1.8.12 ? (#4532)

* import 1.8.12.sh from main branch

* add hestiamail to hestia-users

* version numbers

* Fix roundcube permissions

This patch basically changes the user group root:hestiamail to hestiamail:www-data for roundcube directories.

Also changes the permissions from 644 to 640 to the file /etc/roundcube/config.inc.php so that it cannot be read by others as it contains the roundcube user's password for the database.

* Update CHANGELOG.md

* Fix roundcube permissions

This patch basically changes the user group root:hestiamail to hestiamail:www-data for roundcube directories.

Also changes the permissions from 644 to 640 to the file /etc/roundcube/config.inc.php so that it cannot be read by others as it contains the roundcube user's password for the database.

* Update CHANGELOG.md

* Run npm run format

* Update Roundcube / Snappymail / Filegator

* remove duplicate validate_web_domain (#4536)

---------

Co-authored-by: sahsanu <sahsanu@users.noreply.github.com>
Co-authored-by: Jaap Marcus <9754650+jaapmarcus@users.noreply.github.com>

CHANGELOG.md

@@ -2,6 +2,13 @@
 
 All notable changes to this project will be documented in this file.
 
+## [1.8.12] - Service release
+
+### Security
+
+- Restrict hestiamail file permissions (todo should probably have a link here)
+- Fix roundcube permissions ( GH-4387 )
+
 ## [1.8.11] - Service release
 
 ### Features

README.md

@@ -4,7 +4,7 @@
 
 <h2 align="center">A lightweight and powerful control panel for the modern web</h2>
 
-<p align="center"><strong>Latest stable release:</strong> Version 1.8.11 | <a href="https://github.com/hestiacp/hestiacp/blob/release/CHANGELOG.md">View Changelog</a></p>
+<p align="center"><strong>Latest stable release:</strong> Version 1.8.12 | <a href="https://github.com/hestiacp/hestiacp/blob/release/CHANGELOG.md">View Changelog</a></p>
 
 <p align="center">
 	<a href="https://www.hestiacp.com/">HestiaCP.com</a> |

bin/v-add-sys-roundcube

@@ -116,9 +116,9 @@ if [ "$UPDATE" == "no" ]; then
 	ln -s $RC_CONFIG_DIR/plugins/zipdownload/config.inc.php ./plugins/zipdownload/config.inc.php
 
 	# Set up correct permissions roundcube
-	chown -R root:hestiamail $RC_CONFIG_DIR/
+	chown -R hestiamail:www-data $RC_CONFIG_DIR/
 	chmod 751 -R $RC_CONFIG_DIR
-	chmod 644 $RC_CONFIG_DIR/config.inc.php
+	chmod 640 $RC_CONFIG_DIR/config.inc.php
 	chmod 644 $RC_CONFIG_DIR/plugins/password/config.inc.php
 	chmod 644 $RC_CONFIG_DIR/plugins/newmail_notifier/config.inc.php
 	chmod 644 $RC_CONFIG_DIR/plugins/zipdownload/config.inc.php
@@ -127,13 +127,13 @@ if [ "$UPDATE" == "no" ]; then
 	echo "User-agent: *" > /var/lib/roundcube/robots.txt
 	echo "Disallow: /" >> /var/lib/roundcube/robots.txt
 
-	chown -R root:hestiamail $RC_INSTALL_DIR
+	chown -R hestiamail:www-data $RC_INSTALL_DIR
 
 	# Log file
 	if [ ! -d $RC_LOG ]; then
 		mkdir $RC_LOG
 	fi
-	chown hestiamail:hestiamail $RC_LOG
+	chown hestiamail:www-data $RC_LOG
 	chmod 751 $RC_LOG
 
 	if [ ! -z "$(echo "$DB_SYSTEM" | grep -E 'mysql|pgsql')" ]; then
@@ -192,7 +192,7 @@ else
 	export COMPOSER_ALLOW_SUPERUSER=1
 	$RC_INSTALL_DIR/bin/update.sh --version "$version" > /dev/null 2>&1
 	$RC_INSTALL_DIR/bin/indexcontacts.sh > /dev/null 2>&1
-	chown -R root:hestiamail $RC_INSTALL_DIR
+	chown -R hestiamail:www-data $RC_INSTALL_DIR
 
 	#clean up the mess
 	if [ -d "$RC_INSTALL_DIR/installer" ]; then

docs/.vitepress/theme/components/CopyToClipboardInput.vue

@@ -43,7 +43,7 @@ const copyToClipboard = (event) => {
 		},
 		(err) => {
 			console.error("Could not copy to clipboard:", err);
-		},
+		}
 	);
 };
 </script>

install/hst-install-debian.sh

@@ -31,7 +31,7 @@ HESTIA_COMMON_DIR="$HESTIA/install/common"
 VERBOSE='no'
 
 # Define software versions
-HESTIA_INSTALL_VER='1.8.11'
+HESTIA_INSTALL_VER='1.8.12'
 # Dependencies
 multiphp_v=("5.6" "7.0" "7.1" "7.2" "7.3" "7.4" "8.0" "8.1" "8.2" "8.3")
 fpm_v="8.2"
@@ -1046,6 +1046,8 @@ echo "[ * ] Configuring system settings..."
 
 # Create user for php-fpm configs
 /usr/sbin/useradd "hestiamail" -c "$email" --no-create-home
+# Ensures proper permissions for Hestia service interactions.
+/usr/sbin/adduser hestiamail hestia-users
 
 # Enable SFTP subsystem for SSH
 sftp_subsys_enabled=$(grep -iE "^#?.*subsystem.+(sftp )?sftp-server" /etc/ssh/sshd_config)
@@ -2058,11 +2060,12 @@ if [ "$sieve" = 'yes' ]; then
 		mkdir -p $RC_CONFIG_DIR/plugins/managesieve
 		cp -f $HESTIA_COMMON_DIR/roundcube/plugins/config_managesieve.inc.php $RC_CONFIG_DIR/plugins/managesieve/config.inc.php
 		ln -s $RC_CONFIG_DIR/plugins/managesieve/config.inc.php $RC_INSTALL_DIR/plugins/managesieve/config.inc.php
-		chown -R root:hestiamail $RC_CONFIG_DIR/
+		chown -R hestiamail:www-data $RC_CONFIG_DIR/
 		chmod 751 -R $RC_CONFIG_DIR
 		chmod 644 $RC_CONFIG_DIR/*.php
 		chmod 644 $RC_CONFIG_DIR/plugins/managesieve/config.inc.php
 		sed -i "s/\"archive\"/\"archive\", \"managesieve\"/g" $RC_CONFIG_DIR/config.inc.php
+		chmod 640 $RC_CONFIG_DIR/config.inc.php
 	fi
 
 	# Restart Dovecot and exim4

install/hst-install-ubuntu.sh

@@ -31,7 +31,7 @@ HESTIA_COMMON_DIR="$HESTIA/install/common"
 VERBOSE='no'
 
 # Define software versions
-HESTIA_INSTALL_VER='1.8.11'
+HESTIA_INSTALL_VER='1.8.12'
 # Dependencies
 multiphp_v=("5.6" "7.0" "7.1" "7.2" "7.3" "7.4" "8.0" "8.1" "8.2" "8.3")
 fpm_v="8.2"
@@ -1027,6 +1027,8 @@ echo "[ * ] Configuring system settings..."
 
 # Create user for php-fpm configs
 /usr/sbin/useradd "hestiamail" -c "$email" --no-create-home
+# Ensures proper permissions for Hestia service interactions.
+/usr/sbin/adduser hestiamail hestia-users
 
 # Enable SFTP subsystem for SSH
 sftp_subsys_enabled=$(grep -iE "^#?.*subsystem.+(sftp )?sftp-server" /etc/ssh/sshd_config)
@@ -2033,11 +2035,12 @@ if [ "$sieve" = 'yes' ]; then
 		mkdir -p $RC_CONFIG_DIR/plugins/managesieve
 		cp -f $HESTIA_COMMON_DIR/roundcube/plugins/config_managesieve.inc.php $RC_CONFIG_DIR/plugins/managesieve/config.inc.php
 		ln -s $RC_CONFIG_DIR/plugins/managesieve/config.inc.php $RC_INSTALL_DIR/plugins/managesieve/config.inc.php
-		chown -R root:hestiamail $RC_CONFIG_DIR/
+		chown -R hestiamail:www-data $RC_CONFIG_DIR/
 		chmod 751 -R $RC_CONFIG_DIR
 		chmod 644 $RC_CONFIG_DIR/*.php
 		chmod 644 $RC_CONFIG_DIR/plugins/managesieve/config.inc.php
 		sed -i "s/\"archive\"/\"archive\", \"managesieve\"/g" $RC_CONFIG_DIR/config.inc.php
+		chmod 640 $RC_CONFIG_DIR/config.inc.php
 	fi
 
 	# Restart Dovecot and exim4

install/upgrade/upgrade.conf

@@ -50,17 +50,17 @@ pga_v='7.14.6'
 
 # Set version of RoundCube (Webmail) to update during upgrade if not already installed
 # Note: only applies to "non-apt installs >= 1.4.0 or manually phased out"
-rc_v='1.6.5'
+rc_v='1.6.8'
 
 # Set version of SnappyMail (Webmail) to update during upgrade if not already installed
-sm_v='2.29.4'
+sm_v='2.37.2'
 
 # Update the File Manager or it's configuration file
 # Check if Filegator requires an update based on current version and setting below
 # UPGRADE_UPDATE_FILEMANAGER_CONFIG: Updates only the configuration file if changes are made but now new issue has been issued!
 UPGRADE_UPDATE_FILEMANAGER_CONFIG='false'
 # Set version of File manager to update during upgrade if not already installed
-fm_v='7.9.3'
+fm_v='7.10.1'
 
 # Backblaze
 b2_v='3.10.0'

install/upgrade/versions/1.8.12.sh

@@ -0,0 +1,57 @@
+#!/bin/bash
+
+# Hestia Control Panel upgrade script for target version 1.8.12
+
+#######################################################################################
+#######                      Place additional commands below.                   #######
+#######################################################################################
+####### upgrade_config_set_value only accepts true or false.                    #######
+#######                                                                         #######
+####### Pass through information to the end user in case of a issue or problem  #######
+#######                                                                         #######
+####### Use add_upgrade_message "My message here" to include a message          #######
+####### in the upgrade notification email. Example:                             #######
+#######                                                                         #######
+####### add_upgrade_message "My message here"                                   #######
+#######                                                                         #######
+####### You can use \n within the string to create new lines.                   #######
+#######################################################################################
+
+upgrade_config_set_value 'UPGRADE_UPDATE_WEB_TEMPLATES' 'false'
+upgrade_config_set_value 'UPGRADE_UPDATE_DNS_TEMPLATES' 'false'
+upgrade_config_set_value 'UPGRADE_UPDATE_MAIL_TEMPLATES' 'false'
+upgrade_config_set_value 'UPGRADE_REBUILD_USERS' 'false'
+upgrade_config_set_value 'UPGRADE_UPDATE_FILEMANAGER_CONFIG' 'true'
+
+# Folder paths
+SM_INSTALL_DIR="/var/lib/snappymail"
+SM_CONFIG_DIR="/etc/snappymail"
+SM_LOG="/var/log/snappymail"
+
+if [ -d "/var/lib/snappymail" ]; then
+	chown hestiamail:hestiamail /var/lib/snappymail
+	chown hestiamail:hestiamail /etc/snappymail
+fi
+
+#Roundube folder paths
+RC_INSTALL_DIR="/var/lib/roundcube"
+RC_CONFIG_DIR="/etc/roundcube"
+RC_LOG="/var/log/roundcube"
+
+if [ -d "$RC_INSTALL_DIR" ]; then
+	chown -R hestiamail:www-data "$RC_INSTALL_DIR"
+fi
+if [ -d "$RC_CONFIG_DIR" ]; then
+	chown -R hestiamail:www-data "$RC_CONFIG_DIR"
+fi
+if [ -f "$RC_CONFIG_DIR/config.inc.php" ]; then
+	chmod 640 "$RC_CONFIG_DIR/config.inc.php"
+fi
+if [ -d "$RC_LOG" ]; then
+	chown -R hestiamail:www-data "$RC_LOG"
+fi
+
+sed -i "s/disable_functions =.*/disable_functions = pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority/g" /etc/php/*/cli/php.ini
+
+# Ensures proper permissions for Hestia service interactions.
+/usr/sbin/adduser hestiamail hestia-users

package-lock.json

@@ -1,12 +1,12 @@
 {
 	"name": "hestia",
-	"version": "1.8.9",
+	"version": "1.8.12",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "hestia",
-			"version": "1.8.9",
+			"version": "1.8.12",
 			"hasInstallScript": true,
 			"license": "GPL-3.0-or-later",
 			"dependencies": {

package.json

@@ -1,7 +1,7 @@
 {
 	"name": "hestia",
 	"private": true,
-	"version": "1.8.11",
+	"version": "1.8.12",
 	"description": "An open-source Linux web server control panel.",
 	"repository": "https://github.com/hestiacp/hestiacp",
 	"license": "GPL-3.0-or-later",

src/deb/hestia/control

@@ -1,7 +1,7 @@
 Source: hestia
 Package: hestia
 Priority: optional
-Version: 1.8.11
+Version: 1.8.12
 Section: admin
 Maintainer: HestiaCP <info@hestiacp.com>
 Homepage: https://www.hestiacp.com

test/test.bats

@@ -39,53 +39,6 @@ function setup() {
     source $HESTIA/func/ip.sh
 }
 
-function validate_web_domain() {
-	local user=$1
-	local domain=$2
-	local webproof=$3
-	local webpath=${4}
-
-	refute [ -z "$user" ]
-	refute [ -z "$domain" ]
-	refute [ -z "$webproof" ]
-
-	source $HESTIA/func/ip.sh
-
-	run v-list-web-domain $user $domain
-	assert_success
-
-	USER_DATA=$HESTIA/data/users/$user
-	local domain_ip=$(get_object_value 'web' 'DOMAIN' "$domain" '$IP')
-	SSL=$(get_object_value 'web' 'DOMAIN' "$domain" '$SSL')
-	domain_ip=$(get_real_ip "$domain_ip")
-
-	if [ ! -z $webpath ]; then
-		domain_docroot=$(get_object_value 'web' 'DOMAIN' "$domain" '$CUSTOM_DOCROOT')
-		if [ -n "$domain_docroot" ] && [ -d "$domain_docroot" ]; then
-			assert_file_exist "${domain_docroot}/${webpath}"
-		else
-			assert_file_exist "${HOMEDIR}/${user}/web/${domain}/public_html/${webpath}"
-		fi
-	fi
-
-	# Test HTTP
-	# Curl hates UTF domains so convert them to ascci.
-	domain_idn=$(idn2 $domain)
-	run curl --location --silent --show-error --insecure --resolve "${domain_idn}:80:${domain_ip}" "http://${domain_idn}/${webpath}"
-	assert_success
-	assert_output --partial "$webproof"
-
-	# Test HTTPS
-	if [ "$SSL" = "yes" ]; then
-		run v-list-web-domain-ssl $user $domain
-		assert_success
-
-		run curl --location --silent --show-error --insecure --resolve "${domain_idn}:443:${domain_ip}" "https://${domain_idn}/${webpath}"
-		assert_success
-		assert_output --partial "$webproof"
-	fi
-}
-
 function validate_web_domain() {
     local user=$1
     local domain=$2

web/css/src/themes/default.css

@@ -398,9 +398,7 @@
 			rgb(255 255 255 / 60%) 30%,
 			rgb(255 255 255 / 95%) 95%
 		);
-		box-shadow:
-			inset 0 0 1px #fff,
-			inset -1px -1px 4px rgb(220 220 220 / 40%);
+		box-shadow: inset 0 0 1px #fff, inset -1px -1px 4px rgb(220 220 220 / 40%);
 	}
 
 	&.active {
@@ -778,9 +776,7 @@
 				rgb(190 221 246 / 100%) 51%,
 				rgb(227 240 251 / 100%) 100%
 			);
-			box-shadow:
-				inset 0 0 1px #fff,
-				inset 0 0 6px rgb(255 255 255 / 60%);
+			box-shadow: inset 0 0 1px #fff, inset 0 0 6px rgb(255 255 255 / 60%);
 		}
 
 		&:active,
@@ -794,9 +790,7 @@
 			);
 			color: #046c98;
 			text-shadow: 0 -1px 1px rgb(255 255 255 / 50%);
-			box-shadow:
-				inset 0 0 1px #fff,
-				inset -1px -1px 4px rgb(220 220 220 / 40%);
+			box-shadow: inset 0 0 1px #fff, inset -1px -1px 4px rgb(220 220 220 / 40%);
 		}
 	}
 
@@ -812,9 +806,7 @@
 	border-left: 0;
 	background-color: rgb(255 255 255 / 90%);
 	border-radius: 0 var(--border-radius-base) var(--border-radius-base) 0;
-	box-shadow:
-		inset 0 0 1px rgb(41 90 152 / 10%),
-		inset 0 0 2px rgb(255 255 255 / 100%);
+	box-shadow: inset 0 0 1px rgb(41 90 152 / 10%), inset 0 0 2px rgb(255 255 255 / 100%);
 	text-shadow: 1px 1px rgb(255 255 255 / 90%);
 	color: #069;
 	min-width: 32px;
@@ -935,11 +927,8 @@
 			rgb(247 247 247 / 100%) 0%,
 			rgb(255 255 255 / 100%) 100%
 		);
-		box-shadow:
-			inset 0 1px 1px rgb(255 255 255 / 100%),
-			inset 0 0 1px rgb(255 255 255 / 100%),
-			inset 0 0 4px rgb(255 255 255 / 80%),
-			0 1px 4px rgb(140 140 140 / 35%);
+		box-shadow: inset 0 1px 1px rgb(255 255 255 / 100%), inset 0 0 1px rgb(255 255 255 / 100%),
+			inset 0 0 4px rgb(255 255 255 / 80%), 0 1px 4px rgb(140 140 140 / 35%);
 
 		& .units-table-cell {
 			font-weight: bold;
@@ -1127,9 +1116,7 @@
 		border-radius: 13px;
 		font-weight: 700;
 		font-size: 0.75rem;
-		box-shadow:
-			0 1px 2px rgb(70 70 70 / 50%),
-			inset 0 2px 2px #fff;
+		box-shadow: 0 1px 2px rgb(70 70 70 / 50%), inset 0 2px 2px #fff;
 		color: #6c6c6c;
 		padding-left: 4px;
 		padding-right: 4px;
@@ -1706,9 +1693,7 @@
 	background-color: #f0efef;
 	border: 1px solid rgb(255 255 255 / 98%);
 	border-radius: var(--border-radius-base);
-	box-shadow:
-		inset 0 1px 3px rgb(0 0 0 / 25%),
-		0 8px 40px 0 rgb(0 0 0 / 35%);
+	box-shadow: inset 0 1px 3px rgb(0 0 0 / 25%), 0 8px 40px 0 rgb(0 0 0 / 35%);
 
 	@media (--viewport-small) {
 		min-width: 360px;
@@ -1826,10 +1811,7 @@
 			rgb(223 235 245 / 100%) 100%
 		),
 		#3b9de8;
-	box-shadow:
-		0 1px 3px rgb(0 0 0 / 25%),
-		inset 0 0 1px #fff,
-		inset 0 0 3px rgb(255 255 255 / 50%);
+	box-shadow: 0 1px 3px rgb(0 0 0 / 25%), inset 0 0 1px #fff, inset 0 0 3px rgb(255 255 255 / 50%);
 
 	&:hover {
 		color: #0077c6;
@@ -1841,10 +1823,7 @@
 			rgb(190 221 246 / 100%) 51%,
 			rgb(227 240 251 / 100%) 100%
 		);
-		box-shadow:
-			0 1px 3px rgb(0 0 0 / 25%),
-			inset 0 0 1px #fff,
-			inset 0 0 6px rgb(255 255 255 / 60%);
+		box-shadow: 0 1px 3px rgb(0 0 0 / 25%), inset 0 0 1px #fff, inset 0 0 6px rgb(255 255 255 / 60%);
 	}
 
 	&:active {
@@ -1857,9 +1836,7 @@
 			rgb(162 207 244 / 100%) 51%,
 			rgb(210 232 250 / 100%) 100%
 		);
-		box-shadow:
-			0 1px 2px rgb(0 0 0 / 20%),
-			inset 0 0 1px #fff,
+		box-shadow: 0 1px 2px rgb(0 0 0 / 20%), inset 0 0 1px #fff,
 			inset -1px -1px 4px rgb(220 220 220 / 40%);
 	}
 
@@ -1890,9 +1867,7 @@
 	&:active {
 		background: linear-gradient(to bottom, #fcd0ca 0%, #f5a69d 50%, #f9e3df 100%);
 		color: #ce1500;
-		text-shadow:
-			0 1px 1px rgb(255 255 255 / 20%),
-			0 -1px 1px rgb(255 255 255 / 60%);
+		text-shadow: 0 1px 1px rgb(255 255 255 / 20%), 0 -1px 1px rgb(255 255 255 / 60%);
 		border-color: #f4301a;
 	}
 }
@@ -2052,9 +2027,7 @@
 	background: linear-gradient(to bottom, rgb(247 247 247 / 100%) 0%, rgb(255 255 255 / 100%) 100%);
 	border: 1px solid #ddd;
 	text-shadow: 0 1px rgb(255 255 255 / 95%);
-	box-shadow:
-		inset 0 0 1px rgb(255 255 255 / 100%),
-		inset 0 0 4px rgb(255 255 255 / 80%),
+	box-shadow: inset 0 0 1px rgb(255 255 255 / 100%), inset 0 0 4px rgb(255 255 255 / 80%),
 		0 4px 6px rgb(190 190 190 / 40%);
 	font-weight: 600;
 	color: var(--color-text-link);
@@ -2127,9 +2100,7 @@
 	@media (--viewport-small) {
 		border-radius: 6px;
 		background-color: rgb(255 255 255 / 70%);
-		box-shadow:
-			0 8px 25px rgb(0 0 0 / 30%),
-			inset 0 0 2px rgb(255 255 255 / 100%);
+		box-shadow: 0 8px 25px rgb(0 0 0 / 30%), inset 0 0 2px rgb(255 255 255 / 100%);
 		padding: 70px 50px;
 		max-width: 370px;