ⓘ Follow up on #2794 by making `redirect_port` work even when `redirect_host` is not set. Keep existing host precedence and correctly handle proxy headers, IPv6 addresses, default ports, and invalid port values.
ⓘ Fix linked-server by keeping the child URL recognizable to the parent, then generating the final WebSocket URL on the same host and port the browser is using. This keeps the connection working with the current Webmin session.
ⓘ Extend HTTP and FTP download callbacks with destination validation while preserving legacy tracking callbacks and enforcing SSRF policy across redirects, proxies, caches, and direct/passive sockets.
https://github.com/webmin/webmin/pull/2789#discussion_r3567985773
Block non-public HTTP, HTTPS and FTP destinations by default in File Manager, Mailboxes and Upload and Download, with per-user IP/CIDR exceptions, redirect and proxy protection, cache isolation, and current-ACL enforcement for scheduled jobs.
ⓘ Normalize APT install-result names like `libtinfo6:amd64` to `libtinfo6` so scheduled updates can correctly detect dependency-updated packages and avoid false failure reports.
https://github.com/virtualmin/virtualmin-gpl/issues/1247
ⓘ Move miniserv helper functions into `miniserv-lib.pl`, remove the caller guard from `miniserv.pl`, and keep tests loading the helper library directly while preserving daemon startup behavior.
https://github.com/webmin/webmin/pull/2695
ⓘ Move XML-RPC marshalling helpers into `xmlrpc-lib.pl`, remove the caller guard from `xmlrpc.cgi`, and preserve coverage through direct library tests plus the CGI invocation regression.
https://github.com/webmin/webmin/pull/2763
ⓘ Prevent Webmin from swallowing Certbot's key-path output when extracting PEM paths, while preserving IPv6 cert-name support and adding regression coverage.
ⓘ Require websocket routes to opt in with allow_basic_ws before Basic auth is accepted in session mode. Mark linked ws-link routes and no-cookie backend-session routes as allowed, while leaving normal session-backed routes unmarked.
This PR adds general WebSocket proxying for linked Webmin servers, allowing modules such as `xterm` to work when opened through `servers/link.cgi`.
As requested in https://github.com/webmin/webmin/issues/1866.
This PR fixes Webmin IP access control handling for IPv6 CIDR prefixes that are not divisible by 8, such as `/29` as mentioned in this https://github.com/webmin/webmin/issues/1570 ticket.
Before Webmin validation rejected non-byte-aligned IPv6 network sizes, and the runtime matcher compared IPv6 networks only by whole bytes. This meant valid IPv6 CIDR prefixes could not be used safely in access control rules.
Changes:
- Allow IPv6 access-control prefixes from `/0` through `/128`, without requiring divisibility by 8.
- Add bit-accurate IPv6 prefix matching for ACL checks.
- Apply the same matching behavior in both `miniserv.pl` and `webmin/webmin-lib.pl`.
- Fix IPv6 canonicalization for `::` and trailing `::` forms used by the matcher.
- Add regression tests for `/0`, `/29`, `/32`, `/63`, `/64`, `/127`, and `/128`.
ⓘ Adds hidden `tempdirname` support and normalizes custom temp paths so Webmin always uses a private final directory like `.webmin`, while keeping the existing permission checks.
