[error] panel error, operating system icon

[Paul_Villa]

panel error, operating system icon is not available.
Possible error in the code.

[jacobg830]

I think this was fixed in a recent patch. To fix now, try opening /etc/zpanel/configs/apache/httpd.conf and change:

Code:

ServerTokens Prod

to

Code:

ServerTokens OS

and then restart apache

[Me.B]

Jacob detecting the os that way is not good..... we should use prod setting.

M B

[kandrews]

We need to look at altering the PHP code to find the installed version another way. Until then it is entirely up to the users if they want to change this setting back. However as @Me.B has said it is NOT advisable to show the world your apache version for security reasons.

[Me.B]

It could be even a variable in config file setup post install... this won't be a mess and we could get back os to prod!

M B

[kandrews]

httpd -V or apache2 -V can be ran by any user without root privileges so we could use a hard coded command to fetch this safely (would require security testing).

[Me.B]

it could be run in install process and output dumped in a file. Why we need to run it each time?

Only during upgrade > update. extract the infos and drop 2 vars in config file: OS + webserver that would do the trick.

M B

[kandrews]

Server admins could run yum update / apt-get upgrade at any point... Adding yum / apt post install hooks would be playing with people's system far too much. As long as the command running this is completely hard coded and escaped it will be fine, however I'll get you to review the change to make sure we are happy using this method first.

[Me.B]

Kevin,

I meant only during zpanel install process not after each yum... Notice apache won't change for a long while on ubuntu / centos and we had to change the whole release to get new apache/php and don't think that next php will be shipped to ubuntu 14/centos 7.

Easy and efficient hack to lower privilege we need to run the panel. That's important for security focus.

M B

[kandrews]

The major version doesn't change however the patch number and minor version numbers do change between yum / apt updates.

You can't do any serious damage if we don't use zsudo to run this command, just use system without privileges:

Code:

<?php echo system('httpd -V'); ?>

This way we can get the version and there is no way of changing this code via injection as there is no user input.