Remove legacy PHP view fallbacks and always render Twig templates (Controller, Router). Update ErrorHandler to attempt Twig rendering and provide a safe, escaped minimal HTML fallback on failure instead of requiring PHP views. Also pass whoisData into the domain view. These changes standardize on Twig templates and harden error output.
Migrate many view templates from raw PHP to Twig and modernize UI/UX for 2FA and settings. Controllers updated to provide avatar data and two-factor info (ProfileController, UserController) and SettingsController now includes timezone lists, notification preset selection, cron path, cached update state and rollback availability. ErrorHandler now attempts to render error pages via a new Core\TwigService with a safe fallback to raw PHP views. TwoFactorService generation silences deprecated warnings during QR code creation. Numerous .php view files were removed and replaced with .twig equivalents (2fa setup/verify/backup-codes and many auth, dashboard, domains, errors, layout, users, tags, tld-registry, etc.), and core/TwigService was added. These changes move the app toward a Twig-based templating system, improve 2FA flows, surface avatar images in lists/profiles, and make error rendering more robust.
Add CSV/JSON export and import endpoints and UI for the TLD registry, plus a manual Create TLD modal and drag-and-drop import UX. Standardize import/export logging by adding Logger('import'/'export') calls to Domains, Tags, Notification Groups and TLD flows. Add TldRegistry model helpers (findByTld, getAll) used for deduplication and exports. Update routes for /tld-registry export/import/create and add a migration to bump app_version to 1.1.4. Also update default app_version, enhance WhoisService parsing (registrar regex and ISO-8601 date handling), and adjust the TLD registry index view to include IANA and Export dropdowns, import modal, create modal, and related JS behavior.
Treat file-only/hotfix updates (identified by commit SHA) as non-version changes and clear stale commit-cache so the UI no longer reports an available update after a hotfix. UpdateService now clears commits_behind_count and latest_remote_sha when no new commits are found. LayoutHelper and settings view consider installed_commit_sha vs latest_remote_sha and set commitsBehind to 0 when they match. NotificationService detects commit SHAs for the target version and emits a clearer "hotfix {sha}" message for file-only updates.
Handle hotfix upgrade messaging and clear stale update state after applying updates.
- UpdateController: when notifying admins for hotfixes, pass the current app version as the "to" version so notifications read e.g. "v1.1.3 has been updated" instead of showing a commit SHA.
- NotificationService: adjust system upgrade message to show a simple "has been updated" message when fromVersion equals toVersion (hotfix/file updates) and standard "upgraded from X to Y" otherwise; factor migration label formatting.
- UpdateService: clear cached update-check state after a successful update (add clearUpdateCache method) so the UI no longer shows a stale "update available" card. Keep latest_available_version unchanged to avoid view inconsistencies before migrations run.
Implement CSV/JSON import and export for domains, notification groups and tags (with masking for sensitive channel data), including size/format validation, in-memory CSV building, and logging. Add tag transfer and bulk transfer actions (admin-only). Introduce a new update system: Add UpdateController and UpdateService, migration 025_add_update_system_v1.1.3.sql, and installer changes to include the new migration and version handling; provide endpoints to check, apply, rollback and configure updates. Update helpers and UI bits: add getUpdateBadgeInfo in LayoutHelper, update notification icons/redirects, and add getMaxUploadSize in ViewHelper. Misc: add NotificationGroup::findByName, tweak .gitignore backups path, and update related views and routes.
Introduce richer notifications and domain status handling across the app.
- NotificationService: Add domain status alert formatting/sending, in-app notifications for available/registered/redemption/pending_delete, richer session_new and session_failed notifications (geolocation + UA parsing) and helpers for human-readable status labels.
- Auth/TwoFactor: Emit notifications for successful logins (including remember-me and 2FA) and failed login attempts; update last-login timestamp on various flows.
- DomainController: Wrap bulk domain create in try/catch to handle duplicate race conditions and log failures.
- WhoisService: Detect redemption_period and pending_delete statuses from WHOIS/EPP statuses.
- Settings/Setting: Add settings support for notification status triggers and bump default app_version to 1.1.2; persist/update status trigger values.
- Views/Layout/View helpers: Add parsing/formatting for login notification data, add new status labels/classes (available, redemption_period, pending_delete), update notification icons/colors mapping.
- Top-nav & Notifications UI: Enhance dropdown with rich login/failed-login display (flags, device icons), clickable domain redirects when marking read, badge IDs for dynamic updates.
- Error admin UI: Add copy error report button with robust clipboard fallback and toast UI reused from messages; improved copy UX in admin index/detail.
- Installer: Add new migration 024 to installer migration lists and adjust detected toVersion to 1.1.2.
- DB: Add migration file 024_add_status_notifications_v1.1.2.sql (new file).
These changes add user-facing alerts for domain lifecycle events and stronger login/security notifications while improving UI feedback and robustness during bulk operations.
Add handling for European-style dates (DD/MM/YYYY and DD/MM/YYYY HH:MM:SS) before calling strtotime. The code detects a leading DD/MM/YYYY pattern, interprets it as day/month/year when day>12 or when both day and month are <=12 (favoring European format used by many WHOIS servers like .pt, .es, .fr), then converts it to YYYY-MM-DD with any time part preserved. If month>12 the original string is left for strtotime to handle. This improves robust parsing of WHOIS date strings from servers that use day-first formats.
Introduce selectable webhook payload formats and Google Chat rich-card support. NotificationGroupController now reads and validates a webhook_format option (generic, google_chat, simple_text) and logs a warning if Google Chat format is chosen but the URL does not look like chat.googleapis.com. WebhookChannel gains format constants, a payload builder (generic/simple text/Google Chat card), improved Content-Type header, enhanced logging with masked URLs, response truncation, payload previews, and better RequestException handling. Views updated to expose a Webhook Format dropdown, contextual help (including Google Chat setup instructions), dynamic placeholders/help text, and include the selected format when testing/saving webhooks. These changes add format flexibility and improve observability and safety when sending webhook notifications.
Implements detection of rate limiting in WHOIS and RDAP responses in WhoisService, tracks last error type, and exposes methods to check and clear rate limit errors. Updates check_domains.php to queue domains that fail due to rate limits for retry with exponential backoff, grouped by TLD to avoid repeated rate limiting. Adds statistics and logging for retries and successful retry attempts, and introduces delays between checks and retries to reduce the likelihood of hitting rate limits.
Introduces Pushover as a new notification channel with priority-based alerts, device targeting, and custom sounds. Enhances domain status detection for .nl and .eu domains, ensuring accurate handling when expiration dates or explicit status flags are missing. Fixes PHP 8.x compatibility issues with null parameters in date functions and improves error handling and logging by replacing error_log() with a centralized Logger service. Updates documentation and migrations for version 1.1.1.
- Add avatar upload with Gravatar fallback and initials
- Fix false "available" detection for registered domains
- Clean up WHOIS status parsing and server display
- Update cron job to sync all WHOIS fields
- Fix TLD cache and .me domain parsing issues
Enhanced RDAP response handling to better detect domain availability by checking for 'free' and 'available' statuses in DebugController. WhoisService now normalizes 'free' status to 'AVAILABLE' for consistency in output.
Added checks to ensure vCard fields are arrays with at least 4 elements before accessing their values. This prevents potential errors when parsing registrar and abuse contact information from RDAP responses.
Added 'does not exist' and 'queried object does not exist' to the regex for detecting available domains in WHOIS responses, improving coverage for more registrar messages.
Introduces Mattermost as a new notification channel, including backend service integration, controller validation, UI form fields, and updates to channel type enums in the database schema and migrations. This enables users to configure and send notifications via Mattermost webhooks.
Updated all error and warning logging in TldRegistryService to use the injected logger instead of error_log. This improves consistency and allows for better log management and integration with application logging systems.
Updates calls to importLogModel->completeImport in exception handlers to include a 'failed' status parameter, ensuring clearer logging of failed import operations.
Eliminated Brotli compression support checks and related logging from TldRegistryService. All HTTP clients now explicitly use gzip and deflate encodings only, with cURL options set to disable automatic content decoding and restrict accepted encodings. This simplifies the code and avoids Brotli-related compatibility issues.
Enhanced the brotli support check by adding multiple detection methods: encoding field, features bitmask, and minimum version check. The detection results now include detailed checks and a final decision, improving reliability and logging for brotli support detection.
Enhanced Brotli support detection with detailed logging of detection results. Added logHttpRequest method to log HTTP request and response details for debugging, and integrated it into all HTTP client instantiations using the on_stats callback. Improved client creation logging and refactored Accept-Encoding header handling for clarity.
Introduces a static method to check for Brotli compression support and conditionally includes 'br' in the Accept-Encoding header for HTTP requests. Also removes old incremental migration files from the installer controller.
Moved admin/user isolation checks and related methods from Domain and NotificationGroup models to User model for better separation of concerns. Replaced direct database queries in controllers and services with new model methods. Added methods for assigning unassigned domains/groups, searching domains, and clearing old notification logs. Updated views for improved UI consistency.
Replaced error_log calls with structured logging using the Logger class in DiscordChannel, SlackChannel, TelegramChannel, and WebhookChannel. Log success and error cases with relevant context for improved observability and debugging.
Introduces a new 'Webhook (Custom)' notification channel allowing users to send JSON payloads to any HTTP endpoint (e.g., n8n, Zapier, custom APIs). Updates the UI to support webhook configuration, adds backend validation, and implements the WebhookChannel for sending notifications. Documentation is updated with usage instructions and payload examples.
Introduces two-factor authentication (2FA) with TOTP, backup codes, and email codes. Adds controllers, services, views, and migration for 2FA setup, verification, and management. Updates user and settings models, email helper, and relevant controllers to support 2FA policy enforcement, configuration, and user flows. Enhances security by allowing admins to require or disable 2FA, and provides backup code generation and management for account recovery.
Extracted all email sending logic into a new EmailHelper class for centralized management and improved error handling. Updated AuthController, SettingsController, and EmailChannel to use EmailHelper for sending emails and logging. Added auto-detection of SMTP encryption based on port in both backend (SettingsController) and frontend (settings view), improving user experience and reducing misconfiguration. Enhanced logging for email operations and improved UI feedback for encryption selection.
Updated date parsing logic to distinguish between ISO 8601 dates with timezone information and plain database datetimes. Plain datetimes are now explicitly parsed as UTC to ensure consistent handling and comparison.
Refactored error log model and views to use a unified 'notes' field instead of 'resolution_notes'. Added a modal dialog for entering resolution notes when marking errors as resolved in admin views. Improved stack trace handling in ErrorHandler by storing as JSON and formatting for display. Expanded NotificationService to support multi-channel notifications (email, Telegram, Discord, Slack), group notifications, and improved domain expiration alerts.
Updated the assignment of 'registration_date' and 'record_last_updated' fields to use the normalizeDate method, ensuring consistent date formatting in the TldRegistryService output.
Introduces error log tracking with new ErrorLog model, controller, views, and migration. Adds admin UI for viewing, resolving, and deleting errors. Implements bulk actions for users and notification groups, refactors domain filtering/pagination, and centralizes admin access checks using Auth::requireAdmin().
Introduces CSRF protection to all sensitive controller actions, integrates configurable CAPTCHA (reCAPTCHA v2/v3, Turnstile) for authentication and registration flows, and centralizes input validation via a new InputValidator helper. Adds new helpers and services for CSRF and CAPTCHA, updates settings and migration for CAPTCHA configuration, and enhances logging and error handling in TLD registry import processes. Also improves validation for user, domain, group, and profile inputs throughout the application.
