ⓘ Follow up on #2794 by making `redirect_port` work even when `redirect_host` is not set. Keep existing host precedence and correctly handle proxy headers, IPv6 addresses, default ports, and invalid port values.
ⓘ Fix linked-server by keeping the child URL recognizable to the parent, then generating the final WebSocket URL on the same host and port the browser is using. This keeps the connection working with the current Webmin session.
ⓘ Normalize undefined and empty XML-RPC values during encoding and parsing, preventing uninitialized-value warnings and uncontrolled error-log growth.
https://github.com/webmin/webmin/issues/2793
ⓘ Extend HTTP and FTP download callbacks with destination validation while preserving legacy tracking callbacks and enforcing SSRF policy across redirects, proxies, caches, and direct/passive sockets.
https://github.com/webmin/webmin/pull/2789#discussion_r3567985773
Block non-public HTTP, HTTPS and FTP destinations by default in File Manager, Mailboxes and Upload and Download, with per-user IP/CIDR exceptions, redirect and proxy protection, cache isolation, and current-ACL enforcement for scheduled jobs.
ⓘ Create and detect VLAN devices before applying live configuration, parse live VLANs with their physical parent instead of a virtual alias, normalize persisted dotted VLAN names when the parent device exists, consistently target the real VLAN device across the ip, ifup and vconfig paths, skip recreating existing devices or activating absent disabled ones, and add regression coverage.
https://github.com/webmin/webmin/pull/2785
ⓘ Require a live Usermin miniserv PID before allowing one-time login URL creation, so the feature is only offered when the session backend can actually be used.
ⓘ Centralize global file ACL checks for server-local reads and applies them to batch, LDAP batch, MySQL, and PostgreSQL local import and restore flows. Files are read under the configured `fileunix` identity and staged with the correct command-user ownership, preventing constrained Webmin users from bypassing `root`, `otherdirs`, or `fileunix`.
9ceffce70f (r191495975)
ⓘ Fail closed when checking local batch file imports for Webmin-only users that do not have a Unix home directory.
This prevents an unset global file root ACL, or a home-relative root such as `~/path`, from being treated as filesystem-root access. Explicitly configured allowed directories still work as before.
ⓘ This tightens local server-side batch file execution in the Users and Groups module.
Both user and group batch endpoints now read local batch files through a shared helper that enforces the module `batchdir` ACL, the user’s global file chooser ACL (`root` / `otherdirs`), and the configured `fileunix` read identity. Existing ACLs remain compatible by treating a missing `batchdir` as `/`, while an explicitly blank value denies local server batch files.
Regression coverage was added for allowed paths, denied paths, `otherdirs`, missing/blank `batchdir`, symlink escape rejection, and successful local batch reads.
----
Reproduction / verification steps:
1. Create a constrained Webmin user with access to the `Users and Groups` module.
2. Set the user's Global ACL:
- Root directory for file browser: `/home/user1`
- Other directories to allow: empty
- Browse as Unix user: `nobody`
3. Set the user's `Users and Groups` module ACL:
- Can view batch file form?: `Yes`
- Batch files must be under directory: `/`
4. Create test files on the Webmin host:
```sh
sudo mkdir -p /home/user1
echo ROOT_SECRET_MARKER | sudo tee /root/batch-secret.txt >/dev/null
sudo chown root:root /root/batch-secret.txt
sudo chmod 600 /root/batch-secret.txt
echo ALLOWED_BATCH_MARKER | sudo tee /home/user1/allowed.batch >/dev/null
sudo chmod 644 /home/user1/allowed.batch
sudo ln -sf /root/batch-secret.txt /home/user1/link-secret.batch
echo ROOT_ONLY_ALLOWED_MARKER | sudo tee /home/user1/root-only.batch >/dev/null
sudo chown root:root /home/user1/root-only.batch
sudo chmod 600 /home/user1/root-only.batch
```
5. Log in to Webmin as the constrained user and request:
```text
/useradmin/batch_exec.cgi?source=1&local=/root/batch-secret.txt
/useradmin/gbatch_exec.cgi?source=1&local=/root/batch-secret.txt
```
Expected fixed result:
```text
Local file location is not allowed
```
6. Request an allowed readable file:
```text
/useradmin/batch_exec.cgi?source=1&local=/home/user1/allowed.batch
/useradmin/gbatch_exec.cgi?source=1&local=/home/user1/allowed.batch
```
Expected fixed result:
```text
Invalid action at line 1 : ALLOWED_BATCH_MARKER
```
7. Request a symlink inside the allowed directory that points outside it:
```text
/useradmin/batch_exec.cgi?source=1&local=/home/user1/link-secret.batch
/useradmin/gbatch_exec.cgi?source=1&local=/home/user1/link-secret.batch
```
Expected fixed result:
```text
Local file location is not allowed
```
8. Request a root-only file inside the allowed directory:
```text
/useradmin/batch_exec.cgi?source=1&local=/home/user1/root-only.batch
/useradmin/gbatch_exec.cgi?source=1&local=/home/user1/root-only.batch
```
Expected fixed result:
```text
Local file not found
```
The fixed behavior confirms that local batch file imports now enforce the configured global file ACL, reject symlink escapes, and read files using the configured Unix identity instead of the privileged Webmin process.
