d00p

nutz halt nicht das apt-paket/akltualisiere es nicht. https://docs.froxlor.org/latest/general/update-guide.html#_2-1-update-via-webinterface https://docs.froxlor.org/latest/general/update-guide.html#_2-2-update-via-cli https://docs.froxlor.org/latest/general/update-guide.html#_2-3-manual-update

wenn du das apt-paket nutzt ist das gewollt ja, da /var/www/html/ seit ewigkeiten default webroot unter debian/ubuntu ist

ist doch schon ewig erledigt dieser thread ...

Bugfix release 2.3.13 [Security] fix TLS private key disclosure via Certificates.get/listing API More information: https://github.com/froxlor/froxlor/security/advisories/GHSA-6q2v-jjq5-m2c8 [Cron] fix getWebroot() regressions in Apache/Nginx vhost generation The security-advisory were published on 6th of September.

Security release 2.3.11 / 2.3.12 [Security] fix a 2FA "remember this device" bypass caused by admin/customer ID namespace confusion More information: https://github.com/froxlor/froxlor/security/advisories/GHSA-9fq7-9w8p-c3qh [Security] no longer expose a domain's DKIM private key in Domains/SubDomains API responses More information: https://github.com/froxlor/froxlor/security/advisories/GHSA-79gx-h528-j9xf [Security] invalidate existing sessions and remembered 2FA tokens on password change; hint at API-key rotation More information: https://github.com/froxlor/froxlor/security/advisories/GHSA-57wv-g7m3-hmff [Security] require POST (and therefore CSRF-token validation) to disable 2FA, closing a GET-based cross-site 2FA removal More information: https://github.com/froxlor/froxlor/security/advisories/GHSA-w582-7wqv-62mm [Security] narrow a TOCTOU race in the SSH-key sync cron that re-resolved the authorized_keys path at write time More information: https://github.com/froxlor/froxlor/security/advisories/GHSA-927x-9jfh-mq42 [Security] fix argument-injection into acme.sh via the unescaped Let's Encrypt challenge-path setting More information: https://github.com/froxlor/froxlor/security/advisories/GHSA-3w4g-cmpj-rj42 [Security] re-validate ftp- and email-paths against the customer's directory boundary before deleting files in cron More information: https://github.com/froxlor/froxlor/security/advisories/GHSA-px4q-2rf7-cvcf [Security] fix symlink validation bypass in FileDir::makeCorrectDir(), used by the DataDump export cron; also resolve relative '..' segments in symlink targets before the homedir-prefix check More information: https://github.com/froxlor/froxlor/security/advisories/GHSA-2wjc-6mgx-hq42 [Security] validateUrl() now also checks the URL's userinfo (user/pass) component for CR/LF, and rejects raw control characters before parse_url() can mask them, closing a CRLF-injection bypass More information: https://github.com/froxlor/froxlor/security/advisories/GHSA-gxx3-hwjc-h2gp [Security] improve validation of external sender domains in the EmailSender API More information: https://github.com/froxlor/froxlor/security/advisories/GHSA-m9j6-9856-68xf [Security] no longer expose the password hash in the directory-protection API response More information: https://github.com/froxlor/froxlor/security/advisories/GHSA-8wfc-9qp5-gjxf [Security] reject multi-line SSH public keys to prevent authorized_keys line-injection via comment folding More information: https://github.com/froxlor/froxlor/security/advisories/GHSA-p3v3-74gc-jh5f [Security] sanitize the certificate issuer value before display More information: https://github.com/froxlor/froxlor/security/advisories/GHSA-89vj-gqqr-73p8 [Security] no longer expose a customer's Let's Encrypt account private key in Customers API responses [Security] fix an out-of-range CIDR netmask that could bypass an API-key's allowed_from IP restriction; anchor SQL-interval validation [Security] re-validate documentroot, directory-protection paths and ftp-homedir at write-time in the vhost-generation cron; fix an overly permissive REGEX_DIR pattern used across several path-validation checks [PHP] fix PHP 8.4 "implicitly nullable parameter" deprecation warnings (PHP 7.4 compatibility preserved) [Domains] fix duplicated documentroot-prefix in SubDomains.update(), fixes #1415 [FileDir] fix false-positive rejection of legacy double-slash homedirs in FileDir::makeCorrectFile(), fixes #1416 The security-advisories were published on 6th of September.

the opcache overview chown in froxlor does only reflect the php-version used by froxlor (depending on php-fpm config assigned to froxlor-hostname, most likeley 'Froxlor Vhost Config' and does not necessarily show usage of other installed/used php-fpm versions.

intended, /dev/ is not allowed to be specified. Also consider switching to php-fpm, fcgid is pretty old

Hab ich gesehen, ganz lieben Dank

sichere deine lib/userdata.inc.php lade die letzte 2.0er version (https://files.froxlor.org/releases/froxlor-2.0.24.tar.gz) schiebe dein aktuelles /var/www/html/froxlor beiseite, z.B. /var/www/html/froxlor-2.3 entpacke die 2.0.24 nach /var/www/html/froxlor schiebe deine userdata.inc.php wieder nach lib/ in dem ordner mache die updates switch dann deinen /var/www/html/froxlor-2.3 wieder zu /var/www/html/froxlor (den anderen kannst du optional als backup umbenennen) mach wieder alle updates und nein, lösche bitte auf keinen fall manuell irgendwelche tabellen

Doch die guides sind hilfreich wenn du sie auch liest, siehe https://docs.froxlor.org/latest/general/migration-guide/2.2.html - da ist MINDESTANFORDERUNG froxlor-2.0 und höher. Du kannst nicht von 0.10.x auf 2.3 direkt - die update files sind nicht mehr dabei, das zeug ist JAHRE alt

https://docs.froxlor.org/latest/general/migration-guide/2.0.html bzw. dann für alle weiteren versionen: https://docs.froxlor.org/latest/general/migration-guide/

das kommt von deiner mysql/mariadb config...ich hab seit jahr und tag mit den defaults nie probleme. Möglicherweise haben hier vllt neuere mariadb/mysql versionen neue policies oder so. Denke auch nicht das es an den fehlenden Sonderzeichen, sondern viel mehr an den kurzen 8 Zeichen liegt

it's currently not possible to completely disable statistics as they are used to fill the traffic info

Too early to say - but be assured that we will of course take upgrading into account as always

not in the near future