Cyberpanel delete all files and directors public_html

usmannasir · March 24, 2022, 6:23am

CyberPanel has been audited by rack911 (they are pioneer in these sorts of audits), our work with them is almost complete now.

However, if you can still penetrate using any function do let me know.

We’ve fixed and addressed many security issues.

Because to make it easy to understand where problem happened (but it was our mistake), it was kind of you to point it out. I will again go through code to make sure things are OK.

thanks.

usmannasir · March 24, 2022, 6:23am

It is fixed.

usmannasir · March 24, 2022, 6:24am

nick.chomey:

This is yet another example of why it is MISSION CRITICAL, TOP PRIORITY to improve the versioning system before you work on anything else.

We currently don’t receive any notification that there have been minor updates, so most people have no idea that they need to do so. This is even more urgent when you push tiny updates to fix CATASTROPHIC bugs, such as this one.

It seems completely clear that you should be making proper use of the 2.1.X for all of these - each minor commit should result in the final digit incrementing. It can go to 2.1.99999999 if needed. And then when a major feature is added, it moves to 2.2.0. And when there are breaking changes, it moves to 3.0.0. This is basic, standard practice.

If this makes your development/git workflow more difficult, so be it - it doesn’t matter compared to this. Though, given that this is standard practice, I don’t see how it could be difficult to manage. You’ll just have to adapt your workflow. There is no other choice.

Again, someone nearly lost their entire business because of this bug. Moreover, how many servers and businesses are currently running on a version of 2.1.2 that doesn’t have this fix (let alone all the other fixes from the past 6 months since 2.1.2 was released)? Thousands? Tens of thousands? More? All of your efforts to improve the security and stability are irrelevant if people aren’t made aware until an official version comes out every 6-12 months…

It would be completely unforgivable if you don’t urgently take the appropriate steps (detailed above) to fix this problem once and for all.

@die2mrw007 @shoaibkk @asma, I’m copying you here to make sure you are aware and that you can put your energy towards supporting Usman in urgently making this crucial change

I will release v2.1.3 first and then take care of it.

MyIDKaTePe · March 24, 2022, 2:00pm

this 2.1.2 too ?

MyIDKaTePe · March 24, 2022, 2:01pm

thank you…

dazburn · March 24, 2022, 3:03pm

Can’t even see how to upgrade from 2.1.1 to 2.1.2. Certainly not in Cyberpanel Cloud

nick.chomey · March 24, 2022, 3:47pm

@dazburn That’s odd. Perhaps open a ticket within cyberpanel cloud, or a separate topic in the forum here.

For now, you could run the single automatic upgrade command via your ssh root user. Just wait or press enter when prompted and the most recent version will be installed in a minute or two.

https://community.cyberpanel.net/docs?topic=81

usmannasir · March 26, 2022, 1:07pm

@MyIDKaTePe

Confirm box added while converting to LiteSpeed Enterprise:

MyIDKaTePe · March 26, 2022, 1:41pm

i will try
right now no warning/confirmation box. because im not update cyberpanel yet

MyIDKaTePe · March 26, 2022, 1:43pm

what is this ?

i used to upgrade cyberpanel under screen lol
never see the progress

MyIDKaTePe · March 26, 2022, 1:48pm

oo:

hoooraaaayyy
thankyou

dazburn · March 28, 2022, 11:43am

Once again, our WHOLE SITE has been deleted. And we don’t have a recent backup because of the problem last time.
To say I’m angry is an understatement. I’m fuming that even though we’ve upgraded to your “stable” product your system has DELETED EVERY FILE AGAIN.
We will revert with more logs shortly.

Dreamer · March 28, 2022, 12:56pm

I would recommend set Amazon s3 backups and not trust local backup solution. Use local backup just for store 3 day and AWS atleast couple weeks.
I have s3 for my and wife computer, websites family pictures etc… cost under 3usd month.

dazburn · March 28, 2022, 2:56pm

Thankfully, we found a snapshot backup on AWS.

Having said that, we have no idea WHY or HOW all the files got deleted again and there was nothing in the logs. It’s super concerning that this can even happen. Exactly the same behaviour as last time, all files deleted from /public_html.

Something far more sinister going on in Cyberpanel’s setup and it would be amiss of me to not flag this publicly.

usmannasir · March 28, 2022, 3:06pm

All of CyberPanel code is available open-source that gets downloaded to your server.

I am not sure if you have the latest code. give me output of

cat /usr/local/CyberCP/plogical/backupUtilities.py

usmannasir · April 6, 2022, 10:58am

This has also been added, will come in v2.1.3

nick.chomey · April 6, 2022, 1:28pm

Looks great. Could there also be a small notification in the header when there is a new version? Perhaps it is a link that sends you to the version management page for more details?

Could it even show a count of how many commits you are out of date, and also a number of days that you’re out of date? And a link to the Github commit log to check the comments on them?

Finally, perhaps there could be a button there that runs the upgrade command for you, so that you don’t need to go to SSH?

svenms · April 24, 2022, 1:54am

I had the same problem today! lscache folder went too big and when trying to do a Backup it deleted public_html.
Current version 2.1 build 2 ! with litespeed !

Dreamer · April 24, 2022, 7:00am

Your panel is probably not latest version, devs said they fixed that problem…
Biggest problem with cyberpanel is your panel show version 2.1 build 2, but that don’t mean you are latest version. After initial relase of 2.1 build 2 there been multiple bug fixes on same relase but version stay same… Only way stay updated is keep running update script every week.

usmannasir · April 24, 2022, 11:03pm

We’ve released v2.3.1 and the problem that you don’t know if you are on latest version is also resolved now. CyberPanel v2.3.1 Released - Security Release