4.3.0

4.3.0 follows 4.2.0 and ships early for a security fix: the WebP/AVIF image cache no longer converts customers' images as root. 2087 can now list and revoke a customer's passkeys. The S3 portal copies and moves files larger than 5 GiB, deletes folders of any size and restores earlier versions of a file, and the DNS portal checks a zone's delegation and no longer offers ALIAS records.

Security​

• Images are no longer converted as root. Before 4.3 the converting image cache (WebP/AVIF) ran its image encoders as root on files in customers' websites. Images are now converted only as the website's own user, in a restricted, resource-limited service in the account's resource slice. Root only copies results into the cache after checking each one, symlinks in the website folder are never followed, and ImageMagick is no longer used. Existing sites keep working with no action; the update installs cwebp/avifenc where a site needs them. (hitechcloudcli#494, HiTechCloud-Panel#1833)

Upgrade notes and behaviour changes​

• The image cache no longer uses ImageMagick. WebP needs cwebp and AVIF needs avifenc. For the websites that have the image cache on, the update installs a missing encoder (webp and libavif-bin on Ubuntu and Debian, libwebp-tools and libavif-tools on AlmaLinux, where libavif-tools comes only from EPEL). If that fails, the update warns and goes on; those sites keep serving their originals and every copy already made. (hitechcloudcli#494)
• Image conversions run through systemd-run as the website's user. On a server without systemd nothing is converted; there is no fallback to root. (hitechcloudcli#494)

Added​

• 2087: a customer's passkeys. The account page has a Passkeys card listing the customer's passkeys (name, added, last used), with Revoke and Revoke all for the Super Admin or the account's reseller; each revoke is recorded in the account's activity log and the customer is notified. (hitechcloudcli#493, hitechcloudadmin#334)
• S3 portal: files larger than 5 GiB can be copied and moved; the provider copies them in parts on its side. Copy and move now show progress and a Stop button. (HiTechCloud-Panel#1830)
• S3 portal: restore an earlier version of a file on buckets with versioning; the restored version becomes the latest and the history is kept. (HiTechCloud-Panel#1830)
• DNS portal: Verify nameservers checks the delegation at the registry against the zone's NS records and says clearly whether they match, partly match, point elsewhere or are missing. (HiTechCloud-Panel#1831)
• 2083: the Image Cache page. Websites > Settings > Image Cache now has a menu link. The page says how a conversion runs (as the account's own user, within its resource limits, at the lowest priority, at most 2000 images per run). When the server has no AVIF encoder, AVIF is disabled with the reason beside it, and turning the cache on starts the first conversion as the account's background task instead of inside the page request. (HiTechCloud-Panel#1833)

Fixed​

• S3 portal: deleting a folder no longer stops at 5000 objects; folders of any size are deleted in batches of 1000, with progress and a Stop button. (HiTechCloud-Panel#1830)
• DNS portal: no longer offers ALIAS records, which the server's DNS (BIND 9) cannot serve; a CNAME at the zone apex now points to A and AAAA records instead. (HiTechCloud-Panel#1832)

Known limitations​

• The SELinux module for the cache flush service has not been tested on a host with SELinux enforcing; it was checked offline against the AlmaLinux 9 policy. If it does not load, a WordPress site's flush behaves as in 4.1.6.
• Greylisting stays off on Ubuntu 22.04 and Debian 12 when the cache is secured, as their rspamd cannot sign in with a username (see 4.1.4).