FOSSBilling Files

0.8.9 (2026-10-23)

This patch release hardens authentication, payments, and extension handling, and fixes checkout, invoicing, and domain flows. It includes several security fixes, so users should update as soon as possible.

⚠️ Potentially Breaking Changes

• API errors with explicit HTTP status codes (400–599) now return that HTTP status instead of always returning 200. Application codes that collide with HTTP semantics (413, 436, 437, 498) map to 400 while keeping the original code in the response envelope. The JSON error envelope is unchanged, but integrations must handle non-200 error responses. (#4266)
• Guest authentication calls (client login and signup, staff login) must now be POST requests carrying the pre-login session token from a same-origin context. Custom themes, embed forms, or API integrations that post to these endpoints directly must send the token like the shipped forms do. (#4474)
• Guest cart mutations now also require a session-bound CSRF token and reject cross-origin browser requests. Custom storefront and cart integrations must supply the token. (#4546)
• Gateway return, cancel, and thank-you URLs now route through a dedicated /invoice/payment-return page that only redirects to fixed invoice destinations. The legacy session restore_token flow is removed, and PayPal returns use browser redirects. Custom gateway or theme code relying on the old restore flow should use the new return page. (#4474)

🔐 Security

• Required CSRF tokens and same-origin context for guest login endpoints, and shipped the token in the admin login, client login and signup, order-button, and embed login forms. (#4474)
• Hardened admin-area rendering of staff-authored content: support ticket notes are stored as plain text and rendered without innerHTML, mass-mailer previews render in a sandboxed frame, and notes that are empty after sanitization are rejected. (#4548)
• Made password resets transactional with row locking so revoked tokens can no longer overwrite newer passwords, and bound email-confirmation tokens to the current email address with 24-hour expiry and atomic consume/revoke. (#4474)
• Hardened guest session-state and cart-mutation calls with stricter session handling and cookie semantics. (#4546)
• Routed payment returns through fixed invoice destinations, dropped the legacy session restore-token flow, and bounded ipn.php callback bodies. (#4474)
• Closed installer reinstall bypasses, hardened extension archive extraction with secure staging and pre-validation, made extension configuration reads no-write, and gated guest settings access. (#4474)
• Required authorization and CSRF checks for theme settings, split settings persistence from reads, and hardened admin transaction-error rendering. (#4474)
• Fetched invoice PDF logos through a no-private-network HTTP client with MIME, size, and SVG validation instead of remote Dompdf fetches. (#4474)
• Validated product IDs on public mutation endpoints, client IDs before client deletion, and product icon URL length before writes. (#4466)
• Kept DirectAdmin POST fields out of request URLs, normalized HTTP bootstrap query overrides, respected Formbuilder permissions on product settings, and validated Hestia hostnames. (#4474)
• Rejected truncated encrypted values before decryption and array-valued PayPal IPN fields before verification, and rejected incomplete CWP account details before synchronization. (#4464)
• Validated extension directory metadata and request identifiers so invalid data can never replace the last-known-good copy. (#4493)

📈 Enhancements

• Added single sign-on to the CWP server manager with a safe fallback to the standard panel URL, username-only error logging, and bounded session-request timeouts. (#4459)
• Kept hosting order pages available when control-panel URL lookup fails instead of erroring on adapter failures. (#4462)
• Made the extension directory resilient to outages: successful responses are cached with a last-known-good copy served on refresh failures, and the stale fallback window is 48 hours. (#4493, [#4496])
• Rendered cron-sent emails in each recipient's configured locale. (#4535)
• Added a configurable send time (HH:MM) for invoice reminders, with deferred before-due and after-due handling. (#4520)
• Added product category priority ordering across the storefront, admin, and API pairs, with a bulk category_update_priority endpoint and migration backfill. (#4569)
• Corrected Stripe amount conversion for currencies whose Stripe decimal rules differ from CLDR, including COP, HUF, IDR, ISK, PKR, and UGX. Also hardened renewal paid-skip for inconclusive billing reasons and recorded renewal payments after the first invoice is paid. (#4541, [#4536], [#4523])
• Softened the PayPal item_number echo check to a warning and improved WHM activation when the package already exists. (#4534, [#4565])
• Surfaced missing or invalid extension manifests as user errors instead of unhandled failures. (#4513)
• Made support ticket message dates translatable.

➕ New Features

• Added sitemap coverage for the homepage and custom pages plus product lastmod, backed by a new Custompages guest API. (#4566)

🐛 Bug Fixes

• Fixed duplicate order activation after credit checkout by refreshing the order before activation checks. (#4456)
• Fixed API key settings rendering and kept domain sync eligible for retry after programming errors. (#4463)
• Fixed the services list pagination linking to the catalog route. (#4521)
• Repaired custom-page Unicode storage with utf8mb4 defaults and legacy column repair, and fixed the follow-up charset migration for MariaDB UCA collations.
• Added invoice-counter validation and upgrade checks, and treated invalid domain registration periods as validation errors.
• Fixed cleanup of abandoned sessions and normalized phone numbers before registrar requests.
• Fixed Internet.bs handling of missing registrant fields and French TLD matching.
• Fixed the Extensions page crashing on sparse directory metadata by defaulting optional fields and falling back to a generic icon and author label, and handled missing directory icons. (#4491)
• Fixed CWP suspension error messages, standalone Form Builder rendering, and API Key order pages with default settings.
• Fixed product configuration pages requiring system settings management permission.
• Returned 404 for unavailable news items instead of a generic error.
• Validated product pricing configuration and form-answer configuration instead of failing downstream.

📝 Changes

• Stopped reporting expected, user-facing API errors to Sentry; only unexpected failures are now captured. (#4512)

📦 Dependencies

• Refreshed PHP dependencies including doctrine/orm 3.7.5, doctrine/persistence 4.2.1, Symfony components 7.4.21, sentry/sentry 4.34.0, league/uri 7.9.0, guzzlehttp/psr7 3.2.0, and nette/schema 1.4.0, plus dev tools.
• Refreshed frontend dependencies including @tabler/core 1.7.0, chart.js 4.6.1, flag-icons 7.6.0, and intl-tel-input 29.5.6, and bumped the Composer Docker image digest.