* Use `\A` and `\z` anchors in Finder regex
* Run config patches before core patches
* Ensure cron log exists and owned by www-data
* Change numeric inputs to text for plan limits
* Invoke global listeners for fired event
* Sanitize PDF filenames in `createPdfResponse`
* Use `array_key_exists` for blacklist check
* Prefer custom package value for DirectAdmin
* Validate password argument type in isPasswordStrong
* Skip non-installed non-core modules in Hook Service
* Instantiate `DoctrinePaginator` after limits
* Validate guest message is a string
* Adjust mocks in Hook ServiceTest
* Validate currency conversion rate input
* Stop accepting CSRF header token
* Add `.dockerignore` and modernize CI/Dockerfile
* Mock `CurrencyRepository` in `ServiceTest`
* Add antispam hooks for client/admin login
* Move password reset captcha before rate limiting
* Add sandbox attribute to email preview iframe
* Skip reprocessing and include payment_intent check
* Check password reset captcha after rate limit
* Enhance testCreateAndProcess with DB and TX mocks
* Replace Custom Twig components
Replace custom Twig components with native Twig components, remove unused custom Twig components, and move functionality to macros where appropriate.
m
Update partial_extensions.html.twig
* Update Twig components and migrate to FOSSBilling namespace
* Update Currency module...
* Refactor Twig environment config and loading
* Switch CSRF to cookie-based double-submit
* Add Api Twig extension and restore widget/svg helpers
* Cast language flags; improve JSON parsing
* Add markdown DI service and use in Admin API
* Refactor Twig extensions and markdown, simplify APIs
* Add sandboxed email Twig env, update render APIs
* Fix pagination URL usage and menu class
* Fix HTML markup in email templates
* Use macro for avatars and status badges
* Fix Twig spacing and pagination URL filter order
* Replace Custom Twig components
Replace custom Twig components with native Twig components, remove unused custom Twig components, and move functionality to macros where appropriate.
m
Update partial_extensions.html.twig
* Update Twig components and migrate to FOSSBilling namespace
* Refactor Twig environment config and loading
* Add Api Twig extension and restore widget/svg helpers
* Cast language flags; improve JSON parsing
* Add markdown DI service and use in Admin API
* Refactor Twig extensions and markdown, simplify APIs
* Fix pagination URL usage and menu class
* Fix Twig spacing and pagination URL filter order
* Use `current_theme` global and refactor `period_title`
* Allow markdown and date in email Twig sandbox
* Update email template examples
* Fix Twig URLs, quoting, and logo alt text
* Fix Twig templates: URLs, i18n, search params
* Use `templates/*` directories for module templates
* Tighten Twig sandbox and add tests
* Add Twig environment and template docs to `AGENTS.md`
* Use Symfony Filesystem/Finder and assorted fixes
* Fix ticket reply link fragment concatenation
* Close missing divs in dashboard template
* Use detailed `toApiArray` for client
* Fix module name resolution for email templates
* Regenerate `composer.lock`
* Use `markdown_to_html` filter in admin macro
* Handle null price/quantity and rename test method
* Use `Tools::isHTTPS()` for HTTPS checks
* Add 'area' param to `url` filter and update templates
* Use client area URLs in admin templates
* Use client area and guest API URLs in templates
* Remove client-side invoice delete feature
* Create Twig env via `TwigFactory` for PDF rendering
* Add embedded orderbutton JS and update render
* Add 'srclink' to cspell allowlist
* Use `renderEmailTplString` for email rendering
* Bump twig/markdown-extra to v3.24
* Use `markdown_to_html` for privacy policy
* Escape API JSON, handle null IP, client URLs
* Remove initial admin creation flow
* Handle HTTP failures and make tests robust
* Use `api_url` helper in admin templates
* Use `url` filter for footer link 5
* Add patch53 to remove legacy html templates
* Bump setting last_patch to 53
* Add patch54 to restore legacy email templates
* Use renderEmailTplString for email templating
* Remove redundant else/endif in order template
* Add file-hash cache buster for asset URLs
* Remove raw Twig filter and handle missing modules dir
* Return '-' for future timestamps
* Register and reuse TwigFactory and add CSRF cookie
* Adjust API URL helper and add Twig error handling
* Update composer.lock and package-lock.json
* Add twig_factory to ServiceTest DI
* Use url filter for link_page in template
* Composer - update deps and add markdown-extra
* Remove docblocks and inline comments in `TwigFactory`
* Add patches 53-55 and update `last_patch`
* Add `has_permission` Twig function; exclude `href`
* Remove duplicate network interface form
* Guard removal of legacy dirs; add network input
* Handle null category descriptions in template
* Add Twig adapter env and sandbox policy
* Add 'striptags' to cspell word list
* Update composer.lock (deps updated/removed)
* Sanitize custom payment adapter templates
* Remove redundant legacy API tests
* Bump `last_patch` setting to 56
* Coalesce null before `markdown_to_html`
* Move update patcher to system CLI command
* Remove stray `endif` from recaptcha macro
* Update composer.lock
* Fix extra closing brace in Api ServiceTest
* Fix test errors from main merge
- Remove testGetRequestCount tests (method moved to RateLimiter)
- Remove testGetDi from Staff and System GuestTest (protected method)
- Fix IP error message in testLoginCheckIpException
- Add rate_limiter mock to Staff GuestTest tests that need it
* Fix remaining Staff GuestTest issues
- Add extension service mock for captcha check
- Fix error message from 'User not found' to 'Admin not found'
* Fix Staff GuestTest: update query and add logger mock
* Fix Staff GuestTest: set admin status to active for password reset flow
* Fix stale API calls and inverted required condition
- Notification: replace removed system_string_render with direct output
- Antispam settings: replace |alink/|link with |url/|api_url filters
- build_form macro: fix inverted required condition for non-textarea inputs
* Sanitize JS/data URIs and disable buttons by permission
* Use client login/profile links in support emails
* Encode fb-api JSON and tighten URL sanitization
* Prefer session auth for API key methods
* Remove stray endif and fix template formatting
* Add CSRF token to CSV exports; fix template
* Remove stray endif in currency template
* Make invoice PDF generation return Response
* Fix Twig filters, templates, and form handling
* Remove readonly from anonymous class in test
* Inline DebugBar CSS/JS in renderHead
* Add Bootstrap Tab to global bootstrap
* Capitalize template UI strings
* Use CKEditor API for reply quotes
* Remove WYSIWYG module and move CKEditor to themes
* Bump `last_patch` in install SQL to 59
* Remove Spamchecker module
* Run domain management script only for active orders
* Standardize UI text capitalization & minor fixes
* Remove Spamchecker legacy tests; fix period test
* Rename Spamchecker tests to Antispam
* Restore antispam config in tests; remove fixture
* Refactor Antispam Guest tests for config checks
* Update theme build docs; remove Wysiwyg module
* Remove spamchecker from cspell and tweak comment
* Add spamchecker to cspell word list
* Capitalize 'Update Graphs' button label
* Remove guest API system version endpoint
* Moved theme information to Admin API
* Removed references to the old "comment" module
* Remove unused cron endpoints
* Don't pass registrar information to guests
* Filter out Product toApiArray properties
* Redact public ticket information passed via the guest API
* Move redaction logic to the serializer
* Moved honeypot information to a Twig function
* More redaction
* Fixed tests
* Block additional paths
* Reduce the amount of information passed to clients
* Mask file downloads behind sendFile rather than serializing original path
* Move honeypot information to the new Twig function
* Add missing curly bracket
* Removed unused `get_slider` endpoint
* Turn publicMessageToApiArray into an allowlist
---------
Co-authored-by: Adam Daley <admdly@users.noreply.github.com>
* Remove document_nr enum patch
* Use single quotes
* Remove the removed Queue tables from structure.sql
* Add missing unique keys to `currency` and `exeension`
The getProvidedBasicAuthUsername() method previously only checked for
PHP_AUTH_USER, causing shouldUseTokenLogin() to return true even when
no password was provided. This forced the code path into _tryTokenLogin
which then threw an authentication exception when PHP_AUTH_PW was missing.
This broke the client/profile/api_key_get endpoint, which should allow
session-based auth when no Basic Auth credentials are provided.
Now token auth is only triggered when both PHP_AUTH_USER and PHP_AUTH_PW
are explicitly set, allowing proper fallback to session authentication.
Co-authored-by: Adam Daley <admdly@users.noreply.github.com>
* Pass API data to pagination methods
* Fixed phpStan finding
* Added filtering for data parameters
* Simplify the pagination class by extracting pagination options into a class
* Updated imports
* Move SQL validation before the getAll()
* Moved constants to PaginationOptions and put a sane per_page cap
* Removed `Pagination::getDefaultPerPage()`
* Add focused tests
* Fix product recurrent pricing enabling
The new api call function was passing both the hidden element and the input checkbox for enabled.
As the hidden element is no longer required, it has been removed.
* Overwrite duplicate params and default pricing
---------
Co-authored-by: Adam Daley <admdly@users.noreply.github.com>
* Improve API validation and payment IPN security
* Validate `order_id` param before use
* Fix for PR finding
Co-Authored-By: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Set admin transaction source; fix params/tests
* Require non-empty order_id for send_file
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
