Adam Daley
87528920b6
Harden admin-area rendering of staff-authored content (#4547) * Sanitize support ticket note content Note content arrived through the note_create endpoint and was stored as provided, then rendered in the admin ticket list dialog with innerHTML. Sanitize new notes as plain text on the way in (matching how canned response titles are stored), and render the dialog entries with a text node instead of innerHTML so previously stored content cannot inject markup either. Preserve line breaks while rendering the dialog entries. * Preview massmailer messages in a sandboxed frame The message preview injected the rendered message body straight into the admin page with innerHTML, so a message written by one staff member would run script in the browser of another staff member previewing it. Render the body in a sandboxed iframe instead, using the same posture as the email template preview, and assign srcdoc as a property so the body is never parsed in the page context. * Reject support ticket notes that are empty after sanitization A note whose content is entirely markup survived RequiredParams (which only checks that the parameter exists) and, now that note content is sanitized to plain text on storage, would be persisted as an empty row. Return a validation error instead.
Note
FOSSBilling is under active development and currently considered beta. Expect rough edges and limited support.
FOSSBilling is a free, open-source billing and client management system. It helps online service businesses automate invoicing, payments, and client communication. While it’s popular with web hosting providers, it also works well for software licensing, digital downloads, and subscription services.
Features
- Billing & Invoicing: automated invoices, reminders, and basic reporting.
- Client Management: a central place for client data and communication.
- Extensibility: extension-friendly architecture for integrations and custom features.
- Payments: support for multiple gateways.
- Translations: community-powered, multi-language interface.
- Responsive UI: usable on desktop and mobile.
- Security-focused: built with security best practices in mind.
Getting Started
Requirements
FOSSBilling runs on standard LAMP/LEMP stacks. For the latest system requirements (PHP version, extensions, database, etc.), see the official requirements.
Installation
Follow the step-by-step Getting Started guide.
Just exploring? Try the public demo.
Contributing
We welcome contributions from the community! We’re actively modernizing the codebase and there’s plenty to do.
- Read the contributor guide.
- Pick an item from the open issues.
- Open a PR when you’re ready.
If you prefer to start a conversation first, drop by the forum or say hello on Discord.
Star History
Not a developer? Starring the repository helps others discover the project.
License
FOSSBilling is released under the Apache 2.0 license. See LICENSE for details.
Links
- Website: https://www.fossbilling.org/
- Documentation: https://docs.fossbilling.org/
- Discord: https://fossbilling.org/discord
- Twitter/X: https://twitter.com/FOSSBilling