Chrisw Posted February 5, 2008 Share Posted February 5, 2008 That and remove your server passwords. Pretty easy to obtain those. simple file upload and your toast. Probably not a good idea to allow attachments either. 0 Quote Link to comment Share on other sites More sharing options...
uberhost Posted February 5, 2008 Share Posted February 5, 2008 I'll throw another couple suggestions out there: Change the user name "admin" to something impossible to guess. Do the same for the folder name "admin". A password of 12 or more mixed-case letters with numbers and symbols also helps. Password generator 0 Quote Link to comment Share on other sites More sharing options...
WHMCS CEO Matt Posted February 5, 2008 WHMCS CEO Share Posted February 5, 2008 3.6 will be released later this week. I'd expect it to be some time on Thursday for those who want an exact day So not long now for the impatient ones..! Matt 0 Quote Link to comment Share on other sites More sharing options...
forax Posted February 5, 2008 Share Posted February 5, 2008 That's great Have you implement upcoming Worldpay upgrade on version 3.6 as well? Worldpay is going to upgrade their systems early on 23rd February 2008. 0 Quote Link to comment Share on other sites More sharing options...
bear Posted February 5, 2008 Share Posted February 5, 2008 Yup! You are safer if you change your whmcs url to something other than billing/whmcs, and make sure you remove the powered by whmcs at the bottom. Changing the installation directory's name will only help for a time (security through obscurity), if someone is looking for installations of a script. Plenty of scripts out there to locate other telling info about an application, including spidering for known file names. A recent example for me is a cart script I have on a client's site. Someone has apparently discovered an exploit in the latest version (PHP), and is testing it repeatedly against his version (PERL), where it fails and notifies me that it did. Assuming it was being tried because it hadn't been renamed from the original script, we renamed it. Within a few minutes someone tested the renamed one. As for the "powered by" line...that's only allowed if paid for. I'm sure Matt would have no problem if everyone wanted to purchase the branding free option. Regarding the genuinely impatient people An excellent case for taking away his computer access. That's a heart attack in progress, there... 0 Quote Link to comment Share on other sites More sharing options...
brianoz Posted February 9, 2008 Share Posted February 9, 2008 please wait and test it out first. im tired of updating to the next version only to have the .1 update come out 1 week or 2 later like it always does. take the extra week, work out all the bugs, save us some time.If you're that concerned, one way of dealing with this is to just ignore the first release and wait 2 weeks before installing. I do this before installing most things and it works a treat - most times if there are any serious bugs, they are found and fixed in a release before I get there! I'm sure Matt/WHMCS do what they can to make it reliable, but there will always be bugs found when the product is released to a wider audience, that's just an unavoidable reality with software development. If we all doubled what we paid Matt for our licences he could then afford to spend 2 months testing it before releasing. 0 Quote Link to comment Share on other sites More sharing options...
PPH Posted February 9, 2008 Share Posted February 9, 2008 Actually I would rather see the .1 .2 etc releases as they occur so we know when there are fixes to the initial releases. The silent updates to the download is what gets me. I feel that every time a file is changed in the release, there should be an adjustment to the release #. I don't upgrade to the release on our in use copy until we see the download doesn't change for a week or so Either way we are glad to see Matt so active keeping things tidied up and updated 0 Quote Link to comment Share on other sites More sharing options...
generic Posted February 9, 2008 Share Posted February 9, 2008 If you're that concerned, one way of dealing with this is to just ignore the first release and wait 2 weeks before installing. I do this before installing most things and it works a treat - most times if there are any serious bugs, they are found and fixed in a release before I get there! I'm sure Matt/WHMCS do what they can to make it reliable, but there will always be bugs found when the product is released to a wider audience, that's just an unavoidable reality with software development. If we all doubled what we paid Matt for our licenses he could then afford to spend 2 months testing it before releasing. Really?.. doubt that... anyway... I like WHMCS, I have been a loyal user for a long time. Its the BEST solution. But issues like this are the kind of things that make people begin to look elsewhere. Why do you think we left modernbill, lpanel, etc. for WHMCS in the first place. It was bugs and issues like this that we all got sick of. As far as waiting, I am doing exactly that. I am waiting. Already I see 2-3 new files being released in the forums to fix issues. This release is a security release. It has been suggested we all update. Now the very next day we see several fixed files being released in the forums. So as I see it we have 2 choices. Sit and use a security issue outdated version (as I am doing), or download the latest version and then fix it every time an updated file is released. See my point....... I don't have a solution except to test it out a bit more, or beta it a bit more before a "release" version is distributed. Again i love WHMCS, I really just don't have all the time anymore to check the forums for weeks after a release looking for fixes. 0 Quote Link to comment Share on other sites More sharing options...
MACscr Posted February 9, 2008 Share Posted February 9, 2008 Really?.. doubt that... anyway... I like WHMCS, I have been a loyal user for a long time. Its the BEST solution. But issues like this are the kind of things that make people begin to look elsewhere. Why do you think we left modernbill, lpanel, etc. for WHMCS in the first place. It was bugs and issues like this that we all got sick of. As far as waiting, I am doing exactly that. I am waiting. Already I see 2-3 new files being released in the forums to fix issues. This release is a security release. It has been suggested we all update. Now the very next day we see several fixed files being released in the forums. So as I see it we have 2 choices. Sit and use a security issue outdated version (as I am doing), or download the latest version and then fix it every time an updated file is released. See my point....... I don't have a solution except to test it out a bit more, or beta it a bit more before a "release" version is distributed. Again i love WHMCS, I really just don't have all the time anymore to check the forums for weeks after a release looking for fixes. I agree completely, but I think matt does a pretty good job fixing the bugs right away. I think his only mistake really is by not making an announcement on the forums each time on is found and fixed. And of course changing the version number of th download when this happens. I really dont find it to be that big of a deal as the issues are rarely with template files, so its simply just a overwrite of a php file. I am though starting to rethink how much i want to customize my designs. In the past, i had rewritten 95% of the templates. With releases so often, its a huge pain to update. 0 Quote Link to comment Share on other sites More sharing options...
brianoz Posted February 9, 2008 Share Posted February 9, 2008 But issues like this are the kind of things that make people begin to look elsewhere. Why do you think we left modernbill, lpanel, etc. for WHMCS in the first place. It was bugs and issues like this that we all got sick of.Actually, I left MB not because they had bugs but BECAUSE THEY NEVER FIXED THEM and failed to reply to support tickets. It could't be MORE different here! Good to excellent support, and regular releases - compare MB every 6 - 12 months with WHMCS every 1-2 months. Not even the same ballpark. I do agree though, releases with bugs are a hassle; but most other smaller projects suffer with the same thing. The solution is simple enough - just hold off a little when a new release comes out - wait a week or two, then download and go for it. I also wish Matt would announce fixes to small bugs centrally, would save me some time. 0 Quote Link to comment Share on other sites More sharing options...
uberhost Posted February 10, 2008 Share Posted February 10, 2008 I am though starting to rethink how much i want to customize my designs. In the past, i had rewritten 95% of the templates. With releases so often, its a huge pain to update. Yep, I'm doing fewer template customizations now as well. 0 Quote Link to comment Share on other sites More sharing options...
RPS Posted February 10, 2008 Share Posted February 10, 2008 If you guys want a better/easier way to modify the templates, then WHMCS really needs to include something like this: http://forum.whmcs.com/showthread.php?t=8205 Matt said he would implement it, if the community wanted it. But it didn't get any feedback. This kind of idea will keep template upgrades to a minimum, because you won't have to modify 25 files every time something minor changes. On a side note, it only appears with the 3.6 release, only a handful of files need to be updated. 0 Quote Link to comment Share on other sites More sharing options...
WHMCS CEO Matt Posted February 10, 2008 WHMCS CEO Share Posted February 10, 2008 As someone commented earlier, it's impossible to test every usage scenario so there will always be bugs found in the immediate period after a new release. Every bug is reported in the bug reports forum, and I post once fixed. So there's both an announcement about it and a post when it's fixed. Sometimes the file is included with my post, sometimes not depending on what it is. Regarding template changes, they are always kept to a minimum. Just 8 this time, and 2 of those are optional. Matt 0 Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.