Addon module for WHMCS · Free · MIT

Examen

Find out which of your modules survive WHMCS 9 before you upgrade, not after.

• Free
• Beta — request a copy
• MIT licensed

What it is

Examen is an addon module that audits the WHMCS install it is sitting in. It walks every addon, server, provisioning, gateway and registrar module on disk, reads the source without running any of it, and reports two things: what will break when you move to WHMCS 9, and what about the install itself is worth hardening.

You get a verdict per module — Ready, Needs review, Blocked or Encoded — with the file and line behind every finding, and a single 0–100 readiness score for the install so you can tell at a glance whether the upgrade is an afternoon or a project.

The name is the old monastic habit of the daily examination: sit down once a day and look honestly at what is actually there. That is the whole idea.

The WHMCS 9 problem

WHMCS 9 raises the floor underneath everything you have installed. It needs a newer PHP — 8.2 as the minimum, 8.3 the version to be on — which means the removals and deprecations that landed in PHP 8.2 and 8.3 are now your problem. It ships Smarty 4, which dropped template features that older WHMCS themes and modules leaned on for years. And it raises the minimum ionCube Loader, which can quietly strand an encoded module you have no source for.

The install itself is rarely the hard part. The hard part is the six or ten third-party modules that came with a template, a reseller, or a developer who has since moved on — each written against a PHP and a Smarty that no longer exist, and none of them reviewed since. The failure mode is not a helpful error at upgrade time. It is a client-area page that renders blank, or an order that silently stops provisioning, discovered by a customer.

Examen is the pass someone would do by hand if they had a free week and knew exactly what to grep for.

What it checks

Compatibility

Source-level, across every module directory it finds:

• Removed and deprecated PHP functions for 8.2 and 8.3 — utf8_encode and utf8_decode, each, create_function, money_format, the ereg* family, the mcrypt_* family, strftime, and others in the same category.
• Deprecated syntax — ${var} string interpolation, callable strings that resolve relative to the calling scope, FILTER_SANITIZE_STRING, the (real) cast, and the old implode argument order.
• Dynamic properties — a heuristic pass for writes to properties that were never declared, which PHP 8.2 deprecates and a later version will make fatal.
• Legacy WHMCS database helpers — select_query, update_query, insert_query, full_query, and any surviving mysql_* calls.
• Smarty 4 blockers in .tpl files — {php}, {include_php}, {fetch}, $smarty.template_object and {insert}.
• Smarty 2 and SmartyBC APIs in PHP — the compatibility-class usage and older method calls that Smarty 4 no longer provides.
• Encoded files it cannot inspect — ionCube, SourceGuardian and Zend Guard files are detected and reported as Encoded rather than guessed at. An encoded module is a question for its vendor, and Examen says so instead of pretending to have read it.

Environment

• Your PHP version against the WHMCS 9 requirement — 8.2 minimum, 8.3 recommended.
• ionCube Loader version against the minimum for your PHP minor — 13.0.2 on PHP 8.2, 14.4 on PHP 8.3.
• The PHP extensions WHMCS requires, and which of them are missing.

Security

Configuration and filesystem checks on the install itself:

• An admin directory still on its default name.
• Permissions on configuration.php that are wider than they should be.
• attachments, downloads, templates_c and crons sitting inside the web root where they can be reached over HTTP.
• A leftover install/ directory.
• Active administrators with no two-factor authentication enabled.
• An administrator still using the default admin username.
• API credentials with no IP allowlist attached.
• Error display or SQL debug mode left switched on in production.

What you do with the results

• A weekly scheduled scan with an email summary, so a module added in six months' time does not go unlooked-at.
• CSV and JSON export of every finding, for a ticket, a spreadsheet or a vendor email.
• A history of recent runs, so you can see whether the score is moving in the right direction.

What it will not do to your install

Requirements

• WHMCS 8.13 or any 9.x release
• PHP 8.1 or newer
• An administrator account that can activate addon modules

Examen is deliberately runnable on the version you are on now — auditing an install for WHMCS 9 is not much use if it only installs once you are already there.

Installing it

1. Upload the module to modules/addons/lm_audit in your WHMCS directory.
2. In the admin area, go to Setup → Addon Modules and activate Examen.
3. Assign the admin roles that should be able to see it, in the same screen.
4. Open the module from Addons and run your first scan.

A first scan reads every module directory on disk, so how long it takes depends on how much is installed rather than on how big your client base is.

Beta testers wanted

Licence

Examen is released under the MIT licence. The source is readable, forkable, and yours to keep running whatever happens to us. There is no encoder and no licence server.

Changelog

All WHMCS modules · Support · Privacy · Terms

WHMCS is a trademark of WHMCS Limited. Examen is an independent module for WHMCS built by Liquid Monks, and is not affiliated with, endorsed by, or sponsored by WHMCS Limited.