ASTPP Community Edition 6.2

This is a significant security and stability release for ASTPP Community Edition. It addresses a broad set of security issues, billing and routing defects, and operational improvements identified through internal review and responsible disclosure by external researchers.

All Community Edition operators are strongly advised to upgrade.

Highlights

• Wide-ranging security hardening across the web interface, the FreeSWITCH/dialplan call path, billing and rating, the customer and reseller portals, and file handling.
• Removal of the usage data collection and feedback mechanism (advisory).
• Multiple billing, rating, and package-handling fixes.
• Includes a required database update (astpp-6.2.sql) — see Upgrading.

What's Changed

• Fixed reseller customer DID calls where cost/min was 0.00 (#723, @AshishGohil840)
• Use milliseconds to calculate call billing, improving billing accuracy (#726, @smrdoshi)
• Login security patch (#729, @smrdoshi)
• Updated README (#733, @smrdoshi)
• Removed the usage data collection and feedback module — no account or personal data is collected or transmitted by the application after this change (advisory) (#734, @kinjal-inextrix)
• Applied a broad set of security hardening and bug fixes across the web interface, billing, routing, and API handling, with an accompanying database update astpp-6.2.sql (#735, @fagun-inextrix)
• Hardened internal endpoints, the database error page, and static asset handling (#737, @fagun-inextrix)

Upgrading

• New installations: use the v6.2 installation script.
• Existing v6.0 installations: use the v6.2 upgrade script, and import database/astpp-6.2.sql as part of the upgrade.
• This release targets the existing PHP 7.4 environment. PHP 8.5 support is planned as a separate upcoming release.
• As general good practice for any internet-facing billing platform: restrict access to the web interface and SIP ports to known addresses where possible, use strong, unique credentials, and keep regular backups.

Security & Reporting

• We follow coordinated disclosure. Published advisories and CVEs for ASTPP are maintained here: https://github.com/inextrix/ASTPP/security/advisories
• To report a security issue, please see our guidelines: https://astppbilling.org/security/guideline
• The optional API add-on is not covered by this release and should be treated as unsupported; we recommend removing it until a reworked version is available.

New Contributors

• @fagun-inextrix made their first contribution in #735

Credits

Our thanks to the researchers who reported issues responsibly, and to the community members who raised concerns:

• infrahost (https://infrahost.ch/) and Raphael Schneeberger (https://github.com/ScIT-Raphael)
• Nurullah Özatak (https://github.com/ozatakresearch)
• kta1kri (https://github.com/kta1kri)
• Ahmed Ibrahim (https://github.com/SkeletonSec)
• Mansoor Ahmad (https://github.com/wict0rious)

---

Full Changelog: V6.0.6...v6.2