7.3.0 * Added - Added a "Pay Now" button near the top of the invoice page so clients can jump directly to the payment section. - Added dark mode to the admin panel. - Added the ability for admins to transfer a package between clients. Billing history is not transferred. - Added support for automatically renewing expired domains when the registrar still permits renewal, controlled by the registrar plugin's canAutoRenewDomain() function. - Added wildcard (*) and CIDR range support to the "IPs never to be banned" and "IPs currently banned" settings. - Added a beta version of API v3, currently supporting GET requests for all resources. - Server and registrar plugins can now add custom tabs to the admin package view using the new adminPanels feature. - Added an option to store login sessions in the database. Set SESSION_HANDLER to 'database' in config.php, and optionally set SESSION_LIFETIME to configure the idle timeout in seconds. - Added a Session Cleanup service to remove expired sessions and remember me tokens. - Added a search filter to the package dropdown on the admin ticket view. - Added OAuth authentication for POP3 email routing rules, supporting Google Workspace, Gmail, and Microsoft 365 mailboxes. - Added OAuth authentication for outgoing SMTP, supporting Google Workspace, Gmail, and Microsoft 365. - Added a "Disable Mail Sending" setting to prevent emails from being sent or queued. - Added a Copy button to the API Key page. - Added a resource usage panel to Enhance server packages, Thanks to Sheernox Technology Group. * Improvements - Made the "Client Group" dropdown on client profiles searchable. - Server plugins can now define confirmation prompts for actions such as booting and rebooting. - Updated the Stripe and Stripe Checkout plugins to Stripe API version 2026-08-26.dahlia. - Custom fields and add-ons in the client area now use shared templates across hosting, domain, SSL, and general packages. - Custom field length validation in the client area now supports multibyte characters. - View and edit dialogs in the client area now size correctly for numeric custom field values. - Password custom field values are no longer included in the source of client area product pages. They are loaded on demand when the client chooses to view them. - Password custom field changes are now masked in the package event log. - Added date filtering and searching by order ID or client name to the orders list. - Renamed the plugin method show_publicviews() to getPublicView(). - POP3 passwords and OAuth client secrets are no longer sent back to the browser when editing an email routing rule. Leave these fields blank to retain their current values. - POP3 usernames in email routing rules now support up to 255 characters. - Saving an email routing rule now requires the support setup permission. - Changing your password now signs you out on other devices when database sessions are enabled. - When database sessions are enabled, admin password changes, password resets through reset links, two-factor authentication resets, and staff deactivation now end all active sessions for the affected user. - Remember me now uses secure, revocable tokens. Users who previously selected remember me will need to log in again after updating. - Clients marked as fraud or deleted are now signed out immediately. - Enabling or disabling two-factor authentication now requires the user's current password. - Staff must now enter their current password when changing their own password. - Improved input handling on the change password page. - Password reset and account activation links now use secure, single-use tokens. Links sent before updating will no longer work, and clients will need to request new links. - Password reset links now expire within 24 hours, and account activation links within 7 days, even when "Confirmation Link Availability" is set to a longer period or to never expire. - Requesting a new password reset link now invalidates any previous reset link. - Clients are no longer emailed their new password after resetting it. - Invoice cloning is now recorded as an event instead of a transaction. - The LogicBoxes registrar class is no longer encoded. - Registrar plugins can now display a meaningful error when DNS record retrieval is unsupported by throwing a CE_Exception. - Grouped the Email Invoice and Download PDF buttons into a single icon group to reduce clutter near the top of the invoice. - Made the dropdowns on the add-ons and packages lists searchable. - Improved bulk email performance by reusing a single mail server connection instead of reconnecting for each recipient. - Large announcement and bulk mailer sends can no longer be interrupted by a browser disconnect or server timeout. - Log file entries now always include the remote IP address, not just when DEBUG is enabled - Added a confirmation prompt before clients renew a package or domain. - Added a confirmation prompt before deleting billing profile IDs from the settings page. - Added a confirmation prompt before replacing an existing API key, since generating a new key invalidates the current one. - Increase validations for Stripe payments. - Increase validations for Razorpay payments. - Increase validations for Mollie payments. - Improved Openprovider performance, added TLD and price import, and fixed issues with domain import, nameservers, registration period and registrar lock, thanks to Kodkod Group. - Improved service security by ensuring only staff with permission to manage plugins can run services manually. - Improved security of PDF invoices by ensuring SSL verification is on when loading external images. - Only allow requesting a package cancellation at the end of the billing period if the paid period ends in the future. - Updated the permission for manually changing a ticket status from "Assign tickets" to "Edit Ticket". * Fixed - Fixed an issue where two-factor authentication errors displayed "true" instead of the error message. - Fixed an issue where the affiliate cookie length setting was ignored. - Fixed an issue where the affiliate column on the orders list was always empty, even for orders placed through an affiliate. - Fixed an issue where saving an email routing rule without selecting a ticket type or assignee displayed a generic error instead of a validation message. - Fixed an issue where line breaks in client cancellation reasons were not displayed on the Package Cancellations page. - Fixed an issue where special characters, such as &, in package names, client names, and cancellation reasons were displayed as HTML entities on the Package Cancellations page. - Fixed an issue where cancellations set to "Immediately" were not labeled, highlighted, or sorted correctly when using a non-English language. - Fixed an issue where the AJAX response for the Pending Package Cancellations list included package custom field values that were not needed for display. - Fixed an issue where the signup page could not find phoneverification.phtml. - Fixed an issue where the payment reference field was not automatically focused when the Add Payment Reference window opened. - Fixed hardcoded admin directory paths in ticket email links, revenue reports, and import plugins. - Fixed missing translations on the order page. - Fixed an issue where risk factors were not displayed correctly on the order page. - Fixed an issue where an invalid or comma-formatted "MaxMind Fraud Risk Score" setting, such as 0,5, could cause every order to be rejected as fraud. Invalid values now skip risk score rejection and are logged, and the setting description has been clarified. - Fixed an issue where the order form summary could display a "Total Due Today" one cent higher than the checkout total when a percentage coupon applied to both a package and its add-ons. - Fixed an issue where requests to unknown API paths were logged as Error events in the Event List. - Fixed an issue where pressing Enter in the API Key field could submit its value to an unrelated setting. - Fixed an issue where long client names could displace invoice action buttons or cause them to overlap invoice details. - Fixed inconsistent spacing around the divider between "Invoice To" and "Invoice From" on mobile. - Fixed an issue where announcements ignored the bulk mailer's configured send limit. Large announcements now respect the limit and send in batches across multiple runs. - Fixed an issue where the version access denied page could not force a new access check. - Fixed an issue where payment buttons were still displayed for credited and refunded invoices. - Fixed an issue where the clear button in Select2 dropdowns was misaligned and oversized. - Fixed an issue where differences in decimal precision between the entered amount and the stored balance could prevent a client's credit balance from being fully removed. - Fixed an issue where the Stripe plugin's "Delete Client From Gateway" setting was ignored and the Stripe Checkout plugin's setting was used instead when removing a client from Stripe. - Fixed an issue where PayPal authorization IPNs could apply a payment a second time and add the amount as credit to the client's account. - Fixed an issue in the Virtualizor plugin where a failed suspension caused a fatal error and prevented the autosuspend process from completing. - Fixed an issue in the Virtualizor plugin where errors returned during create, delete, suspend, unsuspend, boot, reboot, shutdown, and package update operations could cause a fatal error instead of displaying the error message. - Fixed an issue in the Virtualizor plugin where the IP Pool ID package setting was not sent to Virtualizor when creating a VPS. - Fixed an issue in the Virtualizor plugin where the plan name was missing from the error message when a matching plan could not be found. - Fixed an issue where the INR and TRY currency symbols were not displayed in the currency list. - Fixed an issue where domain availability lookups for .ca and .us domains, including provincial .ca second-level domains, always reported domains as registered due to changes in the registries' WHOIS responses. - Fixed an issue where the Type, Taxed, and action dropdowns were cut off by the Invoice Entries table when adding or editing an invoice. - Fixed an issue where the payment reference entered when adding a variable payment was not saved to the invoice. - Fixed an issue where ticket type names containing special characters, such as &, were displayed as HTML entities in the "Set to type" dropdown on email routing rules. - Fixed an issue where description tooltips on a client's recurring charges list displayed raw HTML instead of formatted text. - Fixed an issue where description tooltips on a client's recurring charges list could remain stuck on screen. - Fixed an issue where the recurring charge add/edit window displayed a literal
tag in the charge description. - Fixed an issue where premium domains were shown as available for registration when using the ResellerClub registrar. - Fixed an issue where the Knowledge Base Articles page failed to load when no categories existed. - Fixed an issue where upgrade/downgrade options could display the wrong product group name when the available packages belonged to a different group. - Fixed an issue where invoices imported from WHMCS had no creation date, causing invoice PDFs to display 12/31/1969. - Fixed an issue where invoices imported from WHMCS were marked as unsent. - Fixed an issue where non-ASCII characters, such as accented letters, in client details, tickets, and other text were corrupted during WHMCS imports. - Fixed PHP 8.2+ deprecation notices caused by utf8_encode() during WHMCS imports. - Fixed an issue where invoices imported from WHMCS did not retain their payment gateway. - Fixed an issue where invoice item descriptions longer than 200 characters were truncated during WHMCS imports. The remaining text is now preserved in the item detail. - Fixed an issue where ticket replies sent from email addresses other than the client's own, such as CC'd contacts, were missing after WHMCS imports. These replies are now attributed to the ticket's client and include the original sender's address. - Fixed an issue where tickets imported from WHMCS displayed their last reply as "Just now" in the ticket list. - Fixed an issue where domains imported from WHMCS had no expiration date. - Fixed an issue where selecting "Include Closed Tickets" in the admin ticket list did not show closed tickets when the search field was empty. - Fixed an issue where performing an action on the admin invoice list, such as sending an overdue notice, reset the list back to the first page. - Fixed an issue where only the first snapin hooked into the client area page or footer locations would display. - Fixed broken link tag in the **Configure currency** step in WHMCS Importer. - Fixed an issue where the admin invoice page could take several seconds to load on installs with a large number of invoice entries. - Fixed an issue where PHP warnings were logged when viewing invoices with entries that have period dates. - Fixed an issue where toggling privacy protection for LogicBoxes domains would fail with an error. - Fixed an issue where some LogicBoxes registrar errors resulted in a fatal error instead of displaying the error message. - Fixed an issue with Announcements getRecipientsIds failing if recipientsIds is empty. - Fixed an issue where manually closing a ticket did not trigger the Ticket-Closed event. - Fixed an issue where the ticket status dropdown displayed the new status even when the change was denied. - Fixed an issue where quotes in the reason for adding or removing a client's credit balance displayed as encoded characters in the client's event log. - Fixed an issue where some currency symbols were being encoded on the client's affiliate summary on admin panel. - Fixed an issue where clicking "View Commissions" on a client's affiliate summary on admin panel did not filter by that affiliate. - Fixed missing javascript translations on admin panel. - Fixed an issue that allowed an affiliate to earn a commission by signing up under their own affiliate link. - Fixed an issue where visits to your own affiliate link while logged in and repeat visits within 24 hours inflated affiliate click counts. - Fixed the affiliate cookie duration setting being overridden instead of using the configured value. - Fixed an issue where custom report plugins in a directory whose name was not capitalized (for example, plugins/reports/my) displayed blank reports on case-sensitive file systems. 7.2.2 * Improvements - Improved ProxmoxVE helper UI. - Do not refresh the page if an error occurred while activating a package from the package view. - Linode instance creation now shows the specific reason for failure (e.g. invalid region) instead of a generic error message. - Linode instance deletion failures were previously not showing any error message at all. Now the actual error returned by the API (e.g. instance not found) is surfaced to the user. - When deleting a Linode instance, do not remove the last IP address from the custom field. - Allow "External VPS/Package ID" to be searched in the global search. - When provisioning a Linode instance, set the tag as ce-packageId. - Rebuilt Enhance OpenAPI PHP library against new API spec. - Re-added payment reference column to invoice list. - Make sure pricing fields only allow valid characters, whether by typing or pasting the value. - When accepting an order, only activate pending packages in the order. - When deleting a package, ensure we also delete the order_items table. - New Setting: Prepend Package ID to Hostname for Linode servers. - Group linode locations by country in the linode helper. * Fixed - Fixed the issue that sometimes results in the wrong currency for the product prices when trying to upgrade/downgrade a package from the Admin side. - Fixed a display issue on the ProxmoxVE and Linode helper pages where opening a select dropdown could show an unnecessary scrollbar. - Fixed an issue where the admin panel would sometimes display messages in a client's language instead of the admin's language after generating and sending an invoice. - Fixed a ticket page issue where subscribe, spam, delete, and reply actions could trigger multiple times. - Fixed an issue with the "Update via plugin if necessary" warning sometimes showing twice. - Fixed an issue that sometimes prevents getting available IP addresses for a package in the admin area. - Fixed an issue where pagination on the invoices tab of a client profile would carry over from a previously viewed client, causing the table to show no results if the new client had fewer pages of invoices. - Fixed an issue where the template GET param and Template cookie would not apply to the main layout wrapper. - Fixed an issue with checkout hanging if using an invalid key from Stripe. - Fixed an Authorize.net CIM issue that prevented new signups from entering payment details. - Fixed the Softaculous auto-install plugin failing to install scripts on cPanel due to a cPanel security change that removed support for HTTP Basic authentication. - Fixed month names issue in the graph of Annual Revenue report. - Fixed pages with a CAPTCHA sometimes showing the default template instead of the custom one. - Fixed non-image attachments not showing inline on ticket replies in admin. - Fixed PayPal button on signup/invoice pages triggering validation errors on page load. - Fixed an issue where reactivating a package after a failed activation would create a duplicate organization and subscription in Enhance instead of reusing the existing one. - Fixed an issue where website creation failures during package activation showed a generic error message. - Fixed the getPricing function to always return the 'pricedata' array for domain packages. - Fixed location.href from Ticket_Totals to Ticket+Totals in the Ticket Totals report. - Fixed the main 'Orders' menu to take you to the orders list instead of the clients list. - Fixed the main 'Invoice List' menu to take you to the invoices list. - Fixed a security issue. - Fixed issue preventing all available regions from showing in the Linode Helper snapin. - Fixed an issue where a failed organization creation could leave an orphaned org in Enhance instead of being cleaned up. - Fixed field duplication on staff profile when "Force Staff to enable Two Factor Authentication on Next Login" is enabled with the active client panel. - Fixed issues in Signup related to validating client field values and enabling/disabling the payment buttons. - Fixed issue with "Notify Department List For New Ticket Template" and "Notify Department Lead For New Ticket Template" ignoring the line breaks. ================================================================================================================ ================================================================================================================ 7.2.1 * Added - Added a new "Send Invoice Emails" setting under the client's Billing tab. * Improvements - Invoice notifications now use an associated package, when available, to populate package-related tags. - Cancelling a package now also cancels its associated order if the order is still pending and all packages in the order have been cancelled. - Removed the deprecated ChronoPay plugin. - Updated the WorldPay callback to ensure a valid password is configured. - Gateway callbacks now only execute if the plugin is enabled or is associated with a non-fraudulent client. - Improved the Full Client Data JSON Exporter to validate that the provided user ID exists and belongs to a client rather than an administrator. The exporter now also provides a dropdown for selecting a client. - Changed the domain search placeholder on the signup page from "www." to "https://". - Updated default permissions for new installations to allow non-logged-in users to view announcements and Knowledge Base articles, and select the automatic credit card charging option during signup. - Removed the deprecated migratedirectiAction method used for Directi migrations. * Fixed - Fixed an issue where clicking Submit on the order form could submit the order twice, resulting in a false "Signup error" being shown to the client. - Fixed an issue where bulk actions on the Orders page would only apply to one of the selected orders. - Fixed an issue where custom fields would not appear on a client's package General tab if the client was cancelled. - Fixed an issue where prices could overflow product cards on smaller screens during signup. Product cards in the four-column layout now stack correctly on mobile, and long prices scale and wrap within the card. - Fixed an issue where the Last Online tooltip could overflow its container. - Fixed an issue where the tax application setting when editing a coupon always displayed "Before Tax", even when the coupon was configured to apply after tax. - Fixed an issue where internal tickets created by an upgrade or downgrade could incorrectly send an email notification to the client. - Fixed an issue where package lists would not display if one of the client's packages did not have pricing configured in the client's currency. - Fixed an issue where the plugin actions dropdown could appear blank when viewing package snapins, such as invoices or domain renewal logs. - Fixed an issue where announcement emails could not be sent to clients in certain client groups. - Fixed an issue where the Rating column on the Ticket Feedback page would not display and could generate an error. - Fixed an issue where changing the Show filter on the Ticket Feedback page would not reload the list. - Fixed an issue where pagination did not work correctly on the Ticket Feedback page. - Fixed incorrect Compound and VAT values in the Taxes grid. - Fixed an incorrect Tax value in the Products grid. - Fixed an issue where HTML entities could be displayed in product names within the signup cart summary. - Fixed an issue retrieving the registrar in PluginDomains_registrar. - Fixed an issue where clicking Submit Ticket multiple times could create duplicate tickets. - Fixed a security issue. Additional details will be released at a later date.