cpanel-csf (16.31-1+1.1.cpanel) stable; urgency=low

  * Fixed a privilege escalation that let a reseller inject a firewall rule through a CSF Quick Allow or Quick Deny comment.
  * Fixed a bug where CSF split an entry in /etc/csf/csf.allow or /etc/csf/csf.deny when its comment contained a non-ASCII character, which a reseller could use to inject a firewall rule and prevent lfd from blocking an address.
  * Fixed a case where markup stored in a temporary IP entry by lfd could execute in the browser in the WHM Temporary IP Entries interface.
  * Encoded the iptables log fields in the CSF viewlogs view to prevent script injection.
  * The ConfigServer Security & Firewall Messenger service now drops its privileges irreversibly, so a flaw in the network-facing request handler can no longer lead to elevated access.
  * The Messenger service no longer grants symbolic link following, web server user script execution, Apache AllowOverride All, CGI execution, or SSI.
  * CSF now refuses to create the Messenger document root when the configured group resolves to the root group.
  * Restored the Apache status details in CSF load average alerts and statistics, with the Apache server-status key redacted from the alert.
  * Preserve the port, direction, and comment values for temporary firewall rules.
  * Stopped lfd from killing cPanel's internal login/theme rendering process for exceeding the process limit.

 -- Travis Holloway <travis.holloway@webpros.com>  Thu, 06 Aug 2026 00:00:00 -0000

cpanel-csf (16.30-1) stable; urgency=low

  * Fixed a case where CSF reported "[unknown rule]" instead of
  naming the failing firewall rule when a FASTSTART batch was rejected on
  AlmaLinux 10.
  * Fixed a case where cpanel-csf could not be installed or upgraded on
  Debian and Ubuntu because the package required kernel-modules-extra,
  which exists only on RPM-based systems.

 -- Michael Salinas <michael.salinas@webpros.com>  Tue, 04 Aug 2026 00:00:00 -0000

cpanel-csf (16.29-1) stable; urgency=low

  * Fixed a case where CSF built no firewall on AlmaLinux 10
  because the kernel-modules-extra package, which owns nft_compat and the
  legacy iptables kernel modules, is not installed by default. That
  package is now required on EL10, and CSF now names the missing package
  instead of reporting only that individual iptables extensions are
  unsupported.

 -- Michael Salinas <michael.salinas@webpros.com>  Mon, 03 Aug 2026 00:00:00 -0000

cpanel-csf (16.28-1) stable; urgency=low

  * Fix csf silently loading no firewall rules on AlmaLinux 10,
  which blocked outbound connections including package downloads. A
  failed firewall load is now reported and exits non-zero instead of
  appearing to succeed.

 -- Travis Holloway <travis.holloway@webpros.com>  Fri, 31 Jul 2026 00:00:00 -0000

cpanel-csf (16.27-1) stable; urgency=low

  * Fix removal of cpanel-csf leaving firewall rules loaded in
  the kernel with no way to remove them.

 -- Travis Holloway <travis.holloway@webpros.com>  Fri, 31 Jul 2026 00:00:00 -0000

cpanel-csf (16.26-1) stable; urgency=low

  * Harden the CSF Messenger's home/document-root file
  generation against symlink, hard-link, FIFO, lock, and uid-0
  confused-deputy attacks from MESSENGER_USER. A failed run no longer
  leaves the previously installed web server configuration in place,
  csf --mregen now reports errors instead of always reporting success,
  and recaptcha.php is created with mode 0600 so that RECAPTCHA_SECRET
  is not readable by other accounts on the server.

 -- Travis Holloway <travis.holloway@webpros.com>  Fri, 31 Jul 2026 00:00:00 -0000

cpanel-csf (16.25-1) stable; urgency=low

  * Fixed an issue where an entry with a "/0" CIDR mask in
  /etc/csf/csf.ignore stopped lfd from blocking any address at all. A "/0"
  mask is no longer accepted in csf.ignore, and such an entry is now
  reported in /var/log/lfd.log. csf.allow and csf.deny still accept one.

 -- Travis Holloway <travis.holloway@webpros.com>  Thu, 30 Jul 2026 00:00:00 -0000

cpanel-csf (16.24-1) stable; urgency=low

  * Fixed a security issue where a malicious GLOBAL_DENY,
  GLOBAL_ALLOW, or GLOBAL_DYNDNS feed could execute arbitrary commands as
  root. Those feeds now accept only bare IP addresses and CIDR ranges, and
  malformed entries are reported rather than ignored. csf.allow, csf.deny
  and csf.ignore are unaffected; "csf -a" and "csf -d" now reject an
  advanced rule whose port or owner field is malformed.

 -- Tim Mullin <tim.mullin@webpros.com>  Wed, 29 Jul 2026 00:00:00 -0000

cpanel-csf (16.23-1) stable; urgency=low

  * Fix an unauthenticated shell command injection in the CSF
  reCAPTCHA messenger's URL-retrieval fallback (ConfigServer::URLGet), and
  stop the reCAPTCHA secret from leaking into log and process output

 -- David Lanning <david.lanning@webpros.com>  Mon, 27 Jul 2026 00:00:00 -0000

cpanel-csf (16.22-1) stable; urgency=low

  * Prevent a local symlink attack that could let the CSF messenger
  user force root to truncate arbitrary files via the reCAPTCHA unblock
  feature

 -- David Lanning <david.lanning@webpros.com>  Mon, 27 Jul 2026 00:00:00 -0000

cpanel-csf (16.21-1) stable; urgency=low

  * Detect sshd-session process name in SSH login alerts

 -- Michael Salinas <michael.salinas@webpros.com>  Mon, 20 Jul 2026 00:00:00 -0000

cpanel-csf (16.20-1) stable; urgency=low

  * Fix issue where docfile doesn't retain newlines in the file

 -- Andy Baugh <andy.baugh@webpros.com>  Thu, 14 May 2026 00:00:00 -0000

cpanel-csf (16.19-1) stable; urgency=low

  * Fix regex.custom.pm rules silently failing to match log lines

 -- Travis Holloway <travis.holloway@webpros.com>  Thu, 07 May 2026 00:00:00 -0000

cpanel-csf (16.18-1) stable; urgency=low

  * Add managesieve-login to etc/csf.pignore

 -- Andy Baugh <andy.baugh@webpros.com>  Mon, 04 May 2026 00:00:00 -0000

cpanel-csf (16.17-1) stable; urgency=low

  * Stop lfd from exiting at startup when /etc/csf/csf.error is absent.
  * Refactor DIE signal handler in lfd.pl to not trigger on eval blocks.

 -- Andy Baugh <andy.baugh@webpros.com>  Thu, 30 Apr 2026 00:00:00 -0000

cpanel-csf (16.16-1) stable; urgency=low

  * Preserve csf startup error details in lfd logs instead of referring to error files that may not exist

 -- Travis Holloway <travis.holloway@webpros.com>  Wed, 29 Apr 2026 00:00:00 -0000

cpanel-csf (16.15-1) stable; urgency=low

  * Robust restart logic added to pkg.postinst which now creates timestamped
  backups of firewall rules state (iptables-save), validates rule syntax,
  and attempts automatic rollback on restart failure to prevent leaving
  the firewall in an exposed state (CPANEL-52154).

 -- David Lanning <david.lanning@webpros.com>  Fri, 24 Apr 2026 00:00:00 -0000

cpanel-csf (16.14-1) stable; urgency=low

  * Fix LFD auto-restart error

 -- Tim Mullin <tim.mullin@webpros.com>  Thu, 23 Apr 2026 00:00:00 -0000

cpanel-csf (16.13-1) stable; urgency=low

  * Fix failed login detection on Dovecot 2.4

 -- Andy Baugh <andy.baugh@webpros.com>  Wed, 15 Apr 2026 00:00:00 -0000

cpanel-csf (16.12-1) stable; urgency=low

  * Fix CSF plugin and LFD service status persisting in WHM after package
  removal (CPANEL-51933): run unregister_appconfig and clean up
  /etc/chkserv.d/lfd and chkservd.conf entries in prerm.
  * Replace unlink with rm -f in postinst to suppress errors on missing files during updates.

 -- Todd Rinaldo <todd.rinaldo@webpros.com>  Wed, 11 Mar 2026 00:00:00 -0000

cpanel-csf (16.11-1) stable; urgency=low

  * Fix cpanel-csf package upgrade overwriting custom csf-cron entries.

 -- Travis Holloway <travis.holloway@webpros.com>  Fri, 06 Mar 2026 00:00:00 -0000

cpanel-csf (16.10-1) stable; urgency=low

  * Add csf.cloudflare back to %config(noreplace)

 -- Andy Baugh <andy.baugh@webpros.com>  Mon, 02 Mar 2026 00:00:00 -0000

cpanel-csf (16.09-1) stable; urgency=low

  * Assure PERL5LIB does not influence /usr/sbin/csf

 -- Todd Rinaldo <todd.rinaldo@webpros.com>  Fri, 27 Feb 2026 00:00:00 -0000

cpanel-csf (16.08-1) stable; urgency=low

  * Fix file conflict on upgrade in /etc/csf/messenger

 -- Andy Baugh <andy.baugh@webpros.com>  Wed, 25 Feb 2026 00:00:00 -0000

cpanel-csf (16.07-1) stable; urgency=low

  * Fix symlink for /etc/csf/messenger (round 2)

 -- Andy Baugh <andy.baugh@webpros.com>  Wed, 25 Feb 2026 00:00:00 -0000

cpanel-csf (16.06-1) stable; urgency=low

  * Ensure /etc/csf/messenger is a symlink on RPM based systems.

 -- Andy Baugh <andy.baugh@webpros.com>  Wed, 25 Feb 2026 00:00:00 -0000

cpanel-csf (16.05-1) stable; urgency=low

  * Fix issue with symlinks in /etc/ for non-config files not
  being overwritten on first time install on debian based systems.
  * Fix truncated CAPTCHA issues due to line length limit in
  Messenger.pm

 -- Andy Baugh <andy.baugh@webpros.com>  Tue, 24 Feb 2026 00:00:00 -0000

cpanel-csf (16.04-1) stable; urgency=low

  * Relocate non-configuration files from /etc/ to /usr/local/csf/ to comply
  with Ubuntu packaging policies while maintaining backward compatibility
  via symlinks

 -- Travis Holloway <travis.holloway@webpros.com>  Tue, 24 Feb 2026 00:00:00 -0000

cpanel-csf (16.03-1) stable; urgency=low

  * Fixed bug in parsing upper-case time-out duration values

 -- Tim Mullin <tim.mullin@webpros.com>  Tue, 24 Feb 2026 00:00:00 -0000

cpanel-csf (16.02-1) stable; urgency=low

  * Update regex to handle log changes to /var/log/secure on A10

 -- Travis Holloway <travis.holloway@webpros.com>  Mon, 23 Feb 2026 00:00:00 -0000

cpanel-csf (16.01-1) stable; urgency=low

  * Update link in x-arf template

 -- Travis Holloway <travis.holloway@webpros.com>  Fri, 20 Feb 2026 00:00:00 -0000

cpanel-csf (16.00-1) stable; urgency=low

  * Initial RPM packaging of CSF for cPanel OBS build system
  * Converted from install.sh to RPM spec file
  * Modernized entire codebase: switched to cPstrict, added function signatures,
  enforced perltidy standards, addressed perlcritic warnings
  * Removed support for non-cPanel platforms (DirectAdmin, Plesk, VestaCP, CWP,
  InterWorx, CyberPanel, Webmin)
  * Added comprehensive test suite with 100+ test files using Test2 framework
  * Fixed security vulnerabilities: XSS in web UI modules, proper HTML encoding
  throughout
  * Fixed numerous uninitialized variable warnings and potential runtime issues
  * Removed AUTO_UPDATES functionality (package-managed updates only)
  * Replaced custom implementations with cPanel libraries where available
  (Cpanel::Encoder::Tiny, Cpanel::JSON::XS)
  * Added CI/CD workflows for automated building and testing
  * Improved sandbox development environment for easier local testing
  * Refactored core modules for better testability and maintainability
  * Added POD documentation to all public module interfaces
  * Fixed IPv6 handling, timeout validation, and iptables guard conditions
  * Updated regex patterns to handle AlmaLinux 10 log format changes
  * Removed deprecated Perl 4 syntax and bareword filehandles throughout
  * Cleaned up code structure: moved modules to lib/, removed duplicate files

 -- Thomas "Andy" Baugh <andy.baugh@webpros.com>  Thu, 05 Feb 2026 00:00:00 -0000

