cxs

Changes:

• New –options [I]. This option will trigger a match for Ioncube files. As Ioncube files cannot be decoded by cxs, this option can be used to block uploads of Ioncube files in cxscgi.sh. Otherwise, the script will have to be detected using –xtra [file] and the MD5SUM of the script
• Modified option -wttw [file] to prevent reporting of Ioncube files as we cannot decode them and so cannot determine their function
• Option for Ioncube trigger added to UI wizards

Changes:

• Modified UI display of the current configuration for the various cxs commands so that it shows a quarantine error if present
• Added buttons to UI to display the current configuration for the Daily and Weekly cxs commands
• Added golang file detection for exploit fingerprints

Changes:

• Fixed UI not allowing Save Wizard Defaults if in Restricted Mode
• Fixed Save Wizard Defaults when –www, –smtp or –dbreport disabled

Changes:

• Added buttons to UI to display the current configuration for the various cxs commands
• Added timeout to d/b connect to prevent hanging processes waiting for a d/b lock
• Improved efficiency of /etc/cxs/cxscgi.queue processing
• Improved efficiency of quarantine scan processing in UI

Changes:

• Fixed issue where cxsWatch was needlessly updating the SQLite D/B on each scanned file which was causing some performance problems

Changes:

• Fixed bug when using –config [file] in /etc/cxs/cxsftp.sh

Changes:

• Added new option –cutcgimail. This option suppresses emails sent by cxs for ModSecurity hits from /etc/cxs/cxscgi.sh where the reported web script does not exist on the server. Any configured quarantine or delete operations will still be performed. Note: This option is the synonymous with the unsupported –YSKIPCGI option which will continue to work in the same way
• Added –cutcgimail to the cxs ModSecurity Wizard as “Reduce the number of emails from ModSecurity hits”
• Changed the wording in the email sent where the reported web script does not exist on the server
• Improvements to the saving logic in the various UI Wizards

Changes:

• Decoder improvements

Changes:

• Fix issue using stat() after abs_path() on an orphaned sylink

  NOTE: If you received error “Use of uninitialized value $arg in stat”
  during a a cron job scan, that scan will still have completed
  successfully and this fixes that issue

• Ensure d/b is closed after processing dbreport
• Ensure crond is restarted after making changes to cxs-cron

Changes:

• Fix for new cxs Daily/Weekly scan symlink issue