FOSSBilling/FOSSBilling 0.8.6

on GitHub

0.8.6

Alongside this release, we are publishing several security advisories for vulnerabilities addressed in 0.8.5 and later. Users should upgrade as soon as possible as prior releases contain critical vulnerabilities. Using a version older than 0.8.0 is not recommended and such users should upgrade immediately.

This release hardens several security-sensitive areas (CSV exports, cart configuration, extension permissions, and the update process) and adds a number of admin-facing features and fixes across checkout, invoicing, domain, and server-management flows.

⚠️ Potentially Breaking Changes

• FOSSBilling cookies now use standardized fossbilling_* names. Existing sessions and CSRF, locale, and timezone cookies are migrated transparently, but custom themes or scripts that read the legacy cookie names (csrf_token, BBLANG, fb_locale, fb_timezone) directly will need updating. (#4043)

🔐 Security

• CSV exports of client, invoice, and order data are now hardened against secret columns, and the view permission is required in addition to export so staff without read access can no longer enumerate full records. (#4087, #4185)
• Cart operations no longer allow client-supplied configuration to be injected into downloadable-product settings; the admin-defined config now takes precedence. (#4093)
• The manage_extensions permission is now enforced for inactive modules, so staff without that permission cannot manage their configuration. (#4184)
• Downloaded update archives are now verified against a SHA-256 digest before extraction, rejecting missing, malformed, or mismatched archives. (#4166)
• Client-facing hosting plan listings are now scoped to plans actually referenced by an enabled product, and admin-controlled order values are cross-checked against the product's configuration on client ordering paths. (#4185)

➕ New Features

• Currency display can now be customized with format patterns and fraction digits, including manual per-currency exchange-rate overrides. (#4053, #4054, #4069)
• The promo detail page now shows a redemption history table listing each client, order, invoice, and discount amount, and promos can be duplicated from the admin list. (#4119, #4113)
• An "Enable Add Funds" setting now disables client self-service balance top-ups end to end, while admin-side manual credits remain available. (#4117)
• Email Settings can now Bcc a copy of every outgoing message to another mailbox. (#4116)
• Support ticket email previews now show the ticket priority. (#4034)
• Failed invoice-item tasks are now tracked with an attempt counter and a "Failed Items" page, letting admins inspect and re-queue items instead of them being retried indefinitely with only a log line. (#4080)
• A new opt-in cron job can automatically remove stale, never-paid pending-setup orders after a configurable number of days. (#4182)
• TLD registration periods can now be restricted to an explicit list (for registrars that only support specific periods) rather than only a minimum. (#4115)
• The client order details page now shows the discount and the payment amount after discount alongside the full payment amount. (#4114)
• The Update page now surfaces which preview build is available. (#4172)

🐛 Bug Fixes

• Fixed PayPal IPN validation stripping backslashes from field values, which caused 0 - IPN is invalid errors on re-verification. (#4095)
• Fixed the Namecheap adapter never returning domain expiration/registration dates. (#4128)
• Fixed Plesk subscriptions not being assigned a hosting plan on creation, account updates sending an invalid webspace set request, and accounts silently ignoring custom hosting-plan permissions. (#4125, #4129, #4166)
• Fixed DirectAdmin account updates silently resetting custom package values (FTP, cron, SSH, SSL, email quotas, and more). (#4166)
• Fixed WHM reseller accounts always receiving an empty ACL list, which stripped their initial privileges. (#4174)
• Fixed domain expiration dates never refreshing from the registrar via the monthly sync, and the sync marker advancing even when a domain failed. (#4123)
• Fixed hosting orders getting stuck in pending_setup with duplicate createacct retries when activation succeeded remotely but a later step failed. (#4100)
• Fixed checkout rolling back the entire cart when synchronous order activation failed, instead of only failing the affected order. (#4103)
• Fixed promo codes restricted to a specific product or period silently waiving setup fees on products they did not apply to. (#4104)
• Fixed duplicate credits being added to a client balance when an invoice item was charged more than once. (#4079)
• Fixed concurrent invoice-number collisions and credit-payment double-spend by serializing invoice numbering and balance deductions. (#4132)
• Fixed a stock oversell race where concurrent orders could each decrement the same inventory count. (#4132)
• Fixed Stripe webhook double-processing of the same invoice payment. (#4132)
• Fixed Stripe payment amount validation failing on non-integer amounts. (#4148)
• Fixed client emails (suspension, renewal, unsuspend, cancel, uncancel) failing to send during cron runs without an admin session. (#4110, #4112)
• Fixed an admin session ID regeneration grace period being hardcoded to zero, which broke admin impersonation flows. (#4068)
• Fixed client login leaving a stale admin identity in the session. (#4124)
• Fixed the password reset confirmation page and the signup country selector rendering timeout. (#4039, #4052)
• Fixed the admin new-order form crashing for products not priced for all billing periods. (#4067)
• Fixed checkout rendering for one-time products, the domain TLD configuration handler, and an undefined addons variable in the order detail view. (#4045, #4047, #4066)
• Fixed the Cookie Consent settings page crashing when never configured. (#4084)
• Fixed a crash on every page when the currency table was missing newly added columns, and incomplete custom field configuration. (#4057, #4030)
• Fixed the admin client update not persisting the client's group. (#4033)
• Fixed client page and admin order search errors for legacy clients with a group ID of 0. (#4164)
• Fixed core-update login lockout and a mid-update file-swap race, and installer cleanup on default deploys. (#4165, #4171)
• Fixed the exception handler crashing on non-integer exception codes (for example, PDO errors). (#4171)
• Fixed several admin-panel fatal errors and UI issues, including the mass mailer preview, the order button settings form, and the order Service Management tab. (#4167, #4172)
• Fixed the selected payment gateway highlight on checkout/invoice payment and a stray dark border on the selected gateway. (#4096, #4097)
• Fixed cron cleanup leaving order/invoice data inconsistent by routing overdue invoice removal through the normal deletion path. (#4180)