Merge pull request #1708 from master3395/v2.5.5-dev

V2.5.5 dev
2026-02-19 13:06:48 +01:00 · 2026-02-17 00:27:58 +01:00
parent 6c68dbfbb3 feb9c912ac
commit 8ab66af9ea
14 changed files with 2201 additions and 198 deletions
--- a/CyberCP/urls.py
+++ b/CyberCP/urls.py
@@ -26,12 +26,15 @@ from firewall import views as firewall_views
 # includes each installed plugin (under /plugins/<name>/) so settings and
 # other plugin pages work for any installed plugin.

-# Optional app: may be missing after clean clone or git clean -fd (not in all repo trees)
+# Optional app: may be missing after clean clone or git clean -fd (not in all repo trees).
+# When missing or broken, register a placeholder so {% url 'emailMarketing' %} in templates never raises Reverse not found.
 _optional_email_marketing = []
 try:
    _optional_email_marketing.append(path('emailMarketing/', include('emailMarketing.urls')))
-except ModuleNotFoundError:
-    pass
+except (ModuleNotFoundError, ImportError, AttributeError):
+    _optional_email_marketing.append(
+        path('emailMarketing/', RedirectView.as_view(url='/base/', permanent=False), name='emailMarketing')
+    )

 urlpatterns = [
    # Serve static files first (before catch-all routes)
--- a/baseTemplate/templates/baseTemplate/index.html
+++ b/baseTemplate/templates/baseTemplate/index.html
@@ -2142,7 +2142,10 @@
                <a href="{% url 'installed' %}" class="menu-item">
                    <span>Installed</span>
                </a>
-        </div>
+                <a href="{% url 'installed' %}?view=store" class="menu-item">
+                    <span>{% trans "Plugin Store" %}</span>
+                </a>
+            </div>
        {% endif %}
    </div>
    
--- a/cyberpanel_upgrade_monolithic.sh
+++ b/cyberpanel_upgrade_monolithic.sh
@@ -350,58 +350,74 @@ MARIADB_VER="11.8"
 MARIADB_VER_REPO="11.8"

 Check_Argument() {
-# Parse --branch / -b (extract first word after -b or --branch)
-if [[ "$*" = *"--branch "* ]]; then
-  Branch_Name=$(echo "$*" | sed -n 's/.*--branch \([^ ]*\).*/\1/p' | head -1)
-  [[ -n "$Branch_Name" ]] && Branch_Check "$Branch_Name"
-elif [[ "$*" = *"-b "* ]]; then
-  Branch_Name=$(echo "$*" | sed -n 's/.*-b \([^ ]*\).*/\1/p' | head -1)
-  [[ -n "$Branch_Name" ]] && Branch_Check "$Branch_Name"
-fi
-# Parse --repo / -r to use any GitHub user (same URL structure as usmannasir/cyberpanel)
-if [[ "$*" = *"--repo "* ]]; then
-  Git_User_Override=$(echo "$*" | sed -n 's/.*--repo \([^ ]*\).*/\1/p' | head -1)
-fi
-if [[ "$*" = *"-r "* ]] && [[ -z "$Git_User_Override" ]]; then
-  Git_User_Override=$(echo "$*" | sed -n 's/.*-r \([^ ]*\).*/\1/p' | head -1)
-fi
-# Parse --no-system-update to skip yum/dnf update -y (faster upgrade when system is already updated)
-if [[ "$*" = *"--no-system-update"* ]]; then
-  Skip_System_Update="yes"
-  echo -e "\nUsing --no-system-update: skipping full system package update.\n"
-fi
-# Parse --backup-db / --no-backup-db: pre-upgrade MariaDB backup. Default when neither set: ask user (may take a while).
-# --backup-db = always backup; --no-backup-db = never backup; omit both = prompt [y/N]
-Backup_DB_Before_Upgrade=""
-if [[ "$*" = *"--backup-db"* ]]; then
-  Backup_DB_Before_Upgrade="yes"
-  echo -e "\nUsing --backup-db: will create a full MariaDB backup before upgrade.\n"
-elif [[ "$*" = *"--no-backup-db"* ]]; then
-  Backup_DB_Before_Upgrade="no"
-  echo -e "\nUsing --no-backup-db: skipping MariaDB pre-upgrade backup.\n"
-fi
-# Parse --migrate-to-utf8: after upgrading to MariaDB 11.x/12.x, convert DBs/tables from latin1 to utf8mb4 (only if your apps support UTF-8)
-if [[ "$*" = *"--migrate-to-utf8"* ]]; then
-  Migrate_MariaDB_To_UTF8_Requested="yes"
-  echo -e "\nUsing --migrate-to-utf8: will convert databases to UTF-8 (utf8mb4) after MariaDB upgrade.\n"
-fi
-# Parse --mariadb-version (any version: 10.6, 10.11, 10.11.16, 11.8, 12.1, 12.2, 12.3, etc.). Default 11.8.
-# --mariadb is shorthand for --mariadb-version 10.11
-if [[ "$*" = *"--mariadb"* ]] && [[ "$*" != *"--mariadb-version "* ]]; then
-  MARIADB_VER="10.11"
-  echo -e "\nUsing --mariadb: MariaDB 10.11 selected (non-interactive).\n"
-elif [[ "$*" = *"--mariadb-version "* ]]; then
-  MARIADB_VER=$(echo "$*" | sed -n 's/.*--mariadb-version \([^ ]*\).*/\1/p' | head -1)
-  MARIADB_VER="${MARIADB_VER:-11.8}"
-fi
-# Allow any version; repo paths use major.minor (normalized later)
+# Parse arguments with exact next-token so -b v2.5.5-dev --mariadb-version 12.3 does not mangle Branch_Name
+set -- $*
+while [[ $# -ge 1 ]]; do
+  case "$1" in
+    -b|--branch)
+      if [[ -n "${2:-}" ]] && [[ "$2" != -* ]]; then
+        Branch_Name="$2"
+        Branch_Check "$Branch_Name"
+        shift 2
+        continue
+      fi
+      shift
+      ;;
+    --mariadb-version)
+      if [[ -n "${2:-}" ]] && [[ "$2" != -* ]]; then
+        MARIADB_VER="$2"
+        echo -e "\nUsing --mariadb-version: MariaDB $MARIADB_VER selected.\n"
+        shift 2
+        continue
+      fi
+      shift
+      ;;
+    -r|--repo)
+      if [[ -n "${2:-}" ]] && [[ "$2" != -* ]]; then
+        Git_User_Override="$2"
+        echo -e "\nUsing --repo: GitHub user $Git_User_Override for cyberpanel.\n"
+        shift 2
+        continue
+      fi
+      shift
+      ;;
+    --no-system-update)
+      Skip_System_Update="yes"
+      echo -e "\nUsing --no-system-update: skipping full system package update.\n"
+      shift
+      ;;
+    --backup-db)
+      Backup_DB_Before_Upgrade="yes"
+      echo -e "\nUsing --backup-db: will create a full MariaDB backup before upgrade.\n"
+      shift
+      ;;
+    --no-backup-db)
+      Backup_DB_Before_Upgrade="no"
+      echo -e "\nUsing --no-backup-db: skipping MariaDB pre-upgrade backup.\n"
+      shift
+      ;;
+    --migrate-to-utf8)
+      Migrate_MariaDB_To_UTF8_Requested="yes"
+      echo -e "\nUsing --migrate-to-utf8: will convert databases to UTF-8 (utf8mb4) after MariaDB upgrade.\n"
+      shift
+      ;;
+    --mariadb)
+      MARIADB_VER="10.11"
+      echo -e "\nUsing --mariadb: MariaDB 10.11 selected (non-interactive).\n"
+      shift
+      ;;
+    *)
+      shift
+      ;;
+  esac
+done
 }

 Pre_Upgrade_Setup_Git_URL() {
  if [[ $Server_Country != "CN" ]] ; then
    if [[ -n "$Git_User_Override" ]]; then
      Git_User="$Git_User_Override"
-      echo -e "\nUsing GitHub repo: ${Git_User}/cyberpanel (same URL structure as usmannasir)\n"
+      echo -e "\nUsing GitHub repo: ${Git_User}/cyberpanel\n"
    else
      Git_User="usmannasir"
    fi
@@ -778,6 +794,7 @@ EOF
    dnf clean metadata --disablerepo='*' --enablerepo=mariadb 2>/dev/null || true
    # MariaDB 10 -> 11 or 11 -> 12: RPM scriptlet blocks in-place upgrade; do manual stop, remove old server, install target, start, mariadb-upgrade
    MARIADB_OLD_10=$(rpm -qa 'MariaDB-server-10*' 2>/dev/null | head -1)
+    [[ -z "$MARIADB_OLD_10" ]] && MARIADB_OLD_10=$(rpm -qa 2>/dev/null | grep -E '^MariaDB-server-10\.' | head -1)
    MARIADB_OLD_11=$(rpm -qa 'MariaDB-server-11*' 2>/dev/null | head -1)
    # Also detect 11.x by package version (e.g. MariaDB-server-11.8.6-1.el9)
    [[ -z "$MARIADB_OLD_11" ]] && MARIADB_OLD_11=$(rpm -qa 'MariaDB-server*' 2>/dev/null | grep -E 'MariaDB-server-11\.' | head -1)
@@ -791,7 +808,7 @@ EOF
      rpm -e "$MARIADB_OLD_10" --nodeps 2>/dev/null || true
      dnf install -y --enablerepo=mariadb MariaDB-server MariaDB-client MariaDB-devel 2>/dev/null || true
      mkdir -p /etc/my.cnf.d
-      printf "[client]\nskip-ssl = true\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
+      printf "[client]\nssl=0\nskip-ssl\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
      systemctl start mariadb 2>/dev/null || true
      sleep 2
      mariadb-upgrade -u root 2>/dev/null || true
@@ -805,7 +822,7 @@ EOF
      rpm -e "$MARIADB_OLD_11" --nodeps 2>/dev/null || true
      dnf install -y --enablerepo=mariadb MariaDB-server MariaDB-client MariaDB-devel 2>/dev/null || true
      mkdir -p /etc/my.cnf.d
-      printf "[client]\nskip-ssl = true\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
+      printf "[client]\nssl=0\nskip-ssl\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
      systemctl start mariadb 2>/dev/null || true
      sleep 2
      mariadb-upgrade -u root 2>/dev/null || true
@@ -828,7 +845,7 @@ EOF
          rpm -e "$STILL_11" --nodeps 2>/dev/null || true
          dnf install -y --enablerepo=mariadb MariaDB-server MariaDB-client MariaDB-devel 2>/dev/null || true
          mkdir -p /etc/my.cnf.d
-          printf "[client]\nskip-ssl = true\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
+          printf "[client]\nssl=0\nskip-ssl\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
          systemctl start mariadb 2>/dev/null || true
          sleep 2
          mariadb-upgrade -u root 2>/dev/null || true
@@ -838,7 +855,11 @@ EOF
    fi
    # Allow local client to connect without SSL (11.x client defaults to SSL; 10.x server may not have it)
    mkdir -p /etc/my.cnf.d
-    printf "[client]\nskip-ssl = true\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
+    printf "[client]\nssl=0\nskip-ssl\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
+    # Ensure main my.cnf has [client] without SSL when server has SSL disabled (ERROR 2026 fix)
+    if [[ -f /etc/my.cnf ]] && ! grep -q '^\[client\]' /etc/my.cnf 2>/dev/null; then
+      echo -e "\n[client]\nssl=0\nskip-ssl" >> /etc/my.cnf
+    fi
    # Optional: migrate from latin1 to UTF-8 (utf8mb4) when --migrate-to-utf8 and 11.x/12.x
    if [[ "$Migrate_MariaDB_To_UTF8_Requested" = "yes" ]] && { [[ "$MARIADB_VER_REPO" =~ ^11\. ]] || [[ "$MARIADB_VER_REPO" =~ ^12\. ]]; }; then
      Migrate_MariaDB_To_UTF8
@@ -863,6 +884,7 @@ EOF
    
    # Install/upgrade MariaDB from our repo (any version: 10.11, 11.8, 12.x). Manual path for 10->11 and 11->12.
    MARIADB_OLD_10_AL9=$(rpm -qa 'MariaDB-server-10*' 2>/dev/null | head -1)
+    [[ -z "$MARIADB_OLD_10_AL9" ]] && MARIADB_OLD_10_AL9=$(rpm -qa 2>/dev/null | grep -E '^MariaDB-server-10\.' | head -1)
    MARIADB_OLD_11_AL9=$(rpm -qa 'MariaDB-server-11*' 2>/dev/null | head -1)
    [[ -z "$MARIADB_OLD_11_AL9" ]] && MARIADB_OLD_11_AL9=$(rpm -qa 'MariaDB-server*' 2>/dev/null | grep -E 'MariaDB-server-11\.' | head -1)
    if [[ -n "$MARIADB_OLD_10_AL9" ]] && { [[ "$MARIADB_VER_REPO" =~ ^11\. ]] || [[ "$MARIADB_VER_REPO" =~ ^12\. ]]; }; then
@@ -874,7 +896,7 @@ EOF
      rpm -e "$MARIADB_OLD_10_AL9" --nodeps 2>/dev/null || true
      dnf install -y --enablerepo=mariadb MariaDB-server MariaDB-devel 2>/dev/null || dnf install -y mariadb-server mariadb-devel
      mkdir -p /etc/my.cnf.d
-      printf "[client]\nskip-ssl = true\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
+      printf "[client]\nssl=0\nskip-ssl\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
      systemctl start mariadb 2>/dev/null || true
      sleep 2
      mariadb-upgrade -u root 2>/dev/null || true
@@ -888,7 +910,7 @@ EOF
      rpm -e "$MARIADB_OLD_11_AL9" --nodeps 2>/dev/null || true
      dnf install -y --enablerepo=mariadb MariaDB-server MariaDB-devel 2>/dev/null || dnf install -y mariadb-server mariadb-devel
      mkdir -p /etc/my.cnf.d
-      printf "[client]\nskip-ssl = true\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
+      printf "[client]\nssl=0\nskip-ssl\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
      systemctl start mariadb 2>/dev/null || true
      sleep 2
      mariadb-upgrade -u root 2>/dev/null || true
@@ -900,7 +922,7 @@ EOF
    fi
    # Allow local client to connect without SSL
    mkdir -p /etc/my.cnf.d
-    printf "[client]\nskip-ssl = true\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
+    printf "[client]\nssl=0\nskip-ssl\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true

    # Install additional required packages (omit curl - AlmaLinux 9 has curl-minimal, avoid conflict)
    dnf install -y wget unzip zip rsync firewalld psmisc git python3 python3-pip python3-devel 2>/dev/null || dnf install -y --allowerasing wget unzip zip rsync firewalld psmisc git python3 python3-pip python3-devel
@@ -1007,6 +1029,17 @@ if [[ "$Server_OS" = "openEuler" ]] ; then
  dnf install python3 -y
 fi
 #all pre-upgrade operation for openEuler
+
+  # Ensure MariaDB client no-SSL on every upgrade path (avoids ERROR 2026 when server has have_ssl=DISABLED)
+  mkdir -p /etc/my.cnf.d
+  printf "[client]\nssl=0\nskip-ssl\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
+  if [[ -f /etc/my.cnf ]] && ! grep -q '^\[client\]' /etc/my.cnf 2>/dev/null; then
+    echo -e "\n[client]\nssl=0\nskip-ssl" >> /etc/my.cnf
+  fi
+  if [[ -d /etc/mysql/mariadb.conf.d ]]; then
+    printf "[client]\nssl=0\nskip-ssl\n" > /etc/mysql/mariadb.conf.d/99-cyberpanel-client.cnf 2>/dev/null || true
+  fi
+  echo -e "[$(date +"%Y-%m-%d %H:%M:%S")] MariaDB client no-SSL config ensured." | tee -a /var/log/cyberpanel_upgrade_debug.log
 }

 Download_Requirement() {
@@ -1336,6 +1369,16 @@ fi

 echo -e "[$(date +"%Y-%m-%d %H:%M:%S")] Running: $CP_PYTHON upgrade.py $Branch_Name" | tee -a /var/log/cyberpanel_upgrade_debug.log

+# Export Git user so upgrade.py clones from the same repo (master3395 or --repo override)
+export CYBERPANEL_GIT_USER="${Git_User:-usmannasir}"
+# So upgrade.py can import plogical (it runs from /root/cyberpanel_upgrade_tmp)
+export PYTHONPATH="/usr/local/CyberCP${PYTHONPATH:+:$PYTHONPATH}"
+
+# Run from dir that contains upgrade.py
+for d in /root/cyberpanel_upgrade_tmp /usr/local/CyberCP; do
+  if [[ -f "$d/upgrade.py" ]]; then cd "$d" || true; break; fi
+done
+
 # Run upgrade.py and capture output
 upgrade_output=$("$CP_PYTHON" upgrade.py "$Branch_Name" 2>&1)
 RETURN_CODE=$?
@@ -1402,6 +1445,8 @@ elif [[ "$Server_OS" = "openEuler" ]] ; then
 fi

 echo -e "[$(date +"%Y-%m-%d %H:%M:%S")] Running fallback: /usr/local/CyberPanelTemp/bin/python upgrade.py $Branch_Name" | tee -a /var/log/cyberpanel_upgrade_debug.log
+export CYBERPANEL_GIT_USER="${Git_User:-usmannasir}"
+export PYTHONPATH="/usr/local/CyberCP${PYTHONPATH:+:$PYTHONPATH}"
 /usr/local/CyberPanelTemp/bin/python upgrade.py "$Branch_Name" 2>&1 | tee -a /var/log/cyberpanel_upgrade_debug.log
 FALLBACK_CODE=$?
 echo -e "[$(date +"%Y-%m-%d %H:%M:%S")] Fallback upgrade returned code: $FALLBACK_CODE" | tee -a /var/log/cyberpanel_upgrade_debug.log
@@ -1662,7 +1707,8 @@ Sync_CyberCP_To_Latest() {
    cd /usr/local/CyberCP
    git fetch origin 2>&1 | tee -a /var/log/cyberpanel_upgrade_debug.log
    if git show-ref -q "refs/remotes/origin/$Branch_Name"; then
-      git checkout -B "$Branch_Name" "origin/$Branch_Name" 2>&1 | tee -a /var/log/cyberpanel_upgrade_debug.log
+      # Force tree to match remote so local changes/untracked files do not block (settings.py restored below)
+      git reset --hard "origin/$Branch_Name" 2>&1 | tee -a /var/log/cyberpanel_upgrade_debug.log
    else
      git checkout "$Branch_Name" 2>/dev/null || true
      git pull --ff-only origin "$Branch_Name" 2>&1 | tee -a /var/log/cyberpanel_upgrade_debug.log || true
--- a/install/install.py
+++ b/install/install.py
@@ -2149,6 +2149,27 @@ module cyberpanel_ols {
            logging.InstallLog.writeToFile(error_msg)
            raise Exception(error_msg)

+    def _ensure_mariadb_client_no_ssl(self):
+        """Ensure MariaDB client connects without SSL (avoids ERROR 2026 when server has have_ssl=DISABLED)."""
+        client_cnf = "[client]\nssl=0\nskip-ssl\n"
+        try:
+            # RHEL/AlmaLinux: /etc/my.cnf.d/cyberpanel-client.cnf
+            if not os.path.exists('/etc/my.cnf.d'):
+                os.makedirs('/etc/my.cnf.d', mode=0o755, exist_ok=True)
+            with open('/etc/my.cnf.d/cyberpanel-client.cnf', 'w') as f:
+                f.write(client_cnf)
+            logging.InstallLog.writeToFile("Created /etc/my.cnf.d/cyberpanel-client.cnf (client SSL disabled)")
+        except Exception as e:
+            logging.InstallLog.writeToFile("_ensure_mariadb_client_no_ssl: /etc/my.cnf.d: %s" % str(e))
+        try:
+            # Debian/Ubuntu: /etc/mysql/mariadb.conf.d/99-cyberpanel-client.cnf
+            if os.path.exists('/etc/mysql/mariadb.conf.d'):
+                with open('/etc/mysql/mariadb.conf.d/99-cyberpanel-client.cnf', 'w') as f:
+                    f.write(client_cnf)
+                logging.InstallLog.writeToFile("Created /etc/mysql/mariadb.conf.d/99-cyberpanel-client.cnf (client SSL disabled)")
+        except Exception as e:
+            logging.InstallLog.writeToFile("_ensure_mariadb_client_no_ssl: mariadb.conf.d: %s" % str(e))
+
    def command_exists(self, command):
        """Check if a command exists in PATH"""
        try:
@@ -3225,10 +3246,13 @@ module cyberpanel_ols {
        # all the other control panels allow
        # reference: https://oracle-base.com/articles/mysql/mysql-password-less-logins-using-option-files
        mysql_my_root_cnf = '/root/.my.cnf'
+        # Include skip-ssl/ssl=0 so client does not require SSL (avoids ERROR 2026 when server has have_ssl=DISABLED)
        mysql_root_cnf_content = """
 [client]
 user=root
 password="%s"
+ssl=0
+skip-ssl
 """ % password

        with open(mysql_my_root_cnf, 'w') as f:
@@ -3239,6 +3263,10 @@ password="%s"

        logging.InstallLog.writeToFile("Updating /root/.my.cnf!")

+        # Ensure system-wide MariaDB client uses no SSL (all installs: avoids ERROR 2026 on servers with SSL disabled)
+        if self.remotemysql == 'OFF':
+            self._ensure_mariadb_client_no_ssl()
+
        logging.InstallLog.writeToFile("Generating secure environment configuration!")

        # Determine the correct MySQL root password to use
--- a/plogical/upgrade.py
+++ b/plogical/upgrade.py
@@ -296,8 +296,8 @@ except ImportError:
    settings = MinimalSettings()
    print("Recovery complete. Continuing with upgrade...")

-VERSION = '2.4'
-BUILD = 4
+VERSION = '2.5.5'
+BUILD = 5

 CENTOS7 = 0
 CENTOS8 = 1
@@ -3974,9 +3974,10 @@ class Migration(migrations.Migration):
                    Upgrade.restoreCriticalFiles(backup_dir, backed_up_files)
                    return 0, 'Failed to remove old CyberCP directory'

-            # Clone the new repository directly to CyberCP
+            # Clone the new repository (use CYBERPANEL_GIT_USER for fork, e.g. master3395)
+            git_user = os.environ.get('CYBERPANEL_GIT_USER', 'master3395')
            Upgrade.stdOut("Cloning fresh CyberPanel repository...")
-            command = 'git clone https://github.com/usmannasir/cyberpanel CyberCP'
+            command = 'git clone https://github.com/%s/cyberpanel CyberCP' % git_user
            if not Upgrade.executioner(command, command, 1):
                # Try to restore backup if clone fails
                Upgrade.stdOut("Clone failed, attempting to restore backup...")
--- a/pluginHolder/templates/pluginHolder/plugins.html
+++ b/pluginHolder/templates/pluginHolder/plugins.html
@@ -3113,80 +3113,84 @@ document.addEventListener('DOMContentLoaded', function() {
    // Update cache expiry time to local timezone
    updateCacheExpiryTime();
    
-    // Search input listener (debounced)
-    const searchInput = document.getElementById('pluginSearchInput');
-    const searchClearBtn = document.getElementById('pluginSearchClear');
-    if (searchInput) {
-        searchInput.addEventListener('input', function() {
-            currentSearchQuery = this.value;
-            if (searchClearBtn) {
-                searchClearBtn.style.display = currentSearchQuery.trim() ? 'block' : 'none';
-            }
-            displayStorePlugins();
-        });
-        searchInput.addEventListener('keydown', function(e) {
-            if (e.key === 'Escape') {
-                clearPluginSearch();
-                e.preventDefault();
-            }
-        });
-    }
-    
-    // Installed plugins search (Grid View and Table View)
-    const installedSearchInput = document.getElementById('installedPluginSearchInput');
-    const installedSearchClearBtn = document.getElementById('installedPluginSearchClear');
-    if (installedSearchInput) {
-        installedSearchInput.addEventListener('input', function() {
-            if (installedSearchClearBtn) {
-                installedSearchClearBtn.style.display = this.value.trim() ? 'block' : 'none';
-            }
-            filterInstalledPlugins();
-        });
-        installedSearchInput.addEventListener('keydown', function(e) {
-            if (e.key === 'Escape') {
-                clearInstalledPluginSearch();
-                e.preventDefault();
-            }
-        });
-    }
-    
-    // Check URL hash for view preference
-    const hash = window.location.hash.substring(1); // Remove #
-    const validViews = ['grid', 'table', 'store'];
-    
-    // Check if view elements exist before calling toggleView
-    const gridView = document.getElementById('gridView');
-    const tableView = document.getElementById('tableView');
-    const storeView = document.getElementById('storeView');
-    
-    // Only proceed if all view elements exist (plugins are installed)
-    if (gridView && tableView && storeView) {
-        let initialView = 'grid'; // Default
-        if (validViews.includes(hash)) {
-            initialView = hash;
-        } else {
-            // Default to grid view if plugins exist, otherwise show store
-            if (gridView.children.length > 0) {
-                initialView = 'grid';
-            } else {
-                initialView = 'store';
-            }
+    // Respect ?view=store in URL (e.g. from sidebar "Plugin Store" link)
+    const urlParams = new URLSearchParams(window.location.search);
+    const requestedView = urlParams.get('view');
+    if (requestedView === 'store') {
+        toggleView('store');
+    } else {
+        // Search input listener (debounced)
+        const searchInput = document.getElementById('pluginSearchInput');
+        const searchClearBtn = document.getElementById('pluginSearchClear');
+        if (searchInput) {
+            searchInput.addEventListener('input', function() {
+                currentSearchQuery = this.value;
+                if (searchClearBtn) {
+                    searchClearBtn.style.display = currentSearchQuery.trim() ? 'block' : 'none';
+                }
+                displayStorePlugins();
+            });
+            searchInput.addEventListener('keydown', function(e) {
+                if (e.key === 'Escape') {
+                    clearPluginSearch();
+                    e.preventDefault();
+                }
+            });
        }
        
-        // Set initial view without updating hash (only update hash if there was already one)
-        const hadHash = hash.length > 0;
-        try {
-            toggleView(initialView, hadHash);
-        } catch (e) {
-            console.warn('plugins: toggleView on load failed', e);
-            if (storeView) storeView.style.display = 'block';
-            if (gridView) gridView.style.display = 'none';
-            if (tableView) tableView.style.display = 'none';
+        // Installed plugins search (Grid View and Table View)
+        const installedSearchInput = document.getElementById('installedPluginSearchInput');
+        const installedSearchClearBtn = document.getElementById('installedPluginSearchClear');
+        if (installedSearchInput) {
+            installedSearchInput.addEventListener('input', function() {
+                if (installedSearchClearBtn) {
+                    installedSearchClearBtn.style.display = this.value.trim() ? 'block' : 'none';
+                }
+                filterInstalledPlugins();
+            });
+            installedSearchInput.addEventListener('keydown', function(e) {
+                if (e.key === 'Escape') {
+                    clearInstalledPluginSearch();
+                    e.preventDefault();
+                }
+            });
        }
-    } else {
-        // Elements don't exist (no plugins installed), just show store view directly
-        if (storeView) {
-            storeView.style.display = 'block';
+        
+        // Check URL hash for view preference
+        const hash = window.location.hash.substring(1); // Remove #
+        const validViews = ['grid', 'table', 'store'];
+        
+        // Check if view elements exist before calling toggleView
+        const gridView = document.getElementById('gridView');
+        const tableView = document.getElementById('tableView');
+        const storeView = document.getElementById('storeView');
+        
+        // Only proceed if all view elements exist (plugins are installed)
+        if (gridView && tableView && storeView) {
+            let initialView = 'grid'; // Default
+            if (validViews.includes(hash)) {
+                initialView = hash;
+            } else {
+                if (gridView.children.length > 0) {
+                    initialView = 'grid';
+                } else {
+                    initialView = 'store';
+                }
+            }
+            
+            const hadHash = hash.length > 0;
+            try {
+                toggleView(initialView, hadHash);
+            } catch (e) {
+                console.warn('plugins: toggleView on load failed', e);
+                if (storeView) storeView.style.display = 'block';
+                if (gridView) gridView.style.display = 'none';
+                if (tableView) tableView.style.display = 'none';
+            }
+        } else {
+            if (storeView) {
+                storeView.style.display = 'block';
+            }
        }
    }
    
--- a/public/static/baseTemplate/custom-js/system-status.js
+++ b/public/static/baseTemplate/custom-js/system-status.js
--- a/to-do/MARIADB-CLIENT-NO-SSL-INSTALL-UPGRADE.md
+++ b/to-do/MARIADB-CLIENT-NO-SSL-INSTALL-UPGRADE.md
@@ -0,0 +1,51 @@
+# MariaDB Client No-SSL (ERROR 2026 Fix) – Install and Upgrade Coverage
+
+This document summarizes where the MariaDB client “no SSL” configuration is applied so that **install** and **upgrade** both work when the server has `have_ssl=DISABLED` (avoids `ERROR 2026 (HY000): TLS/SSL error: SSL is required, but the server does not support it`).
+
+## What gets applied
+
+- **`[client]`** with **`ssl=0`** and **`skip-ssl`** in:
+  - `/etc/my.cnf.d/cyberpanel-client.cnf` (RHEL/AlmaLinux/CentOS)
+  - `/etc/mysql/mariadb.conf.d/99-cyberpanel-client.cnf` (Debian/Ubuntu, when that directory exists)
+  - Optionally appended to **`/etc/my.cnf`** if it has no `[client]` section
+
+## Install path
+
+| Location | What happens |
+|----------|----------------|
+| **install/install.py** | Writes `/root/.my.cnf` with `[client]` including `ssl=0` and `skip-ssl`. When `remotemysql == 'OFF'`, calls `_ensure_mariadb_client_no_ssl()` which creates `/etc/my.cnf.d/cyberpanel-client.cnf` (RHEL) and `/etc/mysql/mariadb.conf.d/99-cyberpanel-client.cnf` (Debian/Ubuntu). |
+
+So every **fresh install** (local MariaDB) gets the client no-SSL config.
+
+## Upgrade path (modular: `cyberpanel_upgrade.sh` + `upgrade_modules/`)
+
+| Module | What happens |
+|--------|----------------|
+| **03_mariadb.sh** | Defines **`Ensure_MariaDB_Client_No_SSL()`** (writes `cyberpanel-client.cnf`, optional `[client]` in `my.cnf`, and Debian `99-cyberpanel-client.cnf`). Called at end of **`Pre_Upgrade_CentOS7_MySQL`** when that path runs. |
+| **05_repository.sh** | After all OS-specific repository and MariaDB install/upgrade logic (CentOS, AlmaLinux 9, Ubuntu/Debian, openEuler), calls **`Ensure_MariaDB_Client_No_SSL`** once. Every RHEL/DNF path also writes `cyberpanel-client.cnf` and optional `my.cnf` [client] inline; Ubuntu/Debian get the fix via this single call. |
+
+So every **modular upgrade** run applies the client no-SSL config on all supported OSes.
+
+## Upgrade path (monolithic: `cyberpanel_upgrade_monolithic.sh`)
+
+| Location | What happens |
+|----------|----------------|
+| **Pre_Upgrade_Setup_Repository** | Each RHEL/DNF branch already creates `/etc/my.cnf.d/cyberpanel-client.cnf` with `ssl=0` and `skip-ssl` and optionally appends `[client]` to `/etc/my.cnf`. At the **end** of the same function (after Ubuntu and openEuler blocks), a single block runs that: creates `cyberpanel-client.cnf`, appends `[client]` to `my.cnf` if missing, and creates `/etc/mysql/mariadb.conf.d/99-cyberpanel-client.cnf` on Debian/Ubuntu. |
+
+So every **monolithic upgrade** run also ensures the client no-SSL config on all paths.
+
+## Verification
+
+After install or upgrade:
+
+```bash
+mariadb -e "SELECT 1"
+# or
+mariadb -e "SELECT @@version;"
+```
+
+If these work without `ERROR 2026`, the client no-SSL configuration is in effect.
+
+## Manual fix (if needed)
+
+See **to-do/fix-phpmyadmin-mariadb-version-on-server.md** for a manual one-off fix on a single server.
--- a/to-do/fix-phpmyadmin-mariadb-version-on-server.md
+++ b/to-do/fix-phpmyadmin-mariadb-version-on-server.md
@@ -5,9 +5,11 @@
 Run as root on the server:

 ```bash
-# Allow mariadb client to connect without SSL (11.x client requires SSL by default)
+# Allow mariadb client to connect without SSL (avoids ERROR 2026 when server has have_ssl=DISABLED)
 mkdir -p /etc/my.cnf.d
-printf '[client]\nskip-ssl = true\n' > /etc/my.cnf.d/cyberpanel-client.cnf
+printf '[client]\nssl=0\nskip-ssl\n' > /etc/my.cnf.d/cyberpanel-client.cnf
+# If client still requires SSL, add [client] to main my.cnf (only if not already present)
+grep -q '^\[client\]' /etc/my.cnf 2>/dev/null || echo -e "\n[client]\nssl=0\nskip-ssl" >> /etc/my.cnf

 # Now this should work and show the *actual* server version on 3306
 mariadb -e "SELECT @@version;"
--- a/upgrade_modules/02_checks.sh
+++ b/upgrade_modules/02_checks.sh
@@ -140,50 +140,67 @@ MARIADB_VER="11.8"
 MARIADB_VER_REPO="11.8"

 Check_Argument() {
-# Parse --branch / -b (extract first word after -b or --branch)
-if [[ "$*" = *"--branch "* ]]; then
-  Branch_Name=$(echo "$*" | sed -n 's/.*--branch \([^ ]*\).*/\1/p' | head -1)
-  [[ -n "$Branch_Name" ]] && Branch_Check "$Branch_Name"
-elif [[ "$*" = *"-b "* ]]; then
-  Branch_Name=$(echo "$*" | sed -n 's/.*-b \([^ ]*\).*/\1/p' | head -1)
-  [[ -n "$Branch_Name" ]] && Branch_Check "$Branch_Name"
-fi
-# Parse --repo / -r to use any GitHub user (same URL structure as usmannasir/cyberpanel)
-if [[ "$*" = *"--repo "* ]]; then
-  Git_User_Override=$(echo "$*" | sed -n 's/.*--repo \([^ ]*\).*/\1/p' | head -1)
-fi
-if [[ "$*" = *"-r "* ]] && [[ -z "$Git_User_Override" ]]; then
-  Git_User_Override=$(echo "$*" | sed -n 's/.*-r \([^ ]*\).*/\1/p' | head -1)
-fi
-# Parse --no-system-update to skip yum/dnf update -y (faster upgrade when system is already updated)
-if [[ "$*" = *"--no-system-update"* ]]; then
-  Skip_System_Update="yes"
-  echo -e "\nUsing --no-system-update: skipping full system package update.\n"
-fi
-# Parse --backup-db / --no-backup-db: pre-upgrade MariaDB backup. Default when neither set: ask user (may take a while).
-# --backup-db = always backup; --no-backup-db = never backup; omit both = prompt [y/N]
 Backup_DB_Before_Upgrade=""
-if [[ "$*" = *"--backup-db"* ]]; then
-  Backup_DB_Before_Upgrade="yes"
-  echo -e "\nUsing --backup-db: will create a full MariaDB backup before upgrade.\n"
-elif [[ "$*" = *"--no-backup-db"* ]]; then
-  Backup_DB_Before_Upgrade="no"
-  echo -e "\nUsing --no-backup-db: skipping MariaDB pre-upgrade backup.\n"
-fi
-# Parse --migrate-to-utf8: after upgrading to MariaDB 11.x/12.x, convert DBs/tables from latin1 to utf8mb4 (only if your apps support UTF-8)
-if [[ "$*" = *"--migrate-to-utf8"* ]]; then
-  Migrate_MariaDB_To_UTF8_Requested="yes"
-  echo -e "\nUsing --migrate-to-utf8: will convert databases to UTF-8 (utf8mb4) after MariaDB upgrade.\n"
-fi
-# Parse --mariadb-version (any version: 10.6, 10.11, 10.11.16, 11.8, 12.1, 12.2, 12.3, etc.). Default 11.8.
-# --mariadb is shorthand for --mariadb-version 10.11
-if [[ "$*" = *"--mariadb"* ]] && [[ "$*" != *"--mariadb-version "* ]]; then
-  MARIADB_VER="10.11"
-  echo -e "\nUsing --mariadb: MariaDB 10.11 selected (non-interactive).\n"
-elif [[ "$*" = *"--mariadb-version "* ]]; then
-  MARIADB_VER=$(echo "$*" | sed -n 's/.*--mariadb-version \([^ ]*\).*/\1/p' | head -1)
-  MARIADB_VER="${MARIADB_VER:-11.8}"
-fi
-# Allow any version; repo paths use major.minor (normalized later)
+# Parse arguments with exact next-token so -b v2.5.5-dev --mariadb-version 12.3 does not mangle Branch_Name
+set -- $*
+while [[ $# -ge 1 ]]; do
+  case "$1" in
+    -b|--branch)
+      if [[ -n "${2:-}" ]] && [[ "$2" != -* ]]; then
+        Branch_Name="$2"
+        Branch_Check "$Branch_Name"
+        shift 2
+        continue
+      fi
+      shift
+      ;;
+    --mariadb-version)
+      if [[ -n "${2:-}" ]] && [[ "$2" != -* ]]; then
+        MARIADB_VER="$2"
+        echo -e "\nUsing --mariadb-version: MariaDB $MARIADB_VER selected.\n"
+        shift 2
+        continue
+      fi
+      shift
+      ;;
+    -r|--repo)
+      if [[ -n "${2:-}" ]] && [[ "$2" != -* ]]; then
+        Git_User_Override="$2"
+        echo -e "\nUsing --repo: GitHub user $Git_User_Override for cyberpanel.\n"
+        shift 2
+        continue
+      fi
+      shift
+      ;;
+    --no-system-update)
+      Skip_System_Update="yes"
+      echo -e "\nUsing --no-system-update: skipping full system package update.\n"
+      shift
+      ;;
+    --backup-db)
+      Backup_DB_Before_Upgrade="yes"
+      echo -e "\nUsing --backup-db: will create a full MariaDB backup before upgrade.\n"
+      shift
+      ;;
+    --no-backup-db)
+      Backup_DB_Before_Upgrade="no"
+      echo -e "\nUsing --no-backup-db: skipping MariaDB pre-upgrade backup.\n"
+      shift
+      ;;
+    --migrate-to-utf8)
+      Migrate_MariaDB_To_UTF8_Requested="yes"
+      echo -e "\nUsing --migrate-to-utf8: will convert databases to UTF-8 (utf8mb4) after MariaDB upgrade.\n"
+      shift
+      ;;
+    --mariadb)
+      MARIADB_VER="10.11"
+      echo -e "\nUsing --mariadb: MariaDB 10.11 selected (non-interactive).\n"
+      shift
+      ;;
+    *)
+      shift
+      ;;
+  esac
+done
 }

--- a/upgrade_modules/03_mariadb.sh
+++ b/upgrade_modules/03_mariadb.sh
@@ -17,6 +17,7 @@ Pre_Upgrade_CentOS7_MySQL() {
    mariadb-upgrade -uroot -p"$MySQL_Password" 2>/dev/null || mysql_upgrade -uroot -p"$MySQL_Password"
  fi
  mariadb -uroot -p"$MySQL_Password" -e "GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' IDENTIFIED BY '$MySQL_Password';flush privileges" 2>/dev/null || mysql -uroot -p"$MySQL_Password" -e "GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' IDENTIFIED BY '$MySQL_Password';flush privileges"
+  Ensure_MariaDB_Client_No_SSL
 }

 Maybe_Backup_MariaDB_Before_Upgrade() {
@@ -86,3 +87,17 @@ Migrate_MariaDB_To_UTF8() {
  done
  echo -e "[$(date +"%Y-%m-%d %H:%M:%S")] MariaDB UTF-8 (utf8mb4) migration completed." | tee -a /var/log/cyberpanel_upgrade_debug.log
 }
+
+# Ensure MariaDB client connects without SSL (avoids ERROR 2026 when server has have_ssl=DISABLED).
+# Call after any MariaDB install/upgrade so install and upgrade paths both get the fix.
+Ensure_MariaDB_Client_No_SSL() {
+  mkdir -p /etc/my.cnf.d
+  printf "[client]\nssl=0\nskip-ssl\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
+  if [[ -f /etc/my.cnf ]] && ! grep -q '^\[client\]' /etc/my.cnf 2>/dev/null; then
+    echo -e "\n[client]\nssl=0\nskip-ssl" >> /etc/my.cnf
+  fi
+  if [[ -d /etc/mysql/mariadb.conf.d ]]; then
+    printf "[client]\nssl=0\nskip-ssl\n" > /etc/mysql/mariadb.conf.d/99-cyberpanel-client.cnf 2>/dev/null || true
+  fi
+  echo -e "[$(date +"%Y-%m-%d %H:%M:%S")] MariaDB client no-SSL config ensured (cyberpanel-client.cnf, optional my.cnf [client])." | tee -a /var/log/cyberpanel_upgrade_debug.log
+}
--- a/upgrade_modules/04_git_url.sh
+++ b/upgrade_modules/04_git_url.sh
@@ -6,9 +6,9 @@ Pre_Upgrade_Setup_Git_URL() {
  if [[ $Server_Country != "CN" ]] ; then
    if [[ -n "$Git_User_Override" ]]; then
      Git_User="$Git_User_Override"
-      echo -e "\nUsing GitHub repo: ${Git_User}/cyberpanel (same URL structure as usmannasir)\n"
+      echo -e "\nUsing GitHub repo: ${Git_User}/cyberpanel\n"
    else
-      Git_User="usmannasir"
+      Git_User="master3395"
    fi
    Git_Content_URL="https://raw.githubusercontent.com/${Git_User}/cyberpanel"
    Git_Clone_URL="https://github.com/${Git_User}/cyberpanel.git"
--- a/upgrade_modules/05_repository.sh
+++ b/upgrade_modules/05_repository.sh
@@ -261,6 +261,7 @@ EOF
    dnf clean metadata --disablerepo='*' --enablerepo=mariadb 2>/dev/null || true
    # MariaDB 10 -> 11 or 11 -> 12: RPM scriptlet blocks in-place upgrade; do manual stop, remove old server, install target, start, mariadb-upgrade
    MARIADB_OLD_10=$(rpm -qa 'MariaDB-server-10*' 2>/dev/null | head -1)
+    [[ -z "$MARIADB_OLD_10" ]] && MARIADB_OLD_10=$(rpm -qa 2>/dev/null | grep -E '^MariaDB-server-10\.' | head -1)
    MARIADB_OLD_11=$(rpm -qa 'MariaDB-server-11*' 2>/dev/null | head -1)
    # Also detect 11.x by package version (e.g. MariaDB-server-11.8.6-1.el9)
    [[ -z "$MARIADB_OLD_11" ]] && MARIADB_OLD_11=$(rpm -qa 'MariaDB-server*' 2>/dev/null | grep -E 'MariaDB-server-11\.' | head -1)
@@ -274,7 +275,7 @@ EOF
      rpm -e "$MARIADB_OLD_10" --nodeps 2>/dev/null || true
      dnf install -y --enablerepo=mariadb MariaDB-server MariaDB-client MariaDB-devel 2>/dev/null || true
      mkdir -p /etc/my.cnf.d
-      printf "[client]\nskip-ssl = true\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
+      printf "[client]\nssl=0\nskip-ssl\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
      systemctl start mariadb 2>/dev/null || true
      sleep 2
      mariadb-upgrade -u root 2>/dev/null || true
@@ -288,7 +289,7 @@ EOF
      rpm -e "$MARIADB_OLD_11" --nodeps 2>/dev/null || true
      dnf install -y --enablerepo=mariadb MariaDB-server MariaDB-client MariaDB-devel 2>/dev/null || true
      mkdir -p /etc/my.cnf.d
-      printf "[client]\nskip-ssl = true\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
+      printf "[client]\nssl=0\nskip-ssl\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
      systemctl start mariadb 2>/dev/null || true
      sleep 2
      mariadb-upgrade -u root 2>/dev/null || true
@@ -311,7 +312,7 @@ EOF
          rpm -e "$STILL_11" --nodeps 2>/dev/null || true
          dnf install -y --enablerepo=mariadb MariaDB-server MariaDB-client MariaDB-devel 2>/dev/null || true
          mkdir -p /etc/my.cnf.d
-          printf "[client]\nskip-ssl = true\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
+          printf "[client]\nssl=0\nskip-ssl\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
          systemctl start mariadb 2>/dev/null || true
          sleep 2
          mariadb-upgrade -u root 2>/dev/null || true
@@ -321,7 +322,11 @@ EOF
    fi
    # Allow local client to connect without SSL (11.x client defaults to SSL; 10.x server may not have it)
    mkdir -p /etc/my.cnf.d
-    printf "[client]\nskip-ssl = true\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
+    printf "[client]\nssl=0\nskip-ssl\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
+    # Ensure main my.cnf has [client] without SSL when server has SSL disabled (ERROR 2026 fix)
+    if [[ -f /etc/my.cnf ]] && ! grep -q '^\[client\]' /etc/my.cnf 2>/dev/null; then
+      echo -e "\n[client]\nssl=0\nskip-ssl" >> /etc/my.cnf
+    fi
    # Optional: migrate from latin1 to UTF-8 (utf8mb4) when --migrate-to-utf8 and 11.x/12.x
    if [[ "$Migrate_MariaDB_To_UTF8_Requested" = "yes" ]] && { [[ "$MARIADB_VER_REPO" =~ ^11\. ]] || [[ "$MARIADB_VER_REPO" =~ ^12\. ]]; }; then
      Migrate_MariaDB_To_UTF8
@@ -346,6 +351,7 @@ EOF
    
    # Install/upgrade MariaDB from our repo (any version: 10.11, 11.8, 12.x). Manual path for 10->11 and 11->12.
    MARIADB_OLD_10_AL9=$(rpm -qa 'MariaDB-server-10*' 2>/dev/null | head -1)
+    [[ -z "$MARIADB_OLD_10_AL9" ]] && MARIADB_OLD_10_AL9=$(rpm -qa 2>/dev/null | grep -E '^MariaDB-server-10\.' | head -1)
    MARIADB_OLD_11_AL9=$(rpm -qa 'MariaDB-server-11*' 2>/dev/null | head -1)
    [[ -z "$MARIADB_OLD_11_AL9" ]] && MARIADB_OLD_11_AL9=$(rpm -qa 'MariaDB-server*' 2>/dev/null | grep -E 'MariaDB-server-11\.' | head -1)
    if [[ -n "$MARIADB_OLD_10_AL9" ]] && { [[ "$MARIADB_VER_REPO" =~ ^11\. ]] || [[ "$MARIADB_VER_REPO" =~ ^12\. ]]; }; then
@@ -357,7 +363,7 @@ EOF
      rpm -e "$MARIADB_OLD_10_AL9" --nodeps 2>/dev/null || true
      dnf install -y --enablerepo=mariadb MariaDB-server MariaDB-devel 2>/dev/null || dnf install -y mariadb-server mariadb-devel
      mkdir -p /etc/my.cnf.d
-      printf "[client]\nskip-ssl = true\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
+      printf "[client]\nssl=0\nskip-ssl\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
      systemctl start mariadb 2>/dev/null || true
      sleep 2
      mariadb-upgrade -u root 2>/dev/null || true
@@ -371,7 +377,7 @@ EOF
      rpm -e "$MARIADB_OLD_11_AL9" --nodeps 2>/dev/null || true
      dnf install -y --enablerepo=mariadb MariaDB-server MariaDB-devel 2>/dev/null || dnf install -y mariadb-server mariadb-devel
      mkdir -p /etc/my.cnf.d
-      printf "[client]\nskip-ssl = true\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
+      printf "[client]\nssl=0\nskip-ssl\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
      systemctl start mariadb 2>/dev/null || true
      sleep 2
      mariadb-upgrade -u root 2>/dev/null || true
@@ -383,7 +389,7 @@ EOF
    fi
    # Allow local client to connect without SSL
    mkdir -p /etc/my.cnf.d
-    printf "[client]\nskip-ssl = true\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
+    printf "[client]\nssl=0\nskip-ssl\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true

    # Install additional required packages (omit curl - AlmaLinux 9 has curl-minimal, avoid conflict)
    dnf install -y wget unzip zip rsync firewalld psmisc git python3 python3-pip python3-devel 2>/dev/null || dnf install -y --allowerasing wget unzip zip rsync firewalld psmisc git python3 python3-pip python3-devel
@@ -490,5 +496,8 @@ if [[ "$Server_OS" = "openEuler" ]] ; then
  dnf install python3 -y
 fi
 #all pre-upgrade operation for openEuler
+
+  # Ensure MariaDB client no-SSL on every upgrade path (install and upgrade; avoids ERROR 2026)
+  Ensure_MariaDB_Client_No_SSL
 }

--- a/upgrade_modules/08_main_upgrade.sh
+++ b/upgrade_modules/08_main_upgrade.sh
@@ -28,6 +28,9 @@ fi

 echo -e "[$(date +"%Y-%m-%d %H:%M:%S")] Running: $CP_PYTHON upgrade.py $Branch_Name" | tee -a /var/log/cyberpanel_upgrade_debug.log

+# Export Git user so upgrade.py clones from the same repo (master3395 or --repo override)
+export CYBERPANEL_GIT_USER="${Git_User:-master3395}"
+
 # Run upgrade.py and capture output
 upgrade_output=$("$CP_PYTHON" upgrade.py "$Branch_Name" 2>&1)
 RETURN_CODE=$?
@@ -94,6 +97,7 @@ elif [[ "$Server_OS" = "openEuler" ]] ; then
 fi

 echo -e "[$(date +"%Y-%m-%d %H:%M:%S")] Running fallback: /usr/local/CyberPanelTemp/bin/python upgrade.py $Branch_Name" | tee -a /var/log/cyberpanel_upgrade_debug.log
+export CYBERPANEL_GIT_USER="${Git_User:-master3395}"
 /usr/local/CyberPanelTemp/bin/python upgrade.py "$Branch_Name" 2>&1 | tee -a /var/log/cyberpanel_upgrade_debug.log
 FALLBACK_CODE=$?
 echo -e "[$(date +"%Y-%m-%d %H:%M:%S")] Fallback upgrade returned code: $FALLBACK_CODE" | tee -a /var/log/cyberpanel_upgrade_debug.log