Historique des mises à jour
Toutes les versions publiées de Hoster et leur contenu.
-
v1.12.34 Dernière version
- Sécurité Security: the panels' PHP pools are hardened (disk access limited to their own code, sessions, journals and staging directory; system execution functions disabled; strict sessions). The panels' PHP error logs are now actually written
-
v1.12.33
- Sécurité Security: each panel (admin, customer, API) can now only run as root the commands it actually calls; the customer account no longer has access to the server administration commands (users, firewall, packages, updates...)
-
v1.12.32
- Sécurité Security: each panel (admin, customer, API) now runs as its own system account (hoster-admin, hoster-user, hoster-api), with its own sessions, auth journal and file staging directory; www-data no longer has sudo access
- Nouveau The update migrates servers that are already installed automatically; active sessions have to log in again
-
v1.12.31
- Correctif Fix: deleting a PHP runtime is refused when it is the system PHP version, because the panels, the API and phpMyAdmin run on it
-
v1.12.30
- Sécurité Security: the database and admin passwords given to Git deploy and one-click install scripts are no longer visible in the process list
-
v1.12.29
- Sécurité Security: Git deploy now refuses local or internal-address repositories (loopback, cloud metadata) and only accepts the https and ssh protocols, even if the site's repository origin is edited
-
v1.12.28
- Sécurité Security: passwords, API tokens, webhook signatures and TOTP secrets are no longer passed on the command line (no longer visible in the process list)
-
v1.12.27
- Sécurité Security: the update now also protects servers that are already installed (hoster.conf restricted to root, nginx no longer follows site symlinks)
- Sécurité Security: symlinks are refused in the trash, SSH keys, site logs, ClamAV quarantine and folder compression
- Sécurité Security: proxy headers (CF-Connecting-IP, X-Forwarded-For) are only trusted from proxies listed in config/trusted-proxies
- Sécurité Security: outgoing webhooks refuse local addresses and cloud metadata endpoints
- Nouveau Installer: passwords generated by generate_password, MongoDB and openssl errors are now visible
-
v1.12.26
- Sécurité Security: the entrypoint, document path, git repository and branch, and remote backup destination are now validated
- Sécurité Security: trash ids are validated, nginx no longer follows symlinks out of a site, hoster.conf is no longer readable by the pools
- Sécurité Security: auto-login actions are no longer reachable with an API token
-
v1.12.25
- Nouveau List action columns are now a single "Actions" button with a dropdown menu (clear labels, delete at the bottom, confirmations kept) instead of rows of icons.
- Nouveau Screens that showed two tables (antivirus, customer-side Basic auth) now use tabs; the open tab is kept in the address.
- Nouveau Default SSH login banner: product name in ASCII art, "By DebPanel", description, DebPanel site and email. Installed only when the server banner is empty or Debian's stock text: an edited banner is never overwritten.