Skip to content

Update documentation for 0.8.7 release and security fixes #83

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
admdly merged 2 commits into from
Sep 1, 2026
Merged

Update documentation for 0.8.7 release and security fixes #83

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a795c48
Update docs banner for 0.8.7
admdly Sep 1, 2026
c638147
Add 0.8.7 release notes
admdly Sep 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions src/content/docs/index.mdoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,8 @@ description: Learn what FOSSBilling is, where to start, and how to get involved
tableOfContents: false
banner:
content: |
<strong>0.8.6 is here!</strong> Check out the
<a href="https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.6">release notes</a>
<strong>0.8.7 is here!</strong> Check out the
<a href="https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.7">release notes</a>
and <a href="/maintenance/updating/0-7-to-0-8/">0.7 → 0.8 upgrade guide</a> for details.
---

Expand Down
9 changes: 9 additions & 0 deletions src/content/docs/maintenance/Updating/0-7-to-0-8.mdoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -541,6 +541,15 @@ The bundled JavaScript API wrapper (`js/api.js`) already handles the new name, s
- **CSV exports** (clients, invoices, orders) now strip secret columns and require both `view` and `export` permissions. Staff with only `export` will no longer see full records - review group permissions if exports appear empty.
- **Extension permissions:** `manage_extensions` is now enforced for inactive modules. Staff without that permission can no longer open their configuration pages.

## Security Hardening & API Secrets (0.8.7)

{% aside type="caution" %}
**0.8.7 is a security release** addressing several vulnerabilities, including leaked credentials in API responses. If you are running a version older than 0.8.0, update immediately.
{% /aside %}

- Staff and client listing responses no longer include password hashes or API tokens.
- Payment gateway and domain registrar secrets are now masked in API responses and admin forms. Admins see a "Configured" badge instead of the raw value, and leaving a field blank preserves the existing secret.

## Deprecations & Removals (Summary)

| Component | Status | Notes |
Expand Down
13 changes: 13 additions & 0 deletions src/content/docs/maintenance/changelog.mdoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,19 @@ FOSSBilling publishes release notes and tagged versions on GitHub. Use the links

For the latest changes, start with the [most recent release](https://github.com/FOSSBilling/FOSSBilling/releases/latest).

### Version 0.8.7

| Area | Summary |
|------|---------|
| **Security** | Guest signup flow hardened against email address enumeration; password hashes and API tokens no longer leaked in staff and client listing responses; payment gateway and domain registrar secrets masked in API responses and admin forms (admins see a "Configured" badge, and leaving a field blank keeps the existing secret); ResellerClub API credentials redacted from request logs; template existence checks hardened against invalid paths; install filesystem paths stripped from Sentry stack traces. |
| **New Features** | Configurable Redis/Memcached cache backend with an admin cache settings page, Redis TLS support, and per-installation namespace isolation; per-TLD option to require a domain transfer code; "Sync Now" action to refresh domain status, WHOIS contacts, and dates from the registrar on demand. |
| **Enhancements** | WHOIS domain availability lookups replaced with RDAP, with graceful fallback for the Custom and Email adapters; release archives mirrored to Cloudflare R2 so IPv6-only hosts can download updates. |
| **Bug Fixes** | `Order\Service::assertOrderUsable()` restored, fixing client service endpoints failing with error 9998; checkout `TypeError` when a gateway left an invoice unpaid; ResellerClub mixed-case availability lookups, bare-scalar API responses, whois/contact edits, `.FR` contact types, renewals without cached expiration, and non-JSON responses (which previously crashed and leaked credentials); admin-role client/staff logins no longer throttled under the guest anti-brute-force policy; maintenance page crash with "hide company public" enabled; failed public suffix list download no longer breaking checkout; multi-byte UTF-8 corruption in the guest countries response; "change password" error in the client area; subscription renewal invoices allowed for `suspended`/`failed_renew` orders; Stripe checkout race creating duplicate customers and unhandled invalid UTF-8 in API responses; admin order creation with immediate invoice issuance; stale reads causing "has no active service"; extension hook listener rebuild on failure; theme settings fallback when `settings_data.json` is missing; Massmailer crash on mail sending and test client fetching. |
| **Changes** | Native PHP deprecation notices no longer reported to Sentry. |
| **Dependencies** | `io-developer/php-whois` dropped in favor of RDAP availability checks; PHP and frontend dependencies refreshed. |

[View the full 0.8.7 release notes](https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.7) for the complete list of changes.

### Version 0.8.6

| Area | Summary |
Expand Down