d00p

nutz halt nicht das apt-paket/akltualisiere es nicht. https://docs.froxlor.org/latest/general/update-guide.html#_2-1-update-via-webinterface https://docs.froxlor.org/latest/general/update-guide.html#_2-2-update-via-cli https://docs.froxlor.org/latest/general/update-guide.html#_2-3-manual-update

wenn du das apt-paket nutzt ist das gewollt ja, da /var/www/html/ seit ewigkeiten default webroot unter debian/ubuntu ist

ist doch schon ewig erledigt dieser thread ...

Bugfix release 2.3.13 [Security] fix TLS private key disclosure via Certificates.get/listing API More information: https://github.com/froxlor/froxlor/security/advisories/GHSA-6q2v-jjq5-m2c8 [Cron] fix getWebroot() regressions in Apache/Nginx vhost generation The security-advisory were published on 6th of September.

Security release 2.3.11 / 2.3.12 [Security] fix a 2FA "remember this device" bypass caused by admin/customer ID namespace confusion More information: https://github.com/froxlor/froxlor/security/advisories/GHSA-9fq7-9w8p-c3qh [Security] no longer expose a domain's DKIM private key in Domains/SubDomains API responses More information: https://github.com/froxlor/froxlor/security/advisories/GHSA-79gx-h528-j9xf [Security] invalidate existing sessions and remembered 2FA tokens on password change; hint at API-key rotation More information: https://github.com/froxlor/froxlor/security/advisories/GHSA-57wv-g7m3-hmff [Security] require POST (and therefore CSRF-token validation) to disable 2FA, closing a GET-based cross-site 2FA removal More information: https://github.com/froxlor/froxlor/security/advisories/GHSA-w582-7wqv-62mm [Security] narrow a TOCTOU race in the SSH-key sync cron that re-resolved the authorized_keys path at write time More information: https://github.com/froxlor/froxlor/security/advisories/GHSA-927x-9jfh-mq42 [Security] fix argument-injection into acme.sh via the unescaped Let's Encrypt challenge-path setting More information: https://github.com/froxlor/froxlor/security/advisories/GHSA-3w4g-cmpj-rj42 [Security] re-validate ftp- and email-paths against the customer's directory boundary before deleting files in cron More information: https://github.com/froxlor/froxlor/security/advisories/GHSA-px4q-2rf7-cvcf [Security] fix symlink validation bypass in FileDir::makeCorrectDir(), used by the DataDump export cron; also resolve relative '..' segments in symlink targets before the homedir-prefix check More information: https://github.com/froxlor/froxlor/security/advisories/GHSA-2wjc-6mgx-hq42 [Security] validateUrl() now also checks the URL's userinfo (user/pass) component for CR/LF, and rejects raw control characters before parse_url() can mask them, closing a CRLF-injection bypass More information: https://github.com/froxlor/froxlor/security/advisories/GHSA-gxx3-hwjc-h2gp [Security] improve validation of external sender domains in the EmailSender API More information: https://github.com/froxlor/froxlor/security/advisories/GHSA-m9j6-9856-68xf [Security] no longer expose the password hash in the directory-protection API response More information: https://github.com/froxlor/froxlor/security/advisories/GHSA-8wfc-9qp5-gjxf [Security] reject multi-line SSH public keys to prevent authorized_keys line-injection via comment folding More information: https://github.com/froxlor/froxlor/security/advisories/GHSA-p3v3-74gc-jh5f [Security] sanitize the certificate issuer value before display More information: https://github.com/froxlor/froxlor/security/advisories/GHSA-89vj-gqqr-73p8 [Security] no longer expose a customer's Let's Encrypt account private key in Customers API responses [Security] fix an out-of-range CIDR netmask that could bypass an API-key's allowed_from IP restriction; anchor SQL-interval validation [Security] re-validate documentroot, directory-protection paths and ftp-homedir at write-time in the vhost-generation cron; fix an overly permissive REGEX_DIR pattern used across several path-validation checks [PHP] fix PHP 8.4 "implicitly nullable parameter" deprecation warnings (PHP 7.4 compatibility preserved) [Domains] fix duplicated documentroot-prefix in SubDomains.update(), fixes #1415 [FileDir] fix false-positive rejection of legacy double-slash homedirs in FileDir::makeCorrectFile(), fixes #1416 The security-advisories were published on 6th of September.

the opcache overview chown in froxlor does only reflect the php-version used by froxlor (depending on php-fpm config assigned to froxlor-hostname, most likeley 'Froxlor Vhost Config' and does not necessarily show usage of other installed/used php-fpm versions.

intended, /dev/ is not allowed to be specified. Also consider switching to php-fpm, fcgid is pretty old

Hab ich gesehen, ganz lieben Dank

sichere deine lib/userdata.inc.php lade die letzte 2.0er version (https://files.froxlor.org/releases/froxlor-2.0.24.tar.gz) schiebe dein aktuelles /var/www/html/froxlor beiseite, z.B. /var/www/html/froxlor-2.3 entpacke die 2.0.24 nach /var/www/html/froxlor schiebe deine userdata.inc.php wieder nach lib/ in dem ordner mache die updates switch dann deinen /var/www/html/froxlor-2.3 wieder zu /var/www/html/froxlor (den anderen kannst du optional als backup umbenennen) mach wieder alle updates und nein, lösche bitte auf keinen fall manuell irgendwelche tabellen

Doch die guides sind hilfreich wenn du sie auch liest, siehe https://docs.froxlor.org/latest/general/migration-guide/2.2.html - da ist MINDESTANFORDERUNG froxlor-2.0 und höher. Du kannst nicht von 0.10.x auf 2.3 direkt - die update files sind nicht mehr dabei, das zeug ist JAHRE alt

https://docs.froxlor.org/latest/general/migration-guide/2.0.html bzw. dann für alle weiteren versionen: https://docs.froxlor.org/latest/general/migration-guide/

das kommt von deiner mysql/mariadb config...ich hab seit jahr und tag mit den defaults nie probleme. Möglicherweise haben hier vllt neuere mariadb/mysql versionen neue policies oder so. Denke auch nicht das es an den fehlenden Sonderzeichen, sondern viel mehr an den kurzen 8 Zeichen liegt

it's currently not possible to completely disable statistics as they are used to fill the traffic info

Too early to say - but be assured that we will of course take upgrading into account as always

not in the near future

naja, da "geplant" kein 2.3.x release mehr kommt kannst du natürlich für deinen fall da auch deinen fix rein-patchen, keine garantie natürlich

vermutlich sollte froxlor da hier auf "nummer sicher gehen" und das explizit setzen, beachte allerdings https://forum.froxlor.org/index.php?/topic/21240-froxlor-development-update-looking-ahead/

Hm, gestern erst bei nem kunden eingerichtet, da gabs null probleme mit dem verzeichnisschutz via froxlor... root@data01:~# ls -la /etc/apache2/froxlor-htpasswd/ total 12 drwxr-x--x 2 root root 108 Jun 10 06:05 . drwxr-xr-x 9 root root 4096 Feb 6 12:57 .. -rw-r--r-- 1 root root 70 Jun 10 06:05 1-b47d7fd9600f708966f7ceb5f1f0bf81.htpasswd -rw-r--r-- 1 root root 65 Jun 10 06:05 2-1f63ad5a0c24c416f9a98710981de4d1.htpasswdganz normal so wie es seit jahren problemlos funktioniert (gibt ja für jeden kunden auch std.mäßig den verzeichnisschutz auf die statistiken)

Dear froxlor community, today we'd like to share some thoughts about the current state of froxlor development and where we see the project heading in the future. Many of you know that froxlor has been an open-source project for a very long time. Some of us have been maintaining and developing it for well over a decade, through countless releases, feature additions, bug fixes and architectural changes. Over the years, one thing has always driven us: building something useful while actually enjoying the process. Recently, however, the nature of project maintenance has changed significantly. Like many other open-source projects, we are receiving an increasing number of security reports generated or heavily assisted by AI tools. While some of these reports identify legitimate issues and are absolutely appreciated, a large portion require extensive manual investigation before we can even determine whether a vulnerability actually exists. The result is that an ever-growing amount of development time is spent reviewing, reproducing, verifying and responding to reports instead of improving the software itself. As the froxlor development team currently consists of only two active developers, this has become a serious challenge. We want to be very clear: Security remains important and we will continue to investigate and fix legitimate issues. At the same time, we also need to ensure that project maintenance does not completely consume the time and energy required for actual development. For this reason, we have decided to gradually shift our focus: The current 2.x branch will enter a maintenance-oriented phase. Critical bugs and important security issues will continue to be addressed, but development on the 2.x series will be kept to an absolute minimum. Our primary goal moving forward is to focus our efforts on the next major generation of froxlor: version 3.0. We believe that investing our limited time into a modernized architecture, long-term maintainability and future improvements will ultimately benefit the project and the community far more than endlessly extending the lifecycle of the current branch. froxlor exists because of its users, contributors and supporters, and we are incredibly grateful for everyone who has helped the project grow over the years. Thank you for your understanding, your feedback and your continued support. Let's build the next chapter together. — The froxlor Team

Security release 2.3.8 / 2.3.9 / 2.3.10 [Security] add csrf-token validation in ajax-actions More information: https://github.com/froxlor/froxlor/security/advisories/GHSA-xpr4-8vp6-c87j [Security] enhance validation of redirect-URLs for (sub)domains More information: https://github.com/froxlor/froxlor/security/advisories/GHSA-c3p2-mj7v-5mrc [Security] verify numeric values for ipaddress-id's More information: https://github.com/froxlor/froxlor/security/advisories/GHSA-w27m-rmmf-g5w4 [Security] escape allowed special-characters in dns TXT content in frontend More information: https://github.com/froxlor/froxlor/security/advisories/GHSA-43gm-9rr3-cx7g [Security] secure record/label and type in dns-editor More information: https://github.com/froxlor/froxlor/security/advisories/GHSA-5rw4-4665-cvwf [Security] unset sensitive data from api responses More information: https://github.com/froxlor/froxlor/security/advisories/GHSA-7788-ghfq-c6mh [Security] secure user-given destination-path of data-export [SysConfig] fix loading mod_ident.c for proftpd in debian trixe config-templates [UI] dns-editor and ssl-settings are not affected by caneditdomain-flag for customers in the frontend (as the API does already) [Domains] add check for existing files in customer directory when specified as domain-path, #1411 [Cron] fix bug in http to https redirect creation introduced in 2.3.8 [UI] fix missing CSRF token checks in ajax-calls introduced in 2.3.8 The security-advisories were published on 29th of June.

das vorgehen bei dns einträgen ist by design aktuell so, dass der eintrag gelöscht und ein neuer angelegt werden muss.

most likely cache :) it's always cache

Security release 2.3.7 [Security] secured regex for Dns LOC entries validation CVE: CVE-2026-41237 More information: https://github.com/froxlor/froxlor/security/advisories/GHSA-j6fm-9rfm-j5hx [Security] remove invalid control characters in every dns content-field see above [Security] ensure given shell exists in Ftps.add/update CVE: CVE-2026-41235 More information: https://github.com/froxlor/froxlor/security/advisories/GHSA-gcv3-5v9q-fmhh [Security] ensure authorized_keys file for SshKeys is within the customers documentroot CVE: CVE-2026-41236 More information: https://github.com/froxlor/froxlor/security/advisories/GHSA-mq5v-pxpm-8jw2 [Security] ensure a given symlink is resolved and validated correctly in FileDir::makeCorrectFile() see above [Security] secure api-key generation by asking user for current password More information: https://github.com/froxlor/froxlor/security/advisories/GHSA-f9rx-7wf7-jr36 [Security] ensure ownership of email/emailsender in frontend when deleting emailserver More information: https://github.com/froxlor/froxlor/security/advisories/GHSA-mr9h-45p9-fg8h [Security] ensure given dbserver value for Mysqls.add() is within the list of allowed mysql-servers for the customer More information: https://github.com/froxlor/froxlor/security/advisories/GHSA-q4rm-m6xh-5pv7 [UI] add missing label for REBUILD_NSSUSERS task by @lukasbableck in https://github.com/froxlor/froxlor/pull/1402 [i18n] Add Slovak language (sk) by @martinbernat in https://github.com/froxlor/froxlor/pull/1404 The security-advisories will be published on 29th of May in order to give people enough time to update.

nice

it's currently only the last 1000 lines iirc, depending on the customer, these logs can get HUGE and froxlor won't be able to load them (or php timeouts etc.). Maybe we will think of a better solution for froxlor3, this is unlikely to change in 2.x