Staff Chatfor WHMCS · Documentation
v2.0.0
Home › Security & Support

Security & Support

Access control, encryption and safe operation.

Access control

  • The widget requires the role to be selected in Addon Modules → Access Control and to hold the Addon Modules permission.
  • Dashboard, Settings, Chat History and Activity Log are Full Administrator-only.
  • Read-only roles cannot send messages, attach files or edit; the server enforces this, not just the UI.
  • Ghost-mode admins can chat but are hidden from presence and their names are masked in messages.
  • Denied access attempts are written to the activity log.

Request security

  • Chat actions are POST-only, CSRF-protected and AJAX-only.
  • Direct GET access to chat or history endpoints returns a 404 JSON response.
  • Attachment downloads require an authenticated POST with a valid CSRF token.
  • Settings writes, resets, clears and deletions are token-protected.
  • Dashboard analytics refresh is POST-only, CSRF-protected, AJAX-only and Full Administrator-only.
  • Rejected requests fail closed and do not leak message data.

Data protection

  • Chat history and attachment metadata use WHMCS encryption.
  • Attachment files are encrypted at rest.
  • The data/ directory is denied by the bundled .htaccess; add an equivalent rule on Nginx.
  • Legacy plaintext attachments are encrypted automatically.
  • The activity log never stores message content.
  • Dashboard analytics are cached in an encrypted file and contain only aggregate counts and mention names.
  • Deleting a message removes its attachment file and metadata.

Upload safety

  • MIME allowlist: JPG, PNG, GIF, WebP, PDF, TXT and ZIP.
  • Images are validated with getimagesize().
  • Files are stored under random names; original names are used for display only.
  • The size limit is configurable with a hard ceiling of 50 MB.
  • Uploaded content is never executed or served from a public path.

Link preview safety

Previews reject private, loopback, link-local and reserved addresses, do not follow redirects, pin the resolved IP for the request and enforce a short timeout and response size limit. Only text is extracted; scripts, styles and images are discarded.

Content rules

  • Per-admin rate limiting protects against floods.
  • Blocked words reject a message server-side before it is stored.
  • Link blocking can reject any message containing a URL.
  • Message length caps protect storage and rendering.

Reporting a vulnerability

Report security issues privately to HardSoftCode rather than in a public issue tracker. Include the version, WHMCS and PHP versions, and the steps to reproduce. Please do not include live customer data.

Support

HardSoftCode — hardsoftcode.com