Notes de version

v0.16.11

Stronger sign-in protection, on-demand screen lock and Mollie refund tracking

New organizations now start with required two-factor sign-in for the admin portal, every sign-in lock sends an email, and you can lock your screen whenever you step away. Mollie payments now follow refunds and chargebacks in your payment history.

Fonctionnalités

  • Two-factor sign-in by default: every new organization now starts with required two-factor sign-in for the admin portal, and the owner can switch it to optional in the security settings; existing organizations keep their saved setting.
  • Emails for every sign-in lock: when sign-in is locked temporarily after wrong passwords or codes, the account holder gets one email that says when the lock ends and how close the final lock is. After 10 wrong attempts in a row, that step stays locked until a password reset or a two-factor reset, with its own email, and a wrong password now shows only “Invalid email or password”.
  • Recovery for locked accounts: in Status & Access and in Portal access, you can send a password reset link or reset two-factor sign-in, while Unlock stays for temporary locks. You can now also reset two-factor sign-in for people who use the Client Portal, after you confirm with a code from your own authenticator app, and they need to do nothing beforehand.
  • Lock screen on demand: choose Lock screen in the account menu, right before Sign out, in the admin portal and the Client Portal, including the Account sheet on a phone. Protected content disappears at once and you return with your password.
  • Mollie payments with refunds and chargebacks: Pay links now offer only instant methods that you enabled, such as iDEAL, Wero, cards, Apple Pay, Google Pay, Bancontact, KBC, Belfius and PayPal, while bank transfer, pay-later and vouchers no longer show. A refund or chargeback made in Mollie is recorded in the payment history, and when the whole payment goes back, the period becomes unpaid again under the same rules as Undo payment.
  • Receipts name the method: the receipt email now shows how the payment was made, for example “Online · iDEAL”.
  • Refund guidance: the “Paid online” status has an ⓘ that explains that Praxium never moves money, gives the steps in Mollie with the payment's reference and links to Mollie's refund article, and the greyed Undo payment names Mollie and the steps.
  • Undo a desk payment: you can now undo a payment that was recorded at the desk.
  • Clearer membership checkout: in the Client Portal, a plan someone already holds shows as a disabled option with a note beside its name, the terms link sits under the checkbox, and repeated “Book with” labels are numbered.
  • Payment links in the admin portal: “Copy payment link” moved into the row menu, and “Connect with Mollie” shows as Coming soon.
  • A calmer Client Portal: the home lists whole days of upcoming appointments, up to three, every card has one flat frame, “Awaiting confirmation” shows as a white framed pill, and sign-in notices sit inside the card in the brand tint. On a phone, the Account tab opens a sheet with the account menu.
  • A personal “Verify it's you” page: it greets you by first name and says why it asks, either the idle lock or the regular password check, and only the password check offers “Forgot password?”.
  • One look for information messages: every message that informs and asks nothing is now the same blue box with an ⓘ icon in every portal, while warnings stay amber and errors stay red.
  • Password change notice: the “Also log out of all other devices” box is gone, because a password change always signs you out everywhere, and a blue notice beside the form now says so before you change it.
  • Email previews without a click: Email Settings shows the selected template as soon as the view opens, so the “Render preview” button is gone.
  • One Security tab layout: the two-factor backup reminder now sits in the right column, like the password notice.
  • Plum branding preset: the “Plum” preset replaces “Rose” in the branding settings.
  • First payment before saving: when you set up a membership, you can now pick the first payment before you save.

Correctifs

  • Names in emails: names of organizations and people with an apostrophe, such as O'Brien, now read as typed in the email body, text version and subject, instead of showing stray characters inside the name.
  • Entity names without markup characters: an entity name can no longer contain angle brackets or curly braces, saving such a name shows a message, and a stored name that has them falls back to the default name.
  • Password change in the Client Portal: changing the password works again; before, it answered “Resource not found” after the password had already changed and left other sessions open, and now it signs out every device.
  • Locked or deactivated accounts: when an account is locked or deactivated while someone is signed in, the session now ends and the sign-in page names the reason, instead of every page failing with a plain error.
  • Two-factor reset emails: the email about a two-factor reset now reaches staff and people who use the Client Portal, where it never left before, and for the Client Portal it tells them to set up an authenticator app again under My account, Security.
  • Payment made for someone else: a person who paid another person's Pay link now reads that the payment cannot be found on their account and is recorded on the other membership, instead of a promise of a delay that never came true, and the sign-in page says a payment for someone else needs no sign-in.
  • No sideways scrolling on a phone: pages with tables no longer scroll sideways because of hidden text, for example the Memberships tab of a person's record.
  • Badges and hint popovers: badges with an ⓘ are as tall as any other badge, and an ⓘ popover never grows wider than the screen.
  • First page after an update: the first page load after an update no longer fails with “security state unavailable”, so you no longer need a reload.
  • Praxium in Application Info: the compliance summary in Application Info now says Praxium instead of IJFysio, and example placeholders, such as the work email when you add a staff member, use neutral example businesses.

Sécurité et fiabilité

  • Counted password confirmations: every time you confirm your password, for example to unlock the screen, change the password or manage two-factor sign-in, wrong attempts now count toward the sign-in lock, and a locked account is refused.
  • Better protected sign-in sessions: additional safeguards protect sign-in sessions in every portal.
  • More dependable online payments: a failed payment request is retried safely, every call to Mollie ends within its time limit, and the receipt email goes out after Mollie has been answered.
  • Reliable settings updates: changes to your organization's settings now reach every server, instead of occasionally taking up to five minutes.
  • Protected payment updates: an unknown caller can no longer use up your organization's rate limit for payment updates from Mollie.