CWP module for WHMCS - rewritten for PHP 8 / WHMCS 9 (drop-in, MIT)

The official cwp7 module hasn't changed since 30 March 2020. WHMCS has shipped 15 releases since then and now requires PHP 8.2, so I rewrote it.

It's a drop-in replacement: same module name, same directory, same config option order. Existing server entries, products and services keep working with no reconfiguration.

https://github.com/bradleygb/whmcs-cwp-module


Why you'd switch

Running the 2020 module today, these are live faults, not style complaints:

• Disk and bandwidth reporting has never worked. It matches tblhosting.dedicatedip against CWP's ip_address, but dedicatedip is empty for every shared-IP account, so the query matches no rows. It also writes lastupdate with date('Y-m-d H:i:S') - capital S is PHP's ordinal suffix, producing "14:30:th", which MySQL rejects.
• Package changes don't work against current CWP. CWP has a dedicated /v1/changepack endpoint. The module posts to /v1/account with action=udp and the package suffixed "12@", where that endpoint documents a "@12" prefix. Nothing changes and WHMCS reports success.
• Resource limits aren't applied. CWP's add endpoint wants limit_nofile and limit_nproc; account/udp wants openfiles and processes. The module sends nofile and nproc, which neither accepts, so every account gets its package defaults.
• ChangePassword sends 'acction' instead of 'action'. The field never reaches CWP.
• A fatal TypeError in your daily cron. count() is called on the API payload without checking it's an array - on PHP 8 that aborts the cron run.
• The API key is written to the WHMCS Module Log in plaintext, and sent with CURLOPT_SSL_VERIFYPEER and VERIFYHOST both disabled.
• A live autologin URL is minted on every product-details page load and printed into the page HTML, where it persists in page source, browser history and referrer headers.

What's in the rewrite

All of the above fixed. TLS verification on by default with optional certificate pinning. The API key masked in logs and stripped from CWP's own error text - CWP echoes it back inside "Unauthorized action". Autologin sessions minted on click through WHMCS single sign-on. Account creation given its own 180-second budget, and a creation that times out is reconciled rather than left as an orphaned account.

Added: MetaData, TestConnection, ServiceSingleSignOn, ListAccounts for Server Sync, live account detail on the admin service page, and a client area block that makes no API call while rendering - so an unreachable panel can't stall a customer's page.

Optionally, changing a service's Product/Service applies the package to CWP directly, with no second click.

Errors name the exact API Manager function and action when a permission is missing, which matters because CWP's internal permission names don't match its own labels - account/udp is checked as "accout_upd".


Requirements

WHMCS 8.5-9.0, PHP 7.4-8.3, curl and json. Tested on 7.4, 8.0, 8.1, 8.2 and 8.3. MIT licensed. Community module, not affiliated with the CWP project.

Install

Extract into modules/servers/ and press Test Connection. PERMISSIONS.md lists the exact API Manager grants - note the grid is per function and per action, and an action left off produces "Unauthorized action" even when the function looks enabled.

Upgrading: replace the directory contents, nothing else. One thing can stop a previously "working" install - TLS verification is now on. If CWP serves a certificate from a public CA on 2304 you're fine; if it's self-signed, the README covers pinning it.

Issues and pull requests welcome.