Release Distribution Feed

Bug Fixes:
1. User Expiry: Fixed incorrect expiry updates and aligned dashboard expiry counts with the Users List.
2. Profile Bandwidth: Fixed download and upload speed limits not applying correctly.
3. Parental Control: Fixed schedule removal, expired IP pool assignment, and user synchronization issues.
4. Quickpay: Fixed package-change expiry dates and incorrect lower payment amounts.
5. Online Payments: Prevented duplicate payments and improved failed or interrupted bKash payment recovery.
6. Payment Gateway Logo: Fixed partner gateway logos on invoice and payment pages.
7. Invoice Calculation: Fixed monthly bills, previous dues, partial payments, and collection forecast totals.
8. Admin Profile Photo: Fixed image upload, validation, display, and browser cache issues.
9. Dashboard Sessions: Fixed active sessions occasionally becoming blank.
10. Expired SMS: Fixed partner SMS API selection, reminder dates, templates, and synchronization.
11. OLT and ONU: Fixed device detection, ONU data refresh, signal display, and user matching issues.
12. Data Tables: Fixed mouse drag scrolling, column handling, invalid dates, and inconsistent date display.
13. User Import and Documents: Improved file validation, error handling, and upload reliability.
14. Authentication Logs: Fixed manual and automatic removal of old authentication logs.
15. Firewall: Fixed CIDR block handling and permanent web blocks disappearing from the list.

New Features:
1. Mikrotik Login: Administrators and staff can now log in to Mikrotik routers from the NAS page.
2. Custom Bandwidth: Individual users can have custom download and upload speed limits.
3. Custom Pricing: Individual users can have a custom renewal price instead of the package price.
4. Expiry Extension Limits: Added configurable maximum hours, days, and usage count for selfcare expiry extensions.
5. Collection Forecast: Added a report for expected bills, collections, pending dues, expired-user dues, and partial payments.
6. OTT Management: Added OTT API settings, package lists, activation history, and user assignment.
7. MRAM SMS Gateway: Added text and Unicode SMS support with sender ID, label, and balance settings.
8. bKash Agreements: Added saved bKash agreements for easier repeat payments.
9. Permanent Web Blocking: Added permanent IP and CIDR blocking with country and network information.
10. OLT Auto Detection: Added automatic OLT brand, model, SNMP health, and ping detection.
11. Admin Notifications: Added a setting for each administrator to enable or disable notifications.
12. BillPay API: Added support for BillPay payment types and improved payment processing.

Performance Improvements:
1. Improved OLT List loading by checking device status in the background.
2. Improved dashboard, finance, revenue, payment, and user list queries.
3. Improved ONU synchronization and large RADIUS accounting lookups.
4. Added shared invoice calculation logic to keep selfcare and quickpay totals consistent.

Database Updates:
1. Added protection against duplicate payment transaction IDs.
2. Added OLT detected brand, model, and status cache fields.
3. Added OTT API settings and permissions.
4. Added the selfcare portal URL setting for SMS and quickpay links.
5. Added bKash agreement and payment recovery tables.
6. Added MRAM SMS gateway configuration.
7. Added BillPay payment types.
8. Added RADIUS indexes for faster NAS and ONU user lookups.

Bug Fixes:

1. Extend Expiry Time: Resolved an issue where clicking the "Edit" button would unintentionally trigger an additional expiry time update.
2. Profile Bandwidth Management: Fixed bugs affecting the correct application of profile download and upload speed limits.
3. Payment Gateway Logo: Corrected the display issue with reseller (partner) payment gateway logos on invoice and payment pages.
4. Quickpay New Expiry Date: Fixed incorrect new expiry date calculation when a user changes their package via the quickpay page — now correctly calculates from today instead of the old expiry date.
5. Quickpay Total Amount: Fixed incorrect (lower) total amount shown on package change in quickpay — new package is now charged at full price.
6. Duplicate Payment Prevention: Resolved an issue where online payments were occasionally recorded more than once for the same transaction.

New Features:

1. Mikrotik Login for Admin & Staff: Added the option for administrators and staff users to log in directly to Mikrotik routers from the NAS management page.
2. Custom Bandwidth Management: Introduced the ability to set individual custom download and upload speed limits for specific users, overriding the profile default.
3. Custom Pricing: Added support for assigning a custom price to individual users that overrides the standard package price during renewal.
4. Extend Time Limit Settings: Added configurable maximum extend hours and days that a user can self-extend their expiry from the selfcare portal.

Database Updates:

1. Added max_extend_hours and max_extend_days settings to the user portal settings table.
2. Cleaned up duplicate payment entries with the same transaction ID.
3. Added a new performance index on the radacct table to speed up NAS online user queries.

Bugs Fixed:

1. Partner Quick Search All Users — Admin Users list was not showing all users correctly under partner scope due to partnerId filter not being passed properly.
2. NAS Partner Cache Not Clearing — After editing or deleting a NAS, the partner's NAS connection cache (partner:nas:info:{id}) was not being removed from Redis, causing stale data to appear.
3. Partner Added Custom Pricing Packages — Package price for users with custom pricing was not displaying correctly under partner scope.
4. Payment Gateway Logo Responsive Fixed — Payment gateway logos were not displaying properly on smaller screens.
5. NAS Monitor Off Still Showing RTT & Packet Loss — When Monitor (ping) was disabled for a NAS, the table still showed RTT and Packet Loss values. Now shows - when monitor is off.
6. Auth Log Purge Was Slow & Incomplete — Batch size increased from 10,000 to 50,000, removed ORDER BY, added auto index creation. Purge is now significantly faster.
7. SQL Injection Risk in Admin Users List ORDER BY — Column name is now validated against a whitelist before being used in ORDER BY clause.
8. OLT Port List Not Detecting PON Ports — Only EPON prefix was detected before. Now PON prefix is also recognized correctly.
9. Approve Payment bind_param Type Mismatch — Fixed a type mismatch bug in ISP/Partner monthly collection calculation.

New Features:

1. Payment Gateway Orderable — Payment list columns can now be sorted by clicking the column header.
2. User List — Last Log Off Date & Time — User list now supports filtering by the last disconnection date and time.
3. BIN Number on Invoice Settings — VAT BIN Number field added to Invoice Settings.
4. Red Data (fastsmsbd) SMS Gateway — New SMS provider "Red Data" added to SMS Settings.
5. Complaint List Excel Export — All complaint pages now support direct Excel export.
6. Invoice Payments Summary Live Refresh — Summary cards on the Invoice Payments page now refresh live without reloading.
7. CSRF Token Auto-Refresh — Forms on long-open pages were getting stale token errors. Token now auto-refreshes every 25 minutes.
8. Admin User Update Detailed Change Log — Detailed log of exactly which fields were changed and by whom when an admin user is updated.
9. Admin Profile Edit Syslog — Admin profile edits are now recorded in the System Log.
10. System Update Page UI Improved — Update log entries are now displayed in a cleaner, more readable format.
11. FreeRADIUS SQL Queries Updated — queries.conf and radiusd.conf updated to the latest version.

Bug Fixes:

1. Branch Not Showing After Add — When adding a new Branch, the Customer ID Prefix field was not being sent to the server, so the Branch appeared to be added successfully but was never actually saved. This has been fixed.

2. _Profile Suffix Showing in Online Users Page — The Profile column was displaying an extra _Profile text at the end of every profile name. Now only the actual profile name is shown.

3. Bill Cycle Dropdown Showing All Dates — On the User List page, the Bulk Bill Cycle Change dropdown was showing all possible dates instead of only the dates configured for that Partner. Now it loads the Partner's own configured Bill Cycle dates.

4. Cache Not Updating After Payment Assignment — After assigning a payment, the user's Expiry and Invoice were not reflecting immediately in the UI. Cache invalidation has been added to fix this.

5. Delete Operations Not Validating IDs — When invalid or empty IDs were sent to Delete APIs, no proper error was returned. Input validation has now been added with appropriate error messages.

Bug Fixes:
1. Bandwidth History page now shows the correct package name without the _Profile suffix that was incorrectly appearing before.
2. Renewal History page date column now sorts correctly from latest to oldest.
3. Complaint list page date column now sorts correctly from latest to oldest, and the list now opens showing the most recent complaints first.
4. When a user is renewed and their package is changed, the system now immediately updates their IP pool and reconnects them so the new package takes effect right away without waiting.
5. When extending an expired user's account, the expiry date is now properly synced to the user record so FreeRADIUS immediately recognizes the renewal and removes the expired IP pool restriction.
6. SMS sent timestamp (sent_at) is now correctly recorded when an SMS is delivered.
7. Expired reminder SMS no longer sends duplicate messages to the same user on the same day.
8. OLT List page now shows SNMP Health and Ping status columns with color-coded indicators (OK, Issue, Disabled) and tooltip details.
9. Digital Payments page now clears cached table state before reloading after a payment action, preventing stale data from appearing.
10. Profile lookups now only return enabled (active) profiles, preventing disabled profiles from being assigned to users.

New Features

1. PWA (Install as App): Both the Admin Panel and User Selfcare can now be installed as an app on mobile and desktop browsers. An install prompt banner appears automatically when the conditions are met (HTTPS + supported browser). Service worker, manifest, and PWA icon are added for both panels.
2. Push Notifications (Admin Panel): A notification bell icon has been added to the admin topbar. Admins receive real-time payment notifications. Admins can also subscribe to Web Push (browser push notification). From Edit Partner page, partner admins can turn off receiving notifications.
3. Push Notifications (User Selfcare): A notification bell icon has been added to the user selfcare topbar. Users can receive custom notifications sent by admin. From the Profile page, users can view and revoke their registered notification devices under a new "Notification Devices" tab.
4. Bulk Send Notification: From the Users List page, admin can now select multiple users and send them a custom notification. Supports placeholders like {username}, {first_name}, {expiry_date}, {package_name}, etc.
5. Filter Send Notification: A new page (filter-send-notification.php) added so admin can send notifications to filtered groups of users.
6. Notification Log: A new Notification Log page has been added so admin can review the history of all sent notifications.
7. Firebase Push Notifications (Additional Channel): Firebase can now be configured as a secondary push notification channel from General Settings. Requires Firebase Project ID, Sender ID, App ID, Web API Key, VAPID Public Key, Server Key, and Service Account JSON.
8. User Details API: A new REST API endpoint (/api/user/details.php) has been added. It allows fetching user info by ID, username, or phone number. Can be enabled/disabled from General Settings. Supports API key authentication via X-API-KEY header and an option to mask sensitive fields.
9. Extended Users: Admin can extend a user's expiry time by hours or days (even if already expired). Dashboard now shows an "Extended Users" count widget. Users list has a new "Extended" filter column showing when the user was last extended and by which admin. All extension actions are logged in a new srzone_user_extend_log table.
10. Portpos Payment Gateway: Portpos has been added as a new online payment gateway option. Includes both user-facing and partner-facing checkout pages.
11. System Log — IP Country Flag: IP addresses shown in the System Log now display the country flag emoji. Hovering shows a tooltip with the country name and ISP/organization info.
12. Auth Log — Reply Message Column: The RADIUS authentication log now shows the "Reply Message" column (the reason for Accept/Reject from the RADIUS server).
13. Auth Log — Purge Button: A "Purge Old Logs (>1 day)" button has been added to the auth log page so old RADIUS log entries can be cleaned up easily.
14. Cache Management: Two new pages added — Cache Management and Cache Diagnostic — so admin can monitor and clear system cache.
15. NAS — Disabled/Suspended Pool: Two new fields added to NAS configuration: disabled_pool and suspended_pool. This allows routing disabled/suspended users through a separate IP pool.
16. Leads — Delete Lead: A new "Delete Lead" option has been added.
17. About Page: The About page has been redesigned with a cleaner card-based layout showing system version, server stats, and system information.

Bug Fixes & Improvements

1. System Firewall — CSRF Security Fix: The IP unban action was previously done via a GET request (URL parameter), which was a security vulnerability. This has been fixed — unban is now done via POST with a CSRF token. Firewall status data is also cached for 15 seconds to reduce repeated shell calls on page reload.
2. Admin Login — Security Hardening: CSRF token added to the admin login form. Session security settings (session.use_only_cookies, cookie_samesite) configured. Input validation added before submitting login request.
3. CSRF Protection — AJAX Handlers: CSRF validation (isAdminRequestTrustedCompat / isValidCsrfTokenCompat) added to all admin AJAX handlers across the system.
4. Billpay API — Push Notification After Payment: After a successful bKash or Nagad bill payment via the Billpay API, a push notification is now sent to both the customer (selfcare) and the partner admin.
5. Quickpay — CAPTCHA Added: CAPTCHA verification step added before account lookup in the Quickpay flow. Supports searching by Account Number, Username, or Mobile Number.
6. Backup Script — FTP Password Encryption: FTP passwords stored in backup settings are now encrypted/decrypted securely. Dropbox token refresh failure now logs a warning and falls back gracefully instead of failing silently.
7. Dashboard — Lead/Complaint Counts Fixed: Lead and complaint counts on the dashboard were incorrectly filtering by both partner and branch in some cases. Fixed to use only the relevant filter.
8. User Selfcare Finance Info, Sessions History, Traffic Report — Date Format: Dates in these three pages now display in the format 27 Apr, 2026 4:28 pm instead of raw database timestamps.
9. Admin Sessions Tracking: A new srzone_admin_sessions table is created to track admin login activity, current URL, and page title.
10. Settings Table Index: An index on srzone_settings.attribute column added for faster settings lookups.

Bug Fixes
1. Fixed Pay Later invoice issue where the second renewal could become Paid instead of Pending because due amount was being subtracted twice.
2. Fixed custom price query in Pay Later flow by correcting the user ID variable, preventing incorrect pricing fallback.
3. Fixed Rename Username popup JavaScript errors in multiple pages (Renewal, Documents, Print Invoice), so actions no longer break due to stray braces.
4. Fixed SMS modal markup issue in Renewal Cancel page (remaining counter ID and broken class quote), so character counting works properly.
5. Updated SQL migration to make srzone_ippools.toip nullable, fixing IP Pool add failures for CIDR-based entries.

Improvements
1. User Online Sessions page now shows a live Remaining Time countdown instead of only a static expiry date.
2. Session Time format was improved to compact readable style like 2w 4d 1h 3m 15s (and shows 0s when empty).
3. Profile Name display placement in Online Sessions details was cleaned up for better readability.
4. Minor cleanup in scheduled profile cron file comments.

Bug Fixes:
1. Rename button on 19 user pages now shows proper error message on failure
2. Expired voice call records are now automatically deleted after 30 days
3. Renew page no longer shows due amount when balance is zero
4. Day-wise renewal bugs resolved
5. Due amount column added to finance report

New Features:
1. IPv6 support added in IP Pool management (add, edit, delete)
2. User profile page now shows a live countdown timer to expiry instead of a static date
3. Finance report enhanced with partner-level breakdown
4. Removed unused temporary SQL migration and rollback files