Decryption key:
Teleman - Telemarketing & VoIP Service SaaS Application v7.2.0
## [7.2.0] - 2026-11-04
This release closes several ways a customer could get credit without paying for it,
read another customer's data, or take over another customer's phone line. It also
starts billing two things that were never billed. **Read the next section before you
upgrade, and do the steps under *After you upgrade* the same day.**
It also lets a campaign show and choose its AI agent, lets a stuck telephony reset
finish, and fixes Plivo setup for sites whose name has a space in it.
### Read this first — what changes your bill
- **Twilio SMS are charged, for the first time.** An SMS is charged when its delivery
receipt arrives, and messages sent through Twilio never asked for a receipt — so on a
Twilio installation no SMS was ever charged, AI replies included. From the upgrade,
every SMS is charged at your SMS rate, per segment. Check your SMS prices before you
upgrade. Plivo installations were already charged and see no change.
- **Monthly number rental is charged, for the first time.** The monthly charge stopped
with an error on any installation that had an assigned number, so after the month a
number was bought nobody was ever charged for it again. From the next 1st of the month,
each customer is charged each number's monthly cost, as the product always intended —
and a customer who cannot pay loses the number. **Tell your customers before the 1st.**
### Security
- **A top-up is credited only when the payment gateway says it was paid, in full.**
With Razorpay, one small payment could complete any number of other pending top-ups,
of any size. With PayPal, a payment for one top-up could complete a larger one. And a
payment notification sent to your site was accepted without being verified whenever
its gateway's webhook secret was not set. All of these are closed. **Payment
notifications are now refused unless their secret is set** — see step 4 below.
- **KYC identity documents are visible to admins only.** Any signed-in user could
download another user's passport scan, selfie or business registration, and mark
documents as approved.
- **Each customer's AI-agent data is their own.** Any signed-in user could list, read and
export every customer's AI-agent calls and transcripts, read, change or delete every
customer's knowledge bases, and move another customer's number onto their own agent —
taking over that customer's inbound line.
- **"Import from URL" fetches public web pages only.** It fetched any address it was
given, including your server's own network and your cloud provider's metadata address,
which holds the server's credentials.
- **Password-reset links can no longer be pointed at another site.** A forgot-password
request for someone else's email address could make the link in their email point at a
site of the requester's choosing, with a working reset code in it. Your installation now
answers only to the domain in `APP_URL` and its `www.` twin. See step 5.
- **One copy of `.env` is kept instead of thirty.** The daily copy in
`storage/backups/env/` stays, because it is how an emptied `.env` is restored with its
encryption key, but only the newest is kept, an older copy made under a different key is
cut down to that key alone, and `ENV_BACKUPS=false` keeps none at all.
### Added
- **A campaign shows, and lets you choose, the AI agent that takes its calls.** A
campaign used to get whichever agent answered on the number it calls from, without the
screen saying so, and the match could fail over nothing more than a missing `+`,
leaving the campaign without its agent. The agent is now filled in from the number and
can be changed. Numbers are compared by their digits, so `+15551234567` and
`+1 555 123 4567` are the same number; one saved without its country code is still not
matched, and the screen now says so.
- **"Reset telephony" can end the work that blocks it.** A reset is refused while a call
is in progress or a campaign is dialling, and a call whose last status update never
arrived could block it for good. A new checkbox beside the confirmation (or
`--end-work-in-flight` on `php artisan telephony:reset`) hangs up the calls still in
progress, pauses running campaigns and returns scheduled ones to draft, then resets.
The reset itself is exactly as destructive as before.
### Fixed
- **Razorpay webhooks credit the top-up they paid for.** They never found it before, so
a buyer who closed the tab after paying was not credited.
- **A top-up in another currency is refused when the exchange rate cannot be fetched**,
instead of crediting the unconverted figure — 5,000 rupees became 5,000 dollars of
credit.
- **The AI-agent calls CSV export works.** It always failed with an error.
- **Plivo setup works when your site's name has a space in it.** Verifying Plivo
credentials failed with "Invalid Application name" whenever `APP_NAME` contained a
space, so inbound calls and SMS could not be set up. If that happened to you, click
**Verify** again under **Admin → Telephony Settings** after upgrading. An installation
that already verified is not affected.
- **An AI-agent campaign can be launched without a message or an audio file.** The agent
does the talking, but launching still demanded a script that would never be played.
The campaign form now says that the agent speaks instead.
- **Applying a campaign template always selects a campaign type.** A template saved
without one left both options unselected, and the campaign would not save until you
picked one.
### Changed
- **A customer can give an AI agent only a phone number they own**, and the number list
on the agent page shows only theirs (an admin still sees every number). An agent that
already has a number keeps it.
- **Knowledge bases belong to their creator.** On upgrade, each existing one is given to
the owner of an AI agent that uses it. One that no agent uses has no owner to give it
to, so only admins see it; if a customer misses one, that is where it is.
- **System Configuration** has a field for the Stripe webhook signing secret, and the
webhook secret fields for Razorpay, PayPal and Flutterwave are no longer marked
optional.
- **The download unpacks straight into the folder you extract it in** — `app/`,
`public/`, `vendor/` and the rest, with no folder around them. See *Upgrading*.
### Upgrading
Back up your files and your database first. Then extract the download in your
installation's main folder (on cPanel, usually `public_html`) and let it replace the
files that are there. It contains no `.env` and none of your uploads, logs or data, so
your settings and everything your customers have created stay as they are. Then do the
steps below.
### After you upgrade
1. **Run the database migrations** — `php artisan migrate`. This adds the owner column to
knowledge bases and gives existing ones their owners, and loads any interface wording
your installation is missing.
2. **Clear your cached configuration** — `php artisan config:clear`.
3. **Restart your queue workers** — `php artisan queue:restart` (or `pm2 restart all`).
4. **Set the webhook secret for every payment gateway you use**, under **Admin → System
Configuration**: the Stripe webhook signing secret, the Razorpay webhook secret, the
PayPal webhook ID or the Flutterwave secret hash. Until you do, that gateway's payment
notifications are refused, and a top-up is credited only when the buyer comes back to
your site after paying.
5. **Check that `APP_URL` in `.env` is the address your customers use.** If your site
also answers on another domain, or a monitor checks it by IP address, list those in
`APP_TRUSTED_HOSTS`, separated by commas — a request for any other host is now refused.
If `APP_URL` is still `
http://localhost`, set it: nothing is refused until you do, but a
warning is logged every day.
6. **Review your SMS prices, and tell your customers about number rental** — see *Read
this first*.
