This PR adds an `api_only` global permission that restricts a Webmin account to one supported API endpoint, such as virtual-server/remote.cgi.
External integrations need credentials that can call an API without also granting access to the Webmin interface or generic RPC. Existing module permissions do not provide this endpoint-level restriction. The new setting allows administrators to create dedicated integration accounts while Webmin continues performing authorized operations through its privileged backend.
The restriction is enforced in two places:
- MiniServ checks the authenticated account's policy before dispatching CGI, static-file, DAV, or WebSocket requests. Requests outside the configured endpoint receive HTTP 403.
- `init_config` requires the permitted CGI to explicitly opt in before initialization. This also protects Webmin-initializing CGIs hosted by another web server.
Generic RPC is denied for API-only accounts, even when an existing RPC permission would otherwise allow it. The endpoint's own module and operation permissions still apply. Selecting an endpoint does not grant permission to execute every API command.
Webmin Users gains an API-only setting for users and groups. Existing restrictions survive ordinary edits, resets, copies, cloning, renaming, group propagation, and cluster synchronization. Clearing a restriction requires an explicit permission edit. Group updates preserve restrictions already assigned to individual members.
MiniServ reads the policy on each request from the account's existing storage backend: local files, MySQL, PostgreSQL, or LDAP. Policy-read errors deny access instead of treating the account as unrestricted.
Validation passed with the four separately submitted supporting fixes (#2897, #2898, #2899, #2900) ,applied: 169 focused tests, syntax checks, and live Debian tests using file-backed and PostgreSQL accounts. Live checks covered account creation, lifecycle operations, both CGI modes, sessions, RPC, static files, DAV, and WebSockets.
The supporting fixes remain separate PRs. This API-only branch currently has seven lifecycle test failures that depend on the file-cache and group ACL cleanup fixes landing.
This patch fixes CSV imports on systems such as AlmaLinux where MariaDB's `PrivateTmp` setting hides Webmin's temporary files.
The earlier permissions fix could not solve this because the database service still could not see the file.
Imports now use a unique directory under `secure_file_priv`, or the database's data directory, while retaining restricted file permissions and automatic cleanup.
The directory uses the `#sql-` prefix so MariaDB does not treat it as a database during listings, backups, or checks.
Verified live on Debian 13, AlmaLinux 10, Ubuntu 26.04 MariaDB and MySQL 8.4, including database listings and full dumps taken while an import is in progress.
This patch fixes mail sending and SMTP monitoring silently continuing without encryption when STARTTLS is rejected.
That fallback could expose passwords and email contents despite encryption being selected.
Both paths now require a valid STARTTLS success response and stop on failure, while successful TLS and explicitly configured plaintext connections remain supported.
This patch fixes MySQL imports that fail because the database server cannot read the temporary file.
Since the temporary copy is created with mode 0600, a server-side `mysqlimport` fails for imports from a local file, and for uploads by users with a Unix user restriction.
Before running the import as root against a local server, the file is now given the group of the running server process with mode 0640, so the server can read it while other users still cannot. The process is found through the server's reported PID file and must be `mysqld` or `mariadbd`; otherwise the permissions are left unchanged.
This patch fixes leaving old bytes in the input buffer when a later read is shorter.
Those extra bytes can corrupt ordinary HTTP RPC requests. Fast RPC is unaffected (discovered in deep tests with Virtualmin WP Workbench).
The reader now matches Perl's native read behavior, with regression tests for buffered and socket reads, offsets, and zero-length reads.
This patch fixes missing SSH logins on systems without `utmp`, including Ubuntu 26.04.
It adds a Systemd session helper, excludes manager and Webmin and Usermin sessions keeping `who` as the fallback and existing backend where `utmp` is present.
This complements mine earlier https://github.com/webmin/webmin/commit/8417d5c patch, which fixed parsing but could not get sessions missing from `who` output.
Tested on Ubuntu 26.04 Pro and AlmaLinux 10 Pro with both local live test and suites pass.
