Skip to content

Commit 205daa6

Browse files
PDowneyPDowney
authored
Minor changes
Added TLS 1.1 back to the config just to support legacy systems. TLS 1.1 will be disabled if the user enabled the high security SSL mode in EngineScript settings.
1 parent 09ee254 commit 205daa6

5 files changed

Lines changed: 8 additions & 139 deletions

File tree

‎config/etc/nginx/globals/map-cache.conf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -110,7 +110,7 @@ map $request_uri $es_request_uri {
110110
"~*/edd-" 1; # Easy Digital Downloads
111111

112112
# Block: Unsafe Files
113-
#"~*\.(?:asc|aspx?|bak|bash|bat|blade(\.php)?|cfg|cgi|cmd|conf|csh|dll|dump|engine|env|exe|git(ignore)?|hg|inc|info|ini|install|jsp|log|lua|make|mdb|module|old|orig(inal)?|out|pem|pl|po|profile|py|rdf|save|sh|svn|swo|swp|test|theme|tpl|twig|woa|xtmpl)$" 2;
113+
#"~*\.(?:asc|aspx?|bak|bash|bat|blade(\.php)?|cfg|cgi|cmd|conf|csh|dll|dump|engine|env|exe|git(ignore)?|hg|inc|info|ini|install|jsp|log|lua|make|md|mdb|module|old|orig(inal)?|out|pem|pl|po|profile|py|rdf|save|sh|svn|swo|swp|test|theme|tpl|twig|woa|xtmpl)$" 2;
114114
#"~*(Gemfile|Gruntfile|auth|composer|composer/installed|package|package-lock|yarn)\.(?:json|lock)$" 2;
115115
#"~*(changelog|example|installation|legalnotice|license|readme|wp-config)\.(?:html?|md|php|rst|txt)$" 2;
116116
#"~*gems\.(?:rb|locked)?$" 2;

‎config/etc/nginx/ssl/sslshared.conf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ ssl_conf_command Options KTLS;
44
ssl_dhparam /etc/nginx/ssl/dhe/ffdhe2048.pem;
55
ssl_ecdh_curve X25519:P-256:P-384;
66
ssl_prefer_server_ciphers off;
7-
ssl_protocols TLSv1.2 TLSv1.3;
7+
ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
88
ssl_reject_handshake off;
99
ssl_session_cache shared:SSL:5m;
1010
ssl_session_tickets on;

‎config/home/enginescript-install-options.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@ INSTALL_ADMINER=0
4040
# Controls the SSL certificate keylength for all new domains.
4141
# 0 = Normal security (EC-256, 256-bit ECDSA certificate, fast and secure for most sites)
4242
# 1 = High security (EC-384, 384-bit ECDSA certificate, stronger encryption, slightly slower, recommended for high-security environments)
43+
# Also disables TLS 1.1 in nginx (only TLS 1.2 and TLS 1.3 allowed)
4344
#
4445
# If unsure, leave as 0. Set to 1 only if you require maximum SSL strength.
4546
HIGH_SECURITY_SSL=0

‎scripts/functions/auto-upgrade/normal-auto-upgrade.sh‎

Lines changed: 0 additions & 137 deletions
Original file line numberDiff line numberDiff line change
@@ -21,140 +21,3 @@ verify_installation_completion
2121
# Start Main Script
2222

2323
# Upgrade Scripts will be found below:
24-
25-
#----------------------------------------------------------------------------------
26-
# Migration: Admin Tools Directory Structure (2025-12-31)
27-
#
28-
# Migrates admin tools from old /var/www/admin/enginescript/ structure
29-
# to new separated structure:
30-
# - Control Panel: /var/www/admin/control-panel/
31-
# - Tools: /var/www/admin/tools/
32-
#
33-
# This ensures phpMyAdmin and other tools survive EngineScript updates.
34-
#----------------------------------------------------------------------------------
35-
36-
migrate_admin_tools() {
37-
local OLD_ADMIN_DIR="/var/www/admin/enginescript"
38-
local NEW_TOOLS_DIR="/var/www/admin/tools"
39-
local NEW_PANEL_DIR="/var/www/admin/control-panel"
40-
local MIGRATION_NEEDED=0
41-
42-
# Check if old directory structure exists
43-
if [[ -d "$OLD_ADMIN_DIR" ]]; then
44-
echo "============================================================="
45-
echo "Admin Tools Migration: Detected old directory structure"
46-
echo "============================================================="
47-
48-
# Create new directories
49-
mkdir -p "$NEW_TOOLS_DIR"
50-
mkdir -p "$NEW_PANEL_DIR"
51-
52-
# Migrate phpMyAdmin (preserve config!)
53-
if [[ -d "$OLD_ADMIN_DIR/phpmyadmin" ]]; then
54-
echo "Migrating phpMyAdmin..."
55-
if [[ ! -d "$NEW_TOOLS_DIR/phpmyadmin" ]]; then
56-
mv "$OLD_ADMIN_DIR/phpmyadmin" "$NEW_TOOLS_DIR/phpmyadmin"
57-
echo " ✓ phpMyAdmin migrated to $NEW_TOOLS_DIR/phpmyadmin"
58-
MIGRATION_NEEDED=1
59-
else
60-
echo " ℹ phpMyAdmin already exists in new location, skipping"
61-
fi
62-
fi
63-
64-
# Migrate Adminer
65-
if [[ -d "$OLD_ADMIN_DIR/adminer" ]]; then
66-
echo "Migrating Adminer..."
67-
if [[ ! -d "$NEW_TOOLS_DIR/adminer" ]]; then
68-
mv "$OLD_ADMIN_DIR/adminer" "$NEW_TOOLS_DIR/adminer"
69-
echo " ✓ Adminer migrated to $NEW_TOOLS_DIR/adminer"
70-
MIGRATION_NEEDED=1
71-
else
72-
echo " ℹ Adminer already exists in new location, skipping"
73-
fi
74-
fi
75-
76-
# Migrate TinyFileManager (preserve config!)
77-
if [[ -d "$OLD_ADMIN_DIR/tinyfilemanager" ]]; then
78-
echo "Migrating TinyFileManager..."
79-
if [[ ! -d "$NEW_TOOLS_DIR/tinyfilemanager" ]]; then
80-
mv "$OLD_ADMIN_DIR/tinyfilemanager" "$NEW_TOOLS_DIR/tinyfilemanager"
81-
echo " ✓ TinyFileManager migrated to $NEW_TOOLS_DIR/tinyfilemanager"
82-
MIGRATION_NEEDED=1
83-
else
84-
echo " ℹ TinyFileManager already exists in new location, skipping"
85-
fi
86-
fi
87-
88-
# Migrate phpSysInfo
89-
if [[ -d "$OLD_ADMIN_DIR/phpsysinfo" ]]; then
90-
echo "Migrating phpSysInfo..."
91-
if [[ ! -d "$NEW_TOOLS_DIR/phpsysinfo" ]]; then
92-
mv "$OLD_ADMIN_DIR/phpsysinfo" "$NEW_TOOLS_DIR/phpsysinfo"
93-
echo " ✓ phpSysInfo migrated to $NEW_TOOLS_DIR/phpsysinfo"
94-
MIGRATION_NEEDED=1
95-
else
96-
echo " ℹ phpSysInfo already exists in new location, skipping"
97-
fi
98-
fi
99-
100-
# Migrate phpinfo
101-
if [[ -d "$OLD_ADMIN_DIR/phpinfo" ]]; then
102-
echo "Migrating phpinfo..."
103-
if [[ ! -d "$NEW_TOOLS_DIR/phpinfo" ]]; then
104-
mv "$OLD_ADMIN_DIR/phpinfo" "$NEW_TOOLS_DIR/phpinfo"
105-
echo " ✓ phpinfo migrated to $NEW_TOOLS_DIR/phpinfo"
106-
MIGRATION_NEEDED=1
107-
else
108-
echo " ℹ phpinfo already exists in new location, skipping"
109-
fi
110-
fi
111-
112-
# Migrate OpCache-GUI
113-
if [[ -d "$OLD_ADMIN_DIR/opcache-gui" ]]; then
114-
echo "Migrating OpCache-GUI..."
115-
if [[ ! -d "$NEW_TOOLS_DIR/opcache-gui" ]]; then
116-
mv "$OLD_ADMIN_DIR/opcache-gui" "$NEW_TOOLS_DIR/opcache-gui"
117-
echo " ✓ OpCache-GUI migrated to $NEW_TOOLS_DIR/opcache-gui"
118-
MIGRATION_NEEDED=1
119-
else
120-
echo " ℹ OpCache-GUI already exists in new location, skipping"
121-
fi
122-
fi
123-
124-
# Set permissions on migrated tools
125-
if [[ "$MIGRATION_NEEDED" -eq 1 ]]; then
126-
echo "Setting permissions on migrated tools..."
127-
chown -R www-data:www-data "$NEW_TOOLS_DIR"
128-
find "$NEW_TOOLS_DIR" -type d -exec chmod 755 {} \;
129-
find "$NEW_TOOLS_DIR" -type f -exec chmod 644 {} \;
130-
131-
echo ""
132-
echo "============================================================="
133-
echo "Admin Tools Migration Complete!"
134-
echo "============================================================="
135-
echo ""
136-
echo "Tools are now stored in: $NEW_TOOLS_DIR"
137-
echo "Control panel is now in: $NEW_PANEL_DIR"
138-
echo ""
139-
echo "This separation ensures your tool configurations"
140-
echo "(especially phpMyAdmin) survive future EngineScript updates."
141-
echo "============================================================="
142-
echo ""
143-
fi
144-
145-
# Clean up old directory if empty
146-
if [[ -d "$OLD_ADMIN_DIR" ]]; then
147-
# Check if directory is empty (only contains . and ..)
148-
if [[ -z "$(ls -A "$OLD_ADMIN_DIR" 2>/dev/null)" ]]; then
149-
rmdir "$OLD_ADMIN_DIR" 2>/dev/null || true
150-
echo "Removed empty old admin directory: $OLD_ADMIN_DIR"
151-
else
152-
echo "Note: Old admin directory still contains files: $OLD_ADMIN_DIR"
153-
echo " Please review and remove manually if no longer needed."
154-
fi
155-
fi
156-
fi
157-
}
158-
159-
# Run migration check
160-
migrate_admin_tools

‎scripts/install/nginx/nginx-misc.sh‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,11 @@ source /usr/local/bin/enginescript/scripts/functions/shared/enginescript-common.
2222
cp -a /usr/local/bin/enginescript/config/etc/nginx/. /etc/nginx/
2323
sed -i "s|SEDPHPVER|${PHP_VER}|g" /etc/nginx/globals/php-fpm.conf
2424

25+
# Disable TLS 1.1 if high security SSL is enabled
26+
if [[ "${HIGH_SECURITY_SSL}" == "1" ]]; then
27+
sed -i 's|ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;|ssl_protocols TLSv1.2 TLSv1.3;|g' /etc/nginx/ssl/sslshared.conf
28+
fi
29+
2530
# Enable unsafe file blocking if configured
2631
if [[ "${NGINX_BLOCK_UNSAFE_FILES}" == "1" ]]; then
2732
sed -i 's|^ #\("~\*\\.\(?:asc\| \1|' /etc/nginx/globals/map-cache.conf

0 commit comments

Comments
 (0)