Changelog

What shipped in v2.4.0.

2.4.0 (current)

Access control now uses WHMCS's own Access Control list instead of a field of the module's own.

• Access Control — the module's redundant Access Control text field (comma separated role IDs) has been removed. Tick the admin roles that may use the module in WHMCS's built-in Access Control list on the Addon Modules page. The module now follows WHMCS exactly: if no role is ticked nobody has access, and the client-profile password field and manage-users action are hidden for admins without access. Existing role lists are migrated automatically on upgrade.
• Dashboard — redesigned KPI cards (total resets, this month, today's resets) with scoped styling, actor badges in the activity feed, quick actions (generate a test password, find a client, module settings) and a last 7 / 30 / 90 days or all-time activity filter. The feed is sorted by date and capped at 10 rows.
• Reset Trend chart — a responsive daily line chart of password resets that follows the same range filter, capped at 366 days for All Time, with a compact empty state. Chart.js 4.4.1 is bundled locally, so no CDN or network call is required.
• Generated passwords and the module endpoints keep working from WHMCS 9's pretty admin URLs (root-relative endpoints).
• Security hardening — password generation, password saves and settings saves are POST-only (GET returns HTTP 405); controller dispatch only reaches public actions; password length and NUL-byte checks apply to both password entry points; every PHP file refuses direct web access; .htaccess blocks .tpl/.md files and the compiled-template directory; and activation/deactivation failures return a generic message instead of a raw exception.

2.3.0

Configurable password characters, plus a set of fixes to the admin password workflow.

• Password Characters — pick which character types the generator may use (letters, numbers, symbols) on the settings page. Every generated password contains at least one character of each selected type.
• Passwords are now drawn with a cryptographically secure random source instead of str_shuffle().
• Fixed the generate password button: PHP no longer interpolates the admin scripts, which had broken the whole script block and left the button dead.
• Fixed the save form: the reset form now posts the CSRF token in a hidden field, so the new password can actually be saved.
• The generator modal no longer reuses the element ids of the password modal that ships with the WHMCS admin area.
• Admin endpoints are addressed root-relative, so they keep working when the admin area is opened through another host, over http, or from a WHMCS 9 pretty URL such as /admin/client/2/users.

2.2.0

Modern rewrite on the HSCode architecture: namespaced controllers, Smarty admin templates, AJAX settings with toasts, audit log with IP + browser, per-change settings history.

• Dashboard with total/monthly reset counts and recent entries.
• Settings page (password length, log retention) with AJAX save.
• Activity Log (DataTables, IP + user-agent, retention pruning).
• Admin header nav with Email Templates dropdown.