Difference between revisions of "Freeside:2.3.5:Changelog"

From Freeside
Jump to: navigation, search
(XSS (Cross-site scripting) issues)
(XSS (Cross-site scripting) issues)
Line 8: Line 8:
  
 
* Company name and address in the backoffice -- possibly high impact if running self-service and allowing address changes, end-customers might be able to XSS the browser of an employee
 
* Company name and address in the backoffice -- possibly high impact if running self-service and allowing address changes, end-customers might be able to XSS the browser of an employee
* Package definitions, billing events and phone devices in backoffice -- low impact, admins who can edit those things can already do many things worse than XSS employees)
+
* Package definitions, billing events and phone devices in backoffice -- low impact, admins who can edit those things can already do many things worse than XSS other employees
 
* View usage and change package in self-service -- low impact. end-customers XSSing themselves is not really a problem
 
* View usage and change package in self-service -- low impact. end-customers XSSing themselves is not really a problem
  

Revision as of 23:15, 11 November 2012

Notes

This is the changelog for the 2.3.5 release.

For a more detailed, raw log of changes, see the git log

XSS (Cross-site scripting) issues

  • Company name and address in the backoffice -- possibly high impact if running self-service and allowing address changes, end-customers might be able to XSS the browser of an employee
  • Package definitions, billing events and phone devices in backoffice -- low impact, admins who can edit those things can already do many things worse than XSS other employees
  • View usage and change package in self-service -- low impact. end-customers XSSing themselves is not really a problem

Billing events

  • New conditions: "Package Reason Type" / "Package Not Reason Type"
  • New actions: "Unsuspend all of this customer's suspended packages" / "Unsuspend this package"

Ticketing

  • Integrated ticketing updated to RT version 3.8.15

RADIUS

  • Overage billing with per-day caps

VoIP

  • New Windstream CDR format

Misc