EasyEngine v4.13.2

EasyEngine v4.13.2

A security and bug-fix release. Update with ee cli update.

Security

• Site names are validated and quoted in the shell commands EasyEngine runs, in core and in the site packages.
• Clone and sync quote every value they pass to local and remote commands and validate the site details read from the other host.
• Each site's database user on the global database now has access only to its own database. A migration fixes existing sites; customised or shared grants are left alone with a warning.
• Admin-tools sites no longer mount the EasyEngine database into their containers. A migration updates existing admin-tools sites.
• ee log show follows logs without a shell and skips log links that leave the site's log directory.
• Secrets (passwords, API keys, tokens) are kept out of ee.log. The log directory is now readable by root only, and a migration restricts existing logs and masks secrets that earlier versions wrote to them.
• ee site clone no longer writes the new site's database password to ee.log.
• Backup metadata no longer holds site passwords (database, admin and the legacy site auth password); a migration strips them from local copies.
• ee @alias, --ssh and --http targets are refused instead of silently running the command on the local server.
• The admin-tools auth stays independent of the global auth.

Fixes

• ee site clone and ee site sync work when the other host has no sites yet (they failed with "Unable to get site list"), and a clone no longer deletes an existing destination site when that host's site list can't be read.
• Self-signed SSL: the root is now a real CA (on OpenSSL 3.2+, e.g. Ubuntu 26.04 and Debian 13, every self-signed site certificate was rejected); existing roots are repaired with the same key.
• Let's Encrypt HTTP-01 validation works under a strict umask.
• ee site update --ssl=le right after ee site create keeps the www redirect and the www name in the certificate.
• The phar no longer ships the packages' test files.

Behaviour changes

• New site names must be valid hostnames (at most 64 characters, IDN names in punycode). Existing sites keep working.
• Clone and sync refuse database credentials containing quotes, $, backticks or \, and need EasyEngine on both hosts. After this update an older ee refuses non-cli commands, so clone and sync over ssh need v4.13.2 on both hosts.
• ee log show --n accepts only a line count (+N/-N allowed).
• A bare --ssl on clone means le.
• Clone and sync stop with "Unable to get site list" when the other host's ee site list output can't be read, for example on the first command right after EasyEngine was updated there. Run the command again.
• ee admin-tools disable reports a failed container recreate instead of recording admin-tools as disabled.

Upgrade notes

• Admin-tools sites have their php and nginx containers recreated during the update: expect a few seconds of 502 on those sites.
• If the global database isn't running during the update, the grant migration prints the SQL statements to run instead of failing.

What's Changed

easyengine

• chore(release): prepare v4.13.2 #1948 @mrrobot47
• fix(log): mask secret values in logged info tables #1947 @mrrobot47
• fix(phar): leave the packages' tests and features out of the phar #1946 @mrrobot47
• fix(runner): refuse remote targets instead of running the command locally #1945 @mrrobot47
• fix(log): keep secrets out of ee.log and make the log readable by root only #1944 @mrrobot47
• fix(docker): quote site name in volume create and lookup commands #1943 @mrrobot47
• docs(readme): add the zip PHP module and match the installer CI distros #1942 @joelabreo227

site-command

• fix(site): use a new file for every www check EasyEngine/site-command#517 @mrrobot47
• fix(ssl): keep the HTTP-01 challenge files readable under a strict umask EasyEngine/site-command#516 @mrrobot47
• fix(backup): leave site credentials out of backup metadata EasyEngine/site-command#515 @mrrobot47
• fix(site): keep database passwords out of the log EasyEngine/site-command#514 @mrrobot47
• fix(ssl): mark the self-signed root as a CA and repair existing roots EasyEngine/site-command#513 @mrrobot47
• fix(site): restrict each site's database grant to its own database EasyEngine/site-command#512 @mrrobot47
• fix(clone): mask the other site's credentials in logged clone and sync commands EasyEngine/site-command#511 @mrrobot47
• fix(clone): quote clone and sync commands and validate the other host's site details EasyEngine/site-command#510 @mrrobot47
• fix(site): validate new site names and quote site-derived values in shell commands EasyEngine/site-command#509 @mrrobot47
• ci: fix the Behat workflow setup EasyEngine/site-command#508 @mrrobot47
• fix(clone): allow ee site clone onto a host with no existing sites EasyEngine/site-command#501 @mrrobot47

site-type-wp

• fix(site): keep site credentials out of the log EasyEngine/site-type-wp#244 @mrrobot47
• fix(site): validate the site name and quote values in WordPress create commands EasyEngine/site-type-wp#243 @mrrobot47
• ci: fix the Behat workflow setup EasyEngine/site-type-wp#242 @mrrobot47

site-type-php

• fix(site): keep site credentials out of the log EasyEngine/site-type-php#118 @mrrobot47
• fix(site): validate the site name and quote remote database check commands EasyEngine/site-type-php#117 @mrrobot47
• ci: fix the Behat workflow setup EasyEngine/site-type-php#116 @mrrobot47

admin-tools-command

• fix(admin-tools): stop mounting the EasyEngine database into site containers EasyEngine/admin-tools-command#54 @mrrobot47

auth-command

• fix(auth): keep the admin-tools auth independent of the global auth EasyEngine/auth-command#60 @mrrobot47

config-command

• fix(config): print config values without writing them to the log EasyEngine/config-command#14 @mrrobot47

log-command

• fix(log): follow logs without a shell and skip links that leave the log directory EasyEngine/log-command#8 @mrrobot47