vincent_g

If your selling web design they will need to create an account without buying anything. After all we need to give them a proposal don't we? Lets have a proper system where we don't have people spamming the system. I'm also working on Cpanel - pushing them to try and fix the email alias / forwarder. This is a different issue. The problem with that is it forwards spam, emails from known bad senders. I have asked Google Gmail if the email addresses are real - if not then there is no way to block emails from such senders. Still waiting for a reply from Gmail Would be nice if we had support on issues like these

The email address was valid but this is what was entered In addition I received no email of this account being created. Client info First name: Invest $ 8962 and get $ 5645 every month: https://earn-2btc-per-day.blogspot.nl?l=79 Last Name: Invest $ 8962 and get $ 5645 every month: https://earn-2btc-per-day.blogspot.nl?l=79 Company Name: Invest $ 8962 and get $ 5645 every month: https://earn-2btc-per-day.blogspot.nl?l=79 Email address: anja.zinke@gmx.de Every entry will have the same line entered on all other inputs If you can enter this what else can be entered I wonder?

When you have /members/register.php available to the public to register as a new client the form does not check if the email address is an email address. How can that be? I had two new clients entered into the system which were nothing but spam. Every line was a spam containing a URL What else can be entered I wonder if that was possible?

You answer is outdated which is from the current documentation. Have you seen the new API screens in WHM? Account Summary acct-summary Initial Privileges Basic System Information basic-system-info Basic WHM Functions basic-whm-functions Allow CORS HTTP Requests cors-proxy-get Perform cPanel API and UAPI functions through the WHM API cpanel-api Manage cPanel Integration Links cpanel-integration Create User Session create-user-session Digest Authentication digest-auth Generate Mobile Email Configurations generate-email-config List Packages list-pkgs Manage API Tokens manage-api-tokens Manage DNS Records manage-dns-records Manage OpenID Connect manage-oidc Manage Styles manage-styles MySQL Information mysql-info Nameserver Configuration ns-config Public Contact Information public-contact SSL Information ssl-info Account Information Standard Privileges List Accounts list-accts View Account Bandwidth Usage show-bandwidth Account Management Standard Privileges Create Accounts create-acct Terminate Accounts kill-acct Suspend/Unsuspend Accounts suspend-acct Upgrade/Downgrade Accounts upgrade-account SSL Site Management ssl Purchase SSL Certificates ssl-buy SSL CSR/Certificate Generator ssl-gencrt Edit MX Entries edit-mx Change Passwords passwd File and Directory Restoration file-restore DNS Standard Privileges Add DNS Zones create-dns Remove DNS Zones kill-dns Park DNS Zones park-dns Edit DNS Zones edit-dns Packages Standard Privileges Add/Remove Packages add-pkg Edit Packages edit-pkg Third-Party Services Standard Privileges Manage Third-Party Services thirdparty Troubleshooting Standard Privileges Troubleshoot Mail Delivery mailcheck cPanel Management Standard Privileges News Modification news Accounts Package Privileges Allow Creation of Accounts with Shell Access allow-shell Package Access Package Privileges Use Root Packages viewglobalpackages Reseller-specific packages contain a “_” in their name, but root packages do not contain a “_”. Package Creation Package Privileges Create Packages with Addon Domains allow-addoncreate Create Packages with Parked (Alias) Domains allow-parkedcreate Create Packages with a Dedicated IP Address add-pkg-ip Create Packages with Shell Access add-pkg-shell Create Packages with Unlimited Features (for example, email accounts) allow-unlimited-pkgs Create Packages with Custom Email Limits allow-emaillimits-pkgs Create Packages with Unlimited Disk Usage allow-unlimited-disk-pkgs Create Packages with Unlimited Bandwidth allow-unlimited-bw-pkgs Third Party Services Additional Software ConfigServer Security & Firewall (Reseller UI) software-ConfigServer-csf Server Information Global Privileges View Server Status status View Server Information stats Services Global Privileges Restart Services restart Troubleshooting Global Privileges Resynchronize FTP Passwords resftp Account Management Super Privileges Account Modification edit-account Bandwidth Limit Modification limit-bandwidth Quota Modification quota Set an Account to be a Demo Account demo-setup Advanced Account Management Super Privileges Rearrange Accounts rearrange-accts Use this to optimize disk usage across disk drives. Clustering Super Privileges DNS Clustering clustering Locales Super Privileges Modify & Create Locales locale-edit Everything Root Access All Features all Track Email track-email That is the features that you can enable or disable. Please don't show me something that is outdated and tell me what is currently the settings recommended based on new API WHM has created.

Cpanel has changed the API but WHMCS has not updated it's documentation not have they posted a update to the new API settings in WHM. And this new API has a lot of settings that need to be checked in order to work with WHMCS. So my question is what is the recommended settings for WHM? We can give all which may not be so secure. Everything works fine with that. I'm sure giving everything is not needed so what is all that we need without having something in WHMCS error due to API setting not being checked off. I think it's about time WHMCS puts out documentation for it.

Not quite You need to set all privileges - true and it shouldn't be Also the package must be matching assigned to the account in whm must be the one set in the product / module settings in WHMCS So someone didn't think this out it seems. If a reseller is allowed to manage his own account - he's the account owner then he may change the package to one of his own choice. If this happens and a reseller changes his package then WHMCS fails!!! Why would you tie this to the package name?????

Anyone have a clue as to why the table structure from the supplied install.sql supplied with whmcs_v710_full is not correct? There are several tables that don't match what should be there. It in fact matches the install.sql supplied with whmcs_v503_stable.zip Can this be explained as to why this very old SQL script is coming with this new version and is absent all the upgrade scripts?

On the create table sql script ( install sql ) I see `urlforwarding` text COLLATE utf8_unicode_ci NOT NULL, `emailforwarding` text COLLATE utf8_unicode_ci NOT NULL, going way back urlforwarding was changed to dnsmanagement Upgrade340 ALTER TABLE `tbldomains` CHANGE `urlforwarding` `dnsmanagement` TEXT NOT NULL ; First question is which is it `urlforwarding` or `dnsmanagement` ( I believe it's `dnsmanagement` ) Second question is Why TEXT! If I'm not mistaken these are check box entry fields which are either 1 or 0, true or false, yes or no So why change them to TEXT which is way more space than this setting would ever need. From what I see there is not enough attention paid to the tables. As I look through mine I find columns that are not in the create table scripts I find columns that are missing. Is it possible the SQL script with latest version is wrong - not creating the latest versions of the tables Since the software runs with no problems were these missing columns really needed? Since the database has always been upgraded version to version wouldn't it be wise to remove columns no longer needed?

When you try to do things cheaply you pay a price for it eventually. These licenses issued by hosts for resellers are not a good idea as you have to rely on the host to pay their bill! Also they could move your site and disrupt your license by changing the IP. Calpop Went out of business - which host are you so sure of that will stay in business? I have had no problems with WHMCS since version 381 Have a owned license and never had a problem.

I posted a new topic on this same issue as I didn't see your post. This same thing happened to me. I think this clue of %5B0%5D maybe the answer. How did &domains= become &domains%5B0%5D= ? Do you see the same string in your SSL logs? That is what causes the problem as I tested it and it works. I suggest the programming team check this for proper filtering of the domain GET variable

How did it happen is the question? I tried to place the same order and could not either from the main order page to trying it as a client that has login to system. The order came in with this in the string &domains%5B0%5D= I think there is a problem here as this tells me the domains variable may not be filtered proper.

I am surprised that after so many years WHMCS has not added this feature. When setting the price for a domain one has to calculate the price for each number of years set. So one will have to add lets say 12.99 for first year and 25.98 for the second and so on. When will WHMCS place the Javascript code to automate this on that screen? Very simple - set the price for each based on first price and multiply it by number of years. For each currency repeat. It's easy to do. Can be done and fully tested in one hour of less by your programmers. Imagine someone has 5 currencies to deal with. Does he really have to spend a better part of his or her life typing the price for each year term? It's simple to add - on each domain a checkbox next to the year term and a button to update. Click the button and it fills in the price for each number year that has been checked. Vincent G.

Tried to set it to 995 as 110 is not valid for secure pop3 Can't be done it seems. Will we have a patch for this soon? The problem looks to be within serverstatus.php

In my case it was a line in the config file session_name("WHMCS"); Removing the line fixed the problem. I have had that file unchanged going back to version 3.8.1

So far this is not been a fun upgrade. Tech support tells me that these two settings should be set to off. session.cookie_httponly = 0 session.use_only_cookies = 0 So I put a ini file in the admin folder to set this. From my research this does not sound right to me that this should be a problem as these values default to true in PHP and Cpanel installs. These settings were created by PHP to add security when enabled! So why would this be required to false now? And if this is required to be set to false what folder does this script run in?

I can not login either and am not using 2fa I tried the patch anyway to no avail. What's up with this upgrade?

that didn't work for me - I can not login with 5.3.9 From what I see it altered the admin table thus to go back you have to restore the old admin table. I was not aware this upgrade would have altered the database

Since updating to newest version the template Comparison has problems The domain checking doesn't work! When I choose hosting package no matter which type of domain option I choose I get an error for TLD Checked the files and they are same as what came in the whmcs_v512.zip file. Other Order Templates work fine. Is there something else missing??

Sounds to me like this person just has had charge back problems or something of that sort. From what your saying I bet this also caused a bank fee due to funds being low. Yes it's enough to get you angry but sounds like you are on a crusade. Not worth it - move on and try to work within the system which is slanted towards the banks but such is life. If a card is reversed the amount plus a fee is charged to your account and yes they take the money from your checking account. Any charge will be taken from your checking account no matter who you use. I don't hear a ligit complaint here but if you want to fight the banks then support getting Rid of the Fed.

First thing to do is be sure it's a real client. Maxmind is quite helpful with this although you do get false positives. When in doubt call the client. Since Enom has changed their policy that makes all sales final - taking an order is a gamble as if your client is ligit and he decides to cancel you well maybe stuck with the domain. If the card used is fraud then your stuck - no way out. I don't care about refunding the hosting fees as is nothing lost but time. The domain isn't too costly but it's not fun to loose. Either Paypal or Credit Cards are pretty much the same story. Some have it worse - Gold dealers for instance get stuck for around $1600 on a 1 oz. gold coin when the client reverses the charge. That hurts big time.

SFTP requires Shell access To prevent a user from seeing others you need to have jail shell access set I don't allow shell access by any users and to prevent all from having access - even the at the data center

I said I was not effected on a prior post. I was not effected because I run my own servers and they are secure. I run the latest versions of the software and always apply the latest patches. By the way the latest dbconnect patch is the second time this file was patched. Yes Mod Security does block that hack attempt as it's how I learned about it. Is it fixed is the question. This is why you have problems - well Mod Security blocks it so who cares if the problem is still there. I care! - there is no room for mistakes else you have an event such as the one we just seen.

Does anyone know anything about this hack? Was it a version 4 hack or version 5 hack? I didn't see any patches for it. [old exploit removed] It displays the content of the config file. There are videos on youtube about it showing how easy it is to dispay this info. So you get a new client sign up for hosting and he is on the same server as your billing system. Now he has your database and your encrypt string. Was this fixed???

I was not effected by this major problem that took place this past week. But having read the news I have to say Hostgator did make a major mistake. They should not have given out any info without first checking with Matt This is a major mistake - My server company ( Calpop ) would not make such a mistake. The major fault here belongs to Hostgator http://www.scmagazine.com.au/News/301773,thousands-affected-in-billing-cloud-breach.aspx As to how this person got the other security questions correct is not of any importance. Yes this is an additional security problem but the purpose of security is to trip up a hacker. If he had six parts of the security answers correct and was missing one - he was still missing one!!! You don't give him the one part he doesn't have with out getting conformation from the person in charge. So now that the damage is done it's time to find out where we can improve things. As to those hosts that have been effected - you have just experienced a major learning experience. Do not leave your passwords unchanged after requesting help via any help desk. If you were using a hosted billing solution - well - sometimes saving money can cost. One thing I am not too happy with with WHMCS is their new marketing idea which winds up giving large hosting companies an unfair advantage on smaller ones as I now see hosting companies giving away WHMCS with reseller accounts. As this software falls into more hands for small fees the possibility of hackers will increase. This allows them to have hands on access to try and find holes in it. I believe it's a really bad idea - might be a good marketing scheme but long term it's not very good. Vincent G. CW3 Web Hosting

Seems that version 5.1 has added this feature From my view point it should just turn off ID Protect if the client wants to remove it. The only sticky point here is if the domain expired you can not turn it off according to Enom. But they claim you can renew the domain only so not sure how this will pan out if we have such a scenario. Or add it at any time should the client want it. Now adding it is another problem as you would need to have a choice under the current version design. Add it right away which would need to be a product or just flip on the setting and update the price which will add it on next renew. My guess is they made some table changes to allow this to be straight forward as to address the payment cycle problem. Last would be to update any invoice created if the client made changes after an invoice was generated. That's were I stopped coding my script when I read the news on version 5.1 I was about to setup a testing site to try out my code which did all of the above. Based on the quality of the application I am sure they will cover all these problems of adding or removing domain addons and am looking forward to version 5.1