API
ip_authenticationonprovider_update— APIprovider_updateacceptsip_authentication(0/1); enabling clears login/password, disabling requiresloginto avoid “Provider should have login”.subscription_createAPI latency — API no longer blocks ~5–15s waiting formor_subscriptions; setsFLAG_run_script_mor_subscriptionsand defers script execution to cron for prepaid subscription users.userfieldinuser_calls_getresponse — API now returnscalls.userfieldso CRM callback lookups can match calls.- AI Transcriptions API — added MOR API v2 endpoints to submit call recordings for remote AI transcription and retrieve text results.
- API IP access check — check blocked or whitelisted IPs via API.
- API IP Access in Whitelisted IPs — manage API IP access from the Whitelisted IPs GUI.
- API pagination — added
fromandmax_resultsparameters onservices_get,user_calls_get,devices_get,dids_get,subscriptions_get, andusers_getfor paged result sets. - API Permission Groups — API access control by permission group.
- API: drop active calls — added REST
drop_active_callsAPI to terminate active calls. - API v2 authentication — added REST
/api/v2/auth/token,/api/v2/auth/refresh,/api/v2/auth/logout, and/api/v2/auth/mewith access and refresh tokens (Doorkeeper/JWT). - Assign provider as User’s device via API — assign a provider as a user’s device via API.
- CDR currency code fields — added VARCHAR(3) currency columns on CDR (
user_currency,provider_currency,reseller_currency,partner_currency,did_currency,did_inc_currency,did_prov_currency); NULL when currency matches system currency to save space. - Custom SIP headers via API —
device_updateAPI can set custom SIP headers on devices. - DID API validation for non-numeric DIDs — DID APIs no longer require fully numeric DIDs, fixing “DID was not found” for patterns such as
390522351526*. - DID create comment parameters —
did_createAPI acceptscommentandreseller_commentparameters. - DID details update comment fields —
did_details_updateaccepts comment parameters for main DID comment updates. - MOR API v2
/balance— return user balance via API v2. - MOR API v2
/me— return session context for the authenticated API user. - MOR API v2 automatic CDR exports — configure recurring CDR delivery via API.
- MOR API v2 blocked IPs — API v2 endpoints for blocked IP management.
- MOR API v2 CDR export templates — configure CDR export templates via API.
- MOR API v2 DIDs — CRUD-style API coverage for DIDs.
- MOR API v2 rates — query rating data via API v2.
- MOR API v2 ring groups — API v2 endpoints for ring group management.
- MOR API v2 tariff rates — query tariff rate data via API v2.
- MOR API v2 whitelisted IPs — API v2 endpoints for whitelisted IP management.
- REST Calls API (
/calls) — token-based REST endpoint replaces legacyuser_calls_getnaming; fixed total count, addedpage,limit(default 50), andmax_limit(500). - VoiceMail email in device API —
device_details_getreturns VoiceMail email and related voicemail parameters from the device page.
Major Enhancements
Webhooks and notifications
- Warning balance webhook — async HTTP POST to configured Admin Webhook URL when user balance crosses Warning Balance threshold; uses Email variables; independent of Emails Enabled when Warning Balance Active is on.
- Webhook for call end — per-device webhook fired when a call ends, sending user_id, device_id, calltime, src, dst, hangupcause, billsec, call_price, and balance_at_the_end_of_call.
- Alert webhooks — POST to a configured URL when an alert activates or clears (id, name, type, object, cause, value, count, timestamp).
- Hide balance/invoice UI for staff — Warning Balance section hidden for admin and accountant users; Invoice section also hidden for admin (accountants already excluded).
- Warning balance notification label — setting renamed to Send a warning when balance drops lower than (warning-balance alerts are separate from email notifications).
PJSIP and devices
- PJSIP Qualify timeout and frequency settings — split the single Qualify field into separate Qualify timeout and Qualify frequency inputs on PJSIP devices; when Qualify is off both fields are hidden and frequency is stored as 0; device update and provider update API parameters added.
- PJSIP minimum and maximum expiration — added Minimum expiration and Maximum expiration fields on dynamic PJSIP devices (defaults 60 s and 7200 s), mapped to
ps_aors.minimum_expirationandps_aors.maximum_expiration. - PJSIP incoming and outgoing codec preference — added Incoming Call Codec preference and Outgoing Call Codec preference dropdowns on PJSIP devices and providers (local/remote/merge variants), mapped to
ps_endpoints.incoming_call_offer_prefandoutgoing_call_offer_pref; replaces the chan_sip-only “Enforce same codec as on Leg A” pattern for PJSIP. - media_use_received_transport — PJSIP device setting for TLS/DTLS-SRTP media transport (
yes/noon device and via API).
Call monitoring
- Accountant spy calls permission — new “Allow Spy Calls (Monitoring)” permission and ChanSpy device setting for accountants; Active Calls shows spy icon when permitted (aligned with admin/reseller).
- Spy device selector on Active Calls — choose which device to use for call spy when the Monitoring Addon is active; selection stored per browser (cookie) so concurrent sessions for the same user can spy through different devices.
Reseller and permissions
- Reseller Devices limit — cap how many devices each reseller may have.
- Accountant permission: hide provider data on Call Info — new Data permission Last Calls – Hide Provider Data applies on the Call Info page for accountants.
DIDs and call flow
- Diversion header on Call Flow — configurable diversion header input fields (default
${MOR_SIP_TO};reason=unconditional) on Settings and Call Flow “Same as come – with diversion”; hidden from simple users. - DID Incoming/Owner price on Last Calls — added user settings Show DID Incoming Price and Show DID Owner Price; when enabled, Last Calls shows DID number and incoming/owner price columns, including via
user_calls_get.
Destinations and routing
- Unassigned destinations export/import — bulk export and import of unassigned destinations on X19.
SIP headers and localization
- PAI on inbound DID calls — PAI transformation and localization follow DID device settings; added
_any_special keyword for header matching; PAI sent with localized URI and server IP even when provider omits PAI.
Services and wholesale
- Duplicate Services — added the ability to duplicate services.
Billing, tariffs, and rating
- Auto-Tariff import name-to-prefix mapping — Prefix/Code import can use a separate mapping sheet (name column → prefix column) with configurable header skip; added “Pre-Made 3U Telecom” template.
Additional Improvements
Performance and usability
- Origin country in CDR — faster origin-country lookup on CDR reports.
- Invoice List load time — X19 Invoice List optimizations cut load time from ~12–15s to ~3s on a large client database; pagination and mixed-currency totals paths were tuned.
- Email Log load time — Email Log now loads in ~0.5s for any date range on large databases (previously minutes or out-of-memory on wide ranges).
- IVR Transfer to Device performance — faster Transfer To Device action picker on IVR edit for large device counts (client cited ~86,000 devices).
- Device edit speedup — removed dead queries, Confline request cache, gated AMI/MOH loads, and slimmed
find_deviceon/billing/devices/device_edit. devices_allspeedup — batch blocked-IP lookup, SQL pagination count, provider preload, and index onblocked_ipsfor the devices list page.- Dashboard speedup — cached integrity checks when all clear, deferred phonebook load, and targeted cache invalidation on
/billing/main dashboard. - Users list speedup — batch device counts, lean COUNT query, Confline cache, and shared
load_users_list_pagefor list and hidden views. - Logout speedup — skipped authorize and localization filters on logout for faster session teardown.
- Users edit speedup — Confline request cache, gated form data loads, and batched queries on
/billing/users/edit. test_apispeedup — skipped servers_status_check and annoying_messages on the Selenium API hash helper endpoint.- Device edit speedup (additional) — further cuts on device edit load time.
- Last Calls stats speedup — Confline cache, skipped servers_status_check, and memoized dropdown data on
/billing/stats/last_calls_stats. show_devicesspeedup — SQL pagination count, batch blocked-IP lookup, and provider preload on per-user device list.load_bundle_sqlspeedup — skipped admin health checks on Selenium SQL bundle loader; slimmed hot path.
PJSIP and devices
- PJSIP outbound proxy bulk update — enabling or disabling system proxy now updates
outbound_proxyon allps_endpoints(and related tables) and expires the PJSIP endpoint sorcery cache on every Asterisk server, matching per-device save behavior. - PJSIP special-character encoding in ps_* tables —
^and;in passwords and other PJSIP settings are escaped globally when written tops_*tables (^5E,^3B) while raw values remain indevices; avoids double-escaping onoutbound_proxy;lrsuffix. - Reseller “All Servers” option — added an All Servers choice to reseller server settings so resellers see all servers without rewriting every device’s server assignment; device server pick lists match Admin when All Servers is selected.
- Hide chan_sip device type (X19) — when
Hide_Chan_SIPconfline is 1, SIP (chan_sip) is hidden from new device and provider forms and from default device type selection to block new chan_sip endpoints. - PJSIP IPv6 transports — added
udp_ipv6,tcp_ipv6, andtls_ipv6transport options on PJSIP devices and providers, stored indevices.transportand synced tops_*tables. - Caller ID number-pool setting label — renamed the user-device setting to “Allow Users’ Devices to select CallerID as a Random Number from the Number Pool” and moved the Purge User data button per updated User Details layout.
- Auto-select codecs when none chosen — saving a device or provider with no audio codecs selected now auto-enables all audio codecs instead of sending
allow=allto Asterisk; audio and video codec groups are handled separately. - No auto-select for video codecs — reverted the video-codec portion of an earlier auto-select change: when no video codecs are selected they stay disabled (fixes hidden video codecs being auto-enabled on PJSIP save).
- Core cache load performance — sped up cache initialization when many devices/providers each have DST/SRC rules (MOR Core 29.0.40).
- PJSIP Virtual IP on endpoints — when
Virtual_IPconflines entry exists, saving endpoints writesmedia_addressandbind_rtp_to_media_address=yestops_endpoints(one-way: existing devices keep values if conflines removed or changed). - Admin sets Accountant spy device — admin can assign or change Accountant ChanSpy device from User Edit without logging in as the accountant.
- Blocked device Asterisk errors — blocked devices (
hide_from_user) excluded from chan_sip peer SQL so empty-host blocked peers no longer spamsrvlookup failederrors. - Caller ID localization wildcard —
Xwildcard added to cut digits after a specific prefix in localization Caller ID rules across location, device, provider, and prelocalization rules. - Device Rules Destination Add character limit — raised maximum length in the Destination Add field from 20 to 40 characters.
- PJSIP provider registration retry — outbound PJSIP providers now retry registration periodically instead of attempting only once.
- PJSIP outbound registration
lineparameter — registering providers automatically enable Addlineparameter; GUI toggle hidden to preventres_pjsip_outbound_registrationline-support errors. - Reseller Provider Transport setting — Transport option added to Reseller SIP/PJSIP Provider edit (was missing vs admin provider edit).
- Dedicated CLI permission on devices — accountants can manage device CLIs without User Manage permission; IVR permission moved to the IVR section.
Reseller and permissions
- Partner Reseller Pro loss-call routing — core now evaluates Reseller Pro loss-call checks against the common-use provider tariff (not tariff id 0); reverted GUI restriction that blocked adding partner-tree Reseller Pros to common-use providers.
- Whitelisted IPs search by Reason — added Reason filter on Whitelisted IPs (partial match with
%wildcard, same pattern as IP search). - Accountant “See Providers prices and Profit” — permission renamed and radio buttons swapped so Disabled/Read behavior matches other accountant permissions (formerly “See only Users prices”).
- Accountant filter on Invoices — filter the Invoices list by Responsible Accountant.
DIDs and call flow
- Diversion header for DIDs Call Flow — “Same as come – with diversion” on DID call flows now supports configurable diversion header behavior, matching Call Flow diversion settings.
- DID callflow icon on DID edit — callflow icon now appears on the DID edit page; forward callflows show a greyed (inactive) icon on both DID list and edit views.
- DIDs
ai_agent_compatiblefield — database field and index added for DIDs suitable for AI-agent use cases.
Billing, tariffs, and rating
- Failover tariff delete guard — deleting a user tariff assigned as a provider failover tariff is blocked until the failover assignment is removed.
- Wholesale tariff with CLI Groups — Make Wholesale Tariff preserves CLI Groups and adjusts rates accordingly instead of collapsing to a single active rate.
Destinations and routing
- Origin country in CDR (matching logic) — origin lookup strips a leading
+from source before subprefix matching against destination tables that store prefixes without+. - Duplicate CLI matching — when duplicate CLIs exist, routing matches on Domain and CLI together instead of CLI alone.
SIP headers and localization
- Localize PAI with rule groups — Localize PAI now applies Rules from group in addition to standalone rules (MOR Core 28.0.69 / 29.0.52).
- Auto-Dialer calls per minute — Calls per minute field added to Auto-Dialer campaign DB/GUI.
- Copy Leg A Name to Leg B before auth by ANI — MOR Core now copies Caller ID name to Leg B number before auth-by-ANI so authentication can use the name field.
Platform and operations
- SFTP SSL options — added GUI toggles for insecure SSL (
--insecure) and optional CA certificate upload when SFTP uploads fail on certificate validation. /varparent directory permissions — Asterisk install/check no longer chmods/varparent directories to 777; only the target subdirectory receives 777 when needed, avoiding snap and reboot permission fights.- DNS resolver health check — replication/DNS check uses
digqueries instead of ICMP ping so resolvers that block ping but answer DNS are not reported unreachable. - Default IPv6 iptables rules — deploys default
ip6tablesrules to block IPv6 traffic on new installs. - Blocked IPs database load — added DB indexes on
unblockand first 10 characters ofchainto reduce load when fail2ban blocks many IPs. - Generate Hash action log error — GUI Generate Hash no longer writes false Action Log API errors (“Incorrect hash”, “User was not found”) after hash generation.
- Replication check debug output — DB replication failure alerts in
gui_debug.lognow include fullSHOW SLAVE STATUSoutput (Slave_IO_State, Slave_IO_Running, Slave_SQL_Running, etc.). - Exception error messages — clearer exception error text.
- Gemfile gem version lock — pinned Ruby gem versions in the Gemfile.
Other improvements
- SIP rinstance on proxy — OpenSIPS/proxy INVITEs now preserve the
rinstanceparameter from registered Contact URIs (fixes missingrinstanceon outbound INVITE). - mor_direct dialplan extension pattern — broadened
mor_directextension match from_[v:0-9].to_[a-zA-Z0-9]!so IP-auth trunks with letter-prefixed extensions route correctly (X17+). - Provider periodic-check status icon — provider list no longer shows red disabled icon when periodic SIP check is off but
alive=0; icon reflects that calls are not blocked by periodic check.
Bug Fix Report
- Backup failure (iplocations timeout) — backups failed when iplocations could not reach one upstream host; added timeout so backup continues when a geo-lookup source is unreachable.
- DID active-from/active-till timezone display — fixed
did_importcrash (to_timeon nil) and aligned DID edit save/display of active-from and active-till with the specification across X17/X18. - PJSIP device creation error — fixed
ActiveModel::MissingAttributeErroron device create after DB schema update; PJSIPps_*cleanup on delete is more reliable. - Incorrect SIP Contact with reseller outbound DID forcing — fixed wrong Contact header when
force_did_device_calls_as_outbound_for_resellersis enabled on proxy systems. - X19 logo size — fixed incorrect logo sizing on the X19 GUI.
- MOR-Lite menu duplication — removed duplicate BLF-IVR-Time Periods entry after Queues-Log and hid Recordings > Quality Test in MOR-Lite navigation.
- PJSIP device IP cleared on proxy systems — on CCL/proxy systems, PJSIP device update no longer strips device IP or runs manual Asterisk parse/update logic, restoring incoming trunk calls after device edit.
- Asterisk connection timeout crash (Rami) — after Rails upgrade, TCP connection timeouts returned a different exception class; added 3 s timeout and correct rescue handling.
- Asterisk crash on cached tariff prefix with + — fixed Asterisk crash when core cache is enabled and a tariff prefix contains
+(e.g.+66). - Call limit 1 with core cache — fixed incorrect active-call limit enforcement when call limit is 1 and core cache is enabled vs disabled.
- user_register PJSIP endpoint not loaded — PJSIP devices created via
user_registerAPI are now pushed to Asterisk immediately without requiring a subsequent GUI edit. - LCR price order ignores connection fee — LCR
priceordering now considers connection fee, not per-minute rate alone, so the lower total-cost provider is chosen when rates are equal. - PJSIP INVITE with R-URI user@host — fixed incorrect handling of inbound PJSIP INVITEs whose Request-URI uses a bare
user@hostform. - PJSIP hidden device edit crash — fixed crash when editing a hidden PJSIP device where GUI cleared host and incorrectly treated the device as ipauth with PJSIP table mappings.
- DID Owner Cost on Detailed Invoice — Detailed Invoice PDF and CSV now show the DID Owner Cost line when “Hide ‘DID owner cost’ line in detailed PDF invoice” is disabled.
- Localization cut with core cache — fixed destination number cut rules (e.g. cut
00) applying incorrectly when core cache was enabled. mor_device_statuslog/RAM use — stopped repeated status NOTICE spam and excessive log growth for ipauth devices withqualify=no.- Device rules with core cache — device rules (cut/add) now apply correctly when core cache is enabled.
- PJSIP device on user registration — user registration with Registration enabled now inserts the created PJSIP device into
ps_endpoints(aligned withuser_registerAPI behavior). - Localization before Number Pool — Caller ID localization now runs before Number Pool selection so provider-prefixed numbers localize correctly.
- CLI CSV import encoding crash — fixed
incompatible character encodings: ASCII-8BIT and UTF-8when importing device CLIs from CSV (X18/X19). - PDF invoice encoding error — fixed
Prawn::Errors::IncompatibleStringEncodingwhen resellers open generated PDF invoices. - Provider active/inactive LCR cache — toggling provider active/inactive now sets
changes_present=1on all LCRs containing that provider. - Settings page logo — X19 Settings showed X18 logo; updated to X19 branding.
- Device status icon with
qualify=no— devices withqualify=nono longer flip status icons in ways that confuse operators. - Asterisk CPU spikes — added
kolmisoft_skip_chan_sip_endpointssip.conf setting (default on) to skip chan_sip work that accumulated and caused periodic ~110% CPU spikes. - Core cache provider/number pool — fixed “Failed to find provider” in cache and number-pool trie errors after cache updates (MOR Core 29.0.49).
- X19 Pilot Client hotfixes — client-specific Pilot Client fixes on one customer server.
- Automatic tariff import Prefix+CLI — import now groups by
cli_group_hash_keyso rows with the same prefix but different CLI values all import instead of only the first match. - Automatic tariff import duplicate prefixes — fixed temp table doubling row count (duplicate prefixes) on large XLS imports without secondary data.
- Single-DID interval internal error — adding one DID via DID Interval (same start/end) no longer throws internal error (X17–X19).
- Payments CSV crash — fixed
FrozenError: can't modify frozen Stringon Payments to CSV export for subscription payments. - Users List pagination order — fixed duplicate rows across pages when using 1 item per page with Order by Type.
- Admin webhook visibility — admin Warning Balance webhook settings hidden from resellers and other non-admin users.
- Provider rules cut/add order — fixed provider rules incorrectly stripping the first source digit before adding
+prefix (MOR Core 29.0.54). update.shDNS change — update script no longer overwrites system DNS server configuration.- Service type missing on edit — one-time fee service type was not shown when editing services.
- Action Log flooding — Action Log filled every minute with
minute_actions_cooldown_timeentries; Minute Actions no longer write to the Actions table on that cadence. subscription_deleted_and_return_money_wholepayment — subscription deletion with money return did not create the expected payment record.- Dynamic flat-rate subscription billing — new dynamic flat-rate subscriptions derive
period_start_dayfromactivation_start, and Start Period on day is disabled on edit to prevent incorrect partial-period charges. - API crash logging — API crashes (for example invalid DATETIME values in
subscriptions_get) did not produce crash logs; crash logging restored. - Callbacks from wrong Asterisk server — GUI initiated callbacks using the Callback Server setting even when the device was registered on another node; callbacks now use the server where the device is actually registered.
- Active calls limit / forward loop — inbound/outbound limits with failed-action forward could leave stuck or looping active calls.
- Default install example devices — fresh X19 installs defaulted to PJSIP but example devices and providers from install remained SIP; example objects now default to PJSIP.
- Provider registration icons — registration status icons were missing from the provider list on X19.
- ANI device localization with cache — calls via ANI device used global destination rules when core cache was enabled instead of the virtual device’s assigned location rules.
- English sound file permissions on install —
en_sounds.tgzextracted with foreign uid/gid (999/1000) caused coredumps on R9; extraction now preserves the installing owner, with a check for existing systems. - Reseller default device Pass PAI setting — Default Device Caller ID Pass PAI selection now persists after Save Changes instead of reverting to Global.
- Whitelisted IPs rejected local/private/server IPs — whitelist no longer applies local/private/server-IP blocks meant for blocked IPs; server primary and VM IPs can be whitelisted.
- CallerID construction after Provider Rules — fixed malformed CallerID (e.g.
+4nonymous) when Provider Rules cut/add digits on non-numeric names. - Provider registration status with long username — registration status now displays for outbound-registering providers with very long usernames.
- Combined Rules rerating currency — rerating under Combined Rules → Location rules now uses the rate’s currency instead of the system default.
- PJSIP device UNREGISTER button — UNREGISTER on a registered PJSIP device edit page now removes the device registration from
ps_endpoints. - SIP 480 passed as 603 to originator — when a provider returns SIP 480 Temporarily Unavailable, MOR now forwards 480 to the originator instead of converting to 603 Decline (HGC 241 display aligned).
- Common-use provider with cache — fixed routing/regression when common-use provider logic runs with core cache enabled.
- Subscriptions page crash with linked device — Subscriptions list no longer crashes with “Configuration error” when a subscription has a
device_idassigned. device_updatefalse “There is no such API” — fixed crash ondevice_updatewhen callflow referenced server id -1; update succeeds and API returns correctly.- By-provider tariff bypass at zero balance — users with zero balance can no longer place calls on a by-provider dynamic tariff.
- DB replication check false status — replication health check no longer reports broken replication on valid local replica output when remote source check misread column names or upstream state.
- AMI request sent to SIP IP — when adding a MOR Asterisk server, AMI reachability check uses
server_ip_for_amiinstead of the SIP IP. - Default PJSIP device missing limit settings — default device configuration now exposes CPS and other limits available on regular user devices.
- Invalid destination names in Last Calls — destination names from bad CSV imports are filtered to prevent broken Last Calls display.
- PJSIP
ps_endpointscontext on device edit — editing a PJSIP device in a PBX pool no longer resetsps_endpoints.contexttomor_local, restoring in-pool local calls. - Call transfer failures — Asterisk module ABI mismatch during transfer broke billing/routing; core source updated to resolve mismatch.
- Last Calls
dstwith prelocalisation — when prelocalisation is used,dstnow stores the original dialed number instead of the post-preloc value. - Provider CallerID not applied (PJSIP) — provider CallerID was not applied correctly on PJSIP calls.
Questions about these updates?
Whether you are planning an upgrade, need help with migration, or want to discuss how new features fit your network — our team is ready to assist.