BeZazz

Based on my previous post, I set out this evening to fix the current security issue with the following goals in mind:
Remove the Manage button by the service listing in all states except Active. Remove the Switch icons on service row expansion in all states except Active. If someone enters the direct URL to the cPanel Extended dashboard it disables all functionality and displays a message that the account is not properly setup (similar to default cPanel module). Add a notification message somewhere in the Admin so an administrator is aware the next time they login. Email an administrator of the failed provision (this might already be an existing Blesta feature). After getting familiar with Blesta and cPanel Extended codebases, I have fixed the issue and accomplished my first three goals. I'll continue to become more familiar with the codebase so I can complete goals 4 and 5 too.
To accomplish goal #1, I wrapped the template code with a status active check. This removed the Manage button in the Options column of the service row. Here is the code:
/app/views/client/[template]/client_services.pdt
<td> <?php if ($this->Html->ifSet($status) == "active") { ?> <div class="btn-group"> <a href="<?php echo $this->Html->safe($this->base_uri . "services/manage/" . $this->Html->ifSet($services[$i]->id) . "/");?>" class="btn btn-xs btn-default"> <i class="fa fa-cog fa-fw"></i> <?php $this->_("ClientServices.index.option_manage");?> </a> </div> <?php } ?> </td> To accomplish goal #2, I wrapped the containing table row with a status active check. This disables the row expansion feature in all service states except active. Here is the code:
/app/views/client/[template]/client_services.pdt
<?php // List all services for ($i=0; $i<$num_services; $i++) { if ($this->Html->ifSet($status) == "active") { ?> <tr class="expand service_info"> <?php } else { ?> <tr> <?php } ?> <td><?php $this->Html->_($services[$i]->package->name);?></td> <td><?php $this->Html->_($services[$i]->name);?></td> To accomplish goal #3, I wrapped the sidebar tab building code with a status active check. This removes all of the cPanel Extended tabs and features from the /services/manage/ view. By removing the Manage button in goal #1 above, the average user will never be able to reach this URL. But for the tech savvy, it wouldn't be hard to figure out. And my goal with this fix is to prevent those tech savvy types from causing harm?  So just in case this URL is called, unless the service is active, no manage features are available. Here's the code:
/app/controllers/client_services.php
public function manage() { $this->uses(array("Coupons", "ModuleManager")); // Ensure we have a service if (!($service = $this->Services->get((int)$this->get[0])) || $service->client_id != $this->client->id) $this->redirect($this->base_uri); $package = $this->Packages->get($service->package->id); $module = $this->ModuleManager->initModule($service->package->module_id); $module->base_uri = $this->base_uri; $method = isset($this->get[1]) ? $this->get[1] : null; // Set sidebar tabs if ($service->status == "active") { $this->buildTabs($service, $package, $module, $method); } I've also attached some screenshots showing the updated UIs where a cPanel Extended service is in PENDING state and management is basically disabled. Overall, I've had a fun night getting familiar with some of the code. Most importantly, I'm happy I was able to fix this security issue for my needs. I welcome any suggestions and advice from the Blesta Developers as well as cyandark. If there's a better way to fix this issue, please share so I can learn in the process. Thanks again for providing this community and everyone here who are so helpful.
Cheers!

 
 
 

Looks really good Nice and clean looking.

let me give you a pm on this because I don't want this thread to be another "firestorm" over something that can be handed privately.

Blesta is Open Code, not Open Source.
Encrypt the paid modules is necessary to protect the license system. 

First . We never change password to a password that client want . We change the passwords to a generated one and send email about the new password .
The client can request password change but can't determinate it via ticket .
Also is good to see a lebel about how this ticket was opened (manager, email piped,  import email, Api ... )

For me stability is of the utmost importance, I couldn't care less when v4 is released. I have all of the features I currently need and have alternatives in place for those not provided by Blesta. They can take as long as they want, as long as they continue to patch any security issues in 3.6.2 and v4 is nice and stable upon final public release I'll be happy 

Hi, I have this theme in my computer about half year, this theme is of a cancelled project and I will not use the theme anymore, for this I will decided share the theme to the community, this can be useful for something.
This theme not will receive updates. If you want a customization you can send me a PM to get a quote.

cloud.zip

PM me your key, or if you have an account with us and paid for the support & updates that way, please open a ticket. I will get you a copy of v4 beta 1. If you are not going live for a little while, I'd suggest making any customizations to v4 to start with, it will be much easier.

I just opened a ticket.
Thank you I appreciate it

I just opened a ticket.
Thank you I appreciate it

Sounds like it mate haha.

To much effort I guess lol

Pretty sure he was the one that helped me get the support/updates added to my copy of Blesta.
 

You're welcome, you can also grab the beta from the blesta downloads manager and just give it a spin

Ok, thanks for the quick reply.

Hi all
I have had an owned license of Blesta for around 3 years gathering dust.
About 2 weeks ago I have decided I want to use Blesta even f I have to code some modules myself.
My concern / question is.
If I spend time getting Blesta 3x setup (customize it theme ect) will that all be lost when changing over to 4x?

Right, it's a good time to really market the privacy aspect of Blesta. But we go back to what you guys need to do to grow into the hosting industry, feature-wise. Maybe re-prioritize some stuff? Up to you, but there's a lot you guys can do to take advantage of this. 
If my competitor did this for me, I'd be dancing all night, and then work on removing them from the picture  
Maybe a good time to talk to 3rd party developers, pay to integrate their modules directly into Blesta, making migrations from WHMCS a lot easier, a less costly and complicated process. At least to grow it quickly while you have all eyes on you

In other words to Paul and company : DON'T MISS THIS BOAT. this is a gift to you guys, take advantage of it
 

From them or here. https://docs.blesta.com/display/support/Getting+Support#GettingSupport-SupportAccess
 

Yes it does.

 

Yes it does.

This might help a few people, you can't use PHPIDs with this at the moment. This is designed for my business but edit as you please, you can keep it the same and just edit the business name, etc.

please make sure your Service Creation template only has these:

Html: {package.email_html}

Text: {package.email_text}

Then in the welcome emails put the following:
 
Dear {client.first_name} {client.last_name}, PLEASE READ THIS EMAIL IN FULL AND PRINT IT FOR YOUR RECORDS Thank you for your order from us! Your hosting account has now been setup and this email contains all the information you will need in order to begin using your account. If you have requested a domain name during sign up, please keep in mind that your domain name will not be visible on the internet instantly. This process is called propagation and can take up to 48 hours. Until your domain has propagated, your website and email will not function, we have provided a temporary url which you may use to view your website and upload files in the meantime. New Account Information Hosting Package: {package.package} Domain: {service.cpanel_domain} Package Price: {pricing.price | numberformat 2, ".", ","} Package Period: {pricing.period} Cancellation Fee after 10 days of your first product with us: {pricing.cancel_fee | numberformat 2, ".", ","} Login Details Username: {service.cpanel_username} Password: **** [Password Hidden for security reasons] Control Panel URL: http://{module.host_name}:2082/ Once your domain has propogated, you may also use http://www.{service.cpanel_domain}:2082/'>http://www.{service.cpanel_domain}:2082/ Server Information Server IP: {module.host_name} If you are using an existing domain with your new hosting account, you will need to update the nameservers to point to the nameservers listed below. {% for name_server in module.name_servers %} Name server: {name_server}{% endfor %} Uploading Your Website Temporarily you may use one of the addresses given below to manage your web site: Temporary FTP Hostname: {module.host_name} Temporary FTP Username: {service.cpanel_username} Temporary FTP Password: cPanel Password And once your domain has propagated you may use the details below: FTP Hostname: {service.cpanel_domain} Webpage URL: http://www.{service.cpanel_domain} Email Settings For email accounts that you setup, you should use the following connection details in your email program: POP3 Host Address: mail.{service.cpanel_domain} SMTP Host Address: mail.{service.cpanel_domain} Username: The email address you are checking email for. Password: As specified in your control panel. Thank you for choosing CubicWebs. It will look like this:


 
=======================================================
=======================================================
                                     InterWorx Version
=======================================================
Dear {client.first_name} {client.last_name}, PLEASE READ THIS EMAIL IN FULL AND PRINT IT FOR YOUR RECORDS Thank you for your order from us! Your hosting account has now been setup and this email contains all the information you will need in order to begin using your account. If you have requested a domain name during sign up, please keep in mind that your domain name will not be visible on the internet instantly. This process is called propagation and can take up to 48 hours. Until your domain has propagated, your website and email will not function, we have provided a temporary url which you may use to view your website and upload files in the meantime. To get your account password, please go to your dashboard and click on your service row, you will see your username, password and a direct login link. New Account Information Hosting Package: {package.name} Domain: {service.interworx_domain} Package Price: {pricing.price | numberformat 2, ".", ","} Package Period: {pricing.period} Cancellation Fee after 10 days of your first product with us: {pricing.cancel_fee | numberformat 2, ".", ","} Login Details Username: {service.interworx_email} Password: **** [Password Hidden for security reasons] Control Panel URL: http://{module.host_name}:2443/siteworx/ Once your domain has propogated, you may also use http://www.{service.interworx_domain}:2443/siteworx/ Temp domain: http://{module.host_name}/~{service.interworx_username} Server Information Server IP: {module.host_name} If you are using an existing domain with your new hosting account, you will need to update the nameservers to point to the nameservers listed below. {% for name_server in module.name_servers %} Name server: {name_server}{% endfor %} And once your domain has propagated you may use the details below: Webpage URL: http://{service.interworx_domain} Thank you for choosing CubicWebs. =======================================================
=======================================================
                                     SolusVM Version
=======================================================
Dear {client.first_name} {client.last_name}, PLEASE READ THIS EMAIL IN FULL AND PRINT IT FOR YOUR RECORDS Thank you for your order from us! Your virtual server has now been setup and this email contains all the information you will need in order to begin using your account. Package Information Hosting Package: {package.name} Plan name: {service.solusvm_plan} Virtualization: {service.solusvm_type} Package Price: {pricing.price} Package Period: {pricing.period} Cancellation Fee after 10 days of your first product with us: {pricing.cancel_fee} Server Information Hostname: {service.solusvm_hostname} Primary IP: {service.solusvm_main_ip_address} Root Password: {service.solusvm_password} (This will be blank if more than one service is on your account.) Console Information Control Panel: https://{module.host}:{module.port} Console Username: {service.solusvm_console_user} Console Password: {service.solusvm_console_password} {% if service.solusvm_type == "kvm" %} KVM Extras VNC IP address: {service.solusvm_vnc_ip} VNC Port: {service.solusvm_vnc_port} VNC Password: {service.solusvm_vnc_password} {% endif %} Thank you for choosing [Enter Company Name here]. PS: The If statement is a guess and might not work, please remove it if it doesn't and post here. It should show up only if the type is KVM.