Zender - WhatsApp and SMS Messaging Platform and use Android as SMS Gateways (SaaS) v3.11.0

Zender - WhatsApp and SMS Messaging Platform and use Android as SMS Gateways (SaaS) Changelog

Updating your languages

This release adds new text. If you already have a language installed, your own copy is never overwritten by an update, so the new phrases will show as raw keys until you refresh it.

Download the latest files from https://github.com/titansys/zender-languages and re-upload them under Administration → Languages.

Customised a language? Do not overwrite it. That repository's "changes" folder lists exactly the keys each version adds — take the file for this version and add just those lines to your own translation.

Changelog v3.11.0

• Fixed package and credit purchases failing on every payment method, including bank transfer. Currency conversion has been broken since 3.10.0, so checkout could never complete. Add your Exchange Rate API key under Admin → Overview → System; a site already priced in USD does not need one.
• Updated OTP verification to require the phone number being checked, not just the code. Any integration that calls it must now send the number as well. This closes a flaw that let someone verify a number they did not control.
• Updated the Admin API to refuse an empty token, and to create one for you when you switch the feature on. An install with the Admin API enabled but no token generated was open to anyone who found it, so check yours.
• Updated deleting a WhatsApp account through the API to require the delete permission, which was documented but never enforced. A key you scoped without delete rights could still delete accounts; if any integration relied on that, grant the permission properly.
• Fixed package sending limits never being applied, so every account could send without limit whatever its package allowed. Limits now work as intended — review your packages before you update if you rely on them.
• Fixed the connection to your WhatsApp server failing whenever its secret contained a "#". A secret containing a "/" is now refused when you save it, so choose a different one if yours has it.
• Fixed Android pairing codes expiring before they appeared on screen, which made pairing impossible across the Americas and left the code valid far too long further east.
• New provider system for SMS gateways and link shorteners. Pick from 17 providers included with Zender, or paste a provider file for anything else. Check your gateways and shorteners after updating: recognised providers are converted for you along with whatever credentials could be read from the old file, but anything self-hosted — such as YOURLS, Tiara, PHPShort or 66biolinks — has to be added again by hand, and a provider left short of a credential will refuse to send until you complete it.
• Removed the option to upload a PHP file for a gateway or shortener. Uploading code onto your own site was a security risk, and providers are ordinary configuration now.
• Fixed senders being charged more than once for the same message when a provider repeated a delivery report, or when a phone repeated a send report. Partner commissions were duplicated the same way, overstating what a partner was owed.
• Fixed edits silently failing to save on contact groups, API keys and orders, where the change appeared to fail for no stated reason.
• Fixed a deleted gateway stopping every scheduled message from being sent.
• Fixed scheduled WhatsApp messages being able to halt the whole scheduled run.
• Fixed AI flow auto-replies never being sent over SMS.
• Fixed a gateway saved without a default price emptying the gateway list, which left no way to edit or repair it from the dashboard.
• Fixed several lists showing nothing at all when one row referred to something since deleted — scheduled messages, marketing, and partner rates were all affected.
• Fixed the Flow Builder returning an error page instead of a proper response when a step was saved without a name.
• Fixed an unrecognised payout reference showing a server error page.
• Added a check that rejects deletion requests arriving from another site, so a crafted link an administrator clicks can no longer remove data.
• Improved sign-in security: session cookies are now protected from scripts and cross-site use, sessions are renewed whenever you sign in or out, and a session the server never issued is rejected.
• Improved the strength of generated API keys, webhook secrets and security tokens.
• Fixed uploaded files being able to run as code when an extension was hidden in the middle of the filename.
• Fixed imported contact names being able to inject content into your dashboard.
• Fixed error pages revealing where Zender is installed on your server, and added protection against your dashboard being framed by another site.
• Fixed plugin details never actually being checked before installing, so an invalid plugin was accepted as valid.
• Updated a bundled component to close a published security advisory.
• Fixed the installer showing the administrator password in plain text as you typed it.
• Improved accessibility throughout the dashboard: form labels are now linked to their fields, buttons and icons have names screen readers can read, keyboard focus is visible and stays inside open dialogs, and notifications are announced.
• Fixed the error page's "Reload" link signing you out instead of reloading.
• Fixed several API problems: retrieving an SMS message was impossible because of a permission that could not be granted, deleting an SMS campaign looked up the wrong value, and sending a one-time password rejected the capitalised "SMS" and "WhatsApp" the reference itself showed.
• Updated the API reference to drop endpoints, fields and permissions that no longer exist, and the offline copy now says plainly that it covers common tasks rather than the whole API, pointing to the full reference in your dashboard.
• Improved the Android gateway app: when SMS permissions are refused it now explains what is missing and how to enable it, including the extra step Android requires for side-loaded apps, instead of closing itself.
• Improved the Android gateway app's device information dialog, which now shows the SMS settings it was already collecting.
• Updated the WhatsApp server to the latest library, and tightened the sender checks at both ends so a slightly malformed sender is no longer accepted by one side and silently dropped by the other.
• Fixed problems being silently discarded rather than recorded, so database and provider failures now appear in your error log.