysql -e "DELETE FROM mysql.user WHERE User=''"
1529-
mysql -e "DROP DATABASE test" > /dev/null 2>&1
1526+
1527+
# Ater root password
1528+
mysql -e "ALTER USER 'root'@'localhost' IDENTIFIED BY '$mpass'; FLUSH PRIVILEGES;"
1529+
# Remove root login from remote servers
1530+
mysql -e "DELETE FROM mysql.global_priv WHERE User='root' AND Host NOT IN ('localhost', '127.0.0.1', '::1');"
1531+
# Disable anonymous users
1532+
mysql -e "DELETE FROM mysql.global_priv WHERE User='';"
1533+
# Drop test database
1534+
mysql -e "DROP DATABASE IF EXISTS test"
15301535
mysql -e "DELETE FROM mysql.db WHERE Db='test' OR Db='test\\_%'"
1531-
mysql -e "DELETE FROM mysql.user WHERE user='';"
1532-
mysql -e "DELETE FROM mysql.user WHERE password='' AND authentication_string='';"
1536+
1537+
mysql -e "FLUSH PRIVILEGES;"
15331538
fi
15341539

15351540

‎install/hst-install-ubuntu.sh‎

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ HESTIA_INSTALL_DIR="$HESTIA/install/deb"
3131
VERBOSE='no'
3232

3333
# Define software versions
34-
HESTIA_INSTALL_VER='1.5.8'
34+
HESTIA_INSTALL_VER='1.5.9'
3535
# Dependencies
3636
pma_v='5.1.3'
3737
rc_v="1.5.2"
@@ -1540,16 +1540,20 @@ if [ "$mysql" = 'yes' ]; then
15401540

15411541
# Securing MariaDB installation
15421542
mpass=$(gen_pass)
1543-
mysqladmin -u root password $mpass >> $LOG
15441543
echo -e "[client]\npassword='$mpass'\n" > /root/.my.cnf
15451544
chmod 600 /root/.my.cnf
1546-
1547-
# Clear MariaDB Test Users and Databases
1548-
mysql -e "DELETE FROM mysql.user WHERE User=''"
1549-
mysql -e "DROP DATABASE test" > /dev/null 2>&1
1545+
1546+
# Ater root password
1547+
mysql -e "ALTER USER 'root'@'localhost' IDENTIFIED BY '$mpass'; FLUSH PRIVILEGES;"
1548+
# Remove root login from remote servers
1549+
mysql -e "DELETE FROM mysql.global_priv WHERE User='root' AND Host NOT IN ('localhost', '127.0.0.1', '::1');"
1550+
# Disable anonymous users
1551+
mysql -e "DELETE FROM mysql.global_priv WHERE User='';"
1552+
# Drop test database
1553+
mysql -e "DROP DATABASE IF EXISTS test"
15501554
mysql -e "DELETE FROM mysql.db WHERE Db='test' OR Db='test\\_%'"
1551-
mysql -e "DELETE FROM mysql.user WHERE user='';"
1552-
mysql -e "DELETE FROM mysql.user WHERE password='' AND authentication_string='';"
1555+
1556+
mysql -e "FLUSH PRIVILEGES;"
15531557
fi
15541558

15551559

‎install/upgrade/manual/migrate_ngnix_apache_nginx-php-fpm.sh‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
#!/bin/bash
2+
3+
# Function Description
4+
# Manual upgrade script from Nginx + Apache2 + PHP-FPM to Nginx + PHP-FPM
5+
6+
#----------------------------------------------------------#
7+
# Variable&Function #
8+
#----------------------------------------------------------#
9+
10+
# Includes
11+
# shellcheck source=/etc/hestiacp/hestia.conf
12+
source /etc/hestiacp/hestia.conf
13+
# shellcheck source=/usr/local/hestia/func/main.sh
14+
source $HESTIA/func/main.sh
15+
# shellcheck source=/usr/local/hestia/conf/hestia.conf
16+
source $HESTIA/conf/hestia.conf
17+
18+
#----------------------------------------------------------#
19+
# Verifications #
20+
#----------------------------------------------------------#
21+
22+
if [ "$WEB_BACKEND" != "php-fpm" ]; then
23+
check_result $E_NOTEXISTS "PHP-FPM is not enabled" >/dev/null
24+
exit 1;
25+
fi
26+
27+
if [ "$WEB_SYSTEM" != "apache2" ]; then
28+
check_result $E_NOTEXISTS "Apache2 is not enabled" >/dev/null
29+
exit 1;
30+
fi
31+
32+
#----------------------------------------------------------#
33+
# Action #
34+
#----------------------------------------------------------#
35+
36+
# Remove apache2 from config
37+
sed -i "/^WEB_PORT/d" $HESTIA/conf/hestia.conf
38+
sed -i "/^WEB_SSL/d" $HESTIA/conf/hestia.conf
39+
sed -i "/^WEB_SSL_PORT/d" $HESTIA/conf/hestia.conf
40+
sed -i "/^WEB_RGROUPS/d" $HESTIA/conf/hestia.conf
41+
sed -i "/^WEB_SYSTEM/d" $HESTIA/conf/hestia.conf
42+
43+
# Remove nginx (proxy) from config
44+
sed -i "/^PROXY_PORT/d" $HESTIA/conf/hestia.conf
45+
sed -i "/^PROXY_SSL_PORT/d" $HESTIA/conf/hestia.conf
46+
sed -i "/^PROXY_SYSTEM/d" $HESTIA/conf/hestia.conf
47+
48+
# Add Nginx settings to config
49+
echo "WEB_PORT='80'" >> $HESTIA/conf/hestia.conf
50+
echo "WEB_SSL='openssl'" >> $HESTIA/conf/hestia.conf
51+
echo "WEB_SSL_PORT='443'" >> $HESTIA/conf/hestia.conf
52+
echo "WEB_SYSTEM='nginx'" >> $HESTIA/conf/hestia.conf
53+
54+
# Rebuild web config
55+
56+
for user in $($HESTIA/bin/v-list-users plain | cut -f1); do
57+
echo $user
58+
for domain in $($HESTIA/bin/v-list-web-domains $user plain | cut -f1 ); do
59+
$HESTIA/bin/v-change-web-domain-tpl $user $domain 'default'
60+
$HESTIA/bin/v-rebuild-web-domain $user $domain no;
61+
done
62+
done
63+
64+
systemctl restart nginx

0 commit comments

Comments
 (0)