2.1.21

Fixed​

• The webmail greeted customers as MailFlow however the operator had branded it, and could not read its own brand at all.
• A reseller's logo reached none of their customers, and an account's owner could never be changed.
• Rspamd could not be switched on at all on AlmaLinux; ClamAV was installed, enabled, and had never once run.
• A permission granted to a single user reached them up to a day later, or never.
• Adding a DNS zone before the website made the domain impossible to create.
• The document root of a website could not be changed on this stack, and the rule it enforced was about the wrong thing.
• A reseller's logo could grow the sidebar until the navigation left the page.

Added​

• Contacts over CardDAV: your address book on a phone or in a desktop mail client, with nothing to install.
• The certificate behind an S/MIME signature, with the fingerprint that tells two of them apart.
• hitechcloudcli native-user owner moves an account to a reseller, or back.

Notes​

Most of this release is the same shape of bug, found in six places: something reported success while doing nothing.

The webmail read the panel's configuration file to learn its brand. That file holds database credentials, so its directory is 0750 root:root, and the webmail runs as its own unprivileged user — every read failed, every failure fell back to the default name, and a permission error was indistinguishable from a brand nobody had set. The panel now publishes the name, the logo and each reseller's own to a file the webmail may read.

Turning on Rspamd answered "not installed on this server", permanently, on every RHEL-family machine — it is in no RHEL repository. The switch now installs it. ClamAV was worse: installed, enabled, and dead. RHEL ships its configuration with every line commented out, so the daemon starts, says "Please define server type", exits, and restart-loops until systemd gives up, while the installer reported "ClamAV ready" regardless. It now writes a socket and asks the running daemon before saying anything.

An account's owner decides whose brand its panel wears. It was set once, at creation, and nothing could change it afterwards — so an account made before its reseller existed belonged to the administrator forever, and the reseller's logo was a setting with no effect on the very customers it was set for.

Changing a website's document root required a path starting with /var/www/html/, which is the container layout and does not exist here. It was also the wrong check: that path is identical inside every account's container, so requiring it said nothing about whose files these are. The rule is now that the folder is inside the account's own home.