myron 2fa1f10901 Security: fix 8 code-review findings ...

- install.sh: replace /usr/sbin/ufw * with scoped subcommands
- install.sh: remove /usr/bin/curl * and /usr/bin/env * NOPASSWD (trivial root escalation)
- PHPManager: switchVersion() uses sudo rm -f instead of unlink() for old pool
- PHPManager: updateConfig() SQLite syntax (ON CONFLICT / datetime('now'))
- WordPressManager: cloneStaging() escapeshellarg() on all shell-interpolated paths
- WordPressManager: delete() removes DB record before filesystem to avoid phantom records
- WordPressManager: ensureWpCli() validates download size and enforces 30s timeout

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-06-10 12:32:06 +00:00

..

admin

Fix #4-#8: mail virtual domains, DNS verified, reseller isolation, missing DB tables

2026-06-08 03:31:30 +00:00

api

Fix 10 code review findings: security, correctness, and SQLite compat

2026-06-10 03:06:14 +00:00

assets/js

Add account edit modal — package, PHP version, email

2026-06-08 20:39:54 +00:00

bin

Updates page: serve cached results instantly, nightly cron refreshes cache

2026-06-09 22:23:45 +00:00

lib

Security: fix 8 code-review findings

2026-06-10 12:32:06 +00:00

public

Wire update channel (stable/beta) into settings, check, deploy, and version tracking

2026-06-09 22:44:46 +00:00