5.15.14.1

New Features

Network

  • Suspend Credit Limit Notifications - Network owners can now be notified — via callback and/or email — when a network account's balance falls below the configured Suspend credit limit value (#15734)

Banners and Campaigns

  • Search in Category Filter - The banner and campaign category filters now include a search box in both the merchant and affiliate panels — making it easy to find a category when many are configured (#15632)

Improvements

Security

  • Improved Output Escaping - Hardened content rendering in built-in widgets and the report builder (#15806) (#15745)
  • Reduced Information Disclosure - Removed unnecessary data from API responses and improved internal error handling (#15617) (#15772)
  • Strengthened Rate Limiting - Improved rate limiting on multi-operation API requests (#15600)
  • Hardened IP-Based Controls - Improved IP detection and validation for tracking endpoints and the REST API (#15498) (#15505)
  • PagSeguro Plugin Hardening - Tightened input validation in the PagSeguro plugin (#15541)
  • Background Task Hardening - Improved internal data handling in scheduled tasks (#15712)
  • Stripe Webhook Authentication - Strengthened security for incoming Stripe webhooks (#15746)
  • Two-Factor Authentication - Improved two-factor enrollment flow (#15863)

User Interface

  • Login Screens Facelift - Refreshed the login, forgot-password, and set-new-password screens in the signup themes with clearer affiliate vs. merchant role identification and an improved form layout (#15149) (#15741)
  • Logout Confirmation - After an explicit logout, the login screen now shows a "You have been signed out" confirmation banner (#15684)

Affiliate Panel

  • Default Affiliate Logout URL - The default affiliate logout URL now points directly to the affiliate login page, matching the merchant side. Existing customized URLs are unaffected (#15695)

Integrations

  • Shopify Checkout Extensibility - The Shopify integration now supports Checkout Extensibility when "Check missing order on order created" is enabled — except for stores using "Buy Now" buttons that bypass the cart (#14220)
  • SamCart Partial Refunds - Partial refunds received from SamCart webhooks are now tracked with the correct refund amount (#14614)
  • SamCart Recurring Refunds - Refunds of recurring SamCart payments now correctly refund the recurring commission, even when no matching recurring rule is configured (previously the initial payment was refunded instead) (#14730)

Plugins

  • Variables in Default Signup Values - The Default signup values plugin now supports field variables such as {$data1}, {$data2}, allowing hidden fields to be auto-populated from values entered in other signup form fields (#15703)

Performance

  • Home Screen Stats - Refund and chargeback statistics on the home screen, trends report, and quick report are significantly faster on accounts with large transaction history, and now load in a separate request so a slow stats query no longer holds up the rest of the home screen (#15818) (#15820)

Bug Fixes

REST API v3

  • fields Parameter on Grid Endpoints - Fixed the fields parameter being silently ignored on several GET endpoints (transactions, affiliates, banners, campaigns, direct-links, and their affiliate-side variants), so the API now correctly returns only the requested fields (#15761)

Integrations

  • Stripe One-Time Product ID - Fixed Stripe one-time product purchases not having the product ID stored on the transaction, which also caused subsequent refunds for those purchases to fail (#15720)
  • Shopify Remaining Commission on Refund - Fixed declined or refunded Shopify orders sometimes creating an extra "remaining" commission when nothing should have remained after the refund (#13945)

Affiliate Accounts

  • Affiliate Status Change Notifications - Fixed the "On affiliate status changed" email being sent to affiliates even when the merchant checked the "Don't send notification" option while changing their status (#15665)

Login

  • IP Whitelist with Anonymized IPs - Fixed the affiliate and merchant login IP whitelist comparing the anonymized IP against configured entries when "Anonymize IP addresses" was enabled, which blocked valid logins. The "access denied" message now shows the real IP so administrators can correctly whitelist it (#15722)