This PR fixes cached settings remaining available after unlink_file successfully deletes a file.
It clears the file's cached contents and missing-file flag so later reads correctly handle deleted or recreated files.
Tests cover deletion, recreation, translated paths, partial failures, and read-only mode.
This PR fixes MiniServ ignoring CGI Status headers and returning the wrong HTTP status.
Both CGI execution modes now honor explicit statuses, preserve default redirects, and record the correct status in request logs.
The Status control header is no longer forwarded to clients.
Validation passed: 102 local tests and 68 live checks on Debian 13, covering both CGI modes.
This PR fixes global and RPC controls appearing for group members even though saving ignores their edits.
It detects group membership for existing users and clones, even when the editor cannot assign groups.
The check also works for database-backed accounts without relying on local ACL files.
This patch fixes CSV imports on systems such as AlmaLinux where MariaDB's `PrivateTmp` setting hides Webmin's temporary files.
The earlier permissions fix could not solve this because the database service still could not see the file.
Imports now use a unique directory under `secure_file_priv`, or the database's data directory, while retaining restricted file permissions and automatic cleanup.
The directory uses the `#sql-` prefix so MariaDB does not treat it as a database during listings, backups, or checks.
Verified live on Debian 13, AlmaLinux 10, Ubuntu 26.04 MariaDB and MySQL 8.4, including database listings and full dumps taken while an import is in progress.
This patch fixes mail sending and SMTP monitoring silently continuing without encryption when STARTTLS is rejected.
That fallback could expose passwords and email contents despite encryption being selected.
Both paths now require a valid STARTTLS success response and stop on failure, while successful TLS and explicitly configured plaintext connections remain supported.
This patch fixes MySQL imports that fail because the database server cannot read the temporary file.
Since the temporary copy is created with mode 0600, a server-side `mysqlimport` fails for imports from a local file, and for uploads by users with a Unix user restriction.
Before running the import as root against a local server, the file is now given the group of the running server process with mode 0640, so the server can read it while other users still cannot. The process is found through the server's reported PID file and must be `mysqld` or `mariadbd`; otherwise the permissions are left unchanged.
This patch fixes leaving old bytes in the input buffer when a later read is shorter.
Those extra bytes can corrupt ordinary HTTP RPC requests. Fast RPC is unaffected (discovered in deep tests with Virtualmin WP Workbench).
The reader now matches Perl's native read behavior, with regression tests for buffered and socket reads, offsets, and zero-length reads.
