V5 Beta 4 is out: Account Protection, Telegram notifications and Simplified Chinese

5.0-beta.4, the fourth beta round of V5, is now open to every beta installation. This round puts account security first: Account Protection brings risk-based sign-in codes, breached-password checks, attack mode and canary accounts, and the release notes list nearly five hundred changes in all. This post collects the highlights and what you should know before you update.

Account Protection: every sign-in safeguard on one screen

The new Account Protection tab under Settings → Security → Authentication gathers every sign-in protection on one screen, shows the current state of each and saves them with one button. Risky password and JetPass sign-ins ask for a one-time code, and a trusted browser is then remembered for 90 days. A password found in a known breach (checked with Have I Been Pwned) is refused wherever a password is set. Attack mode compares failed sign-ins with your installation's own baseline; above it, the sign-in forms ask for a captcha until two calm hours pass.

Canary accounts are bait accounts you can plant in your client list: any sign-in or reset attempt on one is logged and alerted as a sign of a leaked list. Every sign-in attempt is now recorded under Tools → Sign-in Attempts, suspected account takeovers are listed under Tools → Security Events and emailed to you, and clients are notified when their account is signed in to from a new device or location.

Telegram notifications and a client Account Statement

Telegram joins mail, SMS and the bell as an admin notification channel: set up a bot, link a group or a personal chat, and choose per template what is sent there. Notifications from a module now lead to its own record, from the bell and from the "Open in Panel" button in Telegram.

The client detail page has a new Account Statement tab that lists invoices, payments, refunds and credit movements with a running balance, and downloads as PDF or CSV. Unpaid invoices of the same client can also be merged into a single invoice.

Simplified Chinese, WHost and S3 backups

The Simplified Chinese language pack covers the interface, website themes, notification templates and the invoice PDF, and ships enabled. The new WHost server module handles the account lifecycle, plan sync and one-click control panel sign-in, with 17 hosting tools, traffic gauges and disk usage billing. Amazon S3 and S3 compatible storage such as Wasabi, MinIO and Cloudflare R2 can now be a remote backup destination.

What to know before you update

Some behavior changed on purpose in this round; please look through these before you update:

• Account Protection is active after the update: risky client sign-ins ask for a one-time code, a password found in a known breach is refused, and changing an email address or phone number, managing API keys or saved cards and revealing a license key ask for the password or a two-factor code. Review the settings under Settings → Security → Authentication.
• BotShield now counts attempts per form instead of per IP address: when a form reaches its threshold, every visitor is asked for a captcha on that form for a set time.
• Payments: over seventy payment modules now book the amount the provider actually collected, so a short payment no longer closes the invoice in full.
• Prices saved as 12, 24 or 36 months are sold as yearly terms instead of monthly.
• Invoices created manually in the panel or the Admin API use the client's tax rate and tax exemption instead of always applying the local rate.
• Plan changes: add-ons that the new plan already includes are cancelled, and their unused term is credited.
• One-time services no longer accept a cancellation request from the client.
• Payeer and Coinbase Commerce are deprecated: their payment services can no longer be reached.
• Hosting and VPS category pages no longer promise a 30-day money-back guarantee, a 99.9% uptime SLA or free migration on your behalf; the badges and notes you edited are kept.
• API integrations: a refused module method, tool action or gateway refund now returns 422 with a code instead of 500, and an on/off field sent as text ("false", "off", "no") is no longer read as on. In the Client API, the mobile number no longer changes through PATCH /me. This is a breaking change, so please review your integration.

Notable fixes

Updates no longer overwrite the notification subjects, SMS texts and email bodies you edited in the panel, and edits lost in an earlier update come back from the copies kept on the installation. Updating also no longer resets a module's saved settings, such as payment gateway keys. Account balance payments now move the client's balance correctly, and the cash book no longer counts them twice. Paying a renewal no longer moves a service's end time to midnight, and a domain is no longer marked expired before the due date of its unpaid renewal invoice. Bulk and newsletter emails also no longer hold back invoice and payment emails in the queue.

Security

This round includes more than fifty security improvements; the Account Protection features above are the most visible of them. The details are in the release notes.

Developers and integrations

Modules can run their own migration right after a panel update through the new action:module.updated hook. The Admin API gains endpoints that list a client's activity log and the emails and SMS messages sent to the client, and it can also read the Account Statement, merge invoices and work with Telegram notifications. The theme files changed in this round are in the comparison on GitHub.

Updating and feedback

Your beta installation finds the update under Help → Updates in the admin panel; we recommend taking a file and database backup before you update. Every change is listed in the release notes. Please keep sending the issues you run into with the Report a Bug button in the panel; bug reports now attach the latest error records automatically.

Not in the beta yet? You can apply with the "Request Beta Access" button on the release page.

Release page: releases.wisecp.com/en/wisecp/5.0-beta.4