2.1.24

Added​

• Mail an account can actually control: forward a mailbox, refuse or always accept a sender, move the spam threshold, turn greylisting off for one domain, and see which mailbox is filling the disk.
• Undo Send, and scheduled sending — held by the server, so a scheduled message survives a restart and closing the tab does not send it early.
• PGP: sign, encrypt, decrypt and verify, beside the S/MIME that was already here.
• Calendars and address books can be created, renamed, deleted and lent to another mailbox on the same account, from a phone as well as from webmail.
• A backup SMTP route, for a server whose provider blocks port 25 or whose address has no sending reputation.
• PHP X-Ray: what each PHP worker is doing right now, and what has been slow.
• Hotlink protection, so other people's pages stop serving their images off your bandwidth.
• WP Helper, installed and activated with every WordPress this panel creates.
• Attachments from OneDrive and Dropbox.
• Two plan limits — group addresses, and the largest single message — and the eight Email Pro tiers that use them.

Fixed​

• No mailbox on a native server could sign in with its own password. Anywhere.
• CalDAV and CardDAV answered 401 for every mailbox.
• The blocked-sender list accepted every sender it was supposed to refuse.
• Default Address reported that a domain with a catch-all had none.
• Enabling a DNS cluster failed on a file RHEL has never had.
• An encrypted message's plaintext was being written to the database.
• A blind copy could have been disclosed to every recipient of a PGP message.

Notes​

The password bug is the one to read twice. postfix-accounts.cf is email|hash|uid, and the sync read it with two variables — so every hash it wrote carried the uid on the end and matched nothing. IMAP, POP3, the webmail's own sign-in form, phones, CalDAV: none of them worked with a customer's own password. It went unnoticed because the webmail is normally entered through the panel's single sign-on, which authenticates as Dovecot's master user against a different file entirely. The one path anybody exercised was the one path that did not use these hashes. Updating repairs it.

The blocked-sender bug has the same shape. The lookup sat after Dovecot's quota check, which answers OK for a mailbox under its quota — a final verdict that ends the restriction list. The maps were right, the page listed the block, and the mail arrived. It was found by sending a message from a blocked address and watching it get a 250.

Three things in this release are deliberately narrower than they might look, and each says so where you meet it. A backup SMTP password is written into Postfix's own credentials file and cannot be read back — not by this panel, not by anyone — so saving these settings asks for it again every time. A plan's message-size limit is enforced in webmail; Postfix's own limit is one number for the whole machine, so a customer sending through Outlook is bounded by that instead. And a PGP subject line is not encrypted, because PGP/MIME does not encrypt one.

Hotlink protection allows a request that sends no referer at all, and allows the search engines and social networks without being asked. Both are deliberate: opening an image directly, most feed readers, many privacy settings and a good number of company networks send no referer, and those are visitors rather than thieves — while a rule that blocks Google takes your own thumbnails out of search results and out of every link anybody shares.

The eight Email Pro plans are not created for you. hitechcloudcli plan-emailpro add creates them when you want them, and leaves alone any name you have already used.