• Hi, Pleskians! We are running a UX testing of our upcoming product intended for server management and monitoring.
    We would like to invite you to have a call with us and have some fun checking our prototype. The agenda is pretty simple - we bring new design and some scenarios that you need to walk through and succeed. We will be watching and taking insights for further development of the design.
    If you would like to participate, please use this link to book a meeting. We will sent the link to the clickable prototype at the meeting.
  • (Plesk for Windows):
    MySQL Connector/ODBC 3.51, 5.1, and 5.3 are no longer shipped with Plesk because they have reached end of life. MariaDB Connector/ODBC 64-bit 3.2.4 is now used instead.
  • The Horde webmail has been deprecated. Its complete removal is scheduled for April 2025. For details and recommended actions, see the Feature and Deprecation Plan.

Resolved Mail 'application user' has access to WPT by default

Kaspar

API expert
Plesk Guru
Username:

TITLE


Mail 'application user' has access to WPT by default

PRODUCT, VERSION, OPERATING SYSTEM, ARCHITECTURE

Any OS
Plesk 18.0.56

PROBLEM DESCRIPTION

When creating an emailaccount a Plesk 'application user' user is created too. The 'application user' has access to the WPT of the domain by default. Which poses a security risk.

STEPS TO REPRODUCE

1) Create domain, upon creation choose to install Wordpress
2) Create an email account for the domain
3) Log out of Plesk, login back again with credentials of mail user from step 2
4) Notice how user has access to the WPT and can modify settings

ACTUAL RESULT

Application users have access to WPT.

EXPECTED RESULT

Application users should not have access to WPT.

ANY ADDITIONAL INFORMATION

Could not reproduce issue on 18.0.54 server, but can on 18.0.56.

YOUR EXPECTATIONS FROM PLESK SERVICE TEAM

Confirm bug
 
Last edited:
The issue has been confirmed, but for version 18.0.56 only. Tracking-IDs PPM-14172, PPP-62890. Workaround:
1) Backup /usr/local/psa/admin/plib/pm/Client.php to /usr/local/psa/admin/plib/pm/Client.php.bkp
2) Replace /usr/local/psa/admin/plib/pm/Client.php with the same file from version 18.0.55
 
2) Create an email account for the domain
by the way, I very much dislike that "Can be used to log in to Plesk" is checked by default. Giving a user more rights should be a conscious decision, not a forgotten default.
 
Back
Top