LoginSign Up
← Back to all sparks
F

Froxlor

DEVOPS
Velocity5.0

Server administration and hosting control panel

froxlor.org ↗

Froxlor's bugfix releases now describe their changes, and most are security fixes.

hosting-panelopen-sourcesecurity-fixesphpapi-permissions
◆Current state
Froxlor is an open-source server administration panel. After two bugfix tags with nothing but a compare link, 2.3.14 to 2.3.16 carry real notes: 2.3.14 has four security fixes (theme allowlisting, control characters in FTP members, permission checks on MySQL server and cron reads, admin-scoped mail templates), 2.3.15 fixes database, nginx and SSH-key issues, and 2.3.16 adds PHP 8.5 compatibility and honours a hidden-traffic setting in the API.
◆Where it's heading
Security fixes now arrive in the regular bugfix releases rather than only in separate security releases, and the notes have returned. The issues are mostly authorization scoping inside the admin and customer API, the same class as the 2.3.11 2FA bypass. PHP 8.5 support keeps the panel installable on current distributions.
◆Prediction
Expect further 2.3.x releases with authorization fixes in the API, given the four in 2.3.14 and another in 2.3.16.

◆Recent moves

  1. 20d ago

    froxlor bugfix release 2.3.16

    PHP 8.5 compatibility, multi-line hosting plan descriptions and a fix so the traffic listing respects a customer's hidden-traffic option. Mostly compatibility upkeep, with one small permission fix.

    View source ↗
  2. 1mo ago

    froxlor bugfix release 2.3.15

    A bug-fix release for database error handling, MySQL user host checks, nginx body-size limits and SSH keys on shared FTP home directories. Routine maintenance.

    View source ↗
  3. 1mo ago

    froxlor bugfix release 2.3.14

    Four security fixes covering theme allowlisting, control characters in FTP members, permission checks on server and cron reads, and mail template scoping. Security work arriving inside a regular bugfix release, with notes this time.

    View source ↗
  4. 2mo ago

    froxlor bugfix release 2.3.13

    Tagged a bugfix release, but the body is only a compare link to 2.3.12, so what changed is not visible from the feed. The same shape as 2.3.12 and 2.3.10 before it.

    View source ↗
  5. 2mo ago

    Froxlor bugfix release 2.3.12

    Another bugfix tag published with a bare compare link and no described change.

    View source ↗
  6. 2mo ago

    2FA bypass, DKIM key exposure and acme.sh argument injection all fixed

    The substantive recent release: a 2FA bypass, DKIM key exposure and acme.sh argument injection all fixed. This is where Froxlor's feed actually documents itself.

    View source ↗