Skip to content

VortexPanel v3.4.18 - Release Summary

Choose a tag to compare

View all tags
@BrowserlessAPI BrowserlessAPI released this 23 Aug 03:13
· 2 commits to main since this release
3.4.18
d717513
This commit was signed with the committer’s verified signature.
claude Claude
SSH Key Fingerprint: 32dP45eSMmVSt/G/CGvcxl/P+MO3Nwj9xeTh/GSA2wc
Verified
Learn about vigilant mode.

VortexPanel v3.4.18

Security hardening, correctness fixes, and full multi-distro App Store coverage across all 9 supported distributions.

🔒 Security
Domain validation before any value reaches a shell command or filesystem path — site/WordPress create, clone, and imported-site paths (closes command-injection and path-traversal vectors, including untrusted domains parsed from imported backups).
Self-updater injection fixed — the version field is now constrained to a real version tag before it reaches git checkout.
Terminal WebSocket (/ws/…) is now covered by the IP allowlist, not just /api/ — a stolen cookie can no longer open the root shell from an unlisted IP.
Disallowed IPs return a clean 403 instead of a 500; SESSION_COOKIE_SECURE is set for HTTPS deployments; /api/settings/webroot now requires auth.
Removed the hardcoded admin/admin123 credential fallback (random password generated instead).

🐧 App Store — all 9 distros (Ubuntu, Debian, AlmaLinux, Rocky, RHEL, Oracle, CentOS Stream, CloudLinux, Fedora)
Added RHEL-family (dnf/yum) install paths: Apache (httpd), PHP (Remi), Python, Node.js (rpm.nodesource), Redis, Supervisor, DDNS (EPEL), MariaDB (package-manager-agnostic), phpMyAdmin (portable). Fedora nginx now uses the base repo.
Family-agnostic uninstalls for every app (apt + dnf + yum).
New service-name resolver so start/stop/status use the correct unit per distro (httpd, supervisord, mysqld).

🛠️ Correctness & logic
Fixed: PostgreSQL DB-listing crash, MongoDB create/drop, maintenance-mode vhost corruption (with rollback on failed nginx -t), RHEL sudo-group assignment, CDN config-save crash.
SSL now requests www. only for apex domains (subdomain certs no longer fail); Cloudflare proxied flag preserved with retry-on-failure; monotonic DNS zone serial; Docker proxy cleanup on container removal; HTTP/3 duplicate reuseport prevented.
Go/Node.js project services default to a real web user; PHP extension management and php.ini paths work on RHEL; RHEL log-viewer paths; per-distro deploy web-user and unzip; AI quick-actions honor the disabled flag.

📦 WP Toolkit
Includes the OpenLiteSpeed fixes (correct lsphp detection, vhRoot/restrained, lswsctrl reload, log-dir creation) and the install-path fix.

Assets 2
Loading