Fix to tighten privileged ACL checks

This PR addresses privately reported issue and tries to restricts root/UID 0 user mutations and Custom Commands definition editing to full, non-safe Webmin admins.

This closes privilege-escalation paths for restricted operators while preserving execution of pre-approved Custom Commands under existing cmds ACLs.

.github/workflows/close-inactive.yml

@@ -0,0 +1,15 @@
+name: Close inactive
+
+on:
+  schedule:
+    - cron: "0 12 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
+jobs:
+  close-inactive:
+    uses: webmin/webmin-ci-cd/.github/workflows/close-inactive.yml@main

.github/workflows/tests.yml

@@ -0,0 +1,19 @@
+name: Tests
+
+on:
+  pull_request:
+    branches:
+      - master
+  push:
+    branches:
+      - master
+
+jobs:
+  prove:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install Perl::Critic
+        run: sudo apt-get update && sudo apt-get install -y libperl-critic-perl
+      - name: prove -lr
+        run: prove -lr

.github/workflows/webmin.dev+webmin.yml

@@ -1,4 +1,4 @@
-name: "webmin.dev: webmin/webmin"
+name: Package and upload artifacts
 
 on:
   push:
@@ -25,3 +25,5 @@ jobs:
       PRERELEASE_UPLOAD_SSH_DIR: ${{ secrets.PRERELEASE_UPLOAD_SSH_DIR }}
       DEV_SSH_PRV_KEY: ${{ secrets.DEV_SSH_PRV_KEY }}
       ALL_GPG_PH2: ${{ secrets.ALL_GPG_PH2 }}
+      CODE_REVIEW_API_KEY: ${{ secrets.CODE_REVIEW_API_KEY }}
+      CODE_REVIEW_SMTP_PASSWORD: ${{ secrets.CODE_REVIEW_SMTP_PASSWORD }}

.gitignore

@@ -22,3 +22,4 @@ tarballs/
 minimal/
 .DS_Store
 .vscode/settings.json
+debug.cgi

.perlcriticrc

@@ -0,0 +1,6 @@
+severity = 5
+
+# Octal file permission literals (0700, 0640, etc.) are the standard Perl
+# idiom for chmod/mkdir/permission helpers throughout this codebase. The
+# policy flags chmod 0700 itself, so it is too coarse for our use.
+[-ValuesAndExpressions::ProhibitLeadingZeros]

CHANGELOG.md

@@ -1,5 +1,94 @@
 ## Changelog
 
+#### 2.651 (June 28, 2026)
+* Fix Certbot-backed certificate requests and renewals to correctly parse PEM paths after issuance
+
+#### 2.650 (June 25, 2026)
+* Add new Systemd Services and Units module
+* Add new GRUB 2 Boot Loader module
+* Add new Kea DHCP Server module
+* Add WebSocket proxy support to the Webmin Servers Index module
+* Add basic Alpine Linux support
+* Add IP-based Let's Encrypt certificate support with Certbot 5.3
+* Add editable SSH public keys for newly added Unix users in Users and Groups module
+* Add improvements to custom Webmin temporary directory handling
+* Add quick service and port forwarding controls to the nftables module
+* Add optional pre- and post-scripts for scheduled package updates
+* Add option to control when scheduled package update email is sent
+* Add per-user RPC/API-only access option to the Webmin Users module
+* Add Apache 2.4 MPM process limit directives [#1821](https://github.com/webmin/webmin/issues/1821)
+* Add dhcpcd network backend for Debian and Raspberry Pi OS [#1607](https://github.com/webmin/webmin/issues/1607)
+* Add hardware RAID passthrough devices config in the SMART Status module [#1704](https://github.com/webmin/webmin/issues/1704)
+* Update Xterm.js to fix Control-C handling on iPadOS/Safari terminals
+* Update Webmin systemd service unit to run without forking
+* Fix IPv6 CIDR access control matching [#1570](https://github.com/webmin/webmin/issues/1570)
+* Fix Bootup and Shutdown module to show only services and not all units on systemd systems
+* Fix Let's Encrypt renewal scheduling to count from the last successful request
+* Fix NetworkManager detection on Debian and IPv6 DNS nameserver saving
+* Fix Dovecot configuration file handling when saving extra configs
+* Fix mailbox listing to skip unusable Maildir entries and remove stale deleted or moved entries
+* Fix Postfix module labels to identify virtual alias maps instead of virtual mailbox domains #1541
+* Fix Apache module to hide disabled default virtual hosts from the active server list
+* Fix Netplan DNS saving to preserve YAML structure
+* Fix BIND DNS handling of underscores, trailing dots, and mass record length checks
+* Fix MariaDB user creation when using auth plugin syntax
+* Fix PHP-FPM monitor on EL systems when using `/etc/php.ini` as the config file
+* Fix RPC-only accounts to block browser/module access before module ACL checks
+* Fix reflected XSS in Webmin status messages
+* Fix path validation in File Manager, package delete helpers, and Apache virtual host files
+* Fix authentication state handling for SSL certificate logins and proxied keep-alive requests
+* Update session handling to improve security, which will require users to re-authenticate after upgrading
+* Update the Authentic theme to the latest version with various improvements and fixes:
+  - Add zooming to stats history graphs by holding shift and scrolling in the dashboard
+  - Add support for saving live stats history for up to 24 hours without performance impact
+  - Add better support for the new Nginx, nftables, and upcoming systemd, Kea-DHCP, and GRUB 2 Webmin modules
+  - Add ability to always show available dashboard panels in theme configuration
+  - Add support for live stats and terminal WebSocket connections through Webmin Servers Index proxy links
+  - Fix proxying when Webmin is accessed with a webprefix using Webmin Servers Index module
+  - Fix theme UI helpers to escape generated markup more safely
+  - Fix iOS terminal viewport sizing
+  - Fix editor save handling, clean-state indication and dirty reload guard
+  - Fix popover positioning, z-index and border color for help bubbles
+  - Fix the active product switch border in the navigation menu for the dark palette
+  - Fix to validate password reset return URLs
+
+#### 2.641 (May 10, 2026)
+* Fixed a bug when editing monitors in the System and Server Status module
+* Fix Fail2Ban default jail options
+* Added support for trusted proxy IP addresses
+
+#### 2.640 (May 4, 2026)
+* Add new nftables module with profiles, saved tables, and chains/sets management
+* Add new Nginx module with look and feel matching the Apache module
+* Add option to hide sensitive values (like passwords or tokens) from Webmin's request logs
+* Add custom ACME server support for Webmin SSL renewal
+* Add support for the latest MariaDB on Ubuntu 26.04
+* Add multi-statement SQL query support when executing inline in MySQL/MariaDB module
+* Add support for ext4 hidden inode quota mode
+* Add used space and usage percentage reporting for ZFS in the dashboard
+* Add mass enable and disable buttons for status monitors in the System and Server Status module
+* Update tiny ACME client to the latest version
+* Update DHCP default config for openSUSE 16 [#2678](https://github.com/webmin/webmin/issues/2678)
+* Fix to prevent bypassing two-factor authentication in RPC requests
+* Fix session cookies to use safer defaults
+* Fix handling of connections coming through a reverse proxy
+* Fix unsafe mailbox attachment handling in Mailbox module
+* Fix unsafe decoding of Outlook `winmail.dat` attachments
+* Fix Certbot standalone port conflicts
+* Fix to correctly preserve full quoted action parameters in the Fail2Ban jail editor [#2647](https://github.com/webmin/webmin/issues/2647)
+* Fix Fail2Ban default jail options to preserve required timing defaults when saving
+* Fix ZFS to fall back to `df` when disk space cannot be computed from `zpool`
+* Fix to allow toggling process priority and I/O controls on or off
+* Fix issue where disabled email notifications were still being processed
+* Update Authentic theme to the latest version with various improvements and fixes:
+  - Upgrade stats history graphs from laggy SVG to a blazing-fast canvas renderer
+  - Add option to control corner roundness for the menu, content area and right-side slider
+  - Change the content area to use rounded corners and a margin by default
+  - Fix message of the day display in login page correctly [webmin#2555](https://github.com/webmin/webmin/issues/2685)
+  - Fix tooltip visibility in dark palette
+  - Fix session login button spinner
+  - Fix various button styling issues (active state, tiny buttons, airy buttons, stack position)
+
 #### 2.630 (March 24, 2026)
 * Add improvements to user input validation across all modules
 * Update Authentic theme to the latest version with various improvements and fixes:
@@ -542,7 +631,7 @@ This release adds automatic translations for all languages in UTF-8, updates the
 This release updates the built-in Let's Encrypt client, adds support for creating "safe-mode" Webmin users, support for CAA records in the BIND module, and the ability to search Postfix maps. It also updates the Authentic theme to the latest version, which includes numerous improvements to the File Manager and overall UI.
 
 #### Version 1.930 (August 18, 2019)
-These updates fix a [security vulnerability](http://webmin.com/security.html) and should be installed IMMEDIATELY by all users. Although it is not exploitable in a Webmin install with the default configuration, upgrading is strongly recommended.
+These updates fix a [security vulnerability](https://webmin.com/security/) and should be installed IMMEDIATELY by all users. Although it is not exploitable in a Webmin install with the default configuration, upgrading is strongly recommended.
 
 #### Version 1.920 (July 4, 2019)
 This update includes the latest theme version, translation updates, the ability to disable hosts file entries, easier monitoring of bootup actions, and a bunch of bugfixes.
@@ -875,4 +964,3 @@ This updated includes the latest Authentic theme, a new IPv6 Firewall module for
 #### Version 1.140
 * Fixed a security hole that allowed any user to view the configuration of any module, even those that they should not have access to.
 * Fixed a security hole that could allow an attacker to lock valid users by sending a bogus username or password.
-

README-zh.md

@@ -1,7 +1,7 @@
 ## 内容
 * [更新日志](https://github.com/webmin/webmin/blob/master/CHANGELOG.md)
 * [关于](#关于)
-* [安装](#安装)[<img src="https://github.com/webmin-devel/webmin/blob/master/media/download-23x14-stable.png?raw=true" title="稳定版">](http://webmin.com/download.html)[<img src="https://github.com/webmin-devel/webmin/blob/master/media/download-23x14-devel.png?raw=true" title="Development Versions">](http://webmin.com/devel.html)
+* [安装](#安装)[<img src="https://github.com/webmin-devel/webmin/blob/master/media/download-23x14-stable.png?raw=true" title="稳定版">](https://webmin.com/download.html)[<img src="https://github.com/webmin-devel/webmin/blob/master/media/download-23x14-devel.png?raw=true" title="Development Versions">](https://webmin.com/devel.html)
 * [文档](#文档)
 * [致谢](#致谢)
 * [许可](#许可)
@@ -26,11 +26,11 @@ Perl 5.10 或更高。
 ## 安装
 Webmin 可以两种方法安装：
 
- 1. 下载一个预编译包，可用于不同的发行版（CentOS, Fedora, SuSE, Mandriva, Debian, Ubuntu, Solaris 和 [其他发行版](http://www.webmin.com/support.html)）。[下载页面直达车](http://webmin.com/download.html);
+ 1. 下载一个预编译包，可用于不同的发行版（CentOS, Fedora, SuSE, Mandriva, Debian, Ubuntu, Solaris 和 [其他发行版](https://webmin.com/support.html)）。[下载页面直达车](https://webmin.com/download.html);
   <kbd>注：非常建议[在你的系统添加源](https://doxfer.webmin.com/Webmin/Installation)，这样可以自动更新</kbd>
 
- 2. 下载并解压[源码](https://prdownloads.sourceforge.net/webadmin/webmin-1.996.tar.gz)然后运行[_setup.sh_](http://www.webmin.com/tgz.html) 脚本，无需任何选项，也就是说会直接安装到当前目录。或者使用命令行参数，例如目标目录。
-  <kbd>注：如果你正在安装 Webmin [到Windows](http://www.webmin.com/windows.html) 系统上，你必须运行 `perl setup.pl` 命令。Windows 版能否正常运行取决于许多程序，和可能不属于标准发行版的模块。你需要 _process.exe_ 命令， _sc.exe_ 命令，以及 _Win32::Daemon_ Perl 模块。</kbd>
+ 2. 下载并解压[源码](https://prdownloads.sourceforge.net/webadmin/webmin-1.996.tar.gz)然后运行[_setup.sh_](https://webmin.com/tgz.html) 脚本，无需任何选项，也就是说会直接安装到当前目录。或者使用命令行参数，例如目标目录。
+  <kbd>注：如果你正在安装 Webmin [到Windows](https://webmin.com/windows.html) 系统上，你必须运行 `perl setup.pl` 命令。Windows 版能否正常运行取决于许多程序，和可能不属于标准发行版的模块。你需要 _process.exe_ 命令， _sc.exe_ 命令，以及 _Win32::Daemon_ Perl 模块。</kbd>
 
 ## 文档
 完整的 Webmin 还有它所有模块的详细配置都在[维基页面](https://doxfer.webmin.com/Webmin/Main_Page).
@@ -39,7 +39,7 @@ Webmin 可以两种方法安装：
 
 ### 首席开发者
 
-* [Jamie Cameron](http://www.webmin.com/about.html) [![](https://github.com/webmin-devel/webmin/blob/master/media/linkedin-15x15.png?raw=true)](https://www.linkedin.com/in/jamiecameron2)
+* [Jamie Cameron](https://webmin.com/about.html) [![](https://github.com/webmin-devel/webmin/blob/master/media/linkedin-15x15.png?raw=true)](https://www.linkedin.com/in/jamiecameron2)
 
 ### 贡献者
 

README.md

@@ -45,7 +45,7 @@ For detailed installation instructions check our guide on [webmin.com/download](
 
 ### Lead developer
 
-* [Jamie Cameron](https://www.webmin.com/about.html) [![](https://github.com/webmin-devel/webmin/blob/master/media/linkedin-15x15.png?raw=true)](https://www.linkedin.com/in/jamiecameron2)
+* [Jamie Cameron](https://webmin.com/about.html) [![](https://github.com/webmin-devel/webmin/blob/master/media/linkedin-15x15.png?raw=true)](https://www.linkedin.com/in/jamiecameron2)
 
 ### Developers
 * [Ilia Rostovtsev](https://github.com/iliaross)

acl/acl-lib.pl

@@ -11,7 +11,7 @@ Library for editing webmin users, passwords and access rights.
 
 =cut
 
-BEGIN { push(@INC, ".."); };
+BEGIN { push(@INC, ".."); };    ## no critic
 use strict;
 use warnings;
 no warnings 'redefine';
@@ -92,7 +92,6 @@ while(my $l = <$fh>) {
 		$user{'locale'} = $gconfig{"locale_$user[0]"};
 		$user{'dateformat'} = $gconfig{"dateformat_$user[0]"};
 		$user{'notabs'} = $gconfig{"notabs_$user[0]"};
-		$user{'rbacdeny'} = $gconfig{"rbacdeny_$user[0]"};
 		if ($gconfig{"theme_$user[0]"}) {
 			($user{'theme'}, $user{'overlay'}) =
 				split(/\s+/, $gconfig{"theme_$user[0]"});
@@ -353,7 +352,8 @@ each of which is a hash reference in the same format as their module.info files.
 sub list_module_infos
 {
 my @mods = grep { &check_os_support($_) } &get_all_module_infos();
-return sort { $a->{'desc'} cmp $b->{'desc'} } @mods;
+my @sorted = sort { $a->{'desc'} cmp $b->{'desc'} } @mods;
+return @sorted;
 }
 
 =head2 create_user(&details, [clone])
@@ -501,8 +501,6 @@ else {
 	$gconfig{"lang_".$user->{'name'}} = $user->{'lang'} if ($user->{'lang'});
 	delete($gconfig{"notabs_".$user->{'name'}});
 	$gconfig{"notabs_".$user->{'name'}} = $user->{'notabs'} if ($user->{'notabs'});
-	delete($gconfig{"rbacdeny_".$user->{'name'}});
-	$gconfig{"rbacdeny_".$user->{'name'}} = $user->{'rbacdeny'} if ($user->{'rbacdeny'});
 	delete($gconfig{"ownmods_".$user->{'name'}});
 	$gconfig{"ownmods_".$user->{'name'}} = join(" ", @{$user->{'ownmods'}})
 		if ($user->{'ownmods'} && @{$user->{'ownmods'}});
@@ -722,9 +720,6 @@ else {
 	delete($gconfig{"notabs_".$username});
 	$gconfig{"notabs_".$user->{'name'}} = $user->{'notabs'}
 		if ($user->{'notabs'});
-	delete($gconfig{"rbacdeny_".$username});
-	$gconfig{"rbacdeny_".$user->{'name'}} = $user->{'rbacdeny'}
-		if ($user->{'rbacdeny'});
 	delete($gconfig{"ownmods_".$username});
 	$gconfig{"ownmods_".$user->{'name'}} = join(" ", @{$user->{'ownmods'}})
 		if ($user->{'ownmods'} && @{$user->{'ownmods'}});
@@ -1337,12 +1332,12 @@ my ($miniserv) = @_;
 my $sfile = $miniserv->{'sessiondb'} ? $miniserv->{'sessiondb'} :
 	    $miniserv->{'pidfile'} =~ /^(.*)\/[^\/]+$/ ? "$1/sessiondb"
 						     : return;
-eval "use SDBM_File";
+eval { require SDBM_File; SDBM_File->import; 1 };
 dbmopen(%sessiondb, $sfile, 0700);
 eval { $sessiondb{'1111111111'} = 'foo bar' };
 if ($@) {
 	dbmclose(%sessiondb);
-	eval "use NDBM_File";
+	eval { require NDBM_File; NDBM_File->import; 1 };
 	dbmopen(%sessiondb, $sfile, 0700);
 	}
 else {
@@ -1428,16 +1423,158 @@ Creates a new session ID that's already logged in as the given user
 sub create_session_user
 {
 my ($miniserv, $username, $lifetime) = @_;
-return undef if (&is_readonly_mode());
+return if (&is_readonly_mode());
 &open_session_db($miniserv);
 my $sid = &generate_random_session_id();
-return undef if (!$sid);
+return if (!$sid);
 my $t = time();
 $sessiondb{$sid} = "$username $t 127.0.0.1".($lifetime ? " ".$lifetime : "");
 dbmclose(%sessiondb);
 return $sid;
 }
 
+=head2 set_module_access(&modules, enabled, [&users-groups])
+
+Grants or revokes Webmin module access for users and groups. The modules
+parameter must be an array ref of module names. The enabled flag should be
+1 to grant access, or 0 to revoke access. If the users-groups parameter is
+not given, all users and groups are updated. Otherwise, it must be an array
+ref of usernames and group names. Group names may be prefixed with @ to
+target only a group.
+
+Returns the number of directly updated user and group records.
+
+=cut
+sub set_module_access
+{
+my ($mods, $enabled, $usersgroups) = @_;
+$mods ||= [];
+return 0 if (!@$mods);
+my $set_module_access_list = sub {
+	my ($obj, $key, $addmods) = @_;
+	$addmods ||= $mods;
+	my @old = @{$obj->{$key} || []};
+	my @new;
+	if ($enabled) {
+		@new = &unique(@old, @$addmods);
+		}
+	else {
+		my %remove = map { $_, 1 } @$mods;
+		@new = grep { !$remove{$_} } @old;
+		}
+	return 0 if (join("\0", @old) eq join("\0", @new));
+	$obj->{$key} = \@new;
+	return 1;
+	};
+my $own_module_updates = sub {
+	my ($obj, $inherited) = @_;
+	return $mods if (!$enabled);
+	return [] if (!@{$obj->{'ownmods'} || []} && !@$inherited);
+	return [ grep { &indexof($_, @$inherited) < 0 } @$mods ];
+	};
+my @users = &list_users();
+my @groups = &list_groups();
+my $all = !defined($usersgroups);
+my (%target_user, %target_group);
+if (!$all) {
+	foreach my $ug (@$usersgroups) {
+		if ($ug =~ /^\@(.*)$/) {
+			$target_group{$1} = 1;
+			}
+		else {
+			$target_user{$ug} = 1;
+			$target_group{$ug} = 1;
+			}
+		}
+	}
+my $changed = 0;
+my (%user_group, %group_parent);
+foreach my $g (@groups) {
+	foreach my $m (@{$g->{'members'} || []}) {
+		if ($m =~ /^\@(.*)$/) {
+			$group_parent{$1} = $g;
+			}
+		else {
+			$user_group{$m} = $g;
+			}
+		}
+	}
+my (@ordered_groups, %ordered_group, %ordering_group);
+my $add_ordered_group;
+$add_ordered_group = sub {
+	my ($g) = @_;
+	return if (!$g || $ordered_group{$g->{'name'}});
+	return if ($ordering_group{$g->{'name'}}++);
+	$add_ordered_group->($group_parent{$g->{'name'}});
+	delete($ordering_group{$g->{'name'}});
+	push(@ordered_groups, $g);
+	$ordered_group{$g->{'name'}}++;
+	};
+foreach my $g (@groups) {
+	$add_ordered_group->($g);
+	}
+
+# Update groups first, so member users and sub-groups inherit the new set
+foreach my $g (@ordered_groups) {
+	next if (!$all && !$target_group{$g->{'name'}});
+	my $gchanged = 0;
+	my $parent = $group_parent{$g->{'name'}};
+	my $ownmods = $own_module_updates->(
+		$g, [ @{$parent ? $parent->{'modules'} || [] : []} ]);
+	$gchanged += $set_module_access_list->($g, "modules");
+	$gchanged += $set_module_access_list->($g, "ownmods", $ownmods);
+	if ($gchanged) {
+		&modify_group($g->{'name'}, $g);
+		&update_members(\@users, \@groups, $g->{'modules'},
+				$g->{'members'});
+		$changed++;
+		}
+	}
+
+# Update directly targeted users
+foreach my $u (@users) {
+	next if (!$all && !$target_user{$u->{'name'}});
+	my $uchanged = 0;
+	my $group = $user_group{$u->{'name'}};
+	my $ownmods = $own_module_updates->(
+		$u, [ @{$group ? $group->{'modules'} || [] : []} ]);
+	$uchanged += $set_module_access_list->($u, "modules");
+	$uchanged += $set_module_access_list->($u, "ownmods", $ownmods);
+	if ($uchanged) {
+		&modify_user($u->{'name'}, $u);
+		$changed++;
+		}
+	}
+
+if ($changed) {
+	undef(%main::acl_hash_cache);
+	undef(%main::acl_array_cache);
+	}
+return $changed;
+}
+
+=head2 enable_module_access(&modules, [&users-groups])
+
+Grants users and groups access to one or more modules. This is a wrapper
+around set_module_access.
+
+=cut
+sub enable_module_access
+{
+return &set_module_access($_[0], 1, $_[1]);
+}
+
+=head2 disable_module_access(&modules, [&users-groups])
+
+Revokes users and groups access to one or more modules. This is a wrapper
+around set_module_access.
+
+=cut
+sub disable_module_access
+{
+return &set_module_access($_[0], 0, $_[1]);
+}
+
 =head2 update_members(&allusers, &allgroups, &modules, &members)
 
 Update the modules for members users and groups of some group. The parameters
@@ -1699,7 +1836,7 @@ elsif (&has_command("ssleay")) {
 	return &has_command("ssleay");
 	}
 else {
-	return undef;
+	return;
 	}
 }
 
@@ -1815,6 +1952,7 @@ foreach my $g (&list_groups()) {
 		return $g;
 		}
 	}
+return;
 }
 
 =head2 check_password_restrictions(username, password)
@@ -1859,7 +1997,7 @@ if ($miniserv{'pass_oldblock'} && $user) {
 		last if ($c++ > $miniserv{'pass_oldblock'});
 		}
 	}
-return undef;
+return;
 }
 
 =head2 hash_session_id(sid)
@@ -1896,11 +2034,11 @@ my $use_md5 = &md5_perl_module();
 $use_md5 || &error("No Perl MD5 hashing module found!");
 
 # Add the password
-my $ctx = eval "new $use_md5";
+my $ctx = $use_md5->new;
 $ctx->add($passwd);
 
 # Add some more stuff from the hash of the password and salt
-my $ctx1 = eval "new $use_md5";
+my $ctx1 = $use_md5->new;
 $ctx1->add($passwd);
 $ctx1->add($passwd);
 my $final = $ctx1->digest();
@@ -1949,12 +2087,12 @@ Returns a Perl module for MD5 hashing, or undef if none.
 sub md5_perl_module
 {
 my $use_md5;
-eval "use MD5";
+eval { require MD5; MD5->import; 1 };
 if (!$@) {
         $use_md5 = "MD5";
         }
 else {
-        eval "use Digest::MD5";
+        eval { require Digest::MD5; Digest::MD5->import; 1 };
         if (!$@) {
                 $use_md5 = "Digest::MD5";
                 }
@@ -2111,16 +2249,16 @@ my ($str, $notablecheck) = @_;
 my ($proto, $user, $pass, $host, $prefix, $args) = &split_userdb_string($str);
 if ($proto eq "mysql" || $proto eq "postgresql") {
 	# Load DBI driver
-	eval 'use DBI;';
+	eval { require DBI; DBI->import; 1 };
 	return &text('sql_emod', 'DBI') if ($@);
 	if ($proto eq "mysql") {
-		eval 'use DBD::mysql;';
+		eval { require DBD::mysql; DBD::mysql->import; 1 };
 		return &text('sql_emod', 'DBD::mysql') if ($@);
 		my $drh = DBI->install_driver("mysql");
 		return $text{'sql_emysqldriver'} if (!$drh);
 		}
 	else {
-		eval 'use DBD::Pg;';
+		eval { require DBD::Pg; DBD::Pg->import; 1 };
 		return &text('sql_emod', 'DBD::Pg') if ($@);
 		my $drh = DBI->install_driver("Pg");
 		return $text{'sql_epostgresqldriver'} if (!$drh);
@@ -2152,11 +2290,11 @@ if ($proto eq "mysql" || $proto eq "postgresql") {
 			}
 		}
 	&disconnect_userdb($str, $dbh);
-	return undef;
+	return;
 	}
 elsif ($proto eq "ldap") {
 	# Load LDAP module
-	eval 'use Net::LDAP;';
+	eval { require Net::LDAP; Net::LDAP->import; 1 };
 	return &text('sql_emod', 'Net::LDAP') if ($@);
 
 	# Try to connect
@@ -2190,7 +2328,7 @@ elsif ($proto eq "ldap") {
 		$found || return &text('sql_eldapdn', $prefix);
 		}
 	&disconnect_userdb($str, $dbh);
-	return undef;
+	return;
 	}
 else {
 	return "Unknown user database type $proto";
@@ -2284,8 +2422,8 @@ if (!$miniserv) {
 	$miniserv = { };
 	&get_miniserv_config($miniserv);
 	}
-foreach $a (split(/\s+/, $miniserv->{'anonymous'})) {
-        if ($a =~ /^([^=]+)=(\S+)$/ && $2 eq $user) {
+foreach my $tok (split(/\s+/, $miniserv->{'anonymous'})) {
+        if ($tok =~ /^([^=]+)=(\S+)$/ && $2 eq $user) {
 		push(@rv, $1);
 		}
 	}
@@ -2299,7 +2437,7 @@ sub get_safe_acl
 my ($m) = @_;
 my $mdir = &module_root_directory($m);
 my %rv;
-&read_file_cached("$mdir/safeacl", \%rv) || return undef;
+&read_file_cached("$mdir/safeacl", \%rv) || return;
 return \%rv;
 }
 
@@ -2313,17 +2451,19 @@ sub generate_random_session_id
 my $sid;
 
 # Try /dev/urandom, but with a timeout
-$SIG{ALRM} = sub { close(RANDOM) };
+my $randomfh;
+$SIG{ALRM} = sub { close($randomfh) if ($randomfh) };
 alarm(5);
-if (open(RANDOM, "/dev/urandom")) {
+if (open($randomfh, "<", "/dev/urandom")) {
 	my $tmpsid;
-	if (read(RANDOM, $tmpsid, 16) == 16) {
+	if (read($randomfh, $tmpsid, 16) == 16) {
 		$sid = lc(unpack('h*',$tmpsid));
 		if ($sid !~ /^[0-9a-fA-F]{32}$/) {
 			$sid = 'bad';
 			}
 		}
-	close(RANDOM);
+	close($randomfh);
+	undef($randomfh);
 	}
 alarm(0);
 
@@ -2341,7 +2481,7 @@ return $sid eq 'bad' ? undef : $sid;
 # Generate an ID string that can be used for a password reset link
 sub generate_random_id
 {
-if (open(my $RANDOM, "</dev/urandom")) {
+if (open(my $RANDOM, "<", "/dev/urandom")) {
 	my $sid;
 	my $tmpsid;
 	if (read($RANDOM, $tmpsid, 16) == 16) {
@@ -2350,7 +2490,9 @@ if (open(my $RANDOM, "</dev/urandom")) {
 	close($RANDOM);
 	return $sid;
 	}
-return undef;
+# Explicit undef: callers consume this in hash-literal value position,
+# where bare 'return' would yield () and shift the surrounding pairing.
+return undef;    ## no critic (ProhibitExplicitReturnUndef)
 }
 
 # obsfucate_email(email)
@@ -2368,4 +2510,3 @@ return $mailbox."\@".join(".", @doms);
 }
 
 1;
-

acl/backup_config.pl

@@ -3,7 +3,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require 'acl-lib.pl';
+require 'acl-lib.pl';    ## no critic
 our ($config_directory, %gconfig);
 
 # backup_config_files()
@@ -43,7 +43,7 @@ return @rv;
 # Called before the files are actually read
 sub pre_backup
 {
-return undef;
+return;
 }
 
 # post_backup(&files)
@@ -52,7 +52,7 @@ sub post_backup
 {
 unlink("$config_directory/config.aclbackup");
 unlink("$config_directory/miniserv.conf.aclbackup");
-return undef;
+return;
 }
 
 # pre_restore(&files)
@@ -66,7 +66,7 @@ foreach my $u (&list_users(), &list_groups()) {
 		       glob("$config_directory/*/$u->{'name'}.acl"));
 		}
 	}
-return undef;
+return;
 }
 
 # post_restore(&files)
@@ -101,7 +101,7 @@ foreach my $k (keys %aclbackup) {
 &put_miniserv_config(\%miniserv);
 
 &restart_miniserv();
-return undef;
+return;
 }
 
 1;

acl/cert_form.cgi

@@ -5,11 +5,11 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access);
 &ui_print_header(undef, $text{'cert_title'}, "", undef, undef, undef, undef,
 		 undef, undef, "language=VBSCRIPT onload='postLoad()'");
-eval "use Net::SSLeay";
+eval { require Net::SSLeay; Net::SSLeay->import; 1 };
 
 print "<p>$text{'cert_msg'}<p>\n";
 if ($ENV{'SSL_USER'}) {

acl/cert_issue.cgi

@@ -5,7 +5,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access, $module_config_directory, $base_remote_user);
 &ReadParse();
 

acl/cert_output.cgi

@@ -5,7 +5,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access);
 
 &ReadParse();

acl/cgi_args.pl

@@ -27,5 +27,5 @@ elsif ($cgi eq 'edit_acl.cgi') {
 		}
 	return 'none';
 	}
-return undef;
+return;
 }

acl/convert.cgi

@@ -6,7 +6,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access, $config_directory);
 &ReadParse();
 &error_setup($text{'convert_err'});

acl/convert_form.cgi

@@ -6,7 +6,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access);
 $access{'sync'} && $access{'create'} || &error($text{'convert_ecannot'});
 &ui_print_header(undef, $text{'convert_title'}, "");

acl/defaultacl

@@ -19,7 +19,6 @@ sessions=1
 cats=1
 ips=1
 switch=1
-rbacenable=1
 logouttime=1
 times=1
 minsize=1

acl/delete_group.cgi

@@ -6,7 +6,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access, $base_remote_user);
 &ReadParse();
 &error_setup($text{'gdelete_err'});

acl/delete_groups.cgi

@@ -5,7 +5,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access, $base_remote_user);
 &ReadParse();
 &error_setup($text{'gdeletes_err'});

acl/delete_session.cgi

@@ -6,7 +6,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access, %sessiondb);
 &ReadParse();
 $access{'sessions'} || &error($text{'sessions_ecannot'});

acl/delete_user.cgi

@@ -6,7 +6,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access, $base_remote_user);
 &ReadParse();
 &error_setup($text{'delete_err'});

acl/delete_users.cgi

@@ -5,7 +5,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access, $base_remote_user);
 &ReadParse();
 &error_setup($in{'joingroup'} ? $text{'udeletes_jerr'} : $text{'udeletes_err'});

acl/edit_acl.cgi

@@ -6,7 +6,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access, $base_remote_user, %gconfig);
 &ReadParse();
 $access{'acl'} || &error($text{'acl_emod'});
@@ -48,15 +48,6 @@ else {
 	}
 print &ui_table_start(&text('acl_options', $minfo{'desc'}), "width=100%", 4);
 
-if ($in{'mod'} && $in{'user'} && &supports_rbac($in{'mod'}) &&
-    !$gconfig{'rbacdeny_'.$who}) {
-	# Show RBAC option
-	print &ui_table_row($text{'acl_rbac'},
-		&ui_radio("rbac", $maccess{'rbac'} ? 1 : 0,
-			[ [ 1, $text{'acl_rbacyes'} ],
-			  [ 0, $text{'no'} ] ]), 3);
-	}
-
 # Load custom ACL library
 my $mdir = &module_root_directory($in{'mod'});
 if (-r "$mdir/acl_security.pl") {

acl/edit_group.cgi

@@ -6,7 +6,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access, $config_directory);
 &ReadParse();
 $access{'groups'} || &error($text{'gedit_ecannot'});

acl/edit_pass.cgi

@@ -5,7 +5,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access);
 $access{'pass'} || &error($text{'pass_ecannot'});
 &ui_print_header(undef, $text{'pass_title'}, "");

acl/edit_rbac.cgi

@@ -1,32 +0,0 @@
-#!/usr/local/bin/perl
-# Show RBAC status
-
-use strict;
-use warnings;
-no warnings 'redefine';
-no warnings 'uninitialized';
-require './acl-lib.pl';
-our (%in, %text, %gconfig, %access, $module_name, $module_root_directory);
-$access{'rbacenable'} || &error($text{'rbac_ecannot'});
-&ui_print_header(undef, $text{'rbac_title'}, "");
-
-print "$text{'rbac_desc'}<p>\n";
-if ($gconfig{'os_type'} ne 'solaris') {
-	print &text('rbac_esolaris', $gconfig{'real_os_type'}),"<p>\n";
-	}
-elsif (!&supports_rbac()) {
-	if (&foreign_available("cpan")) {
-		print &text('rbac_eperl', "<tt>Authen::SolarisRBAC</tt>",
-			    "../cpan/download.cgi?source=0&local=$module_root_directory/Authen-SolarisRBAC-0.1.tar.gz&mode=2&return=/$module_name/&returndesc=".&urlize($text{'index_return'})),"<p>\n";
-		}
-	else {
-		print &text('rbac_ecpan', "<tt>Authen::SolarisRBAC</tt>"),
-		      "<p>\n";
-		}
-	}
-else {
-	print "$text{'rbac_ok'}<p>\n";
-	}
-
-&ui_print_footer("", $text{'index_return'});
-

acl/edit_sql.cgi

@@ -5,7 +5,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access);
 $access{'sql'} || &error($text{'sql_ecannot'});
 &ui_print_header(undef, $text{'sql_title'}, "");

acl/edit_sync.cgi

@@ -6,7 +6,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access);
 $access{'sync'} && $access{'create'} && $access{'delete'} ||
 	&error($text{'sync_ecannot'});

acl/edit_unix.cgi

@@ -7,7 +7,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access);
 $access{'unix'} && $access{'create'} && $access{'delete'} ||
 	&error($text{'unix_ecannot'});

acl/edit_user.cgi

@@ -6,7 +6,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %gconfig, %access, $config_directory, $base_remote_user, $remote_user);
 &foreign_require("webmin", "webmin-lib.pl");
 
@@ -42,6 +42,11 @@ else {
 				      : $text{'edit_title2'}, "");
 	}
 my $me = &get_user($base_remote_user);
+my %uaccess = &get_module_acl($in{'user'} || "", "", 1);
+if (!$in{'user'} && $uaccess{'rpc'} == 2) {
+	# Don't offer the confusing 'root' or 'admin' RPC option by default
+	$uaccess{'rpc'} = 0;
+	}
 
 # Give up if readonly
 if ($user{'readonly'} && !$in{'readwrite'}) {
@@ -210,7 +215,10 @@ if ($access{'lang'}) {
 
 if ($access{'locale'}) {
 	# Current locale
-	eval "use DateTime; use DateTime::Locale; use DateTime::TimeZone;";
+	eval { require DateTime; DateTime->import;
+	       require DateTime::Locale; DateTime::Locale->import;
+	       require DateTime::TimeZone; DateTime::TimeZone->import;
+	       1 };
 	if (!$@ && $] > 5.011) {
 		my $locales = &list_locales();
 		my %localesrev = reverse %{$locales};
@@ -280,7 +288,7 @@ if ($showui) {
 # Start of security options section
 my $showsecurity = $access{'logouttime'} || $access{'ips'} ||
 		   $access{'minsize'} ||
-		   &supports_rbac() && $access{'mode'} == 0 || $access{'times'};
+		   $access{'times'};
 if ($showsecurity) {
 	print &ui_hidden_table_start($text{'edit_security'}, "width=100%", 2,
 				     "security", 0, [ "width=30%" ]);
@@ -321,14 +329,6 @@ if ($access{'ips'}) {
 		    4, 30));
 	}
 
-if (&supports_rbac() && $access{'mode'} == 0) {
-	# Deny access to modules not managed by RBAC?
-	print &ui_table_row($text{'edit_rbacdeny'},
-		&ui_radio("rbacdeny", $user{'rbacdeny'} ? 1 : 0,
-			  [ [ 0, $text{'edit_rbacdeny0'} ],
-			    [ 1, $text{'edit_rbacdeny1'} ] ]));
-	}
-
 if ($access{'times'}) {
 	# Show allowed days of the week
 	my %days = map { $_, 1 } split(/,/, $user{'days'} || '');
@@ -371,6 +371,16 @@ elsif ($miniserv{'twofactor_provider'}) {
 		&ui_submit($text{'edit_twofactoradd'}, "twofactor"));
 	}
 
+# Can accept RPC calls?
+if ($access{'acl'} && !$safe) {
+	print &ui_table_row(&hlink($text{'acl_rpc'}, 'rpc'),
+		&ui_radio("rpc", int($uaccess{'rpc'}),
+			  [ [ 1, $text{'acl_rpc1'} ],
+			    $uaccess{'rpc'} == 2 ? ( [ 2, $text{'acl_rpc2'} ] ) : ( ),
+			    [ 3, $text{'acl_rpc3'} ],
+			    [ 0, $text{'acl_rpc0'} ] ]));
+	}
+
 print &ui_hidden_table_end("security");
 
 # Work out which modules can be selected
@@ -450,11 +460,9 @@ print &ui_hidden_table_end("mods");
 
 # Add global ACL section, but only if not set from the group
 my $groupglobal = $memg && -r "$config_directory/$memg->{'name'}.acl";
-if ($access{'acl'} && !$groupglobal && $in{'user'} && !$safe) {
+if ($access{'acl'} && !$groupglobal && !$safe) {
 	print &ui_hidden_table_start($text{'edit_global'}, "width=100%", 2,
 				     "global", 0, [ "width=30%" ]);
-	my %uaccess;
-	%uaccess = &get_module_acl($in{'user'}, "", 1);
 	print &ui_hidden("acl_security_form", 1);
 	&foreign_require("", "acl_security.pl");
 	&foreign_call("", "acl_security_form", \%uaccess);

acl/forgot_form.cgi

@@ -5,7 +5,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text);
 &foreign_require("webmin");
 &error_setup($text{'forgot_err'});

acl/forgot_send.cgi

@@ -5,7 +5,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %gconfig);
 &foreign_require("webmin");
 &error_setup($text{'forgot_err'});

acl/help/rpc.html

@@ -0,0 +1,14 @@
+<header>Can accept RPC calls?</header>
+
+This option determines if the user can make use of Webmin's poweful RPC calls
+feature, which is designed to allow this system to be controlled by a script
+or other Webmin server via HTTP. Because the RPC feature does <b>not</b>
+respect any module grants or fine-grained access controls, this option should
+only be enabled for fully trusted <tt>root</tt>-equivalent users. <p>
+
+In addition, if the <b>RPC calls only</b> option is selected, the user will not
+be able to use the Webmin UI. This is useful for creating a separate login with
+a longer password for RPC purposes only, as two-factor authentication cannot be
+used when making RPC calls. <p>
+
+<footer>

acl/index.cgi

@@ -6,7 +6,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %gconfig, %access, $base_remote_user);
 &ReadParse();
 &ui_print_header(undef, $text{'index_title'}, "", undef, 1, 1);
@@ -206,11 +206,6 @@ if (uc($ENV{'HTTPS'}) eq "ON" && $miniserv{'ca'}) {
 push(@icons, "images/twofactor.gif");
 push(@links, "twofactor_form.cgi");
 push(@titles, $text{'index_twofactor'});
-if ($access{'rbacenable'} && $gconfig{'os_type'} eq 'solaris') {
-	push(@icons, "images/rbac.gif");
-	push(@links, "edit_rbac.cgi");
-	push(@titles, $text{'index_rbac'});
-	}
 if ($access{'pass'}) {
 	push(@icons, "images/pass.gif");
 	push(@links, "edit_pass.cgi");

acl/lang/en

@@ -23,7 +23,6 @@ index_modgroups=Modules from group $1
 index_sync=Configure Unix User Synchronization
 index_unix=Configure Unix User Authentication
 index_sessions=View Login Sessions
-index_rbac=Setup RBAC
 index_delete=Delete Selected
 index_joingroup=Add To Group:
 index_eulist=Failed to list users : $1
@@ -95,9 +94,6 @@ edit_switch=Switch to User
 edit_forgot=Send Password Reset Link
 edit_return=Webmin user
 edit_return2=Webmin group
-edit_rbacdeny=RBAC access mode
-edit_rbacdeny0=RBAC only controls selected module ACLs
-edit_rbacdeny1=RBAC controls all modules and ACLs
 edit_global=Permissions for all modules
 edit_templock=Temporarily locked
 edit_temppass=Force change at next login
@@ -185,8 +181,6 @@ acl_title3=For group $1 in $2
 acl_options=$1 access control options
 acl_config=Can edit module configuration?
 acl_reset=Reset To Full Access
-acl_rbac=Get access control settings from RBAC?
-acl_rbacyes=Yes (overrides settings below)
 
 acl_uall=All users
 acl_uthis=This user
@@ -382,13 +376,6 @@ hide_clone=(Clone $1)
 switch_euser=You are not allowed to switch to this user
 switch_eold=Existing session not found!
 
-rbac_title=Setup RBAC
-rbac_desc=Webmin's RBAC integration provides a way for user module and ACL permissions to be determined from an RBAC (Role Based Access Control) database, rather than Webmin's own configuration files. Once RBAC support is enabled, any user for whom the <b>RBAC controls all modules and ACLs</b> option is selected will have his capabilities determined by RBAC rather than Webmin's own access control settings.
-rbac_esolaris=RBAC is only supported on Solaris at the moment, and so cannot be used on this $1 system.
-rbac_eperl=The Perl module $1 needed for RBAC integration is not installed. <a href='$2'>Click here</a> to have it installed now.
-rbac_ecpan=You do not have access to Webmin's Perl Modules page in order to install the necessary $1 module for RBAC integration.
-rbac_ok=RBAC integration is available on this system, and can be enabled on a per-user basis on the Edit Webmin User page.
-
 udeletes_err=Failed to delete users
 udeletes_jerr=Failed to add users to group
 udeletes_enone=None selected

acl/lang/no

@@ -1,9 +1,9 @@
 index_title=Webmin Brukere
 index_user=Brukere
 index_modules=Moduler
-index_create=Opprett ny Webmin bruker
+index_create=Opprett ny Webmin-bruker
 index_screate=Opprett ny sikker bruker
-index_convert=Konverter Unix til Webmin brukere
+index_convert=Konverter Unix til Webmin-brukere
 index_cert=Krever SSL sertifikat
 index_twofactor=To-faktor autentisering
 index_certmsg=Klikk på denne knappen for å spørre etter et SSL sertifikat som vil gi deg sikker login i Webmin uten å måtte skrive brukernavn og passord.
@@ -14,7 +14,7 @@ index_global=Global ACL
 index_users=Webmin Brukere
 index_groups=Webmin Grupper
 index_group=Gruppe
-index_nousers=Ingen editerbar Webmin bruker er definert.
+index_nousers=Ingen editerbar Webmin-bruker er definert.
 index_nogroups=Ingen editerbar Webmin gruppe er definert.
 index_gcreate=Lag en ny Webmin gruppe
 index_members=Medlemmer
@@ -30,11 +30,11 @@ index_eglist=Kunne ikke liste grupper : $1
 
 edit_title=Rediger Webmin Bruker
 edit_title2=Lag Webmin Bruker
-edit_title3=Opprett sikker Webmin bruker
-edit_readonly=Denne Webmin brukeren bør ikke redigeres siden den vedlikeholdes av modulen $1. <a href='$2'>Klikk her</a> for å ignorere denne advarselen og redigere brukeren allikevel - men vær oppmerksom på at manuelle endringer kan bli overskrevet!
-edit_rights=Tilgangsrettigheter for Webmin bruker
+edit_title3=Opprett sikker Webmin-bruker
+edit_readonly=Denne Webmin-brukeren bør ikke redigeres siden den vedlikeholdes av modulen $1. <a href='$2'>Klikk her</a> for å ignorere denne advarselen og redigere brukeren allikevel - men vær oppmerksom på at manuelle endringer kan bli overskrevet!
+edit_rights=Tilgangsrettigheter for Webmin-bruker
 edit_user=Brukernavn
-edit_cloneof=Klober Webmin bruker
+edit_cloneof=Klober Webmin-bruker
 edit_real=Virkelig navn
 edit_group=Medlem av gruppe
 edit_pass=Passord
@@ -89,7 +89,7 @@ edit_selall=Velg alle
 edit_invert=Inverter valg
 edit_hide=Skjul ubrukte
 edit_switch=Bytt til bruker
-edit_return=Webmin bruker
+edit_return=Webmin-bruker
 edit_return2=Webmin gruppe
 edit_rbacdeny=RBAC tilgangsmodus
 edit_rbacdeny0=RBAC kontrollerer valgte modul ACLer
@@ -126,21 +126,21 @@ save_eoverlay=Et tema-overlegg kan ikke velges med mindre et tema er
 save_edeny=Du kan ikke nekte deg selv tilgang til Webmin Bruker modulen
 save_eos=Det samme som Unix passord opsjonen er ikke støttet på ditt operativsystem.
 save_emd5=Det samme som Unix passord opsjonen kan ikke brukes på systemer med MD5 kryptering
-save_eunix=Unix bruker '$1' eksisterer ikke
+save_eunix=Unix-brukeren '$1' eksisterer ikke
 save_emod=Du kan ikke bevilge tilgang til modul '$1'
 save_ecreate=Du har ikke tilgang til å opprette brukere
-save_euser=Du har ikke tilgang til å editere denne brukeren
+save_euser=Du har ikke tilgang til å redigere denne brukeren
 save_ecolon=Passord kan ikke inneholde : karakteren
 save_epass=Passord er ikke gyldig : $1
-save_eself=Din vanlige IP adresse ($1) vil bli nektet
+save_eself=Din vanlige IP-adresse ($1) vil bli nektet
 save_epam=PAM autentisering er ikke tilgjengelig fordi <tt>Authen::PAM</tt> Perl modulen ikke er installert eller ikke virker ordentlig.
 save_epam2=Du kan bruke Webmin's Perl Modules modul til <a href='$1'>laste ned å installere Authen::PAM</a> nå.
 save_egroup=Du har ikke rettigheter til å tildele til den gruppen
 save_enone=Ingen adresse er tastet inn
-save_enet='$1' er ikke en gyldig nettverks adresse
+save_enet='$1' er ikke en gyldig nettverksadresse
 save_emask='$1' er ikke en gyldig nettmaske
-save_eip='$1' er ikke en komplett IP eller nettverks adresse
-save_ehost=Kunne ikke finne IP adresse for '$1'
+save_eip='$1' er ikke en komplett IP eller nettverksadresse
+save_ehost=Kunne ikke finne IP-adresse for '$1'
 save_elogouttime=Manglende eller ikke-numerisk tid for utlogging ved inaktivitet
 save_eminsize=Manglende eller ikke-numerisk minimum passordlengde
 save_edays=Ingen tillatte dager valgt
@@ -223,11 +223,11 @@ acl_times=Kan endre tillatte innloggings-tider?
 acl_pass=Kan endre passord-begrensinger?
 acl_sql=Kan konfigurere databasen for brukere og grupper?
 
-log_modify=Modifisert Webmin bruker $1
-log_rename=Skiftet navn på Webmin bruker $1 til $2
-log_create=Opprettet Webmin bruker $1
-log_clone=Klonet Webmin bruker $1 til $2
-log_delete=Slettet Webmin bruker $1
+log_modify=Modifisert Webmin-bruker $1
+log_rename=Skiftet navn på Webmin-bruker $1 til $2
+log_create=Opprettet Webmin-bruker $1
+log_clone=Klonet Webmin-bruker $1 til $2
+log_delete=Slettet Webmin-bruker $1
 log_acl=Oppdatert tilgang for $1 i $2
 log_reset=Tilbakestilte tilgang for $1 i $2
 log_cert=Utlevert sertifikat for bruker $1
@@ -235,10 +235,10 @@ log_modify_g=Modifisert Webmin gruppe $1
 log_rename_g=Forandret navn på Webmin gruppe $1 til $2
 log_create_g=Opprettet Webmin gruppe $1
 log_delete_g=Slettet Webmin gruppe $1
-log_switch=Byttet til Webmin bruker $1
-log_delete_users=Slettet $1 Webmin brukere
+log_switch=Byttet til Webmin-bruker $1
+log_delete_users=Slettet $1 Webmin-brukere
 log_delete_groups=Slettet $1 Webmin grupper
-log_joingroup=La til $1 Webmin brukere i gruppe $2
+log_joingroup=La til $1 Webmin-brukere i gruppe $2
 log_pass=Endret passord-begrensinger
 log_unix=Endret unix bruker-autentisering
 log_sync=Endret unix bruker-synkronisering
@@ -273,7 +273,7 @@ gsave_edesc=Ugyldig beskrivelse - tegnet : er ikke tillatt
 convert_title=Konverter Brukere
 convert_ecannot=Du har ikke tilgang til å konvertere Unix brukere
 convert_nogroups=Ingen Webmin gruppe er definert på ditt system. Du må i det minste lage en gruppe før du konverterer brukere, dette for å kunne sette rettigheter for konverterte brukere.
-convert_desc=Denne Dette feltet lar deg konvertere eksisterende Unix brukere til Webmin brukere. Rettighetene til hver nye Webmin bruker vil bestemmes av rettighetene til gruppen som valgt over.
+convert_desc=Denne Dette feltet lar deg konvertere eksisterende Unix-brukere til Webmin-brukere. Rettighetene til hver nye Webmin-bruker vil bestemmes av rettighetene til gruppen som valgt over.
 convert_0=Alle brukere
 convert_1=Bare brukere
 convert_2=Alle unntagen brukere
@@ -284,43 +284,43 @@ convert_sync2=Synk. passord med Unix-bruker i fremtiden?
 convert_ok=Konverter nå
 convert_err=Kunne ikke konvertere brukere
 convert_eusers=Ingen brukere inntastet
-convert_egroup=Unix gruppe eksisterer ikke
-convert_emin=Ugyldig minimum bruker ID (UID)
-convert_emax=Ugyldig maksimum bruker ID (UID)
+convert_egroup=Unix-gruppen eksisterer ikke
+convert_emin=Ugyldig minimum bruker-ID (UID)
+convert_emax=Ugyldig maksimum bruker-ID (UID)
 convert_ewgroup=Ingen sånn Webmin gruppe
 convert_ewgroup2=Du har ikke rettigheter til å tilordne nye brukere til denne gruppen
 convert_skip=Hoppet over $1
 convert_exists=$1 Eksisterer allerede
-convert_invalid=$1 er ikke et gyldig Webmin brukernavn
+convert_invalid=$1 er ikke et gyldig Webmin-brukernavn
 convert_added=$1 er lagt til
-convert_msg=Konverterer Unix brukere...
+convert_msg=Konverterer Unix-brukere...
 convert_user=Unix-bruker
-convert_action=Handling utført
+convert_action=Handling utført
 convert_done=$1 brukere konvertert, $2 ugyldig, $3 finnes allerede, $4 ekskludert.
 convert_users=Brukere som skal konverteres
 
-sync_title=Unix Bruker Synkronisering
-sync_desc=Dette feltet lar deg konfigurere automatisk synkronisering av Unix brukere laget via Webmin og brukere i denne modulen.
+sync_title=Unix-brukersynkronisering
+sync_desc=Dette feltet lar deg konfigurere automatisk synkronisering av Unix-brukere laget via Webmin og brukere i denne modulen.
 sync_nogroups=Ingen Webmin gruppe er definert på ditt system. Du må i det minste lage en gruppe før du konverterer brukere, dette for å kunne sette rettigheter for konverterte brukere.
 sync_when=Synkroniser når
-sync_create=Opprett Webmin bruker når en Unix bruker blir laget.
-sync_update=Oppdater passende Webmin bruker når Unix brukere blir oppdatert.
-sync_delete=Slett passende Webmin bruker når Unix brukere blir slettet.
+sync_create=Opprett Webmin-bruker når en Unix bruker blir laget.
+sync_update=Oppdater passende Webmin-bruker når Unix-brukere blir oppdatert.
+sync_delete=Slett passende Webmin-bruker når Unix-brukere blir slettet.
 sync_group=Tilordne ny bruker til Webmin gruppe
 sync_unix=Sett passord for nye brukere til Unix autentisering
 sync_ecannot=Du har ikke rettigheter til å konfigurere bruker synkronisering.
 
-unix_title=Unix Bruker Autentisering
+unix_title=Unix-brukerautentisering
 unix_err=Kunne ikke lagre Unix autentisering
-unix_desc=Denne siden lar deg konfigurere Webmin til verifisere login forsøk med systemets bruker liste og PAM. Dette kan være nyttig hvis du har mange eksisterende Unix brukere som du ønsker å gi tilgang til Webmin.
-unix_def=Tillat bare login av Webmin brukere
-unix_sel=Tillat Unix brukere i listen nedenfor å logge inn ..
+unix_desc=Denne siden lar deg konfigurere Webmin til verifisere login forsøk med systemets bruker liste og PAM. Dette kan være nyttig hvis du har mange eksisterende Unix-brukere som du ønsker å gi tilgang til Webmin.
+unix_def=Tillat bare login av Webmin-brukere
+unix_sel=Tillat Unix-brukere i listen nedenfor å logge inn ..
 unix_mode=Tillat
 unix_mall=Alle brukere
 unix_group=Medlemmer i gruppen..
-unix_user=Tillat alle Unix brukere login med rettigheter som Users
+unix_user=Tillat alle Unix-brukere login med rettigheter som Users
 unix_who=Bruker eller gruppe
-unix_to=Som Webmin bruker
+unix_to=Som Webmin-bruker
 unix_ecannot=Du har ikke rettigheter til å konfigurere Unix bruker autentisering
 unix_epam=Unix autentisering er ikke tilgjengelig fordi <tt>Authen::PAM</tt> Perl modul ikke er installert eller ikke virker som den skal.
 unix_all=Tillat alle Unix brukere
@@ -329,12 +329,12 @@ unix_deny=Nekt listede Unix brukere
 unix_none=Ingen brukere angitt
 unix_euser='$1' er ikke et gyldig brukernavn
 unix_egroup='$1' er ikke et gyldig gruppenavn
-unix_shells=Nekt Unix brukere hvis skall ikke finnes i filen
+unix_shells=Nekt Unix-brukere hvis skall ikke finnes i filen
 unix_eshells=Manglende eller ikke-eksisterende shells fil
 unix_restrict2=Ekstra restriksjoner
 unix_ewhogroup=Manglende tillatt gruppe i rad $1
 unix_ewhouser=Manglende tilllatt bruker i rad $1
-unix_enone=Ingen tillatte Unix brukere og grupper ble angitt
+unix_enone=Ingen tillatte Unix-brukere og grupper ble angitt
 unix_same=&lt;Samme bruker eller gruppe&gt;
 unix_sudo=TIllatt brukere som kan kjøre alle kommandoer via <tt>sudo</tt> å logge inn som <tt>root</tt>
 unix_pamany=Behandle brukere som bare sender PAM validering som $1
@@ -345,9 +345,9 @@ unix_utable=Tillatte Unix brukere
 
 sessions_title=Aktuell Login Session
 sessions_id=Sessions ID
-sessions_user=Webmin bruker
+sessions_user=Webmin-bruker
 sessions_login=Innlogget
-sessions_host=IP adresse
+sessions_host=IP-adresse
 sessions_lview=Se logger..
 sessions_actions=Handlinger..
 sessions_logouts=Vis også utloggede sesjoner..
@@ -357,7 +357,7 @@ sessions_in=Innlogget
 sessions_out=Logget ut
 sessions_kill=Koble fra..
 
-logins_title=Siste Webmin innlogginger
+logins_title=Siste Webmin-innlogginger
 
 hide_title=Skjul ubrukte moduler
 hide_desc=Følgende moduler vil bli fjernet fra modul tilgangslisten for $1 siden deres tilhørende tjenere ikke er installert på systemet ditt ..
@@ -374,7 +374,7 @@ rbac_desc=Webmin's RBAC integration provides a way for user module and ACL permi
 rbac_esolaris=RBAC støttes bare på Solaris systemer for øyeblikket, og kan derfor ikke brukes på dette $1 systemet.
 rbac_eperl=Perl-modulen $1, som behøves for RBAC integrasjon, er ikke installert. <a href='$2'>Klikk her</a> for å installere den nå.
 rbac_ecpan=Du har ikke tilgang til Webmins Perl Moduler side for å kunne installere den nødvendige $1 modulen for RBAC integrasjon.
-rbac_ok=RBAC integrasjon er tilgjengelig for dette systemet, og kan aktiveres per bruker på siden Rediger Webmin bruker.
+rbac_ok=RBAC integrasjon er tilgjengelig for dette systemet, og kan aktiveres per bruker på siden Rediger Webmin-bruker.
 
 udeletes_err=Kunne ikke slette brukere
 udeletes_jerr=Kunne ikke legg til brukere i gruppe
@@ -391,7 +391,7 @@ gdeletes_rusure=Er du sikker på at du ønsker å slette de $1 valgte gruppene o
 gdeletes_users=Valgte grupper: $1
 gdeletes_ok=Slett grupper
 
-pass_title=Passord begrensinger
+pass_title=Passordbegrensinger
 pass_ecannot=Du har ikke lov til å redigere passord-begrensinger
 pass_header=Innstillinger for Webmin passord begrensinger
 pass_minsize=Minimum passordlengde
@@ -424,7 +424,7 @@ cpass_old=Gamle passord kan ikke brukes på nytt
 
 sql_title=Bruker- og gruppe-database
 sql_ecannot=Du har ikke lov til å konfigurere bruker- og gruppedatabasen
-sql_header=Instillinger for database backend for brukere og grupper
+sql_header=Innstillinger for database backend for brukere og grupper
 sql_host=Vertsnavn
 sql_user=Brukernavn
 sql_pass=Passord
@@ -456,7 +456,7 @@ sql_edb=Ugyldig databasenavn (mellomrom ikke tillatt)
 sql_eprefix=Manglende eller ugyldig base DN (mellomrom ikke tillatt)
 sql_eprefix2=Ugyldig-utseende base DN - skal være på formen <tt>dc=mittdomene,dc=no</tt>
 sql_title2=Opprett manglende tabeller
-sql_tableerr=Instillinger for bruker- og gruppedatabase er gyldig, men noen tabeller som Webmin trenger, mangler : $1
+sql_tableerr=Innstillinger for bruker- og gruppedatabase er gyldig, men noen tabeller som Webmin trenger, mangler : $1
 sql_tableerr2=Klikk på knappen <b>Opprett tabeller</b> nedenfor, for å få opprettet dem automatisk, eller du kan kjøre SQL uttrykket nedenfor manuelt.
 sql_make=Opprett tabeller
 sql_title3=Opprett manglende DN
@@ -489,7 +489,7 @@ twofactor_title=To-faktor autentisering
 twofactor_disable=Deaktiver to-faktor autentisering
 twofactor_already=Din Webmin-bruker har allerede to-faktor autentisering aktivert med leverandør %1 og konto ID %2.
 twofactor_already2=Webmin-brukeren %3 har allerede to-faktor autentisering aktivert med leverandør %1 og konto ID %2.
-twofactor_desc=Denne siden lar deg aktivere to-faktor autentisering for din Webmin bruker vha. <a href='$2' target=_blank>$1</a>. Når denne er aktivert kreves det et ekstra autentiserings-token når du logger inn på Webmin.
+twofactor_desc=Denne siden lar deg aktivere to-faktor autentisering for din Webmin-bruker vha. <a href='$2' target=_blank>$1</a>. Når denne er aktivert kreves det et ekstra autentiserings-token når du logger inn på Webmin.
 twofactor_desc2=Denne siden lar deg aktivere to-faktor autentisering for Webmin-brukeren $1 vha. <a href='$2' target=_blank>$1</a>. Når denne er aktivert vil det kreves et ekstra autentiserings-token for å logge inn på Webmin.
 twofactor_enable=Meld inn til to-faktor autentisering
 twofactor_header=Detaljer for innmelding til to-faktor autentisering

acl/list_sessions.cgi

@@ -6,7 +6,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access, %sessiondb);
 $access{'sessions'} || &error($text{'sessions_ecannot'});
 &ui_print_header(undef, $text{'sessions_title'}, "");

acl/log_parser.pl

@@ -16,8 +16,9 @@ my ($user, $script, $action, $type, $object, $p) = @_;
 my $g = $type eq 'group' ? "_g" : "";
 if ($action eq 'modify') {
 	if ($p->{'old'} ne $p->{'name'}) {
-		return &text('log_rename'.$g, "<tt>$p->{'old'}</tt>",
-					      "<tt>$p->{'name'}</tt>");
+		return &text('log_rename'.$g,
+			     "<tt>".&html_escape($p->{'old'})."</tt>",
+			     "<tt>".&html_escape($p->{'name'})."</tt>");
 		}
 	else {
 		return &text('log_modify'.$g,
@@ -26,7 +27,8 @@ if ($action eq 'modify') {
 	}
 elsif ($action eq 'create') {
 	if ($p->{'clone'}) {
-		return &text('log_clone'.$g, "<tt>$p->{'clone'}</tt>",
+		return &text('log_clone'.$g,
+			     "<tt>".&html_escape($p->{'clone'})."</tt>",
 			     "<tt>".&html_escape($object)."</tt>");
 		}
 	else {
@@ -36,21 +38,23 @@ elsif ($action eq 'create') {
 	}
 elsif ($action eq 'delete') {
 	if ($type eq "users" || $type eq "groups") {
-		return &text('log_delete_'.$type, $object);
+		return &text('log_delete_'.$type, &html_escape($object));
 		}
 	else {
-		return &text('log_delete'.$g, "<tt>$object</tt>");
+		return &text('log_delete'.$g,
+			     "<tt>".&html_escape($object)."</tt>");
 		}
 	}
 elsif ($action eq 'joingroup') {
-	return &text('log_joingroup', $object, $p->{'group'});
+	return &text('log_joingroup', &html_escape($object),
+		     &html_escape($p->{'group'}));
 	}
 elsif ($action eq 'acl') {
-	return &text('log_acl', "<tt>$object</tt>",
+	return &text('log_acl', "<tt>".&html_escape($object)."</tt>",
 		     "<i>".&html_escape($p->{'moddesc'})."</i>");
 	}
 elsif ($action eq 'reset') {
-	return &text('log_reset', "<tt>$object</tt>",
+	return &text('log_reset', "<tt>".&html_escape($object)."</tt>",
 		     "<i>".&html_escape($p->{'moddesc'})."</i>");
 	}
 elsif ($action eq 'cert') {
@@ -60,7 +64,9 @@ elsif ($action eq 'switch') {
 	return &text('log_switch', "<tt>".&html_escape($object)."</tt>");
 	}
 elsif ($action eq 'twofactor') {
-	return &text('log_twofactor', $object, $p->{'provider'}, $p->{'id'});
+	return &text('log_twofactor', &html_escape($object),
+		     &html_escape($p->{'provider'}),
+		     &html_escape($p->{'id'}));
 	}
 elsif ($action eq 'forgot') {
 	return &text('log_forgot_'.$type, &html_escape($p->{'user'}),

acl/makedn.cgi

@@ -5,7 +5,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access);
 $access{'pass'} || &error($text{'sql_ecannot'});
 &ReadParse();

acl/maketables.cgi

@@ -5,7 +5,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access);
 $access{'pass'} || &error($text{'sql_ecannot'});
 &ReadParse();

acl/postinstall.pl

@@ -3,7 +3,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require 'acl-lib.pl';
+require 'acl-lib.pl';    ## no critic
 our ($config_directory);
 
 # Rename the .acl files for any groups to .gacl files

acl/save_acl.cgi

@@ -6,7 +6,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access, $base_remote_user, %gconfig,
      $config_directory);
 &ReadParse();
@@ -54,13 +54,8 @@ else {
 	if (defined($in{'noconfig'})) {
 		$maccess{'noconfig'} = $in{'noconfig'};
 		}
-	if ($in{'rbac'}) {
-		# RBAC overrides everything
-		$maccess{'rbac'} = 1;
-		}
-	elsif (-r "../$in{'_acl_mod'}/acl_security.pl") {
+	if (-r "../$in{'_acl_mod'}/acl_security.pl") {
 		# Use user inputs
-		$maccess{'rbac'} = 0 if (defined($in{'rbac'}));
 		&foreign_require($in{'_acl_mod'}, "acl_security.pl");
 		&foreign_call($in{'_acl_mod'}, "acl_security_save",
 			      \%maccess, \%in);

acl/save_group.cgi

@@ -6,7 +6,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access, $config_directory);
 &ReadParse();
 

acl/save_pass.cgi

@@ -5,7 +5,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access);
 $access{'pass'} || &error($text{'pass_ecannot'});
 &error_setup($text{'pass_err'});

acl/save_sql.cgi

@@ -5,7 +5,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access);
 $access{'pass'} || &error($text{'sql_ecannot'});
 &ReadParse();

acl/save_sync.cgi

@@ -6,7 +6,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access, $module_config_directory);
 &ReadParse();
 $access{'sync'} && $access{'create'} && $access{'delete'} ||

acl/save_twofactor.cgi

@@ -5,7 +5,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access, $base_remote_user);
 &foreign_require("webmin");
 &error_setup($text{'twofactor_err'});

acl/save_unix.cgi

@@ -6,7 +6,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access);
 &ReadParse();
 &error_setup($text{'unix_err'});
@@ -70,7 +70,7 @@ else {
 	}
 if ($in{'sudo'}) {
 	&has_command("sudo") || &error(&text('unix_esudo', "<tt>sudo</tt>"));
-	eval "use IO::Pty";
+	eval { require IO::Pty; IO::Pty->import; 1 };
 	$@ && &error(&text('unix_esudomod', "<tt>IO::Pty</tt>"));
 	}
 $miniserv{'sudo'} = $in{'sudo'};

acl/save_user.cgi

@@ -6,7 +6,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access, $config_directory, $base_remote_user);
 &foreign_require("webmin", "webmin-lib.pl");
 &ReadParse();
@@ -105,11 +105,6 @@ foreach my $u (@ulist) {
 # Find the current group
 my $oldgroup = $in{'old'} ? &get_users_group($in{'old'}) : undef;
 
-if (&supports_rbac()) {
-	# Save RBAC mode
-	$user{'rbacdeny'} = $in{'rbacdeny'};
-	}
-
 my $newgroup;
 if (defined($in{'group'})) {
 	# Check if group is allowed
@@ -374,11 +369,13 @@ else {
 	}
 
 my $aclfile = "$config_directory/$in{'name'}.acl";
-if ($in{'old'} && $in{'acl_security_form'} && !$newgroup && !$in{'safe'}) {
-	# Update user's global ACL
+if ($in{'acl_security_form'} && !$newgroup && !$in{'safe'}) {
+	# Update user's global ACL, and merge in RPC setting which has
+	# been moved out of this form
 	&foreign_require("", "acl_security.pl");
 	my %uaccess;
 	&foreign_call("", "acl_security_save", \%uaccess, \%in);
+	$uaccess{'rpc'} = $in{'rpc'};
 	&lock_file($aclfile);
 	&save_module_acl(\%uaccess, $in{'name'}, "", 1);
 	&set_ownership_permissions(undef, undef, 0640, $aclfile);

acl/schema.cgi

@@ -5,7 +5,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access);
 $access{'pass'} || &error($text{'sql_ecannot'});
 

acl/switch.cgi

@@ -5,7 +5,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access, %sessiondb);
 &ReadParse();
 &can_edit_user($in{'user'}) && $access{'switch'} ||

acl/t/perlcritic.t

@@ -0,0 +1,65 @@
+#!/usr/bin/perl
+use strict;
+use warnings;
+use Test::More;
+
+BEGIN {
+    eval { require Perl::Critic; 1 }
+        or plan skip_all => 'Perl::Critic not installed';
+}
+
+use File::Find;
+
+sub script_dir
+{
+    my $path = $0;
+    if ($path =~ m{^/}) {
+        $path =~ s{/[^/]+$}{};
+        return $path;
+    }
+    my $cwd = `pwd`;
+    chomp($cwd);
+    if ($path =~ m{/}) {
+        $path =~ s{/[^/]+$}{};
+        return $cwd.'/'.$path;
+    }
+    return $cwd;
+}
+
+my $bindir = script_dir();
+my $module_dir = "$bindir/..";
+chdir($module_dir) or die "chdir: $!";
+
+my @files;
+find(
+    sub {
+        return if -d;
+        # Skip symlinks: shared libs (e.g. md5-lib.pl -> ../useradmin/md5-lib.pl)
+        # belong to the module that owns the underlying file.
+        return if -l;
+        return unless /\.(pl|cgi)\z/;
+        # *.info.pl is the Polish-locale translation of *.info, not Perl code.
+        return if /\.info\.pl\z/;
+        push(@files, $File::Find::name);
+    },
+    '.'
+);
+
+@files = sort @files;
+if (!@files) {
+    plan skip_all => 'no perl files to check';
+}
+
+my $critic = Perl::Critic->new(
+    -profile => "$bindir/../../.perlcriticrc",
+);
+
+foreach my $file (@files) {
+    my @violations = $critic->critique($file);
+    is(scalar @violations, 0, "$file perlcritic");
+    if (@violations) {
+        diag join("", @violations);
+    }
+}
+
+done_testing();

acl/test_twofactor.cgi

@@ -5,7 +5,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %access, $base_remote_user);
 &foreign_require("webmin");
 &error_setup($text{'twofactor_terr'});

acl/twofactor.pl

@@ -1,6 +1,10 @@
 #!/usr/local/bin/perl
 # Validate the OTP for some user
 
+use strict;
+use warnings;
+no warnings 'once';
+our $module_name;
 $main::no_acl_check = 1;
 $main::no_referers_check = 1;
 $ENV{'WEBMIN_CONFIG'} = "/etc/webmin";
@@ -8,17 +12,19 @@ $ENV{'WEBMIN_VAR'} = "/var/webmin";
 if ($0 =~ /^(.*\/)[^\/]+$/) {
         chdir($1);
         }
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 $module_name eq 'acl' || die "Command must be run with full path";
 
 # Check command-line args
 @ARGV == 5 || die "Usage: $0 user provider id token api-key";
-($user, $provider, $id, $token, $apikey) = @ARGV;
+my ($user, $provider, $id, $token, $apikey) = @ARGV;
 
 # Call the provider validation function
 &foreign_require("webmin");
-$func = "webmin::validate_twofactor_".$provider;
-$err = &$func($id, $token, $apikey);
+my $method = "validate_twofactor_".$provider;
+my $code = webmin->can($method)
+	or die "Unknown twofactor provider: $provider\n";
+my $err = $code->($id, $token, $apikey);
 if ($err) {
 	$err =~ s/\r|\n/ /g;
 	print $err,"\n";

acl/twofactor_form.cgi

@@ -5,7 +5,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access, $base_remote_user);
 &foreign_require("webmin");
 &error_setup($text{'twofactor_err'});

acl_security.pl

@@ -16,7 +16,7 @@ print &ui_table_row($text{'acl_root'},
 # Other dirs to allow
 print &ui_table_row($text{'acl_otherdirs'},
 	&ui_textarea("otherdirs", join("\n", split(/\t+/, $o->{'otherdirs'})),
-		     5, 40), 3);
+		     3, 40), 3);
 
 # Can see dot files?
 print &ui_table_row($text{'acl_nodot'},
@@ -77,18 +77,6 @@ print &ui_table_row($text{'acl_gedit'},
 
 print &ui_table_hr();
 
-# Can submit feedback?
-print &ui_table_row($text{'acl_feedback'},
-	&ui_radio("feedback", int($o->{'feedback'}),
-	  	  [ map { [ $_, $text{'acl_feedback'.$_} ] } (2,3,1,0) ]));
-
-# Can accept RPC calls?
-print &ui_table_row($text{'acl_rpc'},
-	&ui_radio("rpc", int($o->{'rpc'}),
-		  [ [ 1, $text{'acl_rpc1'} ],
-		    $o->{'rpc'} == 2 ? ( [ 2, $text{'acl_rpc2'} ] ) : ( ),
-		    [ 0, $text{'acl_rpc0'} ] ]));
-
 # Get new permissions?
 print &ui_table_row($text{'acl_negative'},
 	&ui_radio("negative", int($o->{'negative'}),
@@ -110,27 +98,26 @@ print &ui_table_row($text{'acl_webminsearch'},
 # Parse the form for global security options
 sub acl_security_save
 {
-$_[0]->{'root'} = $in{'root_def'} ? undef : $in{'root'};
-$_[0]->{'otherdirs'} = join("\t", split(/\r?\n/, $in{'otherdirs'}));
-$_[0]->{'nodot'} = $in{'nodot'};
+my ($o) = @_;
+$o->{'root'} = $in{'root_def'} ? undef : $in{'root'};
+$o->{'otherdirs'} = join("\t", split(/\r?\n/, $in{'otherdirs'}));
+$o->{'nodot'} = $in{'nodot'};
 
-$_[0]->{'uedit_mode'} = $in{'uedit_mode'};
-$_[0]->{'uedit'} = $in{'uedit_mode'} == 2 ? $in{'uedit_can'} :
+$o->{'uedit_mode'} = $in{'uedit_mode'};
+$o->{'uedit'} = $in{'uedit_mode'} == 2 ? $in{'uedit_can'} :
 		   $in{'uedit_mode'} == 3 ? $in{'uedit_cannot'} :
 		   $in{'uedit_mode'} == 4 ? $in{'uedit_uid'} :
 		   $in{'uedit_mode'} == 5 ? getgrnam($in{'uedit_group'}) : "";
-$_[0]->{'uedit2'} = $in{'uedit_mode'} == 4 ? $in{'uedit_uid2'} : undef;
+$o->{'uedit2'} = $in{'uedit_mode'} == 4 ? $in{'uedit_uid2'} : undef;
 
-$_[0]->{'gedit_mode'} = $in{'gedit_mode'};
-$_[0]->{'gedit'} = $in{'gedit_mode'} == 2 ? $in{'gedit_can'} :
+$o->{'gedit_mode'} = $in{'gedit_mode'};
+$o->{'gedit'} = $in{'gedit_mode'} == 2 ? $in{'gedit_can'} :
 		   $in{'gedit_mode'} == 3 ? $in{'gedit_cannot'} :
 		   $in{'gedit_mode'} == 4 ? $in{'gedit_gid'} : "";
-$_[0]->{'gedit2'} = $in{'gedit_mode'} == 4 ? $in{'gedit_gid2'} : undef;
-$_[0]->{'feedback'} = $in{'feedback'};
-$_[0]->{'rpc'} = $in{'rpc'};
-$_[0]->{'negative'} = $in{'negative'};
-$_[0]->{'readonly'} = $in{'readonly'};
-$_[0]->{'fileunix'} = $in{'fileunix_def'} ? undef : $in{'fileunix'};
-$_[0]->{'webminsearch'} = $in{'webminsearch'};
+$o->{'gedit2'} = $in{'gedit_mode'} == 4 ? $in{'gedit_gid2'} : undef;
+$o->{'negative'} = $in{'negative'};
+$o->{'readonly'} = $in{'readonly'};
+$o->{'fileunix'} = $in{'fileunix_def'} ? undef : $in{'fileunix'};
+$o->{'webminsearch'} = $in{'webminsearch'};
 }
 

apache/acl_security.pl

@@ -5,115 +5,84 @@ require 'apache-lib.pl';
 # Output HTML for editing security options for the apache module
 sub acl_security_form
 {
-print "<tr> <td valign=top rowspan=4><b>$text{'acl_virts'}</b></td>\n";
-print "<td rowspan=4 valign=top>\n";
-printf "<input type=radio name=virts_def value=1 %s> %s\n",
-	$_[0]->{'virts'} eq '*' ? 'checked' : '', $text{'acl_vall'};
-printf "<input type=radio name=virts_def value=0 %s> %s<br>\n",
-	$_[0]->{'virts'} eq '*' ? '' : 'checked', $text{'acl_vsel'};
-print "<select name=virts multiple size=5>\n";
-local $conf = &get_config();
-local @virts = ( { 'value' => '__default__' },
-		 &find_directive_struct("VirtualHost", $conf) );
-local %vcan = map { $_, 1 } split(/\s+/, $_[0]->{'virts'});
-local $v;
-foreach $v (@virts) {
-	local @vn = &virt_acl_name($v);
-	local ($can) = grep { $vcan{$_} } @vn;
-	local $vn = $can || $vn[0];
-	printf "<option value=\"%s\" %s>%s</option>\n",
-		$vn, $can ? "selected" : "",
-		$vn eq "__default__" ? $text{'acl_defserv'} : $vn;
+my ($o) = @_;
+
+my $conf = &get_config();
+my @virts = ( { 'value' => '__default__' },
+	      &find_directive_struct("VirtualHost", $conf) );
+my @vsel = $o->{'virts'} eq '*' ? () : split(/\s+/, $o->{'virts'});
+my %vcan = map { $_, 1 } @vsel;
+my @vopts;
+foreach my $v (@virts) {
+	my @vn = &virt_acl_name($v);
+	my ($can) = grep { $vcan{$_} } @vn;
+	my $show = $can || $vn[0];
+	push(@vopts, [ $show,
+		       $show eq "__default__" ? $text{'acl_defserv'}
+					      : $show ]);
 	delete($vcan{$can}) if ($can);
 	}
-foreach $vn (keys %vcan) {
-	next if ($vn eq "*");
-	printf "<option value=\"%s\" %s>%s</option>\n",
-		$vn, "selected",
-		$vn eq "__default__" ? $text{'acl_defserv'} : $vn;
+print &ui_table_row($text{'acl_virts'},
+	&ui_radio("virts_def", $o->{'virts'} eq '*' ? 1 : 0,
+		  [ [ 1, $text{'acl_vall'} ],
+		    [ 0, $text{'acl_vsel'} ] ])."<br>\n".
+	&ui_select("virts", \@vsel, \@vopts, 5, 1, 1),
+	3);
+
+print &ui_table_row($text{'acl_global'},
+	&ui_select("global",
+		   defined($o->{'global'}) && $o->{'global'} ne '' ?
+			$o->{'global'} : 0,
+		   [ [ 1, $text{'yes'} ],
+		     [ 2, $text{'acl_htaccess'} ],
+		     [ 0, $text{'no'} ] ]));
+print &ui_table_row($text{'acl_create'},
+	&ui_yesno_radio("create", $o->{'create'}));
+
+print &ui_table_row($text{'acl_vuser'},
+	&ui_yesno_radio("vuser", $o->{'vuser'}));
+print &ui_table_row($text{'acl_vaddr'},
+	&ui_yesno_radio("vaddr", $o->{'vaddr'}));
+
+print &ui_table_row($text{'acl_pipe'},
+	&ui_yesno_radio("pipe", $o->{'pipe'}));
+print &ui_table_row($text{'acl_stop'},
+	&ui_yesno_radio("stop", $o->{'stop'}));
+
+print &ui_table_row($text{'acl_apply'},
+	&ui_yesno_radio("apply", $o->{'apply'}));
+print &ui_table_row($text{'acl_names'},
+	&ui_yesno_radio("names", $o->{'names'}));
+
+print &ui_table_row($text{'acl_dir'},
+	&ui_textbox("dir", $o->{'dir'}, 30)." ".
+	&file_chooser_button("dir", 1),
+	3);
+
+print &ui_table_row($text{'acl_aliasdir'},
+	&ui_textbox("aliasdir", $o->{'aliasdir'}, 30)." ".
+	&file_chooser_button("aliasdir", 1),
+	3);
+
+my @typesel = $o->{'types'} eq '*' ? () : split(/\s+/, $o->{'types'});
+my @typeopts;
+for (my $i = 0; $text{"type_$i"}; $i++) {
+	push(@typeopts, [ $i, $text{"type_$i"} ]);
 	}
-print "</select></td>\n";
+print &ui_table_row($text{'acl_types'},
+	&ui_radio("types_def", $o->{'types'} eq '*' ? 1 : 0,
+		  [ [ 1, $text{'acl_all'} ],
+		    [ 0, $text{'acl_sel'} ] ])."<br>\n".
+	&ui_select("types", \@typesel, \@typeopts, 5, 1),
+	3);
 
-print "<td><b>$text{'acl_global'}</b></td> <td><select name=global>\n";
-printf "<option value=1 %s>$text{'yes'}</option>\n",
-	$_[0]->{'global'} == 1 ? "selected" : "";
-printf "<option value=2 %s>$text{'acl_htaccess'}</option>\n",
-	$_[0]->{'global'} == 2 ? "selected" : "";
-printf "<option value=0 %s>$text{'no'}</option></select></td> </tr>\n",
-	$_[0]->{'global'} == 0 ? "selected" : "";
-
-print "<tr> <td><b>$text{'acl_create'}</b></td> <td>\n";
-printf "<input type=radio name=create value=1 %s> $text{'yes'}\n",
-	$_[0]->{'create'} ? "checked" : "";
-printf "<input type=radio name=create value=0 %s> $text{'no'}</td> </tr>\n",
-	$_[0]->{'create'} ? "" : "checked";
-
-print "<tr> <td><b>$text{'acl_vuser'}</b></td> <td>\n";
-printf "<input type=radio name=vuser value=1 %s> $text{'yes'}\n",
-	$_[0]->{'vuser'} ? "checked" : "";
-printf "<input type=radio name=vuser value=0 %s> $text{'no'}</td> </tr>\n",
-	$_[0]->{'vuser'} ? "" : "checked";
-
-print "<tr> <td><b>$text{'acl_vaddr'}</b></td> <td>\n";
-printf "<input type=radio name=vaddr value=1 %s> $text{'yes'}\n",
-	$_[0]->{'vaddr'} ? "checked" : "";
-printf "<input type=radio name=vaddr value=0 %s> $text{'no'}</td> </tr>\n",
-	$_[0]->{'vaddr'} ? "" : "checked";
-
-print "<tr> <td><b>$text{'acl_pipe'}</b></td> <td>\n";
-printf "<input type=radio name=pipe value=1 %s> $text{'yes'}\n",
-	$_[0]->{'pipe'} ? "checked" : "";
-printf "<input type=radio name=pipe value=0 %s> $text{'no'}</td>\n",
-	$_[0]->{'pipe'} ? "" : "checked";
-
-print "<td><b>$text{'acl_stop'}</b></td> <td>\n";
-printf "<input type=radio name=stop value=1 %s> $text{'yes'}\n",
-	$_[0]->{'stop'} ? "checked" : "";
-printf "<input type=radio name=stop value=0 %s> $text{'no'}</td> </tr>\n",
-	$_[0]->{'stop'} ? "" : "checked";
-
-print "<tr> <td><b>$text{'acl_apply'}</b></td> <td>\n";
-printf "<input type=radio name=apply value=1 %s> $text{'yes'}\n",
-	$_[0]->{'apply'} ? "checked" : "";
-printf "<input type=radio name=apply value=0 %s> $text{'no'}</td>\n",
-	$_[0]->{'apply'} ? "" : "checked";
-
-print "<td><b>$text{'acl_names'}</b></td> <td>\n";
-printf "<input type=radio name=names value=1 %s> $text{'yes'}\n",
-	$_[0]->{'names'} ? "checked" : "";
-printf "<input type=radio name=names value=0 %s> $text{'no'}</td> </tr>\n",
-	$_[0]->{'names'} ? "" : "checked";
-
-print "<tr> <td><b>$text{'acl_dir'}</b></td>\n";
-printf "<td colspan=3><input name=dir size=30 value='%s'> %s</td> </tr>\n",
-	$_[0]->{'dir'}, &file_chooser_button("dir", 1);
-
-print "<tr> <td><b>$text{'acl_aliasdir'}</b></td>\n";
-printf "<td colspan=3><input name=aliasdir size=30 value='%s'> %s</td> </tr>\n",
-	$_[0]->{'aliasdir'}, &file_chooser_button("aliasdir", 1);
-
-print "<tr> <td valign=top><b>$text{'acl_types'}</b></td>\n";
-print "<td colspan=3>\n";
-printf "<input type=radio name=types_def value=1 %s> $text{'acl_all'}&nbsp;\n",
-	$_[0]->{'types'} eq '*' ? "checked" : "";
-printf "<input type=radio name=types_def value=0 %s> $text{'acl_sel'}<br>\n",
-	$_[0]->{'types'} eq '*' ? "" : "checked";
-map { $types{$_}++ } split(/\s+/, $_[0]->{'types'});
-print "<select name=types size=5 multiple>\n";
-for($i=0; $text{"type_$i"}; $i++) {
-	printf "<option value=\"%d\" %s>%s</option>\n",
-		$i, $types{$i} ? "selected" : "", $text{"type_$i"};
-	}
-print "</select></td> </tr>\n";
-
-print "<tr> <td valign=top><b>$text{'acl_dirs'}</b></td>\n";
-print "<td colspan=3>\n";
-print &ui_radio("dirsmode", $_[0]->{'dirsmode'},
-		[ [ 0, $text{'acl_dirs0'} ],
-		  [ 1, $text{'acl_dirs1'} ],
-		  [ 2, $text{'acl_dirs2'} ] ]),"<br>\n";
-print &ui_textarea("dirs", join("\n", split(/\s+/, $_[0]->{'dirs'})), 5, 50);
-print "</td> </tr>\n";
+print &ui_table_row($text{'acl_dirs'},
+	&ui_radio("dirsmode", $o->{'dirsmode'},
+		  [ [ 0, $text{'acl_dirs0'} ],
+		    [ 1, $text{'acl_dirs1'} ],
+		    [ 2, $text{'acl_dirs2'} ] ])."<br>\n".
+	&ui_textarea("dirs", join("\n", split(/\s+/, $o->{'dirs'})), 5, 50),
+	3);
 }
 
 # acl_security_save(&options)
@@ -141,4 +110,3 @@ $_[0]->{'names'} = $in{'names'};
 $_[0]->{'dirsmode'} = $in{'dirsmode'};
 $_[0]->{'dirs'} = join(" ", split(/\s+/, $in{'dirs'}));
 }
-

apache/apache-lib.pl

@@ -436,6 +436,13 @@ foreach $v (@virt) {
 return \@get_config_cache;
 }
 
+# flush_config_cache()
+# Delete all in-memory config caches
+sub flush_config_cache
+{
+undef(@get_config_cache);
+}
+
 # get_config_file(filename, [&seen-files])
 # Returns a list of config hash refs from some file
 sub get_config_file
@@ -788,6 +795,428 @@ unlink($file);
 &delete_webfile_link($file);
 }
 
+# can_manage_vhost_files()
+# Returns 1 if this system uses Debian-style available/enabled site dirs
+sub can_manage_vhost_files
+{
+return 0 if ($gconfig{'os_type'} ne 'debian-linux');
+my $avail = &vhost_available_dir();
+my $enabled = &vhost_enabled_dir();
+return $avail && -d $avail && $enabled && -d $enabled &&
+       &simplify_path(&resolve_links($avail)) ne
+       &simplify_path(&resolve_links($enabled));
+}
+
+# vhost_available_dir()
+# Returns the configured directory of available Apache virtual host files
+sub vhost_available_dir
+{
+return $config{'virt_file'} ? &server_root($config{'virt_file'}) : undef;
+}
+
+# vhost_enabled_dir()
+# Returns the configured directory of enabled Apache virtual host symlinks
+sub vhost_enabled_dir
+{
+return $config{'link_dir'} ? &server_root($config{'link_dir'}) : undef;
+}
+
+# get_vhost_available_files()
+# Returns real config files from the directory used for new virtual hosts
+sub get_vhost_available_files
+{
+my @rv;
+return @rv if (!&can_manage_vhost_files());
+my $avail = &vhost_available_dir();
+opendir(AVAIL, $avail) || return @rv;
+foreach my $f (sort { lc($a) cmp lc($b) } readdir(AVAIL)) {
+	next if ($f eq "." || $f eq "..");
+	my $file = $avail."/".$f;
+	my $rfile = &simplify_path(&resolve_links($file));
+	next if (!$rfile || !-f $rfile || !-r $rfile);
+	push(@rv, $rfile);
+	}
+closedir(AVAIL);
+return &unique(@rv);
+}
+
+# find_virtuals_in_file(file)
+# Returns VirtualHost blocks parsed from one config file
+sub find_virtuals_in_file
+{
+my ($file) = @_;
+my $rfile = &simplify_path(&resolve_links($file));
+$rfile ||= $file;
+return ( ) if (!-r $rfile);
+my @conf = &get_config_file($rfile);
+return grep { $_->{'file'} eq $rfile }
+       &find_directive_struct("VirtualHost", \@conf);
+}
+
+# is_default_vhost(&virt)
+# Returns 1 if a VirtualHost looks like a default/catch-all host
+sub is_default_vhost
+{
+my ($virt) = @_;
+return 1 if (!$virt);
+return 1 if ($virt->{'value'} =~ /_default_/i);
+return 1 if (!&find_directive("ServerName", $virt->{'members'}));
+return 0;
+}
+
+# can_manage_vhost_file(file)
+# Returns 1 if all virtual hosts in a file are manageable by this user
+sub can_manage_vhost_file
+{
+my ($file) = @_;
+my $rfile = &simplify_path(&resolve_links($file));
+$rfile ||= $file;
+return 0 if (!$rfile || !-f $rfile || !-r $rfile);
+my @virts = &find_virtuals_in_file($rfile);
+return 0 if (!@virts);
+foreach my $virt (@virts) {
+	return 0 if (&is_default_vhost($virt));
+	return 0 if (!&can_edit_virt($virt));
+	}
+return 1;
+}
+
+# can_manage_vhost_state_file(file)
+# Returns 1 if a virtual host file can have its enabled state managed here
+sub can_manage_vhost_state_file
+{
+my ($file) = @_;
+my $rfile = &simplify_path(&resolve_links($file));
+$rfile ||= $file;
+return 0 if (!$rfile || !-f $rfile);
+my %available = map { $_, 1 } &get_vhost_available_files();
+return 0 if (!$available{$rfile});
+return &can_manage_vhost_file($rfile);
+}
+
+# get_virtual_list_rows(&config)
+# Returns row hashes for the virtual-host list, preserving sites-available order
+sub get_virtual_list_rows
+{
+my ($conf) = @_;
+my @active = grep { &can_edit_virt($_) }
+	     &find_directive_struct("VirtualHost", $conf);
+if (&can_manage_vhost_files()) {
+	my @rows;
+	my %active_by_file;
+	foreach my $v (@active) {
+		my $file = &simplify_path(&resolve_links($v->{'file'}));
+		$file ||= $v->{'file'};
+		push(@{$active_by_file{$file}}, $v);
+		}
+	my %done_virt;
+	foreach my $file (&get_vhost_available_files()) {
+		my @filevirts = @{$active_by_file{$file} || [ ]};
+		my $active = @filevirts ? 1 : 0;
+		if (!@filevirts) {
+			@filevirts = grep { &can_edit_virt($_) &&
+					     !&is_default_vhost($_) }
+				     &find_virtuals_in_file($file);
+			}
+		foreach my $v (@filevirts) {
+			push(@rows, { 'virt' => $v,
+				      'active' => $active,
+				      'file' => $file });
+			$done_virt{$v}++;
+			}
+		}
+	foreach my $v (@active) {
+		next if ($done_virt{$v});
+		push(@rows, { 'virt' => $v,
+			      'active' => 1,
+			      'file' => $v->{'file'} });
+		}
+	return @rows;
+	}
+return map { { 'virt' => $_, 'active' => 1, 'file' => $_->{'file'} } }
+       @active;
+}
+
+# vhost_file_link(file)
+# Returns the enabled symlink path for a virtual host file
+sub vhost_file_link
+{
+my ($file) = @_;
+return undef if (!&can_manage_vhost_files());
+my $rfile = &simplify_path(&resolve_links($file));
+$rfile ||= $file;
+my $avail = &vhost_available_dir();
+my $short;
+if (opendir(AVAIL, $avail)) {
+	foreach my $f (sort { lc($a) cmp lc($b) } readdir(AVAIL)) {
+		next if ($f eq "." || $f eq "..");
+		my $afile = $avail."/".$f;
+		my $rafile = &simplify_path(&resolve_links($afile));
+		if ($rafile && $rafile eq $rfile) {
+			$short = $f;
+			last;
+			}
+		}
+	closedir(AVAIL);
+	}
+$short ||= $rfile;
+$short =~ s/^.*\///;
+return &vhost_enabled_dir()."/".$short;
+}
+
+# vhost_file_links(file)
+# Returns enabled symlinks for a virtual host file
+sub vhost_file_links
+{
+my ($file) = @_;
+my @rv;
+return @rv if (!&can_manage_vhost_files());
+my $rfile = &simplify_path(&resolve_links($file));
+$rfile ||= $file;
+my $enabled = &vhost_enabled_dir();
+opendir(LINKDIR, $enabled) || return @rv;
+foreach my $f (readdir(LINKDIR)) {
+	next if ($f eq "." || $f eq "..");
+	my $link = $enabled."/".$f;
+	next if (!-l $link);
+	my $rlink = &simplify_path(&resolve_links($link));
+	if ($rlink && $rlink eq $rfile) {
+		push(@rv, $link);
+		}
+	}
+closedir(LINKDIR);
+return @rv;
+}
+
+# vhost_file_enabled(file)
+# Returns 1 if a virtual host file has an enabled symlink
+sub vhost_file_enabled
+{
+my ($file) = @_;
+return scalar(&vhost_file_links($file)) ? 1 : 0;
+}
+
+# enable_vhost_file(file)
+# Enables a virtual host file and rolls back if apache configtest fails
+sub enable_vhost_file
+{
+my ($file) = @_;
+my $rfile = &simplify_path(&resolve_links($file));
+$rfile ||= $file;
+return $text{'enable_efile'} if (!&can_manage_vhost_state_file($rfile));
+my $verr = &virtualmin_vhost_file_state_error($rfile, "enable");
+return $verr if ($verr);
+my $link = &vhost_file_link($rfile);
+$link || return $text{'enable_elinkdir'};
+return undef if (&vhost_file_enabled($rfile));
+if (-e $link || -l $link) {
+	return &text('enable_elinkexists', "<tt>".&html_escape($link)."</tt>");
+	}
+&symlink_logged($rfile, $link) ||
+	return &text('enable_elink', "<tt>".&html_escape($link)."</tt>",
+		     "<tt>".&html_escape($!)."</tt>");
+my $err = &test_config();
+if ($err) {
+	&unlink_logged($link);
+	return &text('enable_etest', "<tt>".&html_escape($err)."</tt>");
+	}
+&flush_config_cache();
+&update_last_config_change();
+return undef;
+}
+
+# disable_vhost_file(file)
+# Disables a virtual host file and rolls back if apache configtest fails
+sub disable_vhost_file
+{
+my ($file) = @_;
+my $rfile = &simplify_path(&resolve_links($file));
+$rfile ||= $file;
+return $text{'enable_efile'} if (!&can_manage_vhost_state_file($rfile));
+my $verr = &virtualmin_vhost_file_state_error($rfile, "disable");
+return $verr if ($verr);
+my @links = &vhost_file_links($file);
+return undef if (!@links);
+my @restore = map { [ $_, readlink($_) ] } @links;
+my @removed;
+foreach my $link (@links) {
+	if (!&unlink_logged($link)) {
+		foreach my $r (@removed) {
+			&symlink_logged($r->[1], $r->[0])
+				if (defined($r->[1]) && !-e $r->[0] && !-l $r->[0]);
+			}
+		return &text('enable_eunlink',
+			     "<tt>".&html_escape($link)."</tt>",
+			     "<tt>".&html_escape($!)."</tt>");
+		}
+	my ($restore) = grep { $_->[0] eq $link } @restore;
+	push(@removed, $restore) if ($restore);
+	}
+my $err = &test_config();
+if ($err) {
+	foreach my $r (@restore) {
+		&symlink_logged($r->[1], $r->[0])
+			if (defined($r->[1]) && !-e $r->[0] && !-l $r->[0]);
+		}
+	return &text('enable_etest', "<tt>".&html_escape($err)."</tt>");
+	}
+&flush_config_cache();
+&update_last_config_change();
+return undef;
+}
+
+# virtualmin_available()
+# Returns 1 if Virtualmin is installed and supported on this system
+sub virtualmin_available
+{
+return $main::apache_virtualmin_available
+	if (defined($main::apache_virtualmin_available));
+$main::apache_virtualmin_available = &foreign_check("virtual-server");
+return $main::apache_virtualmin_available;
+}
+
+# virtualmin_domain_by_name(name)
+# Returns a Virtualmin domain object by domain name, if one exists
+sub virtualmin_domain_by_name
+{
+my ($name) = @_;
+return undef if (!&virtualmin_available());
+return $main::apache_virtualmin_domain_by_name_cache{$name}
+	if (exists($main::apache_virtualmin_domain_by_name_cache{$name}));
+&foreign_require("virtual-server");
+my $d = &virtual_server::get_domain_by("dom", $name);
+$main::apache_virtualmin_domain_by_name_cache{$name} = $d;
+return $d;
+}
+
+# virtual_names(&virt)
+# Returns all hostnames from ServerName and ServerAlias directives
+sub virtual_names
+{
+my ($virt) = @_;
+my @rv;
+my $sn = &find_directive("ServerName", $virt->{'members'});
+push(@rv, $sn) if ($sn);
+foreach my $sa (&find_directive_struct("ServerAlias", $virt->{'members'})) {
+	push(@rv, @{$sa->{'words'} || [ ]});
+	if (!@{$sa->{'words'} || [ ]} && $sa->{'value'}) {
+		push(@rv, $sa->{'value'});
+		}
+	}
+return grep { $_ && $_ ne "*" } &unique(@rv);
+}
+
+# virtualmin_domain_for_vhost_file(file)
+# Returns the Virtualmin domain object for a virtual host file, if any
+sub virtualmin_domain_for_vhost_file
+{
+my ($file) = @_;
+return undef if (!&virtualmin_available());
+my $rfile = &simplify_path(&resolve_links($file));
+$rfile ||= $file;
+return $main::apache_virtualmin_domain_for_file_cache{$rfile}
+	if (exists($main::apache_virtualmin_domain_for_file_cache{$rfile}));
+foreach my $virt (&find_virtuals_in_file($file)) {
+	next if (!&can_edit_virt($virt));
+	foreach my $name (&virtual_names($virt)) {
+		my $d = &virtualmin_domain_by_name($name);
+		if (!$d && $name =~ /^www\.(\S+)/i) {
+			$d = &virtualmin_domain_by_name($1);
+			}
+		if ($d) {
+			$main::apache_virtualmin_domain_for_file_cache{$rfile} = $d;
+			return $d;
+			}
+		}
+	}
+$main::apache_virtualmin_domain_for_file_cache{$rfile} = undef;
+return undef;
+}
+
+# vhost_file_state(file)
+# Returns the effective enabled state for a virtual host file
+sub vhost_file_state
+{
+my ($file) = @_;
+my $d = &virtualmin_domain_for_vhost_file($file);
+if ($d) {
+	return { 'enabled' => $d->{'disabled'} ? 0 : 1,
+		 'source' => 'virtualmin',
+		 'domain' => $d };
+	}
+return { 'enabled' => &vhost_file_enabled($file) ? 1 : 0,
+	 'source' => 'apache' };
+}
+
+# vhost_file_toggle_action(file)
+# Returns the action needed to toggle a virtual host file's effective state
+sub vhost_file_toggle_action
+{
+my ($file) = @_;
+return &vhost_file_state($file)->{'enabled'} ? "disable" : "enable";
+}
+
+# virtualmin_domain_state_link(&domain, enabled?)
+# Returns a link to the Virtualmin state change form for some domain
+sub virtualmin_domain_state_link
+{
+my ($d, $enabled) = @_;
+my $page = $enabled ? "disable_domain.cgi" : "enable_domain.cgi";
+my $label = $enabled ? $text{'enable_virtualmin_disable_label'} :
+		       $text{'enable_virtualmin_enable_label'};
+my $url = "../virtual-server/".$page."?dom=".&urlize($d->{'id'});
+return &ui_link(&quote_escape($url), "\"".$label."\"");
+}
+
+# virtualmin_vhost_file_state_error(file, action)
+# Returns an error if a Virtualmin-owned site is being enabled or disabled here
+sub virtualmin_vhost_file_state_error
+{
+my ($file, $action) = @_;
+return undef if ($action ne "enable" && $action ne "disable");
+my $state_info = &vhost_file_state($file);
+return undef if ($state_info->{'source'} ne "virtualmin");
+my $d = $state_info->{'domain'};
+return undef if (!$d);
+my $state = lc($state_info->{'enabled'} ? $text{'index_enabled'} :
+					  $text{'index_disabled'});
+my $dom = "<tt>".&html_escape($d->{'dom'})."</tt>";
+my $link = &virtualmin_domain_state_link($d, $state_info->{'enabled'});
+return $state_info->{'enabled'} ?
+	&text('enable_evirtualmin_disable', $dom, $state, $link) :
+	&text('enable_evirtualmin_enable', $dom, $state, $link);
+}
+
+# delete_virtuals_from_file(file, &virtualhosts...)
+# Deletes VirtualHost blocks from one file and removes the file if empty
+sub delete_virtuals_from_file
+{
+my ($file, @virts) = @_;
+return 0 if (!@virts);
+my $lref = &read_file_lines($file);
+foreach my $virt (sort { $b->{'line'} <=> $a->{'line'} } @virts) {
+	my $len = $virt->{'eline'} - $virt->{'line'} + 1;
+	splice(@$lref, $virt->{'line'}, $len);
+	}
+my $empty = 1;
+foreach my $line (@$lref) {
+	if ($line =~ /\S/) {
+		$empty = 0;
+		last;
+		}
+	}
+&flush_file_lines($file);
+if ($empty) {
+	foreach my $link (&vhost_file_links($file)) {
+		&unlink_logged($link);
+		}
+	&unlink_logged($file);
+	}
+&flush_config_cache();
+&update_last_config_change();
+return scalar(@virts);
+}
+
 # renumber(&config, line, file, offset)
 # Recursively changes the line number of all directives from some file 
 # beyond the given line.
@@ -1544,9 +1973,10 @@ return undef;
 # if necessary.
 sub before_changing
 {
+my @extra = grep { $_ } @_;
 if ($config{'test_always'} || $access{'test_always'}) {
 	local $conf = &get_config();
-	local @files = &unique(map { $_->{'file'} } @$conf);
+	local @files = &unique((map { $_->{'file'} } @$conf), @extra);
 	local $/ = undef;
 	local $f;
 	foreach $f (@files) {
@@ -1969,10 +2399,11 @@ return @rv;
 sub create_webfile_link
 {
 local ($file) = @_;
-if ($config{'link_dir'}) {
+my $linkdir = &vhost_enabled_dir();
+if ($linkdir) {
 	local $short = $file;
 	$short =~ s/^.*\///;
-	local $linksrc = "$config{'link_dir'}/$short";
+	local $linksrc = "$linkdir/$short";
 	&lock_file($linksrc);
 	symlink($file, $linksrc);
 	&unlock_file($linksrc);
@@ -1985,16 +2416,16 @@ if ($config{'link_dir'}) {
 sub delete_webfile_link
 {
 local ($file) = @_;
-if ($config{'link_dir'}) {
-	local $short = $file;
-	$short =~ s/^.*\///;
-	opendir(LINKDIR, $config{'link_dir'});
+$file = &simplify_path(&resolve_links($file));
+my $linkdir = &vhost_enabled_dir();
+if ($linkdir && opendir(LINKDIR, $linkdir)) {
 	foreach my $f (readdir(LINKDIR)) {
-		if ($f ne "." && $f ne ".." &&
-		    (&simplify_path(
-		       &resolve_links($config{'link_dir'}."/".$f)) eq $file ||
-		     $short eq $f)) {
-			&unlink_logged($config{'link_dir'}."/".$f);
+		if ($f ne "." && $f ne "..") {
+			my $link = $linkdir."/".$f;
+			next if (!-l $link);
+			if (&simplify_path(&resolve_links($link)) eq $file) {
+				&unlink_logged($link);
+				}
 			}
 		}
 	closedir(LINKDIR);

apache/core.pl

@@ -73,11 +73,12 @@ $rv = [	[ 'AccessFileName', 0, 5, 'virtual', undef, 5 ],
 	[ 'Options', 0, 5, 'virtual directory htaccess', undef, 3 ],
 	[ 'PidFile', 0, 9, 'global', -2.0 ],
 	[ 'Protocols', 0, 1, 'virtual', 2.4 ],
-	[ 'require', 0, 4, 'directory htaccess', undef, 6 ],
+	[ 'require', 0, 4, 'directory htaccess', '-2.4', 6 ],
+	[ 'Require allow deny order Satisfy', 1, 4, 'directory htaccess', 2.4, 6 ],
 	[ 'RLimitCPU', 0, 0, 'virtual', 1.2 ],
 	[ 'RLimitMEM', 0, 0, 'virtual', 1.2 ],
 	[ 'RLimitNPROC', 0, 0, 'virtual', 1.2 ],
-	[ 'Satisfy', 0, 4, 'directory htaccess', 1.2, 4 ],
+	[ 'Satisfy', 0, 4, 'directory htaccess', '1.2-2.4', 4 ],
 	[ 'ScoreBoardFile', 0, 9, 'global', '1.2-2.0' ],
 	[ 'SendBufferSize', 0, 1, 'global', -2.0 ],
 	[ 'ServerAdmin', 0, 1, 'virtual' ],
@@ -108,7 +109,7 @@ return ();
 sub edit_MaxClients
 {
 return (1,
-	$text{'core_maxconc'},
+	&hlink($text{'core_maxconc'}, "MaxClients"),
 	&opt_input($_[0]->{'value'}, "MaxClients", $text{'core_default'}, 4));
 }
 sub save_MaxClients
@@ -117,6 +118,19 @@ return &parse_opt("MaxClients", '^\d+$',
 		  $text{'core_emaxconc'});
 }
 
+sub edit_MaxRequestWorkers
+{
+return (1,
+	&hlink($text{'core_maxconc'}, "MaxRequestWorkers"),
+	&opt_input($_[0]->{'value'}, "MaxRequestWorkers",
+		   $text{'core_default'}, 4));
+}
+sub save_MaxRequestWorkers
+{
+return &parse_opt("MaxRequestWorkers", '^\d+$',
+		  $text{'core_emaxconc'});
+}
+
 sub edit_MaxKeepAliveRequests
 {
 return (1,
@@ -132,7 +146,7 @@ return &parse_opt("MaxKeepAliveRequests", '^\d+$',
 sub edit_MaxRequestsPerChild
 {
 return (1,
-	$text{'core_maxreq'},
+	&hlink($text{'core_maxreq'}, "MaxRequestsPerChild"),
 	&opt_input($_[0]->{'value'}, "MaxRequestsPerChild", $text{'core_default'}, 5));
 }
 sub save_MaxRequestsPerChild
@@ -144,7 +158,7 @@ return &parse_opt("MaxRequestsPerChild", '^\d+$',
 sub edit_MinSpareServers
 {
 return (1,
-	$text{'core_minspare'},
+	&hlink($text{'core_minspare'}, "MinSpareServers"),
 	&opt_input($_[0]->{'value'},"MinSpareServers",$text{'core_default'}, 4));
 }
 sub save_MinSpareServers
@@ -156,7 +170,7 @@ return &parse_opt("MinSpareServers", '^\d+$',
 sub edit_MaxSpareServers
 {
 return (1,
-	$text{'core_maxspare'},
+	&hlink($text{'core_maxspare'}, "MaxSpareServers"),
 	&opt_input($_[0]->{'value'},"MaxSpareServers",$text{'core_default'}, 4));
 }
 sub save_MaxSpareServers
@@ -168,7 +182,7 @@ return &parse_opt("MaxSpareServers", '^\d+$',
 sub edit_StartServers
 {
 return (1,
-	$text{'core_initial'},
+	&hlink($text{'core_initial'}, "StartServers"),
 	&opt_input($_[0]->{'value'}, "StartServers", $text{'core_default'}, 4));
 }
 sub save_StartServers
@@ -177,9 +191,70 @@ return &parse_opt("StartServers", '^\d+$',
 		  $text{'core_einitial'});
 }
 
+sub edit_ServerLimit
+{
+return (1,
+	&hlink($text{'core_serverlimit'}, "ServerLimit"),
+	&opt_input($_[0]->{'value'}, "ServerLimit", $text{'core_default'}, 4));
+}
+sub save_ServerLimit
+{
+return &parse_opt("ServerLimit", '^\d+$',
+		  $text{'core_eserverlimit'});
+}
+
+sub edit_MinSpareThreads
+{
+return (1,
+	&hlink($text{'worker_minspare'}, "MinSpareThreads"),
+	&opt_input($_[0]->{'value'},"MinSpareThreads",$text{'core_default'}, 4));
+}
+sub save_MinSpareThreads
+{
+return &parse_opt("MinSpareThreads", '^\d+$',
+		  $text{'worker_eminspare'});
+}
+
+sub edit_MaxSpareThreads
+{
+return (1,
+	&hlink($text{'worker_maxspare'}, "MaxSpareThreads"),
+	&opt_input($_[0]->{'value'},"MaxSpareThreads",$text{'core_default'}, 4));
+}
+sub save_MaxSpareThreads
+{
+return &parse_opt("MaxSpareThreads", '^\d+$',
+		  $text{'worker_emaxspare'});
+}
+
+sub edit_ThreadLimit
+{
+return (1,
+	&hlink($text{'worker_threadlimit'}, "ThreadLimit"),
+	&opt_input($_[0]->{'value'},"ThreadLimit",$text{'core_default'}, 4));
+}
+sub save_ThreadLimit
+{
+return &parse_opt("ThreadLimit", '^\d+$',
+		  $text{'worker_ethreadlimit'});
+}
+
+sub edit_ThreadsPerChild
+{
+return (1,
+	&hlink($text{'worker_threads'}, "ThreadsPerChild"),
+	&opt_input($_[0]->{'value'},"ThreadsPerChild",$text{'core_default'}, 4));
+}
+sub save_ThreadsPerChild
+{
+return &parse_opt("ThreadsPerChild", '^\d+$',
+		  $text{'worker_ethreads'});
+}
+
 sub edit_RLimitCPU
 {
-return &rlimit_input("RLimitCPU", $text{'core_cpulimit'}, $_[0]);
+return &rlimit_input("RLimitCPU",
+		     &hlink($text{'core_cpulimit'}, "RLimitCPU"), $_[0]);
 }
 sub save_RLimitCPU
 {
@@ -188,7 +263,8 @@ return &parse_rlimit("RLimitCPU", $text{'core_cpulimit2'});
 
 sub edit_RLimitMEM
 {
-return &rlimit_input("RLimitMEM", $text{'core_memlimit'}, $_[0]);
+return &rlimit_input("RLimitMEM",
+		     &hlink($text{'core_memlimit'}, "RLimitMEM"), $_[0]);
 }
 sub save_RLimitMEM
 {
@@ -197,7 +273,8 @@ return &parse_rlimit("RLimitMEM", $text{'core_memlimit2'});
 
 sub edit_RLimitNPROC
 {
-return &rlimit_input("RLimitNPROC", $text{'core_proclimit'}, $_[0]);
+return &rlimit_input("RLimitNPROC",
+		     &hlink($text{'core_proclimit'}, "RLimitNPROC"), $_[0]);
 }
 sub save_RLimitNPROC
 {
@@ -958,6 +1035,234 @@ if ($in{'AuthType'}) { return ( [ $in{'AuthType'} ] ); }
 else { return ( [ ] ); }
 }
 
+# parse_access_require_rule(value)
+# Maps a Require line to a UI mode and value.
+sub parse_access_require_rule
+{
+my ($value) = @_;
+my $lv = lc($value);
+return ('granted', '') if ($lv eq 'all granted');
+return ('denied', '') if ($lv eq 'all denied');
+return ('local', '') if ($lv eq 'local');
+return ('valid-user', '') if ($lv eq 'valid-user');
+return ('file-owner', '') if ($lv eq 'file-owner');
+return ('file-group', '') if ($lv eq 'file-group');
+if ($value =~ /^(ip|host|env|user|group|method|expr)\s+(.+)$/i) {
+	return (lc($1), $2);
+	}
+return ('other', $value);
+}
+
+# legacy_access_rule_to_require(&directive)
+# Converts a single Allow rule from legacy syntax to a Require mode/value pair.
+sub legacy_access_rule_to_require
+{
+my ($dir) = @_;
+my $what = join(" ", @{$dir->{'words'}});
+$what =~ s/^from\s+//i;
+return ('granted', '') if (lc($what) eq 'all');
+return ('env', $1) if ($what =~ /^env=(\S+)$/i);
+return ($what =~ /^[0-9a-f\.\:\/]+$/i ? 'ip' : 'host', $what);
+}
+
+# legacy_access_to_require_rules(&allow, &deny, &order)
+# For the common Apache 2.4 cases, convert old Allow/Deny/Order rules to Require.
+sub legacy_access_to_require_rules
+{
+my ($allow, $deny, $order) = @_;
+my $orderv = @$order ? lc($order->[0]->{'value'}) : '';
+
+# allow from all
+if (@$allow == 1 && !@$deny && $allow->[0]->{'value'} =~ /^from\s+all$/i) {
+	return [ [ 'granted', '' ] ];
+	}
+
+# deny from all
+if (@$deny == 1 && !@$allow && $deny->[0]->{'value'} =~ /^from\s+all$/i) {
+	return [ [ 'denied', '' ] ];
+	}
+
+# deny from all, then allow some specific requests
+if ($orderv eq 'deny,allow' &&
+    @$deny == 1 &&
+    $deny->[0]->{'value'} =~ /^from\s+all$/i &&
+    @$allow) {
+	my @rv;
+	foreach my $dir (@$allow) {
+		push(@rv, [ &legacy_access_rule_to_require($dir) ]);
+		}
+	return \@rv;
+	}
+
+return [ ];
+}
+
+# access_require_conf_root()
+# Returns the outer-most config list that contains the current section.
+sub access_require_conf_root
+{
+return $vconf if (defined($vconf));
+return $hconf if (defined($hconf));
+return $conf;
+}
+
+# access_require_container_info(&requires, &satisfy)
+# Determines the current top-level Require container mode and rules.
+sub access_require_container_info
+{
+my ($requires, $satisfy) = @_;
+my @all = grep { $_->{'type'} } &find_directive_struct("RequireAll", $conf);
+my @any = grep { $_->{'type'} } &find_directive_struct("RequireAny", $conf);
+my @rules = @$requires;
+my $mode = @$satisfy ? lc($satisfy->[0]->{'value'}) : 'default';
+my $advanced = 0;
+
+if (@all || @any) {
+	$advanced = 1 if (@all + @any > 1 || @$requires || @$satisfy);
+	my $container = @all ? $all[0] : $any[0];
+	$mode = @all ? 'all' : 'any';
+	@rules = ( );
+	foreach my $m (@{$container->{'members'}}) {
+		next if ($m->{'name'} eq 'dummy');
+		if ($m->{'type'} || lc($m->{'name'}) ne 'require') {
+			$advanced = 1;
+			next;
+			}
+		push(@rules, $m);
+		}
+	}
+
+return ($mode, \@rules, $advanced);
+}
+
+sub edit_Require_allow_deny_order_Satisfy
+{
+my ($reqs, $allow, $deny, $order, $satisfy, $e) = @_;
+my (@mode, @value);
+my ($logic, $active_reqs, $advanced) =
+	&access_require_container_info($reqs, $satisfy);
+foreach my $req (@$active_reqs) {
+	my ($m, $v) = &parse_access_require_rule($req->{'value'});
+	push(@mode, $m);
+	push(@value, $v);
+	}
+
+my $has_legacy = @$allow || @$deny || @$order || @$satisfy;
+if (!@mode && $has_legacy) {
+	foreach my $r (@{&legacy_access_to_require_rules($allow, $deny, $order)}) {
+		push(@mode, $r->[0]);
+		push(@value, $r->[1]);
+		}
+	}
+
+push(@mode, "");
+push(@value, "");
+
+my $rv = "";
+if ($has_legacy) {
+	$rv .= &ui_alert($text{'core_require_legacy'}, 'warning',
+		["fa-info-circle", "", 1],
+		{ style => "margin-bottom: 5px;" });
+	}
+if ($advanced) {
+	$rv .= "<i>$text{'core_require_advanced'}</i><br>\n";
+	}
+$rv .= "$text{'core_require_logic'} ".
+	&select_input($logic, "Require_logic", "default",
+		"$text{'core_require_logic_default'},default",
+		"$text{'core_require_logic_any'},any",
+		"$text{'core_require_logic_all'},all")."<br>\n";
+$rv .= &ui_tag("div", "", { style => "height: 5px;" });
+$rv .= "<table border>\n".
+	"<tr $tb> <td><b>$text{'core_require_type'}</b></td> ".
+	"<td><b>$text{'core_require_value'}</b></td> </tr>\n";
+for(my $i=0; $i<@mode; $i++) {
+	$rv .= "<tr $cb>\n";
+	$rv .= "<td>".&select_input($mode[$i], "Require_mode_$i", "",
+		"$text{'default'},",
+		"$text{'core_require_granted'},granted",
+		"$text{'core_require_denied'},denied",
+		"$text{'core_require_local'},local",
+		"$text{'core_require_ip'},ip",
+		"$text{'core_require_host'},host",
+		"$text{'core_require_env'},env",
+		"$text{'core_require_user'},user",
+		"$text{'core_require_group'},group",
+		"$text{'core_require_validuser'},valid-user",
+		"$text{'core_require_fileowner'},file-owner",
+		"$text{'core_require_filegroup'},file-group",
+		"$text{'core_require_method'},method",
+		"$text{'core_require_expr'},expr",
+		"$text{'core_require_other'},other")."</td>\n";
+	$rv .= sprintf "<td><input name=Require_value_%d size=40 value=\"%s\"></td>\n",
+		$i, &html_escape($value[$i]);
+	$rv .= "</tr>\n";
+	}
+$rv .= "</table>\n";
+return (2, $text{'mod_access_restr'}, $rv);
+}
+
+sub save_Require_allow_deny_order_Satisfy
+{
+my (@req);
+for(my $i=0; defined($in{"Require_mode_$i"}); $i++) {
+	my $mode = $in{"Require_mode_$i"};
+	my $value = $in{"Require_value_$i"};
+	$value =~ /\r|\n|\0/ && &error($text{'enewline'});
+	$value =~ s/^\s+//;
+	$value =~ s/\s+$//;
+	next if (!$mode && $value eq '');
+	$mode || &error($text{'core_require_etype'});
+	if ($mode eq 'granted') {
+		push(@req, "all granted");
+		}
+	elsif ($mode eq 'denied') {
+		push(@req, "all denied");
+		}
+	elsif ($mode eq 'local' ||
+	       $mode eq 'valid-user' ||
+	       $mode eq 'file-owner' ||
+	       $mode eq 'file-group') {
+		push(@req, $mode);
+		}
+	elsif ($mode eq 'other') {
+		$value =~ /\S/ || &error($text{'core_require_evalue'});
+		push(@req, $value);
+		}
+	else {
+		$value =~ /\S/ || &error($text{'core_require_evalue'});
+		push(@req, "$mode $value");
+		}
+	}
+
+my $logic = $in{'Require_logic'} || 'default';
+my $root = &access_require_conf_root();
+my @all = grep { $_->{'type'} } &find_directive_struct("RequireAll", $conf);
+my @any = grep { $_->{'type'} } &find_directive_struct("RequireAny", $conf);
+my @containers = (@all, @any);
+
+if (@req && $logic ne 'default') {
+	my $new = {
+		'name' => $logic eq 'all' ? 'RequireAll' : 'RequireAny',
+		'value' => '',
+		'type' => 1,
+		'members' => [ map { {
+			'name' => 'Require',
+			'value' => $_,
+			'type' => 0,
+		} } @req ],
+	};
+	my $old = shift(@containers);
+	&save_directive_struct($old, $new, $conf, $root);
+	}
+
+foreach my $c (@containers) {
+	&save_directive_struct($c, undef, $conf, $root);
+	}
+
+return ( $logic eq 'default' ? \@req : [ ], [ ], [ ], [ ], [ ] );
+}
+
 sub edit_require
 {
 local($rv, $mode, $list);
@@ -1051,7 +1356,7 @@ return &parse_opt("LockFile", '^\S+', $text{'core_elock'});
 
 sub edit_LimitRequestBody
 {
-return (1, $text{'core_maxbody'},
+return (1, &hlink($text{'core_maxbody'}, "LimitRequestBody"),
 	&opt_input($_[0]->{'value'}, "LimitRequestBody", $text{'core_default'}, 8)
 		.&ui_space(2).$text{'bytes'});
 }
@@ -1062,7 +1367,7 @@ return &parse_opt("LimitRequestBody", '^\d+$', $text{'core_ebody'});
 
 sub edit_LimitXMLRequestBody
 {
-return (1, $text{'core_maxxml'},
+return (1, &hlink($text{'core_maxxml'}, "LimitXMLRequestBody"),
 	&opt_input($_[0]->{'value'}, "LimitXMLRequestBody",
 		   $text{'core_default'}, 8).&ui_space(2).$text{'bytes'});
 }
@@ -1075,7 +1380,7 @@ return &parse_opt("LimitXMLRequestBody", '^\d+$', $text{'core_exml'});
 
 sub edit_LimitRequestFields
 {
-return (1, $text{'core_maxhead'},
+return (1, &hlink($text{'core_maxhead'}, "LimitRequestFields"),
 	&opt_input($_[0]->{'value'}, "LimitRequestFields", $text{'core_default'}, 6));
 }
 sub save_LimitRequestFields
@@ -1085,7 +1390,7 @@ return &parse_opt("LimitRequestFields", '^\d+$', $text{'core_ehead'});
 
 sub edit_LimitRequestFieldsize
 {
-return (1, $text{'core_maxshead'},
+return (1, &hlink($text{'core_maxshead'}, "LimitRequestFieldsize"),
 	&opt_input($_[0]->{'value'}, "LimitRequestFieldsize", $text{'core_default'}, 6));
 }
 sub save_LimitRequestFieldsize
@@ -1095,7 +1400,7 @@ return &parse_opt("LimitRequestFieldsize", '^\d+$', $text{'core_eshead'});
 
 sub edit_LimitRequestLine
 {
-return (1, $text{'core_maxline'},
+return (1, &hlink($text{'core_maxline'}, "LimitRequestLine"),
 	&opt_input($_[0]->{'value'}, "LimitRequestLine", $text{'core_default'}, 6));
 }
 sub save_LimitRequestLine
@@ -1402,4 +1707,3 @@ else { return ( [ ], [ ] ); }
 }
 
 1;
-

apache/delete_vservs.cgi

@@ -3,31 +3,107 @@
 
 require './apache-lib.pl';
 &ReadParse();
-&error_setup($text{'delete_err'});
+@d = split(/\0/, $in{'d'});
+$file_action = $in{'toggle'} ? "toggle" : undef;
+&error_setup($file_action ? $text{'enable_err'} : $text{'delete_err'});
 $access{'vaddr'} || &error($text{'delete_ecannot'});
 $conf = &get_config();
-@d = split(/\0/, $in{'d'});
+$can_vhost_files = &can_manage_vhost_files();
 @d || &error($text{'delete_enone'});
 
+if ($file_action) {
+	&can_manage_vhost_files() || &error($text{'enable_elinkdir'});
+	foreach $d (@d) {
+		if ($d =~ /^file\t([^\t]+)/) {
+			$file = $1;
+			}
+		elsif ($d !~ /^file\t/) {
+			($vmembers, $vconf) = &get_virtual_config($d);
+			next if (!$vconf || !&can_edit_virt($vconf));
+			$file = $vconf->{'file'};
+			}
+		else {
+			next;
+			}
+		$rfile = $file ? &simplify_path(&resolve_links($file)) : undef;
+		$files{$rfile}++ if ($rfile && -f $rfile &&
+				      &can_manage_vhost_state_file($rfile));
+		}
+	@files = keys %files;
+	@files || &error($text{'enable_enone'});
+	foreach $file (@files) {
+		$action = &vhost_file_toggle_action($file);
+		$err = &virtualmin_vhost_file_state_error($file, $action);
+		$err && &error($err);
+		$file_actions{$file} = $action;
+		}
+	foreach $file (@files) {
+		$err = $file_actions{$file} eq "enable" ?
+			&enable_vhost_file($file) :
+			&disable_vhost_file($file);
+		$err && &error($err);
+		}
+	&webmin_log($file_action, "vhostfile", scalar(@files));
+	&redirect("");
+	exit;
+	}
+if (!$in{'delete'}) {
+	&error($text{'delete_eaction'});
+	}
+
 # Get them all
 foreach $d (@d) {
+	if ($d =~ /^file\t([^\t]+)\t(\d+)$/) {
+		push(@{$file_lines{$1}}, $2);
+		next;
+		}
+	elsif ($d =~ /^file\t/) {
+		next;
+		}
 	($vmembers, $vconf) = &get_virtual_config($d);
+	$vconf || &error($text{'delete_egone'});
 	&can_edit_virt($vconf) || &error(&text('delete_ecannot2',
 					       &virtual_name($vconf)));
+	$can_vhost_files && &is_default_vhost($vconf) &&
+		&error($text{'delete_edefault'});
 	push(@virts, $vconf);
 	}
+if (%file_lines) {
+	foreach $file (keys %file_lines) {
+		$rfile = &simplify_path(&resolve_links($file));
+		next if (!$rfile || !-f $rfile ||
+			 !&can_manage_vhost_state_file($rfile));
+		@fvirts = &find_virtuals_in_file($rfile);
+		foreach $line (@{$file_lines{$file}}) {
+			($vconf) = grep { $_->{'line'} == $line } @fvirts;
+			$vconf || &error($text{'delete_egone'});
+			&can_edit_virt($vconf) ||
+				&error(&text('delete_ecannot2',
+					     &virtual_name($vconf)));
+			&is_default_vhost($vconf) &&
+				&error($text{'delete_edefault'});
+			push(@{$file_virts{$rfile}}, $vconf);
+			}
+		}
+	}
+@virts || %file_virts || &error($text{'delete_enone'});
 
 # Delete their structures
-&before_changing();
+&before_changing(keys %file_virts);
 foreach $vconf (@virts) {
 	&lock_file($vconf->{'file'});
 	&save_directive_struct($vconf, undef, $conf, $conf);
 	&delete_file_if_empty($vconf->{'file'});
 	}
+foreach $file (keys %file_virts) {
+	&lock_file($file);
+	$deleted += &delete_virtuals_from_file($file, @{$file_virts{$file}});
+	&unlock_file($file);
+	}
 &flush_file_lines();
 &unlock_all_files();
 &update_last_config_change();
 &after_changing();
-&webmin_log("virts", "delete", scalar(@virts));
+$deleted += scalar(@virts);
+&webmin_log("virts", "delete", $deleted);
 &redirect("");
-

apache/edit_defines.cgi

@@ -11,7 +11,8 @@ print $text{'defines_desc'},"<p>\n";
 @defs = &get_httpd_defines(1);
 if (@defs) {
 	print &text('defines_config',
-		  "<tt><b>".join(" ", @defs)."</b></tt>"),"<p>\n";
+		  "<tt><b>".&html_escape(join(" ", @defs))."</b></tt>"),
+	      "<p>\n";
 	}
 
 print &ui_form_start("save_defines.cgi", "post");

apache/edit_global.cgi

@@ -28,7 +28,7 @@ if ($in{'type'} == 6) {
 	print &ui_hr();
 	print &ui_subheading($text{'global_mime'});
 	print "$text{'global_mimedesc'}<p>\n";
-	@links = ( &ui_link("edit_gmime_type.cgi?file=$mfile",
+	@links = ( &ui_link("edit_gmime_type.cgi?file=".&urlize($mfile),
 	           $text{'global_add'}) );
 	print &ui_links_row(\@links);
 	print &ui_columns_start([ $text{'global_type'},
@@ -41,7 +41,8 @@ if ($in{'type'} == 6) {
 		if (/^\s*(\S+)\s*(.*)$/) {
 			print &ui_columns_row([
 				&ui_link("edit_gmime_type.cgi?line=$line".
-				"&file=$mfile", $1), $2 ]);
+				"&file=".&urlize($mfile), &html_escape($1)),
+				&html_escape($2) ]);
 			}
 		$line++;
 		}

apache/help/AssignUserId.html

@@ -0,0 +1,7 @@
+<header>Tie virtual to child process</header>
+The <tt>AssignUserId</tt> directive assigns a virtual host to a child process
+running with the selected user ID and group ID for the legacy perchild MPM.
+<p>
+This directive is only available for Apache versions and MPMs that support
+perchild.
+<p><footer>

apache/help/ChildPerUserId.html

@@ -0,0 +1,7 @@
+<header>Child process UID assignments</header>
+The <tt>ChildPerUserId</tt> directive defines how many child processes should
+run for a selected user ID and group ID in the legacy perchild MPM.
+<p>
+This directive is only available for Apache versions and MPMs that support
+perchild.
+<p><footer>

apache/help/LimitRequestBody.html

@@ -0,0 +1,7 @@
+<header>Maximum request body size</header>
+The <tt>LimitRequestBody</tt> directive sets the maximum allowed size of an HTTP
+request body in bytes.
+<p>
+This can be used to limit upload or form submission size for the server,
+virtual host, directory, or location where the directive is applied.
+<p><footer>

apache/help/LimitRequestFields.html

@@ -0,0 +1,7 @@
+<header>Maximum headers in request</header>
+The <tt>LimitRequestFields</tt> directive sets the maximum number of HTTP
+request header fields that Apache will accept.
+<p>
+Lowering this limit can reduce exposure to unusually large requests, but values
+that are too low can reject legitimate clients.
+<p><footer>

apache/help/LimitRequestFieldsize.html

@@ -0,0 +1,7 @@
+<header>Maximum request header size</header>
+The <tt>LimitRequestFieldSize</tt> directive sets the maximum size of each HTTP
+request header field in bytes.
+<p>
+Lowering this limit can reject oversized request headers, but values that are
+too low can break clients that send larger cookies or authorization headers.
+<p><footer>

apache/help/LimitRequestLine.html

@@ -0,0 +1,7 @@
+<header>Maximum request line size</header>
+The <tt>LimitRequestLine</tt> directive sets the maximum size of the HTTP
+request line in bytes.
+<p>
+This line contains the method, requested URI, and HTTP protocol version. Values
+that are too low can reject legitimate long URLs.
+<p><footer>

apache/help/LimitXMLRequestBody.html

@@ -0,0 +1,6 @@
+<header>Maximum XML request body size</header>
+The <tt>LimitXMLRequestBody</tt> directive sets the maximum allowed size of an
+XML request body in bytes.
+<p>
+It is mainly used by modules that parse XML request bodies, such as WebDAV.
+<p><footer>

apache/help/MaxClients.html

@@ -0,0 +1,8 @@
+<header>Maximum simultaneous requests</header>
+The <tt>MaxClients</tt> directive is the old Apache name for the maximum number
+of requests that can be served at the same time. On Apache 2.4 and newer, the
+equivalent directive is <tt>MaxRequestWorkers</tt>.
+<p>
+For prefork MPM, this limits child server processes. For threaded MPMs, it
+limits the total number of worker threads across all child processes.
+<p><footer>

apache/help/MaxRequestWorkers.html

@@ -0,0 +1,9 @@
+<header>Maximum simultaneous requests</header>
+The <tt>MaxRequestWorkers</tt> directive sets the maximum number of requests
+that Apache can serve at the same time. Requests above this limit wait until an
+existing worker is free.
+<p>
+For prefork MPM, this limits child server processes. For threaded MPMs, it
+limits the total number of worker threads across all child processes. Raising
+this value may also require increasing <tt>ServerLimit</tt>.
+<p><footer>

apache/help/MaxRequestsPerChild.html

@@ -0,0 +1,8 @@
+<header>Maximum requests per child process</header>
+The <tt>MaxRequestsPerChild</tt> directive sets how many requests an Apache
+child process will handle before it exits and is replaced. A value of
+<tt>0</tt> means the process is not recycled because of this limit.
+<p>
+Recycling can help contain memory growth in long-running processes, but setting
+this too low can create unnecessary process churn.
+<p><footer>

apache/help/MaxSpareServers.html

@@ -0,0 +1,8 @@
+<header>Maximum idle server processes</header>
+The <tt>MaxSpareServers</tt> directive sets the maximum number of idle child
+server processes Apache tries to keep when using prefork-style process
+handling.
+<p>
+If more idle child processes are available, Apache stops some of them to avoid
+keeping unnecessary processes running.
+<p><footer>

apache/help/MaxSpareThreads.html

@@ -0,0 +1,7 @@
+<header>Maximum idle worker threads</header>
+The <tt>MaxSpareThreads</tt> directive sets the maximum number of idle worker
+threads Apache tries to keep when using a threaded MPM such as worker or event.
+<p>
+If more idle threads are available, Apache can reduce the number of running
+workers instead of keeping excess capacity open.
+<p><footer>

apache/help/MaxThreadsPerChild.html

@@ -0,0 +1,6 @@
+<header>Maximum threads per child process</header>
+The <tt>MaxThreadsPerChild</tt> directive sets the maximum number of worker
+threads allowed in each child process for the legacy perchild MPM.
+<p>
+This directive only appears for Apache versions and MPMs that support perchild.
+<p><footer>

apache/help/MinSpareServers.html

@@ -0,0 +1,8 @@
+<header>Minimum idle server processes</header>
+The <tt>MinSpareServers</tt> directive sets the minimum number of idle child
+server processes Apache tries to keep ready when using prefork-style process
+handling.
+<p>
+If fewer idle child processes are available, Apache starts more so new
+connections can be accepted without waiting for a process to be created.
+<p><footer>

apache/help/MinSpareThreads.html

@@ -0,0 +1,8 @@
+<header>Minimum idle worker threads</header>
+The <tt>MinSpareThreads</tt> directive sets the minimum number of idle worker
+threads Apache tries to keep ready when using a threaded MPM such as worker or
+event.
+<p>
+If fewer idle threads are available, Apache starts or adjusts child processes
+so new connections can be accepted without waiting for threads to become free.
+<p><footer>

apache/help/NumServers.html

@@ -0,0 +1,6 @@
+<header>Number of child processes</header>
+The <tt>NumServers</tt> directive sets the number of child server processes for
+the legacy perchild MPM.
+<p>
+This directive only appears for Apache versions and MPMs that support perchild.
+<p><footer>

apache/help/RLimitCPU.html

@@ -0,0 +1,8 @@
+<header>CPU resource limit</header>
+The <tt>RLimitCPU</tt> directive sets a CPU time resource limit for processes
+started by Apache in this context, such as CGI programs where supported by the
+operating system.
+<p>
+The soft limit is applied first. If a hard limit is also set, it is the maximum
+value that the process can raise the soft limit to.
+<p><footer>

apache/help/RLimitMEM.html

@@ -0,0 +1,8 @@
+<header>Memory resource limit</header>
+The <tt>RLimitMEM</tt> directive sets a memory resource limit for processes
+started by Apache in this context, such as CGI programs where supported by the
+operating system.
+<p>
+The soft limit is applied first. If a hard limit is also set, it is the maximum
+value that the process can raise the soft limit to.
+<p><footer>

apache/help/RLimitNPROC.html

@@ -0,0 +1,8 @@
+<header>Process limit</header>
+The <tt>RLimitNPROC</tt> directive sets a process count resource limit for
+processes started by Apache in this context, such as CGI programs where
+supported by the operating system.
+<p>
+The soft limit is applied first. If a hard limit is also set, it is the maximum
+value that the process can raise the soft limit to.
+<p><footer>

apache/help/ServerLimit.html

@@ -0,0 +1,9 @@
+<header>Server process limit</header>
+The <tt>ServerLimit</tt> directive sets the hard upper limit on the number of
+Apache child server processes. It caps values such as
+<tt>MaxRequestWorkers</tt> for prefork MPM, and works with
+<tt>ThreadsPerChild</tt> for threaded MPMs.
+<p>
+Increasing this value may require a full Apache stop and start before it takes
+effect.
+<p><footer>

apache/help/StartServers.html

@@ -0,0 +1,7 @@
+<header>Server processes at startup</header>
+The <tt>StartServers</tt> directive sets how many child server processes Apache
+starts when the server first launches.
+<p>
+Apache adjusts the number of child processes after startup based on traffic and
+the spare process or spare thread limits.
+<p><footer>

apache/help/StartThreads.html

@@ -0,0 +1,7 @@
+<header>Initial threads per child process</header>
+The <tt>StartThreads</tt> directive sets how many worker threads are created at
+startup for legacy threaded MPMs that support this directive.
+<p>
+Apache may adjust the number of running workers after startup based on traffic
+and the configured spare thread limits.
+<p><footer>

apache/help/ThreadLimit.html

@@ -0,0 +1,7 @@
+<header>Thread limit per child process</header>
+The <tt>ThreadLimit</tt> directive sets the hard upper limit for the number of
+worker threads that can be configured in each child process.
+<p>
+It must be high enough for <tt>ThreadsPerChild</tt>. Increasing this value may
+require a full Apache stop and start before it takes effect.
+<p><footer>

apache/help/ThreadsPerChild.html

@@ -0,0 +1,7 @@
+<header>Worker threads per child process</header>
+The <tt>ThreadsPerChild</tt> directive sets how many worker threads Apache
+creates in each child process when using a threaded MPM.
+<p>
+The total request capacity for threaded MPMs is controlled by this value
+together with <tt>ServerLimit</tt> and <tt>MaxRequestWorkers</tt>.
+<p><footer>

apache/index.cgi

@@ -102,6 +102,10 @@ if (&can_edit_virt()) {
 	push(@vproxy, undef);
 	$sn ||= &get_system_hostname();
 	push(@vurl, $defport ? "http://$sn:$defport/" : "http://$sn/");
+	push(@vfile, undef);
+	push(@vstatus, "");
+	push(@vsel, undef);
+	push(@vfilemanage, 0);
 	$showing_default++;
 	}
 
@@ -128,16 +132,23 @@ elsif ($httpd_modules{'core'} >= 1.2) {
 	$ba = &find_directive("ServerName", $conf);
 	$nv{&to_ipaddress($ba ? $ba : &get_system_hostname())}++;
 	}
-@virt = grep { &can_edit_virt($_) } @virt;
+$can_vhost_files = &can_manage_vhost_files();
+@vrows = &get_virtual_list_rows($conf);
 if ($config{'show_order'} == 1) {
 	# sort by server name
-	@virt = sort { &server_name_sort($a) cmp &server_name_sort($b) } @virt;
+	@vrows = sort { &server_name_sort($a->{'virt'}) cmp
+			&server_name_sort($b->{'virt'}) } @vrows;
 	}
 elsif ($config{'show_order'} == 2) {
 	# sort by IP address
-	@virt = sort { &server_ip_sort($a) cmp &server_ip_sort($b) } @virt;
+	@vrows = sort { &server_ip_sort($a->{'virt'}) cmp
+			&server_ip_sort($b->{'virt'}) } @vrows;
 	}
-foreach $v (@virt) {
+@virt = map { $_->{'virt'} } grep { $_->{'active'} } @vrows;
+%available_vhost_file = map { $_, 1 } &get_vhost_available_files()
+	if ($can_vhost_files);
+foreach $r (@vrows) {
+	$v = $r->{'virt'};
 	$vm = $v->{'members'};
 	if ($v->{'words'}->[0] =~ /^\[(\S+)\]:(\d+)$/) {
 		# IPv6 address and port
@@ -163,7 +174,7 @@ foreach $v (@virt) {
 	$idx = &indexof($v, @$conf);
 	push(@vidx, $idx);
 	push(@vname, $text{'index_virt'});
-	push(@vlink, "virt_index.cgi?virt=$idx");
+	push(@vlink, $r->{'active'} ? "virt_index.cgi?virt=$idx" : undef);
 	$sname = &find_directive("ServerName", $vm);
 	local $daddr = $addr eq "_default_" ||
                        ($addr eq "*" && $httpd_modules{'core'} < 1.2);
@@ -225,10 +236,34 @@ foreach $v (@virt) {
 		}
 	$sp = undef if ($sp == 80 && $prot eq "http" ||
 			$sp == 443 && $prot eq "https");
-	push(@vurl, $sp ? "$prot://$sn:$sp/" : "$prot://$sn/");
+	push(@vurl, $r->{'active'} ?
+		    ($sp ? "$prot://$sn:$sp/" : "$prot://$sn/") : undef);
+	local $rfile = $r->{'file'} ? &simplify_path(&resolve_links($r->{'file'}))
+				    : undef;
+	push(@vfile, $rfile);
+	local $status = "";
+	if ($can_vhost_files && $rfile && $available_vhost_file{$rfile}) {
+		local $enabled = &vhost_file_state($rfile)->{'enabled'};
+		$status = $enabled ? $text{'index_enabled'} :
+				     $text{'index_disabled'};
+		}
+	push(@vstatus, $status);
+	local $file_manage = $can_vhost_files && $rfile &&
+			     $available_vhost_file{$rfile} &&
+			     &can_manage_vhost_state_file($rfile);
+	push(@vfilemanage, $file_manage ? 1 : 0);
+	local $sel;
+	if ($r->{'active'} && (!$can_vhost_files || !&is_default_vhost($v))) {
+		$sel = $idx;
+		}
+	elsif (!$r->{'active'} && $can_vhost_files && $rfile &&
+	       $available_vhost_file{$rfile} && $file_manage) {
+		$sel = "file\t".$rfile."\t".$v->{'line'};
+		}
+	push(@vsel, $sel);
 	}
 
-if (@vlink == 1 && !$access{'global'} && $access{'virts'} ne "*" &&
+if (@vlink == 1 && $vlink[0] && !$access{'global'} && $access{'virts'} ne "*" &&
     !$access{'create'} && $access{'noconfig'}) {
 	# Can only manage one vhost, so go direct to it
 	&redirect($vlink[0]);
@@ -297,7 +332,9 @@ if ($access{'global'}) {
 # work out select links
 print &ui_tabs_start_tab("mode", "list");
 #print $text{'index_desclist'},"<p>\n";
-$showdel = $access{'vaddr'} && ($vidx[0] || $vidx[1]);
+$showdel = $access{'vaddr'} &&
+	   grep { defined($_) && $_ ne "" } @vsel;
+$showtoggle = $can_vhost_files && grep { $_ } @vfilemanage;
 @links = ( );
 if ($showdel) {
 	push(@links, &select_all_link("d"),
@@ -326,8 +363,10 @@ if ($config{'max_servers'} && @vname > $config{'max_servers'}) {
 	}
 elsif ($config{'show_list'} && scalar(@vname)) {
 	# as list for people with lots of servers
+	$list_form = "vhosts_form";
 	if ($showdel) {
-		print &ui_form_start("delete_vservs.cgi", "post");
+		print &ui_form_start("delete_vservs.cgi", "post", undef,
+				     "id='$list_form'");
 		}
 	print &ui_links_row(\@links);
 	print &ui_columns_start([
@@ -337,19 +376,23 @@ elsif ($config{'show_list'} && scalar(@vname)) {
 		$text{'index_port'},
 		$text{'index_name'},
 		$text{'index_root'},
+		$can_vhost_files ? ( $text{'index_status'} ) : ( ),
 		$text{'index_url'} ], 100);
 	for($i=0; $i<@vname; $i++) {
 		local @cols;
-		push(@cols, &ui_link($vlink[$i], $vname[$i]) );
+		push(@cols, $vlink[$i] ? &ui_link($vlink[$i], $vname[$i]) :
+					  $vname[$i] );
 		push(@cols, &html_escape($vaddr[$i]));
 		push(@cols, &html_escape($vport[$i]));
 		push(@cols, $vserv[$i] || $text{'index_auto'});
 		push(@cols, &html_escape($vproxy[$i]) ||
 			    &html_escape($vroot[$i]));
-		push(@cols, &ui_link($vurl[$i], $text{'index_view'}) );
-		if ($showdel && $vidx[$i]) {
+		push(@cols, $vstatus[$i]) if ($can_vhost_files);
+		push(@cols, $vurl[$i] ? &ui_link($vurl[$i], $text{'index_view'}) :
+					"" );
+		if ($showdel && defined($vsel[$i]) && $vsel[$i] ne "") {
 			print &ui_checked_columns_row(\@cols, undef,
-						      "d", $vidx[$i]);
+						      "d", $vsel[$i]);
 			}
 		elsif ($showdel) {
 			print &ui_columns_row([ "", @cols ]);
@@ -361,13 +404,23 @@ elsif ($config{'show_list'} && scalar(@vname)) {
 	print &ui_columns_end();
 	print &ui_links_row(\@links);
 	if ($showdel) {
-		print &ui_form_end([ [ "delete", $text{'index_delete'} ] ]);
+		if ($showtoggle) {
+			print &ui_form_end_side_by_side($list_form,
+				[ [ "delete", $text{'index_delete'} ] ],
+				[ [ "toggle", $text{'index_toggle'}, undef,
+				    undef, "form=\"$list_form\"" ] ]);
+			}
+		else {
+			print &ui_form_end([ [ "delete", $text{'index_delete'} ] ]);
+			}
 		}
 	}
 else {
 	# as icons for niceness
+	$list_form = "vhosts_form";
 	if ($showdel) {
-		print &ui_form_start("delete_vservs.cgi", "post");
+		print &ui_form_start("delete_vservs.cgi", "post", undef,
+				     "id='$list_form'");
 		}
 	print &ui_links_row(\@links);
 	print "<table width=100% cellpadding=5>\n";
@@ -376,8 +429,9 @@ else {
 		print '<div class="row icons-row inline-row">';
 		&generate_icon("images/virt.gif", $vname[$i], $vlink[$i],
 			       undef, undef, undef,
-			       $vidx[$i] && $access{'vaddr'} ?
-					&ui_checkbox("d", $vidx[$i]) : "");
+			       defined($vsel[$i]) && $vsel[$i] ne "" &&
+			       $access{'vaddr'} ?
+					&ui_checkbox("d", $vsel[$i]) : "");
 		print "</div>\n";
 		print "</td> <td valign=top>\n";
 		print "$vdesc[$i]<br>\n";
@@ -397,12 +451,24 @@ else {
 			print "<b>$text{'index_root'}</b> ",
 			      &html_escape($vroot[$i]),"</td> </tr>\n";
 			}
+		if ($can_vhost_files && $vstatus[$i]) {
+			print "<tr><td colspan=2><b>$text{'index_status'}</b> ",
+			      $vstatus[$i],"</td></tr>\n";
+			}
 		print "</table></td> </tr>\n";
 		}
 	print "</table>\n";
 	print &ui_links_row(\@links);
 	if ($showdel) {
-		print &ui_form_end([ [ "delete", $text{'index_delete'} ] ]);
+		if ($showtoggle) {
+			print &ui_form_end_side_by_side($list_form,
+				[ [ "delete", $text{'index_delete'} ] ],
+				[ [ "toggle", $text{'index_toggle'}, undef,
+				    undef, "form=\"$list_form\"" ] ]);
+			}
+		else {
+			print &ui_form_end([ [ "delete", $text{'index_delete'} ] ]);
+			}
 		}
 	}
 print &ui_tabs_end_tab();
@@ -492,4 +558,3 @@ return $addr eq '_default_' || $addr eq '*' ? undef :
        $addr =~ /^\[(\S+)\]$/ && &check_ip6address($1) ? $1 :
 			         &to_ipaddress($addr);
 }
-

apache/lang/ar.auto

@@ -330,7 +330,7 @@ acl_types=أنواع التوجيه المتاحة
 acl_all=الكل
 acl_sel=المحدد ..
 acl_names=يمكن تعديل أسماء الخادم؟
-acl_dirs=Apache directives available<br><font size=-1>(Subject to types limit above)</font>
+acl_dirs=توجيهات Apache المتاحة، وفقًا لأنواع التوجيهات المحددة أعلاه
 acl_dirs0=الكل
 acl_dirs1=المدرجة فقط ..
 acl_dirs2=كل ما عدا المدرجة ..

apache/lang/bg

@@ -329,7 +329,7 @@ acl_types=Налични видове директиви
 acl_all=Всички
 acl_sel=Избрани..
 acl_names=Може да редактира имена на сървъри?
-acl_dirs=Достъпни директиви на Apache<br><font size=-1>(съгласно лимита на типове по-горе)</font>
+acl_dirs=Налични директиви на Apache, ограничени от избраните по-горе типове директиви
 acl_dirs0=Всички
 acl_dirs1=Само изброените ..
 acl_dirs2=Всички освен изброените ..

apache/lang/ca

@@ -329,7 +329,7 @@ acl_types=Tipus de directives disponibles
 acl_all=Tots
 acl_sel=Seleccionats...
 acl_names=Pot editar els noms dels servidors
-acl_dirs=Directives Apache disponibles<br><font size=-1>(Subjectes al límit de tipus superior)</font>
+acl_dirs=Directives Apache disponibles, limitades pels tipus de directiva seleccionats a sobre
 acl_dirs0=Totes
 acl_dirs1=Només les llistades
 acl_dirs2=Totes excepte les llistades

apache/lang/cs

@@ -320,7 +320,7 @@ acl_types=Typy direktiv k dispozici
 acl_all=Všechny
 acl_sel=Vybrané..
 acl_names=Mohu upravovat názvy serverů?
-acl_dirs=Direktivy Apache jsou přístupné<br><font size=-1>(Subject to types limit above)</font>
+acl_dirs=Dostupné direktivy Apache, omezené typy direktiv vybranými výše
 acl_dirs0=Vše
 acl_dirs1=Jen vybrané ..
 acl_dirs2=Vše kromě vybraných ..

apache/lang/da

@@ -78,7 +78,7 @@ acl_types=Tilgængelige direktiv typer
 acl_all=Alle
 acl_sel=Valgte ..
 acl_names=Kan redigere servernavne?
-acl_dirs=Apache direktiver tilgængelige<br><font size=-1>(Subjekt tor type begrænsinger ovenfor)</font>
+acl_dirs=Tilgængelige Apache-direktiver, begrænset af de direktivtyper, der er valgt ovenfor
 acl_dirs0=Alle
 acl_dirs1=Kun listede ..
 acl_dirs2=Alle undtagen listede ..

apache/lang/de

@@ -331,7 +331,7 @@ acl_types=Verfügbare Direktiventypen
 acl_all=Alle
 acl_sel=Ausgewählt..
 acl_names=Kann Servernamen bearbeiten?
-acl_dirs=Verfügbare Apache-Direktiven<br><font size=-1>(Abhängig von obigen Typenbeschränkungen)</font>
+acl_dirs=Verfügbare Apache-Direktiven, eingeschränkt durch die oben ausgewählten Direktivtypen
 acl_dirs0=Alle
 acl_dirs1=Nur aufgeführte ..
 acl_dirs2=Alle außer aufgeführte ..

apache/lang/el

@@ -329,7 +329,7 @@ acl_types=Directive types available
 acl_all=All
 acl_sel=Selected..
 acl_names=Can edit server names?
-acl_dirs=Apache directives available<br><font size=-1>(Subject to types limit above)</font>
+acl_dirs=Διαθέσιμες οδηγίες Apache, περιορισμένες από τους τύπους οδηγιών που έχουν επιλεγεί παραπάνω
 acl_dirs0=All
 acl_dirs1=Only listed ..
 acl_dirs2=All except listed ..

apache/lang/en

@@ -34,6 +34,9 @@ index_listen=Listen on address (if needed)
 index_port=Port
 index_name=Server Name
 index_root=Document Root
+index_status=State
+index_enabled=Enabled
+index_disabled=Disabled
 index_url=URL
 index_view=Open..
 index_adddir=Allow access to this directory
@@ -57,6 +60,7 @@ index_fmode1=Virtual servers file $1
 index_fmode1d=New file under virtual servers directory $1
 index_fmode2=Selected file..
 index_delete=Delete Selected Servers
+index_toggle=Toggle State
 
 cvirt_ecannot=You are not allowed to create a virtual server
 cvirt_err=Failed to create virtual server
@@ -332,7 +336,7 @@ acl_types=Directive types available
 acl_all=All
 acl_sel=Selected..
 acl_names=Can edit server names?
-acl_dirs=Apache directives available<br><font size=-1>(Subject to types limit above)</font>
+acl_dirs=Available Apache directives, limited by the directive types selected above
 acl_dirs0=All
 acl_dirs1=Only listed ..
 acl_dirs2=All except listed ..
@@ -342,13 +346,15 @@ core_maxkeep=Maximum keepalives per connection
 core_maxreq=Maximum requests per server process
 core_minspare=Minimum spare server processes
 core_maxspare=Maximum spare server processes
-core_initial=Initial server processes
+core_initial=Server processes at startup
+core_serverlimit=Server process limit
 core_emaxconc=Maximum concurrent requests must be an integer
 core_emaxkeep=Maximum keepalives per connection must be an integer
 core_emaxreq=Maximum requests per server process must be an integer
 core_eminspare=Minimum spare server processes must be an integer
 core_emaxspare=Maximum spare server processes must be an integer
-core_einitial=Initial server processes must be an integer
+core_einitial=Server processes at startup must be an integer
+core_eserverlimit=Server process limit must be an integer
 core_default=Default
 core_cpulimit=CPU resource limit
 core_memlimit=Memory resource limit
@@ -873,6 +879,30 @@ mod_access_epip='$1' is not a valid partial IP address
 mod_access_emask='$1' is not a valid network/netmask pair
 mod_access_ecidr='$1' is not a valid network/CIDR pair
 mod_access_evar='$1' is not a valid variable name
+core_require_legacy=Legacy Allow/Deny/Order directives were found. Apache 2.4 uses Require rules. Saving this form will replace the legacy directives with the Require rules below.
+core_require_advanced=Advanced authorization containers were found. This form edits a flat set of Require rules with an optional top-level RequireAny or RequireAll block. Saving will replace nested or mixed authorization containers.
+core_require_logic=Authorization logic
+core_require_logic_default=Default flat Require rules
+core_require_logic_any=Any rule may match
+core_require_logic_all=All rules must match
+core_require_type=Rule type
+core_require_value=Value or arguments
+core_require_granted=Allow all requests
+core_require_denied=Deny all requests
+core_require_local=Only local requests
+core_require_ip=Request from IP or network
+core_require_host=Request from host
+core_require_env=If variable is set
+core_require_user=Only these users
+core_require_group=Only these groups
+core_require_validuser=All valid users
+core_require_fileowner=File owner matches
+core_require_filegroup=Group owner matches
+core_require_method=HTTP method
+core_require_expr=Expression
+core_require_other=Raw Require rule
+core_require_etype=You must select a Require rule type
+core_require_evalue=You must enter a value for the selected Require rule
 
 mod_auth_ufile=User text file
 mod_auth_uedit=Edit users
@@ -1008,6 +1038,7 @@ log_stop=Stopped webserver
 log_apply=Applied changes
 log_manual=Manually edited configuration file $1
 log_virts_delete=Deleted $1 virtual servers
+log_toggle_vhostfile=Toggled state of $1 virtual host files
 
 search_title=Find Servers
 search_notfound=No matching virtual servers found
@@ -1035,6 +1066,8 @@ worker_eminspare=Minimum spare threads must be an integer
 worker_emaxspare=Maximum spare threads must be an integer
 worker_threads=Threads per child process
 worker_ethreads=Number of threads per child process must be an integer
+worker_threadlimit=Thread limit per child process
+worker_ethreadlimit=Thread limit per child process must be an integer
 
 perchild_sthreads=Initial threads per child process
 perchild_esthreads=Number of threads per child process must be an integer
@@ -1124,6 +1157,22 @@ delete_err=Failed to delete virtual servers
 delete_enone=None selected
 delete_ecannot=You are not allowed to delete servers
 delete_ecannot2=You are not allowed to edit the server $1
+delete_eaction=No action was selected
+delete_egone=The selected virtual server no longer exists
+delete_edefault=The default virtual server cannot be deleted
+
+enable_err=Failed to change virtual host file state
+enable_enone=No manageable virtual host files were selected
+enable_efile=Virtual host file does not exist or cannot be managed
+enable_elinkdir=No enabled virtual host links directory is configured
+enable_elink=Failed to create symbolic link $1 : $2
+enable_eunlink=Failed to remove symbolic link $1 : $2
+enable_elinkexists=The symbolic link $1 already exists
+enable_etest=Apache configuration test failed after changing the virtual host file state : $1
+enable_evirtualmin_disable=This Apache virtual host is managed by Virtualmin virtual server $1, which is currently $2. Site disabling should be done in Virtualmin using $3.
+enable_evirtualmin_enable=This Apache virtual host is managed by Virtualmin virtual server $1, which is currently $2. Site enabling should be done in Virtualmin using $3.
+enable_virtualmin_disable_label=Disable and Delete &#x21fe; Disable Virtual Server
+enable_virtualmin_enable_label=Disable and Delete &#x21fe; Enable Virtual Server
 
 syslog_desc=Apache error log
 

apache/lang/es.auto

@@ -33,7 +33,7 @@ htaccess_err=Error al crear el archivo de opciones
 defines_list=Parámetros definidos
 
 acl_aliasdir=Limite los alias al directorio
-acl_dirs=Directivas de Apache disponibles <br><font size=-1> (Sujeto al límite de tipos anterior) </font>
+acl_dirs=Directivas de Apache disponibles, limitadas por los tipos de directiva seleccionados arriba
 acl_dirs0=Todos
 acl_dirs1=Solo listado ..
 acl_dirs2=Todos excepto los enumerados.