3.9.6

Five panel themes, WebEngine installs that say why they failed, and a round of security fixes. Update.

Security​

• Another account's website could be detached through the API. The sites bulk API checked ownership on the posted site name but detached by the posted id. The row is now looked up by id and ownership is checked on its own name.
• Another account's WordPress hardening could be rewritten. The WordPress security endpoint had no ownership check. It now checks first.
• "Mark safe" in the malware quarantine followed symbolic links while running as root, so a file planted in .quarantine could hand an account ownership of a system file. Paths are resolved and checked, ownership is changed without following links, and the weekly quarantine got the same fix.
• A file-manager delete with an empty name or . emptied the whole home directory. It is refused.

WebEngines and the App Store​

• Caddy installs no longer end in a bare exit 1. Caddy comes from its own repository, then from the operating system's package, then from the official release binary pinned by checksum. A repository that cannot be reached no longer leaves a broken apt source behind.
• OpenResty says where it cannot be installed. Packages exist for AlmaLinux/Rocky/RHEL 8 and 9, Debian 11 and 12 and Ubuntu 22.04 and 24.04; on anything else (AlmaLinux 10, Debian 13, ...) the App Store and the WebEngine page say "not available on this server" instead of offering an Install that can only fail.
• A failed install shows its reason, taken from the installer's own error line, and a task that has been silent for ten minutes says it may be waiting on a package-manager lock and how to look.
• Package installs wait up to five minutes for the dpkg lock (a fresh server running its first unattended upgrade) instead of failing at once.

Themes​

• Five themes in the customer panel and the admin: Default (the panel's own look), cPanel style, DirectAdmin style, Plesk style and HiTechCloud. Flat colours only; light and dark mode for each.
• Administrators decide in Settings > HiTechCloud Panel > Themes: the default theme for customers, whether customers may choose, and which themes they may choose. The choice is applied on the server, so pages never flash.
• The open sidebar reserves its own width in both panels, so nothing (the area tab strip, notifications) slides under it any more.

Admin​

• Domains shows whether each site answers only Cloudflare, with a switch.
• WAF rules sets the action threshold, lets a rule through on one website (or one path of it), and lists every exception with a button to undo it.

Sentinel, updates and scheduled jobs​

• The high swap usage alert, and the swap cleanup with it, no longer repeat several times an hour.
• A lock or timestamp dated in the future (taken while the clock was ahead) no longer makes Sentinel skip its checks.
• Repair no longer removes the lock of an update that is running.
• Jobs that a systemd timer runs are no longer also run from cron, and a job you commented out in the scheduled jobs stays off after an update.
• The weekly malware sweep runs again on servers without its timer.

WordPress and scanning​

• The vulnerability scan checks plugins at their own version (WooCommerce was checked at the version of a library it bundles), and an advisory service that fails no longer reads as "no vulnerabilities" or deletes the previous result.
• WordPress hardening rules are applied once each; an empty set removes the file instead of writing an empty one.

Webmail​

• Updated to the 3.8.0 webmail base: backup and restore from Settings, automatic Cc and Bcc per account, attachment preview (including password-protected PDFs), fixes to failed logins behind a reverse proxy and to a message that could freeze the server.