From ac65e98bfbf2915e8ddbe88f9e6af423c6d3d208 Mon Sep 17 00:00:00 2001
From: Mihael Koep <mihael.koep@softwareschneiderei.de>
Date: Wed, 5 Aug 2026 13:16:25 +0200
Subject: [PATCH 1/5] Fix #2810

XML-RPC now retains type information on scalars.
---
 xmlrpc-lib.pl | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/xmlrpc-lib.pl b/xmlrpc-lib.pl
index 02a37963f..8a7fdb69a 100644
--- a/xmlrpc-lib.pl
+++ b/xmlrpc-lib.pl
@@ -18,7 +18,13 @@ my ($base64) = &find_xmls("base64", $value, 1);
 my ($struct) = &find_xmls("struct", $value, 1);
 my ($array) = &find_xmls("array", $value, 1);
 if ($scalar) {
-	return $scalar->[1]->[2] // "";
+    my ($type, $content) = ($scalar->[0], $scalar->[1]->[2] // "");
+
+    return int($content) if ($type eq "int" || $type eq "i4");
+    return $content ? 1 : 0 if ($type eq "boolean");
+    return $content + 0.0 if ($type eq "double");
+
+    return $content;
 	}
 elsif ($date) {
 	# Need to decode date

From 137fbd5768ea3f0e2de71887c84e25392abf5115 Mon Sep 17 00:00:00 2001
From: Ilia Ross <ilia@ross.gdn>
Date: Wed, 5 Aug 2026 15:17:21 +0200
Subject: [PATCH 2/5] Fix to normalized XML-RPC scalar tag names

https://github.com/webmin/webmin/pull/2811
---
 t/xmlrpc.t    |  8 ++++++++
 xmlrpc-lib.pl | 11 ++++++-----
 2 files changed, 14 insertions(+), 5 deletions(-)

diff --git a/t/xmlrpc.t b/t/xmlrpc.t
index c01d04b9e..45cbb400f 100644
--- a/t/xmlrpc.t
+++ b/t/xmlrpc.t
@@ -228,6 +228,14 @@ subtest 'parse_xml_value' => sub {
 		'<array><data><value><int>1</int></value><value><string>x</string></value></data></array>'));
 	is(ref($a), 'ARRAY', 'array -> arrayref');
 	is_deeply($a, [1, 'x'], 'array elements parsed in order');
+
+	# Scalar tags must retain their type when a nested value is later encoded.
+	require JSON::PP;
+	my $typed = parse_xml_value(value_tree(
+		'<struct><member><name>integer</name><value><int>1800</int></value></member><member><name>boolean</name><value><boolean>1</boolean></value></member><member><name>double</name><value><double>2.5</double></value></member><member><name>string</name><value><string>1800</string></value></member></struct>'));
+	is(JSON::PP->new->canonical->encode($typed),
+	   '{"boolean":1,"double":2.5,"integer":1800,"string":"1800"}',
+	   'nested scalar types preserved for JSON');
 };
 
 # Round-trip: encode_xml_value then parse_xml_value should reproduce the
diff --git a/xmlrpc-lib.pl b/xmlrpc-lib.pl
index 8a7fdb69a..d0d5f0edd 100644
--- a/xmlrpc-lib.pl
+++ b/xmlrpc-lib.pl
@@ -18,13 +18,14 @@ my ($base64) = &find_xmls("base64", $value, 1);
 my ($struct) = &find_xmls("struct", $value, 1);
 my ($array) = &find_xmls("array", $value, 1);
 if ($scalar) {
-    my ($type, $content) = ($scalar->[0], $scalar->[1]->[2] // "");
+	my ($type, $content) = ($scalar->[0], $scalar->[1]->[2] // "");
+	$type = lc($type);
 
-    return int($content) if ($type eq "int" || $type eq "i4");
-    return $content ? 1 : 0 if ($type eq "boolean");
-    return $content + 0.0 if ($type eq "double");
+	return int($content) if ($type eq "int" || $type eq "i4");
+	return $content ? 1 : 0 if ($type eq "boolean");
+	return $content + 0.0 if ($type eq "double");
 
-    return $content;
+	return $content;
 	}
 elsif ($date) {
 	# Need to decode date

From 555ff28a4db13ea997fef920f722cc1f9a295470 Mon Sep 17 00:00:00 2001
From: Ilia Ross <ilia@ross.gdn>
Date: Wed, 5 Aug 2026 21:00:36 +0200
Subject: [PATCH 3/5] Add global systemd user unit controls

---
 systemd/systemd-lib.pl | 52 ++++++++++++++++++++++++++++++++++++++++++
 systemd/t/run-tests.t  | 41 +++++++++++++++++++++++++++++++++
 2 files changed, 93 insertions(+)

diff --git a/systemd/systemd-lib.pl b/systemd/systemd-lib.pl
index e1b7b4888..fd9b3db2d 100644
--- a/systemd/systemd-lib.pl
+++ b/systemd/systemd-lib.pl
@@ -2552,6 +2552,32 @@ my $out = backquote_logged($cmd." 2>&1 </dev/null");
 return (!$?, $out);
 }
 
+=head2 global_user_systemctl_command(arg, ...)
+
+Returns a quoted systemctl command line for changing global user-unit policy.
+
+=cut
+sub global_user_systemctl_command
+{
+my (@args) = @_;
+my $systemctl = has_command("systemctl") || "systemctl";
+return join(" ", quotemeta($systemctl), "--global",
+	    map { quotemeta($_) } @args);
+}
+
+=head2 run_global_user_systemctl(arg, ...)
+
+Runs systemctl --global, returning an OK flag and command output.
+
+=cut
+sub run_global_user_systemctl
+{
+my (@args) = @_;
+my $cmd = global_user_systemctl_command(@args);
+my $out = backquote_logged($cmd." 2>&1 </dev/null");
+return (!$?, $out);
+}
+
 =head2 reload_user_manager(user)
 
 Tells a user's systemd manager to re-read its unit files.
@@ -3350,6 +3376,32 @@ my $out = backquote_logged(
 return (!$?, $out);
 }
 
+=head2 enable_global_user_unit(name)
+
+Enables a systemd user unit globally for all user managers.
+
+=cut
+sub enable_global_user_unit
+{
+my ($name) = @_;
+return (0, $text{'systemd_ename'}) if (!valid_unit_name($name));
+my ($ok, $out) = run_global_user_systemctl("enable", $name);
+return ($ok && !startup_change_skipped($out), $out);
+}
+
+=head2 disable_global_user_unit(name)
+
+Disables a globally-enabled systemd user unit for all user managers.
+
+=cut
+sub disable_global_user_unit
+{
+my ($name) = @_;
+return (0, $text{'systemd_ename'}) if (!valid_unit_name($name));
+my ($ok, $out) = run_global_user_systemctl("disable", $name);
+return ($ok && !startup_change_skipped($out), $out);
+}
+
 =head2 enable_user_unit(user, name)
 
 Enable a systemd user unit.
diff --git a/systemd/t/run-tests.t b/systemd/t/run-tests.t
index ebcd140b8..58a24136b 100644
--- a/systemd/t/run-tests.t
+++ b/systemd/t/run-tests.t
@@ -1716,6 +1716,47 @@ like(get_unit_root(), qr{^/(etc|usr/lib|lib)/systemd/system$},
               'reload_user_manager reloads the user manager');
 }
 
+{
+    my @cmds;
+    local *main::has_command = sub {
+        return $_[0] eq 'systemctl' ? '/bin/systemctl' : undef;
+    };
+    local *main::backquote_logged = sub {
+        push(@cmds, $_[0]);
+        $? = 0;
+        return 'ran';
+    };
+    my ($ok, $out) = run_global_user_systemctl(
+        'is-enabled', 'demo.service');
+    ok($ok, 'run_global_user_systemctl reports command success');
+    is($out, 'ran', 'run_global_user_systemctl returns command output');
+    is($cmds[-1],
+       quotemeta('/bin/systemctl').' --global '.quotemeta('is-enabled').' '.
+           quotemeta('demo.service').' 2>&1 </dev/null',
+       'global user systemctl command uses global scope and quotes arguments');
+}
+
+{
+    my @run;
+    local *main::run_global_user_systemctl = sub {
+        push(@run, [ @_ ]);
+        return (1, 'ok');
+    };
+    my ($ok) = enable_global_user_unit('demo.service');
+    ok($ok, 'enable_global_user_unit reports success');
+    is_deeply($run[-1], [ 'enable', 'demo.service' ],
+              'enable_global_user_unit arguments');
+    ($ok) = disable_global_user_unit('demo.service');
+    ok($ok, 'disable_global_user_unit reports success');
+    is_deeply($run[-1], [ 'disable', 'demo.service' ],
+              'disable_global_user_unit arguments');
+    my $before_invalid = scalar(@run);
+    ($ok) = enable_global_user_unit('bad;touch.service');
+    ok(!$ok, 'global user enable rejects invalid unit names');
+    is(scalar(@run), $before_invalid,
+       'invalid global user unit name builds no systemctl command');
+}
+
 {
     my @run;
     local *main::run_user_systemctl = sub {

From 9b4c722f753c6a57bf00297b4454e8561c9a9a65 Mon Sep 17 00:00:00 2001
From: Ilia Ross <ilia@ross.gdn>
Date: Thu, 6 Aug 2026 03:47:20 +0200
Subject: [PATCH 4/5] Fix to enforce permissions for Webmin systemd unit
 https://github.com/webmin/webmin/issues/2809

---
 init/updateboot.pl | 1 +
 1 file changed, 1 insertion(+)

diff --git a/init/updateboot.pl b/init/updateboot.pl
index 1ad0909d9..da9304f8e 100755
--- a/init/updateboot.pl
+++ b/init/updateboot.pl
@@ -41,6 +41,7 @@ if ($product) {
 		&flush_file_lines($temp);
 
 		copy_source_dest($temp, "$systemd_root/$product.service");
+		&set_ownership_permissions(0, 0, 0644, "$systemd_root/$product.service");
 		$reload_daemon->();
 
 		if ($status eq "disabled") {

From c4d72079421a15e345091544eb320f35355c0d08 Mon Sep 17 00:00:00 2001
From: Ilia Ross <ilia@ross.gdn>
Date: Thu, 6 Aug 2026 03:51:10 +0200
Subject: [PATCH 5/5] Fix to enforce secure ownership for Webmin init scripts
 https://github.com/webmin/webmin/issues/2809

---
 init/updateboot.pl | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/init/updateboot.pl b/init/updateboot.pl
index da9304f8e..06f355b68 100755
--- a/init/updateboot.pl
+++ b/init/updateboot.pl
@@ -71,7 +71,7 @@ if ($product) {
 			}
 		&flush_file_lines($temp);
 		&copy_source_dest($temp, "/etc/init.d/$product");
-		chmod(0755, "/etc/init.d/$product");
+		&set_ownership_permissions(0, 0, 0755, "/etc/init.d/$product");
 		&unlink_file($temp);
 		if ($status == 2 || $want_boot) {
 			&enable_at_boot($product);
@@ -100,6 +100,7 @@ if ($product) {
 		}
 	elsif (-d "/etc/init.d") {
 		copy_source_dest("$root_directory/webmin-init", "/etc/init.d/$product");
+		&set_ownership_permissions(0, 0, 0755, "/etc/init.d/$product");
 		system("chkconfig --add $product >/dev/null 2>&1");
 		}
 	}