In our previous update (v4.25) we added a host of new data export features. This included the ability to export invoice data to QuickBooks, Sage, Xero and several other popular accountancy packages.
For MIDAS v4.26, we’re adding a couple of additional features to the export capabilities of our booking software.
Export Users
MIDAS is already capable of exporting Booking, Client, Invoice, and Resource data in a range of formats.
For v4.26 we’re now also allowing user data to be exportable.
Exported user data includes all privileges assigned to each account within your MIDAS system.
One piece of advice we offer to help customers keep their MIDAS systems secure is that each user account should only be granted the minimum permissions each individual requires.
For customers with a large number of user accounts, this new export option allows administrators to quickly audit the permissions assigned to every user account.
Refined Client Data Exports
The ongoing global COVID-19 pandemic is forcing organizations to adapt to how they operate. Throughout this period, we’ve been listening closely to our customers feedback.
In addition, we’ve been adding new and improved features in v4.25 and v4.26 to further improve how MIDAS can work for your business in these unprecedented times.
One of our customer’s reached out to us as they wanted a way to collate the email addresses of all their clients who had bookings over a certain date range. This was so that they could send out a bulk email to inform them hat their facilities had temporarily closed.
Now, whilst a list of all client’s addresses could be exported by MIDAS, there was no easy way to generate a subset list of clients based upon when their bookings took – or were due to take – place.
We’ve addressed this for v4.26! There’s now the option to export all clients, or just details of those with bookings within a specific date range!
Export Clients With Bookings Within A Specified Date Range
For MIDAS v4.26 we’re improving the password change process for users, with the introduction of a new “Disallow Known Breached Passwords” admin setting:
Disallow Known Breached Passwords
With this setting enabled, whenever a user changes their password MIDAS checks that it doesn’t appear in any known online data breaches.
Have I been Pwned?
This feature utilizes the popular 3rd party “Have I Been Pwned” service. This is a database of more than half a billion passwords which have previously been exposed in various data breaches.
Don’t worry though, your actual password is never sent to the “Have I Been Pwned” service. Here’s how it works;
You enter a desired new password in MIDAS.
MIDAS creates a cryptographic “hash” (SHA-1) of the password you entered. The first five characters of this hash are sent to the Have I Been Pwned service.
If hashes with the same first five characters are found in the Pwned Passwords repository, the Have I Been Pwned service responds with all these hashes.
MIDAS sifts through the received hashes to see if there’s a complete match with the full SHA-1 hash of your new password.
If a match is found, your desired password has appeared in at least one public data breach. MIDAS will then display an alert and ask you to enter a different password.
The Change Password dialog in MIDAS
The chosen password isn’t considered secure as it appears in other online data breaches
The new “Disallow Known Breached Passwords” setting in MIDAS will be enabled by default. It can readily be enabled/disabled via MIDAS Admin Options → Manage MIDAS → Security.
We’re passionate about security, and this latest improvement is just one of the ways we help keep your account and MIDAS system secure.
Interested in learning more about security in your MIDAS system? Try these links…
Security is our number one priority here at MIDAS. We constantly strive to ensure our software remains secure, and provide users with a range of tools to help keep their MIDAS accounts and data secure.
We’re further enhancing security in MIDAS v4.25 and introducing a new admin setting.
New & Unfamiliar Login Notifications
A new “Alert users upon logins from unfamiliar devices” setting is located under MIDAS Admin Options → Manage MIDAS → Security.
With this setting enabled, a user account logged into from an unfamiliar browser/device, will trigger an automated email notification to the account holder.
Email Notification alerting user to an unfamiliar login to their account
This email notification is customizable through a template via MIDAS Admin Options → Manage MIDAS → Templates. The default notification provides details of the browser, operating system, and IP address of the new login. It advises that the notification can be safely ignored if the new login was genuine, or what to do if the user doesn’t recognize the login.
Obviously for these email notifications to be sent, your MIDAS system must be correctly configured for sending email.
Other “Under The Hood” Security Enhancements
You’ll often see “Security Enhancement” in the changelog for our MIDAS software. This is nothing to worry about, and it’s part of our pro-active approach to security.
We routinely make small changes to improve and “harden” our software against a variety of threats.
One of the security enhancements we’ve made in v4.25 is to drop usage of the “Math::Random::Secure” Perl module. Perl – the language that we develop our software in – is capable of natively generating random numbers. MIDAS uses random numbers for a variety of things, including password generation and unique session tokens. However, random numbers natively generated by Perl are not “cryptographically secure”. As such, we’ve been utilizing the “Math::Random::Secure” module to ensure that random numbers generated by MIDAS were cryptographically secure.
The developers of “Math::Random::Secure” haven’t updated it in over three years. Whilst the module still functions, it depends upon another module (Crypt::Random::Secure), which itself depends upon another module (Any::Moose) which has since been deprecated.
So for this reason, and also for performance reasons, MIDAS v4.25 now defaults to using Crypt::PRNG instead. If this Perl module isn’t available on your server, MIDAS will simply revert back to Perl’s native random number generator. However, it’s really easy to install Perl modules, and so for enhanced security we’d recommend installing Crypt::PRNG.
Dropping TLS 1.1 support for cloud-hosted customers
TLS stands for “Transport Layer Security” and is a mechanism used to facilitate secure connections and communications over the internet. To date, there have been three versions of TLS, each more secure than the last. The latest version of TLS is 1.3. The original TLS 1.0 version is considered “weak”, and no longer supported by modern browsers. We previously dropped support for TLS 1.0 on our servers back in July 2017.
To coincide with the release of MIDAS v4.25, we’ll be dropping support for TLS 1.1 connections to our client servers. Our client servers will continue to support both TLS 1.2 and TLS 1.3 secure connections.
Dropping TLS 1.1 support should have no noticeable impact for regular users of MIDAS. We’ve already dropped TLS 1.1 support on our website. If you’re reading this post, then you’ll still be able to access your hosted MIDAS system once TLS 1.1 support is dropped.
However, if you’re a cloud-hosted MIDAS customer utilizing the optional MIDAS API then you may need to take action. Please ensure that your applications and the underlying programming language you develop in can support (and are correctly configured for) TLS 1.2/1.3 connections.
If your applications/programming languages do not support at least TLS 1.2, your MIDAS API calls will begin to fail once we disable TLS 1.1 support.
Please refer to the vendor of your programming language if you’re unsure whether it supports TLS 1.2/1.3, or for assistance enabling such support in your development environment. This doesn’t affect API users interfacing with a self hosted MIDAS system.
These are just a few of the new and improved features for MIDAS v4.25. Please see this post for details of other new features you’ll find in v4.25.
If you’ve been following our recent posts, you’ll know that we’re introducing a whole host of new features for MIDAS v4.25. Many of the new and improved features in v4.25 relate to invoicing.
There’s a lot to take in, so we thought it would be useful to summarize the new and improved invoicing features of MIDAS, with links to posts with more information.
In addition to the above, there’s a handful of smaller invoicing improvements worth noting too:
Update visible notes once an invoice has been finalized
Once an invoice is first printed, or emailed to the client, MIDAS considers the invoice “finalized”. The content of finalized invoices cannot then be changed. However, MIDAS does allow you to update the paid status of the invoice at any time. Additionally, you can also add internal notes at any time. Internal notes are not visible to clients on actual invoices.
From v4.25 we’re now also allowing you to modify the “visible” notes section on invoices – even after they’ve been finalized!
Consolidate multiple identical invoice items
MIDAS now consolidates identical items on invoices. For example, say you’re adding a booking across two venues (rooms), each of which requires a “CD Player” resource in it.
When invoicing for these bookings, MIDAS would previously list the two venues separately and the two resources separately.
Now, MIDAS will identify these instances and combine items accordingly. So now instead of having two lines on an invoice both for a “CD Player” and both with a quantity of 1, they’d be a single “CD Player” line with a quantity of 2.
Empty itemized Invoice Notes excluded
The visible “Notes” section on invoices can be configured to be automatically populated with the content of a booking field. For instance, you could set the “Booking Notes” to automatically appear in the “Notes” section of the client’s invoice.
If multiple bookings appear on the same invoice, it could get confusing as to which booking the invoice notes relate to. That’s why we’ve previously provided an “Itemize Notes” option. When enabled, each item on the client’s invoice with an associated note is indicated with a reference number. This appears on the invoice line it relates to, and then also in the Notes section below.
If an item had no notes associated with it however, it would still be given a reference number. This could be just as confusing if none of the bookings had notes. You’d end up with a string of meaningless numbers in the Notes section, like [1] [2] [3] [4] [5]
We’ve sorted this out for v4.25! Now, only bookings with notes will be numerically referenced if the “Itemize Notes” option is enabled.
These are just a few of the new and improved features for MIDAS v4.25. Please see this post for details of other new features you’ll find in v4.25.
You can also ask questions and discuss the new features of v4.25 over on Reddit.