FOSSBilling Files

0.8.7

This release focuses on security hardening and stability, with fixes across domain registration, checkout, invoicing, and email, plus new domain management and caching options.

Users should update as soon as possible as several vulnerabilities have been addressed in this version. If you are using a version older than 0.8.0, you should update immediately.**

🔐 Security

• Hardened the guest signup flow against email address enumeration. (#4234)
• Stopped leaking password hashes and API tokens in staff and client listing responses. (#4203)
• Masked payment gateway and domain registrar secrets in API responses and admin forms. Admins now see a "Configured" badge instead of the raw value, and leaving a field blank keeps the existing secret. (#4205)
• Redacted ResellerClub API credentials from request logs. (#4257)
• Hardened template existence checks against invalid paths. (#4219)
• Stripped install filesystem paths from Sentry stack traces so hosting account names and domains are no longer reported. (#4252)

📈 Enhancements

• Replaced WHOIS domain availability lookups with RDAP, with graceful fallback for the Custom and Email adapters. (#4204)
• Mirrored release archives to Cloudflare R2 so IPv6-only hosts can download updates. (#4255)

➕ New Features

• Added a configurable Redis/Memcached cache backend with an admin cache settings page, Redis TLS support, and per-installation namespace isolation. (#4202, [#4221])
• Added a per-TLD option to require a domain transfer code. (#4200)
• Added a "Sync Now" action to refresh domain status, WHOIS contacts, and dates from the registrar on demand. (#4201)

🐛 Bug Fixes

• Restored Order\Service::assertOrderUsable() so client service endpoints no longer fail with error 9998. (#4190)
• Fixed a checkout TypeError when a gateway left an invoice unpaid. (#4191)
• Fixed ResellerClub reporting registered domains as available for mixed-case lookups. (#4195)
• Fixed ResellerClub crashing on bare-scalar API responses such as true/false. (#4194)
• Fixed ResellerClub whois/contact edits, which failed after ResellerClub deprecated its contacts/modify endpoint. (#4197)
• Added .FR contact type handling to the ResellerClub adapter. (#4208)
• Stopped throttling admin-role client/staff logins under the guest anti-brute-force policy. (#4216)
• Fixed the maintenance page crashing when "hide company public" is enabled. (#4217)
• Prevented a failed public suffix list download from breaking checkout. (#4220)
• Fixed multi-byte UTF-8 corruption in the guest countries response, e.g. "Åland Islands". (#4240)
• Fixed ResellerClub domain renewals failing when the expiration date wasn't cached. (#4230)
• Fixed the "change password" error in the client area. (#4235)
• Allowed subscription renewal invoices for orders in suspended or failed_renew status. (#4242)
• Fixed a Stripe checkout race that could create duplicate customers and fail with an idempotency error, and validated setup-intent metadata before subscribing. (#4245)
• Fixed admin order creation failing when issuing an invoice immediately.
• Fixed orders intermittently failing with "has no active service" due to stale reads after activation.
• Fixed extension activation/deactivation not reliably rebuilding hook listeners on failure.
• Fixed unhandled exceptions on API responses containing invalid UTF-8. (#4254)
• Fixed ResellerClub crashing (and leaking credentials via the resulting error) on a non-JSON API response. (#4254)
• Fell back to the shipped theme settings template when settings_data.json is missing. (#4258)
• Fixed the Massmailer module crashing when sending mail or fetching a test client.

📝 Changes

• Stopped reporting native PHP deprecation notices to Sentry. (#4243)

📦 Dependencies

• Dropped the io-developer/php-whois dependency in favor of RDAP availability checks. (#4204)
• Refreshed PHP and frontend dependencies.