In this blog post we’ll shed some light on some of the “security enhancements” that were recently introduced in MIDAS v4.11 and v4.12.

IP Change Detection

Starting with MIDAS v4.12, If a logged in user’s IP address changes whilst they are logged in, then the system will automatically log the user account out, forcing the user to log in again.

It’s rare that a user’s IP address would legitimately change mid-session, so this additional security enhancement will not be noticed by the majority of our users.

What it does do however is strengthen user sessions against a “session hijack“. In general terms, a “session hijack” is when a malicious attacker takes over a user account by gaining access to the unique identifying token (or cookie) of an active user session.

With the new IP Change Detection implemented in MIDAS v4.12, should a user fall victim to a session hijack, the session would be immediately invalidated as the originating IP address would suddenly change from the valid user’s IP address, to the IP address of the attacker.

→ Tip: User’s IP addresses are also logged in each MIDAS system’s Recent Activity Log

Shorter Cookie Persistence

We’ve all come across website with “Remember Me” or “Keep Me Logged In” tick boxes on login screens. These mean that you don’t have to remember your username & password for the site each time you come to log in. When you select this box, information is stored in a browser “cookie” and retrieved the next time you visit.

MIDAS has included a “Remember Me” tickbox on the login screen since v4.07 (September 2014). Previously, the cookie saved by your browser would persist until 1st January 2020 – some 4 years in the future!

This meant that if you were to log in to MIDAS today, you could come back to the same browser in a few years time, and still log in without needing to remember your credentials.

We felt this was a little too long for your browser to be retaining such data. Therefore, from MIDAS v4.12 the “Remember Me” option will only remember your details for a period of 90 days. If you don’t log in again within this period, you’ll have to manually enter your email address/password again the next time you do.

Why is this better? Well, it ensures that “dormant” user accounts (those not logged into for over 90 days) don’t have lingering login details persisting in client-side cookies.

→ Tip: MIDAS Administrators can choose to disable the “Remember Me” option completely. This may be done via MIDAS Admin Options → Manage MIDAS → Security

Improved Session Control

In MIDAS v4.11, we introduced a new security setting to automatically log out any users that have remained logged-in for more than a set number of hours. This setting may be found under MIDAS Admin Options → Manage MIDAS → Security → Session Control.

This is different to existing “inactivity” logout setting, which causes users to be logged off after a period of no activity. The additional “Always force logout after…” setting automatically logs users off after a set period of time, regardless if they are “active” or not.

Why is this useful? Well, browser extensions/addons exist which automatically “reload” a webpage at a recurring interval. This could potentially allow a user account to remain logged-in indefinitely, even if the “Inactivity forces logout after…” setting was set.

For example, if “Inactivity forces logout after…” setting in MIDAS was set to “1 hour”, then usually 1 hour after a user’s last interaction with MIDAS, they will be automatically logged off. However, if an addon/extension were setup to “reload” part of MIDAS every 30 minutes, this would look like “user activity” to MIDAS, and so the account would never be automatically logged out.

To combat this, the new additional “Always force logout after…” setting was introduced for v4.11. If your business usually runs 9am-5pm, you could set this setting to 8 hours. This will mean that no user account can remained logged in for more than 8 hours in total. So if a user was to log in at 9am and use a browser addon/extension to effectively remain logged in all day, they will still be automatically logged out of MIDAS at 5pm.

New Session Manager

MIDAS can be configured to allow concurrent logins to user accounts from multiple browsers/devices. When enabled, this allows a user to be concurrently logged into MIDAS from their laptop, phone, and tablet.

MIDAS v4.11 introduced a new “Session Manager“. This allows users to see other devices they’re currently logged in from. The session manager shows the IP address and browser of each session, and allows you to remotely log out!

Improved Password Change Behavior

MIDAS offers the ability to allow multiple concurrent logins to the same user account. In v4.11 we’ve enhanced this security. We’ve made it so that if a user changes their MIDAS password, all other devices they’re currently logged into from will be automatically logged out. Previously, changing a password from one device wouldn’t take effect on other devices a user was logged into until the next time they logged in.

Cryptographically-secure Random Number Generation

MIDAS stores passwords which are SHA512 hashed and randomly “salted”. The “randomness” of this “salt” has been improved starting with v4.11. Now, if the Perl module “Math::Random::Secure” is available on the server where a MIDAS system resides, MIDAS will utilize it to generate cryptographically-secure random numbers.

The post Recent “Security Enhancements” in MIDAS appeared first on MIDAS - Room Booking System | Blog.

During this time we’ve seen many competitors come and go, and numerous customers making the switch to MIDAS. We have a genuine passion for how our software helps make life easier, saving time, money, and effort for venue administrators right across the globe, and we remain extremely customer focused.

With exciting new and improved features being added to MIDAS several times each year, we’re pleased to tell you about our latest update – v4.12 – which has just been released!

New & Improved in 4.12:

• New: Maintain a line of credit for clients, which is automatically applied to their subsequent invoices
• New: “Current Availability” venue report
• New: Support for card payments via Stripe
• New: %BOOKING_COST% and %TOTAL_COST% variables in booking confirmation/request approved email templates
• Improved: More control over generated content in various email templates
• Improved: Invoicing screen now shows “quick links” to recently created and recently finalized invoices
• Improved: Bulk invoice generation can now be limited by venue/booking type
• Change: Booking Request cancellation/notification unsubscribe links now require additional user click to confirm [Why?]
• Performance & Security enhancements
• Fixed: Cumulative roll-up of various fixes for issues discovered since v4.11 – see https://bugs.mid.as for details

How To Get MIDAS v4.12…

Help Improve MIDAS!

We’re able to bring you exciting updates like v4.12 thanks in part to our Beta Testers – many of whom are just every day MIDAS users!

Our Beta Testers get early-access to upcoming releases to explore and provide feedback on, allowing us to make changes and address potential issues before each new version is publicly released.

We also reward Testers for their contributions with discounts against the cost of purchasing MIDAS, or which can be used against upgrades & renewals for an existing MIDAS system!

We’re always on the lookout for additional testers to help shape future versions of MIDAS. It’s free to get involved and you don’t need any previous experience.

→ Find out more, apply now, and help shape future MIDAS releases

If you have any questions about MIDAS, why not drop us an email, or reach out to us through social media – We’d love to hear from you!

The post MIDAS v4.12 Out Now! appeared first on MIDAS - Room Booking System | Blog.

The “Booking Request” features of MIDAS, allow people to submit booking “requests” which then require approval by an administrator before becoming a “confirmed” booking.

There are a number of reasons why a booking request may legitimately appear to “vanish” from the system; first of all, another administrative user may have already rejected the original booking request, or the original requestor may have changed their mind and canceled their own request.

When a person makes a booking request, MIDAS automatically send them an email notification containing details of the request they’ve submitted. These email notifications also contain a “booking request cancellation link” allowing them to cancel their request if for whatever reason they’ve changed their mind before their request is approved.

Inspecting the provided “Recent Activity Log” for the customer’s MIDAS system, there was no evidence to suggest that another user had simply rejected the missing booking requests.

There was however evidence that the booking request cancellation links, contained within the notification emails sent to original requestors had been clicked.

The customer was confident that no-one had clicked these cancellation links in their emails.

Now, the “Recent Activity Log” within MIDAS is very useful – not only does it record actions performed within a MIDAS system, it also records the user who performed the action (where applicable), the time/date the action occurred, and the IP address of the device which performed the action.

This allowed us to correlate booking request cancellation link clicks with the IP addresses from which each originated.

Interestingly, the IP addresses could all be traced back to Barracuda Networks, Inc, a company offering security products, including email security and spam filters.

So what was going on?

Once upon a time spam filters could easily detect spam email messages, as spammers tended to the same domains in their spam. As a result, spam filtering software could simply scan the content of an email message, and cross-reference any links contained within against a list of known spamming domains.

Many spam filters still behave in this way, however, in an attempt to stay one step ahead of the spammers, some spam filtering software/services – such as those provide by Barracuda Networks, Inc, go one step further and actively “click” EVERY link in every email they scan. The purpose behind this is to analyze the content and domain every link points to.

Whilst this will most likely help reduce spam further for the recipient, it can have a number of undesired consequences for users!

For example, if the recipient subscribes to any newsletters/mailing lists which contain a one-click unsubscribe link at the bottom, they will be automatically unsubscribed simply by receiving the email itself, before they even open it – let alone click the unsubscribe link!

The same thing was happening for our customer’s booking request notification emails – the booking request cancellation links were being automatically “clicked” by the spam filtering software/services which were scanning the recipient’s email.

Balancing user convenience vs aggressive mail scanners

We’ve always believed in making things as easy as possible for users – which is why we originally made canceling booking requests as simple as a “one-click” link – click once, and your request is canceled.

However, in light of these recent issues, we’re making a small change for MIDAS v4.12. Canceling a booking request will now unfortunately be a two-step process. Clicking a booking request cancellation link in a notification email will take the requestor to a web page where they will need to then click a confirm button in order to cancel their request.

The introduction of this second confirmation step, whilst less convenient for the end-user, will at least prevent aggressive mail filtering software/services which automatically “click” every link in every email, from automatically canceling booking requests without any human interaction.

The same “two-step” behavior will also be applied for links in booking/invoice reminder emails to suppress future reminders from a MIDAS system.

In the meantime, if you’re running an earlier version of MIDAS, and notice your booking requests being automatically canceled without any intervention, please check and adjust the settings in your mail scanning/filtering software. You may need to add email from your MIDAS system to an “allow list”, or prevent the automatic following of links within email.

The post Missing booking requests? – Your mail filters may be to blame! appeared first on MIDAS - Room Booking System | Blog.

A growing selection of templates are available and editable within MIDAS, allowing you to customize and tailor the appearance of various parts of the software, as well as printouts and emails.

Templates are constructed using a combination of common HTML code and special MIDAS variables – don’t worry if you’re not familiar with HTML, we’re produced a handy “What is HTML and how do I use it within my MIDAS templates?” guide, complete with simple examples.

MIDAS also includes a visual WYSIWYG (what-you-see-is-what-you-get) template editor where you can simply drag/drop/insert elements into your templates, rather than entering raw HTML code.

Since the introduction of templates, email templates in particular contained a special %CONTENT% variable. This variable would be automatically substituted for generated content when an email was sent. For example, here’s some simplified content for a Booking Confirmation email template in MIDAS v4.11:

In the above template, when a booking confirmation email is sent, the variable %CLIENT_FIRSTNAME% is automatically substituted with the forename of the client the notification is to be sent to and %DATABASE% is be substituted for the name of your MIDAS database (usually your organization’s name).

The %CONTENT% variable is then replaced with details of the client’s bookings, and would include the booking fields that had been selected via MIDAS Admin Options → Manage MIDAS → Fields → Show In → Booking Confirmation.

Using the above template, the resulting email content may look like:

For MIDAS v4.12, we’ve overhauled email templates to give you far greater flexibility and control over the generated content of emails. The rigid %CONTENT% variable has been replaced with more useful variables. For example, a new booking confirmation email template may now look like this:

…as you can see, the original %CONTENT% variable has been replaced in v4.12 with a <bookings> … </bookings> section, in which you can add your own text and variables to customize the generated content exactly as you’d like. You can also include content from any custom booking fields you’ve added to MIDAS – for example, if you’ve created a booking field named “Test Field”, you can insert the variable %CUSTOM_TEST_FIELD% into the <bookings> … </bookings> section. (This brings email templates in line with the format of templates in our optional Digital Signage and Web Calendars addons, which have always supported <bookings> … </bookings> template sections)

We’ve also added support for a couple of new variables too; %BOOKING_COST% and %TOTAL_COST%.

%BOOKING_COST% can be added within the <bookings> … </bookings> section and will be substituted for the cost of the individual booking (including both venue and resource usage).

%TOTAL_COST% can be added anywhere in the template and will be substituted for the total cost of all the bookings listed in the email.

When editing templates via MIDAS Admin Options → Manage MIDAS → Templates, a complete list is displayed of all available variables that can be inserted into the current templates.

We believe replacing the limited %CONTENT% variable with a flexible <bookings> … </bookings> section in email notifications will give customers far greater control over the appearance and content of emails sent through MIDAS.

The post More Flexible Email Templates appeared first on MIDAS - Room Booking System | Blog.

Back in October 2010, we released MIDAS v3.10. This update introduced a new feature allowing your clients to pay invoices generated by MIDAS online using either PayPal or Google Wallet (or Google Checkout as it was known back then).

Whilst the ability for customer’s clients to pay their invoices online using PayPal was popular, Unfortunately, Google changed direction with their Google Checkout/Wallet service. This meant it was no longer a viable payment processor for customer’s client’s invoices. As such, the option to pay invoices via Google Checkout was removed as of MIDAS v4.07 in September 2014. You can read more about the sad demise of Google Checkout in this blog post.

Since then, PayPal has been the sole payment option natively provided within MIDAS to allow your clients to pay invoices online. Of course, with our optional API available, customers have been able to develop their own specific integrations with other 3rd party payment processors as required.

However, ever since we removed the Google Checkout/Wallet option, we’ve wanted to include a “PayPal alternative” as standard within our software.

For nearly two years now, we’ve made card payments simpler through our own website, by partnering with Stripe. We’ve been very impressed with Stripe, and they are now our preferred payment processor.

So we’re pleased to announce that Stripe will now also be a native payment option for invoices within MIDAS itself, along with the existing PayPal option!

Here’s a few of the things we really like about Stripe:

• Stripe allows you to take a payment on the current page. Unlike PayPal, the customer won’t be transferred to a separate “hosted” payment page.
• Despite allowing card payments to be taken on the current page, no card details pass through or are stored the server where your MIDAS resides. All the processing is handled by Stripe, ensuring you are fully comply with PCI DSS 3.1
• Stripe automatically withdraws funds to your bank account on a rolling 7 day basis. With PayPal, funds remain in your account until you manually withdraw them.
• Stripe never forces the customer to “create an account” in order to make a card payment. With PayPal, “unregistered” users may be forced to create a PayPal account in order to make a card payment. This can depending upon your geographic region, or the number of times you’ve used PayPal before.
• In our experience, Stripe’s processing fees have been lower than PayPal’s.

What about PayPal?

Now, reading the above, you make think that we’re anti-PayPal. Don’t worry – we’re very aware of the popularity of PayPal. It’s still arguably the most common online payment processor across the globe. Therefore, we have no plans to remove the PayPal payment option from our software. But we do believe in giving our customers choice over their payment provider. This is why we’re really exciting to be able to offer native Stripe integration starting with MIDAS v4.12!

You’ll be able to choose which payment provider to use to allow your clients to pay their invoices online. You can also configure both, to give clients a choice of completing their payment via PayPal or Stripe:

In order to accept payments through PayPal, you’ll need a PayPal account.

In order to accept payments through Stripe, you’ll need a Stripe account. You’ll also need Stripe API keys. For more information on obtaining these, please see our KB article “Configuring Stripe Integration“

Once you’ve set up your PayPal and/or Stripe account, you can enable and configure them via MIDAS Admin Options → Manage MIDAS → Invoicing → Online Payments. Once configured, your customers will then be able to pay their invoices online via https://your_midas_url/pay:

With Stripe integration, as soon as a client completes their payment, their invoice will automatically be instantly updated in MIDAS to reflect their payment.

With PayPal integration, you’ll also need to configure Instant Payment Notifications (IPN) within your PayPal account in order for MIDAS to automatically update a client’s invoice following a successful PayPal transaction.

The post Accept Card Payments with Stripe appeared first on MIDAS - Room Booking System | Blog.

One of the areas of our software that we often receive feedback and ideas for new features for is “Invoicing”. We’re pleased to once again adding even more Invoicing features for v4.12, one of which will facilitate the ability to maintain a line of “credit” for each of your clients.

Adding credit for a client is really simple, and is done via the “Current Credit” field in each client’s database entry. Simply enter the amount to credit to associate with the client and click “Save Changes”:

Then, the next time an invoice is generated/created for the client, this credit will be applied to their invoice as a discount, and the line of credit remaining for the client updated accordingly.

Example 1:

• A client entry has a $70 credit associated it.
• The client’s next invoice is for a total of $100.
• $70 is automatically deducted from the pre-tax total of their next invoice
• The client’s remaining credit balance automatically reduces to $0

Example 2:

• A client entry has a $70 credit associated with it.
• The client’s next invoice is for a total of $50.
• $50 is automatically deducted from the pre-tax total of that invoice
• The client’s remaining credit balance automatically reduces to $20, which will be applied to their next invoice

Users with access to the invoicing capabilities of MIDAS and who also have the ability to modify clients can update the amount of credit associated with each client at any time.

The post Maintain a line of credit for your clients appeared first on MIDAS - Room Booking System | Blog.

To that end, MIDAS v4.12 is on the horizon, and over the coming blog posts, we’re giving you a first look at some of the new features and improvements you can look forward to in the next MIDAS update..

The first new feature of v4.12 we’d like to unveil is a brand-new “Current Availability” report:

Arising from customer suggestions of being able to see an “overview” of the current and forecast availability of your venues “at a glance”, the new Current Availability, provides just that!

The report analyses each venue to determine is current status. If a venue is presently “available”, MIDAS will check to see when it’s available until (i.e. when the next booking takes place). If a venue isn’t presently available, MIDAS will check to see when it’s next available.

The results for all venues are then amalgamated into a single easy-to-read “Current Availability” report, which can also be printed.

The Current Availability report is just one of over a dozen real-time reports and statistics that MIDAS can generate. For more information, please see: https://mid.as/help/statistics

Finally, as we mentioned at the top of this article, it’s been 10 years since the first release of MIDAS, and there’s still time to enter our epic giveaway to celebrate – head on over to [THIS GIVEAWAY HAS NOW ENDED] – for you chance to WIN a FREE Cloud-Hosted edition of MIDAS, or your share of $1,000 worth of discounts off our software (including upgrades, addons, and subscription renewals)

The post New Current Availability Report appeared first on MIDAS - Room Booking System | Blog.