Ensuring Compatibility with Existing Systems
Developers
cPanel/WHM 11.25 includes optional features which, if enabled, could cause integration issues with software designed to interact with earlier versions of cPanel and WHM. Please read on to find out how to ensure smooth integration of your software with cPanel/WHM 11.25.
Security Tokens
This optional feature of cPanel/WHM 11.25 is designed to mitigate XSRF attacks. If you enable this feature, URLs will contain a session token in the form cpsess<number>.
When security tokens are enabled, absolute URLs will no longer be allowed. If you choose to enable this feature, you will need to ensure that you are using relative URLs within your product.
Non-browser systems that interact with cPanel, WHM, and webmail using basic HTTP authentication can bypass this security measure by ensuring that no session cookies are sent with requests.
To enable security tokens:
- Access Tweak Settings in WHM.
- Find and enable the following option: Require security tokens for all interfaces. This will greatly improve the security of cPanel and WHM against XSRF attacks, but may break integration with other systems, login applications, billing software and third party themes.
- Click Save.
Disabling this option should work for most XML API users. To solve other problems that may arise, Source IP Check has been modified to enable logins from the most recent IP address when no white-list can be found. This should reduce user annoyance and prevent every frame from showing the security questions screen.
Blank Referer Checks
Version 11.25 handles blank referer checks differently, to make them more accurate. If a page is sent with a blank referer inside an existing session, it will trigger an XSRF prevention page. This is not affected inside the sessions that do not use cookies and are authenticated via HTTP or WHM.
Server Administrators
mbox Not Supported
Server administrators using the mbox format for mail will find that upgrading to cPanel/WHM 11.25 requires conversion to the Maildir format.
You can effect this conversion before upgrading by selecting the Mail Directory Conversion System option in WHM, and clicking Convert Accounts to Maildir.
