TCP Shield

v2.0.0 - 2026-09-11

PHP 7.2 - 7.4, 8.1 - 8.4 · Blesta 5.x

Security: a domain, backend set, Bedrock tunnel or firewall rule id posted from a tab is now checked for shape and re-matched against the service's own network before any call is made, and every id is URL-encoded into the request path - a crafted id previously steered the call at a different network on the same TCPShield account, with the account API key attached, and only the module log showed it. The Network ID is an admin-only field and is now dropped from any client-driven order or service edit and rejected when another active service already holds it - a client could otherwise bind their service to another customer's network and then rename, manage or delete it.
Fixes: a failed backend-set update during suspend or unsuspend is now reported instead of silently ignored (a service could read Suspended while it kept proxying traffic, or stay dead after payment); the pre-suspension snapshot is written before anything is changed, is no longer overwritten by a second suspension - which used to replace the stored backends with 0.0.0.0:0 permanently - and is cleared once restored. Every delete in the Domains, Backends, Bedrock Backends and Firewall tabs now asks for confirmation, and the record to delete travels in its own field so a delete cannot act on the wrong row. API calls carry a total timeout, not only a connect timeout, so a stalled response no longer holds a page or a cron run until PHP's execution limit, and the TLS floor is TLS 1.2. An API response whose body spans more than one line is no longer truncated to its last line (it decoded as nothing while the request still read as successful). A backend list typed without spaces after the commas is split correctly instead of being sent as one malformed backend, and the expected format is spelled out in the tab. The statistics charts cast their plotted values numerically. The five staff-side service tabs (Statistics, Domains, Backends, Bedrock Backends, Firewall) now have their own admin-styled views instead of reusing the client portal's layout, so they match the rest of the admin panel instead of looking visibly out of place. The staff-side domain verification popup no longer renders as duplicated, unstyled chrome on top of the admin theme's own dialog; it now uses an admin-styled view like the rest of the staff tabs. The API Key and Mock API field help tooltips on the Add Account and Edit Account forms no longer drop onto their own line under the field; the Mock API checkbox tooltip in particular no longer floats disconnected from its checkbox.
Features: staff can now manage a client's domains, backends, Bedrock tunnels and firewall from the admin service page; the protected CNAME is stored as a service field, shown on the service summary and available to the welcome email as a tag; renaming a service now renames its TCPShield network; the Statistics tab has a period selector (last 24 hours / 2 days / 7 days); packages can cap the number of domains and backend sets a client may add.
Action required after upgrading from v1.0.0: re-save each TCPShield account. v1.0.0 stored the account API key in plain text, offered it as an email tag and used it as the account's display key; all three are fixed, but an existing account keeps its plaintext key until it is saved again.

v1.0.0 - 2024-09-22

PHP 7.2 - 7.3, 8.1 - 8.4 · Blesta 5.x

Blesta Club release