WorldWideWebDev

Ive sent you an email,, Cheers Anthony

All good now, Created a ticket just explaining the message i was getting and they rectified the problem straight away.

After the patch 5.213. You are using an Owned License for which the support & updates validity period expired before this release. Therefore in order to use this version of WHMCS, you first need to renew your support & updates access. You can do this from our client area @ www.whmcs.com/members/clientarea.php If you feel this message to be an error, please contact us @www.whmcs.com/get-support Got a new license key? Click here to enter it Yet An active support and updates package is not required for security patches. If you're seeing an error please open a ticket and our support team will be able to assist you. And to clarify you should update either to 5.1.14 *OR* 5.2.13 (the latest). There is no 5.2.14 version, and there is only 1 patch for each version. I'm seeing a lot of people applying either both patches, or the one that doesn't apply to their version, leading to problems. Matt

It would be a great idea to have a shame list of all hack attempt IP addresses. A shame list if you wish!

Does anyone have an answer to this question? If i have lost my mobile, have a new phone and don't have the backup key, how do i run the initial install again to get the scan code on the screen? It seems i can set it up for a new user , but anyone already using an Oath code can't go back and repeat the setup??

Instant like to this place. I also like the url for more info https://ifttt.com/wtf .. Thanks guys,, useful site.

The idea behind it was that if anyone has a WHMCS log (most of Us) with an attack IP, Id's of persons who have run scripts, changed details etc, has a suspicious gmail accounts with in your billing installations, we could compare to see if they are here. But from answers on this post, if i was suspicious i now know i could always just ask the admins to check if someone has joined with a certain email address. Example, i got hacked by kandyug@gmail.com and had scripts run by tested@gmail.com . If these guys have been registered here, it would be interesting . Dont know what the hell we could do, but, anyway..cheers

I would like to see or be able to reveal the IP address of the person when posting in the forums. Somehow i recall in the past in other forums that my ip address was listed below my comments. No problem with me. I wonder how many ip addresses would coincide with some strange behavious in WHMCS logs??? Go for it, open discussion...

Hey, Vec, i get it, you're just a pain in the Butt. There really is nothing else that interest you apart from getting people fired up on the forums..lol

Just out of curiosity what has IOS7 Junk got to do with WHMCS CODE?

Bitching in business doesn't make you rich. Hard work and care does. Substandard products destroy business. .. Bitching about the bitching adds to the bitching.. and doesn't get anyone anywhere. Actually thats like listening to the radio and complaining you don't like the program.. Im sure there is a dial on a radio. Uhm

Here's my Cents worth, Not ten.. Everyone here seems to an extent nonchalant and blasé about these security risks. Damo "If you're that unhappy then vote with your feet and find another system" its not always that easy. And if you know of one thats fantastic, please let us know.. I move on. WHMCS patches seem to have been knee jerk reactions all along. To think that some of us have critical business information, Credit details, domain passwords, hosting information and passwords, pay pal info and personal client details. Who here is angry about this? I sure am and everyone should be. How can any of us be to any extent accepting that this information, details, phone numbers whatever can get out? Wake up, this is serious stuff. And ill tell you what, if my host got hacked and leaked my information out, there would be some serious repercussions. Now tell me, how many people on this forum are here to play with a stupid failing WHMCS who don't care and on the other hand, how many are running legitimate business who thought they had a good product and have been shocked, scared and let down? I'd guess the blasé ones are here for the fun and the angry ones have something to lose. How many people here actually feel safe?? That should be the question and how many of your customers are safe? If only one of these stupid hackers gets in to a small business and defaces, scams email and clocks up some expenses against Registrars and ourselves , who pays? THERE IS A LOT MORE AT STAKE HERE than some people wish to admit. If banks cant get their **************** together with all the millions they spend, what hope have we?The hackers are only going to get better at what they do, the situation is only going to get worse. Wanna bet on that?

Dr Mckay, wish i had of found this before i had payed for it... Thanks.. i will keep your number for future use....Cheers

I learnt this the hard way and had to redo all of my setup every time there is a major update, and lately that is a ridiculous amount of times. Then i realised. When uploading the new files into your WHMCS directory your FTP program may ask you a question. (depending on your preset settings) It may prompt you with " there is already a folder named "BLA BLA" in this directory , if you continue , all contents of this folder will be overwritten" Then you have a choice "Continue" or Merge Folders" On the first few occasions I did choose continue and found everything lost to a standard install. Grrrrrr. Then i tried Merge on subsequent installations / patches. When choosing "Merge" i then get prompted that there is a file named "Bla Bla' in the current folder, If you continue that file will be replaced with the new file " This time i chose "Continue" to overwrite the file. This scenario prompts you to overwrite existing files which is ok, because WHMCS updates do not include your custom theme or add ons etc. So a merge will prompt you to overwrite current files, even in the themes folder, which is the Blend theme, V4 etc but not the Say "My host" RackHost' ThemeForest" folders because the update does not include these. Therefore it leaves the custom folder alone and i ended up with my themes and add ons still intact after the update. One thing it does overwrite in this second scenario is the custom logos, Invoice logo etc. Again, because update include these logos and they are always overwritten. We create our own logos by uploading a logo and calling it by the same name, not by choosing a logo. So a full backup is always handy to have so that when you find an item has changed a quick upload of the old backup item gets you going quickly. Hope this makes sense , cheers.

Do this, it stuffs them after they have taken the time to sign up, go through using the two factor authentication, etc etc Make sure you have been to General Settings / Other and tick the boxes that prevents clients from changing their own details. [TABLE=class: form, width: 100%] [TR] [TD=class: fieldlabel, align: right]Locked Client Profile Fields[/TD] [TD=class: fieldarea, bgcolor: #EFEFEF, align: left]Select any fields below that you want to prevent clients being able to edit from the client area: [TABLE=width: 100%] [TR] [TD=width: 25%] First Name[/TD] [TD=width: 25%] Last Name[/TD] [TD=width: 25%] Company Name[/TD] [TD=width: 25%] Email Address[/TD] [/TR] [TR] [TD=width: 25%] Address 1[/TD] [TD=width: 25%] Address 2[/TD] [TD=width: 25%] City[/TD] [TD=width: 25%] State/Region[/TD] [/TR] [TR] [TD=width: 25%] Postcode[/TD] [TD=width: 25%] Country[/TD] [TD=width: 25%] Phone Number[/TD] [/TR] [/TABLE] [/TD] [/TR] [/TABLE] I guess you can let them change their phone number.. That outta give them the irrates!

I sympathise and admit i dont feel to secure at the moment, and after investing years in time, money on add-ons and getting it the way i liked i am now faced with the prospect of WTF do i do? Not a good feeling.....

http://www.whmcs.com/services/ We offer a range of services to aid your WHMCS experience. [h=2]Installation[/h]We offer various setup & assistance services to help you get up & running with WHMCS, or to have a check-up on an existing installation. Installation services start from just $24.95. Find out more

just got the email. WHMCS has released new patches for the 5.2 and 5.1 minor releases. These updates provide targeted changes to address security concerns with the WHMCS product. You are highly encouraged to update immediately.

Mine did not.. Maybe someone tried something?

I like his styles and a prayer to boot.. [TABLE=width: 100%] [TR] [TD]psalm91 Web Hosting Guru [/TD] [/TR] [/TABLE] [TABLE=class: tborder, width: 100%, align: center] [TR] [TD=class: alt2, bgcolor: #FAFAFA][TABLE=width: 100%] [TR] [TD][/TD] [TD=width: 100%]Screen capture this ! __________________ Treat your password like your toothbrush. Don't let anybody else use it, and get a new one every six months.Sancte Michael Archangele, defende nos in proelio, contra nequitiam et insidias diaboli esto praesidium. Imperet illi Deus, supplices deprecamur: tuque, Princeps militiae coelestis, Satanam aliosque spiritus malignos, qui ad perditionem animarum pervagantur in mundo, divina virtute, in infernum detrude. Amen [/TD] [TD][/TD] [/TR] [/TABLE] [/TD] [/TR] [TR] [TD=class: alt1, bgcolor: #EFEFEF][/TD] [/TR] [/TABLE]

Hi Zomex, it doesnt appear to cause any issue other than show up in logs, but im a bit paranoid of late... Index.php in every folder. Simple and effective.. I cant view any tpl files through internet explorer, it just shows a blank. Thats why i thought it may be some sort of hack from within WHMCS.. I had a look in the directory , the .tpl file in this template did not exist. I looked at the original custom template which i purchased to see, but this template never had a clientareasecurity.tpl. I looked at the default template to see if this had its own clientareasecurity.tpl and it did , so i have copied the tpl file and placed it in my custom RackHost template folder. (And hope to a higher power it doesn't cause more problems and the log error disappears. ) Bear, i have to look into this .htaccess file a bit more. I have not set one up but it seems its the way to go. Thanks for the tip guys, i have plenty to do... Cheers

Its time to go DEFCON 5......

Hi neilstudy. no i haven't done what you mentioned. Where can i get info about doing that. That seems like one way of locking it up..

The last two clients ive had join up have done so with questionable names and contact information. when i check the logs the reveal this :- 17/10/2013 20:18 Smarty Error: unable to read resource: "/var/www/vhosts/worldwidewebs.com.au/httpdocs/billing/templates/RackHost/clientareasecurity.tpl" Client 119.18.155.82 The other client was :- 11/10/2013 05:13 Smarty Error: unable to read resource: "/var/www/vhosts/worldwidewebs.com.au/httpdocs/billing/templates/RackHost/clientareasecurity.tpl" Client 41.107.107.69 11/10/2013 05:13 Smarty Error: unable to read resource: "/var/www/vhosts/worldwidewebs.com.au/httpdocs/billing/templates/RackHost/clientareasecurity.tpl" Client 41.107.107.69 11/10/2013 05:03 Smarty Error: unable to read resource: "/var/www/vhosts/worldwidewebs.com.au/httpdocs/billing/templates/RackHost/clientareasecurity.tpl" Client 178.32.244.27 What are they doing to come up with this error and does anyone know if its an issue??

That is really strange. I think you need to check the logs and verify whats happened and alert support. ASAP..