Fix to require trusted proxies for SSL client cert headers

This PR tightens handling of proxied SSL client certificate headers so they are only honored when Webmin is configured to trust SSL headers and the direct TCP peer matches an explicit `trusted_proxies` entry.

The change preserves legacy forwarded-IP behavior for `trust_real_ip`, but prevents ambiguous legacy configs with no trusted proxy from accepting spoofable `X-SSL-Client-*` headers as authentication identity. During postinstall, such legacy configs now default to `no_trust_ssl=1`.

.github/workflows/close-inactive.yml

@@ -0,0 +1,15 @@
+name: Close inactive
+
+on:
+  schedule:
+    - cron: "0 12 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
+jobs:
+  close-inactive:
+    uses: webmin/webmin-ci-cd/.github/workflows/close-inactive.yml@main

.github/workflows/tests.yml

@@ -0,0 +1,19 @@
+name: Tests
+
+on:
+  pull_request:
+    branches:
+      - master
+  push:
+    branches:
+      - master
+
+jobs:
+  prove:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install Perl::Critic
+        run: sudo apt-get update && sudo apt-get install -y libperl-critic-perl
+      - name: prove -lr
+        run: prove -lr

.github/workflows/webmin.dev+webmin.yml

@@ -1,4 +1,4 @@
-name: "webmin.dev: webmin/webmin"
+name: Package and upload artifacts
 
 on:
   push:
@@ -25,3 +25,5 @@ jobs:
       PRERELEASE_UPLOAD_SSH_DIR: ${{ secrets.PRERELEASE_UPLOAD_SSH_DIR }}
       DEV_SSH_PRV_KEY: ${{ secrets.DEV_SSH_PRV_KEY }}
       ALL_GPG_PH2: ${{ secrets.ALL_GPG_PH2 }}
+      CODE_REVIEW_API_KEY: ${{ secrets.CODE_REVIEW_API_KEY }}
+      CODE_REVIEW_SMTP_PASSWORD: ${{ secrets.CODE_REVIEW_SMTP_PASSWORD }}

.perlcriticrc

@@ -0,0 +1,6 @@
+severity = 5
+
+# Octal file permission literals (0700, 0640, etc.) are the standard Perl
+# idiom for chmod/mkdir/permission helpers throughout this codebase. The
+# policy flags chmod 0700 itself, so it is too coarse for our use.
+[-ValuesAndExpressions::ProhibitLeadingZeros]

CHANGELOG.md

@@ -1,5 +1,65 @@
 ## Changelog
 
+#### 2.652 (July, 2026)
+* Fix to recognize hex numeric HTML entities to work in various elements
+
+#### 2.651 (June 28, 2026)
+* Fix Certbot-backed certificate requests and renewals to correctly parse PEM paths after issuance
+* Fix live activation of Linux bond interfaces [#2777](https://github.com/webmin/webmin/pull/2777)
+* Update the Authentic theme to the latest version with various improvements and fixes:
+  - Fix search-result all-items delete in File Manager
+  - Fix search-result delete ordering in File Manager
+  - Fix to speed up search-result deletion cleanup in File Manager
+
+#### 2.650 (June 25, 2026)
+* Add new Systemd Services and Units module
+* Add new GRUB 2 Boot Loader module
+* Add new Kea DHCP Server module
+* Add WebSocket proxy support to the Webmin Servers Index module
+* Add basic Alpine Linux support
+* Add IP-based Let's Encrypt certificate support with Certbot 5.3
+* Add editable SSH public keys for newly added Unix users in Users and Groups module
+* Add improvements to custom Webmin temporary directory handling
+* Add quick service and port forwarding controls to the nftables module
+* Add optional pre- and post-scripts for scheduled package updates
+* Add option to control when scheduled package update email is sent
+* Add per-user RPC/API-only access option to the Webmin Users module
+* Add Apache 2.4 MPM process limit directives [#1821](https://github.com/webmin/webmin/issues/1821)
+* Add dhcpcd network backend for Debian and Raspberry Pi OS [#1607](https://github.com/webmin/webmin/issues/1607)
+* Add hardware RAID passthrough devices config in the SMART Status module [#1704](https://github.com/webmin/webmin/issues/1704)
+* Update Xterm.js to fix Control-C handling on iPadOS/Safari terminals
+* Update Webmin systemd service unit to run without forking
+* Fix IPv6 CIDR access control matching [#1570](https://github.com/webmin/webmin/issues/1570)
+* Fix Bootup and Shutdown module to show only services and not all units on systemd systems
+* Fix Let's Encrypt renewal scheduling to count from the last successful request
+* Fix NetworkManager detection on Debian and IPv6 DNS nameserver saving
+* Fix Dovecot configuration file handling when saving extra configs
+* Fix mailbox listing to skip unusable Maildir entries and remove stale deleted or moved entries
+* Fix Postfix module labels to identify virtual alias maps instead of virtual mailbox domains #1541
+* Fix Apache module to hide disabled default virtual hosts from the active server list
+* Fix Netplan DNS saving to preserve YAML structure
+* Fix BIND DNS handling of underscores, trailing dots, and mass record length checks
+* Fix MariaDB user creation when using auth plugin syntax
+* Fix PHP-FPM monitor on EL systems when using `/etc/php.ini` as the config file
+* Fix RPC-only accounts to block browser/module access before module ACL checks
+* Fix reflected XSS in Webmin status messages
+* Fix path validation in File Manager, package delete helpers, and Apache virtual host files
+* Fix authentication state handling for SSL certificate logins and proxied keep-alive requests
+* Update session handling to improve security, which will require users to re-authenticate after upgrading
+* Update the Authentic theme to the latest version with various improvements and fixes:
+  - Add zooming to stats history graphs by holding shift and scrolling in the dashboard
+  - Add support for saving live stats history for up to 24 hours without performance impact
+  - Add better support for the new Nginx, nftables, and upcoming systemd, Kea-DHCP, and GRUB 2 Webmin modules
+  - Add ability to always show available dashboard panels in theme configuration
+  - Add support for live stats and terminal WebSocket connections through Webmin Servers Index proxy links
+  - Fix proxying when Webmin is accessed with a webprefix using Webmin Servers Index module
+  - Fix theme UI helpers to escape generated markup more safely
+  - Fix iOS terminal viewport sizing
+  - Fix editor save handling, clean-state indication and dirty reload guard
+  - Fix popover positioning, z-index and border color for help bubbles
+  - Fix the active product switch border in the navigation menu for the dark palette
+  - Fix to validate password reset return URLs
+
 #### 2.641 (May 10, 2026)
 * Fixed a bug when editing monitors in the System and Server Status module
 * Fix Fail2Ban default jail options
@@ -912,4 +972,3 @@ This updated includes the latest Authentic theme, a new IPv6 Firewall module for
 #### Version 1.140
 * Fixed a security hole that allowed any user to view the configuration of any module, even those that they should not have access to.
 * Fixed a security hole that could allow an attacker to lock valid users by sending a bogus username or password.
-

acl/acl-lib.pl

@@ -11,7 +11,7 @@ Library for editing webmin users, passwords and access rights.
 
 =cut
 
-BEGIN { push(@INC, ".."); };
+BEGIN { push(@INC, ".."); };    ## no critic
 use strict;
 use warnings;
 no warnings 'redefine';
@@ -92,7 +92,6 @@ while(my $l = <$fh>) {
 		$user{'locale'} = $gconfig{"locale_$user[0]"};
 		$user{'dateformat'} = $gconfig{"dateformat_$user[0]"};
 		$user{'notabs'} = $gconfig{"notabs_$user[0]"};
-		$user{'rbacdeny'} = $gconfig{"rbacdeny_$user[0]"};
 		if ($gconfig{"theme_$user[0]"}) {
 			($user{'theme'}, $user{'overlay'}) =
 				split(/\s+/, $gconfig{"theme_$user[0]"});
@@ -353,7 +352,8 @@ each of which is a hash reference in the same format as their module.info files.
 sub list_module_infos
 {
 my @mods = grep { &check_os_support($_) } &get_all_module_infos();
-return sort { $a->{'desc'} cmp $b->{'desc'} } @mods;
+my @sorted = sort { $a->{'desc'} cmp $b->{'desc'} } @mods;
+return @sorted;
 }
 
 =head2 create_user(&details, [clone])
@@ -501,8 +501,6 @@ else {
 	$gconfig{"lang_".$user->{'name'}} = $user->{'lang'} if ($user->{'lang'});
 	delete($gconfig{"notabs_".$user->{'name'}});
 	$gconfig{"notabs_".$user->{'name'}} = $user->{'notabs'} if ($user->{'notabs'});
-	delete($gconfig{"rbacdeny_".$user->{'name'}});
-	$gconfig{"rbacdeny_".$user->{'name'}} = $user->{'rbacdeny'} if ($user->{'rbacdeny'});
 	delete($gconfig{"ownmods_".$user->{'name'}});
 	$gconfig{"ownmods_".$user->{'name'}} = join(" ", @{$user->{'ownmods'}})
 		if ($user->{'ownmods'} && @{$user->{'ownmods'}});
@@ -722,9 +720,6 @@ else {
 	delete($gconfig{"notabs_".$username});
 	$gconfig{"notabs_".$user->{'name'}} = $user->{'notabs'}
 		if ($user->{'notabs'});
-	delete($gconfig{"rbacdeny_".$username});
-	$gconfig{"rbacdeny_".$user->{'name'}} = $user->{'rbacdeny'}
-		if ($user->{'rbacdeny'});
 	delete($gconfig{"ownmods_".$username});
 	$gconfig{"ownmods_".$user->{'name'}} = join(" ", @{$user->{'ownmods'}})
 		if ($user->{'ownmods'} && @{$user->{'ownmods'}});
@@ -1337,12 +1332,12 @@ my ($miniserv) = @_;
 my $sfile = $miniserv->{'sessiondb'} ? $miniserv->{'sessiondb'} :
 	    $miniserv->{'pidfile'} =~ /^(.*)\/[^\/]+$/ ? "$1/sessiondb"
 						     : return;
-eval "use SDBM_File";
+eval { require SDBM_File; SDBM_File->import; 1 };
 dbmopen(%sessiondb, $sfile, 0700);
 eval { $sessiondb{'1111111111'} = 'foo bar' };
 if ($@) {
 	dbmclose(%sessiondb);
-	eval "use NDBM_File";
+	eval { require NDBM_File; NDBM_File->import; 1 };
 	dbmopen(%sessiondb, $sfile, 0700);
 	}
 else {
@@ -1428,16 +1423,158 @@ Creates a new session ID that's already logged in as the given user
 sub create_session_user
 {
 my ($miniserv, $username, $lifetime) = @_;
-return undef if (&is_readonly_mode());
+return if (&is_readonly_mode());
 &open_session_db($miniserv);
 my $sid = &generate_random_session_id();
-return undef if (!$sid);
+return if (!$sid);
 my $t = time();
 $sessiondb{$sid} = "$username $t 127.0.0.1".($lifetime ? " ".$lifetime : "");
 dbmclose(%sessiondb);
 return $sid;
 }
 
+=head2 set_module_access(&modules, enabled, [&users-groups])
+
+Grants or revokes Webmin module access for users and groups. The modules
+parameter must be an array ref of module names. The enabled flag should be
+1 to grant access, or 0 to revoke access. If the users-groups parameter is
+not given, all users and groups are updated. Otherwise, it must be an array
+ref of usernames and group names. Group names may be prefixed with @ to
+target only a group.
+
+Returns the number of directly updated user and group records.
+
+=cut
+sub set_module_access
+{
+my ($mods, $enabled, $usersgroups) = @_;
+$mods ||= [];
+return 0 if (!@$mods);
+my $set_module_access_list = sub {
+	my ($obj, $key, $addmods) = @_;
+	$addmods ||= $mods;
+	my @old = @{$obj->{$key} || []};
+	my @new;
+	if ($enabled) {
+		@new = &unique(@old, @$addmods);
+		}
+	else {
+		my %remove = map { $_, 1 } @$mods;
+		@new = grep { !$remove{$_} } @old;
+		}
+	return 0 if (join("\0", @old) eq join("\0", @new));
+	$obj->{$key} = \@new;
+	return 1;
+	};
+my $own_module_updates = sub {
+	my ($obj, $inherited) = @_;
+	return $mods if (!$enabled);
+	return [] if (!@{$obj->{'ownmods'} || []} && !@$inherited);
+	return [ grep { &indexof($_, @$inherited) < 0 } @$mods ];
+	};
+my @users = &list_users();
+my @groups = &list_groups();
+my $all = !defined($usersgroups);
+my (%target_user, %target_group);
+if (!$all) {
+	foreach my $ug (@$usersgroups) {
+		if ($ug =~ /^\@(.*)$/) {
+			$target_group{$1} = 1;
+			}
+		else {
+			$target_user{$ug} = 1;
+			$target_group{$ug} = 1;
+			}
+		}
+	}
+my $changed = 0;
+my (%user_group, %group_parent);
+foreach my $g (@groups) {
+	foreach my $m (@{$g->{'members'} || []}) {
+		if ($m =~ /^\@(.*)$/) {
+			$group_parent{$1} = $g;
+			}
+		else {
+			$user_group{$m} = $g;
+			}
+		}
+	}
+my (@ordered_groups, %ordered_group, %ordering_group);
+my $add_ordered_group;
+$add_ordered_group = sub {
+	my ($g) = @_;
+	return if (!$g || $ordered_group{$g->{'name'}});
+	return if ($ordering_group{$g->{'name'}}++);
+	$add_ordered_group->($group_parent{$g->{'name'}});
+	delete($ordering_group{$g->{'name'}});
+	push(@ordered_groups, $g);
+	$ordered_group{$g->{'name'}}++;
+	};
+foreach my $g (@groups) {
+	$add_ordered_group->($g);
+	}
+
+# Update groups first, so member users and sub-groups inherit the new set
+foreach my $g (@ordered_groups) {
+	next if (!$all && !$target_group{$g->{'name'}});
+	my $gchanged = 0;
+	my $parent = $group_parent{$g->{'name'}};
+	my $ownmods = $own_module_updates->(
+		$g, [ @{$parent ? $parent->{'modules'} || [] : []} ]);
+	$gchanged += $set_module_access_list->($g, "modules");
+	$gchanged += $set_module_access_list->($g, "ownmods", $ownmods);
+	if ($gchanged) {
+		&modify_group($g->{'name'}, $g);
+		&update_members(\@users, \@groups, $g->{'modules'},
+				$g->{'members'});
+		$changed++;
+		}
+	}
+
+# Update directly targeted users
+foreach my $u (@users) {
+	next if (!$all && !$target_user{$u->{'name'}});
+	my $uchanged = 0;
+	my $group = $user_group{$u->{'name'}};
+	my $ownmods = $own_module_updates->(
+		$u, [ @{$group ? $group->{'modules'} || [] : []} ]);
+	$uchanged += $set_module_access_list->($u, "modules");
+	$uchanged += $set_module_access_list->($u, "ownmods", $ownmods);
+	if ($uchanged) {
+		&modify_user($u->{'name'}, $u);
+		$changed++;
+		}
+	}
+
+if ($changed) {
+	undef(%main::acl_hash_cache);
+	undef(%main::acl_array_cache);
+	}
+return $changed;
+}
+
+=head2 enable_module_access(&modules, [&users-groups])
+
+Grants users and groups access to one or more modules. This is a wrapper
+around set_module_access.
+
+=cut
+sub enable_module_access
+{
+return &set_module_access($_[0], 1, $_[1]);
+}
+
+=head2 disable_module_access(&modules, [&users-groups])
+
+Revokes users and groups access to one or more modules. This is a wrapper
+around set_module_access.
+
+=cut
+sub disable_module_access
+{
+return &set_module_access($_[0], 0, $_[1]);
+}
+
 =head2 update_members(&allusers, &allgroups, &modules, &members)
 
 Update the modules for members users and groups of some group. The parameters
@@ -1699,7 +1836,7 @@ elsif (&has_command("ssleay")) {
 	return &has_command("ssleay");
 	}
 else {
-	return undef;
+	return;
 	}
 }
 
@@ -1815,6 +1952,7 @@ foreach my $g (&list_groups()) {
 		return $g;
 		}
 	}
+return;
 }
 
 =head2 check_password_restrictions(username, password)
@@ -1859,7 +1997,7 @@ if ($miniserv{'pass_oldblock'} && $user) {
 		last if ($c++ > $miniserv{'pass_oldblock'});
 		}
 	}
-return undef;
+return;
 }
 
 =head2 hash_session_id(sid)
@@ -1896,11 +2034,11 @@ my $use_md5 = &md5_perl_module();
 $use_md5 || &error("No Perl MD5 hashing module found!");
 
 # Add the password
-my $ctx = eval "new $use_md5";
+my $ctx = $use_md5->new;
 $ctx->add($passwd);
 
 # Add some more stuff from the hash of the password and salt
-my $ctx1 = eval "new $use_md5";
+my $ctx1 = $use_md5->new;
 $ctx1->add($passwd);
 $ctx1->add($passwd);
 my $final = $ctx1->digest();
@@ -1949,12 +2087,12 @@ Returns a Perl module for MD5 hashing, or undef if none.
 sub md5_perl_module
 {
 my $use_md5;
-eval "use MD5";
+eval { require MD5; MD5->import; 1 };
 if (!$@) {
         $use_md5 = "MD5";
         }
 else {
-        eval "use Digest::MD5";
+        eval { require Digest::MD5; Digest::MD5->import; 1 };
         if (!$@) {
                 $use_md5 = "Digest::MD5";
                 }
@@ -2111,16 +2249,16 @@ my ($str, $notablecheck) = @_;
 my ($proto, $user, $pass, $host, $prefix, $args) = &split_userdb_string($str);
 if ($proto eq "mysql" || $proto eq "postgresql") {
 	# Load DBI driver
-	eval 'use DBI;';
+	eval { require DBI; DBI->import; 1 };
 	return &text('sql_emod', 'DBI') if ($@);
 	if ($proto eq "mysql") {
-		eval 'use DBD::mysql;';
+		eval { require DBD::mysql; DBD::mysql->import; 1 };
 		return &text('sql_emod', 'DBD::mysql') if ($@);
 		my $drh = DBI->install_driver("mysql");
 		return $text{'sql_emysqldriver'} if (!$drh);
 		}
 	else {
-		eval 'use DBD::Pg;';
+		eval { require DBD::Pg; DBD::Pg->import; 1 };
 		return &text('sql_emod', 'DBD::Pg') if ($@);
 		my $drh = DBI->install_driver("Pg");
 		return $text{'sql_epostgresqldriver'} if (!$drh);
@@ -2152,11 +2290,11 @@ if ($proto eq "mysql" || $proto eq "postgresql") {
 			}
 		}
 	&disconnect_userdb($str, $dbh);
-	return undef;
+	return;
 	}
 elsif ($proto eq "ldap") {
 	# Load LDAP module
-	eval 'use Net::LDAP;';
+	eval { require Net::LDAP; Net::LDAP->import; 1 };
 	return &text('sql_emod', 'Net::LDAP') if ($@);
 
 	# Try to connect
@@ -2190,7 +2328,7 @@ elsif ($proto eq "ldap") {
 		$found || return &text('sql_eldapdn', $prefix);
 		}
 	&disconnect_userdb($str, $dbh);
-	return undef;
+	return;
 	}
 else {
 	return "Unknown user database type $proto";
@@ -2284,8 +2422,8 @@ if (!$miniserv) {
 	$miniserv = { };
 	&get_miniserv_config($miniserv);
 	}
-foreach $a (split(/\s+/, $miniserv->{'anonymous'})) {
-        if ($a =~ /^([^=]+)=(\S+)$/ && $2 eq $user) {
+foreach my $tok (split(/\s+/, $miniserv->{'anonymous'})) {
+        if ($tok =~ /^([^=]+)=(\S+)$/ && $2 eq $user) {
 		push(@rv, $1);
 		}
 	}
@@ -2299,7 +2437,7 @@ sub get_safe_acl
 my ($m) = @_;
 my $mdir = &module_root_directory($m);
 my %rv;
-&read_file_cached("$mdir/safeacl", \%rv) || return undef;
+&read_file_cached("$mdir/safeacl", \%rv) || return;
 return \%rv;
 }
 
@@ -2313,17 +2451,19 @@ sub generate_random_session_id
 my $sid;
 
 # Try /dev/urandom, but with a timeout
-$SIG{ALRM} = sub { close(RANDOM) };
+my $randomfh;
+$SIG{ALRM} = sub { close($randomfh) if ($randomfh) };
 alarm(5);
-if (open(RANDOM, "/dev/urandom")) {
+if (open($randomfh, "<", "/dev/urandom")) {
 	my $tmpsid;
-	if (read(RANDOM, $tmpsid, 16) == 16) {
+	if (read($randomfh, $tmpsid, 16) == 16) {
 		$sid = lc(unpack('h*',$tmpsid));
 		if ($sid !~ /^[0-9a-fA-F]{32}$/) {
 			$sid = 'bad';
 			}
 		}
-	close(RANDOM);
+	close($randomfh);
+	undef($randomfh);
 	}
 alarm(0);
 
@@ -2341,7 +2481,7 @@ return $sid eq 'bad' ? undef : $sid;
 # Generate an ID string that can be used for a password reset link
 sub generate_random_id
 {
-if (open(my $RANDOM, "</dev/urandom")) {
+if (open(my $RANDOM, "<", "/dev/urandom")) {
 	my $sid;
 	my $tmpsid;
 	if (read($RANDOM, $tmpsid, 16) == 16) {
@@ -2350,7 +2490,9 @@ if (open(my $RANDOM, "</dev/urandom")) {
 	close($RANDOM);
 	return $sid;
 	}
-return undef;
+# Explicit undef: callers consume this in hash-literal value position,
+# where bare 'return' would yield () and shift the surrounding pairing.
+return undef;    ## no critic (ProhibitExplicitReturnUndef)
 }
 
 # obsfucate_email(email)
@@ -2368,4 +2510,3 @@ return $mailbox."\@".join(".", @doms);
 }
 
 1;
-

acl/backup_config.pl

@@ -3,7 +3,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require 'acl-lib.pl';
+require 'acl-lib.pl';    ## no critic
 our ($config_directory, %gconfig);
 
 # backup_config_files()
@@ -43,7 +43,7 @@ return @rv;
 # Called before the files are actually read
 sub pre_backup
 {
-return undef;
+return;
 }
 
 # post_backup(&files)
@@ -52,7 +52,7 @@ sub post_backup
 {
 unlink("$config_directory/config.aclbackup");
 unlink("$config_directory/miniserv.conf.aclbackup");
-return undef;
+return;
 }
 
 # pre_restore(&files)
@@ -66,7 +66,7 @@ foreach my $u (&list_users(), &list_groups()) {
 		       glob("$config_directory/*/$u->{'name'}.acl"));
 		}
 	}
-return undef;
+return;
 }
 
 # post_restore(&files)
@@ -101,7 +101,7 @@ foreach my $k (keys %aclbackup) {
 &put_miniserv_config(\%miniserv);
 
 &restart_miniserv();
-return undef;
+return;
 }
 
 1;

acl/cert_form.cgi

@@ -5,11 +5,11 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access);
 &ui_print_header(undef, $text{'cert_title'}, "", undef, undef, undef, undef,
 		 undef, undef, "language=VBSCRIPT onload='postLoad()'");
-eval "use Net::SSLeay";
+eval { require Net::SSLeay; Net::SSLeay->import; 1 };
 
 print "<p>$text{'cert_msg'}<p>\n";
 if ($ENV{'SSL_USER'}) {

acl/cert_issue.cgi

@@ -5,7 +5,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access, $module_config_directory, $base_remote_user);
 &ReadParse();
 

acl/cert_output.cgi

@@ -5,7 +5,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access);
 
 &ReadParse();

acl/cgi_args.pl

@@ -27,5 +27,5 @@ elsif ($cgi eq 'edit_acl.cgi') {
 		}
 	return 'none';
 	}
-return undef;
+return;
 }

acl/convert.cgi

@@ -6,7 +6,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access, $config_directory);
 &ReadParse();
 &error_setup($text{'convert_err'});

acl/convert_form.cgi

@@ -6,7 +6,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access);
 $access{'sync'} && $access{'create'} || &error($text{'convert_ecannot'});
 &ui_print_header(undef, $text{'convert_title'}, "");

acl/defaultacl

@@ -19,7 +19,6 @@ sessions=1
 cats=1
 ips=1
 switch=1
-rbacenable=1
 logouttime=1
 times=1
 minsize=1

acl/delete_group.cgi

@@ -6,7 +6,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access, $base_remote_user);
 &ReadParse();
 &error_setup($text{'gdelete_err'});

acl/delete_groups.cgi

@@ -5,7 +5,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access, $base_remote_user);
 &ReadParse();
 &error_setup($text{'gdeletes_err'});

acl/delete_session.cgi

@@ -6,7 +6,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access, %sessiondb);
 &ReadParse();
 $access{'sessions'} || &error($text{'sessions_ecannot'});

acl/delete_user.cgi

@@ -6,7 +6,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access, $base_remote_user);
 &ReadParse();
 &error_setup($text{'delete_err'});

acl/delete_users.cgi

@@ -5,7 +5,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access, $base_remote_user);
 &ReadParse();
 &error_setup($in{'joingroup'} ? $text{'udeletes_jerr'} : $text{'udeletes_err'});

acl/edit_acl.cgi

@@ -6,7 +6,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access, $base_remote_user, %gconfig);
 &ReadParse();
 $access{'acl'} || &error($text{'acl_emod'});
@@ -48,15 +48,6 @@ else {
 	}
 print &ui_table_start(&text('acl_options', $minfo{'desc'}), "width=100%", 4);
 
-if ($in{'mod'} && $in{'user'} && &supports_rbac($in{'mod'}) &&
-    !$gconfig{'rbacdeny_'.$who}) {
-	# Show RBAC option
-	print &ui_table_row($text{'acl_rbac'},
-		&ui_radio("rbac", $maccess{'rbac'} ? 1 : 0,
-			[ [ 1, $text{'acl_rbacyes'} ],
-			  [ 0, $text{'no'} ] ]), 3);
-	}
-
 # Load custom ACL library
 my $mdir = &module_root_directory($in{'mod'});
 if (-r "$mdir/acl_security.pl") {

acl/edit_group.cgi

@@ -6,7 +6,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access, $config_directory);
 &ReadParse();
 $access{'groups'} || &error($text{'gedit_ecannot'});

acl/edit_pass.cgi

@@ -5,7 +5,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access);
 $access{'pass'} || &error($text{'pass_ecannot'});
 &ui_print_header(undef, $text{'pass_title'}, "");

acl/edit_rbac.cgi

@@ -1,32 +0,0 @@
-#!/usr/local/bin/perl
-# Show RBAC status
-
-use strict;
-use warnings;
-no warnings 'redefine';
-no warnings 'uninitialized';
-require './acl-lib.pl';
-our (%in, %text, %gconfig, %access, $module_name, $module_root_directory);
-$access{'rbacenable'} || &error($text{'rbac_ecannot'});
-&ui_print_header(undef, $text{'rbac_title'}, "");
-
-print "$text{'rbac_desc'}<p>\n";
-if ($gconfig{'os_type'} ne 'solaris') {
-	print &text('rbac_esolaris', $gconfig{'real_os_type'}),"<p>\n";
-	}
-elsif (!&supports_rbac()) {
-	if (&foreign_available("cpan")) {
-		print &text('rbac_eperl', "<tt>Authen::SolarisRBAC</tt>",
-			    "../cpan/download.cgi?source=0&local=$module_root_directory/Authen-SolarisRBAC-0.1.tar.gz&mode=2&return=/$module_name/&returndesc=".&urlize($text{'index_return'})),"<p>\n";
-		}
-	else {
-		print &text('rbac_ecpan', "<tt>Authen::SolarisRBAC</tt>"),
-		      "<p>\n";
-		}
-	}
-else {
-	print "$text{'rbac_ok'}<p>\n";
-	}
-
-&ui_print_footer("", $text{'index_return'});
-

acl/edit_sql.cgi

@@ -5,7 +5,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access);
 $access{'sql'} || &error($text{'sql_ecannot'});
 &ui_print_header(undef, $text{'sql_title'}, "");

acl/edit_sync.cgi

@@ -6,7 +6,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access);
 $access{'sync'} && $access{'create'} && $access{'delete'} ||
 	&error($text{'sync_ecannot'});

acl/edit_unix.cgi

@@ -7,7 +7,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access);
 $access{'unix'} && $access{'create'} && $access{'delete'} ||
 	&error($text{'unix_ecannot'});

acl/edit_user.cgi

@@ -6,7 +6,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %gconfig, %access, $config_directory, $base_remote_user, $remote_user);
 &foreign_require("webmin", "webmin-lib.pl");
 
@@ -42,6 +42,11 @@ else {
 				      : $text{'edit_title2'}, "");
 	}
 my $me = &get_user($base_remote_user);
+my %uaccess = &get_module_acl($in{'user'} || "", "", 1);
+if (!$in{'user'} && $uaccess{'rpc'} == 2) {
+	# Don't offer the confusing 'root' or 'admin' RPC option by default
+	$uaccess{'rpc'} = 0;
+	}
 
 # Give up if readonly
 if ($user{'readonly'} && !$in{'readwrite'}) {
@@ -210,7 +215,10 @@ if ($access{'lang'}) {
 
 if ($access{'locale'}) {
 	# Current locale
-	eval "use DateTime; use DateTime::Locale; use DateTime::TimeZone;";
+	eval { require DateTime; DateTime->import;
+	       require DateTime::Locale; DateTime::Locale->import;
+	       require DateTime::TimeZone; DateTime::TimeZone->import;
+	       1 };
 	if (!$@ && $] > 5.011) {
 		my $locales = &list_locales();
 		my %localesrev = reverse %{$locales};
@@ -280,7 +288,7 @@ if ($showui) {
 # Start of security options section
 my $showsecurity = $access{'logouttime'} || $access{'ips'} ||
 		   $access{'minsize'} ||
-		   &supports_rbac() && $access{'mode'} == 0 || $access{'times'};
+		   $access{'times'};
 if ($showsecurity) {
 	print &ui_hidden_table_start($text{'edit_security'}, "width=100%", 2,
 				     "security", 0, [ "width=30%" ]);
@@ -321,14 +329,6 @@ if ($access{'ips'}) {
 		    4, 30));
 	}
 
-if (&supports_rbac() && $access{'mode'} == 0) {
-	# Deny access to modules not managed by RBAC?
-	print &ui_table_row($text{'edit_rbacdeny'},
-		&ui_radio("rbacdeny", $user{'rbacdeny'} ? 1 : 0,
-			  [ [ 0, $text{'edit_rbacdeny0'} ],
-			    [ 1, $text{'edit_rbacdeny1'} ] ]));
-	}
-
 if ($access{'times'}) {
 	# Show allowed days of the week
 	my %days = map { $_, 1 } split(/,/, $user{'days'} || '');
@@ -371,6 +371,16 @@ elsif ($miniserv{'twofactor_provider'}) {
 		&ui_submit($text{'edit_twofactoradd'}, "twofactor"));
 	}
 
+# Can accept RPC calls?
+if ($access{'acl'} && !$safe) {
+	print &ui_table_row(&hlink($text{'acl_rpc'}, 'rpc'),
+		&ui_radio("rpc", int($uaccess{'rpc'}),
+			  [ [ 1, $text{'acl_rpc1'} ],
+			    $uaccess{'rpc'} == 2 ? ( [ 2, $text{'acl_rpc2'} ] ) : ( ),
+			    [ 3, $text{'acl_rpc3'} ],
+			    [ 0, $text{'acl_rpc0'} ] ]));
+	}
+
 print &ui_hidden_table_end("security");
 
 # Work out which modules can be selected
@@ -450,11 +460,9 @@ print &ui_hidden_table_end("mods");
 
 # Add global ACL section, but only if not set from the group
 my $groupglobal = $memg && -r "$config_directory/$memg->{'name'}.acl";
-if ($access{'acl'} && !$groupglobal && $in{'user'} && !$safe) {
+if ($access{'acl'} && !$groupglobal && !$safe) {
 	print &ui_hidden_table_start($text{'edit_global'}, "width=100%", 2,
 				     "global", 0, [ "width=30%" ]);
-	my %uaccess;
-	%uaccess = &get_module_acl($in{'user'}, "", 1);
 	print &ui_hidden("acl_security_form", 1);
 	&foreign_require("", "acl_security.pl");
 	&foreign_call("", "acl_security_form", \%uaccess);

acl/forgot_form.cgi

@@ -5,7 +5,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text);
 &foreign_require("webmin");
 &error_setup($text{'forgot_err'});

acl/forgot_send.cgi

@@ -5,7 +5,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %gconfig);
 &foreign_require("webmin");
 &error_setup($text{'forgot_err'});

acl/help/rpc.html

@@ -0,0 +1,14 @@
+<header>Can accept RPC calls?</header>
+
+This option determines if the user can make use of Webmin's poweful RPC calls
+feature, which is designed to allow this system to be controlled by a script
+or other Webmin server via HTTP. Because the RPC feature does <b>not</b>
+respect any module grants or fine-grained access controls, this option should
+only be enabled for fully trusted <tt>root</tt>-equivalent users. <p>
+
+In addition, if the <b>RPC calls only</b> option is selected, the user will not
+be able to use the Webmin UI. This is useful for creating a separate login with
+a longer password for RPC purposes only, as two-factor authentication cannot be
+used when making RPC calls. <p>
+
+<footer>

acl/index.cgi

@@ -6,7 +6,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %gconfig, %access, $base_remote_user);
 &ReadParse();
 &ui_print_header(undef, $text{'index_title'}, "", undef, 1, 1);
@@ -206,11 +206,6 @@ if (uc($ENV{'HTTPS'}) eq "ON" && $miniserv{'ca'}) {
 push(@icons, "images/twofactor.gif");
 push(@links, "twofactor_form.cgi");
 push(@titles, $text{'index_twofactor'});
-if ($access{'rbacenable'} && $gconfig{'os_type'} eq 'solaris') {
-	push(@icons, "images/rbac.gif");
-	push(@links, "edit_rbac.cgi");
-	push(@titles, $text{'index_rbac'});
-	}
 if ($access{'pass'}) {
 	push(@icons, "images/pass.gif");
 	push(@links, "edit_pass.cgi");

acl/lang/en

@@ -23,7 +23,6 @@ index_modgroups=Modules from group $1
 index_sync=Configure Unix User Synchronization
 index_unix=Configure Unix User Authentication
 index_sessions=View Login Sessions
-index_rbac=Setup RBAC
 index_delete=Delete Selected
 index_joingroup=Add To Group:
 index_eulist=Failed to list users : $1
@@ -95,9 +94,6 @@ edit_switch=Switch to User
 edit_forgot=Send Password Reset Link
 edit_return=Webmin user
 edit_return2=Webmin group
-edit_rbacdeny=RBAC access mode
-edit_rbacdeny0=RBAC only controls selected module ACLs
-edit_rbacdeny1=RBAC controls all modules and ACLs
 edit_global=Permissions for all modules
 edit_templock=Temporarily locked
 edit_temppass=Force change at next login
@@ -185,8 +181,6 @@ acl_title3=For group $1 in $2
 acl_options=$1 access control options
 acl_config=Can edit module configuration?
 acl_reset=Reset To Full Access
-acl_rbac=Get access control settings from RBAC?
-acl_rbacyes=Yes (overrides settings below)
 
 acl_uall=All users
 acl_uthis=This user
@@ -382,13 +376,6 @@ hide_clone=(Clone $1)
 switch_euser=You are not allowed to switch to this user
 switch_eold=Existing session not found!
 
-rbac_title=Setup RBAC
-rbac_desc=Webmin's RBAC integration provides a way for user module and ACL permissions to be determined from an RBAC (Role Based Access Control) database, rather than Webmin's own configuration files. Once RBAC support is enabled, any user for whom the <b>RBAC controls all modules and ACLs</b> option is selected will have his capabilities determined by RBAC rather than Webmin's own access control settings.
-rbac_esolaris=RBAC is only supported on Solaris at the moment, and so cannot be used on this $1 system.
-rbac_eperl=The Perl module $1 needed for RBAC integration is not installed. <a href='$2'>Click here</a> to have it installed now.
-rbac_ecpan=You do not have access to Webmin's Perl Modules page in order to install the necessary $1 module for RBAC integration.
-rbac_ok=RBAC integration is available on this system, and can be enabled on a per-user basis on the Edit Webmin User page.
-
 udeletes_err=Failed to delete users
 udeletes_jerr=Failed to add users to group
 udeletes_enone=None selected

acl/lang/no

@@ -1,9 +1,9 @@
 index_title=Webmin Brukere
 index_user=Brukere
 index_modules=Moduler
-index_create=Opprett ny Webmin bruker
+index_create=Opprett ny Webmin-bruker
 index_screate=Opprett ny sikker bruker
-index_convert=Konverter Unix til Webmin brukere
+index_convert=Konverter Unix til Webmin-brukere
 index_cert=Krever SSL sertifikat
 index_twofactor=To-faktor autentisering
 index_certmsg=Klikk på denne knappen for å spørre etter et SSL sertifikat som vil gi deg sikker login i Webmin uten å måtte skrive brukernavn og passord.
@@ -14,7 +14,7 @@ index_global=Global ACL
 index_users=Webmin Brukere
 index_groups=Webmin Grupper
 index_group=Gruppe
-index_nousers=Ingen editerbar Webmin bruker er definert.
+index_nousers=Ingen editerbar Webmin-bruker er definert.
 index_nogroups=Ingen editerbar Webmin gruppe er definert.
 index_gcreate=Lag en ny Webmin gruppe
 index_members=Medlemmer
@@ -30,11 +30,11 @@ index_eglist=Kunne ikke liste grupper : $1
 
 edit_title=Rediger Webmin Bruker
 edit_title2=Lag Webmin Bruker
-edit_title3=Opprett sikker Webmin bruker
-edit_readonly=Denne Webmin brukeren bør ikke redigeres siden den vedlikeholdes av modulen $1. <a href='$2'>Klikk her</a> for å ignorere denne advarselen og redigere brukeren allikevel - men vær oppmerksom på at manuelle endringer kan bli overskrevet!
-edit_rights=Tilgangsrettigheter for Webmin bruker
+edit_title3=Opprett sikker Webmin-bruker
+edit_readonly=Denne Webmin-brukeren bør ikke redigeres siden den vedlikeholdes av modulen $1. <a href='$2'>Klikk her</a> for å ignorere denne advarselen og redigere brukeren allikevel - men vær oppmerksom på at manuelle endringer kan bli overskrevet!
+edit_rights=Tilgangsrettigheter for Webmin-bruker
 edit_user=Brukernavn
-edit_cloneof=Klober Webmin bruker
+edit_cloneof=Klober Webmin-bruker
 edit_real=Virkelig navn
 edit_group=Medlem av gruppe
 edit_pass=Passord
@@ -89,7 +89,7 @@ edit_selall=Velg alle
 edit_invert=Inverter valg
 edit_hide=Skjul ubrukte
 edit_switch=Bytt til bruker
-edit_return=Webmin bruker
+edit_return=Webmin-bruker
 edit_return2=Webmin gruppe
 edit_rbacdeny=RBAC tilgangsmodus
 edit_rbacdeny0=RBAC kontrollerer valgte modul ACLer
@@ -126,21 +126,21 @@ save_eoverlay=Et tema-overlegg kan ikke velges med mindre et tema er
 save_edeny=Du kan ikke nekte deg selv tilgang til Webmin Bruker modulen
 save_eos=Det samme som Unix passord opsjonen er ikke støttet på ditt operativsystem.
 save_emd5=Det samme som Unix passord opsjonen kan ikke brukes på systemer med MD5 kryptering
-save_eunix=Unix bruker '$1' eksisterer ikke
+save_eunix=Unix-brukeren '$1' eksisterer ikke
 save_emod=Du kan ikke bevilge tilgang til modul '$1'
 save_ecreate=Du har ikke tilgang til å opprette brukere
-save_euser=Du har ikke tilgang til å editere denne brukeren
+save_euser=Du har ikke tilgang til å redigere denne brukeren
 save_ecolon=Passord kan ikke inneholde : karakteren
 save_epass=Passord er ikke gyldig : $1
-save_eself=Din vanlige IP adresse ($1) vil bli nektet
+save_eself=Din vanlige IP-adresse ($1) vil bli nektet
 save_epam=PAM autentisering er ikke tilgjengelig fordi <tt>Authen::PAM</tt> Perl modulen ikke er installert eller ikke virker ordentlig.
 save_epam2=Du kan bruke Webmin's Perl Modules modul til <a href='$1'>laste ned å installere Authen::PAM</a> nå.
 save_egroup=Du har ikke rettigheter til å tildele til den gruppen
 save_enone=Ingen adresse er tastet inn
-save_enet='$1' er ikke en gyldig nettverks adresse
+save_enet='$1' er ikke en gyldig nettverksadresse
 save_emask='$1' er ikke en gyldig nettmaske
-save_eip='$1' er ikke en komplett IP eller nettverks adresse
-save_ehost=Kunne ikke finne IP adresse for '$1'
+save_eip='$1' er ikke en komplett IP eller nettverksadresse
+save_ehost=Kunne ikke finne IP-adresse for '$1'
 save_elogouttime=Manglende eller ikke-numerisk tid for utlogging ved inaktivitet
 save_eminsize=Manglende eller ikke-numerisk minimum passordlengde
 save_edays=Ingen tillatte dager valgt
@@ -223,11 +223,11 @@ acl_times=Kan endre tillatte innloggings-tider?
 acl_pass=Kan endre passord-begrensinger?
 acl_sql=Kan konfigurere databasen for brukere og grupper?
 
-log_modify=Modifisert Webmin bruker $1
-log_rename=Skiftet navn på Webmin bruker $1 til $2
-log_create=Opprettet Webmin bruker $1
-log_clone=Klonet Webmin bruker $1 til $2
-log_delete=Slettet Webmin bruker $1
+log_modify=Modifisert Webmin-bruker $1
+log_rename=Skiftet navn på Webmin-bruker $1 til $2
+log_create=Opprettet Webmin-bruker $1
+log_clone=Klonet Webmin-bruker $1 til $2
+log_delete=Slettet Webmin-bruker $1
 log_acl=Oppdatert tilgang for $1 i $2
 log_reset=Tilbakestilte tilgang for $1 i $2
 log_cert=Utlevert sertifikat for bruker $1
@@ -235,10 +235,10 @@ log_modify_g=Modifisert Webmin gruppe $1
 log_rename_g=Forandret navn på Webmin gruppe $1 til $2
 log_create_g=Opprettet Webmin gruppe $1
 log_delete_g=Slettet Webmin gruppe $1
-log_switch=Byttet til Webmin bruker $1
-log_delete_users=Slettet $1 Webmin brukere
+log_switch=Byttet til Webmin-bruker $1
+log_delete_users=Slettet $1 Webmin-brukere
 log_delete_groups=Slettet $1 Webmin grupper
-log_joingroup=La til $1 Webmin brukere i gruppe $2
+log_joingroup=La til $1 Webmin-brukere i gruppe $2
 log_pass=Endret passord-begrensinger
 log_unix=Endret unix bruker-autentisering
 log_sync=Endret unix bruker-synkronisering
@@ -273,7 +273,7 @@ gsave_edesc=Ugyldig beskrivelse - tegnet : er ikke tillatt
 convert_title=Konverter Brukere
 convert_ecannot=Du har ikke tilgang til å konvertere Unix brukere
 convert_nogroups=Ingen Webmin gruppe er definert på ditt system. Du må i det minste lage en gruppe før du konverterer brukere, dette for å kunne sette rettigheter for konverterte brukere.
-convert_desc=Denne Dette feltet lar deg konvertere eksisterende Unix brukere til Webmin brukere. Rettighetene til hver nye Webmin bruker vil bestemmes av rettighetene til gruppen som valgt over.
+convert_desc=Denne Dette feltet lar deg konvertere eksisterende Unix-brukere til Webmin-brukere. Rettighetene til hver nye Webmin-bruker vil bestemmes av rettighetene til gruppen som valgt over.
 convert_0=Alle brukere
 convert_1=Bare brukere
 convert_2=Alle unntagen brukere
@@ -284,43 +284,43 @@ convert_sync2=Synk. passord med Unix-bruker i fremtiden?
 convert_ok=Konverter nå
 convert_err=Kunne ikke konvertere brukere
 convert_eusers=Ingen brukere inntastet
-convert_egroup=Unix gruppe eksisterer ikke
-convert_emin=Ugyldig minimum bruker ID (UID)
-convert_emax=Ugyldig maksimum bruker ID (UID)
+convert_egroup=Unix-gruppen eksisterer ikke
+convert_emin=Ugyldig minimum bruker-ID (UID)
+convert_emax=Ugyldig maksimum bruker-ID (UID)
 convert_ewgroup=Ingen sånn Webmin gruppe
 convert_ewgroup2=Du har ikke rettigheter til å tilordne nye brukere til denne gruppen
 convert_skip=Hoppet over $1
 convert_exists=$1 Eksisterer allerede
-convert_invalid=$1 er ikke et gyldig Webmin brukernavn
+convert_invalid=$1 er ikke et gyldig Webmin-brukernavn
 convert_added=$1 er lagt til
-convert_msg=Konverterer Unix brukere...
+convert_msg=Konverterer Unix-brukere...
 convert_user=Unix-bruker
-convert_action=Handling utført
+convert_action=Handling utført
 convert_done=$1 brukere konvertert, $2 ugyldig, $3 finnes allerede, $4 ekskludert.
 convert_users=Brukere som skal konverteres
 
-sync_title=Unix Bruker Synkronisering
-sync_desc=Dette feltet lar deg konfigurere automatisk synkronisering av Unix brukere laget via Webmin og brukere i denne modulen.
+sync_title=Unix-brukersynkronisering
+sync_desc=Dette feltet lar deg konfigurere automatisk synkronisering av Unix-brukere laget via Webmin og brukere i denne modulen.
 sync_nogroups=Ingen Webmin gruppe er definert på ditt system. Du må i det minste lage en gruppe før du konverterer brukere, dette for å kunne sette rettigheter for konverterte brukere.
 sync_when=Synkroniser når
-sync_create=Opprett Webmin bruker når en Unix bruker blir laget.
-sync_update=Oppdater passende Webmin bruker når Unix brukere blir oppdatert.
-sync_delete=Slett passende Webmin bruker når Unix brukere blir slettet.
+sync_create=Opprett Webmin-bruker når en Unix bruker blir laget.
+sync_update=Oppdater passende Webmin-bruker når Unix-brukere blir oppdatert.
+sync_delete=Slett passende Webmin-bruker når Unix-brukere blir slettet.
 sync_group=Tilordne ny bruker til Webmin gruppe
 sync_unix=Sett passord for nye brukere til Unix autentisering
 sync_ecannot=Du har ikke rettigheter til å konfigurere bruker synkronisering.
 
-unix_title=Unix Bruker Autentisering
+unix_title=Unix-brukerautentisering
 unix_err=Kunne ikke lagre Unix autentisering
-unix_desc=Denne siden lar deg konfigurere Webmin til verifisere login forsøk med systemets bruker liste og PAM. Dette kan være nyttig hvis du har mange eksisterende Unix brukere som du ønsker å gi tilgang til Webmin.
-unix_def=Tillat bare login av Webmin brukere
-unix_sel=Tillat Unix brukere i listen nedenfor å logge inn ..
+unix_desc=Denne siden lar deg konfigurere Webmin til verifisere login forsøk med systemets bruker liste og PAM. Dette kan være nyttig hvis du har mange eksisterende Unix-brukere som du ønsker å gi tilgang til Webmin.
+unix_def=Tillat bare login av Webmin-brukere
+unix_sel=Tillat Unix-brukere i listen nedenfor å logge inn ..
 unix_mode=Tillat
 unix_mall=Alle brukere
 unix_group=Medlemmer i gruppen..
-unix_user=Tillat alle Unix brukere login med rettigheter som Users
+unix_user=Tillat alle Unix-brukere login med rettigheter som Users
 unix_who=Bruker eller gruppe
-unix_to=Som Webmin bruker
+unix_to=Som Webmin-bruker
 unix_ecannot=Du har ikke rettigheter til å konfigurere Unix bruker autentisering
 unix_epam=Unix autentisering er ikke tilgjengelig fordi <tt>Authen::PAM</tt> Perl modul ikke er installert eller ikke virker som den skal.
 unix_all=Tillat alle Unix brukere
@@ -329,12 +329,12 @@ unix_deny=Nekt listede Unix brukere
 unix_none=Ingen brukere angitt
 unix_euser='$1' er ikke et gyldig brukernavn
 unix_egroup='$1' er ikke et gyldig gruppenavn
-unix_shells=Nekt Unix brukere hvis skall ikke finnes i filen
+unix_shells=Nekt Unix-brukere hvis skall ikke finnes i filen
 unix_eshells=Manglende eller ikke-eksisterende shells fil
 unix_restrict2=Ekstra restriksjoner
 unix_ewhogroup=Manglende tillatt gruppe i rad $1
 unix_ewhouser=Manglende tilllatt bruker i rad $1
-unix_enone=Ingen tillatte Unix brukere og grupper ble angitt
+unix_enone=Ingen tillatte Unix-brukere og grupper ble angitt
 unix_same=&lt;Samme bruker eller gruppe&gt;
 unix_sudo=TIllatt brukere som kan kjøre alle kommandoer via <tt>sudo</tt> å logge inn som <tt>root</tt>
 unix_pamany=Behandle brukere som bare sender PAM validering som $1
@@ -345,9 +345,9 @@ unix_utable=Tillatte Unix brukere
 
 sessions_title=Aktuell Login Session
 sessions_id=Sessions ID
-sessions_user=Webmin bruker
+sessions_user=Webmin-bruker
 sessions_login=Innlogget
-sessions_host=IP adresse
+sessions_host=IP-adresse
 sessions_lview=Se logger..
 sessions_actions=Handlinger..
 sessions_logouts=Vis også utloggede sesjoner..
@@ -357,7 +357,7 @@ sessions_in=Innlogget
 sessions_out=Logget ut
 sessions_kill=Koble fra..
 
-logins_title=Siste Webmin innlogginger
+logins_title=Siste Webmin-innlogginger
 
 hide_title=Skjul ubrukte moduler
 hide_desc=Følgende moduler vil bli fjernet fra modul tilgangslisten for $1 siden deres tilhørende tjenere ikke er installert på systemet ditt ..
@@ -374,7 +374,7 @@ rbac_desc=Webmin's RBAC integration provides a way for user module and ACL permi
 rbac_esolaris=RBAC støttes bare på Solaris systemer for øyeblikket, og kan derfor ikke brukes på dette $1 systemet.
 rbac_eperl=Perl-modulen $1, som behøves for RBAC integrasjon, er ikke installert. <a href='$2'>Klikk her</a> for å installere den nå.
 rbac_ecpan=Du har ikke tilgang til Webmins Perl Moduler side for å kunne installere den nødvendige $1 modulen for RBAC integrasjon.
-rbac_ok=RBAC integrasjon er tilgjengelig for dette systemet, og kan aktiveres per bruker på siden Rediger Webmin bruker.
+rbac_ok=RBAC integrasjon er tilgjengelig for dette systemet, og kan aktiveres per bruker på siden Rediger Webmin-bruker.
 
 udeletes_err=Kunne ikke slette brukere
 udeletes_jerr=Kunne ikke legg til brukere i gruppe
@@ -391,7 +391,7 @@ gdeletes_rusure=Er du sikker på at du ønsker å slette de $1 valgte gruppene o
 gdeletes_users=Valgte grupper: $1
 gdeletes_ok=Slett grupper
 
-pass_title=Passord begrensinger
+pass_title=Passordbegrensinger
 pass_ecannot=Du har ikke lov til å redigere passord-begrensinger
 pass_header=Innstillinger for Webmin passord begrensinger
 pass_minsize=Minimum passordlengde
@@ -424,7 +424,7 @@ cpass_old=Gamle passord kan ikke brukes på nytt
 
 sql_title=Bruker- og gruppe-database
 sql_ecannot=Du har ikke lov til å konfigurere bruker- og gruppedatabasen
-sql_header=Instillinger for database backend for brukere og grupper
+sql_header=Innstillinger for database backend for brukere og grupper
 sql_host=Vertsnavn
 sql_user=Brukernavn
 sql_pass=Passord
@@ -456,7 +456,7 @@ sql_edb=Ugyldig databasenavn (mellomrom ikke tillatt)
 sql_eprefix=Manglende eller ugyldig base DN (mellomrom ikke tillatt)
 sql_eprefix2=Ugyldig-utseende base DN - skal være på formen <tt>dc=mittdomene,dc=no</tt>
 sql_title2=Opprett manglende tabeller
-sql_tableerr=Instillinger for bruker- og gruppedatabase er gyldig, men noen tabeller som Webmin trenger, mangler : $1
+sql_tableerr=Innstillinger for bruker- og gruppedatabase er gyldig, men noen tabeller som Webmin trenger, mangler : $1
 sql_tableerr2=Klikk på knappen <b>Opprett tabeller</b> nedenfor, for å få opprettet dem automatisk, eller du kan kjøre SQL uttrykket nedenfor manuelt.
 sql_make=Opprett tabeller
 sql_title3=Opprett manglende DN
@@ -489,7 +489,7 @@ twofactor_title=To-faktor autentisering
 twofactor_disable=Deaktiver to-faktor autentisering
 twofactor_already=Din Webmin-bruker har allerede to-faktor autentisering aktivert med leverandør %1 og konto ID %2.
 twofactor_already2=Webmin-brukeren %3 har allerede to-faktor autentisering aktivert med leverandør %1 og konto ID %2.
-twofactor_desc=Denne siden lar deg aktivere to-faktor autentisering for din Webmin bruker vha. <a href='$2' target=_blank>$1</a>. Når denne er aktivert kreves det et ekstra autentiserings-token når du logger inn på Webmin.
+twofactor_desc=Denne siden lar deg aktivere to-faktor autentisering for din Webmin-bruker vha. <a href='$2' target=_blank>$1</a>. Når denne er aktivert kreves det et ekstra autentiserings-token når du logger inn på Webmin.
 twofactor_desc2=Denne siden lar deg aktivere to-faktor autentisering for Webmin-brukeren $1 vha. <a href='$2' target=_blank>$1</a>. Når denne er aktivert vil det kreves et ekstra autentiserings-token for å logge inn på Webmin.
 twofactor_enable=Meld inn til to-faktor autentisering
 twofactor_header=Detaljer for innmelding til to-faktor autentisering

acl/list_sessions.cgi

@@ -6,7 +6,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access, %sessiondb);
 $access{'sessions'} || &error($text{'sessions_ecannot'});
 &ui_print_header(undef, $text{'sessions_title'}, "");

acl/log_parser.pl

@@ -16,8 +16,9 @@ my ($user, $script, $action, $type, $object, $p) = @_;
 my $g = $type eq 'group' ? "_g" : "";
 if ($action eq 'modify') {
 	if ($p->{'old'} ne $p->{'name'}) {
-		return &text('log_rename'.$g, "<tt>$p->{'old'}</tt>",
-					      "<tt>$p->{'name'}</tt>");
+		return &text('log_rename'.$g,
+			     "<tt>".&html_escape($p->{'old'})."</tt>",
+			     "<tt>".&html_escape($p->{'name'})."</tt>");
 		}
 	else {
 		return &text('log_modify'.$g,
@@ -26,7 +27,8 @@ if ($action eq 'modify') {
 	}
 elsif ($action eq 'create') {
 	if ($p->{'clone'}) {
-		return &text('log_clone'.$g, "<tt>$p->{'clone'}</tt>",
+		return &text('log_clone'.$g,
+			     "<tt>".&html_escape($p->{'clone'})."</tt>",
 			     "<tt>".&html_escape($object)."</tt>");
 		}
 	else {
@@ -36,21 +38,23 @@ elsif ($action eq 'create') {
 	}
 elsif ($action eq 'delete') {
 	if ($type eq "users" || $type eq "groups") {
-		return &text('log_delete_'.$type, $object);
+		return &text('log_delete_'.$type, &html_escape($object));
 		}
 	else {
-		return &text('log_delete'.$g, "<tt>$object</tt>");
+		return &text('log_delete'.$g,
+			     "<tt>".&html_escape($object)."</tt>");
 		}
 	}
 elsif ($action eq 'joingroup') {
-	return &text('log_joingroup', $object, $p->{'group'});
+	return &text('log_joingroup', &html_escape($object),
+		     &html_escape($p->{'group'}));
 	}
 elsif ($action eq 'acl') {
-	return &text('log_acl', "<tt>$object</tt>",
+	return &text('log_acl', "<tt>".&html_escape($object)."</tt>",
 		     "<i>".&html_escape($p->{'moddesc'})."</i>");
 	}
 elsif ($action eq 'reset') {
-	return &text('log_reset', "<tt>$object</tt>",
+	return &text('log_reset', "<tt>".&html_escape($object)."</tt>",
 		     "<i>".&html_escape($p->{'moddesc'})."</i>");
 	}
 elsif ($action eq 'cert') {
@@ -60,7 +64,9 @@ elsif ($action eq 'switch') {
 	return &text('log_switch', "<tt>".&html_escape($object)."</tt>");
 	}
 elsif ($action eq 'twofactor') {
-	return &text('log_twofactor', $object, $p->{'provider'}, $p->{'id'});
+	return &text('log_twofactor', &html_escape($object),
+		     &html_escape($p->{'provider'}),
+		     &html_escape($p->{'id'}));
 	}
 elsif ($action eq 'forgot') {
 	return &text('log_forgot_'.$type, &html_escape($p->{'user'}),

acl/makedn.cgi

@@ -5,7 +5,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access);
 $access{'pass'} || &error($text{'sql_ecannot'});
 &ReadParse();

acl/maketables.cgi

@@ -5,7 +5,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access);
 $access{'pass'} || &error($text{'sql_ecannot'});
 &ReadParse();

acl/postinstall.pl

@@ -3,7 +3,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require 'acl-lib.pl';
+require 'acl-lib.pl';    ## no critic
 our ($config_directory);
 
 # Rename the .acl files for any groups to .gacl files

acl/save_acl.cgi

@@ -6,7 +6,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access, $base_remote_user, %gconfig,
      $config_directory);
 &ReadParse();
@@ -54,13 +54,8 @@ else {
 	if (defined($in{'noconfig'})) {
 		$maccess{'noconfig'} = $in{'noconfig'};
 		}
-	if ($in{'rbac'}) {
-		# RBAC overrides everything
-		$maccess{'rbac'} = 1;
-		}
-	elsif (-r "../$in{'_acl_mod'}/acl_security.pl") {
+	if (-r "../$in{'_acl_mod'}/acl_security.pl") {
 		# Use user inputs
-		$maccess{'rbac'} = 0 if (defined($in{'rbac'}));
 		&foreign_require($in{'_acl_mod'}, "acl_security.pl");
 		&foreign_call($in{'_acl_mod'}, "acl_security_save",
 			      \%maccess, \%in);

acl/save_group.cgi

@@ -6,7 +6,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access, $config_directory);
 &ReadParse();
 

acl/save_pass.cgi

@@ -5,7 +5,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access);
 $access{'pass'} || &error($text{'pass_ecannot'});
 &error_setup($text{'pass_err'});

acl/save_sql.cgi

@@ -5,7 +5,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access);
 $access{'pass'} || &error($text{'sql_ecannot'});
 &ReadParse();

acl/save_sync.cgi

@@ -6,7 +6,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access, $module_config_directory);
 &ReadParse();
 $access{'sync'} && $access{'create'} && $access{'delete'} ||

acl/save_twofactor.cgi

@@ -5,7 +5,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access, $base_remote_user);
 &foreign_require("webmin");
 &error_setup($text{'twofactor_err'});

acl/save_unix.cgi

@@ -6,7 +6,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access);
 &ReadParse();
 &error_setup($text{'unix_err'});
@@ -70,7 +70,7 @@ else {
 	}
 if ($in{'sudo'}) {
 	&has_command("sudo") || &error(&text('unix_esudo', "<tt>sudo</tt>"));
-	eval "use IO::Pty";
+	eval { require IO::Pty; IO::Pty->import; 1 };
 	$@ && &error(&text('unix_esudomod', "<tt>IO::Pty</tt>"));
 	}
 $miniserv{'sudo'} = $in{'sudo'};

acl/save_user.cgi

@@ -6,7 +6,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access, $config_directory, $base_remote_user);
 &foreign_require("webmin", "webmin-lib.pl");
 &ReadParse();
@@ -105,11 +105,6 @@ foreach my $u (@ulist) {
 # Find the current group
 my $oldgroup = $in{'old'} ? &get_users_group($in{'old'}) : undef;
 
-if (&supports_rbac()) {
-	# Save RBAC mode
-	$user{'rbacdeny'} = $in{'rbacdeny'};
-	}
-
 my $newgroup;
 if (defined($in{'group'})) {
 	# Check if group is allowed
@@ -374,11 +369,13 @@ else {
 	}
 
 my $aclfile = "$config_directory/$in{'name'}.acl";
-if ($in{'old'} && $in{'acl_security_form'} && !$newgroup && !$in{'safe'}) {
-	# Update user's global ACL
+if ($in{'acl_security_form'} && !$newgroup && !$in{'safe'}) {
+	# Update user's global ACL, and merge in RPC setting which has
+	# been moved out of this form
 	&foreign_require("", "acl_security.pl");
 	my %uaccess;
 	&foreign_call("", "acl_security_save", \%uaccess, \%in);
+	$uaccess{'rpc'} = $in{'rpc'};
 	&lock_file($aclfile);
 	&save_module_acl(\%uaccess, $in{'name'}, "", 1);
 	&set_ownership_permissions(undef, undef, 0640, $aclfile);

acl/schema.cgi

@@ -5,7 +5,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access);
 $access{'pass'} || &error($text{'sql_ecannot'});
 

acl/switch.cgi

@@ -5,7 +5,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access, %sessiondb);
 &ReadParse();
 &can_edit_user($in{'user'}) && $access{'switch'} ||

acl/t/perlcritic.t

@@ -0,0 +1,65 @@
+#!/usr/bin/perl
+use strict;
+use warnings;
+use Test::More;
+
+BEGIN {
+    eval { require Perl::Critic; 1 }
+        or plan skip_all => 'Perl::Critic not installed';
+}
+
+use File::Find;
+
+sub script_dir
+{
+    my $path = $0;
+    if ($path =~ m{^/}) {
+        $path =~ s{/[^/]+$}{};
+        return $path;
+    }
+    my $cwd = `pwd`;
+    chomp($cwd);
+    if ($path =~ m{/}) {
+        $path =~ s{/[^/]+$}{};
+        return $cwd.'/'.$path;
+    }
+    return $cwd;
+}
+
+my $bindir = script_dir();
+my $module_dir = "$bindir/..";
+chdir($module_dir) or die "chdir: $!";
+
+my @files;
+find(
+    sub {
+        return if -d;
+        # Skip symlinks: shared libs (e.g. md5-lib.pl -> ../useradmin/md5-lib.pl)
+        # belong to the module that owns the underlying file.
+        return if -l;
+        return unless /\.(pl|cgi)\z/;
+        # *.info.pl is the Polish-locale translation of *.info, not Perl code.
+        return if /\.info\.pl\z/;
+        push(@files, $File::Find::name);
+    },
+    '.'
+);
+
+@files = sort @files;
+if (!@files) {
+    plan skip_all => 'no perl files to check';
+}
+
+my $critic = Perl::Critic->new(
+    -profile => "$bindir/../../.perlcriticrc",
+);
+
+foreach my $file (@files) {
+    my @violations = $critic->critique($file);
+    is(scalar @violations, 0, "$file perlcritic");
+    if (@violations) {
+        diag join("", @violations);
+    }
+}
+
+done_testing();

acl/test_twofactor.cgi

@@ -5,7 +5,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %access, $base_remote_user);
 &foreign_require("webmin");
 &error_setup($text{'twofactor_terr'});

acl/twofactor.pl

@@ -1,6 +1,10 @@
 #!/usr/local/bin/perl
 # Validate the OTP for some user
 
+use strict;
+use warnings;
+no warnings 'once';
+our $module_name;
 $main::no_acl_check = 1;
 $main::no_referers_check = 1;
 $ENV{'WEBMIN_CONFIG'} = "/etc/webmin";
@@ -8,17 +12,19 @@ $ENV{'WEBMIN_VAR'} = "/var/webmin";
 if ($0 =~ /^(.*\/)[^\/]+$/) {
         chdir($1);
         }
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 $module_name eq 'acl' || die "Command must be run with full path";
 
 # Check command-line args
 @ARGV == 5 || die "Usage: $0 user provider id token api-key";
-($user, $provider, $id, $token, $apikey) = @ARGV;
+my ($user, $provider, $id, $token, $apikey) = @ARGV;
 
 # Call the provider validation function
 &foreign_require("webmin");
-$func = "webmin::validate_twofactor_".$provider;
-$err = &$func($id, $token, $apikey);
+my $method = "validate_twofactor_".$provider;
+my $code = webmin->can($method)
+	or die "Unknown twofactor provider: $provider\n";
+my $err = $code->($id, $token, $apikey);
 if ($err) {
 	$err =~ s/\r|\n/ /g;
 	print $err,"\n";

acl/twofactor_form.cgi

@@ -5,7 +5,7 @@ use strict;
 use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
-require './acl-lib.pl';
+require './acl-lib.pl';    ## no critic
 our (%in, %text, %config, %access, $base_remote_user);
 &foreign_require("webmin");
 &error_setup($text{'twofactor_err'});

acl_security.pl

@@ -16,7 +16,7 @@ print &ui_table_row($text{'acl_root'},
 # Other dirs to allow
 print &ui_table_row($text{'acl_otherdirs'},
 	&ui_textarea("otherdirs", join("\n", split(/\t+/, $o->{'otherdirs'})),
-		     5, 40), 3);
+		     3, 40), 3);
 
 # Can see dot files?
 print &ui_table_row($text{'acl_nodot'},
@@ -77,18 +77,6 @@ print &ui_table_row($text{'acl_gedit'},
 
 print &ui_table_hr();
 
-# Can submit feedback?
-print &ui_table_row($text{'acl_feedback'},
-	&ui_radio("feedback", int($o->{'feedback'}),
-	  	  [ map { [ $_, $text{'acl_feedback'.$_} ] } (2,3,1,0) ]));
-
-# Can accept RPC calls?
-print &ui_table_row($text{'acl_rpc'},
-	&ui_radio("rpc", int($o->{'rpc'}),
-		  [ [ 1, $text{'acl_rpc1'} ],
-		    $o->{'rpc'} == 2 ? ( [ 2, $text{'acl_rpc2'} ] ) : ( ),
-		    [ 0, $text{'acl_rpc0'} ] ]));
-
 # Get new permissions?
 print &ui_table_row($text{'acl_negative'},
 	&ui_radio("negative", int($o->{'negative'}),
@@ -110,27 +98,26 @@ print &ui_table_row($text{'acl_webminsearch'},
 # Parse the form for global security options
 sub acl_security_save
 {
-$_[0]->{'root'} = $in{'root_def'} ? undef : $in{'root'};
-$_[0]->{'otherdirs'} = join("\t", split(/\r?\n/, $in{'otherdirs'}));
-$_[0]->{'nodot'} = $in{'nodot'};
+my ($o) = @_;
+$o->{'root'} = $in{'root_def'} ? undef : $in{'root'};
+$o->{'otherdirs'} = join("\t", split(/\r?\n/, $in{'otherdirs'}));
+$o->{'nodot'} = $in{'nodot'};
 
-$_[0]->{'uedit_mode'} = $in{'uedit_mode'};
-$_[0]->{'uedit'} = $in{'uedit_mode'} == 2 ? $in{'uedit_can'} :
+$o->{'uedit_mode'} = $in{'uedit_mode'};
+$o->{'uedit'} = $in{'uedit_mode'} == 2 ? $in{'uedit_can'} :
 		   $in{'uedit_mode'} == 3 ? $in{'uedit_cannot'} :
 		   $in{'uedit_mode'} == 4 ? $in{'uedit_uid'} :
 		   $in{'uedit_mode'} == 5 ? getgrnam($in{'uedit_group'}) : "";
-$_[0]->{'uedit2'} = $in{'uedit_mode'} == 4 ? $in{'uedit_uid2'} : undef;
+$o->{'uedit2'} = $in{'uedit_mode'} == 4 ? $in{'uedit_uid2'} : undef;
 
-$_[0]->{'gedit_mode'} = $in{'gedit_mode'};
-$_[0]->{'gedit'} = $in{'gedit_mode'} == 2 ? $in{'gedit_can'} :
+$o->{'gedit_mode'} = $in{'gedit_mode'};
+$o->{'gedit'} = $in{'gedit_mode'} == 2 ? $in{'gedit_can'} :
 		   $in{'gedit_mode'} == 3 ? $in{'gedit_cannot'} :
 		   $in{'gedit_mode'} == 4 ? $in{'gedit_gid'} : "";
-$_[0]->{'gedit2'} = $in{'gedit_mode'} == 4 ? $in{'gedit_gid2'} : undef;
-$_[0]->{'feedback'} = $in{'feedback'};
-$_[0]->{'rpc'} = $in{'rpc'};
-$_[0]->{'negative'} = $in{'negative'};
-$_[0]->{'readonly'} = $in{'readonly'};
-$_[0]->{'fileunix'} = $in{'fileunix_def'} ? undef : $in{'fileunix'};
-$_[0]->{'webminsearch'} = $in{'webminsearch'};
+$o->{'gedit2'} = $in{'gedit_mode'} == 4 ? $in{'gedit_gid2'} : undef;
+$o->{'negative'} = $in{'negative'};
+$o->{'readonly'} = $in{'readonly'};
+$o->{'fileunix'} = $in{'fileunix_def'} ? undef : $in{'fileunix'};
+$o->{'webminsearch'} = $in{'webminsearch'};
 }
 

apache/apache-lib.pl

@@ -436,6 +436,13 @@ foreach $v (@virt) {
 return \@get_config_cache;
 }
 
+# flush_config_cache()
+# Delete all in-memory config caches
+sub flush_config_cache
+{
+undef(@get_config_cache);
+}
+
 # get_config_file(filename, [&seen-files])
 # Returns a list of config hash refs from some file
 sub get_config_file
@@ -788,6 +795,428 @@ unlink($file);
 &delete_webfile_link($file);
 }
 
+# can_manage_vhost_files()
+# Returns 1 if this system uses Debian-style available/enabled site dirs
+sub can_manage_vhost_files
+{
+return 0 if ($gconfig{'os_type'} ne 'debian-linux');
+my $avail = &vhost_available_dir();
+my $enabled = &vhost_enabled_dir();
+return $avail && -d $avail && $enabled && -d $enabled &&
+       &simplify_path(&resolve_links($avail)) ne
+       &simplify_path(&resolve_links($enabled));
+}
+
+# vhost_available_dir()
+# Returns the configured directory of available Apache virtual host files
+sub vhost_available_dir
+{
+return $config{'virt_file'} ? &server_root($config{'virt_file'}) : undef;
+}
+
+# vhost_enabled_dir()
+# Returns the configured directory of enabled Apache virtual host symlinks
+sub vhost_enabled_dir
+{
+return $config{'link_dir'} ? &server_root($config{'link_dir'}) : undef;
+}
+
+# get_vhost_available_files()
+# Returns real config files from the directory used for new virtual hosts
+sub get_vhost_available_files
+{
+my @rv;
+return @rv if (!&can_manage_vhost_files());
+my $avail = &vhost_available_dir();
+opendir(AVAIL, $avail) || return @rv;
+foreach my $f (sort { lc($a) cmp lc($b) } readdir(AVAIL)) {
+	next if ($f eq "." || $f eq "..");
+	my $file = $avail."/".$f;
+	my $rfile = &simplify_path(&resolve_links($file));
+	next if (!$rfile || !-f $rfile || !-r $rfile);
+	push(@rv, $rfile);
+	}
+closedir(AVAIL);
+return &unique(@rv);
+}
+
+# find_virtuals_in_file(file)
+# Returns VirtualHost blocks parsed from one config file
+sub find_virtuals_in_file
+{
+my ($file) = @_;
+my $rfile = &simplify_path(&resolve_links($file));
+$rfile ||= $file;
+return ( ) if (!-r $rfile);
+my @conf = &get_config_file($rfile);
+return grep { $_->{'file'} eq $rfile }
+       &find_directive_struct("VirtualHost", \@conf);
+}
+
+# is_default_vhost(&virt)
+# Returns 1 if a VirtualHost looks like a default/catch-all host
+sub is_default_vhost
+{
+my ($virt) = @_;
+return 1 if (!$virt);
+return 1 if ($virt->{'value'} =~ /_default_/i);
+return 1 if (!&find_directive("ServerName", $virt->{'members'}));
+return 0;
+}
+
+# can_manage_vhost_file(file)
+# Returns 1 if all virtual hosts in a file are manageable by this user
+sub can_manage_vhost_file
+{
+my ($file) = @_;
+my $rfile = &simplify_path(&resolve_links($file));
+$rfile ||= $file;
+return 0 if (!$rfile || !-f $rfile || !-r $rfile);
+my @virts = &find_virtuals_in_file($rfile);
+return 0 if (!@virts);
+foreach my $virt (@virts) {
+	return 0 if (&is_default_vhost($virt));
+	return 0 if (!&can_edit_virt($virt));
+	}
+return 1;
+}
+
+# can_manage_vhost_state_file(file)
+# Returns 1 if a virtual host file can have its enabled state managed here
+sub can_manage_vhost_state_file
+{
+my ($file) = @_;
+my $rfile = &simplify_path(&resolve_links($file));
+$rfile ||= $file;
+return 0 if (!$rfile || !-f $rfile);
+my %available = map { $_, 1 } &get_vhost_available_files();
+return 0 if (!$available{$rfile});
+return &can_manage_vhost_file($rfile);
+}
+
+# get_virtual_list_rows(&config)
+# Returns row hashes for the virtual-host list, preserving sites-available order
+sub get_virtual_list_rows
+{
+my ($conf) = @_;
+my @active = grep { &can_edit_virt($_) }
+	     &find_directive_struct("VirtualHost", $conf);
+if (&can_manage_vhost_files()) {
+	my @rows;
+	my %active_by_file;
+	foreach my $v (@active) {
+		my $file = &simplify_path(&resolve_links($v->{'file'}));
+		$file ||= $v->{'file'};
+		push(@{$active_by_file{$file}}, $v);
+		}
+	my %done_virt;
+	foreach my $file (&get_vhost_available_files()) {
+		my @filevirts = @{$active_by_file{$file} || [ ]};
+		my $active = @filevirts ? 1 : 0;
+		if (!@filevirts) {
+			@filevirts = grep { &can_edit_virt($_) &&
+					     !&is_default_vhost($_) }
+				     &find_virtuals_in_file($file);
+			}
+		foreach my $v (@filevirts) {
+			push(@rows, { 'virt' => $v,
+				      'active' => $active,
+				      'file' => $file });
+			$done_virt{$v}++;
+			}
+		}
+	foreach my $v (@active) {
+		next if ($done_virt{$v});
+		push(@rows, { 'virt' => $v,
+			      'active' => 1,
+			      'file' => $v->{'file'} });
+		}
+	return @rows;
+	}
+return map { { 'virt' => $_, 'active' => 1, 'file' => $_->{'file'} } }
+       @active;
+}
+
+# vhost_file_link(file)
+# Returns the enabled symlink path for a virtual host file
+sub vhost_file_link
+{
+my ($file) = @_;
+return undef if (!&can_manage_vhost_files());
+my $rfile = &simplify_path(&resolve_links($file));
+$rfile ||= $file;
+my $avail = &vhost_available_dir();
+my $short;
+if (opendir(AVAIL, $avail)) {
+	foreach my $f (sort { lc($a) cmp lc($b) } readdir(AVAIL)) {
+		next if ($f eq "." || $f eq "..");
+		my $afile = $avail."/".$f;
+		my $rafile = &simplify_path(&resolve_links($afile));
+		if ($rafile && $rafile eq $rfile) {
+			$short = $f;
+			last;
+			}
+		}
+	closedir(AVAIL);
+	}
+$short ||= $rfile;
+$short =~ s/^.*\///;
+return &vhost_enabled_dir()."/".$short;
+}
+
+# vhost_file_links(file)
+# Returns enabled symlinks for a virtual host file
+sub vhost_file_links
+{
+my ($file) = @_;
+my @rv;
+return @rv if (!&can_manage_vhost_files());
+my $rfile = &simplify_path(&resolve_links($file));
+$rfile ||= $file;
+my $enabled = &vhost_enabled_dir();
+opendir(LINKDIR, $enabled) || return @rv;
+foreach my $f (readdir(LINKDIR)) {
+	next if ($f eq "." || $f eq "..");
+	my $link = $enabled."/".$f;
+	next if (!-l $link);
+	my $rlink = &simplify_path(&resolve_links($link));
+	if ($rlink && $rlink eq $rfile) {
+		push(@rv, $link);
+		}
+	}
+closedir(LINKDIR);
+return @rv;
+}
+
+# vhost_file_enabled(file)
+# Returns 1 if a virtual host file has an enabled symlink
+sub vhost_file_enabled
+{
+my ($file) = @_;
+return scalar(&vhost_file_links($file)) ? 1 : 0;
+}
+
+# enable_vhost_file(file)
+# Enables a virtual host file and rolls back if apache configtest fails
+sub enable_vhost_file
+{
+my ($file) = @_;
+my $rfile = &simplify_path(&resolve_links($file));
+$rfile ||= $file;
+return $text{'enable_efile'} if (!&can_manage_vhost_state_file($rfile));
+my $verr = &virtualmin_vhost_file_state_error($rfile, "enable");
+return $verr if ($verr);
+my $link = &vhost_file_link($rfile);
+$link || return $text{'enable_elinkdir'};
+return undef if (&vhost_file_enabled($rfile));
+if (-e $link || -l $link) {
+	return &text('enable_elinkexists', "<tt>".&html_escape($link)."</tt>");
+	}
+&symlink_logged($rfile, $link) ||
+	return &text('enable_elink', "<tt>".&html_escape($link)."</tt>",
+		     "<tt>".&html_escape($!)."</tt>");
+my $err = &test_config();
+if ($err) {
+	&unlink_logged($link);
+	return &text('enable_etest', "<tt>".&html_escape($err)."</tt>");
+	}
+&flush_config_cache();
+&update_last_config_change();
+return undef;
+}
+
+# disable_vhost_file(file)
+# Disables a virtual host file and rolls back if apache configtest fails
+sub disable_vhost_file
+{
+my ($file) = @_;
+my $rfile = &simplify_path(&resolve_links($file));
+$rfile ||= $file;
+return $text{'enable_efile'} if (!&can_manage_vhost_state_file($rfile));
+my $verr = &virtualmin_vhost_file_state_error($rfile, "disable");
+return $verr if ($verr);
+my @links = &vhost_file_links($file);
+return undef if (!@links);
+my @restore = map { [ $_, readlink($_) ] } @links;
+my @removed;
+foreach my $link (@links) {
+	if (!&unlink_logged($link)) {
+		foreach my $r (@removed) {
+			&symlink_logged($r->[1], $r->[0])
+				if (defined($r->[1]) && !-e $r->[0] && !-l $r->[0]);
+			}
+		return &text('enable_eunlink',
+			     "<tt>".&html_escape($link)."</tt>",
+			     "<tt>".&html_escape($!)."</tt>");
+		}
+	my ($restore) = grep { $_->[0] eq $link } @restore;
+	push(@removed, $restore) if ($restore);
+	}
+my $err = &test_config();
+if ($err) {
+	foreach my $r (@restore) {
+		&symlink_logged($r->[1], $r->[0])
+			if (defined($r->[1]) && !-e $r->[0] && !-l $r->[0]);
+		}
+	return &text('enable_etest', "<tt>".&html_escape($err)."</tt>");
+	}
+&flush_config_cache();
+&update_last_config_change();
+return undef;
+}
+
+# virtualmin_available()
+# Returns 1 if Virtualmin is installed and supported on this system
+sub virtualmin_available
+{
+return $main::apache_virtualmin_available
+	if (defined($main::apache_virtualmin_available));
+$main::apache_virtualmin_available = &foreign_check("virtual-server");
+return $main::apache_virtualmin_available;
+}
+
+# virtualmin_domain_by_name(name)
+# Returns a Virtualmin domain object by domain name, if one exists
+sub virtualmin_domain_by_name
+{
+my ($name) = @_;
+return undef if (!&virtualmin_available());
+return $main::apache_virtualmin_domain_by_name_cache{$name}
+	if (exists($main::apache_virtualmin_domain_by_name_cache{$name}));
+&foreign_require("virtual-server");
+my $d = &virtual_server::get_domain_by("dom", $name);
+$main::apache_virtualmin_domain_by_name_cache{$name} = $d;
+return $d;
+}
+
+# virtual_names(&virt)
+# Returns all hostnames from ServerName and ServerAlias directives
+sub virtual_names
+{
+my ($virt) = @_;
+my @rv;
+my $sn = &find_directive("ServerName", $virt->{'members'});
+push(@rv, $sn) if ($sn);
+foreach my $sa (&find_directive_struct("ServerAlias", $virt->{'members'})) {
+	push(@rv, @{$sa->{'words'} || [ ]});
+	if (!@{$sa->{'words'} || [ ]} && $sa->{'value'}) {
+		push(@rv, $sa->{'value'});
+		}
+	}
+return grep { $_ && $_ ne "*" } &unique(@rv);
+}
+
+# virtualmin_domain_for_vhost_file(file)
+# Returns the Virtualmin domain object for a virtual host file, if any
+sub virtualmin_domain_for_vhost_file
+{
+my ($file) = @_;
+return undef if (!&virtualmin_available());
+my $rfile = &simplify_path(&resolve_links($file));
+$rfile ||= $file;
+return $main::apache_virtualmin_domain_for_file_cache{$rfile}
+	if (exists($main::apache_virtualmin_domain_for_file_cache{$rfile}));
+foreach my $virt (&find_virtuals_in_file($file)) {
+	next if (!&can_edit_virt($virt));
+	foreach my $name (&virtual_names($virt)) {
+		my $d = &virtualmin_domain_by_name($name);
+		if (!$d && $name =~ /^www\.(\S+)/i) {
+			$d = &virtualmin_domain_by_name($1);
+			}
+		if ($d) {
+			$main::apache_virtualmin_domain_for_file_cache{$rfile} = $d;
+			return $d;
+			}
+		}
+	}
+$main::apache_virtualmin_domain_for_file_cache{$rfile} = undef;
+return undef;
+}
+
+# vhost_file_state(file)
+# Returns the effective enabled state for a virtual host file
+sub vhost_file_state
+{
+my ($file) = @_;
+my $d = &virtualmin_domain_for_vhost_file($file);
+if ($d) {
+	return { 'enabled' => $d->{'disabled'} ? 0 : 1,
+		 'source' => 'virtualmin',
+		 'domain' => $d };
+	}
+return { 'enabled' => &vhost_file_enabled($file) ? 1 : 0,
+	 'source' => 'apache' };
+}
+
+# vhost_file_toggle_action(file)
+# Returns the action needed to toggle a virtual host file's effective state
+sub vhost_file_toggle_action
+{
+my ($file) = @_;
+return &vhost_file_state($file)->{'enabled'} ? "disable" : "enable";
+}
+
+# virtualmin_domain_state_link(&domain, enabled?)
+# Returns a link to the Virtualmin state change form for some domain
+sub virtualmin_domain_state_link
+{
+my ($d, $enabled) = @_;
+my $page = $enabled ? "disable_domain.cgi" : "enable_domain.cgi";
+my $label = $enabled ? $text{'enable_virtualmin_disable_label'} :
+		       $text{'enable_virtualmin_enable_label'};
+my $url = "../virtual-server/".$page."?dom=".&urlize($d->{'id'});
+return &ui_link(&quote_escape($url), "\"".$label."\"");
+}
+
+# virtualmin_vhost_file_state_error(file, action)
+# Returns an error if a Virtualmin-owned site is being enabled or disabled here
+sub virtualmin_vhost_file_state_error
+{
+my ($file, $action) = @_;
+return undef if ($action ne "enable" && $action ne "disable");
+my $state_info = &vhost_file_state($file);
+return undef if ($state_info->{'source'} ne "virtualmin");
+my $d = $state_info->{'domain'};
+return undef if (!$d);
+my $state = lc($state_info->{'enabled'} ? $text{'index_enabled'} :
+					  $text{'index_disabled'});
+my $dom = "<tt>".&html_escape($d->{'dom'})."</tt>";
+my $link = &virtualmin_domain_state_link($d, $state_info->{'enabled'});
+return $state_info->{'enabled'} ?
+	&text('enable_evirtualmin_disable', $dom, $state, $link) :
+	&text('enable_evirtualmin_enable', $dom, $state, $link);
+}
+
+# delete_virtuals_from_file(file, &virtualhosts...)
+# Deletes VirtualHost blocks from one file and removes the file if empty
+sub delete_virtuals_from_file
+{
+my ($file, @virts) = @_;
+return 0 if (!@virts);
+my $lref = &read_file_lines($file);
+foreach my $virt (sort { $b->{'line'} <=> $a->{'line'} } @virts) {
+	my $len = $virt->{'eline'} - $virt->{'line'} + 1;
+	splice(@$lref, $virt->{'line'}, $len);
+	}
+my $empty = 1;
+foreach my $line (@$lref) {
+	if ($line =~ /\S/) {
+		$empty = 0;
+		last;
+		}
+	}
+&flush_file_lines($file);
+if ($empty) {
+	foreach my $link (&vhost_file_links($file)) {
+		&unlink_logged($link);
+		}
+	&unlink_logged($file);
+	}
+&flush_config_cache();
+&update_last_config_change();
+return scalar(@virts);
+}
+
 # renumber(&config, line, file, offset)
 # Recursively changes the line number of all directives from some file 
 # beyond the given line.
@@ -1544,9 +1973,10 @@ return undef;
 # if necessary.
 sub before_changing
 {
+my @extra = grep { $_ } @_;
 if ($config{'test_always'} || $access{'test_always'}) {
 	local $conf = &get_config();
-	local @files = &unique(map { $_->{'file'} } @$conf);
+	local @files = &unique((map { $_->{'file'} } @$conf), @extra);
 	local $/ = undef;
 	local $f;
 	foreach $f (@files) {
@@ -1969,10 +2399,11 @@ return @rv;
 sub create_webfile_link
 {
 local ($file) = @_;
-if ($config{'link_dir'}) {
+my $linkdir = &vhost_enabled_dir();
+if ($linkdir) {
 	local $short = $file;
 	$short =~ s/^.*\///;
-	local $linksrc = "$config{'link_dir'}/$short";
+	local $linksrc = "$linkdir/$short";
 	&lock_file($linksrc);
 	symlink($file, $linksrc);
 	&unlock_file($linksrc);
@@ -1985,16 +2416,16 @@ if ($config{'link_dir'}) {
 sub delete_webfile_link
 {
 local ($file) = @_;
-if ($config{'link_dir'}) {
-	local $short = $file;
-	$short =~ s/^.*\///;
-	opendir(LINKDIR, $config{'link_dir'});
+$file = &simplify_path(&resolve_links($file));
+my $linkdir = &vhost_enabled_dir();
+if ($linkdir && opendir(LINKDIR, $linkdir)) {
 	foreach my $f (readdir(LINKDIR)) {
-		if ($f ne "." && $f ne ".." &&
-		    (&simplify_path(
-		       &resolve_links($config{'link_dir'}."/".$f)) eq $file ||
-		     $short eq $f)) {
-			&unlink_logged($config{'link_dir'}."/".$f);
+		if ($f ne "." && $f ne "..") {
+			my $link = $linkdir."/".$f;
+			next if (!-l $link);
+			if (&simplify_path(&resolve_links($link)) eq $file) {
+				&unlink_logged($link);
+				}
 			}
 		}
 	closedir(LINKDIR);

apache/core.pl

@@ -109,7 +109,7 @@ return ();
 sub edit_MaxClients
 {
 return (1,
-	$text{'core_maxconc'},
+	&hlink($text{'core_maxconc'}, "MaxClients"),
 	&opt_input($_[0]->{'value'}, "MaxClients", $text{'core_default'}, 4));
 }
 sub save_MaxClients
@@ -118,6 +118,19 @@ return &parse_opt("MaxClients", '^\d+$',
 		  $text{'core_emaxconc'});
 }
 
+sub edit_MaxRequestWorkers
+{
+return (1,
+	&hlink($text{'core_maxconc'}, "MaxRequestWorkers"),
+	&opt_input($_[0]->{'value'}, "MaxRequestWorkers",
+		   $text{'core_default'}, 4));
+}
+sub save_MaxRequestWorkers
+{
+return &parse_opt("MaxRequestWorkers", '^\d+$',
+		  $text{'core_emaxconc'});
+}
+
 sub edit_MaxKeepAliveRequests
 {
 return (1,
@@ -133,7 +146,7 @@ return &parse_opt("MaxKeepAliveRequests", '^\d+$',
 sub edit_MaxRequestsPerChild
 {
 return (1,
-	$text{'core_maxreq'},
+	&hlink($text{'core_maxreq'}, "MaxRequestsPerChild"),
 	&opt_input($_[0]->{'value'}, "MaxRequestsPerChild", $text{'core_default'}, 5));
 }
 sub save_MaxRequestsPerChild
@@ -145,7 +158,7 @@ return &parse_opt("MaxRequestsPerChild", '^\d+$',
 sub edit_MinSpareServers
 {
 return (1,
-	$text{'core_minspare'},
+	&hlink($text{'core_minspare'}, "MinSpareServers"),
 	&opt_input($_[0]->{'value'},"MinSpareServers",$text{'core_default'}, 4));
 }
 sub save_MinSpareServers
@@ -157,7 +170,7 @@ return &parse_opt("MinSpareServers", '^\d+$',
 sub edit_MaxSpareServers
 {
 return (1,
-	$text{'core_maxspare'},
+	&hlink($text{'core_maxspare'}, "MaxSpareServers"),
 	&opt_input($_[0]->{'value'},"MaxSpareServers",$text{'core_default'}, 4));
 }
 sub save_MaxSpareServers
@@ -169,7 +182,7 @@ return &parse_opt("MaxSpareServers", '^\d+$',
 sub edit_StartServers
 {
 return (1,
-	$text{'core_initial'},
+	&hlink($text{'core_initial'}, "StartServers"),
 	&opt_input($_[0]->{'value'}, "StartServers", $text{'core_default'}, 4));
 }
 sub save_StartServers
@@ -178,9 +191,70 @@ return &parse_opt("StartServers", '^\d+$',
 		  $text{'core_einitial'});
 }
 
+sub edit_ServerLimit
+{
+return (1,
+	&hlink($text{'core_serverlimit'}, "ServerLimit"),
+	&opt_input($_[0]->{'value'}, "ServerLimit", $text{'core_default'}, 4));
+}
+sub save_ServerLimit
+{
+return &parse_opt("ServerLimit", '^\d+$',
+		  $text{'core_eserverlimit'});
+}
+
+sub edit_MinSpareThreads
+{
+return (1,
+	&hlink($text{'worker_minspare'}, "MinSpareThreads"),
+	&opt_input($_[0]->{'value'},"MinSpareThreads",$text{'core_default'}, 4));
+}
+sub save_MinSpareThreads
+{
+return &parse_opt("MinSpareThreads", '^\d+$',
+		  $text{'worker_eminspare'});
+}
+
+sub edit_MaxSpareThreads
+{
+return (1,
+	&hlink($text{'worker_maxspare'}, "MaxSpareThreads"),
+	&opt_input($_[0]->{'value'},"MaxSpareThreads",$text{'core_default'}, 4));
+}
+sub save_MaxSpareThreads
+{
+return &parse_opt("MaxSpareThreads", '^\d+$',
+		  $text{'worker_emaxspare'});
+}
+
+sub edit_ThreadLimit
+{
+return (1,
+	&hlink($text{'worker_threadlimit'}, "ThreadLimit"),
+	&opt_input($_[0]->{'value'},"ThreadLimit",$text{'core_default'}, 4));
+}
+sub save_ThreadLimit
+{
+return &parse_opt("ThreadLimit", '^\d+$',
+		  $text{'worker_ethreadlimit'});
+}
+
+sub edit_ThreadsPerChild
+{
+return (1,
+	&hlink($text{'worker_threads'}, "ThreadsPerChild"),
+	&opt_input($_[0]->{'value'},"ThreadsPerChild",$text{'core_default'}, 4));
+}
+sub save_ThreadsPerChild
+{
+return &parse_opt("ThreadsPerChild", '^\d+$',
+		  $text{'worker_ethreads'});
+}
+
 sub edit_RLimitCPU
 {
-return &rlimit_input("RLimitCPU", $text{'core_cpulimit'}, $_[0]);
+return &rlimit_input("RLimitCPU",
+		     &hlink($text{'core_cpulimit'}, "RLimitCPU"), $_[0]);
 }
 sub save_RLimitCPU
 {
@@ -189,7 +263,8 @@ return &parse_rlimit("RLimitCPU", $text{'core_cpulimit2'});
 
 sub edit_RLimitMEM
 {
-return &rlimit_input("RLimitMEM", $text{'core_memlimit'}, $_[0]);
+return &rlimit_input("RLimitMEM",
+		     &hlink($text{'core_memlimit'}, "RLimitMEM"), $_[0]);
 }
 sub save_RLimitMEM
 {
@@ -198,7 +273,8 @@ return &parse_rlimit("RLimitMEM", $text{'core_memlimit2'});
 
 sub edit_RLimitNPROC
 {
-return &rlimit_input("RLimitNPROC", $text{'core_proclimit'}, $_[0]);
+return &rlimit_input("RLimitNPROC",
+		     &hlink($text{'core_proclimit'}, "RLimitNPROC"), $_[0]);
 }
 sub save_RLimitNPROC
 {
@@ -1280,7 +1356,7 @@ return &parse_opt("LockFile", '^\S+', $text{'core_elock'});
 
 sub edit_LimitRequestBody
 {
-return (1, $text{'core_maxbody'},
+return (1, &hlink($text{'core_maxbody'}, "LimitRequestBody"),
 	&opt_input($_[0]->{'value'}, "LimitRequestBody", $text{'core_default'}, 8)
 		.&ui_space(2).$text{'bytes'});
 }
@@ -1291,7 +1367,7 @@ return &parse_opt("LimitRequestBody", '^\d+$', $text{'core_ebody'});
 
 sub edit_LimitXMLRequestBody
 {
-return (1, $text{'core_maxxml'},
+return (1, &hlink($text{'core_maxxml'}, "LimitXMLRequestBody"),
 	&opt_input($_[0]->{'value'}, "LimitXMLRequestBody",
 		   $text{'core_default'}, 8).&ui_space(2).$text{'bytes'});
 }
@@ -1304,7 +1380,7 @@ return &parse_opt("LimitXMLRequestBody", '^\d+$', $text{'core_exml'});
 
 sub edit_LimitRequestFields
 {
-return (1, $text{'core_maxhead'},
+return (1, &hlink($text{'core_maxhead'}, "LimitRequestFields"),
 	&opt_input($_[0]->{'value'}, "LimitRequestFields", $text{'core_default'}, 6));
 }
 sub save_LimitRequestFields
@@ -1314,7 +1390,7 @@ return &parse_opt("LimitRequestFields", '^\d+$', $text{'core_ehead'});
 
 sub edit_LimitRequestFieldsize
 {
-return (1, $text{'core_maxshead'},
+return (1, &hlink($text{'core_maxshead'}, "LimitRequestFieldsize"),
 	&opt_input($_[0]->{'value'}, "LimitRequestFieldsize", $text{'core_default'}, 6));
 }
 sub save_LimitRequestFieldsize
@@ -1324,7 +1400,7 @@ return &parse_opt("LimitRequestFieldsize", '^\d+$', $text{'core_eshead'});
 
 sub edit_LimitRequestLine
 {
-return (1, $text{'core_maxline'},
+return (1, &hlink($text{'core_maxline'}, "LimitRequestLine"),
 	&opt_input($_[0]->{'value'}, "LimitRequestLine", $text{'core_default'}, 6));
 }
 sub save_LimitRequestLine
@@ -1631,4 +1707,3 @@ else { return ( [ ], [ ] ); }
 }
 
 1;
-

apache/delete_vservs.cgi

@@ -3,31 +3,107 @@
 
 require './apache-lib.pl';
 &ReadParse();
-&error_setup($text{'delete_err'});
+@d = split(/\0/, $in{'d'});
+$file_action = $in{'toggle'} ? "toggle" : undef;
+&error_setup($file_action ? $text{'enable_err'} : $text{'delete_err'});
 $access{'vaddr'} || &error($text{'delete_ecannot'});
 $conf = &get_config();
-@d = split(/\0/, $in{'d'});
+$can_vhost_files = &can_manage_vhost_files();
 @d || &error($text{'delete_enone'});
 
+if ($file_action) {
+	&can_manage_vhost_files() || &error($text{'enable_elinkdir'});
+	foreach $d (@d) {
+		if ($d =~ /^file\t([^\t]+)/) {
+			$file = $1;
+			}
+		elsif ($d !~ /^file\t/) {
+			($vmembers, $vconf) = &get_virtual_config($d);
+			next if (!$vconf || !&can_edit_virt($vconf));
+			$file = $vconf->{'file'};
+			}
+		else {
+			next;
+			}
+		$rfile = $file ? &simplify_path(&resolve_links($file)) : undef;
+		$files{$rfile}++ if ($rfile && -f $rfile &&
+				      &can_manage_vhost_state_file($rfile));
+		}
+	@files = keys %files;
+	@files || &error($text{'enable_enone'});
+	foreach $file (@files) {
+		$action = &vhost_file_toggle_action($file);
+		$err = &virtualmin_vhost_file_state_error($file, $action);
+		$err && &error($err);
+		$file_actions{$file} = $action;
+		}
+	foreach $file (@files) {
+		$err = $file_actions{$file} eq "enable" ?
+			&enable_vhost_file($file) :
+			&disable_vhost_file($file);
+		$err && &error($err);
+		}
+	&webmin_log($file_action, "vhostfile", scalar(@files));
+	&redirect("");
+	exit;
+	}
+if (!$in{'delete'}) {
+	&error($text{'delete_eaction'});
+	}
+
 # Get them all
 foreach $d (@d) {
+	if ($d =~ /^file\t([^\t]+)\t(\d+)$/) {
+		push(@{$file_lines{$1}}, $2);
+		next;
+		}
+	elsif ($d =~ /^file\t/) {
+		next;
+		}
 	($vmembers, $vconf) = &get_virtual_config($d);
+	$vconf || &error($text{'delete_egone'});
 	&can_edit_virt($vconf) || &error(&text('delete_ecannot2',
 					       &virtual_name($vconf)));
+	$can_vhost_files && &is_default_vhost($vconf) &&
+		&error($text{'delete_edefault'});
 	push(@virts, $vconf);
 	}
+if (%file_lines) {
+	foreach $file (keys %file_lines) {
+		$rfile = &simplify_path(&resolve_links($file));
+		next if (!$rfile || !-f $rfile ||
+			 !&can_manage_vhost_state_file($rfile));
+		@fvirts = &find_virtuals_in_file($rfile);
+		foreach $line (@{$file_lines{$file}}) {
+			($vconf) = grep { $_->{'line'} == $line } @fvirts;
+			$vconf || &error($text{'delete_egone'});
+			&can_edit_virt($vconf) ||
+				&error(&text('delete_ecannot2',
+					     &virtual_name($vconf)));
+			&is_default_vhost($vconf) &&
+				&error($text{'delete_edefault'});
+			push(@{$file_virts{$rfile}}, $vconf);
+			}
+		}
+	}
+@virts || %file_virts || &error($text{'delete_enone'});
 
 # Delete their structures
-&before_changing();
+&before_changing(keys %file_virts);
 foreach $vconf (@virts) {
 	&lock_file($vconf->{'file'});
 	&save_directive_struct($vconf, undef, $conf, $conf);
 	&delete_file_if_empty($vconf->{'file'});
 	}
+foreach $file (keys %file_virts) {
+	&lock_file($file);
+	$deleted += &delete_virtuals_from_file($file, @{$file_virts{$file}});
+	&unlock_file($file);
+	}
 &flush_file_lines();
 &unlock_all_files();
 &update_last_config_change();
 &after_changing();
-&webmin_log("virts", "delete", scalar(@virts));
+$deleted += scalar(@virts);
+&webmin_log("virts", "delete", $deleted);
 &redirect("");
-

apache/help/AssignUserId.html

@@ -0,0 +1,7 @@
+<header>Tie virtual to child process</header>
+The <tt>AssignUserId</tt> directive assigns a virtual host to a child process
+running with the selected user ID and group ID for the legacy perchild MPM.
+<p>
+This directive is only available for Apache versions and MPMs that support
+perchild.
+<p><footer>

apache/help/ChildPerUserId.html

@@ -0,0 +1,7 @@
+<header>Child process UID assignments</header>
+The <tt>ChildPerUserId</tt> directive defines how many child processes should
+run for a selected user ID and group ID in the legacy perchild MPM.
+<p>
+This directive is only available for Apache versions and MPMs that support
+perchild.
+<p><footer>

apache/help/LimitRequestBody.html

@@ -0,0 +1,7 @@
+<header>Maximum request body size</header>
+The <tt>LimitRequestBody</tt> directive sets the maximum allowed size of an HTTP
+request body in bytes.
+<p>
+This can be used to limit upload or form submission size for the server,
+virtual host, directory, or location where the directive is applied.
+<p><footer>

apache/help/LimitRequestFields.html

@@ -0,0 +1,7 @@
+<header>Maximum headers in request</header>
+The <tt>LimitRequestFields</tt> directive sets the maximum number of HTTP
+request header fields that Apache will accept.
+<p>
+Lowering this limit can reduce exposure to unusually large requests, but values
+that are too low can reject legitimate clients.
+<p><footer>

apache/help/LimitRequestFieldsize.html

@@ -0,0 +1,7 @@
+<header>Maximum request header size</header>
+The <tt>LimitRequestFieldSize</tt> directive sets the maximum size of each HTTP
+request header field in bytes.
+<p>
+Lowering this limit can reject oversized request headers, but values that are
+too low can break clients that send larger cookies or authorization headers.
+<p><footer>

apache/help/LimitRequestLine.html

@@ -0,0 +1,7 @@
+<header>Maximum request line size</header>
+The <tt>LimitRequestLine</tt> directive sets the maximum size of the HTTP
+request line in bytes.
+<p>
+This line contains the method, requested URI, and HTTP protocol version. Values
+that are too low can reject legitimate long URLs.
+<p><footer>

apache/help/LimitXMLRequestBody.html

@@ -0,0 +1,6 @@
+<header>Maximum XML request body size</header>
+The <tt>LimitXMLRequestBody</tt> directive sets the maximum allowed size of an
+XML request body in bytes.
+<p>
+It is mainly used by modules that parse XML request bodies, such as WebDAV.
+<p><footer>

apache/help/MaxClients.html

@@ -0,0 +1,8 @@
+<header>Maximum simultaneous requests</header>
+The <tt>MaxClients</tt> directive is the old Apache name for the maximum number
+of requests that can be served at the same time. On Apache 2.4 and newer, the
+equivalent directive is <tt>MaxRequestWorkers</tt>.
+<p>
+For prefork MPM, this limits child server processes. For threaded MPMs, it
+limits the total number of worker threads across all child processes.
+<p><footer>

apache/help/MaxRequestWorkers.html

@@ -0,0 +1,9 @@
+<header>Maximum simultaneous requests</header>
+The <tt>MaxRequestWorkers</tt> directive sets the maximum number of requests
+that Apache can serve at the same time. Requests above this limit wait until an
+existing worker is free.
+<p>
+For prefork MPM, this limits child server processes. For threaded MPMs, it
+limits the total number of worker threads across all child processes. Raising
+this value may also require increasing <tt>ServerLimit</tt>.
+<p><footer>

apache/help/MaxRequestsPerChild.html

@@ -0,0 +1,8 @@
+<header>Maximum requests per child process</header>
+The <tt>MaxRequestsPerChild</tt> directive sets how many requests an Apache
+child process will handle before it exits and is replaced. A value of
+<tt>0</tt> means the process is not recycled because of this limit.
+<p>
+Recycling can help contain memory growth in long-running processes, but setting
+this too low can create unnecessary process churn.
+<p><footer>

apache/help/MaxSpareServers.html

@@ -0,0 +1,8 @@
+<header>Maximum idle server processes</header>
+The <tt>MaxSpareServers</tt> directive sets the maximum number of idle child
+server processes Apache tries to keep when using prefork-style process
+handling.
+<p>
+If more idle child processes are available, Apache stops some of them to avoid
+keeping unnecessary processes running.
+<p><footer>

apache/help/MaxSpareThreads.html

@@ -0,0 +1,7 @@
+<header>Maximum idle worker threads</header>
+The <tt>MaxSpareThreads</tt> directive sets the maximum number of idle worker
+threads Apache tries to keep when using a threaded MPM such as worker or event.
+<p>
+If more idle threads are available, Apache can reduce the number of running
+workers instead of keeping excess capacity open.
+<p><footer>

apache/help/MaxThreadsPerChild.html

@@ -0,0 +1,6 @@
+<header>Maximum threads per child process</header>
+The <tt>MaxThreadsPerChild</tt> directive sets the maximum number of worker
+threads allowed in each child process for the legacy perchild MPM.
+<p>
+This directive only appears for Apache versions and MPMs that support perchild.
+<p><footer>

apache/help/MinSpareServers.html

@@ -0,0 +1,8 @@
+<header>Minimum idle server processes</header>
+The <tt>MinSpareServers</tt> directive sets the minimum number of idle child
+server processes Apache tries to keep ready when using prefork-style process
+handling.
+<p>
+If fewer idle child processes are available, Apache starts more so new
+connections can be accepted without waiting for a process to be created.
+<p><footer>

apache/help/MinSpareThreads.html

@@ -0,0 +1,8 @@
+<header>Minimum idle worker threads</header>
+The <tt>MinSpareThreads</tt> directive sets the minimum number of idle worker
+threads Apache tries to keep ready when using a threaded MPM such as worker or
+event.
+<p>
+If fewer idle threads are available, Apache starts or adjusts child processes
+so new connections can be accepted without waiting for threads to become free.
+<p><footer>

apache/help/NumServers.html

@@ -0,0 +1,6 @@
+<header>Number of child processes</header>
+The <tt>NumServers</tt> directive sets the number of child server processes for
+the legacy perchild MPM.
+<p>
+This directive only appears for Apache versions and MPMs that support perchild.
+<p><footer>

apache/help/RLimitCPU.html

@@ -0,0 +1,8 @@
+<header>CPU resource limit</header>
+The <tt>RLimitCPU</tt> directive sets a CPU time resource limit for processes
+started by Apache in this context, such as CGI programs where supported by the
+operating system.
+<p>
+The soft limit is applied first. If a hard limit is also set, it is the maximum
+value that the process can raise the soft limit to.
+<p><footer>

apache/help/RLimitMEM.html

@@ -0,0 +1,8 @@
+<header>Memory resource limit</header>
+The <tt>RLimitMEM</tt> directive sets a memory resource limit for processes
+started by Apache in this context, such as CGI programs where supported by the
+operating system.
+<p>
+The soft limit is applied first. If a hard limit is also set, it is the maximum
+value that the process can raise the soft limit to.
+<p><footer>

apache/help/RLimitNPROC.html

@@ -0,0 +1,8 @@
+<header>Process limit</header>
+The <tt>RLimitNPROC</tt> directive sets a process count resource limit for
+processes started by Apache in this context, such as CGI programs where
+supported by the operating system.
+<p>
+The soft limit is applied first. If a hard limit is also set, it is the maximum
+value that the process can raise the soft limit to.
+<p><footer>

apache/help/ServerLimit.html

@@ -0,0 +1,9 @@
+<header>Server process limit</header>
+The <tt>ServerLimit</tt> directive sets the hard upper limit on the number of
+Apache child server processes. It caps values such as
+<tt>MaxRequestWorkers</tt> for prefork MPM, and works with
+<tt>ThreadsPerChild</tt> for threaded MPMs.
+<p>
+Increasing this value may require a full Apache stop and start before it takes
+effect.
+<p><footer>

apache/help/StartServers.html

@@ -0,0 +1,7 @@
+<header>Server processes at startup</header>
+The <tt>StartServers</tt> directive sets how many child server processes Apache
+starts when the server first launches.
+<p>
+Apache adjusts the number of child processes after startup based on traffic and
+the spare process or spare thread limits.
+<p><footer>

apache/help/StartThreads.html

@@ -0,0 +1,7 @@
+<header>Initial threads per child process</header>
+The <tt>StartThreads</tt> directive sets how many worker threads are created at
+startup for legacy threaded MPMs that support this directive.
+<p>
+Apache may adjust the number of running workers after startup based on traffic
+and the configured spare thread limits.
+<p><footer>

apache/help/ThreadLimit.html

@@ -0,0 +1,7 @@
+<header>Thread limit per child process</header>
+The <tt>ThreadLimit</tt> directive sets the hard upper limit for the number of
+worker threads that can be configured in each child process.
+<p>
+It must be high enough for <tt>ThreadsPerChild</tt>. Increasing this value may
+require a full Apache stop and start before it takes effect.
+<p><footer>

apache/help/ThreadsPerChild.html

@@ -0,0 +1,7 @@
+<header>Worker threads per child process</header>
+The <tt>ThreadsPerChild</tt> directive sets how many worker threads Apache
+creates in each child process when using a threaded MPM.
+<p>
+The total request capacity for threaded MPMs is controlled by this value
+together with <tt>ServerLimit</tt> and <tt>MaxRequestWorkers</tt>.
+<p><footer>

apache/index.cgi

@@ -102,6 +102,10 @@ if (&can_edit_virt()) {
 	push(@vproxy, undef);
 	$sn ||= &get_system_hostname();
 	push(@vurl, $defport ? "http://$sn:$defport/" : "http://$sn/");
+	push(@vfile, undef);
+	push(@vstatus, "");
+	push(@vsel, undef);
+	push(@vfilemanage, 0);
 	$showing_default++;
 	}
 
@@ -128,16 +132,23 @@ elsif ($httpd_modules{'core'} >= 1.2) {
 	$ba = &find_directive("ServerName", $conf);
 	$nv{&to_ipaddress($ba ? $ba : &get_system_hostname())}++;
 	}
-@virt = grep { &can_edit_virt($_) } @virt;
+$can_vhost_files = &can_manage_vhost_files();
+@vrows = &get_virtual_list_rows($conf);
 if ($config{'show_order'} == 1) {
 	# sort by server name
-	@virt = sort { &server_name_sort($a) cmp &server_name_sort($b) } @virt;
+	@vrows = sort { &server_name_sort($a->{'virt'}) cmp
+			&server_name_sort($b->{'virt'}) } @vrows;
 	}
 elsif ($config{'show_order'} == 2) {
 	# sort by IP address
-	@virt = sort { &server_ip_sort($a) cmp &server_ip_sort($b) } @virt;
+	@vrows = sort { &server_ip_sort($a->{'virt'}) cmp
+			&server_ip_sort($b->{'virt'}) } @vrows;
 	}
-foreach $v (@virt) {
+@virt = map { $_->{'virt'} } grep { $_->{'active'} } @vrows;
+%available_vhost_file = map { $_, 1 } &get_vhost_available_files()
+	if ($can_vhost_files);
+foreach $r (@vrows) {
+	$v = $r->{'virt'};
 	$vm = $v->{'members'};
 	if ($v->{'words'}->[0] =~ /^\[(\S+)\]:(\d+)$/) {
 		# IPv6 address and port
@@ -163,7 +174,7 @@ foreach $v (@virt) {
 	$idx = &indexof($v, @$conf);
 	push(@vidx, $idx);
 	push(@vname, $text{'index_virt'});
-	push(@vlink, "virt_index.cgi?virt=$idx");
+	push(@vlink, $r->{'active'} ? "virt_index.cgi?virt=$idx" : undef);
 	$sname = &find_directive("ServerName", $vm);
 	local $daddr = $addr eq "_default_" ||
                        ($addr eq "*" && $httpd_modules{'core'} < 1.2);
@@ -225,10 +236,34 @@ foreach $v (@virt) {
 		}
 	$sp = undef if ($sp == 80 && $prot eq "http" ||
 			$sp == 443 && $prot eq "https");
-	push(@vurl, $sp ? "$prot://$sn:$sp/" : "$prot://$sn/");
+	push(@vurl, $r->{'active'} ?
+		    ($sp ? "$prot://$sn:$sp/" : "$prot://$sn/") : undef);
+	local $rfile = $r->{'file'} ? &simplify_path(&resolve_links($r->{'file'}))
+				    : undef;
+	push(@vfile, $rfile);
+	local $status = "";
+	if ($can_vhost_files && $rfile && $available_vhost_file{$rfile}) {
+		local $enabled = &vhost_file_state($rfile)->{'enabled'};
+		$status = $enabled ? $text{'index_enabled'} :
+				     $text{'index_disabled'};
+		}
+	push(@vstatus, $status);
+	local $file_manage = $can_vhost_files && $rfile &&
+			     $available_vhost_file{$rfile} &&
+			     &can_manage_vhost_state_file($rfile);
+	push(@vfilemanage, $file_manage ? 1 : 0);
+	local $sel;
+	if ($r->{'active'} && (!$can_vhost_files || !&is_default_vhost($v))) {
+		$sel = $idx;
+		}
+	elsif (!$r->{'active'} && $can_vhost_files && $rfile &&
+	       $available_vhost_file{$rfile} && $file_manage) {
+		$sel = "file\t".$rfile."\t".$v->{'line'};
+		}
+	push(@vsel, $sel);
 	}
 
-if (@vlink == 1 && !$access{'global'} && $access{'virts'} ne "*" &&
+if (@vlink == 1 && $vlink[0] && !$access{'global'} && $access{'virts'} ne "*" &&
     !$access{'create'} && $access{'noconfig'}) {
 	# Can only manage one vhost, so go direct to it
 	&redirect($vlink[0]);
@@ -297,7 +332,9 @@ if ($access{'global'}) {
 # work out select links
 print &ui_tabs_start_tab("mode", "list");
 #print $text{'index_desclist'},"<p>\n";
-$showdel = $access{'vaddr'} && ($vidx[0] || $vidx[1]);
+$showdel = $access{'vaddr'} &&
+	   grep { defined($_) && $_ ne "" } @vsel;
+$showtoggle = $can_vhost_files && grep { $_ } @vfilemanage;
 @links = ( );
 if ($showdel) {
 	push(@links, &select_all_link("d"),
@@ -326,8 +363,10 @@ if ($config{'max_servers'} && @vname > $config{'max_servers'}) {
 	}
 elsif ($config{'show_list'} && scalar(@vname)) {
 	# as list for people with lots of servers
+	$list_form = "vhosts_form";
 	if ($showdel) {
-		print &ui_form_start("delete_vservs.cgi", "post");
+		print &ui_form_start("delete_vservs.cgi", "post", undef,
+				     "id='$list_form'");
 		}
 	print &ui_links_row(\@links);
 	print &ui_columns_start([
@@ -337,19 +376,23 @@ elsif ($config{'show_list'} && scalar(@vname)) {
 		$text{'index_port'},
 		$text{'index_name'},
 		$text{'index_root'},
+		$can_vhost_files ? ( $text{'index_status'} ) : ( ),
 		$text{'index_url'} ], 100);
 	for($i=0; $i<@vname; $i++) {
 		local @cols;
-		push(@cols, &ui_link($vlink[$i], $vname[$i]) );
+		push(@cols, $vlink[$i] ? &ui_link($vlink[$i], $vname[$i]) :
+					  $vname[$i] );
 		push(@cols, &html_escape($vaddr[$i]));
 		push(@cols, &html_escape($vport[$i]));
 		push(@cols, $vserv[$i] || $text{'index_auto'});
 		push(@cols, &html_escape($vproxy[$i]) ||
 			    &html_escape($vroot[$i]));
-		push(@cols, &ui_link($vurl[$i], $text{'index_view'}) );
-		if ($showdel && $vidx[$i]) {
+		push(@cols, $vstatus[$i]) if ($can_vhost_files);
+		push(@cols, $vurl[$i] ? &ui_link($vurl[$i], $text{'index_view'}) :
+					"" );
+		if ($showdel && defined($vsel[$i]) && $vsel[$i] ne "") {
 			print &ui_checked_columns_row(\@cols, undef,
-						      "d", $vidx[$i]);
+						      "d", $vsel[$i]);
 			}
 		elsif ($showdel) {
 			print &ui_columns_row([ "", @cols ]);
@@ -361,13 +404,23 @@ elsif ($config{'show_list'} && scalar(@vname)) {
 	print &ui_columns_end();
 	print &ui_links_row(\@links);
 	if ($showdel) {
-		print &ui_form_end([ [ "delete", $text{'index_delete'} ] ]);
+		if ($showtoggle) {
+			print &ui_form_end_side_by_side($list_form,
+				[ [ "delete", $text{'index_delete'} ] ],
+				[ [ "toggle", $text{'index_toggle'}, undef,
+				    undef, "form=\"$list_form\"" ] ]);
+			}
+		else {
+			print &ui_form_end([ [ "delete", $text{'index_delete'} ] ]);
+			}
 		}
 	}
 else {
 	# as icons for niceness
+	$list_form = "vhosts_form";
 	if ($showdel) {
-		print &ui_form_start("delete_vservs.cgi", "post");
+		print &ui_form_start("delete_vservs.cgi", "post", undef,
+				     "id='$list_form'");
 		}
 	print &ui_links_row(\@links);
 	print "<table width=100% cellpadding=5>\n";
@@ -376,8 +429,9 @@ else {
 		print '<div class="row icons-row inline-row">';
 		&generate_icon("images/virt.gif", $vname[$i], $vlink[$i],
 			       undef, undef, undef,
-			       $vidx[$i] && $access{'vaddr'} ?
-					&ui_checkbox("d", $vidx[$i]) : "");
+			       defined($vsel[$i]) && $vsel[$i] ne "" &&
+			       $access{'vaddr'} ?
+					&ui_checkbox("d", $vsel[$i]) : "");
 		print "</div>\n";
 		print "</td> <td valign=top>\n";
 		print "$vdesc[$i]<br>\n";
@@ -397,12 +451,24 @@ else {
 			print "<b>$text{'index_root'}</b> ",
 			      &html_escape($vroot[$i]),"</td> </tr>\n";
 			}
+		if ($can_vhost_files && $vstatus[$i]) {
+			print "<tr><td colspan=2><b>$text{'index_status'}</b> ",
+			      $vstatus[$i],"</td></tr>\n";
+			}
 		print "</table></td> </tr>\n";
 		}
 	print "</table>\n";
 	print &ui_links_row(\@links);
 	if ($showdel) {
-		print &ui_form_end([ [ "delete", $text{'index_delete'} ] ]);
+		if ($showtoggle) {
+			print &ui_form_end_side_by_side($list_form,
+				[ [ "delete", $text{'index_delete'} ] ],
+				[ [ "toggle", $text{'index_toggle'}, undef,
+				    undef, "form=\"$list_form\"" ] ]);
+			}
+		else {
+			print &ui_form_end([ [ "delete", $text{'index_delete'} ] ]);
+			}
 		}
 	}
 print &ui_tabs_end_tab();
@@ -492,4 +558,3 @@ return $addr eq '_default_' || $addr eq '*' ? undef :
        $addr =~ /^\[(\S+)\]$/ && &check_ip6address($1) ? $1 :
 			         &to_ipaddress($addr);
 }
-

apache/lang/en

@@ -34,6 +34,9 @@ index_listen=Listen on address (if needed)
 index_port=Port
 index_name=Server Name
 index_root=Document Root
+index_status=State
+index_enabled=Enabled
+index_disabled=Disabled
 index_url=URL
 index_view=Open..
 index_adddir=Allow access to this directory
@@ -57,6 +60,7 @@ index_fmode1=Virtual servers file $1
 index_fmode1d=New file under virtual servers directory $1
 index_fmode2=Selected file..
 index_delete=Delete Selected Servers
+index_toggle=Toggle State
 
 cvirt_ecannot=You are not allowed to create a virtual server
 cvirt_err=Failed to create virtual server
@@ -342,13 +346,15 @@ core_maxkeep=Maximum keepalives per connection
 core_maxreq=Maximum requests per server process
 core_minspare=Minimum spare server processes
 core_maxspare=Maximum spare server processes
-core_initial=Initial server processes
+core_initial=Server processes at startup
+core_serverlimit=Server process limit
 core_emaxconc=Maximum concurrent requests must be an integer
 core_emaxkeep=Maximum keepalives per connection must be an integer
 core_emaxreq=Maximum requests per server process must be an integer
 core_eminspare=Minimum spare server processes must be an integer
 core_emaxspare=Maximum spare server processes must be an integer
-core_einitial=Initial server processes must be an integer
+core_einitial=Server processes at startup must be an integer
+core_eserverlimit=Server process limit must be an integer
 core_default=Default
 core_cpulimit=CPU resource limit
 core_memlimit=Memory resource limit
@@ -1032,6 +1038,7 @@ log_stop=Stopped webserver
 log_apply=Applied changes
 log_manual=Manually edited configuration file $1
 log_virts_delete=Deleted $1 virtual servers
+log_toggle_vhostfile=Toggled state of $1 virtual host files
 
 search_title=Find Servers
 search_notfound=No matching virtual servers found
@@ -1059,6 +1066,8 @@ worker_eminspare=Minimum spare threads must be an integer
 worker_emaxspare=Maximum spare threads must be an integer
 worker_threads=Threads per child process
 worker_ethreads=Number of threads per child process must be an integer
+worker_threadlimit=Thread limit per child process
+worker_ethreadlimit=Thread limit per child process must be an integer
 
 perchild_sthreads=Initial threads per child process
 perchild_esthreads=Number of threads per child process must be an integer
@@ -1148,6 +1157,22 @@ delete_err=Failed to delete virtual servers
 delete_enone=None selected
 delete_ecannot=You are not allowed to delete servers
 delete_ecannot2=You are not allowed to edit the server $1
+delete_eaction=No action was selected
+delete_egone=The selected virtual server no longer exists
+delete_edefault=The default virtual server cannot be deleted
+
+enable_err=Failed to change virtual host file state
+enable_enone=No manageable virtual host files were selected
+enable_efile=Virtual host file does not exist or cannot be managed
+enable_elinkdir=No enabled virtual host links directory is configured
+enable_elink=Failed to create symbolic link $1 : $2
+enable_eunlink=Failed to remove symbolic link $1 : $2
+enable_elinkexists=The symbolic link $1 already exists
+enable_etest=Apache configuration test failed after changing the virtual host file state : $1
+enable_evirtualmin_disable=This Apache virtual host is managed by Virtualmin virtual server $1, which is currently $2. Site disabling should be done in Virtualmin using $3.
+enable_evirtualmin_enable=This Apache virtual host is managed by Virtualmin virtual server $1, which is currently $2. Site enabling should be done in Virtualmin using $3.
+enable_virtualmin_disable_label=Disable and Delete ⇾ Disable Virtual Server
+enable_virtualmin_enable_label=Disable and Delete ⇾ Enable Virtual Server
 
 syslog_desc=Apache error log
 

apache/lang/no

@@ -32,8 +32,8 @@ index_addr=Adresse
 index_nv=Legg til adresse for navnebasert virtuell server (hvis nødvendig)
 index_listen=Lytt på adresse (hvis nødvendig)
 index_port=Port
-index_name=Tjener Navn
-index_root=Dokument Rot
+index_name=Tjenernavn
+index_root=Dokumentrot
 index_url=URL
 index_view=Åpne..
 index_adddir=Gi tilgang til denne katalogen
@@ -243,8 +243,8 @@ htfile_header2=$1 for $2
 reconfig_title=Rekonfigurer kjente moduler
 reconfig_ecannot=Du har ikke lov til å rekonfigurere apache
 reconfig_ever=Kunne ikke hente versjonsnummer på Apache server programmet $1. Sjekk din <a href='$2'>modul konfigurasjon</a> for å forsikre deg om at dette er riktig sti.
-reconfig_desc1=Din Apache konfigurasjon er endret, eller har ikke blit undersøkt av Webmin enda. Nedenfor finner du en liste over alle Apache moduler som støttes av Webmin, med de installerte modulene avmerket. Du kan velge eller velge bort moduler dersom listen ikke er korrekt.
-reconfig_desc2=Nedenfor finner du en liste over alle Apache moduler som støttes av Webmin, med de installerte modulene avmerket. Dersom du benytter dynamisk lastede moduler kan det være nødvendig å velge de modulene som er dynamisk lastet.
+reconfig_desc1=Din Apache konfigurasjon er endret, eller har ikke blit undersøkt av Webmin enda. Nedenfor finner du en liste over alle Apache-moduler som støttes av Webmin, med de installerte modulene avmerket. Du kan velge eller velge bort moduler dersom listen ikke er korrekt.
+reconfig_desc2=Nedenfor finner du en liste over alle Apache-moduler som støttes av Webmin, med de installerte modulene avmerket. Dersom du benytter dynamisk lastede moduler kan det være nødvendig å velge de modulene som er dynamisk lastet.
 reconfig_desc3=Dersom du er usikker på hvilke moduler som støttes av Apache på ditt system, kan du klikke Konfigurer, siden Webmin normalt autmatisk vil kunne finne ut hvilke moduler som er støttet.
 reconfig_ok=Konfigurer
 
@@ -272,9 +272,9 @@ authu_euser=Ikke noe brukernavn oppgitt
 authu_euser2=Brukernavn kan ikke inneholde en :
 authu_edup=En bruker ved navn '$1' finnes allerede
 authu_sync=Innstillingene nedenfor lar deg konfigurerer Webmin til å automatisk legge til, oppdatere eller slette en bruker fra denne passordfilen når en bruker er lagt til, endret eller fjernet i modulen <tt>Brukere og grupper</tt>.
-authu_screate=Legg til en bruker når en Unix bruker blir lagt til
-authu_sdelete=Slett brukeren når en Unix bruker slettes
-authu_smodify=Endre brukeren når en Unix bruker endres
+authu_screate=Legg til en bruker når en Unix-bruker blir lagt til
+authu_sdelete=Slett brukeren når en Unix-bruker slettes
+authu_smodify=Endre brukeren når en Unix-bruker endres
 
 authg_ecannot='$1' er ikke en tillatt grupper tekstfil
 authg_title=Gruppeliste
@@ -465,8 +465,8 @@ core_group=Gruppenavn
 core_gid=Gruppe ID
 core_user=Brukernavn
 core_uid=Bruker ID
-core_asgroup=Kjør som Unix gruppe
-core_asuser=Kjør som Unix bruker
+core_asgroup=Kjør som Unix-gruppe
+core_asuser=Kjør som Unix-bruker
 core_euid='$1' er ikke en gyldig gruppe ID
 core_egid='$1' er ikke en gyldig bruker ID
 core_tourl=Gå til URL..
@@ -990,7 +990,7 @@ log_mime_modify=Endret MIME type $1
 log_mime_create=Lagt til MIME type $1
 log_defines=Endret definerte parametere
 log_reconfig=Rekonfigurert kjente moduler
-log_mods=Endret konfigurerte Apache moduler
+log_mods=Endret konfigurerte Apache-moduler
 log_start=Startet webserver
 log_stop=Stoppet webserver
 log_apply=Endringer lagret
@@ -1063,7 +1063,7 @@ cache_emaxoc=Antall objekter å cache i minne må være et heltall
 
 suexec_su=Kjør CGI programmer som
 suexec_none=Bruker fra global konfigurasjon
-suexec_user=Unix bruker
+suexec_user=Unix-bruker
 suexec_group=og gruppe
 suexec_euser=Manglende eller ugyldig bruker å kjøre CGI programmer som
 suexec_egroup=Manglende eller ugyldig gruppe å kjøre CGI programmer som
@@ -1078,8 +1078,8 @@ filter_out=Output Filter definisjoner
 filter_ename=Ugyldig filter navn '$1'
 filter_ecmd=Mangler kommando for filter '$1'
 
-cdir_err=Kunne ikke opprette per-directory instillinger
-cdir_err2=Kunne ikke lagre per-directory innstillinger
+cdir_err=Kunne ikke opprette per-mappe-innstillinger
+cdir_err2=Kunne ikke lagre per-mappe-innstillinger
 cdir_epath=Manglende sti
 cdir_eproxy=Proxy innstillinger kan ikke opprettes med match regexp innstillingen slått på
 cdir_ecannot=Du har ikke tilgang til å opprette per-katalog innstillinger for den angitte stien
@@ -1126,12 +1126,12 @@ mod_auth_digest_al=Hashing algoritme
 mod_auth_digest_domain=URLer og stier i samme domene
 mod_auth_digest_edomain=Manglende URLer og stier i samme domene
 
-mods_title=Konfigurer Apache moduler
+mods_title=Konfigurer Apache-moduler
 mods_mod=Modul
 mods_state=Gjeldende tilstand
 mods_enabled=Slått på
 mods_disabled=Slått av
 mods_available=Tilgjengelig for installasjon
-mods_ecannot=Du har ikke tilgang til å konfigurere Apache moduler
+mods_ecannot=Du har ikke tilgang til å konfigurere Apache-moduler
 mods_save=Slå på valgte moduler
-mods_desc=Denne siden lar deg velge hvilke valgfrie Apache moduler som er slått på, ved å bruke sjekkboksen ved siden av hvert modulnavn. Vær forsiktig når du slår av en modul, siden alle eksisterende direktiver for den modulen, ikke lenger vil gjenkjennes.
+mods_desc=Denne siden lar deg velge hvilke valgfrie Apache-moduler som er slått på, ved å bruke sjekkboksen ved siden av hvert modulnavn. Vær forsiktig når du slår av en modul, siden alle eksisterende direktiver for den modulen, ikke lenger vil gjenkjennes.

apache/mod_mpm_event.pl

@@ -1,5 +1,5 @@
 # mod_mpm_event.pl
-# Defines editors for the pre-forking module in apache 2.4.
+# Defines editors for the event MPM module in apache 2.4.
 # The actual functions for all of these are still in core.pl
 
 sub mod_mpm_event_directives
@@ -9,13 +9,17 @@ $rv = [ [ 'CoreDumpDirectory', 0, 9, 'global', 2.0 ],
 	[ 'BindAddress Listen Port', 1, 1, 'global', 2.0, 10 ],
 	[ 'ListenBacklog', 0, 1, 'global', 2.0 ],
 	[ 'LockFile', 0, 9, 'global', 2.0 ],
+	[ 'MaxRequestWorkers', 0, 0, 'global', 2.313 ],
 	[ 'MaxRequestsPerChild', 0, 0, 'global', 2.0 ],
-	[ 'MinSpareServers', 0, 0, 'global', 2.0 ],
-	[ 'MaxSpareServers', 0, 0, 'global', 2.0 ],
+	[ 'MinSpareThreads', 0, 0, 'global', 2.0 ],
+	[ 'MaxSpareThreads', 0, 0, 'global', 2.0 ],
 	[ 'PidFile', 0, 9, 'global', 2.0 ],
 	[ 'ScoreBoardFile', 0, 9, 'global', 2.0 ],
 	[ 'SendBufferSize', 0, 1, 'global', 2.0 ],
+	[ 'ServerLimit', 0, 0, 'global', 2.0 ],
 	[ 'StartServers', 0, 0, 'global', 2.0 ],
+	[ 'ThreadLimit', 0, 0, 'global', 2.0 ],
+	[ 'ThreadsPerChild', 0, 0, 'global', 2.0 ],
 	[ 'Group', 0, 8, 'global', 2.0 ],
 	[ 'User', 0, 8, 'global', 2.0, 10 ] ];
 return &make_directives($rv, $_[0], "mod_mpm_event");

apache/mod_mpm_prefork.pl

@@ -9,12 +9,14 @@ $rv = [ [ 'CoreDumpDirectory', 0, 9, 'global', 2.0 ],
 	[ 'BindAddress Listen Port', 1, 1, 'global', 2.0, 10 ],
 	[ 'ListenBacklog', 0, 1, 'global', 2.0 ],
 	[ 'LockFile', 0, 9, 'global', 2.0 ],
+	[ 'MaxRequestWorkers', 0, 0, 'global', 2.313 ],
 	[ 'MaxRequestsPerChild', 0, 0, 'global', 2.0 ],
 	[ 'MinSpareServers', 0, 0, 'global', 2.0 ],
 	[ 'MaxSpareServers', 0, 0, 'global', 2.0 ],
 	[ 'PidFile', 0, 9, 'global', 2.0 ],
 	[ 'ScoreBoardFile', 0, 9, 'global', 2.0 ],
 	[ 'SendBufferSize', 0, 1, 'global', 2.0 ],
+	[ 'ServerLimit', 0, 0, 'global', 2.0 ],
 	[ 'StartServers', 0, 0, 'global', 2.0 ],
 	[ 'Group', 0, 8, 'global', 2.0 ],
 	[ 'User', 0, 8, 'global', 2.0, 10 ] ];

apache/mod_mpm_worker.pl

@@ -0,0 +1,27 @@
+# mod_mpm_worker.pl
+# Defines editors for the worker MPM module in apache 2.4.
+# The actual functions for all of these are still in core.pl
+
+sub mod_mpm_worker_directives
+{
+local $rv;
+$rv = [ [ 'CoreDumpDirectory', 0, 9, 'global', 2.0 ],
+	[ 'BindAddress Listen Port', 1, 1, 'global', 2.0, 10 ],
+	[ 'ListenBacklog', 0, 1, 'global', 2.0 ],
+	[ 'LockFile', 0, 9, 'global', 2.0 ],
+	[ 'MaxRequestWorkers', 0, 0, 'global', 2.313 ],
+	[ 'MaxRequestsPerChild', 0, 0, 'global', 2.0 ],
+	[ 'MinSpareThreads', 0, 0, 'global', 2.0 ],
+	[ 'MaxSpareThreads', 0, 0, 'global', 2.0 ],
+	[ 'PidFile', 0, 9, 'global', 2.0 ],
+	[ 'ScoreBoardFile', 0, 9, 'global', 2.0 ],
+	[ 'SendBufferSize', 0, 1, 'global', 2.0 ],
+	[ 'ServerLimit', 0, 0, 'global', 2.0 ],
+	[ 'StartServers', 0, 0, 'global', 2.0 ],
+	[ 'ThreadLimit', 0, 0, 'global', 2.0 ],
+	[ 'ThreadsPerChild', 0, 0, 'global', 2.0 ],
+	[ 'Group', 0, 8, 'global', 2.0 ],
+	[ 'User', 0, 8, 'global', 2.0, 10 ] ];
+return &make_directives($rv, $_[0], "mod_mpm_worker");
+}
+

apache/mpm_netware.pl

@@ -18,7 +18,7 @@ return &make_directives($rv, $_[0], "mpm_netware");
 sub edit_MinSpareThreads
 {
 return (1,
-	$text{'worker_minspare'},
+	&hlink($text{'worker_minspare'}, "MinSpareThreads"),
 	&opt_input($_[0]->{'value'},"MinSpareThreads",$text{'default'}, 4));
 }
 sub save_MinSpareThreads
@@ -30,7 +30,7 @@ return &parse_opt("MinSpareThreads", '^\d+$',
 sub edit_MaxSpareThreads
 {
 return (1,
-	$text{'worker_maxspare'},
+	&hlink($text{'worker_maxspare'}, "MaxSpareThreads"),
 	&opt_input($_[0]->{'value'},"MaxSpareThreads",$text{'default'}, 4));
 }
 sub save_MaxSpareThreads
@@ -42,7 +42,7 @@ return &parse_opt("MaxSpareThreads", '^\d+$',
 sub edit_StartThreads
 {
 return (1,
-	$text{'perchild_sthreads'},
+	&hlink($text{'perchild_sthreads'}, "StartThreads"),
 	&opt_input($_[0]->{'value'},"StartThreads",$text{'default'}, 4));
 }
 sub save_StartThreads
@@ -51,4 +51,3 @@ return &parse_opt("StartThreads", '^\d+$',
 		  $text{'perchild_esthreads'});
 }
 
-

apache/mpm_winnt.pl

@@ -18,7 +18,7 @@ return &make_directives($rv, $_[0], "mpm_winnt");
 sub edit_ThreadsPerChild
 {
 return (1,
-	$text{'worker_threads'},
+	&hlink($text{'worker_threads'}, "ThreadsPerChild"),
 	&opt_input($_[0]->{'value'},"ThreadsPerChild",$text{'default'}, 4));
 }
 sub save_ThreadsPerChild
@@ -26,4 +26,3 @@ sub save_ThreadsPerChild
 return &parse_opt("ThreadsPerChild", '^\d+$',
 		  $text{'worker_ethreads'});
 }
-

apache/perchild.pl

@@ -35,7 +35,7 @@ $rv .= sprintf "<input type=radio name=AssignUserId_def value=0 %s>\n",
 $rv .= &text('perchild_assignug',
 	"<input name=AssignUserId_uid size=8 value='$_[0]->{'words'}->[0]'>",
 	"<input name=AssignUserId_gid size=8 value='$_[0]->{'words'}->[1]'>");
-return (2, $text{'perchild_assign'}, $rv);
+return (2, &hlink($text{'perchild_assign'}, "AssignUserId"), $rv);
 }
 sub save_AssignUserId
 {
@@ -66,7 +66,7 @@ foreach $c (@{$_[0]}, undef) {
 	$i++;
 	}
 $rv .= "</table>\n";
-return (2, $text{'perchild_child'}, $rv);
+return (2, &hlink($text{'perchild_child'}, "ChildPerUserId"), $rv);
 }
 sub save_ChildPerUserId
 {
@@ -88,7 +88,7 @@ return ( \@rv );
 sub edit_MinSpareThreads
 {
 return (1,
-	$text{'worker_minspare'},
+	&hlink($text{'worker_minspare'}, "MinSpareThreads"),
 	&opt_input($_[0]->{'value'},"MinSpareThreads",$text{'default'}, 4));
 }
 sub save_MinSpareThreads
@@ -100,7 +100,7 @@ return &parse_opt("MinSpareThreads", '^\d+$',
 sub edit_MaxSpareThreads
 {
 return (1,
-	$text{'worker_maxspare'},
+	&hlink($text{'worker_maxspare'}, "MaxSpareThreads"),
 	&opt_input($_[0]->{'value'},"MaxSpareThreads",$text{'default'}, 4));
 }
 sub save_MaxSpareThreads
@@ -112,7 +112,7 @@ return &parse_opt("MaxSpareThreads", '^\d+$',
 sub edit_StartThreads
 {
 return (1,
-	$text{'perchild_sthreads'},
+	&hlink($text{'perchild_sthreads'}, "StartThreads"),
 	&opt_input($_[0]->{'value'},"StartThreads",$text{'default'}, 4));
 }
 sub save_StartThreads
@@ -124,7 +124,7 @@ return &parse_opt("StartThreads", '^\d+$',
 sub edit_NumServers
 {
 return (1,
-	$text{'perchild_numservers'},
+	&hlink($text{'perchild_numservers'}, "NumServers"),
 	&opt_input($_[0]->{'value'},"NumServers",$text{'default'}, 4));
 }
 sub save_NumServers
@@ -136,7 +136,7 @@ return &parse_opt("NumServers", '^\d+$',
 sub edit_MaxThreadsPerChild
 {
 return (1,
-	$text{'perchild_maxthreads'},
+	&hlink($text{'perchild_maxthreads'}, "MaxThreadsPerChild"),
 	&opt_input($_[0]->{'value'},"MaxThreadsPerChild",$text{'default'}, 4));
 }
 sub save_MaxThreadsPerChild

apache/prefork.pl

@@ -9,12 +9,15 @@ $rv = [ [ 'CoreDumpDirectory', 0, 9, 'global', 2.0 ],
 	[ 'BindAddress Listen Port', 1, 1, 'global', 2.0, 10 ],
 	[ 'ListenBacklog', 0, 1, 'global', 2.0 ],
 	[ 'LockFile', 0, 9, 'global', 2.0 ],
+	[ 'MaxClients', 0, 0, 'global', '2.0-2.313' ],
+	[ 'MaxRequestWorkers', 0, 0, 'global', 2.313 ],
 	[ 'MaxRequestsPerChild', 0, 0, 'global', 2.0 ],
 	[ 'MinSpareServers', 0, 0, 'global', 2.0 ],
 	[ 'MaxSpareServers', 0, 0, 'global', 2.0 ],
 	[ 'PidFile', 0, 9, 'global', 2.0 ],
 	[ 'ScoreBoardFile', 0, 9, 'global', 2.0 ],
 	[ 'SendBufferSize', 0, 1, 'global', 2.0 ],
+	[ 'ServerLimit', 0, 0, 'global', 2.0 ],
 	[ 'StartServers', 0, 0, 'global', 2.0 ],
 	[ 'Group', 0, 8, 'global', 2.0 ],
 	[ 'User', 0, 8, 'global', 2.0, 10 ] ];

apache/t/vhost-files.t

@@ -0,0 +1,409 @@
+#!/usr/bin/perl
+# Tests for Debian-style Apache sites-available/sites-enabled handling.
+
+use strict;
+use warnings;
+use Test::More;
+use File::Basename qw(dirname);
+use File::Path qw(make_path);
+use File::Spec;
+use File::Temp qw(tempdir);
+use Cwd qw(abs_path);
+
+my $root = abs_path(File::Spec->catdir(dirname(__FILE__), '..', '..'));
+my $tmp = abs_path(tempdir(CLEANUP => 1));
+my $webmin_config = File::Spec->catdir($tmp, 'webmin-config');
+my $webmin_var = File::Spec->catdir($tmp, 'webmin-var');
+my $apache_root = File::Spec->catdir($tmp, 'apache2');
+my $available = File::Spec->catdir($apache_root, 'sites-available');
+my $enabled = File::Spec->catdir($apache_root, 'sites-enabled');
+my $apache_conf = File::Spec->catfile($apache_root, 'apache2.conf');
+
+make_path($webmin_config, $webmin_var, "$webmin_config/apache",
+	  "$webmin_var/apache", $apache_root, $available, $enabled);
+
+sub write_text
+{
+my ($file, $text) = @_;
+open(my $fh, '>', $file) || die "Failed to write $file: $!";
+print $fh $text;
+close($fh) || die "Failed to close $file: $!";
+}
+
+sub read_text
+{
+my ($file) = @_;
+open(my $fh, '<', $file) || die "Failed to read $file: $!";
+local $/ = undef;
+my $text = <$fh>;
+close($fh) || die "Failed to close $file: $!";
+return $text;
+}
+
+sub vhost_conf
+{
+my ($name, $rootdir) = @_;
+my $name_line = defined($name) ? "    ServerName $name\n" : "";
+return "<VirtualHost *:80>\n".
+       $name_line.
+       "    DocumentRoot $rootdir\n".
+       "</VirtualHost>\n";
+}
+
+my $default = File::Spec->catfile($available, '000-default.conf');
+my $alpha = File::Spec->catfile($available, 'alpha.conf');
+my $beta = File::Spec->catfile($available, 'beta.conf');
+my $charlie = File::Spec->catfile($available, 'charlie.conf');
+
+write_text($default, vhost_conf(undef, '/srv/default'));
+write_text($alpha, vhost_conf('alpha.example', '/srv/alpha'));
+write_text($beta, vhost_conf('beta.example', '/srv/beta'));
+write_text($charlie, vhost_conf('charlie.example', '/srv/charlie'));
+write_text($apache_conf,
+	"ServerRoot \"$apache_root\"\n".
+	"Listen 80\n".
+	"IncludeOptional $enabled/*.conf\n");
+
+symlink($default, File::Spec->catfile($enabled, '000-default.conf')) ||
+	die "Failed to symlink default: $!";
+symlink($alpha, File::Spec->catfile($enabled, 'alpha.conf')) ||
+	die "Failed to symlink alpha: $!";
+symlink($charlie, File::Spec->catfile($enabled, 'charlie.conf')) ||
+	die "Failed to symlink charlie: $!";
+
+write_text(File::Spec->catfile($webmin_config, 'config'),
+	"os_type=debian-linux\n".
+	"os_version=12\n".
+	"real_os_type=Debian Linux\n".
+	"real_os_version=12\n");
+write_text(File::Spec->catfile($webmin_config, 'miniserv.conf'),
+	"root=$root\n");
+write_text(File::Spec->catfile($webmin_config, 'apache', 'config'),
+	"httpd_dir=$apache_root\n".
+	"httpd_path=/bin/true\n".
+	"httpd_conf=$apache_conf\n".
+	"apachectl_path=/bin/true\n".
+	"httpd_version=2.4.57\n".
+	"test_apachectl=0\n".
+	"test_config=1\n".
+	"virt_file=$available\n".
+	"link_dir=$enabled\n");
+
+$ENV{'WEBMIN_CONFIG'} = $webmin_config;
+$ENV{'WEBMIN_VAR'} = $webmin_var;
+$ENV{'FOREIGN_MODULE_NAME'} = 'apache';
+$ENV{'FOREIGN_ROOT_DIRECTORY'} = $root;
+$ENV{'REMOTE_USER'} = 'root';
+
+unshift(@INC, $root);
+require File::Spec->catfile($root, 'apache', 'apache-lib.pl');
+
+{
+	no warnings 'once';
+	$main::text{'enable_elinkdir'} = 'No enabled virtual host links directory is configured';
+	$main::text{'enable_efile'} = 'Virtual host file does not exist or cannot be managed';
+	$main::text{'enable_elink'} = 'Failed to create symbolic link $1 : $2';
+	$main::text{'enable_eunlink'} = 'Failed to remove symbolic link $1 : $2';
+	$main::text{'enable_elinkexists'} = 'The symbolic link $1 already exists';
+	$main::text{'enable_etest'} = 'Apache configuration test failed after changing the virtual host file state : $1';
+	$main::text{'enable_evirtualmin_disable'} = 'This Apache virtual host is managed by Virtualmin virtual server $1, which is currently $2. Site disabling should be done in Virtualmin using $3.';
+	$main::text{'enable_evirtualmin_enable'} = 'This Apache virtual host is managed by Virtualmin virtual server $1, which is currently $2. Site enabling should be done in Virtualmin using $3.';
+	$main::text{'enable_virtualmin_disable_label'} = 'Disable and Delete &#x21fe; Disable Virtual Server';
+	$main::text{'enable_virtualmin_enable_label'} = 'Disable and Delete &#x21fe; Enable Virtual Server';
+	$main::text{'index_enabled'} = 'Enabled';
+	$main::text{'index_disabled'} = 'Disabled';
+	$main::text{'eafter'} = 'Apache configuration test failed : $1';
+}
+
+sub apache_config
+{
+main::flush_config_cache();
+my $conf = main::get_config();
+ok($conf, 'test apache config can be parsed');
+return $conf;
+}
+
+sub row_names
+{
+return [ map {
+	scalar(main::find_directive('ServerName', $_->{'virt'}->{'members'})) || ''
+	} @_ ];
+}
+
+sub row_states
+{
+return [ map { $_->{'active'} ? 'enabled' : 'disabled' } @_ ];
+}
+
+subtest 'sites-available files are manageable and ordered' => sub {
+	ok(main::can_manage_vhost_files(),
+	   'sites-available/enabled dirs are manageable');
+	is_deeply(
+		[ main::get_vhost_available_files() ],
+		[ $default, $alpha, $beta, $charlie ],
+		'available files are listed in stable filename order',
+	);
+
+	my @rows = main::get_virtual_list_rows(apache_config());
+	is_deeply(row_names(@rows),
+		  [ '', 'alpha.example', 'beta.example', 'charlie.example' ],
+		  'disabled rows stay in sites-available order');
+	is_deeply(row_states(@rows),
+		  [ 'enabled', 'enabled', 'disabled', 'enabled' ],
+		  'row active state follows sites-enabled symlinks');
+	ok(!main::can_manage_vhost_file($default),
+	   'default virtual host file is not file-state manageable');
+};
+
+subtest 'disable removes only the enabled symlink' => sub {
+	no warnings 'once';
+	unlink($main::last_config_change_flag);
+	unlink($main::last_restart_time_flag);
+	main::restart_last_restart_time();
+	my $old = time() - 10;
+	utime($old, $old, $main::last_restart_time_flag);
+
+	{
+		no warnings 'redefine';
+		local *main::test_config = sub { return undef; };
+		is(main::disable_vhost_file($alpha), undef, 'disable succeeds');
+	}
+	ok(main::needs_config_restart(),
+	   'disable marks config as needing apply');
+
+	ok(-f $alpha, 'disable leaves the sites-available file in place');
+	ok(!-e File::Spec->catfile($enabled, 'alpha.conf'),
+	   'disable removes the sites-enabled symlink');
+
+	my @rows = main::get_virtual_list_rows(apache_config());
+	is_deeply(row_names(@rows),
+		  [ '', 'alpha.example', 'beta.example', 'charlie.example' ],
+		  'disabled row remains in the same list position');
+	is_deeply(row_states(@rows),
+		  [ 'enabled', 'disabled', 'disabled', 'enabled' ],
+		  'disabled row status is updated');
+};
+
+subtest 'enable creates a symlink without touching the source file' => sub {
+	no warnings 'once';
+	unlink($main::last_config_change_flag);
+	unlink($main::last_restart_time_flag);
+	main::restart_last_restart_time();
+	my $old = time() - 10;
+	utime($old, $old, $main::last_restart_time_flag);
+
+	{
+		no warnings 'redefine';
+		local *main::test_config = sub { return undef; };
+		is(main::enable_vhost_file($beta), undef, 'enable succeeds');
+	}
+	ok(main::needs_config_restart(),
+	   'enable marks config as needing apply');
+
+	my $link = File::Spec->catfile($enabled, 'beta.conf');
+	ok(-f $beta, 'enable leaves the sites-available file in place');
+	ok(-l $link, 'enable creates the sites-enabled symlink');
+	is(readlink($link), $beta, 'enabled symlink points to the available file');
+	ok(main::vhost_file_enabled($beta), 'vhost_file_enabled sees the symlink');
+};
+
+subtest 'same-name symlink to another target is not disabled' => sub {
+	my $otherdir = File::Spec->catdir($tmp, 'other-sites');
+	my $other = File::Spec->catfile($otherdir, 'charlie.conf');
+	my $link = File::Spec->catfile($enabled, 'charlie.conf');
+	make_path($otherdir);
+	write_text($other, vhost_conf('other.example', '/srv/other'));
+	unlink($link) || die "Failed to remove charlie link: $!";
+	symlink($other, $link) || die "Failed to symlink other charlie: $!";
+
+	ok(!main::vhost_file_enabled($charlie),
+	   'same-name symlink to another file is not considered enabled');
+	{
+		no warnings 'redefine';
+		local *main::test_config = sub { return undef; };
+		is(main::disable_vhost_file($charlie), undef, 'disable is a no-op');
+	}
+	ok(-l $link, 'same-name symlink to another target is preserved');
+	is(readlink($link), $other, 'preserved symlink target is unchanged');
+};
+
+subtest 'disabled default virtual hosts stay hidden' => sub {
+	my $disabled_default = File::Spec->catfile($available,
+						  'zz-disabled-default.conf');
+	write_text($disabled_default, vhost_conf(undef, '/srv/disabled-default'));
+
+	my @rows = main::get_virtual_list_rows(apache_config());
+	ok(!(grep { $_->{'file'} eq $disabled_default } @rows),
+	   'disabled catch-all virtual host file is not listed as a normal vhost');
+};
+
+subtest 'legacy webfile link helpers resolve relative link_dir' => sub {
+	my $relative = File::Spec->catfile($available, 'relative.conf');
+	my $link = File::Spec->catfile($enabled, 'relative.conf');
+	write_text($relative, vhost_conf('relative.example', '/srv/relative'));
+	unlink($link);
+
+	{
+		no warnings 'once';
+		local $main::config{'link_dir'} = 'sites-enabled';
+		main::create_webfile_link($relative);
+		ok(-l $link, 'relative link_dir creates link under ServerRoot');
+		is(readlink($link), $relative,
+		   'created relative link_dir symlink points to the vhost file');
+		main::delete_webfile_link($relative);
+		ok(!-e $link && !-l $link,
+		   'relative link_dir delete removes the enabled symlink');
+	}
+};
+
+subtest 'file-level actions require access to every virtual host in the file' => sub {
+	my $mixed = File::Spec->catfile($available, 'mixed.conf');
+	write_text($mixed,
+		vhost_conf('alpha.example', '/srv/mixed-alpha').
+		vhost_conf('hidden.example', '/srv/mixed-hidden'));
+
+	{
+		no warnings 'once';
+		local $main::access{'virts'} = 'alpha.example:80';
+		ok(!main::can_manage_vhost_file($mixed),
+		   'mixed-access file cannot be managed by a restricted user');
+	}
+	ok(main::can_manage_vhost_file($mixed),
+	   'shared file can be managed when all contained vhosts are allowed');
+};
+
+subtest 'state helpers enforce allowed files and ACLs directly' => sub {
+	my $outside = File::Spec->catfile($tmp, 'outside.conf');
+	write_text($outside, vhost_conf('outside.example', '/srv/outside'));
+	is(main::enable_vhost_file($outside),
+	   'Virtual host file does not exist or cannot be managed',
+	   'enable rejects files outside sites-available');
+
+	my $mixed = File::Spec->catfile($available, 'state-mixed.conf');
+	write_text($mixed,
+		vhost_conf('alpha.example', '/srv/state-alpha').
+		vhost_conf('hidden.example', '/srv/state-hidden'));
+	{
+		no warnings 'once';
+		local $main::access{'virts'} = 'alpha.example:80';
+		is(main::enable_vhost_file($mixed),
+		   'Virtual host file does not exist or cannot be managed',
+		   'enable rejects mixed-access files without relying on caller validation');
+	}
+};
+
+subtest 'change rollback covers extra disabled vhost files' => sub {
+	my $rollback = File::Spec->catfile($available, 'rollback.conf');
+	my $original = vhost_conf('rollback.example', '/srv/rollback');
+	write_text($rollback, $original);
+	my @virts = main::find_virtuals_in_file($rollback);
+	is(scalar(@virts), 1, 'rollback fixture has one vhost');
+
+	{
+		no warnings qw(redefine once);
+		local %main::before_changing;
+		local $main::config{'test_always'} = 1;
+		local *main::test_config = sub { return 'bad config'; };
+		local *main::error = sub { die $_[0]; };
+		main::before_changing($rollback);
+		is(main::delete_virtuals_from_file($rollback, @virts), 1,
+		   'disabled vhost file deletion removes the vhost');
+		ok(!-e $rollback, 'empty disabled vhost file is deleted');
+		like(eval { main::after_changing(); 1 } ? '' : $@,
+		     qr/bad config/, 'failed post-change test reports an error');
+	}
+	ok(-f $rollback, 'rollback recreates the disabled vhost file');
+	is(read_text($rollback), $original,
+	   'rollback restores the disabled vhost file contents');
+};
+
+subtest 'apache configtest failure rolls back link changes' => sub {
+	my $delta = File::Spec->catfile($available, 'delta.conf');
+	my $delta_link = File::Spec->catfile($enabled, 'delta.conf');
+	write_text($delta, vhost_conf('delta.example', '/srv/delta'));
+
+	{
+		no warnings 'redefine';
+		local *main::test_config = sub { return 'bad config'; };
+		like(main::enable_vhost_file($delta), qr/bad config/,
+		     'failed enable reports apache configtest output');
+	}
+	ok(!-e $delta_link, 'failed enable removes the new symlink');
+
+	symlink($delta, $delta_link) || die "Failed to symlink delta: $!";
+	{
+		no warnings 'redefine';
+		local *main::test_config = sub { return 'bad config'; };
+		like(main::disable_vhost_file($delta), qr/bad config/,
+		     'failed disable reports apache configtest output');
+	}
+	ok(-l $delta_link, 'failed disable restores the removed symlink');
+	is(readlink($delta_link), $delta, 'restored symlink target is unchanged');
+};
+
+subtest 'Virtualmin-managed virtual host files cannot be toggled directly' => sub {
+	my $enabled_domain = File::Spec->catfile($available, 'vm-enabled.conf');
+	my $disabled_domain = File::Spec->catfile($available, 'vm-disabled.conf');
+	write_text($enabled_domain,
+		vhost_conf('www.vm-enabled.example', '/srv/vm-enabled'));
+	write_text($disabled_domain,
+		vhost_conf('vm-disabled.example', '/srv/vm-disabled'));
+
+	{
+		no warnings qw(redefine once);
+		local %main::apache_virtualmin_domain_for_file_cache;
+		local %main::apache_virtualmin_domain_by_name_cache;
+		local *main::virtualmin_available = sub { return 1; };
+		local *main::virtualmin_domain_by_name = sub {
+			my ($name) = @_;
+			return $name eq 'vm-enabled.example' ?
+				{ 'dom' => $name, 'id' => '12345',
+				  'disabled' => '' } :
+			       $name eq 'vm-disabled.example' ?
+				{ 'dom' => $name, 'id' => '67890',
+				  'disabled' => 'web' } :
+				undef;
+			};
+
+		my $disable_err =
+			main::virtualmin_vhost_file_state_error($enabled_domain,
+								'disable');
+		my $enabled_state = main::vhost_file_state($enabled_domain);
+		is($enabled_state->{'source'}, 'virtualmin',
+		   'Virtualmin is the effective state source for managed files');
+		ok($enabled_state->{'enabled'},
+		   'Virtualmin enabled domain is reported as enabled');
+		is(main::vhost_file_toggle_action($enabled_domain), 'disable',
+		   'toggle action follows the Virtualmin enabled state');
+		like($disable_err, qr/currently enabled/,
+		     'Virtualmin state is included for enabled domains');
+		like($disable_err, qr/Disable Virtual Server/,
+		     'disabling directs users to Virtualmin disable action');
+		like($disable_err,
+		     qr{virtual-server/disable_domain\.cgi\?dom=12345},
+		     'disabling links to the Virtualmin disable form');
+
+		my $enable_err =
+			main::virtualmin_vhost_file_state_error($disabled_domain,
+								'enable');
+		my $disabled_state = main::vhost_file_state($disabled_domain);
+		is($disabled_state->{'source'}, 'virtualmin',
+		   'Virtualmin remains the state source for disabled domains');
+		ok(!$disabled_state->{'enabled'},
+		   'Virtualmin disabled domain is reported as disabled');
+		is(main::vhost_file_toggle_action($disabled_domain), 'enable',
+		   'toggle action follows the Virtualmin disabled state');
+		like($enable_err, qr/currently disabled/,
+		     'Virtualmin state is included for disabled domains');
+		like($enable_err, qr/Enable Virtual Server/,
+		     'enabling directs users to Virtualmin enable action');
+		like($enable_err,
+		     qr{virtual-server/enable_domain\.cgi\?dom=67890},
+		     'enabling links to the Virtualmin enable form');
+
+		is(main::virtualmin_vhost_file_state_error($alpha, 'disable'),
+		   undef, 'non-Virtualmin virtual host files can still be toggled');
+	}
+};
+
+done_testing();

apache/worker.pl

@@ -9,14 +9,17 @@ $rv = [ [ 'CoreDumpDirectory', 0, 9, 'global', 2.0 ],
 	[ 'BindAddress Listen Port', 1, 1, 'global', 2.0, 10 ],
 	[ 'ListenBacklog', 0, 1, 'global', 2.0 ],
 	[ 'LockFile', 0, 9, 'global', 2.0 ],
-	[ 'MaxClients', 0, 0, 'global', 2.0 ],
+	[ 'MaxClients', 0, 0, 'global', '2.0-2.313' ],
+	[ 'MaxRequestWorkers', 0, 0, 'global', 2.313 ],
 	[ 'MaxRequestsPerChild', 0, 0, 'global', 2.0 ],
 	[ 'MinSpareThreads', 0, 0, 'global', 2.0 ],
 	[ 'MaxSpareThreads', 0, 0, 'global', 2.0 ],
 	[ 'PidFile', 0, 9, 'global', 2.0 ],
 	[ 'ScoreBoardFile', 0, 9, 'global', 2.0 ],
 	[ 'SendBufferSize', 0, 1, 'global', 2.0 ],
+	[ 'ServerLimit', 0, 0, 'global', 2.0 ],
 	[ 'StartServers', 0, 0, 'global', 2.0 ],
+	[ 'ThreadLimit', 0, 0, 'global', 2.0 ],
 	[ 'ThreadsPerChild', 0, 0, 'global', 2.0 ],
 	[ 'Group', 0, 8, 'global', 2.0 ],
 	[ 'User', 0, 8, 'global', 2.0, 10 ] ];
@@ -26,7 +29,7 @@ return &make_directives($rv, $_[0], "worker");
 sub edit_MinSpareThreads
 {
 return (1,
-	$text{'worker_minspare'},
+	&hlink($text{'worker_minspare'}, "MinSpareThreads"),
 	&opt_input($_[0]->{'value'},"MinSpareThreads",$text{'default'}, 4));
 }
 sub save_MinSpareThreads
@@ -38,7 +41,7 @@ return &parse_opt("MinSpareThreads", '^\d+$',
 sub edit_MaxSpareThreads
 {
 return (1,
-	$text{'worker_maxspare'},
+	&hlink($text{'worker_maxspare'}, "MaxSpareThreads"),
 	&opt_input($_[0]->{'value'},"MaxSpareThreads",$text{'default'}, 4));
 }
 sub save_MaxSpareThreads
@@ -50,7 +53,7 @@ return &parse_opt("MaxSpareThreads", '^\d+$',
 sub edit_ThreadsPerChild
 {
 return (1,
-	$text{'worker_threads'},
+	&hlink($text{'worker_threads'}, "ThreadsPerChild"),
 	&opt_input($_[0]->{'value'},"ThreadsPerChild",$text{'default'}, 4));
 }
 sub save_ThreadsPerChild
@@ -58,4 +61,3 @@ sub save_ThreadsPerChild
 return &parse_opt("ThreadsPerChild", '^\d+$',
 		  $text{'worker_ethreads'});
 }
-

at/macos-lib.pl

@@ -35,21 +35,24 @@ return @rv;
 # create_atjob(user, time, commands, directory, send-email)
 sub create_atjob
 {
-my @tm = localtime($_[1]);
+my ($user, $tm, $cmds, $dir, $email) = @_;
+my @tm = localtime($tm);
 my $date = sprintf "%2.2d:%2.2d %d.%d.%d",
 		$tm[2], $tm[1], $tm[3], $tm[4]+1, $tm[5]+1900;
-my $mailflag = $_[4] ? "-m" : "";
+my $mailflag = $email ? "-m" : "";
 no strict "subs";
-&open_execute_command(AT, "su \"$_[0]\" -c \"cd $_[3] ; at $mailflag $date\" >/dev/null 2>&1", 0); 
-print AT $_[2];
+my $fullcmd = &command_as_user($user, 0, "cd $dir ; at $mailflag $date");
+&open_execute_command(AT, "$fullcmd >/dev/null 2>&1", 0); 
+print AT $cmds;
 close(AT);
 use strict "subs";
-&additional_log('exec', undef, "su \"$_[0]\" -c \"cd $_[3] ; at $mailflag $date\"");
+&additional_log('exec', undef, $fullcmd);
 }
 
 # delete_atjob(id)
 sub delete_atjob
 {
-&system_logged("atrm \"$_[0]\" >/dev/null 2>&1");
+my ($id) = @_;
+&system_logged("atrm ".quotemeta($id)." >/dev/null 2>&1");
 }
 

at/module.info

@@ -1,6 +1,6 @@
 name=At
 desc=Scheduled Commands
-os_support=solaris slackware-linux redhat-linux mandrake-linux debian-linux suse-linux united-linux open-linux turbo-linux corel-linux msc-linux freebsd netbsd openbsd generic-linux openserver macos gentoo-linux irix sol-linux coherent-linux openmamba-linux syno-linux
+os_support=solaris slackware-linux redhat-linux mandrake-linux debian-linux suse-linux united-linux open-linux turbo-linux corel-linux msc-linux freebsd netbsd openbsd generic-linux alpine-linux openserver macos gentoo-linux irix sol-linux coherent-linux openmamba-linux syno-linux
 category=system
 longdesc=Schedule the execution of one-off commands or scripts.
 depends=proc

at/openserver-lib.pl

@@ -5,13 +5,13 @@ no warnings "redefine";
 
 sub list_atjobs
 {
-local @rv;
+my @rv;
 opendir(DIR, $config{'at_dir'}) || return ();
 while($f = readdir(DIR)) {
-	local $p = "$config{'at_dir'}/$f";
+	my $p = "$config{'at_dir'}/$f";
 	if ($f =~ /^(\d+)\.a(\S+)$/) {
-		local @st = stat($p);
-		local $job = { 'id' => $f,
+		my @st = stat($p);
+		my $job = { 'id' => $f,
 			       'date' => $1,
 			       'user' => scalar(getpwuid($st[4])),
 			       'created' => $st[9] };
@@ -32,17 +32,20 @@ return @rv;
 # create_atjob(user, time, commands, directory)
 sub create_atjob
 {
-local @tm = localtime($_[1]);
-local $date = strftime "%H:%M %b %d", @tm;
-&open_execute_command(AT, "su \"$_[0]\" -c \"cd $_[3] ; at $date\"", 0); 
-print AT $_[2];
+my ($user, $tm, $cmds, $dir) = @_;
+my @tm = localtime($tm);
+my $date = strftime "%H:%M %b %d", @tm;
+my $fullcmd = &command_as_user($user, 0, "cd $dir ; at $date");
+&open_execute_command(AT, $fullcmd, 0); 
+print AT $cmds;
 close(AT);
-&additional_log('exec', undef, "su \"$_[0]\" -c \"cd $_[3] ; at $date\"");
+&additional_log('exec', undef, $fullcmd);
 }
 
 # delete_atjob(id)
 sub delete_atjob
 {
-&system_logged("at -r \"$_[0]\"");
+my ($id) = @_;
+&system_logged("at -r ".quotemeta($id));
 }
 

bacula-backup/bacula-backup-lib.pl

@@ -58,6 +58,23 @@ $testcmd->finish();
 return $dbh;
 }
 
+# bacula_catalog_table_exists(&dbh, table)
+# Returns 1 if the Bacula catalog contains a table, 0 if not
+sub bacula_catalog_table_exists
+{
+local ($dbh, $table) = @_;
+$table =~ /^\w+\z/ || die "Illegal catalog table name";
+local $dbh->{'PrintError'} = 0;
+local $dbh->{'RaiseError'} = 0;
+my $cmd = eval { $dbh->prepare("SELECT 1 FROM $table WHERE 1 = 0") };
+my $ok;
+if ($cmd) {
+	$ok = eval { $cmd->execute() };
+	$cmd->finish();
+	}
+return $ok ? 1 : 0;
+}
+
 # read_config_file(file)
 # Parses a bacula config file
 sub read_config_file
@@ -1678,4 +1695,3 @@ return ( \%tags, $run );
 }
 
 1;
-