Commit Graph

9 Commits

Author SHA1 Message Date
master3395
bbcfec196d fix: LPMA launch routes in secMiddleware; strict sign-on + lpma_policy_read
- secMiddleware: allow Limited phpMyAdmin launch URLs and phpmyadminsignin
  without JSON-body filtering that breaks sign-on POSTs
- plogical/public phpmyadminsignin: lpma_policy_read.inc.php, strict cookie helpers
- webmail: section header comments only
2026-03-27 21:54:17 +01:00
master3395
4d62272664 Merge upstream v2.4.5 into v2.5.5-dev for full stack parity
Integrates webmail and emailDelivery apps, mail-server and install/upgrade
paths, cyberpanel_ols 2.7.0-style binaries, and v2.4.5 UI patterns while
preserving v2.5.5-dev behavior (SnappyMail/PUBLIC_ROOT, childPath in
launchChild, hardened downloads and SSH activity modal).
2026-03-25 20:36:51 +01:00
master3395
9b038badec Database create: allow special chars in password, return real errors, safe SQL
- secMiddleware: allow dbPassword to bypass strict char check (stronger passwords)
- mysqlUtilities.createDatabase: return (0, error_message) on failure so UI shows real error instead of '0'
- mysqlUtilities.createDatabase: backtick-quote db name (fix 'near -admin' with hyphens), escape password and user for SQL
- submitDBCreation: pass through error message from createDatabase
- backupUtilities, Backupsv2, restoreMeta: treat createDatabase != 1 as failure (tuple return)
- patches/allow-dbpassword-special-chars.patch for secMiddleware deploy
2026-03-13 23:36:29 +01:00
master3395
4177f0023b Misc: firewall, pluginHolder, mobile CSS, install utilities, static assets
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-14 23:02:47 +01:00
master3395
7ad2044a9c Fix static file serving: Allow /static/ paths in secMiddleware and add static file URL pattern 2026-01-19 17:26:58 +01:00
master3395
ed7d4743b6 Add plugin system enhancements and testPlugin
- Enhanced plugin installer to properly extract and install plugins
- Added security middleware exception for plugin webhook endpoints
- Improved plugin listing with better error handling
- Added testPlugin as example plugin for CyberPanel plugin system
- Updated INSTALLED_APPS and URL routing for plugins

Author: master3395
2026-01-04 21:04:51 +01:00
usmannasir
e65109feca Fix security middleware to allow file content in API endpoints
- Add bypass check for 'content' field INSIDE isAPIEndpoint block
- Prevents blocking of legitimate JavaScript/PHP code in replace-file API
- Bypass list includes: content, fileContent, configData, rewriteRules, modSecRules
- Security check still applies to other fields in API requests
- Fixes: Replace-file API being blocked by security middleware
2025-10-26 15:08:34 +05:00
Master3395
48c9c1ad6a Update README and enhance error handling: Increment version to 2.4 Build 4 and add notes on PHP version management. Improve error logging across multiple modules by replacing BaseException with Exception and utilizing secure error handling methods. Ensure consistent error responses in API and middleware functions for better debugging and user feedback. 2025-09-21 20:36:12 +02:00
usmannasir
6dd7114f6d Initial commit for v2.4.3 2025-08-01 14:56:30 +05:00