WHMCS.Community

WHMCS 8 removed the ability for administrators to change a user's password from the admin area. Change User Password puts it back, safely and with every action recorded. Change a password straight from the client profile or from the Manage Users dropdown, generate a strong password with one click, and optionally email it to the user so they can log in right away. Owned License ($30.00) - https://www.hardsoftcode.com/cart/link/change-user-password-for-whmcs/owned Source Code License ($200.00) - https://www.hardsoftcode.com/cart/link/change-user-password-for-whmcs/source Why you need it Users ask support to reset their password, and WHMCS no longer lets you do it. Staff can reset passwords without ever needing the old one. Every change is logged with who did it, when and from where. Highlights Two places to change a password: the client profile tab and the Manage Users dropdown, using the native WHMCS modal. Built-in password generator: configurable length (8–64) and character types, using a cryptographically secure random source. Optional email to the user: sent with a ready-made Change User Password template. Dashboard and activity log: KPI cards, a reset trend chart, and a full audit trail with IP and browser. Role-based access: uses the built-in WHMCS Access Control list, enforced server side. Secure by design: POST-only, CSRF-protected endpoints, and no passwords in the logs. Works on WHMCS 8.x and 9.x. Admin area only, no client-area changes. What's New This release makes the module's modal endpoints POST-only with CSRF validation. Opening an endpoint URL directly in the browser now returns the standard WHMCS HTTP Method Not Allowed page, just like WHMCS core routes. CSRF checks also go through one shared, fail-closed helper, so the modal shows a clean error instead of a raw response. Access control now uses the built-in WHMCS Access Control list, and existing role lists are migrated automatically. The dashboard has been redesigned with total, monthly and daily reset counters, a quick action bar, a 7 / 30 / 90 day or all-time filter, and a new Reset Trend chart. Endpoints are now root-relative so they work from WHMCS 9 pretty admin URLs, and security was hardened across all endpoints and files. You can now choose which character types the password generator uses (letters, numbers and symbols), and passwords are generated with a cryptographically secure random source. This release also fixes the Generate button and the CSRF token on the save form, so new passwords save correctly. Features Change a password Change a password from the client profile tab Change a password from the client profile → Users tab Change a password from Clients → Manage Users One click to change a password in a native WHMCS modal Send an email notification to the user with the new password Works with WHMCS 9 pretty URLs Password generator Configurable password length (8–64) Configurable character types: letters, numbers, symbols At least one character of every selected type Cryptographically secure random generation Copy and Insert buttons Admin and audit Dashboard with total, monthly and daily reset counters Reset Trend chart with 7 / 30 / 90 day and all-time filters Activity log with actor, IP and browser user-agent Settings history that names every changed value Configurable log retention with automatic cleanup Security and access Role-based access control using the WHMCS Access Control list POST-only, CSRF-protected endpoints No passwords stored in the activity log or the email log No changes to WHMCS core files Email Ready-made Change User Password email template Changelog v2.4.1 Added: Three dashboard KPI cards: Total Resets, This Month and Today's Resets Added: Quick action bar: generate a test password, find a client, settings Added: 7 / 30 / 90 day and all-time activity filter Added: Reset Trend chart, capped at 366 days for All Time, with Chart.js 4.4.1 bundled (no CDN) Added: Password Characters setting: choose letters, numbers and symbols Added: Every selected character type is guaranteed in each generated password Added: Dashboard, Activity Log (DataTables) and admin header navigation Added: Audit log with IP and browser Added: Per-change settings history Added: AJAX settings with toast messages Updated: Modal body (a=index) is now POST-only with a CSRF token, like WHMCS core routes Updated: Opening an endpoint URL directly in the browser returns the WHMCS HTTP Method Not Allowed page Updated: Access Control now uses the built-in WHMCS role list, and the module's own role field was removed Updated: Existing role lists are migrated automatically, and an empty role list denies access, matching WHMCS Updated: Dashboard redesigned, with the activity feed sorted by date, capped at 10 rows and showing actor badges Updated: Endpoints are root-relative, so they work from WHMCS 9 pretty admin URLs Updated: Password generation is now cryptographically secure (random_int() + Fisher-Yates) instead of str_shuffle() Updated: Modern rewrite on the HSCode architecture: namespaced controllers and Smarty admin templates Fixed: Direct GET to a=store and a=password now returns the WHMCS 405 page instead of a bare JSON error Fixed: GET responses no longer mint or echo a CSRF token Fixed: Dashboard counters now count password changes only, so settings saves no longer inflate them Fixed: Generate button now works Fixed: CSRF token on the save form, so new passwords save correctly Fixed: Generator modal no longer reuses WHMCS element IDs Fixed: Length warning and pre-filled password Improved: CSRF validation is centralised in one fail-closed helper that returns a clean JSON 403 to the modal Improved: a=store and a=password use the same CSRF helper Improved: Access is enforced consistently in the UI and the endpoints Improved: Security hardening: POST-only password generation, password saves and settings saves, restricted controller dispatch, password length and NUL byte checks, direct file access blocked, .htaccess rules, and generic activation and deactivation errors

That string ships in WHMCS's own language files (it's the FAQ text on the MarketConnect SocialBee store page), which is why grep finds it in every lang file. The value has "href=" doubled inside the quotes, so browsers treat it as a relative link and the "calls" link ends up pointing at a path on your own WHMCS domain instead of socialbee.com. Your sed fix works, but I wouldn't leave it there: lang/english.php and the other core lang files are replaced on every WHMCS update, so the broken link quietly comes back. Language overrides survive updates: 1.  Create the folder lang/overrides/ if it doesn't exist, then a file lang/overrides/english.php that starts with <?php 2. Add just the corrected key: $_LANG['store']['socialbee']['faq']['a2']['i2'] = "Support through <a href='https://socialbee.com/calendar/'>calls</a>, chat, or email communication. We’re one of the few social media tools still offering on-call support."; 3. Do the same for each language you actually have enabled (lang/overrides/farsi.php, lang/overrides/arabic.php and so on). Override files only need the keys you're changing; everything else still loads from the main file. Then load the SocialBee store page with that language selected and hover the link to confirm it now goes to socialbee.com. It's also worth reporting it to WHMCS as a bug so it gets corrected in the shipped files, since every install with MarketConnect has the same broken link.

As a temporary fix, you may edit the viewticket.tpl file manually and replace the last script block with the updated code in blend template. From <script> $(document).ready(function() { if (typeof aiRating !== 'undefined') { aiRating.init(); } }); </script> To <script> $(document).ready(function() { if (typeof aiRating !== 'undefined') { aiRating.init(); } // Prevent Chrome Password Manager autofill in Status Selectize function fixStatusAutofill() { var statusSelect = document.querySelector( '#frmAddTicketReply select[name="status"].selectized' ); if (!statusSelect) { return; } var statusInput = statusSelect.nextElementSibling ? statusSelect.nextElementSibling.querySelector('input') : null; if (!statusInput) { return; } statusInput.setAttribute('autocomplete', 'off'); statusInput.setAttribute('data-lpignore', 'true'); statusInput.setAttribute('readonly', 'readonly'); function clearInvalidValue() { var currentValue = statusInput.value.trim(); var validOption = Array.from(statusSelect.options).some(function(option) { return option.text.trim().toLowerCase() === currentValue.toLowerCase(); }); if (currentValue && !validOption) { statusInput.value = ''; statusInput.dispatchEvent(new Event('input', { bubbles: true })); } } clearInvalidValue(); if (!statusInput.dataset.autofillFixed) { statusInput.addEventListener('focus', function() { clearInvalidValue(); statusInput.removeAttribute('readonly'); setTimeout(clearInvalidValue, 100); }); statusInput.dataset.autofillFixed = 'true'; } } fixStatusAutofill(); setTimeout(fixStatusAutofill, 500); setTimeout(fixStatusAutofill, 1500); }); </script>    

Hi So what prompted this was my AI automation. I have AI compile details on security updates several times a day - giving us prompt warning of any action we need to take to secure our servers.   Part of the work it does is checking all the relevant places for updates, mitigation steps etc for our entire stack. The AI stumbled upon this blog post and set alarm bells off. We checked the link it provided and sure enough  - there it was a page published about Lagom and others on the 21st. So yeah, perhaps dont pubish till its ready. 

Indeed that is the case, strange that other clients do not have this issue, maybe I switched too fast to a new solution that is not working properly, yet.

Hello WHMCS Community, We’re introducing Weeby Studio — a complete WHMCS theme with a visual website builder, custom client area, and matching orderform and checkout, created by Hostk. The idea is simple: give hosting businesses a consistent brand experience and practical control over their website. Your pages, product presentation, customer workspace, and checkout share one design, with a dedicated Studio inside WHMCS to make it your own. Your hosting website. Your brand. Your Studio. Meet the Visual Studio Update your website from a focused visual workspace inside the WHMCS administration area. Edit visually: change website text, images, links, buttons, and supported styling. Build your pages: create or duplicate public pages, add content blocks, and arrange editable sections. Find every detail: navigate page structure through Pages and Layers. Manage your assets: upload images and replace editable visuals. Preview across devices: review desktop, tablet, and mobile layouts. Control shared elements: customize website navigation, headers, footers, and brand settings. Manage on-page SEO: edit browser titles, search descriptions, and image alternative text. Publish when ready: save an unpublished draft, review your changes, then publish. Keep a recovery path: export editable project backups and revisit saved published versions. Everyday content changes can be made in the visual editor, while native WHMCS forms, live prices, permissions, and transactions retain their original behavior. One design, from first visit to checkout Weeby Studio includes three connected parts of your customer experience: 1. Your public website A responsive hosting website with service landing pages, product presentations, comparison sections, and shared navigation. 2. Your client area A branded customer workspace for services, domains, invoices, support tickets, account information, and everyday account tasks. 3. Your orderform A matching product selection, configuration, cart, and checkout experience using native WHMCS ordering. The result is a consistent visual identity as customers move between your website, their account, and their next purchase. 23 starting pages. Room for your own ideas. The included public collection contains 23 pages, including 14 service landing pages, a homepage, service directory, and policy pages. Hosting & compute: Web Hosting, Cloud Hosting, Reseller Hosting, VPS Hosting, Dedicated Servers, and Game Servers. Business & security: Domains, Professional Email, SSL Certificates, and VPN. Expert services: Web Design, Backup & Recovery, Website Migration, and Managed Services. Customize the included content or create additional public pages through the Studio. 12 color palettes + your own brand colors Start with the original Weeby blue, navy, and white identity, choose one of 12 coordinated palettes, or create a custom palette. Set your brand accents, buttons, navigation, headings, text, backgrounds, surfaces, and borders. Customize your logo, typography, content width, and button corners from the shared design controls. Supported bundled visuals and the default favicon follow the selected palette. Your uploaded photos, custom logo, and custom favicon keep their original artwork. Product presentation connected to WHMCS Your real catalog stays central to the website. Connect website plan slots to specific WHMCS products or product groups. Display product names, descriptions, prices, and available billing cycles from WHMCS. Use the currencies and pricing configured in your installation. Customize supported CPU, RAM, storage, transfer, and other resource display labels. Presentation labels remain separate from the actual service specifications and allowances defined in WHMCS. A client area that feels part of your brand The custom client area brings key customer tasks into a coordinated layout: Dashboard with service overview and account updates. Sidebar navigation and account shortcuts. Product and service management screens. Domain listings and supported management actions. Invoices, billing information, and payment-related account views. Support tickets, Knowledgebase, and announcements. Login, registration, password recovery, and account details. Available actions follow the customer’s permissions and your enabled WHMCS functionality. Checkout with the details customers need The matching orderform supports product configuration, available billing cycles, domain choices, configurable options, add-ons, and guest or existing-customer checkout. Its itemized order summary presents the information supplied by WHMCS, including products, domains, selected options, billing periods, and recurring charges where available. Native discounts, taxes, credits, and totals remain authoritative. Multilingual content. RTL & LTR layouts. Translate public website content, navigation, and supported theme labels through the Studio, with a reading direction for each language. Prepare English LTR and Arabic RTL presentations, while native account and checkout fields use your installed WHMCS language packs. Language and currency controls follow your WHMCS configuration. Installation & documentation The package includes the website theme, matching orderform, Studio administration addon, and English and Arabic HTML documentation. Installation guidance covers activation, branding, products, languages, publishing, updates, and recovery. Editable project backups, saved published versions, and factory design recovery tools help you manage future changes. Weeby Studio requires an existing, licensed, self-hosted WHMCS installation. Confirm compatibility with your WHMCS release before purchasing. Hosting, WHMCS licensing, payment gateways, registrars, and provisioning services are configured separately. Explore Weeby Studio Live website demo https://hostk.com/weeby-demo/ Live Client Area demo https://hostk.com/weeby-demo/clientarea.php Email Address: test@hostk.com Password: test Special Price: $49.99 USD — reduced from $120 USD One-time purchase. Website-bound activation for one installation. Get Weeby Studio https://hostk.com/weeby/ We’d love to hear your feedback on the visual Studio, the customer workspace, and the ordering experience. Questions are welcome in this thread. Weeby Studio by Hostk Your website. Your client area. Your checkout. One connected brand.    

Hello WHMCS Community, We’re introducing Weeby Studio — a complete WHMCS theme with a visual website builder, custom client area, and matching orderform and checkout, created by Hostk. The idea is simple: give hosting businesses a consistent brand experience and practical control over their website. Your pages, product presentation, customer workspace, and checkout share one design, with a dedicated Studio inside WHMCS to make it your own. Your hosting website. Your brand. Your Studio. Meet the Visual Studio Update your website from a focused visual workspace inside the WHMCS administration area. Edit visually: change website text, images, links, buttons, and supported styling. Build your pages: create or duplicate public pages, add content blocks, and arrange editable sections. Find every detail: navigate page structure through Pages and Layers. Manage your assets: upload images and replace editable visuals. Preview across devices: review desktop, tablet, and mobile layouts. Control shared elements: customize website navigation, headers, footers, and brand settings. Manage on-page SEO: edit browser titles, search descriptions, and image alternative text. Publish when ready: save an unpublished draft, review your changes, then publish. Keep a recovery path: export editable project backups and revisit saved published versions. Everyday content changes can be made in the visual editor, while native WHMCS forms, live prices, permissions, and transactions retain their original behavior. One design, from first visit to checkout Weeby Studio includes three connected parts of your customer experience: 1. Your public website A responsive hosting website with service landing pages, product presentations, comparison sections, and shared navigation. 2. Your client area A branded customer workspace for services, domains, invoices, support tickets, account information, and everyday account tasks. 3. Your orderform A matching product selection, configuration, cart, and checkout experience using native WHMCS ordering. The result is a consistent visual identity as customers move between your website, their account, and their next purchase. 23 starting pages. Room for your own ideas. The included public collection contains 23 pages, including 14 service landing pages, a homepage, service directory, and policy pages. Hosting & compute: Web Hosting, Cloud Hosting, Reseller Hosting, VPS Hosting, Dedicated Servers, and Game Servers. Business & security: Domains, Professional Email, SSL Certificates, and VPN. Expert services: Web Design, Backup & Recovery, Website Migration, and Managed Services. Customize the included content or create additional public pages through the Studio. 12 color palettes + your own brand colors Start with the original Weeby blue, navy, and white identity, choose one of 12 coordinated palettes, or create a custom palette. Set your brand accents, buttons, navigation, headings, text, backgrounds, surfaces, and borders. Customize your logo, typography, content width, and button corners from the shared design controls. Supported bundled visuals and the default favicon follow the selected palette. Your uploaded photos, custom logo, and custom favicon keep their original artwork. Product presentation connected to WHMCS Your real catalog stays central to the website. Connect website plan slots to specific WHMCS products or product groups. Display product names, descriptions, prices, and available billing cycles from WHMCS. Use the currencies and pricing configured in your installation. Customize supported CPU, RAM, storage, transfer, and other resource display labels. Presentation labels remain separate from the actual service specifications and allowances defined in WHMCS. A client area that feels part of your brand The custom client area brings key customer tasks into a coordinated layout: Dashboard with service overview and account updates. Sidebar navigation and account shortcuts. Product and service management screens. Domain listings and supported management actions. Invoices, billing information, and payment-related account views. Support tickets, Knowledgebase, and announcements. Login, registration, password recovery, and account details. Available actions follow the customer’s permissions and your enabled WHMCS functionality. Checkout with the details customers need The matching orderform supports product configuration, available billing cycles, domain choices, configurable options, add-ons, and guest or existing-customer checkout. Its itemized order summary presents the information supplied by WHMCS, including products, domains, selected options, billing periods, and recurring charges where available. Native discounts, taxes, credits, and totals remain authoritative. Multilingual content. RTL & LTR layouts. Translate public website content, navigation, and supported theme labels through the Studio, with a reading direction for each language. Prepare English LTR and Arabic RTL presentations, while native account and checkout fields use your installed WHMCS language packs. Language and currency controls follow your WHMCS configuration. Installation & documentation The package includes the website theme, matching orderform, Studio administration addon, and English and Arabic HTML documentation. Installation guidance covers activation, branding, products, languages, publishing, updates, and recovery. Editable project backups, saved published versions, and factory design recovery tools help you manage future changes. Weeby Studio requires an existing, licensed, self-hosted WHMCS installation. Confirm compatibility with your WHMCS release before purchasing. Hosting, WHMCS licensing, payment gateways, registrars, and provisioning services are configured separately. Explore Weeby Studio Live website demo https://hostk.com/weeby-demo/ Live Client Area demo https://hostk.com/weeby-demo/clientarea.php Email Address: test@hostk.com Password: test Special Price: $49.99 USD — reduced from $120 USD One-time purchase. Website-bound activation for one installation. Get Weeby Studio https://hostk.com/weeby/ We’d love to hear your feedback on the visual Studio, the customer workspace, and the ordering experience. Questions are welcome in this thread. Weeby Studio by Hostk Your website. Your client area. Your checkout. One connected brand.    

HostX V3.1.2 Is Now Available! We’re pleased to announce the release of HostX V3.1.2, bringing improved WHMCS v9.1.0 compatibility, UI enhancements, responsive improvements, and several bug fixes. What's New? Compatibility & Improvements Improved compatibility with WHMCS v9.1.0. Updated language files to follow WHMCS 9.x naming conventions. Improved mobile responsiveness of the addon module. Refined the default login page styling. Enhanced Product Addon and VPS product field designs in the order form. Added Credit Notes and Debit Notes menus to the sidebar with styling that matches the HostX layout. Bug Fixes Fixed responsive issues in the Domain Search block's TLD section. Fixed Domain page heading color issues across all layouts. Fixed the checkout registration form toggle button layout across browsers. Fixed the EV description issue on the SSL Certificate MarketConnect page. Fixed banner spacing on MarketConnect pages when using a sticky header. This update focuses on making HostX more consistent, responsive, and compatible with the latest WHMCS release. Already using HostX? Update to V3.1.2 and enjoy the latest improvements! Thank you for your continued support and feedback. Buy Now: https://whmcsglobalservices.com/webhosting-template/hostx-whmcs-theme-template/

HostX V3.1.2 Is Now Available! We’re pleased to announce the release of HostX V3.1.2, bringing improved WHMCS v9.1.0 compatibility, UI enhancements, responsive improvements, and several bug fixes. What's New? Compatibility & Improvements Improved compatibility with WHMCS v9.1.0. Updated language files to follow WHMCS 9.x naming conventions. Improved mobile responsiveness of the addon module. Refined the default login page styling. Enhanced Product Addon and VPS product field designs in the order form. Added Credit Notes and Debit Notes menus to the sidebar with styling that matches the HostX layout. Bug Fixes Fixed responsive issues in the Domain Search block's TLD section. Fixed Domain page heading color issues across all layouts. Fixed the checkout registration form toggle button layout across browsers. Fixed the EV description issue on the SSL Certificate MarketConnect page. Fixed banner spacing on MarketConnect pages when using a sticky header. This update focuses on making HostX more consistent, responsive, and compatible with the latest WHMCS release. Already using HostX? Update to V3.1.2 and enjoy the latest improvements! Thank you for your continued support and feedback. Buy Now: https://whmcsglobalservices.com/webhosting-template/hostx-whmcs-theme-template/

HostX V3.1.2 Is Now Available! We’re pleased to announce the release of HostX V3.1.2, bringing improved WHMCS v9.1.0 compatibility, UI enhancements, responsive improvements, and several bug fixes. What's New? Compatibility & Improvements Improved compatibility with WHMCS v9.1.0. Updated language files to follow WHMCS 9.x naming conventions. Improved mobile responsiveness of the addon module. Refined the default login page styling. Enhanced Product Addon and VPS product field designs in the order form. Added Credit Notes and Debit Notes menus to the sidebar with styling that matches the HostX layout. Bug Fixes Fixed responsive issues in the Domain Search block's TLD section. Fixed Domain page heading color issues across all layouts. Fixed the checkout registration form toggle button layout across browsers. Fixed the EV description issue on the SSL Certificate MarketConnect page. Fixed banner spacing on MarketConnect pages when using a sticky header. This update focuses on making HostX more consistent, responsive, and compatible with the latest WHMCS release. Already using HostX? Update to V3.1.2 and enjoy the latest improvements! Thank you for your continued support and feedback. Buy Now: https://whmcsglobalservices.com/webhosting-template/hostx-whmcs-theme-template/