Fix to tighten privileged ACL checks

This PR addresses privately reported issue and tries to restricts root/UID 0 user mutations and Custom Commands definition editing to full, non-safe Webmin admins.

This closes privilege-escalation paths for restricted operators while preserving execution of pre-approved Custom Commands under existing cmds ACLs.

.github/workflows/code-review.yml

@@ -1,12 +0,0 @@
-name: Code Review
-
-on:
-  pull_request:
-    branches:
-      - master
-
-jobs:
-  code-review:
-    uses: webmin/webmin-ci-cd/.github/workflows/code-review.yml@main
-    secrets:
-      CODE_REVIEW_API_KEY: ${{ secrets.CODE_REVIEW_API_KEY }}

.github/workflows/webmin.dev+webmin.yml

@@ -1,4 +1,4 @@
-name: Build
+name: Package and upload artifacts
 
 on:
   push:

CHANGELOG.md

@@ -1,5 +1,57 @@
 ## Changelog
 
+#### 2.651 (June 28, 2026)
+* Fix Certbot-backed certificate requests and renewals to correctly parse PEM paths after issuance
+
+#### 2.650 (June 25, 2026)
+* Add new Systemd Services and Units module
+* Add new GRUB 2 Boot Loader module
+* Add new Kea DHCP Server module
+* Add WebSocket proxy support to the Webmin Servers Index module
+* Add basic Alpine Linux support
+* Add IP-based Let's Encrypt certificate support with Certbot 5.3
+* Add editable SSH public keys for newly added Unix users in Users and Groups module
+* Add improvements to custom Webmin temporary directory handling
+* Add quick service and port forwarding controls to the nftables module
+* Add optional pre- and post-scripts for scheduled package updates
+* Add option to control when scheduled package update email is sent
+* Add per-user RPC/API-only access option to the Webmin Users module
+* Add Apache 2.4 MPM process limit directives [#1821](https://github.com/webmin/webmin/issues/1821)
+* Add dhcpcd network backend for Debian and Raspberry Pi OS [#1607](https://github.com/webmin/webmin/issues/1607)
+* Add hardware RAID passthrough devices config in the SMART Status module [#1704](https://github.com/webmin/webmin/issues/1704)
+* Update Xterm.js to fix Control-C handling on iPadOS/Safari terminals
+* Update Webmin systemd service unit to run without forking
+* Fix IPv6 CIDR access control matching [#1570](https://github.com/webmin/webmin/issues/1570)
+* Fix Bootup and Shutdown module to show only services and not all units on systemd systems
+* Fix Let's Encrypt renewal scheduling to count from the last successful request
+* Fix NetworkManager detection on Debian and IPv6 DNS nameserver saving
+* Fix Dovecot configuration file handling when saving extra configs
+* Fix mailbox listing to skip unusable Maildir entries and remove stale deleted or moved entries
+* Fix Postfix module labels to identify virtual alias maps instead of virtual mailbox domains #1541
+* Fix Apache module to hide disabled default virtual hosts from the active server list
+* Fix Netplan DNS saving to preserve YAML structure
+* Fix BIND DNS handling of underscores, trailing dots, and mass record length checks
+* Fix MariaDB user creation when using auth plugin syntax
+* Fix PHP-FPM monitor on EL systems when using `/etc/php.ini` as the config file
+* Fix RPC-only accounts to block browser/module access before module ACL checks
+* Fix reflected XSS in Webmin status messages
+* Fix path validation in File Manager, package delete helpers, and Apache virtual host files
+* Fix authentication state handling for SSL certificate logins and proxied keep-alive requests
+* Update session handling to improve security, which will require users to re-authenticate after upgrading
+* Update the Authentic theme to the latest version with various improvements and fixes:
+  - Add zooming to stats history graphs by holding shift and scrolling in the dashboard
+  - Add support for saving live stats history for up to 24 hours without performance impact
+  - Add better support for the new Nginx, nftables, and upcoming systemd, Kea-DHCP, and GRUB 2 Webmin modules
+  - Add ability to always show available dashboard panels in theme configuration
+  - Add support for live stats and terminal WebSocket connections through Webmin Servers Index proxy links
+  - Fix proxying when Webmin is accessed with a webprefix using Webmin Servers Index module
+  - Fix theme UI helpers to escape generated markup more safely
+  - Fix iOS terminal viewport sizing
+  - Fix editor save handling, clean-state indication and dirty reload guard
+  - Fix popover positioning, z-index and border color for help bubbles
+  - Fix the active product switch border in the navigation menu for the dark palette
+  - Fix to validate password reset return URLs
+
 #### 2.641 (May 10, 2026)
 * Fixed a bug when editing monitors in the System and Server Status module
 * Fix Fail2Ban default jail options
@@ -912,4 +964,3 @@ This updated includes the latest Authentic theme, a new IPv6 Firewall module for
 #### Version 1.140
 * Fixed a security hole that allowed any user to view the configuration of any module, even those that they should not have access to.
 * Fixed a security hole that could allow an attacker to lock valid users by sending a bogus username or password.
-

acl/acl-lib.pl

@@ -1433,6 +1433,148 @@ dbmclose(%sessiondb);
 return $sid;
 }
 
+=head2 set_module_access(&modules, enabled, [&users-groups])
+
+Grants or revokes Webmin module access for users and groups. The modules
+parameter must be an array ref of module names. The enabled flag should be
+1 to grant access, or 0 to revoke access. If the users-groups parameter is
+not given, all users and groups are updated. Otherwise, it must be an array
+ref of usernames and group names. Group names may be prefixed with @ to
+target only a group.
+
+Returns the number of directly updated user and group records.
+
+=cut
+sub set_module_access
+{
+my ($mods, $enabled, $usersgroups) = @_;
+$mods ||= [];
+return 0 if (!@$mods);
+my $set_module_access_list = sub {
+	my ($obj, $key, $addmods) = @_;
+	$addmods ||= $mods;
+	my @old = @{$obj->{$key} || []};
+	my @new;
+	if ($enabled) {
+		@new = &unique(@old, @$addmods);
+		}
+	else {
+		my %remove = map { $_, 1 } @$mods;
+		@new = grep { !$remove{$_} } @old;
+		}
+	return 0 if (join("\0", @old) eq join("\0", @new));
+	$obj->{$key} = \@new;
+	return 1;
+	};
+my $own_module_updates = sub {
+	my ($obj, $inherited) = @_;
+	return $mods if (!$enabled);
+	return [] if (!@{$obj->{'ownmods'} || []} && !@$inherited);
+	return [ grep { &indexof($_, @$inherited) < 0 } @$mods ];
+	};
+my @users = &list_users();
+my @groups = &list_groups();
+my $all = !defined($usersgroups);
+my (%target_user, %target_group);
+if (!$all) {
+	foreach my $ug (@$usersgroups) {
+		if ($ug =~ /^\@(.*)$/) {
+			$target_group{$1} = 1;
+			}
+		else {
+			$target_user{$ug} = 1;
+			$target_group{$ug} = 1;
+			}
+		}
+	}
+my $changed = 0;
+my (%user_group, %group_parent);
+foreach my $g (@groups) {
+	foreach my $m (@{$g->{'members'} || []}) {
+		if ($m =~ /^\@(.*)$/) {
+			$group_parent{$1} = $g;
+			}
+		else {
+			$user_group{$m} = $g;
+			}
+		}
+	}
+my (@ordered_groups, %ordered_group, %ordering_group);
+my $add_ordered_group;
+$add_ordered_group = sub {
+	my ($g) = @_;
+	return if (!$g || $ordered_group{$g->{'name'}});
+	return if ($ordering_group{$g->{'name'}}++);
+	$add_ordered_group->($group_parent{$g->{'name'}});
+	delete($ordering_group{$g->{'name'}});
+	push(@ordered_groups, $g);
+	$ordered_group{$g->{'name'}}++;
+	};
+foreach my $g (@groups) {
+	$add_ordered_group->($g);
+	}
+
+# Update groups first, so member users and sub-groups inherit the new set
+foreach my $g (@ordered_groups) {
+	next if (!$all && !$target_group{$g->{'name'}});
+	my $gchanged = 0;
+	my $parent = $group_parent{$g->{'name'}};
+	my $ownmods = $own_module_updates->(
+		$g, [ @{$parent ? $parent->{'modules'} || [] : []} ]);
+	$gchanged += $set_module_access_list->($g, "modules");
+	$gchanged += $set_module_access_list->($g, "ownmods", $ownmods);
+	if ($gchanged) {
+		&modify_group($g->{'name'}, $g);
+		&update_members(\@users, \@groups, $g->{'modules'},
+				$g->{'members'});
+		$changed++;
+		}
+	}
+
+# Update directly targeted users
+foreach my $u (@users) {
+	next if (!$all && !$target_user{$u->{'name'}});
+	my $uchanged = 0;
+	my $group = $user_group{$u->{'name'}};
+	my $ownmods = $own_module_updates->(
+		$u, [ @{$group ? $group->{'modules'} || [] : []} ]);
+	$uchanged += $set_module_access_list->($u, "modules");
+	$uchanged += $set_module_access_list->($u, "ownmods", $ownmods);
+	if ($uchanged) {
+		&modify_user($u->{'name'}, $u);
+		$changed++;
+		}
+	}
+
+if ($changed) {
+	undef(%main::acl_hash_cache);
+	undef(%main::acl_array_cache);
+	}
+return $changed;
+}
+
+=head2 enable_module_access(&modules, [&users-groups])
+
+Grants users and groups access to one or more modules. This is a wrapper
+around set_module_access.
+
+=cut
+sub enable_module_access
+{
+return &set_module_access($_[0], 1, $_[1]);
+}
+
+=head2 disable_module_access(&modules, [&users-groups])
+
+Revokes users and groups access to one or more modules. This is a wrapper
+around set_module_access.
+
+=cut
+sub disable_module_access
+{
+return &set_module_access($_[0], 0, $_[1]);
+}
+
 =head2 update_members(&allusers, &allgroups, &modules, &members)
 
 Update the modules for members users and groups of some group. The parameters
@@ -2368,4 +2510,3 @@ return $mailbox."\@".join(".", @doms);
 }
 
 1;
-

acl/lang/no

@@ -1,9 +1,9 @@
 index_title=Webmin Brukere
 index_user=Brukere
 index_modules=Moduler
-index_create=Opprett ny Webmin bruker
+index_create=Opprett ny Webmin-bruker
 index_screate=Opprett ny sikker bruker
-index_convert=Konverter Unix til Webmin brukere
+index_convert=Konverter Unix til Webmin-brukere
 index_cert=Krever SSL sertifikat
 index_twofactor=To-faktor autentisering
 index_certmsg=Klikk på denne knappen for å spørre etter et SSL sertifikat som vil gi deg sikker login i Webmin uten å måtte skrive brukernavn og passord.
@@ -14,7 +14,7 @@ index_global=Global ACL
 index_users=Webmin Brukere
 index_groups=Webmin Grupper
 index_group=Gruppe
-index_nousers=Ingen editerbar Webmin bruker er definert.
+index_nousers=Ingen editerbar Webmin-bruker er definert.
 index_nogroups=Ingen editerbar Webmin gruppe er definert.
 index_gcreate=Lag en ny Webmin gruppe
 index_members=Medlemmer
@@ -30,11 +30,11 @@ index_eglist=Kunne ikke liste grupper : $1
 
 edit_title=Rediger Webmin Bruker
 edit_title2=Lag Webmin Bruker
-edit_title3=Opprett sikker Webmin bruker
-edit_readonly=Denne Webmin brukeren bør ikke redigeres siden den vedlikeholdes av modulen $1. <a href='$2'>Klikk her</a> for å ignorere denne advarselen og redigere brukeren allikevel - men vær oppmerksom på at manuelle endringer kan bli overskrevet!
-edit_rights=Tilgangsrettigheter for Webmin bruker
+edit_title3=Opprett sikker Webmin-bruker
+edit_readonly=Denne Webmin-brukeren bør ikke redigeres siden den vedlikeholdes av modulen $1. <a href='$2'>Klikk her</a> for å ignorere denne advarselen og redigere brukeren allikevel - men vær oppmerksom på at manuelle endringer kan bli overskrevet!
+edit_rights=Tilgangsrettigheter for Webmin-bruker
 edit_user=Brukernavn
-edit_cloneof=Klober Webmin bruker
+edit_cloneof=Klober Webmin-bruker
 edit_real=Virkelig navn
 edit_group=Medlem av gruppe
 edit_pass=Passord
@@ -89,7 +89,7 @@ edit_selall=Velg alle
 edit_invert=Inverter valg
 edit_hide=Skjul ubrukte
 edit_switch=Bytt til bruker
-edit_return=Webmin bruker
+edit_return=Webmin-bruker
 edit_return2=Webmin gruppe
 edit_rbacdeny=RBAC tilgangsmodus
 edit_rbacdeny0=RBAC kontrollerer valgte modul ACLer
@@ -126,21 +126,21 @@ save_eoverlay=Et tema-overlegg kan ikke velges med mindre et tema er
 save_edeny=Du kan ikke nekte deg selv tilgang til Webmin Bruker modulen
 save_eos=Det samme som Unix passord opsjonen er ikke støttet på ditt operativsystem.
 save_emd5=Det samme som Unix passord opsjonen kan ikke brukes på systemer med MD5 kryptering
-save_eunix=Unix bruker '$1' eksisterer ikke
+save_eunix=Unix-brukeren '$1' eksisterer ikke
 save_emod=Du kan ikke bevilge tilgang til modul '$1'
 save_ecreate=Du har ikke tilgang til å opprette brukere
-save_euser=Du har ikke tilgang til å editere denne brukeren
+save_euser=Du har ikke tilgang til å redigere denne brukeren
 save_ecolon=Passord kan ikke inneholde : karakteren
 save_epass=Passord er ikke gyldig : $1
-save_eself=Din vanlige IP adresse ($1) vil bli nektet
+save_eself=Din vanlige IP-adresse ($1) vil bli nektet
 save_epam=PAM autentisering er ikke tilgjengelig fordi <tt>Authen::PAM</tt> Perl modulen ikke er installert eller ikke virker ordentlig.
 save_epam2=Du kan bruke Webmin's Perl Modules modul til <a href='$1'>laste ned å installere Authen::PAM</a> nå.
 save_egroup=Du har ikke rettigheter til å tildele til den gruppen
 save_enone=Ingen adresse er tastet inn
-save_enet='$1' er ikke en gyldig nettverks adresse
+save_enet='$1' er ikke en gyldig nettverksadresse
 save_emask='$1' er ikke en gyldig nettmaske
-save_eip='$1' er ikke en komplett IP eller nettverks adresse
-save_ehost=Kunne ikke finne IP adresse for '$1'
+save_eip='$1' er ikke en komplett IP eller nettverksadresse
+save_ehost=Kunne ikke finne IP-adresse for '$1'
 save_elogouttime=Manglende eller ikke-numerisk tid for utlogging ved inaktivitet
 save_eminsize=Manglende eller ikke-numerisk minimum passordlengde
 save_edays=Ingen tillatte dager valgt
@@ -223,11 +223,11 @@ acl_times=Kan endre tillatte innloggings-tider?
 acl_pass=Kan endre passord-begrensinger?
 acl_sql=Kan konfigurere databasen for brukere og grupper?
 
-log_modify=Modifisert Webmin bruker $1
-log_rename=Skiftet navn på Webmin bruker $1 til $2
-log_create=Opprettet Webmin bruker $1
-log_clone=Klonet Webmin bruker $1 til $2
-log_delete=Slettet Webmin bruker $1
+log_modify=Modifisert Webmin-bruker $1
+log_rename=Skiftet navn på Webmin-bruker $1 til $2
+log_create=Opprettet Webmin-bruker $1
+log_clone=Klonet Webmin-bruker $1 til $2
+log_delete=Slettet Webmin-bruker $1
 log_acl=Oppdatert tilgang for $1 i $2
 log_reset=Tilbakestilte tilgang for $1 i $2
 log_cert=Utlevert sertifikat for bruker $1
@@ -235,10 +235,10 @@ log_modify_g=Modifisert Webmin gruppe $1
 log_rename_g=Forandret navn på Webmin gruppe $1 til $2
 log_create_g=Opprettet Webmin gruppe $1
 log_delete_g=Slettet Webmin gruppe $1
-log_switch=Byttet til Webmin bruker $1
-log_delete_users=Slettet $1 Webmin brukere
+log_switch=Byttet til Webmin-bruker $1
+log_delete_users=Slettet $1 Webmin-brukere
 log_delete_groups=Slettet $1 Webmin grupper
-log_joingroup=La til $1 Webmin brukere i gruppe $2
+log_joingroup=La til $1 Webmin-brukere i gruppe $2
 log_pass=Endret passord-begrensinger
 log_unix=Endret unix bruker-autentisering
 log_sync=Endret unix bruker-synkronisering
@@ -273,7 +273,7 @@ gsave_edesc=Ugyldig beskrivelse - tegnet : er ikke tillatt
 convert_title=Konverter Brukere
 convert_ecannot=Du har ikke tilgang til å konvertere Unix brukere
 convert_nogroups=Ingen Webmin gruppe er definert på ditt system. Du må i det minste lage en gruppe før du konverterer brukere, dette for å kunne sette rettigheter for konverterte brukere.
-convert_desc=Denne Dette feltet lar deg konvertere eksisterende Unix brukere til Webmin brukere. Rettighetene til hver nye Webmin bruker vil bestemmes av rettighetene til gruppen som valgt over.
+convert_desc=Denne Dette feltet lar deg konvertere eksisterende Unix-brukere til Webmin-brukere. Rettighetene til hver nye Webmin-bruker vil bestemmes av rettighetene til gruppen som valgt over.
 convert_0=Alle brukere
 convert_1=Bare brukere
 convert_2=Alle unntagen brukere
@@ -284,43 +284,43 @@ convert_sync2=Synk. passord med Unix-bruker i fremtiden?
 convert_ok=Konverter nå
 convert_err=Kunne ikke konvertere brukere
 convert_eusers=Ingen brukere inntastet
-convert_egroup=Unix gruppe eksisterer ikke
-convert_emin=Ugyldig minimum bruker ID (UID)
-convert_emax=Ugyldig maksimum bruker ID (UID)
+convert_egroup=Unix-gruppen eksisterer ikke
+convert_emin=Ugyldig minimum bruker-ID (UID)
+convert_emax=Ugyldig maksimum bruker-ID (UID)
 convert_ewgroup=Ingen sånn Webmin gruppe
 convert_ewgroup2=Du har ikke rettigheter til å tilordne nye brukere til denne gruppen
 convert_skip=Hoppet over $1
 convert_exists=$1 Eksisterer allerede
-convert_invalid=$1 er ikke et gyldig Webmin brukernavn
+convert_invalid=$1 er ikke et gyldig Webmin-brukernavn
 convert_added=$1 er lagt til
-convert_msg=Konverterer Unix brukere...
+convert_msg=Konverterer Unix-brukere...
 convert_user=Unix-bruker
-convert_action=Handling utført
+convert_action=Handling utført
 convert_done=$1 brukere konvertert, $2 ugyldig, $3 finnes allerede, $4 ekskludert.
 convert_users=Brukere som skal konverteres
 
-sync_title=Unix Bruker Synkronisering
-sync_desc=Dette feltet lar deg konfigurere automatisk synkronisering av Unix brukere laget via Webmin og brukere i denne modulen.
+sync_title=Unix-brukersynkronisering
+sync_desc=Dette feltet lar deg konfigurere automatisk synkronisering av Unix-brukere laget via Webmin og brukere i denne modulen.
 sync_nogroups=Ingen Webmin gruppe er definert på ditt system. Du må i det minste lage en gruppe før du konverterer brukere, dette for å kunne sette rettigheter for konverterte brukere.
 sync_when=Synkroniser når
-sync_create=Opprett Webmin bruker når en Unix bruker blir laget.
-sync_update=Oppdater passende Webmin bruker når Unix brukere blir oppdatert.
-sync_delete=Slett passende Webmin bruker når Unix brukere blir slettet.
+sync_create=Opprett Webmin-bruker når en Unix bruker blir laget.
+sync_update=Oppdater passende Webmin-bruker når Unix-brukere blir oppdatert.
+sync_delete=Slett passende Webmin-bruker når Unix-brukere blir slettet.
 sync_group=Tilordne ny bruker til Webmin gruppe
 sync_unix=Sett passord for nye brukere til Unix autentisering
 sync_ecannot=Du har ikke rettigheter til å konfigurere bruker synkronisering.
 
-unix_title=Unix Bruker Autentisering
+unix_title=Unix-brukerautentisering
 unix_err=Kunne ikke lagre Unix autentisering
-unix_desc=Denne siden lar deg konfigurere Webmin til verifisere login forsøk med systemets bruker liste og PAM. Dette kan være nyttig hvis du har mange eksisterende Unix brukere som du ønsker å gi tilgang til Webmin.
-unix_def=Tillat bare login av Webmin brukere
-unix_sel=Tillat Unix brukere i listen nedenfor å logge inn ..
+unix_desc=Denne siden lar deg konfigurere Webmin til verifisere login forsøk med systemets bruker liste og PAM. Dette kan være nyttig hvis du har mange eksisterende Unix-brukere som du ønsker å gi tilgang til Webmin.
+unix_def=Tillat bare login av Webmin-brukere
+unix_sel=Tillat Unix-brukere i listen nedenfor å logge inn ..
 unix_mode=Tillat
 unix_mall=Alle brukere
 unix_group=Medlemmer i gruppen..
-unix_user=Tillat alle Unix brukere login med rettigheter som Users
+unix_user=Tillat alle Unix-brukere login med rettigheter som Users
 unix_who=Bruker eller gruppe
-unix_to=Som Webmin bruker
+unix_to=Som Webmin-bruker
 unix_ecannot=Du har ikke rettigheter til å konfigurere Unix bruker autentisering
 unix_epam=Unix autentisering er ikke tilgjengelig fordi <tt>Authen::PAM</tt> Perl modul ikke er installert eller ikke virker som den skal.
 unix_all=Tillat alle Unix brukere
@@ -329,12 +329,12 @@ unix_deny=Nekt listede Unix brukere
 unix_none=Ingen brukere angitt
 unix_euser='$1' er ikke et gyldig brukernavn
 unix_egroup='$1' er ikke et gyldig gruppenavn
-unix_shells=Nekt Unix brukere hvis skall ikke finnes i filen
+unix_shells=Nekt Unix-brukere hvis skall ikke finnes i filen
 unix_eshells=Manglende eller ikke-eksisterende shells fil
 unix_restrict2=Ekstra restriksjoner
 unix_ewhogroup=Manglende tillatt gruppe i rad $1
 unix_ewhouser=Manglende tilllatt bruker i rad $1
-unix_enone=Ingen tillatte Unix brukere og grupper ble angitt
+unix_enone=Ingen tillatte Unix-brukere og grupper ble angitt
 unix_same=&lt;Samme bruker eller gruppe&gt;
 unix_sudo=TIllatt brukere som kan kjøre alle kommandoer via <tt>sudo</tt> å logge inn som <tt>root</tt>
 unix_pamany=Behandle brukere som bare sender PAM validering som $1
@@ -345,9 +345,9 @@ unix_utable=Tillatte Unix brukere
 
 sessions_title=Aktuell Login Session
 sessions_id=Sessions ID
-sessions_user=Webmin bruker
+sessions_user=Webmin-bruker
 sessions_login=Innlogget
-sessions_host=IP adresse
+sessions_host=IP-adresse
 sessions_lview=Se logger..
 sessions_actions=Handlinger..
 sessions_logouts=Vis også utloggede sesjoner..
@@ -357,7 +357,7 @@ sessions_in=Innlogget
 sessions_out=Logget ut
 sessions_kill=Koble fra..
 
-logins_title=Siste Webmin innlogginger
+logins_title=Siste Webmin-innlogginger
 
 hide_title=Skjul ubrukte moduler
 hide_desc=Følgende moduler vil bli fjernet fra modul tilgangslisten for $1 siden deres tilhørende tjenere ikke er installert på systemet ditt ..
@@ -374,7 +374,7 @@ rbac_desc=Webmin's RBAC integration provides a way for user module and ACL permi
 rbac_esolaris=RBAC støttes bare på Solaris systemer for øyeblikket, og kan derfor ikke brukes på dette $1 systemet.
 rbac_eperl=Perl-modulen $1, som behøves for RBAC integrasjon, er ikke installert. <a href='$2'>Klikk her</a> for å installere den nå.
 rbac_ecpan=Du har ikke tilgang til Webmins Perl Moduler side for å kunne installere den nødvendige $1 modulen for RBAC integrasjon.
-rbac_ok=RBAC integrasjon er tilgjengelig for dette systemet, og kan aktiveres per bruker på siden Rediger Webmin bruker.
+rbac_ok=RBAC integrasjon er tilgjengelig for dette systemet, og kan aktiveres per bruker på siden Rediger Webmin-bruker.
 
 udeletes_err=Kunne ikke slette brukere
 udeletes_jerr=Kunne ikke legg til brukere i gruppe
@@ -391,7 +391,7 @@ gdeletes_rusure=Er du sikker på at du ønsker å slette de $1 valgte gruppene o
 gdeletes_users=Valgte grupper: $1
 gdeletes_ok=Slett grupper
 
-pass_title=Passord begrensinger
+pass_title=Passordbegrensinger
 pass_ecannot=Du har ikke lov til å redigere passord-begrensinger
 pass_header=Innstillinger for Webmin passord begrensinger
 pass_minsize=Minimum passordlengde
@@ -424,7 +424,7 @@ cpass_old=Gamle passord kan ikke brukes på nytt
 
 sql_title=Bruker- og gruppe-database
 sql_ecannot=Du har ikke lov til å konfigurere bruker- og gruppedatabasen
-sql_header=Instillinger for database backend for brukere og grupper
+sql_header=Innstillinger for database backend for brukere og grupper
 sql_host=Vertsnavn
 sql_user=Brukernavn
 sql_pass=Passord
@@ -456,7 +456,7 @@ sql_edb=Ugyldig databasenavn (mellomrom ikke tillatt)
 sql_eprefix=Manglende eller ugyldig base DN (mellomrom ikke tillatt)
 sql_eprefix2=Ugyldig-utseende base DN - skal være på formen <tt>dc=mittdomene,dc=no</tt>
 sql_title2=Opprett manglende tabeller
-sql_tableerr=Instillinger for bruker- og gruppedatabase er gyldig, men noen tabeller som Webmin trenger, mangler : $1
+sql_tableerr=Innstillinger for bruker- og gruppedatabase er gyldig, men noen tabeller som Webmin trenger, mangler : $1
 sql_tableerr2=Klikk på knappen <b>Opprett tabeller</b> nedenfor, for å få opprettet dem automatisk, eller du kan kjøre SQL uttrykket nedenfor manuelt.
 sql_make=Opprett tabeller
 sql_title3=Opprett manglende DN
@@ -489,7 +489,7 @@ twofactor_title=To-faktor autentisering
 twofactor_disable=Deaktiver to-faktor autentisering
 twofactor_already=Din Webmin-bruker har allerede to-faktor autentisering aktivert med leverandør %1 og konto ID %2.
 twofactor_already2=Webmin-brukeren %3 har allerede to-faktor autentisering aktivert med leverandør %1 og konto ID %2.
-twofactor_desc=Denne siden lar deg aktivere to-faktor autentisering for din Webmin bruker vha. <a href='$2' target=_blank>$1</a>. Når denne er aktivert kreves det et ekstra autentiserings-token når du logger inn på Webmin.
+twofactor_desc=Denne siden lar deg aktivere to-faktor autentisering for din Webmin-bruker vha. <a href='$2' target=_blank>$1</a>. Når denne er aktivert kreves det et ekstra autentiserings-token når du logger inn på Webmin.
 twofactor_desc2=Denne siden lar deg aktivere to-faktor autentisering for Webmin-brukeren $1 vha. <a href='$2' target=_blank>$1</a>. Når denne er aktivert vil det kreves et ekstra autentiserings-token for å logge inn på Webmin.
 twofactor_enable=Meld inn til to-faktor autentisering
 twofactor_header=Detaljer for innmelding til to-faktor autentisering

acl/t/run-tests.t

@@ -701,6 +701,152 @@ is(group_line({ name => 'empty' }),
               'delete_group removes the only group');
 }
 
+# set_module_access and wrappers: batch enable/disable module visibility for
+# users and groups, while keeping ownmods in sync for future group refreshes.
+{
+    _reset_fixture();
+    create_user({ name => 'alice',
+                  pass => 'x',
+                  modules => [ 'useradmin', 'apache' ],
+                  ownmods => [ 'apache' ] });
+    create_group({ name => 'wheel',
+                   members => [ 'alice' ],
+                   modules => [ 'useradmin', 'apache' ],
+                   desc => 'Sysadmins',
+                   ownmods => [ 'apache' ] });
+    _clear_caches();
+
+    is(disable_module_access([ 'apache' ]), 2,
+       'disable_module_access without targets updates all users and groups');
+
+    my $alice = get_user('alice');
+    my $wheel = get_group('wheel');
+    is_deeply($alice->{'modules'}, [ 'useradmin' ],
+              'global disable removes module from user modules');
+    is_deeply($alice->{'ownmods'}, [],
+              'global disable removes module from user ownmods');
+    is_deeply($wheel->{'modules'}, [ 'useradmin' ],
+              'global disable removes module from group modules');
+    is_deeply($wheel->{'ownmods'}, [],
+              'global disable removes module from group ownmods');
+}
+
+{
+    _reset_fixture();
+    create_user({ name => 'alice',
+                  pass => 'x',
+                  modules => [ 'useradmin' ] });
+    create_group({ name => 'wheel',
+                   members => [ 'alice' ],
+                   modules => [ 'useradmin' ],
+                   desc => 'Sysadmins' });
+    _clear_caches();
+
+    is(enable_module_access([ 'apache' ], [ '@wheel' ]), 1,
+       'enable_module_access can target one group by @name');
+
+    my $alice = get_user('alice');
+    my $wheel = get_group('wheel');
+    is_deeply($wheel->{'modules'}, [ 'useradmin', 'apache' ],
+              'targeted group enable adds module to group modules');
+    is_deeply($wheel->{'ownmods'}, [],
+              'targeted group enable leaves top-level group ownmods unchanged');
+    is_deeply($alice->{'modules'}, [ 'useradmin', 'apache' ],
+              'targeted group enable propagates to member user modules');
+    is_deeply($alice->{'ownmods'}, [],
+              'targeted group enable leaves member user ownmods unchanged');
+
+    is(disable_module_access([ 'apache' ], [ '@wheel' ]), 1,
+       'disable_module_access can target one group by @name');
+
+    $alice = get_user('alice');
+    $wheel = get_group('wheel');
+    is_deeply($wheel->{'modules'}, [ 'useradmin' ],
+              'targeted group disable removes module from group modules');
+    is_deeply($wheel->{'ownmods'}, [],
+              'targeted group disable removes module from group ownmods');
+    is_deeply($alice->{'modules'}, [ 'useradmin' ],
+              'targeted group disable propagates to member user modules');
+}
+
+{
+    _reset_fixture();
+    create_user({ name => 'carol',
+                  pass => 'x',
+                  modules => [ 'useradmin' ] });
+    create_group({ name => 'child',
+                   members => [ 'carol' ],
+                   modules => [ 'useradmin' ],
+                   desc => 'Child group' });
+    create_group({ name => 'parent',
+                   members => [ '@child' ],
+                   modules => [ 'useradmin' ],
+                   desc => 'Parent group' });
+    _clear_caches();
+
+    is(enable_module_access([ 'apache' ]), 1,
+       'enable_module_access handles all nested groups');
+
+    my $child = get_group('child');
+    my $carol = get_user('carol');
+    is_deeply($child->{'modules'}, [ 'useradmin', 'apache' ],
+              'child group inherits module from parent enabled later in file');
+    is_deeply($child->{'ownmods'}, [],
+              'child group does not record inherited module as ownmod');
+    is_deeply($carol->{'modules'}, [ 'useradmin', 'apache' ],
+              'child group member inherits module through nested groups');
+    is_deeply($carol->{'ownmods'}, [],
+              'child group member does not record inherited module as ownmod');
+}
+
+{
+    _reset_fixture();
+    create_user({ name => 'root',
+                  pass => 'x',
+                  modules => [ 'useradmin' ] });
+    _clear_caches();
+
+    is(enable_module_access([ 'apache' ], [ 'root' ]), 1,
+       'enable_module_access can target a standalone user');
+    my $root = get_user('root');
+    is_deeply($root->{'modules'}, [ 'useradmin', 'apache' ],
+              'standalone user enable adds module to user modules');
+    is_deeply($root->{'ownmods'}, [],
+              'standalone user enable does not create ownmods');
+}
+
+{
+    _reset_fixture();
+    create_user({ name => 'bob',
+                  pass => 'x',
+                  modules => [ 'useradmin' ] });
+    create_group({ name => 'wheel',
+                   members => [ 'bob' ],
+                   modules => [ 'useradmin' ],
+                   desc => 'Sysadmins' });
+    _clear_caches();
+
+    is(enable_module_access([ 'apache' ], [ 'bob' ]), 1,
+       'enable_module_access can target one user by name');
+
+    my $bob = get_user('bob');
+    is_deeply($bob->{'modules'}, [ 'useradmin', 'apache' ],
+              'targeted user enable adds module to user modules');
+    is_deeply($bob->{'ownmods'}, [ 'apache' ],
+              'targeted user enable records explicit user ownmod');
+
+    # A later group refresh must not erase a directly granted user module.
+    my @users = list_users();
+    my @groups = list_groups();
+    my ($wheel) = grep { $_->{'name'} eq 'wheel' } @groups;
+    update_members(\@users, \@groups, $wheel->{'modules'},
+                   $wheel->{'members'});
+    _clear_caches();
+    $bob = get_user('bob');
+    is_deeply($bob->{'modules'}, [ 'useradmin', 'apache' ],
+              'targeted user enable survives later group refresh');
+}
+
 # copy_acl_files (file mode): copy a module ACL file from one name to another.
 {
     _reset_fixture();

apache/core.pl

@@ -109,7 +109,7 @@ return ();
 sub edit_MaxClients
 {
 return (1,
-	$text{'core_maxconc'},
+	&hlink($text{'core_maxconc'}, "MaxClients"),
 	&opt_input($_[0]->{'value'}, "MaxClients", $text{'core_default'}, 4));
 }
 sub save_MaxClients
@@ -118,6 +118,19 @@ return &parse_opt("MaxClients", '^\d+$',
 		  $text{'core_emaxconc'});
 }
 
+sub edit_MaxRequestWorkers
+{
+return (1,
+	&hlink($text{'core_maxconc'}, "MaxRequestWorkers"),
+	&opt_input($_[0]->{'value'}, "MaxRequestWorkers",
+		   $text{'core_default'}, 4));
+}
+sub save_MaxRequestWorkers
+{
+return &parse_opt("MaxRequestWorkers", '^\d+$',
+		  $text{'core_emaxconc'});
+}
+
 sub edit_MaxKeepAliveRequests
 {
 return (1,
@@ -133,7 +146,7 @@ return &parse_opt("MaxKeepAliveRequests", '^\d+$',
 sub edit_MaxRequestsPerChild
 {
 return (1,
-	$text{'core_maxreq'},
+	&hlink($text{'core_maxreq'}, "MaxRequestsPerChild"),
 	&opt_input($_[0]->{'value'}, "MaxRequestsPerChild", $text{'core_default'}, 5));
 }
 sub save_MaxRequestsPerChild
@@ -145,7 +158,7 @@ return &parse_opt("MaxRequestsPerChild", '^\d+$',
 sub edit_MinSpareServers
 {
 return (1,
-	$text{'core_minspare'},
+	&hlink($text{'core_minspare'}, "MinSpareServers"),
 	&opt_input($_[0]->{'value'},"MinSpareServers",$text{'core_default'}, 4));
 }
 sub save_MinSpareServers
@@ -157,7 +170,7 @@ return &parse_opt("MinSpareServers", '^\d+$',
 sub edit_MaxSpareServers
 {
 return (1,
-	$text{'core_maxspare'},
+	&hlink($text{'core_maxspare'}, "MaxSpareServers"),
 	&opt_input($_[0]->{'value'},"MaxSpareServers",$text{'core_default'}, 4));
 }
 sub save_MaxSpareServers
@@ -169,7 +182,7 @@ return &parse_opt("MaxSpareServers", '^\d+$',
 sub edit_StartServers
 {
 return (1,
-	$text{'core_initial'},
+	&hlink($text{'core_initial'}, "StartServers"),
 	&opt_input($_[0]->{'value'}, "StartServers", $text{'core_default'}, 4));
 }
 sub save_StartServers
@@ -178,9 +191,70 @@ return &parse_opt("StartServers", '^\d+$',
 		  $text{'core_einitial'});
 }
 
+sub edit_ServerLimit
+{
+return (1,
+	&hlink($text{'core_serverlimit'}, "ServerLimit"),
+	&opt_input($_[0]->{'value'}, "ServerLimit", $text{'core_default'}, 4));
+}
+sub save_ServerLimit
+{
+return &parse_opt("ServerLimit", '^\d+$',
+		  $text{'core_eserverlimit'});
+}
+
+sub edit_MinSpareThreads
+{
+return (1,
+	&hlink($text{'worker_minspare'}, "MinSpareThreads"),
+	&opt_input($_[0]->{'value'},"MinSpareThreads",$text{'core_default'}, 4));
+}
+sub save_MinSpareThreads
+{
+return &parse_opt("MinSpareThreads", '^\d+$',
+		  $text{'worker_eminspare'});
+}
+
+sub edit_MaxSpareThreads
+{
+return (1,
+	&hlink($text{'worker_maxspare'}, "MaxSpareThreads"),
+	&opt_input($_[0]->{'value'},"MaxSpareThreads",$text{'core_default'}, 4));
+}
+sub save_MaxSpareThreads
+{
+return &parse_opt("MaxSpareThreads", '^\d+$',
+		  $text{'worker_emaxspare'});
+}
+
+sub edit_ThreadLimit
+{
+return (1,
+	&hlink($text{'worker_threadlimit'}, "ThreadLimit"),
+	&opt_input($_[0]->{'value'},"ThreadLimit",$text{'core_default'}, 4));
+}
+sub save_ThreadLimit
+{
+return &parse_opt("ThreadLimit", '^\d+$',
+		  $text{'worker_ethreadlimit'});
+}
+
+sub edit_ThreadsPerChild
+{
+return (1,
+	&hlink($text{'worker_threads'}, "ThreadsPerChild"),
+	&opt_input($_[0]->{'value'},"ThreadsPerChild",$text{'core_default'}, 4));
+}
+sub save_ThreadsPerChild
+{
+return &parse_opt("ThreadsPerChild", '^\d+$',
+		  $text{'worker_ethreads'});
+}
+
 sub edit_RLimitCPU
 {
-return &rlimit_input("RLimitCPU", $text{'core_cpulimit'}, $_[0]);
+return &rlimit_input("RLimitCPU",
+		     &hlink($text{'core_cpulimit'}, "RLimitCPU"), $_[0]);
 }
 sub save_RLimitCPU
 {
@@ -189,7 +263,8 @@ return &parse_rlimit("RLimitCPU", $text{'core_cpulimit2'});
 
 sub edit_RLimitMEM
 {
-return &rlimit_input("RLimitMEM", $text{'core_memlimit'}, $_[0]);
+return &rlimit_input("RLimitMEM",
+		     &hlink($text{'core_memlimit'}, "RLimitMEM"), $_[0]);
 }
 sub save_RLimitMEM
 {
@@ -198,7 +273,8 @@ return &parse_rlimit("RLimitMEM", $text{'core_memlimit2'});
 
 sub edit_RLimitNPROC
 {
-return &rlimit_input("RLimitNPROC", $text{'core_proclimit'}, $_[0]);
+return &rlimit_input("RLimitNPROC",
+		     &hlink($text{'core_proclimit'}, "RLimitNPROC"), $_[0]);
 }
 sub save_RLimitNPROC
 {
@@ -1280,7 +1356,7 @@ return &parse_opt("LockFile", '^\S+', $text{'core_elock'});
 
 sub edit_LimitRequestBody
 {
-return (1, $text{'core_maxbody'},
+return (1, &hlink($text{'core_maxbody'}, "LimitRequestBody"),
 	&opt_input($_[0]->{'value'}, "LimitRequestBody", $text{'core_default'}, 8)
 		.&ui_space(2).$text{'bytes'});
 }
@@ -1291,7 +1367,7 @@ return &parse_opt("LimitRequestBody", '^\d+$', $text{'core_ebody'});
 
 sub edit_LimitXMLRequestBody
 {
-return (1, $text{'core_maxxml'},
+return (1, &hlink($text{'core_maxxml'}, "LimitXMLRequestBody"),
 	&opt_input($_[0]->{'value'}, "LimitXMLRequestBody",
 		   $text{'core_default'}, 8).&ui_space(2).$text{'bytes'});
 }
@@ -1304,7 +1380,7 @@ return &parse_opt("LimitXMLRequestBody", '^\d+$', $text{'core_exml'});
 
 sub edit_LimitRequestFields
 {
-return (1, $text{'core_maxhead'},
+return (1, &hlink($text{'core_maxhead'}, "LimitRequestFields"),
 	&opt_input($_[0]->{'value'}, "LimitRequestFields", $text{'core_default'}, 6));
 }
 sub save_LimitRequestFields
@@ -1314,7 +1390,7 @@ return &parse_opt("LimitRequestFields", '^\d+$', $text{'core_ehead'});
 
 sub edit_LimitRequestFieldsize
 {
-return (1, $text{'core_maxshead'},
+return (1, &hlink($text{'core_maxshead'}, "LimitRequestFieldsize"),
 	&opt_input($_[0]->{'value'}, "LimitRequestFieldsize", $text{'core_default'}, 6));
 }
 sub save_LimitRequestFieldsize
@@ -1324,7 +1400,7 @@ return &parse_opt("LimitRequestFieldsize", '^\d+$', $text{'core_eshead'});
 
 sub edit_LimitRequestLine
 {
-return (1, $text{'core_maxline'},
+return (1, &hlink($text{'core_maxline'}, "LimitRequestLine"),
 	&opt_input($_[0]->{'value'}, "LimitRequestLine", $text{'core_default'}, 6));
 }
 sub save_LimitRequestLine
@@ -1631,4 +1707,3 @@ else { return ( [ ], [ ] ); }
 }
 
 1;
-

apache/help/AssignUserId.html

@@ -0,0 +1,7 @@
+<header>Tie virtual to child process</header>
+The <tt>AssignUserId</tt> directive assigns a virtual host to a child process
+running with the selected user ID and group ID for the legacy perchild MPM.
+<p>
+This directive is only available for Apache versions and MPMs that support
+perchild.
+<p><footer>

apache/help/ChildPerUserId.html

@@ -0,0 +1,7 @@
+<header>Child process UID assignments</header>
+The <tt>ChildPerUserId</tt> directive defines how many child processes should
+run for a selected user ID and group ID in the legacy perchild MPM.
+<p>
+This directive is only available for Apache versions and MPMs that support
+perchild.
+<p><footer>

apache/help/LimitRequestBody.html

@@ -0,0 +1,7 @@
+<header>Maximum request body size</header>
+The <tt>LimitRequestBody</tt> directive sets the maximum allowed size of an HTTP
+request body in bytes.
+<p>
+This can be used to limit upload or form submission size for the server,
+virtual host, directory, or location where the directive is applied.
+<p><footer>

apache/help/LimitRequestFields.html

@@ -0,0 +1,7 @@
+<header>Maximum headers in request</header>
+The <tt>LimitRequestFields</tt> directive sets the maximum number of HTTP
+request header fields that Apache will accept.
+<p>
+Lowering this limit can reduce exposure to unusually large requests, but values
+that are too low can reject legitimate clients.
+<p><footer>

apache/help/LimitRequestFieldsize.html

@@ -0,0 +1,7 @@
+<header>Maximum request header size</header>
+The <tt>LimitRequestFieldSize</tt> directive sets the maximum size of each HTTP
+request header field in bytes.
+<p>
+Lowering this limit can reject oversized request headers, but values that are
+too low can break clients that send larger cookies or authorization headers.
+<p><footer>

apache/help/LimitRequestLine.html

@@ -0,0 +1,7 @@
+<header>Maximum request line size</header>
+The <tt>LimitRequestLine</tt> directive sets the maximum size of the HTTP
+request line in bytes.
+<p>
+This line contains the method, requested URI, and HTTP protocol version. Values
+that are too low can reject legitimate long URLs.
+<p><footer>

apache/help/LimitXMLRequestBody.html

@@ -0,0 +1,6 @@
+<header>Maximum XML request body size</header>
+The <tt>LimitXMLRequestBody</tt> directive sets the maximum allowed size of an
+XML request body in bytes.
+<p>
+It is mainly used by modules that parse XML request bodies, such as WebDAV.
+<p><footer>

apache/help/MaxClients.html

@@ -0,0 +1,8 @@
+<header>Maximum simultaneous requests</header>
+The <tt>MaxClients</tt> directive is the old Apache name for the maximum number
+of requests that can be served at the same time. On Apache 2.4 and newer, the
+equivalent directive is <tt>MaxRequestWorkers</tt>.
+<p>
+For prefork MPM, this limits child server processes. For threaded MPMs, it
+limits the total number of worker threads across all child processes.
+<p><footer>

apache/help/MaxRequestWorkers.html

@@ -0,0 +1,9 @@
+<header>Maximum simultaneous requests</header>
+The <tt>MaxRequestWorkers</tt> directive sets the maximum number of requests
+that Apache can serve at the same time. Requests above this limit wait until an
+existing worker is free.
+<p>
+For prefork MPM, this limits child server processes. For threaded MPMs, it
+limits the total number of worker threads across all child processes. Raising
+this value may also require increasing <tt>ServerLimit</tt>.
+<p><footer>

apache/help/MaxRequestsPerChild.html

@@ -0,0 +1,8 @@
+<header>Maximum requests per child process</header>
+The <tt>MaxRequestsPerChild</tt> directive sets how many requests an Apache
+child process will handle before it exits and is replaced. A value of
+<tt>0</tt> means the process is not recycled because of this limit.
+<p>
+Recycling can help contain memory growth in long-running processes, but setting
+this too low can create unnecessary process churn.
+<p><footer>

apache/help/MaxSpareServers.html

@@ -0,0 +1,8 @@
+<header>Maximum idle server processes</header>
+The <tt>MaxSpareServers</tt> directive sets the maximum number of idle child
+server processes Apache tries to keep when using prefork-style process
+handling.
+<p>
+If more idle child processes are available, Apache stops some of them to avoid
+keeping unnecessary processes running.
+<p><footer>

apache/help/MaxSpareThreads.html

@@ -0,0 +1,7 @@
+<header>Maximum idle worker threads</header>
+The <tt>MaxSpareThreads</tt> directive sets the maximum number of idle worker
+threads Apache tries to keep when using a threaded MPM such as worker or event.
+<p>
+If more idle threads are available, Apache can reduce the number of running
+workers instead of keeping excess capacity open.
+<p><footer>

apache/help/MaxThreadsPerChild.html

@@ -0,0 +1,6 @@
+<header>Maximum threads per child process</header>
+The <tt>MaxThreadsPerChild</tt> directive sets the maximum number of worker
+threads allowed in each child process for the legacy perchild MPM.
+<p>
+This directive only appears for Apache versions and MPMs that support perchild.
+<p><footer>

apache/help/MinSpareServers.html

@@ -0,0 +1,8 @@
+<header>Minimum idle server processes</header>
+The <tt>MinSpareServers</tt> directive sets the minimum number of idle child
+server processes Apache tries to keep ready when using prefork-style process
+handling.
+<p>
+If fewer idle child processes are available, Apache starts more so new
+connections can be accepted without waiting for a process to be created.
+<p><footer>

apache/help/MinSpareThreads.html

@@ -0,0 +1,8 @@
+<header>Minimum idle worker threads</header>
+The <tt>MinSpareThreads</tt> directive sets the minimum number of idle worker
+threads Apache tries to keep ready when using a threaded MPM such as worker or
+event.
+<p>
+If fewer idle threads are available, Apache starts or adjusts child processes
+so new connections can be accepted without waiting for threads to become free.
+<p><footer>

apache/help/NumServers.html

@@ -0,0 +1,6 @@
+<header>Number of child processes</header>
+The <tt>NumServers</tt> directive sets the number of child server processes for
+the legacy perchild MPM.
+<p>
+This directive only appears for Apache versions and MPMs that support perchild.
+<p><footer>

apache/help/RLimitCPU.html

@@ -0,0 +1,8 @@
+<header>CPU resource limit</header>
+The <tt>RLimitCPU</tt> directive sets a CPU time resource limit for processes
+started by Apache in this context, such as CGI programs where supported by the
+operating system.
+<p>
+The soft limit is applied first. If a hard limit is also set, it is the maximum
+value that the process can raise the soft limit to.
+<p><footer>

apache/help/RLimitMEM.html

@@ -0,0 +1,8 @@
+<header>Memory resource limit</header>
+The <tt>RLimitMEM</tt> directive sets a memory resource limit for processes
+started by Apache in this context, such as CGI programs where supported by the
+operating system.
+<p>
+The soft limit is applied first. If a hard limit is also set, it is the maximum
+value that the process can raise the soft limit to.
+<p><footer>

apache/help/RLimitNPROC.html

@@ -0,0 +1,8 @@
+<header>Process limit</header>
+The <tt>RLimitNPROC</tt> directive sets a process count resource limit for
+processes started by Apache in this context, such as CGI programs where
+supported by the operating system.
+<p>
+The soft limit is applied first. If a hard limit is also set, it is the maximum
+value that the process can raise the soft limit to.
+<p><footer>

apache/help/ServerLimit.html

@@ -0,0 +1,9 @@
+<header>Server process limit</header>
+The <tt>ServerLimit</tt> directive sets the hard upper limit on the number of
+Apache child server processes. It caps values such as
+<tt>MaxRequestWorkers</tt> for prefork MPM, and works with
+<tt>ThreadsPerChild</tt> for threaded MPMs.
+<p>
+Increasing this value may require a full Apache stop and start before it takes
+effect.
+<p><footer>

apache/help/StartServers.html

@@ -0,0 +1,7 @@
+<header>Server processes at startup</header>
+The <tt>StartServers</tt> directive sets how many child server processes Apache
+starts when the server first launches.
+<p>
+Apache adjusts the number of child processes after startup based on traffic and
+the spare process or spare thread limits.
+<p><footer>

apache/help/StartThreads.html

@@ -0,0 +1,7 @@
+<header>Initial threads per child process</header>
+The <tt>StartThreads</tt> directive sets how many worker threads are created at
+startup for legacy threaded MPMs that support this directive.
+<p>
+Apache may adjust the number of running workers after startup based on traffic
+and the configured spare thread limits.
+<p><footer>

apache/help/ThreadLimit.html

@@ -0,0 +1,7 @@
+<header>Thread limit per child process</header>
+The <tt>ThreadLimit</tt> directive sets the hard upper limit for the number of
+worker threads that can be configured in each child process.
+<p>
+It must be high enough for <tt>ThreadsPerChild</tt>. Increasing this value may
+require a full Apache stop and start before it takes effect.
+<p><footer>

apache/help/ThreadsPerChild.html

@@ -0,0 +1,7 @@
+<header>Worker threads per child process</header>
+The <tt>ThreadsPerChild</tt> directive sets how many worker threads Apache
+creates in each child process when using a threaded MPM.
+<p>
+The total request capacity for threaded MPMs is controlled by this value
+together with <tt>ServerLimit</tt> and <tt>MaxRequestWorkers</tt>.
+<p><footer>

apache/lang/en

@@ -346,13 +346,15 @@ core_maxkeep=Maximum keepalives per connection
 core_maxreq=Maximum requests per server process
 core_minspare=Minimum spare server processes
 core_maxspare=Maximum spare server processes
-core_initial=Initial server processes
+core_initial=Server processes at startup
+core_serverlimit=Server process limit
 core_emaxconc=Maximum concurrent requests must be an integer
 core_emaxkeep=Maximum keepalives per connection must be an integer
 core_emaxreq=Maximum requests per server process must be an integer
 core_eminspare=Minimum spare server processes must be an integer
 core_emaxspare=Maximum spare server processes must be an integer
-core_einitial=Initial server processes must be an integer
+core_einitial=Server processes at startup must be an integer
+core_eserverlimit=Server process limit must be an integer
 core_default=Default
 core_cpulimit=CPU resource limit
 core_memlimit=Memory resource limit
@@ -1064,6 +1066,8 @@ worker_eminspare=Minimum spare threads must be an integer
 worker_emaxspare=Maximum spare threads must be an integer
 worker_threads=Threads per child process
 worker_ethreads=Number of threads per child process must be an integer
+worker_threadlimit=Thread limit per child process
+worker_ethreadlimit=Thread limit per child process must be an integer
 
 perchild_sthreads=Initial threads per child process
 perchild_esthreads=Number of threads per child process must be an integer

apache/lang/no

@@ -32,8 +32,8 @@ index_addr=Adresse
 index_nv=Legg til adresse for navnebasert virtuell server (hvis nødvendig)
 index_listen=Lytt på adresse (hvis nødvendig)
 index_port=Port
-index_name=Tjener Navn
-index_root=Dokument Rot
+index_name=Tjenernavn
+index_root=Dokumentrot
 index_url=URL
 index_view=Åpne..
 index_adddir=Gi tilgang til denne katalogen
@@ -243,8 +243,8 @@ htfile_header2=$1 for $2
 reconfig_title=Rekonfigurer kjente moduler
 reconfig_ecannot=Du har ikke lov til å rekonfigurere apache
 reconfig_ever=Kunne ikke hente versjonsnummer på Apache server programmet $1. Sjekk din <a href='$2'>modul konfigurasjon</a> for å forsikre deg om at dette er riktig sti.
-reconfig_desc1=Din Apache konfigurasjon er endret, eller har ikke blit undersøkt av Webmin enda. Nedenfor finner du en liste over alle Apache moduler som støttes av Webmin, med de installerte modulene avmerket. Du kan velge eller velge bort moduler dersom listen ikke er korrekt.
-reconfig_desc2=Nedenfor finner du en liste over alle Apache moduler som støttes av Webmin, med de installerte modulene avmerket. Dersom du benytter dynamisk lastede moduler kan det være nødvendig å velge de modulene som er dynamisk lastet.
+reconfig_desc1=Din Apache konfigurasjon er endret, eller har ikke blit undersøkt av Webmin enda. Nedenfor finner du en liste over alle Apache-moduler som støttes av Webmin, med de installerte modulene avmerket. Du kan velge eller velge bort moduler dersom listen ikke er korrekt.
+reconfig_desc2=Nedenfor finner du en liste over alle Apache-moduler som støttes av Webmin, med de installerte modulene avmerket. Dersom du benytter dynamisk lastede moduler kan det være nødvendig å velge de modulene som er dynamisk lastet.
 reconfig_desc3=Dersom du er usikker på hvilke moduler som støttes av Apache på ditt system, kan du klikke Konfigurer, siden Webmin normalt autmatisk vil kunne finne ut hvilke moduler som er støttet.
 reconfig_ok=Konfigurer
 
@@ -272,9 +272,9 @@ authu_euser=Ikke noe brukernavn oppgitt
 authu_euser2=Brukernavn kan ikke inneholde en :
 authu_edup=En bruker ved navn '$1' finnes allerede
 authu_sync=Innstillingene nedenfor lar deg konfigurerer Webmin til å automatisk legge til, oppdatere eller slette en bruker fra denne passordfilen når en bruker er lagt til, endret eller fjernet i modulen <tt>Brukere og grupper</tt>.
-authu_screate=Legg til en bruker når en Unix bruker blir lagt til
-authu_sdelete=Slett brukeren når en Unix bruker slettes
-authu_smodify=Endre brukeren når en Unix bruker endres
+authu_screate=Legg til en bruker når en Unix-bruker blir lagt til
+authu_sdelete=Slett brukeren når en Unix-bruker slettes
+authu_smodify=Endre brukeren når en Unix-bruker endres
 
 authg_ecannot='$1' er ikke en tillatt grupper tekstfil
 authg_title=Gruppeliste
@@ -465,8 +465,8 @@ core_group=Gruppenavn
 core_gid=Gruppe ID
 core_user=Brukernavn
 core_uid=Bruker ID
-core_asgroup=Kjør som Unix gruppe
-core_asuser=Kjør som Unix bruker
+core_asgroup=Kjør som Unix-gruppe
+core_asuser=Kjør som Unix-bruker
 core_euid='$1' er ikke en gyldig gruppe ID
 core_egid='$1' er ikke en gyldig bruker ID
 core_tourl=Gå til URL..
@@ -990,7 +990,7 @@ log_mime_modify=Endret MIME type $1
 log_mime_create=Lagt til MIME type $1
 log_defines=Endret definerte parametere
 log_reconfig=Rekonfigurert kjente moduler
-log_mods=Endret konfigurerte Apache moduler
+log_mods=Endret konfigurerte Apache-moduler
 log_start=Startet webserver
 log_stop=Stoppet webserver
 log_apply=Endringer lagret
@@ -1063,7 +1063,7 @@ cache_emaxoc=Antall objekter å cache i minne må være et heltall
 
 suexec_su=Kjør CGI programmer som
 suexec_none=Bruker fra global konfigurasjon
-suexec_user=Unix bruker
+suexec_user=Unix-bruker
 suexec_group=og gruppe
 suexec_euser=Manglende eller ugyldig bruker å kjøre CGI programmer som
 suexec_egroup=Manglende eller ugyldig gruppe å kjøre CGI programmer som
@@ -1078,8 +1078,8 @@ filter_out=Output Filter definisjoner
 filter_ename=Ugyldig filter navn '$1'
 filter_ecmd=Mangler kommando for filter '$1'
 
-cdir_err=Kunne ikke opprette per-directory instillinger
-cdir_err2=Kunne ikke lagre per-directory innstillinger
+cdir_err=Kunne ikke opprette per-mappe-innstillinger
+cdir_err2=Kunne ikke lagre per-mappe-innstillinger
 cdir_epath=Manglende sti
 cdir_eproxy=Proxy innstillinger kan ikke opprettes med match regexp innstillingen slått på
 cdir_ecannot=Du har ikke tilgang til å opprette per-katalog innstillinger for den angitte stien
@@ -1126,12 +1126,12 @@ mod_auth_digest_al=Hashing algoritme
 mod_auth_digest_domain=URLer og stier i samme domene
 mod_auth_digest_edomain=Manglende URLer og stier i samme domene
 
-mods_title=Konfigurer Apache moduler
+mods_title=Konfigurer Apache-moduler
 mods_mod=Modul
 mods_state=Gjeldende tilstand
 mods_enabled=Slått på
 mods_disabled=Slått av
 mods_available=Tilgjengelig for installasjon
-mods_ecannot=Du har ikke tilgang til å konfigurere Apache moduler
+mods_ecannot=Du har ikke tilgang til å konfigurere Apache-moduler
 mods_save=Slå på valgte moduler
-mods_desc=Denne siden lar deg velge hvilke valgfrie Apache moduler som er slått på, ved å bruke sjekkboksen ved siden av hvert modulnavn. Vær forsiktig når du slår av en modul, siden alle eksisterende direktiver for den modulen, ikke lenger vil gjenkjennes.
+mods_desc=Denne siden lar deg velge hvilke valgfrie Apache-moduler som er slått på, ved å bruke sjekkboksen ved siden av hvert modulnavn. Vær forsiktig når du slår av en modul, siden alle eksisterende direktiver for den modulen, ikke lenger vil gjenkjennes.

apache/mod_mpm_event.pl

@@ -1,5 +1,5 @@
 # mod_mpm_event.pl
-# Defines editors for the pre-forking module in apache 2.4.
+# Defines editors for the event MPM module in apache 2.4.
 # The actual functions for all of these are still in core.pl
 
 sub mod_mpm_event_directives
@@ -9,13 +9,17 @@ $rv = [ [ 'CoreDumpDirectory', 0, 9, 'global', 2.0 ],
 	[ 'BindAddress Listen Port', 1, 1, 'global', 2.0, 10 ],
 	[ 'ListenBacklog', 0, 1, 'global', 2.0 ],
 	[ 'LockFile', 0, 9, 'global', 2.0 ],
+	[ 'MaxRequestWorkers', 0, 0, 'global', 2.313 ],
 	[ 'MaxRequestsPerChild', 0, 0, 'global', 2.0 ],
-	[ 'MinSpareServers', 0, 0, 'global', 2.0 ],
-	[ 'MaxSpareServers', 0, 0, 'global', 2.0 ],
+	[ 'MinSpareThreads', 0, 0, 'global', 2.0 ],
+	[ 'MaxSpareThreads', 0, 0, 'global', 2.0 ],
 	[ 'PidFile', 0, 9, 'global', 2.0 ],
 	[ 'ScoreBoardFile', 0, 9, 'global', 2.0 ],
 	[ 'SendBufferSize', 0, 1, 'global', 2.0 ],
+	[ 'ServerLimit', 0, 0, 'global', 2.0 ],
 	[ 'StartServers', 0, 0, 'global', 2.0 ],
+	[ 'ThreadLimit', 0, 0, 'global', 2.0 ],
+	[ 'ThreadsPerChild', 0, 0, 'global', 2.0 ],
 	[ 'Group', 0, 8, 'global', 2.0 ],
 	[ 'User', 0, 8, 'global', 2.0, 10 ] ];
 return &make_directives($rv, $_[0], "mod_mpm_event");

apache/mod_mpm_prefork.pl

@@ -9,12 +9,14 @@ $rv = [ [ 'CoreDumpDirectory', 0, 9, 'global', 2.0 ],
 	[ 'BindAddress Listen Port', 1, 1, 'global', 2.0, 10 ],
 	[ 'ListenBacklog', 0, 1, 'global', 2.0 ],
 	[ 'LockFile', 0, 9, 'global', 2.0 ],
+	[ 'MaxRequestWorkers', 0, 0, 'global', 2.313 ],
 	[ 'MaxRequestsPerChild', 0, 0, 'global', 2.0 ],
 	[ 'MinSpareServers', 0, 0, 'global', 2.0 ],
 	[ 'MaxSpareServers', 0, 0, 'global', 2.0 ],
 	[ 'PidFile', 0, 9, 'global', 2.0 ],
 	[ 'ScoreBoardFile', 0, 9, 'global', 2.0 ],
 	[ 'SendBufferSize', 0, 1, 'global', 2.0 ],
+	[ 'ServerLimit', 0, 0, 'global', 2.0 ],
 	[ 'StartServers', 0, 0, 'global', 2.0 ],
 	[ 'Group', 0, 8, 'global', 2.0 ],
 	[ 'User', 0, 8, 'global', 2.0, 10 ] ];

apache/mod_mpm_worker.pl

@@ -0,0 +1,27 @@
+# mod_mpm_worker.pl
+# Defines editors for the worker MPM module in apache 2.4.
+# The actual functions for all of these are still in core.pl
+
+sub mod_mpm_worker_directives
+{
+local $rv;
+$rv = [ [ 'CoreDumpDirectory', 0, 9, 'global', 2.0 ],
+	[ 'BindAddress Listen Port', 1, 1, 'global', 2.0, 10 ],
+	[ 'ListenBacklog', 0, 1, 'global', 2.0 ],
+	[ 'LockFile', 0, 9, 'global', 2.0 ],
+	[ 'MaxRequestWorkers', 0, 0, 'global', 2.313 ],
+	[ 'MaxRequestsPerChild', 0, 0, 'global', 2.0 ],
+	[ 'MinSpareThreads', 0, 0, 'global', 2.0 ],
+	[ 'MaxSpareThreads', 0, 0, 'global', 2.0 ],
+	[ 'PidFile', 0, 9, 'global', 2.0 ],
+	[ 'ScoreBoardFile', 0, 9, 'global', 2.0 ],
+	[ 'SendBufferSize', 0, 1, 'global', 2.0 ],
+	[ 'ServerLimit', 0, 0, 'global', 2.0 ],
+	[ 'StartServers', 0, 0, 'global', 2.0 ],
+	[ 'ThreadLimit', 0, 0, 'global', 2.0 ],
+	[ 'ThreadsPerChild', 0, 0, 'global', 2.0 ],
+	[ 'Group', 0, 8, 'global', 2.0 ],
+	[ 'User', 0, 8, 'global', 2.0, 10 ] ];
+return &make_directives($rv, $_[0], "mod_mpm_worker");
+}
+

apache/mpm_netware.pl

@@ -18,7 +18,7 @@ return &make_directives($rv, $_[0], "mpm_netware");
 sub edit_MinSpareThreads
 {
 return (1,
-	$text{'worker_minspare'},
+	&hlink($text{'worker_minspare'}, "MinSpareThreads"),
 	&opt_input($_[0]->{'value'},"MinSpareThreads",$text{'default'}, 4));
 }
 sub save_MinSpareThreads
@@ -30,7 +30,7 @@ return &parse_opt("MinSpareThreads", '^\d+$',
 sub edit_MaxSpareThreads
 {
 return (1,
-	$text{'worker_maxspare'},
+	&hlink($text{'worker_maxspare'}, "MaxSpareThreads"),
 	&opt_input($_[0]->{'value'},"MaxSpareThreads",$text{'default'}, 4));
 }
 sub save_MaxSpareThreads
@@ -42,7 +42,7 @@ return &parse_opt("MaxSpareThreads", '^\d+$',
 sub edit_StartThreads
 {
 return (1,
-	$text{'perchild_sthreads'},
+	&hlink($text{'perchild_sthreads'}, "StartThreads"),
 	&opt_input($_[0]->{'value'},"StartThreads",$text{'default'}, 4));
 }
 sub save_StartThreads
@@ -51,4 +51,3 @@ return &parse_opt("StartThreads", '^\d+$',
 		  $text{'perchild_esthreads'});
 }
 
-

apache/mpm_winnt.pl

@@ -18,7 +18,7 @@ return &make_directives($rv, $_[0], "mpm_winnt");
 sub edit_ThreadsPerChild
 {
 return (1,
-	$text{'worker_threads'},
+	&hlink($text{'worker_threads'}, "ThreadsPerChild"),
 	&opt_input($_[0]->{'value'},"ThreadsPerChild",$text{'default'}, 4));
 }
 sub save_ThreadsPerChild
@@ -26,4 +26,3 @@ sub save_ThreadsPerChild
 return &parse_opt("ThreadsPerChild", '^\d+$',
 		  $text{'worker_ethreads'});
 }
-

apache/perchild.pl

@@ -35,7 +35,7 @@ $rv .= sprintf "<input type=radio name=AssignUserId_def value=0 %s>\n",
 $rv .= &text('perchild_assignug',
 	"<input name=AssignUserId_uid size=8 value='$_[0]->{'words'}->[0]'>",
 	"<input name=AssignUserId_gid size=8 value='$_[0]->{'words'}->[1]'>");
-return (2, $text{'perchild_assign'}, $rv);
+return (2, &hlink($text{'perchild_assign'}, "AssignUserId"), $rv);
 }
 sub save_AssignUserId
 {
@@ -66,7 +66,7 @@ foreach $c (@{$_[0]}, undef) {
 	$i++;
 	}
 $rv .= "</table>\n";
-return (2, $text{'perchild_child'}, $rv);
+return (2, &hlink($text{'perchild_child'}, "ChildPerUserId"), $rv);
 }
 sub save_ChildPerUserId
 {
@@ -88,7 +88,7 @@ return ( \@rv );
 sub edit_MinSpareThreads
 {
 return (1,
-	$text{'worker_minspare'},
+	&hlink($text{'worker_minspare'}, "MinSpareThreads"),
 	&opt_input($_[0]->{'value'},"MinSpareThreads",$text{'default'}, 4));
 }
 sub save_MinSpareThreads
@@ -100,7 +100,7 @@ return &parse_opt("MinSpareThreads", '^\d+$',
 sub edit_MaxSpareThreads
 {
 return (1,
-	$text{'worker_maxspare'},
+	&hlink($text{'worker_maxspare'}, "MaxSpareThreads"),
 	&opt_input($_[0]->{'value'},"MaxSpareThreads",$text{'default'}, 4));
 }
 sub save_MaxSpareThreads
@@ -112,7 +112,7 @@ return &parse_opt("MaxSpareThreads", '^\d+$',
 sub edit_StartThreads
 {
 return (1,
-	$text{'perchild_sthreads'},
+	&hlink($text{'perchild_sthreads'}, "StartThreads"),
 	&opt_input($_[0]->{'value'},"StartThreads",$text{'default'}, 4));
 }
 sub save_StartThreads
@@ -124,7 +124,7 @@ return &parse_opt("StartThreads", '^\d+$',
 sub edit_NumServers
 {
 return (1,
-	$text{'perchild_numservers'},
+	&hlink($text{'perchild_numservers'}, "NumServers"),
 	&opt_input($_[0]->{'value'},"NumServers",$text{'default'}, 4));
 }
 sub save_NumServers
@@ -136,7 +136,7 @@ return &parse_opt("NumServers", '^\d+$',
 sub edit_MaxThreadsPerChild
 {
 return (1,
-	$text{'perchild_maxthreads'},
+	&hlink($text{'perchild_maxthreads'}, "MaxThreadsPerChild"),
 	&opt_input($_[0]->{'value'},"MaxThreadsPerChild",$text{'default'}, 4));
 }
 sub save_MaxThreadsPerChild

apache/prefork.pl

@@ -9,12 +9,15 @@ $rv = [ [ 'CoreDumpDirectory', 0, 9, 'global', 2.0 ],
 	[ 'BindAddress Listen Port', 1, 1, 'global', 2.0, 10 ],
 	[ 'ListenBacklog', 0, 1, 'global', 2.0 ],
 	[ 'LockFile', 0, 9, 'global', 2.0 ],
+	[ 'MaxClients', 0, 0, 'global', '2.0-2.313' ],
+	[ 'MaxRequestWorkers', 0, 0, 'global', 2.313 ],
 	[ 'MaxRequestsPerChild', 0, 0, 'global', 2.0 ],
 	[ 'MinSpareServers', 0, 0, 'global', 2.0 ],
 	[ 'MaxSpareServers', 0, 0, 'global', 2.0 ],
 	[ 'PidFile', 0, 9, 'global', 2.0 ],
 	[ 'ScoreBoardFile', 0, 9, 'global', 2.0 ],
 	[ 'SendBufferSize', 0, 1, 'global', 2.0 ],
+	[ 'ServerLimit', 0, 0, 'global', 2.0 ],
 	[ 'StartServers', 0, 0, 'global', 2.0 ],
 	[ 'Group', 0, 8, 'global', 2.0 ],
 	[ 'User', 0, 8, 'global', 2.0, 10 ] ];

apache/worker.pl

@@ -9,14 +9,17 @@ $rv = [ [ 'CoreDumpDirectory', 0, 9, 'global', 2.0 ],
 	[ 'BindAddress Listen Port', 1, 1, 'global', 2.0, 10 ],
 	[ 'ListenBacklog', 0, 1, 'global', 2.0 ],
 	[ 'LockFile', 0, 9, 'global', 2.0 ],
-	[ 'MaxClients', 0, 0, 'global', 2.0 ],
+	[ 'MaxClients', 0, 0, 'global', '2.0-2.313' ],
+	[ 'MaxRequestWorkers', 0, 0, 'global', 2.313 ],
 	[ 'MaxRequestsPerChild', 0, 0, 'global', 2.0 ],
 	[ 'MinSpareThreads', 0, 0, 'global', 2.0 ],
 	[ 'MaxSpareThreads', 0, 0, 'global', 2.0 ],
 	[ 'PidFile', 0, 9, 'global', 2.0 ],
 	[ 'ScoreBoardFile', 0, 9, 'global', 2.0 ],
 	[ 'SendBufferSize', 0, 1, 'global', 2.0 ],
+	[ 'ServerLimit', 0, 0, 'global', 2.0 ],
 	[ 'StartServers', 0, 0, 'global', 2.0 ],
+	[ 'ThreadLimit', 0, 0, 'global', 2.0 ],
 	[ 'ThreadsPerChild', 0, 0, 'global', 2.0 ],
 	[ 'Group', 0, 8, 'global', 2.0 ],
 	[ 'User', 0, 8, 'global', 2.0, 10 ] ];
@@ -26,7 +29,7 @@ return &make_directives($rv, $_[0], "worker");
 sub edit_MinSpareThreads
 {
 return (1,
-	$text{'worker_minspare'},
+	&hlink($text{'worker_minspare'}, "MinSpareThreads"),
 	&opt_input($_[0]->{'value'},"MinSpareThreads",$text{'default'}, 4));
 }
 sub save_MinSpareThreads
@@ -38,7 +41,7 @@ return &parse_opt("MinSpareThreads", '^\d+$',
 sub edit_MaxSpareThreads
 {
 return (1,
-	$text{'worker_maxspare'},
+	&hlink($text{'worker_maxspare'}, "MaxSpareThreads"),
 	&opt_input($_[0]->{'value'},"MaxSpareThreads",$text{'default'}, 4));
 }
 sub save_MaxSpareThreads
@@ -50,7 +53,7 @@ return &parse_opt("MaxSpareThreads", '^\d+$',
 sub edit_ThreadsPerChild
 {
 return (1,
-	$text{'worker_threads'},
+	&hlink($text{'worker_threads'}, "ThreadsPerChild"),
 	&opt_input($_[0]->{'value'},"ThreadsPerChild",$text{'default'}, 4));
 }
 sub save_ThreadsPerChild
@@ -58,4 +61,3 @@ sub save_ThreadsPerChild
 return &parse_opt("ThreadsPerChild", '^\d+$',
 		  $text{'worker_ethreads'});
 }
-

at/macos-lib.pl

@@ -35,21 +35,24 @@ return @rv;
 # create_atjob(user, time, commands, directory, send-email)
 sub create_atjob
 {
-my @tm = localtime($_[1]);
+my ($user, $tm, $cmds, $dir, $email) = @_;
+my @tm = localtime($tm);
 my $date = sprintf "%2.2d:%2.2d %d.%d.%d",
 		$tm[2], $tm[1], $tm[3], $tm[4]+1, $tm[5]+1900;
-my $mailflag = $_[4] ? "-m" : "";
+my $mailflag = $email ? "-m" : "";
 no strict "subs";
-&open_execute_command(AT, "su \"$_[0]\" -c \"cd $_[3] ; at $mailflag $date\" >/dev/null 2>&1", 0); 
-print AT $_[2];
+my $fullcmd = &command_as_user($user, 0, "cd $dir ; at $mailflag $date");
+&open_execute_command(AT, "$fullcmd >/dev/null 2>&1", 0); 
+print AT $cmds;
 close(AT);
 use strict "subs";
-&additional_log('exec', undef, "su \"$_[0]\" -c \"cd $_[3] ; at $mailflag $date\"");
+&additional_log('exec', undef, $fullcmd);
 }
 
 # delete_atjob(id)
 sub delete_atjob
 {
-&system_logged("atrm \"$_[0]\" >/dev/null 2>&1");
+my ($id) = @_;
+&system_logged("atrm ".quotemeta($id)." >/dev/null 2>&1");
 }
 

at/module.info

@@ -1,6 +1,6 @@
 name=At
 desc=Scheduled Commands
-os_support=solaris slackware-linux redhat-linux mandrake-linux debian-linux suse-linux united-linux open-linux turbo-linux corel-linux msc-linux freebsd netbsd openbsd generic-linux openserver macos gentoo-linux irix sol-linux coherent-linux openmamba-linux syno-linux
+os_support=solaris slackware-linux redhat-linux mandrake-linux debian-linux suse-linux united-linux open-linux turbo-linux corel-linux msc-linux freebsd netbsd openbsd generic-linux alpine-linux openserver macos gentoo-linux irix sol-linux coherent-linux openmamba-linux syno-linux
 category=system
 longdesc=Schedule the execution of one-off commands or scripts.
 depends=proc

at/openserver-lib.pl

@@ -5,13 +5,13 @@ no warnings "redefine";
 
 sub list_atjobs
 {
-local @rv;
+my @rv;
 opendir(DIR, $config{'at_dir'}) || return ();
 while($f = readdir(DIR)) {
-	local $p = "$config{'at_dir'}/$f";
+	my $p = "$config{'at_dir'}/$f";
 	if ($f =~ /^(\d+)\.a(\S+)$/) {
-		local @st = stat($p);
-		local $job = { 'id' => $f,
+		my @st = stat($p);
+		my $job = { 'id' => $f,
 			       'date' => $1,
 			       'user' => scalar(getpwuid($st[4])),
 			       'created' => $st[9] };
@@ -32,17 +32,20 @@ return @rv;
 # create_atjob(user, time, commands, directory)
 sub create_atjob
 {
-local @tm = localtime($_[1]);
-local $date = strftime "%H:%M %b %d", @tm;
-&open_execute_command(AT, "su \"$_[0]\" -c \"cd $_[3] ; at $date\"", 0); 
-print AT $_[2];
+my ($user, $tm, $cmds, $dir) = @_;
+my @tm = localtime($tm);
+my $date = strftime "%H:%M %b %d", @tm;
+my $fullcmd = &command_as_user($user, 0, "cd $dir ; at $date");
+&open_execute_command(AT, $fullcmd, 0); 
+print AT $cmds;
 close(AT);
-&additional_log('exec', undef, "su \"$_[0]\" -c \"cd $_[3] ; at $date\"");
+&additional_log('exec', undef, $fullcmd);
 }
 
 # delete_atjob(id)
 sub delete_atjob
 {
-&system_logged("at -r \"$_[0]\"");
+my ($id) = @_;
+&system_logged("at -r ".quotemeta($id));
 }
 

bind8/acl_security.pl

@@ -3,7 +3,7 @@ use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
 
-require 'bind8-lib.pl';
+require 'bind8-lib.pl';    ## no critic
 # Globals from bind8-lib.pl
 our (%config, %text, %in);
 

bind8/backup_config.pl

@@ -45,21 +45,21 @@ return map { &make_chroot($_) } &unique(@rv);
 # Called before the files are actually read
 sub pre_backup
 {
-return undef;
+return;
 }
 
 # post_backup(&files)
 # Called after the files are actually read
 sub post_backup
 {
-return undef;
+return;
 }
 
 # pre_restore(&files)
 # Called before the files are restored from a backup
 sub pre_restore
 {
-return undef;
+return;
 }
 
 # post_restore(&files)
@@ -71,7 +71,7 @@ my $pidfile = &get_pid_file();
 if (&check_pid_file(&make_chroot($pidfile, 1))) {
 	return &restart_bind();
 	}
-return undef;
+return;
 }
 
 1;

bind8/bind8-lib.pl

@@ -12,16 +12,31 @@ use WebminCore;
 our (%text, %config, %gconfig, $module_name, $module_var_directory, $module_config_file, $module_config_directory);
 
 my $dnssec_tools_minver = 1.13;
-my $have_dnssec_tools = eval "require Net::DNS::SEC::Tools::dnssectools;";
+my $have_dnssec_tools = eval {
+	require Net::DNS::SEC::Tools::dnssectools;
+	1;
+	};
 my %freeze_zone_count;
 
 if ($have_dnssec_tools) {
-	eval "use Net::DNS::SEC::Tools::dnssectools;
-	      use Net::DNS::SEC::Tools::rollmgr;
-	      use Net::DNS::SEC::Tools::rollrec;
-	      use Net::DNS::SEC::Tools::keyrec;
-	      use Net::DNS::RR::DS;
-	      use Net::DNS;";
+	# All companion modules must load cleanly. A partial install would
+	# otherwise leave unqualified calls like rollmgr_sendcmd / rollrec_*
+	# undefined, causing runtime death deep inside dnssec helpers.
+	$have_dnssec_tools = eval {
+		require Net::DNS::SEC::Tools::dnssectools;
+		Net::DNS::SEC::Tools::dnssectools->import;
+		require Net::DNS::SEC::Tools::rollmgr;
+		Net::DNS::SEC::Tools::rollmgr->import;
+		require Net::DNS::SEC::Tools::rollrec;
+		Net::DNS::SEC::Tools::rollrec->import;
+		require Net::DNS::SEC::Tools::keyrec;
+		Net::DNS::SEC::Tools::keyrec->import;
+		require Net::DNS::RR::DS;
+		Net::DNS::RR::DS->import;
+		require Net::DNS;
+		Net::DNS->import;
+		1;
+		};
 	}
 
 &init_config();
@@ -78,7 +93,7 @@ if ($gconfig{'os_type'} =~ /-linux$/ &&
 		# Version: 9.14.2 deprecated the use of -r option
 		# in favor of using /dev/random [bugs:#5370]. So no
 		# entropy generation is needed.
-		return undef;
+		return;
 		}
 	}
 # No random flag, and entropy is needed
@@ -97,13 +112,13 @@ sub have_dnssec_tools_support
 		# dnssectools_rollrec
 		# dnssectools_keydir
 		# dnssectools_rollmgr_pidfile
-		return undef if (!$config{'dnssectools_conf'} ||
+		return if (!$config{'dnssectools_conf'} ||
 				 !$config{'dnssectools_rollrec'} ||
 				 !$config{'dnssectools_keydir'} ||
 				 !$config{'dnssectools_rollmgr_pidfile'});
 		return 1;
 	}
-	return undef;
+	return;
 }
 
 # get_bind_version()
@@ -116,7 +131,7 @@ if (&has_command($config{'named_path'})) {
 		return $2;
 		}
 	}
-return undef;
+return;
 }
 
 our @get_config_cache;
@@ -330,7 +345,7 @@ else {
 	while(1) {
 		$t = $_[0]->[++$i];
 		if ($t eq "{" || $t eq ";" || $t eq "}") { last; }
-		elsif (!defined($t)) { ${$_[2]} = $i; return undef; }
+		elsif (!defined($t)) { ${$_[2]} = $i; return; }
 		else { push(@vals, $t); }
 		}
 	$str{'values'} = \@vals;
@@ -342,7 +357,7 @@ else {
 		$str{'type'} = 1;
 		$j = 0;
 		while($_[0]->[$i] ne "}") {
-			if (!defined($_[0]->[$i])) { ${$_[2]} = $i; return undef; }
+			if (!defined($_[0]->[$i])) { ${$_[2]} = $i; return; }
 			my $substr = &parse_struct(
 				$_[0], $_[1], \$i, $j++, $_[4]);
 			if ($substr) {
@@ -388,7 +403,7 @@ sub find_value
 {
 my @v = &find($_[0], $_[1]);
 if (!@v) {
-	return undef;
+	return wantarray ? () : undef;
 	}
 elsif (wantarray) {
 	return map { &extract_value($_) } @v;
@@ -2075,9 +2090,9 @@ foreach my $v (&find("view", $conf)) {
         push(@zones, &find("zone", $v->{'members'}));
         }
 my ($z) = grep { lc($_->{'value'}) eq lc($name) } @zones;
-return undef if (!$z);
+return if (!$z);
 my $file = &find("file", $z->{'members'});
-return undef if (!$file);
+return if (!$file);
 my $filename = &absolute_path($file->{'values'}->[0]);
 $filename = &make_chroot($filename) if ($chroot);
 return $filename;
@@ -2256,7 +2271,7 @@ else {
 		}
 	}
 &refresh_nscd();
-return undef;
+return;
 }
 
 # before_editing(&zone)
@@ -2330,7 +2345,7 @@ elsif ($ex || $out =~ /failed|not found|error/i) {
 	return &text('restart_endc', "<tt>".&html_escape($out)."</tt>");
 	}
 &refresh_nscd();
-return undef;
+return;
 }
 
 # start_bind()
@@ -2375,7 +2390,7 @@ my $rv = $?;
 if ($rv || $out =~ /chroot.*not available/i) {
 	return &text('start_error', $out ? "<tt>$out</tt>" : "Unknown error");
 	}
-return undef;
+return;
 }
 
 # stop_bind()
@@ -2398,7 +2413,7 @@ else {
 		return $text{'stop_epid'};
 		}
 	}
-return undef;
+return;
 }
 
 # is_bind_running()
@@ -2437,7 +2452,7 @@ foreach my $c (@$vconf) {
 		return $c->{'index'};
 		}
 	}
-return undef;
+return;
 }
 
 # create_zone(&zone, &conf, [view-idx])
@@ -2641,7 +2656,7 @@ foreach my $z (@zones) {
 		return $z;
 		}
 	}
-return undef;
+return;
 }
 
 # get_zone_name_or_error(index|name, [viewindex|"any"])
@@ -2870,7 +2885,7 @@ if ($config{'tmpl_dnssec'} && &supports_dnssec()) {
 if ($secerr) {
 	return &text('mcreate_ednssec', $secerr);
 	}
-return undef;
+return;
 }
 
 # automatic_filename(domain, is-reverse, base, [viewname])
@@ -3305,7 +3320,7 @@ if ($view eq '' && @views || $view ne '' && @views > 1) {
                         [ map { [ $_->{'index'}, $_->{'value'} ] }
                             grep { $_->{'index'} ne $view } @views ]));
 	}
-return undef;
+return;
 }
 
 # download_root_zone(file)
@@ -3344,7 +3359,7 @@ if ($temp) {
 				     quotemeta($rootfile)." </dev/null");
 	return &text('boot_egzip2', "<tt>".&html_escape($out)."</tt>") if ($?);
 	}
-return undef;
+return;
 }
 
 # restart_links([&zone-name])
@@ -3458,13 +3473,14 @@ $fn || return "Could not work out keys directory!";
 my $dom = $z->{'members'} ? $z->{'values'}->[0] : $z->{'name'};
 
 # Remove all keys for the same zone
-opendir(ZONEDIR, $fn);
-foreach my $f (readdir(ZONEDIR)) {
+opendir(my $zonedir, $fn)
+	|| return "Failed to open keys directory $fn : $!";
+foreach my $f (readdir($zonedir)) {
 	if ($f =~ /^K\Q$dom\E\.\+(\d+)\+(\d+)\.(key|private)$/) {
 		&unlink_file("$fn/$f");
 		}
 	}
-closedir(ZONEDIR);
+closedir($zonedir);
 
 # Fork a background job to do lots of IO, to generate entropy
 my $pid;
@@ -3570,7 +3586,7 @@ foreach my $key (@keys) {
 	}
 &bump_soa_record($chrootfn, \@recs);
 
-return undef;
+return;
 }
 
 # resign_dnssec_key(&zone|&zone-name)
@@ -3643,7 +3659,7 @@ $newzonekey || return "Could not find new DNSSEC zone key";
 my $err = &sign_dnssec_zone($z);
 return "Re-signing failed : $err" if ($err);
 
-return undef;
+return;
 }
 
 # delete_dnssec_key(&zone|&zone-name, [save-key])
@@ -3753,7 +3769,7 @@ foreach my $r (@signedrecs) {
 	}
 &create_multiple_records($fn, \@addrecs);
 &unlink_file($signed);
-return undef;
+return;
 }
 
 # check_if_dnssec_tools_managed(&domain)
@@ -3801,7 +3817,7 @@ if (&check_if_dnssec_tools_managed($dom)) {
 	my $err = &dt_resign_zone($dom, $zonefile, $krfile, 0);
 	&unlock_file(&make_chroot($zonefile));
 	&error($err) if ($err);
-	return undef;
+	return;
 	}
 
 my $keyrec = &get_dnskey_record($z, $recs);
@@ -3820,8 +3836,17 @@ my ($z, $saved) = @_;
 my $dir = &get_keys_dir($z);
 my $dom = $z->{'members'} ? $z->{'values'}->[0] : $z->{'name'};
 my %keymap;
-opendir(ZONEDIR, $dir);
-foreach my $f (readdir(ZONEDIR)) {
+my $zonedir;
+if (!opendir($zonedir, $dir)) {
+	# A missing keys directory is the normal state before any DNSSEC
+	# keys have been generated for this zone; an unreadable one is a
+	# real error, but we can't return a string here because several
+	# list-context callers would treat it as a key hashref. Fall back
+	# to "no keys" and leave a breadcrumb in the error log.
+	warn "get_dnssec_key: opendir $dir failed: $!\n" if (-e $dir);
+	return wantarray ? () : undef;
+	}
+foreach my $f (readdir($zonedir)) {
 	if ($f =~ /^K\Q$dom\E\.\+(\d+)\+(\d+)\.key(\.saved)?$/) {
 		# Found the public key file .. read it
 		next if ($3 && !$saved);
@@ -3867,7 +3892,7 @@ foreach my $f (readdir(ZONEDIR)) {
 		while($rv->{'privatetext'} =~ s/^;.*\r?\n//) { }
 		}
 	}
-closedir(ZONEDIR);
+closedir($zonedir);
 
 # Sort to put KSK first
 my @rv = values %keymap;
@@ -4155,7 +4180,7 @@ sub dt_sign_zone
 
 	&dt_rollerd_restart();
 	&restart_bind();
-	return undef;
+	return;
 }
 
 # dt_resign_zone(zone-name, zonefile, krfile, threshold)
@@ -4212,7 +4237,7 @@ sub dt_resign_zone
 
 	&restart_zone($d);
 
-	return undef;
+	return;
 }
 
 # dt_zskroll_zone(zone-name)
@@ -4220,12 +4245,13 @@ sub dt_resign_zone
 sub dt_zskroll_zone
 {
 	my ($d) = @_;
-	no strict "subs";
+	# Constants exported by Net::DNS::SEC::Tools::rollmgr,
+	# which is only loaded when dnssec-tools is installed.
+	no strict "subs";    ## no critic (ProhibitNoStrict)
 	if (!rollmgr_sendcmd(CHANNEL_WAIT,ROLLCMD_ROLLZSK,$d)) {
 		return $text{'dt_zone_erollctl'};
 	}
-	use strict "subs";
-	return undef;
+	return;
 }
 
 # dt_kskroll_zone(zone-name)
@@ -4233,12 +4259,11 @@ sub dt_zskroll_zone
 sub dt_kskroll_zone
 {
 	my ($d) = @_;
-	no strict "subs";
+	no strict "subs";    ## no critic (ProhibitNoStrict)
 	if (!rollmgr_sendcmd(CHANNEL_WAIT,ROLLCMD_ROLLKSK,$d)) {
 		return $text{'dt_zone_erollctl'};
 	}
-	use strict "subs";
-	return undef;
+	return;
 }
 
 # dt_notify_parentzone(zone-name)
@@ -4246,12 +4271,11 @@ sub dt_kskroll_zone
 sub dt_notify_parentzone
 {
 	my ($d) = @_;
-	no strict "subs";
+	no strict "subs";    ## no critic (ProhibitNoStrict)
 	if (!rollmgr_sendcmd(CHANNEL_WAIT,ROLLCMD_DSPUB,$d)) {
 		return $text{'dt_zone_erollctl'};
 	}
-	use strict "subs";
-	return undef;
+	return;
 }
 
 # dt_rollerd_restart()
@@ -4270,7 +4294,7 @@ sub dt_rollerd_restart
 	$r = $config{"dnssectools_rollrec"};
 	$cmd = "$rollerd -rrfile ".quotemeta($r);
 	&execute_command($cmd);
-	return undef;
+	return;
 }
 
 # dt_genkrf()
@@ -4329,7 +4353,7 @@ sub dt_genkrf
 	$out = &backquote_logged("$cmd 2>&1");
 
 	return $out if ($?);
-	return undef;
+	return;
 }
 
 
@@ -4400,7 +4424,7 @@ sub dt_delete_dnssec_state
 		&unlink_file($z_dir."/dsset-".$dom.".");
 	}
 
-	return undef;
+	return;
 }
 
 # get_ds_record(&zone|&zone-name)
@@ -4424,7 +4448,7 @@ else {
 if (&has_command("dnssec-dsfromkey")) {
 	# Generate with a command
 	my $out = &backquote_command("dnssec-dsfromkey -f ".quotemeta(&make_chroot(&absolute_path($zonefile)))." ".quotemeta($dom)." 2>/dev/null");
-	return undef if ($?);
+	return if ($?);
 	$out =~ s/\r|\n//g;
 	return $out;
 	}
@@ -4445,9 +4469,9 @@ my $conf = &get_config();
 my $options = &find("options", $conf);
 my $mems = $options ? $options->{'members'} : [ ];
 my $en = &find_value("dnssec-enable", $mems);
-return undef if (!$en || $en !~ /yes/i);
+return if (!$en || $en !~ /yes/i);
 my $tkeys = &find("trusted-keys", $conf);
-return undef if (!$tkeys || !@{$tkeys->{'members'}});
+return if (!$tkeys || !@{$tkeys->{'members'}});
 return &text('trusted_warning',
 	     &get_webprefix().'/bind8/conf_trusted.cgi')."<p>\n".
        &ui_form_start(&get_webprefix().'/bind8/fix_trusted.cgi')."\n".

bind8/cgi_args.pl

@@ -62,5 +62,5 @@ elsif ($cgi eq 'view_text.cgi' || $cgi eq 'edit_soptions.cgi') {
 	return $z ? 'zone='.$z->{'zone'}.
 		    ($z->{'view'} ? '&view='.$z->{'viewindex'} : '') : 'none';
 	}
-return undef;
+return;
 }

bind8/check_zone.cgi

@@ -5,7 +5,7 @@ use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 # Globals from bind8-lib.pl
 our (%access, %text, %in);
 

bind8/close.cgi

@@ -7,7 +7,7 @@ no warnings 'uninitialized';
 # Globals
 our (%in);
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 &ReadParse();
 my @heiropen = &get_heiropen();
 @heiropen = grep { $_ ne $in{'what'} } @heiropen;

bind8/conf_acls.cgi

@@ -8,7 +8,7 @@ no warnings 'uninitialized';
 # Globals
 our (%text, %access);
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 $access{'defaults'} || &error($text{'acls_ecannot'});
 &ui_print_header(undef, $text{'acls_title'}, "",
 		 undef, undef, undef, undef, &restart_links());

bind8/conf_controls.cgi

@@ -7,7 +7,7 @@ no warnings 'uninitialized';
 # Globals
 our (%text, %access); 
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 $access{'defaults'} || &error($text{'controls_ecannot'});
 &ui_print_header(undef, $text{'controls_title'}, "",
 		 undef, undef, undef, undef, &restart_links());

bind8/conf_dnssec.cgi

@@ -7,7 +7,7 @@ no warnings 'uninitialized';
 # Globals
 our (%text, %access, %config);
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 &ReadParse();
 $access{'defaults'} || &error($text{'dnssec_ecannot'});
 &ui_print_header(undef, $text{'dnssec_title'}, "",

bind8/conf_dnssectools.cgi

@@ -7,7 +7,7 @@ no warnings 'uninitialized';
 # Globals
 our (%access, %text, %config);
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 
 &ReadParse();
 $access{'defaults'} || &error($text{'dt_conf_ecannot'});

bind8/conf_files.cgi

@@ -8,7 +8,7 @@ no warnings 'uninitialized';
 # Globals
 our (%access, %text);
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 $access{'defaults'} || &error($text{'files_ecannot'});
 &ui_print_header(undef, $text{'files_title'}, "",
 		 undef, undef, undef, undef, &restart_links());

bind8/conf_forwarding.cgi

@@ -8,7 +8,7 @@ no warnings 'uninitialized';
 # Globals
 our (%access, %text);
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 $access{'defaults'} || &error($text{'forwarding_ecannot'});
 &ui_print_header(undef, $text{'forwarding_title'}, "",
 		 undef, undef, undef, undef, &restart_links());

bind8/conf_keys.cgi

@@ -6,7 +6,7 @@ use warnings;
 no warnings 'redefine';
 no warnings 'uninitialized';
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 # Globals
 our (%access, %text);
 

bind8/conf_logging.cgi

@@ -8,7 +8,7 @@ no warnings 'uninitialized';
 our (%access, %text, %in);
 our (@syslog_levels, @severities, @cat_list);
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 $access{'defaults'} || &error($text{'logging_ecannot'});
 &ui_print_header(undef, $text{'logging_title'}, "",
 		 undef, undef, undef, undef, &restart_links());

bind8/conf_manual.cgi

@@ -7,7 +7,7 @@ no warnings 'uninitialized';
 # Globals
 our (%access, %text, %in);
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 $access{'defaults'} || &error($text{'manual_ecannot'});
 &ReadParse();
 &ui_print_header(undef, $text{'manual_title'}, "",

bind8/conf_misc.cgi

@@ -8,7 +8,7 @@ no warnings 'uninitialized';
 # Globals
 our (%access, %text);
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 $access{'defaults'} || &error($text{'misc_ecannot'});
 &ui_print_header(undef, $text{'misc_title'}, "",
 		 undef, undef, undef, undef, &restart_links());

bind8/conf_ncheck.cgi

@@ -7,7 +7,7 @@ no warnings 'uninitialized';
 # Globals
 our (%access, %text, %config);
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 &ReadParse();
 $access{'defaults'} || &error($text{'ncheck_ecannot'});
 

bind8/conf_net.cgi

@@ -7,7 +7,7 @@ no warnings 'uninitialized';
 # Globals
 our (%access, %text); 
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 $access{'defaults'} || &error($text{'net_ecannot'});
 &ui_print_header(undef, $text{'net_title'}, "",
 		 undef, undef, undef, undef, &restart_links());

bind8/conf_rndc.cgi

@@ -9,7 +9,7 @@ no warnings 'uninitialized';
 our (%access, %text, %config);
 our $module_name;
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 $access{'defaults'} || &error($text{'rndc_ecannot'});
 &ui_print_header(undef, $text{'rndc_title'}, "",
 		 undef, undef, undef, undef, &restart_links());

bind8/conf_servers.cgi

@@ -8,7 +8,7 @@ no warnings 'uninitialized';
 # Globals
 our (%access, %text);
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 $access{'defaults'} || &error($text{'servers_ecannot'});
 &ui_print_header(undef, $text{'servers_title'}, "",
 		 undef, undef, undef, undef, &restart_links());

bind8/conf_trusted.cgi

@@ -8,7 +8,7 @@ no warnings 'uninitialized';
 our (%access, %text, $bind_version);
 our $dnssec_dlv_zone;
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 &ReadParse();
 $access{'defaults'} || &error($text{'trusted_ecannot'});
 &supports_dnssec_client() || &error($text{'trusted_esupport'});

bind8/conf_zonedef.cgi

@@ -8,7 +8,7 @@ no warnings 'uninitialized';
 # Globals
 our (%access, %text, %config);
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 $access{'defaults'} || &error($text{'zonedef_ecannot'});
 &ui_print_header(undef, $text{'zonedef_title'}, "",
 		 undef, undef, undef, undef, &restart_links());
@@ -92,7 +92,7 @@ if (&supports_dnssec()) {
 
 	# Default algorithm
 	print &ui_table_row($text{'zonedef_alg'},
-		&ui_select("alg", $config{'tmpl_dnssecalg'} || "RSASHA1",
+		&ui_select("alg", $config{'tmpl_dnssecalg'} || "RSASHA256",
 			   [ &list_dnssec_algorithms() ]), 3);
 
 	# Default size

bind8/convert_master.cgi

@@ -8,7 +8,7 @@ no warnings 'uninitialized';
 # Globals
 our (%access, %text, %in, %config);
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 &ReadParse();
 &error_setup($text{'convert_err'});
 

bind8/convert_slave.cgi

@@ -8,7 +8,7 @@ no warnings 'uninitialized';
 # Globals
 our (%access, %text, %in);
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 &ReadParse();
 &error_setup($text{'convert_err'});
 

bind8/cpan_modules.pl

@@ -1,4 +1,6 @@
-require 'bind8-lib.pl';
+use strict;
+use warnings;
+require 'bind8-lib.pl';    ## no critic
 
 sub cpan_recommended
 {

bind8/create_delegation.cgi

@@ -8,7 +8,7 @@ no warnings 'uninitialized';
 # Globals
 our (%access, %text, %in, %config);
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 &ReadParse();
 &error_setup($text{'dcreate_err'});
 $access{'delegation'} || &error($text{'dcreate_ecannot'});

bind8/create_forward.cgi

@@ -8,7 +8,7 @@ no warnings 'uninitialized';
 # Globals
 our (%access, %text, %in, %config);
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 &ReadParse();
 &error_setup($text{'fcreate_err'});
 $access{'forward'} || &error($text{'fcreate_ecannot'});

bind8/create_hint.cgi

@@ -9,7 +9,7 @@ no warnings 'uninitialized';
 our (%access, %text, %in);
 our $module_root_directory;
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 &ReadParse();
 &error_setup($text{'hcreate_err'});
 $access{'master'} || &error($text{'hcreate_ecannot'});

bind8/create_master.cgi

@@ -8,7 +8,7 @@ no warnings 'uninitialized';
 # Globals
 our (%access, %text, %in, %config);
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 &ReadParse();
 &error_setup($text{'mcreate_err'});
 $access{'master'} || &error($text{'mcreate_ecannot'});

bind8/create_slave.cgi

@@ -11,7 +11,7 @@ no warnings 'uninitialized';
 # Globals
 our (%access, %text, %in, %config);
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 &ReadParse();
 &error_setup($in{'type'} ? $text{'screate_err1'} : $text{'screate_err2'});
 $access{'slave'} || &error($in{'type'} ? $text{'screate_ecannot1'}
@@ -100,16 +100,21 @@ if ($file) {
 	}
 
 # Create the structure
-my @mdirs = map { { 'name' => $_ } } @masters;
+my @mdirs;
+foreach my $m (@masters) {
+	my $mdir = { 'name' => $m,
+		     'values' => [ ] };
+	if ($masterkey) {
+		push(@{$mdir->{'values'}}, 'key', $masterkey);
+		}
+	push(@mdirs, $mdir);
+	}
 my $masters = { 'name' => 'masters',
-	     'type' => 1,
-	     'members' => \@mdirs };
+	        'type' => 1,
+	        'members' => \@mdirs };
 if (defined($masterport)) {
 	$masters->{'values'} = [ 'port', $masterport ];
 	}
-if ($masterkey) {
-	$masters->{'values'} = [ 'key', $masterkey ];
-	}
 my $dir = { 'name' => 'zone',
 	 'values' => [ $in{'zone'} ],
 	 'type' => 1,

bind8/create_view.cgi

@@ -7,7 +7,7 @@ no warnings 'uninitialized';
 # Globals
 our (%access, %text, %in);
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 &error_setup($text{'vcreate_err'});
 &ReadParse();
 my $add_to_file = &add_to_file();

bind8/delegation_form.cgi

@@ -8,7 +8,7 @@ no warnings 'uninitialized';
 # Globals
 our (%access, %text, %config);
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 $access{'delegation'} || &error($text{'dcreate_ecannot'});
 $access{'ro'} && &error($text{'master_ero'});
 &ui_print_header(undef, $text{'dcreate_title'}, "",

bind8/delete_recs.cgi

@@ -7,7 +7,7 @@ no warnings 'uninitialized';
 # Globals
 our (%access, %text, %in, %config);
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 &ReadParse();
 &error_setup($text{'drecs_err'});
 my $zone = &get_zone_name_or_error($in{'zone'}, $in{'view'});

bind8/delete_view.cgi

@@ -8,7 +8,7 @@ no warnings 'uninitialized';
 # Globals
 our (%access, %text, %in); 
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 &ReadParse();
 my $parent = &get_config_parent();
 my $conf = $parent->{'members'};

bind8/delete_zone.cgi

@@ -11,7 +11,7 @@ our (%access, %text, %in, %config);
 # Globals from records-lib.pl
 our $ipv6revzone;
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 &ReadParse();
 
 my $zone = &get_zone_name_or_error($in{'zone'}, $in{'view'});

bind8/disable_zonedt.cgi

@@ -6,7 +6,7 @@ no warnings 'redefine';
 no warnings 'uninitialized';
 our (%access, %text, %in); 
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 
 &error_setup($text{'dt_zone_err'});
 &ReadParse();

bind8/disable_zonekey.cgi

@@ -6,7 +6,7 @@ no warnings 'redefine';
 no warnings 'uninitialized';
 our (%access, %text, %in);
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 &error_setup($text{'zonekey_err'});
 &ReadParse();
 my $zone = &get_zone_name_or_error($in{'zone'}, $in{'view'});

bind8/dns_boot.cgi

@@ -7,7 +7,7 @@ no warnings 'redefine';
 no warnings 'uninitialized';
 our (%text, %config, %in);
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 &error_setup($text{'boot_err'});
 &ReadParse();
 

bind8/edit_delegation.cgi

@@ -7,7 +7,7 @@ no warnings 'redefine';
 no warnings 'uninitialized';
 our (%access, %in, %text);
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 &ReadParse();
 
 $in{'view'} = 'any' if ($in{'view'} eq '');

bind8/edit_forward.cgi

@@ -7,7 +7,7 @@ no warnings 'redefine';
 no warnings 'uninitialized';
 our (%access, %in, %text);
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 &ReadParse();
 
 $in{'view'} = 'any' if ($in{'view'} eq '');

bind8/edit_hint.cgi

@@ -7,7 +7,7 @@ no warnings 'redefine';
 no warnings 'uninitialized';
 our (%in, %text);
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 &ReadParse();
 my $zone = &get_zone_name_or_error($in{'zone'}, $in{'view'});
 my $dom = $zone->{'name'};

bind8/edit_master.cgi

@@ -7,7 +7,7 @@ no warnings 'redefine';
 no warnings 'uninitialized';
 our (%access, %text, %in, %config, %is_extra);
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 &ReadParse();
 our $ipv6revzone;
 $in{'view'} = 'any' if (!$in{'view'} || $in{'view'} eq '');

bind8/edit_options.cgi

@@ -7,7 +7,7 @@ no warnings 'redefine';
 no warnings 'uninitialized';
 our (%access, %text, %in); 
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 &ReadParse();
 
 my $zone = &get_zone_name_or_error($in{'zone'}, $in{'view'});

bind8/edit_record.cgi

@@ -7,7 +7,7 @@ no warnings 'redefine';
 no warnings 'uninitialized';
 our (%access, %text, %in); 
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 &ReadParse();
 my $zone = &get_zone_name_or_error($in{'zone'}, $in{'view'});
 my $dom = $zone->{'name'};

bind8/edit_recs.cgi

@@ -7,7 +7,7 @@ no warnings 'redefine';
 no warnings 'uninitialized';
 our (%access, %text, %in, %config, %is_extra);
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 &ReadParse();
 my $zone = &get_zone_name_or_error($in{'zone'}, $in{'view'});
 my $dom = $zone->{'name'};

bind8/edit_slave.cgi

@@ -7,7 +7,7 @@ no warnings 'redefine';
 no warnings 'uninitialized';
 our (%access, %text, %in, %config); 
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 &ReadParse();
 our $ipv6revzone;
 

bind8/edit_soa.cgi

@@ -7,7 +7,7 @@ no warnings 'redefine';
 no warnings 'uninitialized';
 our (%access, %in, %text, %config);
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 &ReadParse();
 my $zone = &get_zone_name_or_error($in{'zone'}, $in{'view'});
 my $dom = $zone->{'name'};
@@ -65,7 +65,7 @@ print &ui_table_row($text{'master_minimum'},
 	&time_unit_choice("minunit", $u[3]));
 
 # Default TTL
-my $ttl = $defttl->{'defttl'} if ($defttl);
+my $ttl = $defttl ? $defttl->{'defttl'} : undef;
 my ($ttlu) = &extract_time_units($ttl);
 print &ui_table_row($text{'master_defttl'},
 	&ui_radio("defttl_def", $defttl ? 0 : 1,

bind8/edit_soptions.cgi

@@ -8,7 +8,7 @@ no warnings 'uninitialized';
 our (%access, %in, %text);
 our $scriptname;
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 &ReadParse();
 
 my $zone = &get_zone_name_or_error($in{'zone'}, $in{'view'});

bind8/edit_text.cgi

@@ -7,7 +7,7 @@ no warnings 'redefine';
 no warnings 'uninitialized';
 our (%access, %text, %in, %config);
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 &ReadParse();
 my $zone = &get_zone_name_or_error($in{'zone'}, $in{'view'});
 my $file = &absolute_path($zone->{'file'});

bind8/edit_tls.cgi

@@ -7,7 +7,7 @@ no warnings 'redefine';
 no warnings 'uninitialized';
 our (%access, %text, %in);
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 $access{'defaults'} || &error($text{'tls_ecannot'});
 &supports_tls() || &error($text{'tls_esupport'});
 &ReadParse();

bind8/edit_view.cgi

@@ -7,7 +7,7 @@ no warnings 'redefine';
 no warnings 'uninitialized';
 our (%access, %text, %in);
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 &ReadParse();
 my $conf = &get_config();
 my $view = $conf->[$in{'index'}];

bind8/edit_zonedt.cgi

@@ -6,7 +6,7 @@ no warnings 'redefine';
 no warnings 'uninitialized';
 our (%access, %text, %in, %config, $in);
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 
 &ReadParse();
 my $zone = &get_zone_name_or_error($in{'zone'}, $in{'view'});

bind8/edit_zonekey.cgi

@@ -6,7 +6,7 @@ no warnings 'redefine';
 no warnings 'uninitialized';
 our (%access, %in, %text, $in, %config);
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 &ReadParse();
 my $zone = &get_zone_name_or_error($in{'zone'}, $in{'view'});
 my $dom = $zone->{'name'};

bind8/enable_zonedt.cgi

@@ -6,7 +6,7 @@ no warnings 'redefine';
 no warnings 'uninitialized';
 our (%access, %text, %in);
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 
 &error_setup($text{'dt_zone_err'});
 &ReadParse();

bind8/enable_zonekey.cgi

@@ -6,7 +6,7 @@ no warnings 'redefine';
 no warnings 'uninitialized';
 our (%access, %text, %in);
 
-require './bind8-lib.pl';
+require './bind8-lib.pl';    ## no critic
 &error_setup($text{'zonekey_err'});
 &ReadParse();
 my $zone = &get_zone_name_or_error($in{'zone'}, $in{'view'});