WHMCS 6.0 is here!

Version 6.0 is out now and available. You can auto install WHMCS 6.0.0 with one click via Softaculous. Here is the guide.  You can also upgrade your existing installations to WHMCS 6.0.0 via Softaculous. Here is the guide.

whmcs-v6-bannerVersion 6 is packed with new features, watch the video below for a look at some of them in action.

Key Features in WHMCS V6 include :

  • Optimized for Mobile

  • Contextual Sidebars

  • Dynamic Searching & Pagination

  • Client Notifications

  • Localisation – Bonjour, Ciao, Hola…

  • Developer Friendly

Release Notes for V6

Source : http://blog.whmcs.com

WHMCS Security Release 4.5.6 and 5.2.6 Update Now !

WHMCS has released new patches for the 4.5, 5.0, 5.1, and 5.2 minor releases. These updates provide targeted changes to address security concerns with the WHMCS product. You are highly encouraged to update immediately.

whmcs logo

WHMCS has rated these updates as including critical or important security impacts.

Releases
The following full-release versions of WHMCS have been published and address all known vulnerabilities:
5.2.6

The latest public releases of WHMCS are available inside members area at WHMCS.

WHMCS has been updated to 5.2.6 in Softaculous as well. If you have Softaculous installed on your server you can upgrade to the latest version of WHMCS via Softaculous.

PLEASE NOTE: The 4.5 series reached End Of Life as of June 30th 2013. WHMCS is aware that some customers have not moved to an LTS version due to the newness of the LTS policy. The related 4.5 patch release published along with this Security Advisory is provided as a courtesy to those customers. From this point forward, there will be no more patches provided for 4.5 or any other release that has reached EOL.

There is no reason to believe that these vulnerabilities are known to the public. As such, WHMCS will only release limited information regarding the vulnerabilities at this time.

Once sufficient time has passed to allow WHMCS customers to update their installed software, WHMCS will release additional information regarding the nature of the security issue.

These Targeted Security Releases and Patches address 9 vulnerabilities in WHMCS versions 4.5, 5.0, .5.1, and 5.2.

Source : http://www.whmcs.com

WHMCS Security update for 4.x and 5.x released

WHMCS has released new patches for the 4 and 5 series. These updates provide targeted changes to address security concerns with the WHMCS product. You are highly encouraged to update immediately.
WHMCS has rated these updates as including critical and important security impacts.

Security Issue Information
The resolved security issues were all identified by Vlad C. of NetSec Interactive Solutions <http://safeornot.net> (as mentioned by WHMCS). There is no reason to believe that these vulnerabilities are known to the public. As such, WHMCS has only released limited information regarding the vulnerabilities at this time.

Once sufficient time has passed to allow WHMCS customers to update their installed software, WHMCS will release additional information regarding the nature of the security issues. These Targeted Security Releases and Patches address 6 vulnerabilities in WHMCS version 4.0, 4.1, 4.2, 4.3, 4.4, 4.5, 5.0, 5.1, and BETA 5.2. Additional, supplemental information is scheduled to be released on April 9th, 2013 by the WHMCS team.

WHMCS V5.2.2 has also been released

This is a maintenance update to address issues reported in the V5.2.1 release earlier this week.

One of the key additions is additional backwards compatibility for modules and custom pages written for earlier versions. This will mean that custom pages should require *NO* changes to continue functioning exactly as before.

Another point of note is that with the V5.2.1 update, the ResellerClub and all other LogicBoxes based modules were updated to use the new API Key method of integration which is safer and more secure, and so if you are a user of any LogicBoxes based domain registrar module in WHMCS you will need to enter an API Key in the Setup > Domain Registrars page before you can continue using it.

Please also be aware that if you use the live chat addon, an update is required to that for compatability with WHMCS V5.2.x.

WHMCS 5.2.2 is now available via Softaculous and you can upgrade your WHMCS installations via one click.

Source : http://whmcs.com

5 steps to secure your WHMCS installation

WHMCS is an all-in-one client management, billing & support solution for online businesses. Handling everything from signup to termination, WHMCS is a powerful business automation tool that puts you firmly in control. Get started with WHMCS by installing it with one click via Softaculous.

whmcs logo

WHMCS has many features built-in to help keep your data safe, but here are several simple extra steps you can take to secure your WHMCS installation even further.

1. Change your WHMCS Admin Folder Name :

Malicious users who visit your site and recognise a WHMCS install will know that they can try logging into your admin area @ /admin/ To protect against this, you can rename the admin folder to something else. You then must tell WHMCS what the name of that folder is for things to work by adding the following line to the configuration.php file :

$customadminpath = "custom_admin_folder_name_goes_here";

Please note that if you have already created a cron job, or one has been created for you, you will need to update the path on the cron as well. eg :

php -q /home/mylogin/public_html/secure/myfoldername/cron.php

You can configure this step on the install form itself while installing WHMCS via Softaculous, just choose the “Admin Folder” you desire.

2. Password Protect the Admin Directory :

Add a second layer of protection to the admin directory by setting up .htaccess password protection. Most users can do this via the Password Protect Directories option in cPanel. Remember to keep your .htaccess username/password distinct and unique.

3. Move the attachments, downloads & templates_c folders :

The three folders “attachments”, “downloads” and “templates_c” need to be writeable by WHMCS and therefore require the permissions 777 (writeable by all). When folders have this permission level it is safer to place the folders outside of the public accessible folder tree on your website. WHMCS allows you to do this. If you do move the folders, then you must tell WHMCS where they have been moved to by adding the following lines to the configuration.php file :

$templates_compiledir = "/home/username/templates_c/";
$attachments_dir = "/home/username/attachments/";
$downloads_dir = "/home/username/downloads/";

In the above example, “username” is the cpanel username and so the 3 folders are located in the home directory, above public_html.

Note that if you are running suphp or phpsuexec you should not make the mode changes as the folders will already be writeable. In fact, you cannot set folder or file permissions to be 777 when running suphp or phpsuexec – the highest permissions are 755 for both folders and files.

If you are installing WHMCS via Softaculous the files will be in the data directory i.e. outside the public accessible folder tree by default.

4. Move the crons folder :

The “crons” folder contains the domain synchronisation file so this should also be moved outside the public accessible folder tree to prevent outside users from triggering it.

WHMCS allows you to do this. If you do move the folders, then you must tell WHMCS where they have been moved to by editing the /crons/config.php file and specifying the path to the WHMCS root directory, for example:

 $whmcspath = '/home/username/public_html/whmcs/';

In the above example, “username” is the cpanel username and whmcs is located in the directory “whmcs”.

5. Restrict Access by IP :

For added security, if your staff use fixed IP addresses, you can add even more protection to your admin area by restricting access to a specific set of IPs. This is done by creating a file with the name .htaccess within your WHMCS admin directory, with the following content:

order deny,allow
allow from 12.34.5.67
allow from 98.76.54.32
deny from all

You can specify as many different allow from lines as you require. Or you can even allow entire IP subnet’s by specifying just the first part of an IP, for example: “12.34.”. This is called Htaccess IP Restriction.

Source : http://www.whmcs.com