muchos

AFAIK you can't you decryptpassword for clients passwords. The issues isn't my understanding of hashing the password with the salt, it is the issue of mismatching hash's with this particular salt, potentially a bug or error in handling foreign characters?

Sorry I was referring to the 'getclientsdetails' action, the password field (for that client) that is returned.

I am having trouble creating the correct hash for a certain account, not sure why, could be due an unusual salt. I can log into the control panel with the password: mutasim4321 , but when it comes to creating a hash to use over the API it doesn't match the one saved. The password hash stored is e706df93eceb437192fe0ae7d1793c92:ýsg The one created is md5(ýsgmutasim4321) = be2c54930f8df4c3db04fd57f5c56186. Any ideas?

Would it be possible to accept payments through the mobile version of PayPal in a custom order form and for the payment to be accepted by WHMCS, I was hoping that if IPN is enabled and pointing to WHMCS then providing the correct parameters are passed to the IPN system that it would replicate a the normal PayPal payment action. If so what information needs to be send to PayPal in the transaction for it to associate the payment with the correct invoice. Thanks

it would be nice to see "Next Due Date" filled with the date of end of the trial, just a thought..

Resolved: {if !$loggedin} {php} header('Location: /register.php'); {/php} {/if}

I want users to register before they can see the order/cart process. Something like this? {if !$loggedin} redirect => register.php {else} rest of code.. {/if} Thanks

I only offer one service, and I don't want customers to be able to have more than one of these in the cart. Any ideas? Thanks

If the user has be referred by an affiliate will that affiliate recieve recurring payments from that client once the client starts paying?

Cheers I'll check it out

Any suggestions of how to do this? I am looking to give my customers a free trial for x number of months and then be billed /account suspended after. Also for my affiliates to be paid (recurring) as and when their referals start paying. Thanks

Is there any way I can recall the name in a .tpl? It is for use with a header image. E.g. - Page - cart.php Name - Cart Thus header image will be Cart.gif I tried <img src="{$breadcrumbnav}.gif"... But that fails to work on most pages as it has a trail not just the page name Cheers, Mutasim

Thanks for clearing that up, the software is a bit oversensitive IMHO

I ran the scan myself on my own site if that is what you where asking... I didn't try and exploit the found errors because I don't know how

Using Acunetix I ran a security check on my site and it picked up quite a few potential issues... Firstly the lack of SSL brings up a possible interception exploit (which I've sorted with an SSL certificate) (Which I know is not a script problem) But the issue that worried me was that the software picked up some High alert security issues (the highest out of 4 levels of warning). With the error: Script source code disclosure Vulnerability description: It is possible to read the source code of this script by using script filename as a parameter. It seems that this script includes a file which name is determined using user-supplied data. This data is not properly validated before being passed to the include function. The impact of this vulnerability: An attacker can gather sensitive information (database connection strings, application logic) by analysing the source code. This information can be used to launch further attacks. Attack details: The Cookie variable PHPSESSID has been set to announcements.php How to fix this vulnerability: Analyse the source code of this script and solve the problem. Web references: iMPERVA Source Code Disclosure \/\/ \/\/ \/\/.imperva.com/application_defense_center/glossary/source_code_disclosure.html For the following pages: - announcements.php - downloads.php - knowledgebase.php - serverstatus.php - index.php Still running search, so if any more docs are affected will update you - Mutasim