gPowerHost Posted October 25, 2013 Share Posted October 25, 2013 Earlier today Matt posted http://blog.whmcs.com/security.php?t=80587 recommending that we de-select the "Enable Mass Payment" checkbox in Setup > General Settings > Invoices. Then a patch was released. But the explanation of the quickly following patch says nothing about Mass Payments. It lists many other things. Is this still an open issue, or has the patch v5.2.12 and I assume v5.1.13 resolved the Mass Payments vulnerability definitively? Also, it would be nice if these notices were pushed to the admin area. My WHMCS News Feed's latest message is from Friday, October 18th, 2013. Isn't this the fastest and most direct way to get the word out? 0 Quote Link to comment Share on other sites More sharing options...
vincent1 Posted October 25, 2013 Share Posted October 25, 2013 Indeed, I'd also like to know if the patch still requires we deselect mass payment option? Thanks 0 Quote Link to comment Share on other sites More sharing options...
sohouk Posted October 25, 2013 Share Posted October 25, 2013 I think it is essential that such information is pushed to the Admin area. We don't use Facebook or Twitter and I've only read the blog because it was mentioned here. I never usually visit it assuming (wrongly) it comes through to the admin home screen. Putting it in a place where everyone goes seems much more sensible rather than relying on a client checking the blog daily and providing two other methods that some don't use. Trevor 0 Quote Link to comment Share on other sites More sharing options...
Infopro Posted October 25, 2013 Share Posted October 25, 2013 You can also Subscribe to the Announcements Forum and get daily email notifications. To do that, click thru here: News & Announcements Subscription Settings - WHMCS Forums 0 Quote Link to comment Share on other sites More sharing options...
vincent1 Posted October 25, 2013 Share Posted October 25, 2013 I have added htaccess password for my /admin/ will that stop the current vulnerability? Thanks 0 Quote Link to comment Share on other sites More sharing options...
Infopro Posted October 25, 2013 Share Posted October 25, 2013 I have added htaccess password for my /admin/will that stop the current vulnerability? Thanks Have you read any of this page at all? Further Security Steps - WHMCS Documentation 0 Quote Link to comment Share on other sites More sharing options...
brian! Posted October 25, 2013 Share Posted October 25, 2013 I think it is essential that such information is pushed to the Admin area.We don't use Facebook or Twitter and I've only read the blog because it was mentioned here. I never usually visit it assuming (wrongly) it comes through to the admin home screen. Putting it in a place where everyone goes seems much more sensible rather than relying on a client checking the blog daily and providing two other methods that some don't use. it was suggested in another thread to subscribe to IFTTT.com and using the recipe from below, you will receive an email whenever a post is made to the whmcs blog - though in my case, i've set it up only to send an email when a post is made in the WHMCS security blog. I can tell you that I received emails from IFTTT long before I received an email from WHMCS - so it is worth considering. http://forum.whmcs.com/showthread.php?80622-How-to-Receive-an-Instant-Email-whenever-WHMCS-adds-a-new-blog-post I don't think subscribing to the News & Announcements thread is worthwhile as you will only receive an update daily (24 hours could be a long time when it comes to security updates!), and also not all blog posts are posted there. 0 Quote Link to comment Share on other sites More sharing options...
Blueberry3.14 Posted October 25, 2013 Share Posted October 25, 2013 You can also Subscribe to the Announcements Forum and get daily email notifications. To do that, click thru here:News & Announcements Subscription Settings - WHMCS Forums That would be an excellent idea, except that there's absolutely nothing in the News & Announcements forum about this latest issue/exploit. The last post in there is from Matt on 10/18/13, regarding the 2nd of (so far) 3 exploits this month. Communication has always been a weak point with WHMCS. 0 Quote Link to comment Share on other sites More sharing options...
ffeingol Posted October 25, 2013 Share Posted October 25, 2013 it was suggested in another thread to subscribe to IFTTT.com [snip] GMTA. I had dome the exact same thing except it goes to my pushover account as a high priority alert, so it pushes to my phone etc. 0 Quote Link to comment Share on other sites More sharing options...
Infopro Posted October 25, 2013 Share Posted October 25, 2013 That would be an excellent idea, except that there's absolutely nothing in the News & Announcements forum about this latest issue/exploit. The last post in there is from Matt on 10/18/13, regarding the 2nd of (so far) 3 exploits this month. Communication has always been a weak point with WHMCS. I believe the posts on the blog are to reflect the posts in the Announcements forum at all times. I look into this and make it happen. 0 Quote Link to comment Share on other sites More sharing options...
Blueberry3.14 Posted October 25, 2013 Share Posted October 25, 2013 I think it is essential that such information is pushed to the Admin area.We don't use Facebook or Twitter and I've only read the blog because it was mentioned here. I never usually visit it assuming (wrongly) it comes through to the admin home screen. Putting it in a place where everyone goes seems much more sensible rather than relying on a client checking the blog daily and providing two other methods that some don't use. Trevor You can very easily subscribe to the blog via RSS and/or email, and using IFTTT you can set up a means to receive Tweets. You can get their Facebook page updates through RSS also. There are ways to receive the information, assuming the information IS made available. Many companies/vendors/etc post status and security updates through Twitter, Facebook, the company blog... social media is pretty much the means for information any more, and easier to receive for most people than email (email can be blocked, etc). I don't mean to lecture you, but you do your company a disservice if you don't monitor Facebook and Twitter. Not saying you have to be logged in and refresh the pages...both have options to be notified when a post/tweet is made, and you can get an email notification from that if you configure it so. On Facebook hit "like" then "get notifications" (then set up Facebook to email you if you like). RSS can go to your phone, Facebook notifications as well, same with Twitter. There ARE ways (again, assuming the information is put out there to begin with, which is MY biggest complaint about WHMCS). As for having the information pushed to the admin area, that functionality is already there (though it's not working, at least not on 5.1.13 for me). One of the available admin area widgets is "WHMCS News Feed." http://docs.whmcs.com/Widgets "WHMCS News Feed - All the latest news & updates from WHMCS straight to your WHMCS dashboard." It just needs to be enabled for the admin account you login under, if it's not already. However, it also doesn't seem to be configured correctly from the source (or at least it's not working for me, I'm re-downloading ALL 5.1.x files to make sure). The widget pulls the news from this page: http://www.whmcs.com/feeds/news.php (which the blog feed, and was last updated 10/18/13), yet it's not displaying correctly in my admin area (although the "Follow us on Twitter" link is, so the widget is OK, but the source feed is screwed up). - - - Updated - - - I believe the posts on the blog are to reflect the posts in the Announcements forum at all times. I look into this and make it happen. It is; the last post (blog and forum announcements) about any security issue was 10/18/13, 7 days ago. There's also the whmcs_news widget for the admin area, but as I just posted about (in reply to another user in this thread) that seems to be broken. I'm making sure it's not a problem on my side by re-downloading all the files for my version. - - - Updated - - - GMTA. I had dome the exact same thing except it goes to my pushover account as a high priority alert, so it pushes to my phone etc. RSS still works, too. Notifications to your phone and all that. 0 Quote Link to comment Share on other sites More sharing options...
Blueberry3.14 Posted October 25, 2013 Share Posted October 25, 2013 Oops..Nevermind. All my replies got merged into one reply. I'm still not used to that, though it's a good feature. 0 Quote Link to comment Share on other sites More sharing options...
zomex Posted October 26, 2013 Share Posted October 26, 2013 I think it is essential that such information is pushed to the Admin area.We don't use Facebook or Twitter and I've only read the blog because it was mentioned here. I never usually visit it assuming (wrongly) it comes through to the admin home screen. Putting it in a place where everyone goes seems much more sensible rather than relying on a client checking the blog daily and providing two other methods that some don't use. Trevor I completely agree. I'm very disappointed that this is the first I've heard of this recommendation. All data in the admin panel is very old, seeing as all of us login to our admin panel daily it makes sense to use this area to notify users first. 0 Quote Link to comment Share on other sites More sharing options...
vincent1 Posted October 26, 2013 Share Posted October 26, 2013 Not really that useful to me, as the hacker changed admin login so I was locked out until I changed via phpMyAdmin 0 Quote Link to comment Share on other sites More sharing options...
gPowerHost Posted October 28, 2013 Author Share Posted October 28, 2013 OK well we still have Mass Payments disabled. I guess they have no idea if it is safe to turn it back on. 0 Quote Link to comment Share on other sites More sharing options...
gPowerHost Posted October 28, 2013 Author Share Posted October 28, 2013 (edited) While I'm not pleased with the hackers, annoyed with all of the competitive nay sayers I'm also not pleased with the WHMCS meek behavior. You seem unwilling to use the tools you have to push information out quickly. Yes of course I have rss, but WHMCS is very lazy and indecisive when it comes to how to get the info out. Stop being afraid of what people will think. Really! If you have to release an update daily do so. And use your ability to push the notification out. Otherwise, your coy behavior forces us to scour the internet looking for the latest news. Because we think you are too afraid to be upfront often enough. Take control and start informing us! Stop being afraid of what we will think. If your patch breaks things, like the last one did (credit card captures), correct it the next day. I am getting sick of WHMCS forcing me to go read the lengthy WHT forums because you will not be straight forward. If your PR people are telling you to be silent fire them! Repeat fire them! If you pushed good info out twice daily to the cart you could easily take control and prevent us from waisting our time wondering if the RSS is broken, or if you decided to post elsewhere this time. Or if you are too afraid of the backlash. Do you think all of your customers are stupid and can't think for themselves? We know when nay sayers take a valid point and twist it. But you are the ones forcing us to go read that dribble! All the best, and waiting for you to take control of your company and start leading yourselves, and us out of this mess. Edited October 28, 2013 by gPowerHost spelling 0 Quote Link to comment Share on other sites More sharing options...
PWPH Posted October 28, 2013 Share Posted October 28, 2013 (edited) OK well we still have Mass Payments disabled. I guess they have no idea if it is safe to turn it back on. I'm amazed how many times that question has been over looked by the WHMCS staff, I have seen it mentioned in 4 threads or more and staff have even posted in those threads but not one single staff member has answered that question. Quite sad in my opinion! Edited October 28, 2013 by PWPH 0 Quote Link to comment Share on other sites More sharing options...
WHMCS Chris Posted October 28, 2013 Share Posted October 28, 2013 OK well we still have Mass Payments disabled. I guess they have no idea if it is safe to turn it back on. Hello Kendal, If you're running 5.2.12, it is safe to re-enable Mass Payments. It is related to the first descriptor in the blog for 5.2.12: http://blog.whmcs.com/?t=80615 Regards, and I apologize for any inconvenience this may have caused. 0 Quote Link to comment Share on other sites More sharing options...
gPowerHost Posted October 29, 2013 Author Share Posted October 29, 2013 Hello Kendal,If you're running 5.2.12, it is safe to re-enable Mass Payments. It is related to the first descriptor in the blog for 5.2.12: http://blog.whmcs.com/?t=80615 Regards, and I apologize for any inconvenience this may have caused. Thanks for the update. 0 Quote Link to comment Share on other sites More sharing options...
WHMCS Chris Posted October 29, 2013 Share Posted October 29, 2013 You're welcome - I apologize for the delay. In the future, please feel free to submit a ticket if you have a question. That's what we're there for 0 Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.