diff --git a/src/content/docs/index.mdoc b/src/content/docs/index.mdoc index 91a160b..f985d12 100644 --- a/src/content/docs/index.mdoc +++ b/src/content/docs/index.mdoc @@ -4,8 +4,8 @@ description: Learn what FOSSBilling is, where to start, and how to get involved tableOfContents: false banner: content: | - 0.8.6 is here! Check out the - release notes + 0.8.7 is here! Check out the + release notes and 0.7 → 0.8 upgrade guide for details. --- diff --git a/src/content/docs/maintenance/Updating/0-7-to-0-8.mdoc b/src/content/docs/maintenance/Updating/0-7-to-0-8.mdoc index 9767ca3..a937d15 100644 --- a/src/content/docs/maintenance/Updating/0-7-to-0-8.mdoc +++ b/src/content/docs/maintenance/Updating/0-7-to-0-8.mdoc @@ -541,6 +541,15 @@ The bundled JavaScript API wrapper (`js/api.js`) already handles the new name, s - **CSV exports** (clients, invoices, orders) now strip secret columns and require both `view` and `export` permissions. Staff with only `export` will no longer see full records - review group permissions if exports appear empty. - **Extension permissions:** `manage_extensions` is now enforced for inactive modules. Staff without that permission can no longer open their configuration pages. +## Security Hardening & API Secrets (0.8.7) + +{% aside type="caution" %} +**0.8.7 is a security release** addressing several vulnerabilities, including leaked credentials in API responses. If you are running a version older than 0.8.0, update immediately. +{% /aside %} + +- Staff and client listing responses no longer include password hashes or API tokens. +- Payment gateway and domain registrar secrets are now masked in API responses and admin forms. Admins see a "Configured" badge instead of the raw value, and leaving a field blank preserves the existing secret. + ## Deprecations & Removals (Summary) | Component | Status | Notes | diff --git a/src/content/docs/maintenance/changelog.mdoc b/src/content/docs/maintenance/changelog.mdoc index dbc8ea3..25c479b 100644 --- a/src/content/docs/maintenance/changelog.mdoc +++ b/src/content/docs/maintenance/changelog.mdoc @@ -18,6 +18,19 @@ FOSSBilling publishes release notes and tagged versions on GitHub. Use the links For the latest changes, start with the [most recent release](https://github.com/FOSSBilling/FOSSBilling/releases/latest). +### Version 0.8.7 + +| Area | Summary | +|------|---------| +| **Security** | Guest signup flow hardened against email address enumeration; password hashes and API tokens no longer leaked in staff and client listing responses; payment gateway and domain registrar secrets masked in API responses and admin forms (admins see a "Configured" badge, and leaving a field blank keeps the existing secret); ResellerClub API credentials redacted from request logs; template existence checks hardened against invalid paths; install filesystem paths stripped from Sentry stack traces. | +| **New Features** | Configurable Redis/Memcached cache backend with an admin cache settings page, Redis TLS support, and per-installation namespace isolation; per-TLD option to require a domain transfer code; "Sync Now" action to refresh domain status, WHOIS contacts, and dates from the registrar on demand. | +| **Enhancements** | WHOIS domain availability lookups replaced with RDAP, with graceful fallback for the Custom and Email adapters; release archives mirrored to Cloudflare R2 so IPv6-only hosts can download updates. | +| **Bug Fixes** | `Order\Service::assertOrderUsable()` restored, fixing client service endpoints failing with error 9998; checkout `TypeError` when a gateway left an invoice unpaid; ResellerClub mixed-case availability lookups, bare-scalar API responses, whois/contact edits, `.FR` contact types, renewals without cached expiration, and non-JSON responses (which previously crashed and leaked credentials); admin-role client/staff logins no longer throttled under the guest anti-brute-force policy; maintenance page crash with "hide company public" enabled; failed public suffix list download no longer breaking checkout; multi-byte UTF-8 corruption in the guest countries response; "change password" error in the client area; subscription renewal invoices allowed for `suspended`/`failed_renew` orders; Stripe checkout race creating duplicate customers and unhandled invalid UTF-8 in API responses; admin order creation with immediate invoice issuance; stale reads causing "has no active service"; extension hook listener rebuild on failure; theme settings fallback when `settings_data.json` is missing; Massmailer crash on mail sending and test client fetching. | +| **Changes** | Native PHP deprecation notices no longer reported to Sentry. | +| **Dependencies** | `io-developer/php-whois` dropped in favor of RDAP availability checks; PHP and frontend dependencies refreshed. | + +[View the full 0.8.7 release notes](https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.7) for the complete list of changes. + ### Version 0.8.6 | Area | Summary |