webguy2 Posted November 21, 2013 Share Posted November 21, 2013 You give us a security update, because of an error in your coding. Now I am locked out of my admin area unless I pay for an annual "support and updates" fee. New versions with additional features and/or responses to support request...yes, that is worth asking for more money. Problem is....if we don't update, we have a security problem with your application. Not that it changes the situation, but why was I not informed of this before I applied the security patch? This doesn't seem right. 0 Quote Link to comment Share on other sites More sharing options...
NovemberRain Posted November 21, 2013 Share Posted November 21, 2013 This is really ridiculous. They had to provide secure code in the first place and this was not the case with the previous security patches. This looks like a sneaky trick to make us renew the license. 0 Quote Link to comment Share on other sites More sharing options...
webguy2 Posted November 21, 2013 Author Share Posted November 21, 2013 I didn't want to say that, but really... I already paid for a product that is suppose to work and be secure. We are handling financial transactions here. Apparently rolling back isn't an option either. 0 Quote Link to comment Share on other sites More sharing options...
niels Posted November 21, 2013 Share Posted November 21, 2013 When you buy the product it says "1 year of updates included". Why do you think it says that? How much more clear can they make it? 0 Quote Link to comment Share on other sites More sharing options...
webguy2 Posted November 21, 2013 Author Share Posted November 21, 2013 Updates yes...security fixes, different story. I paid for a program that is suppose to be secure. I didn't make it unsecure... 0 Quote Link to comment Share on other sites More sharing options...
NovemberRain Posted November 21, 2013 Share Posted November 21, 2013 (edited) When you buy the product it says "1 year of updates included". Why do you think it says that? How much more clear can they make it? This is a security patch. They are fixing their insecure code which is their fault. It is not enhancements, new features or support tickets. In that case you would be right. If they want me to renew, they should do it by convincing me it is a solid and secure product. Currently this is not the case with all the recent security flaws and that's why I am not planning to renew and I am looking for other alternatives now. This code should already be secure in the first place. If it is not, they should fix it free! Edited November 21, 2013 by NovemberRain 1 Quote Link to comment Share on other sites More sharing options...
webguy2 Posted November 21, 2013 Author Share Posted November 21, 2013 They are not answering my support tickets... I can't even go back to any version as they are all vulnerable. Security Status Update As you may be aware, a security issue has been published which affects all known versions of WHMCS. We are currently aware of the issue and are working on a software update to prevent this attack vector from being successful. We will be publishing software updates for the versions in Active Development and LTS per our Long Term Support Policy: http://docs.whmcs.com/Long_Term_Support Please keep watch on our blog, facebook and twitter to receive the latest updates. 0 Quote Link to comment Share on other sites More sharing options...
SeanP Posted November 21, 2013 Share Posted November 21, 2013 You don't have to pay for security patches. This was confirmed by Matt on WHT: http://www.webhostingtalk.com/showpost.php?p=8921776&postcount=72 Just put in a ticket for resolution. 0 Quote Link to comment Share on other sites More sharing options...
webguy2 Posted November 21, 2013 Author Share Posted November 21, 2013 Then why am I locked out of the admin area? I submitted a ticket hours ago. I really do like the program and I appreciate the effort I know it takes to create, but this is a PITA, as is having to install the updates/security fixes. (I won't go into how many we've had to do in the past 2 months). I suggest an automated system to remotely update core files, see Joomla or WP. They already have us connecting to their system remotely when we login. Separate security fixes from updates/enhancements. - - - Updated - - - No reply from them yet, but now can login. Thank you. 0 Quote Link to comment Share on other sites More sharing options...
mt247 Posted November 21, 2013 Share Posted November 21, 2013 I am very glad that they are staying on top of security issues and am certainly willing to pay for the service. It's much better than having updates delayed due to lack of staff or funding. -Scott 0 Quote Link to comment Share on other sites More sharing options...
SeanP Posted November 21, 2013 Share Posted November 21, 2013 I wouldn't patch a live production environment without first trying it on a dev install. It would prevent you from being "dead in the water" after applying a patch like this. It's always good to test first (even a quick test), to make sure it doesn't break your specific implementation of the software. Otherwise, you patch, it breaks, then you wait for hours until someone responds to fix it. 0 Quote Link to comment Share on other sites More sharing options...
othellotech Posted November 21, 2013 Share Posted November 21, 2013 I wouldn't patch a live production environment without first trying it on a dev install ^ this cannot be +1'd enough ! 0 Quote Link to comment Share on other sites More sharing options...
openmind Posted November 22, 2013 Share Posted November 22, 2013 So to recap... People are moaning that there are security issues and demand they get fixed WHMCS do the right thing and get a security audit done Users upgrade and moan that they need to pay (god forbid) for the patches/upgrades They then wast time posting on the forum about how terrible their life is They don't run a dev install to make the patch actually works If I was in WHMCSs position I would make any upgrade, security or otherwise part of the support contract. If people can't/won't pay the equivalent of $2 per month to run their business then that is their problem. 2 Quote Link to comment Share on other sites More sharing options...
John M Posted December 14, 2013 Share Posted December 14, 2013 So to recap... People are moaning that there are security issues and demand they get fixed WHMCS do the right thing and get a security audit done Users upgrade and moan that they need to pay (god forbid) for the patches/upgrades They then wast time posting on the forum about how terrible their life is They don't run a dev install to make the patch actually works If I was in WHMCSs position I would make any upgrade, security or otherwise part of the support contract. If people can't/won't pay the equivalent of $2 per month to run their business then that is their problem. Agreed 100 percent. 0 Quote Link to comment Share on other sites More sharing options...
AffordableDomainsCanada Posted December 14, 2013 Share Posted December 14, 2013 (edited) I wouldn't patch a live production environment without first trying it on a dev install. It would prevent you from being "dead in the water" after applying a patch like this. It's always good to test first (even a quick test), to make sure it doesn't break your specific implementation of the software. Otherwise, you patch, it breaks, then you wait for hours until someone responds to fix it. I dont understand this, I used to do this, I have a seperate site dedicated just to the development of my site, - Link Removed, no need for it here - and I can update my site here, apply the patch, and do my testing, but when I do this same process on my live site, I have run into problems! Uploading files, etc.. The best way is to do a FULL backup of your site, then update the live site. If you have any problems, you always have that FULL site backup to fall back on! Testing your update on a dev site is not always a guaranteed problem solver! Edited December 17, 2013 by Infopro Killed Useless Link 0 Quote Link to comment Share on other sites More sharing options...
pRieStaKos Posted December 14, 2013 Share Posted December 14, 2013 This is propably a complaining thread of a user-customer and not a developer. Because u should know that there isnt any script/OS or other app that is fully secured. Everyday a new security hole pops up and new patches/fixes must be made. So, u should always have ways to recovery any problem about your site/app or other online service u got, in case u got problem or a third person causes you. Testing inviroment is a must like backup/restore features. 0 Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.