ebmocwen

I'm not sure why the update is required either. The hosting server support TLSv1.1, i'm not sure why the Nominet module comes into it. Did anyone report their module actually stopped working? Or is this a problem that simply didn't happen?

My nominet module on 5.3.14 never stopped working. I suspect it will stop working after the upgrade to WHMCS 6.

Dear Eddy, Thank you for your reply. I am running WHMCS 5.3.14 and expected the EPP to stop working, but it's fine. I called Nominet today and they said they don't know why it is working as it's should have stopped. I wondered if there was a "change over" period where both TSL 1 and 1.1 would work together. They denied this was the case. I'm running WHMCS 5.3x, PHP 5.4 and Centos 6. I asked this question here because I was worried that if I upgrade to WHMCS 6, I need to then upgrade my PHP to 5.6 and i'm not sure if I can test all of this in time should the upgrade break my current live setup. Thanks.

We haven't quite get around to upgrading to WHMCS 6.x yet so we are currently still running 5.3.x. After reading this WHMCS blog entry posted 20th August regarding the Nominet module: http://blog.whmcs.com/?t=117270 This module will only be available for WHMCS 6.x but surprisingly, our WHMCS 5.x module works with Nominet EPP without any problems, so I was wondering if anyone knew why this was? Are we the last people running WHMCS 5.x? Has anyone else experienced the same issue? The reason I ask is, we plan to upgrade to WHMCS 6 to resolve this problem (which currently isn;t a problem for us) so I was wondering if we introduce the problem by upgrading? Thank you in advance for any assistance/advice you can offer!

GoCardless York UK Module + WHMCS 6.x Does anyone have any feedback on whether GoCardless (YUH) works with WHMCS 6.x? I'm working on my upgrade and wondering if there are any issues I need to look out for! Thank you in advance!

UPDATE: A new fork of GoCardless module has been uploaded by York UK Hosting (Thanks nathany!) I've installed this module and will report any issues to York, but I feel good about this ----- This is a fork of v1.1.0 created by York UK Hosting. The fork implements the following: 1. Fixes the callback 500 error 2. Account level billing rather than product/service level. A single agreement can then used to bill for any invoice. 3. Supression of 'payment failed' emails to prevent confusion 4. Support to request GoCardless payments X days ahead of invoice due date to ensure payments are received by the due date rather than after. 5. Store the PreAuth in a separate table so that GoCardless can be used alongside a credit/debit card within a single account. Download: https://github.com/yorkukhosting/gocardless-whmcs -----

I'm really interested to get GoCardless to work, the reduced processing costs really make it worth it. How did you get on with the module? Did you find a solution? Any information you can share will be greatly appreciated!

Additionally, i've found the impelling fork of 1.1 which was updated just 2 months ago: https://github.com/impelling/gocardless-whmcs Are you using this fork? Reducing the monthly fees paid to PayPal are more than worth the effort to try to find a solution!

Thank you so much for your feedback - and taking the time to write such a detailed response. I'm really interested in making this module work, and your tips have headed me in the right direction. I'm going to run with 10 clients, then work it out from there. I kind of need the problem to occur so I can get on with fixing them, thanks again!

I see there has been a lot of discussion about GoCardless in previous years, however, i've not seen much since the last module was released by GoCardless - v1.1.0 - in Feb 2014. https://github.com/gocardless/gocardless-whmcs I know WHMCS no longer supports GoCardless with their own module, but the v1.1 module was developed by GoCardless and it is used instead of the WHMCS module. Is anyone using this with success? Did the new module resolve all the problems reported prior to its release? Alternatively, if anyone has developed a module for GoCardless, i'd be interested and willing to pay for it! Thanks in advance.

Just one thing to note, the fact that the AES_ENCRYPT post made it to your database does indicate that your mod_security rules might not be working - assuming that you have a current set such as the Atomicorp Gotroot set

At the point where the client account in WHMCS is being created, it is impossible to know if that new client is going to pay as they need the client account in order to pay the invoice generated for the services they are ordering.

I installed the 5.2.12 incremental patch straight on to my 5.2.10 install and have not experienced this problem.

Wouldn't it be easier to submit the ip addresses that we know came from an attempted hack? It would be more useful to see a list of perpetrator ip addresses than a list of poster ip addresses.

The "Atomicorp Realtime Gotroot" rules are a great place to start if you are currently not using a live rule feed.

Can I suggest that security updates alerts are sent by SMS? When vulnerabilities are made public, time is of the essence. I'd rest more easily knowing that if there was an update, I'd get an SMS to my mobile. I find I'm checking my email more often than usual (and these forums) in an attempt to stay as secure as possible. No doubt these troubled times will pass, and WHMCS will be more secure as a result of the focus placed upon it, but in the meantime SMS updates or alerts would be a godsend.

I *almost* did this. I wouldn't be surprised if many others have done so to. I missed 5.2.11, saw the update for 5.2.12 and at the bottom of the page 5.1.13 was mentioned, had to look more than twice, was wondering where 5.2.13 could be found.

I'd recommend looking through your apache access logs for all pages access requests to "configuration.php", also you may find the value passed to 'c' will be present as a "POST" to this file. This might provide further clues as to what may have been executed as PHP through this file.

Did the client pay using paypal, initially a valid payment caused the order to complete, then the payment was detected as fraud by paypal and they retracted it from you? I'd check to see if the payment succeeded, even if only for a few moments, it would be enough to validate the order.

Great tips... Also consider.... 1) rename the 'admin' folder to something else (change it back temporarily before upgrades/updates) 2) use .htaccess authentication to restrict access to the 'admin' folder 3) protect 'admin' folder further by restricting access to subset of authorised IP addresses (where possible) Just my 2c.

I'm glad the patches are released so quickly, it could be much worse.

Just updated to 5.2.10, hadn't even had time to find the bugs in 5.2.9 yet. Anyone following this thread, please be sure to check out the latest security update for 5.1 and 5.2 products: http://blog.whmcs.com/?t=80298

It's quite unnerving to find attempted hacks, even though you are covered. Luckily i've not had any attempted hacks yet, i'm not sure how the hackers are finding WHMCS installs to hack. I am using the "unbranded" version, so i'm not sure if that takes me off the radar a little for hackers performing basic google searches for WHMCS installations.

I used my own self-developed billing and provisioning system for years, as the business grew the maintenance increased as I needed to add more and more features to keep up with the competition. It wasn't long before I was more developer than business manager. After 8 years I considered a pre-packaged system, I found WHMCS. 18 months later, I took the plunge - and have not regretted it at all. Anything WHMCS does not do you can code yourself and integrate using the built in action hooks. WHMCS does everything you need to start up and it also does a whole load of things you do not realise you need. Why re-invent the wheel? If I was starting from scratch I would not hesitate to start with WHMCS. Good luck!

You should get a 403 error, it should not go through to your site - otherwise the rule is not working.