Release notes for HestiaCP v1.2.0

Release date: Jul 08 2020

490 Commits since v1.1.1 github

NOTE: Debian 8 is no longer supported as it has reached EOL (end-of-life) status.

Features

  • Added support for Ubuntu Server 20.04 LTS.
  • Added File Manager functionality (with File Gator backend) with the ability to add or remove at any time (v-add-sys-filemanager and v-delete-sys-filemanager)
  • Extended built-in firewall to support allowing or blocking traffic using IP lists.
  • Improved Apache2 performance by switching to mpm_event instead mod_prefork by default for new installations.
  • Added support for configuring individual TTL per DNS record. Thanks to @jaapmarcus!
  • Updated translations for Polish (thanks to @RejectPL!), Dutch, French, German, and Italian (WIP).
  • Added the ability to set the default PHP command line version per-user.
  • Added geolocation support to awstats to improve traffic reports.
  • Enabled Roundcube plugins newmail_notifier and zipdownload by default.
  • Added HELO support for multiple domains and IPs.
  • Added the ability to manage SSH keys from CLI and web interface.
  • Added a manual migration script for apache2 mpm_event for existing installations/upgrades ($HESTIA/install/upgrade/manual/migrate_mpm_event.sh).
  • Added BATS system for testing the functionality of Bash scripts (WIP).
  • Added v-change-sys-db-alias to change phpMyAdmin and phpPgAdmin access points (v-change-sys-db-alias pma/pga myCustomURL).

Bugfixes

  • Prevent ability to change the password of a non-Hestia user account. Thanks to Alexandre Zanni!
  • Adjust Let's Encrypt validation check for IDN domains, thanks to @zanami!
  • Set backup download location on FTP/SFTP restore, thanks to @Daniyal-Javani!
  • Stop trying to renew Let's Encrypt certificates after multiple consecutive failed attempts. Thanks to @dpeca!
  • Fixed an issue with auto-logout when used behind Cloudflare proxy and reworked 2FA authentication part. Thanks to @rmj-s!
  • Fixed an issue where changing an email account password would fail if similar account names were present.
  • Fixed an issue where e-mail quota was not preserved when (un)suspending or rebuilding a mail account.
  • Fixed an issue where SSH configuration was not saved currently when edited from the Web interface.
  • Fixed an issue where DNS IP did not use NAT/Public IP when available after changing web domain IP.
  • Fixed an issue that would occur when a user would attempt to recover their account when two-factor authentication is enabled.
  • Fixed permission issues that were presented when restoring a user backup.
  • Improved page load performance of Control Panel web interface.
  • Use Sury.org repository for Apache2 packages.
  • Improved compatibility with Roundcube and PHP 7.4.
  • Restrict the ability to edit crontab service via Control Panel web interface.
  • Check whether Nginx, Apache2 and MariaDB are selected for installation prior to adding third party repositories.
  • Restrict public access to Apache2 server-status page.
  • Remove duplicated set-cookie line in default fpm config.
  • Ignore empty lines when listing firewall rules.
  • Improved top-level navigation in the Control Panel web interface (Server tab has been moved next to the Notification icon).
  • Corrected various minor user interface and theme issues.
  • Cleanup temporary files when uploading custom SSL certificate from Web interface.
  • Cleanup temporary files when adding/renewing Let's Encrypt SSL certificate.
  • Cleanup temporary files after running v-list-sys-services.
  • Removed some legacy code and unused assets.
  • Don't calculate /home folder size in v-list-sys-info.
  • Adjust v-list-sys-services to honor the changed fail2ban service name.
  • Rework busy port validation in v-change-sys-port.
  • Implement a validation function to verify the correct version in hestia.conf prior to installation.
  • Introduced a delay when an incorrect username, password, or 2FA code has been entered repeatedly.
  • Improved "Forgot password" function prevent brute force attacks.
  • Fixed an issue where the backup update counter was not updated properly when v-delete-user-backup was executed.
  • Fixed an issue with public_(s)html file ownership.
  • Fixed an issue with phpPgAdmin access.
  • Fixed an issue where the wrong port was set for www.conf on certain configurations.
  • Fixed an issue where Composer would fail to install.
  • Fixed an issue where the selected theme was not immediately applied.
  • Fixed an issue where HTTP-to-HTTPS redirection and HTTP Strict Transport Security (HSTS) events were not shown in the user history log.
  • Fixed an issue where the web domain access log page was incorrectly formatted.
  • Fixed an issue where awstats would show a HostAliases error if a web domain did not have any aliases.
  • Fixed an issue where awstats configuration was not updated if web domain aliases were added or removed.
  • Fixed an issue where user interface elements would overlap or display in the wrong place when using non-English locales.
  • Fixed an issue where phpMyAdmin and phpPgAdmin were inaccessible from the Web UI if custom URLs had been set.
  • Fixed an issue where mail SSL certificates were not restored properly from a backup archive.
  • Fixed an issue where mail domain configuration files were not removed when the domain was deleted.
  • Improved the functionality of v-change-domain-owner to correctly move mail domains and provide status output and logging/notifications.
  • Improved the functionality of v-update-sys-hestia-git to allow user to specify GitHub repository and whether to build only core package or core and dependencies.
  • Corrected the behavior of phpMyAdmin and phpPgAdmin so that alias dialogs accept custom word only and not full URL, aligns with webmail alias behavior.
  • Corrected the behavior of the installer so that APT repositories are not added if installation is aborted due to version mismatch.
  • Fixed an issue where upgrade procedures were not executed correctly when skipping between versions (e.g. 1.0.6 > 1.2.0).

Known issues and notes

  • NOTE: Custom phpMyAdmin and phpPgAdmin URL's will be reset once during this upgrade to correct a legacy code issue.
  • Let's Encrypt renewal fails when removing alias from web domain (#856)
  • Some translation strings need to be updated for accuracy (#746)
  • v-restore-user only works with backup archives stored in /backup mount point (#641)