Captivo Portal changelog — 2026 · Page 8 of 12

Improvements

• Unsaved-change warnings now also cover privacy, SMTP and template settings.
• Template tabs now mark which tab has unsaved changes. Since "Save" only saves the open tab, edits on another tab were lost unnoticed.
• Enabling unmasked exports now asks for a confirmation explaining what it means.
• Changing a team member's role now asks for confirmation; a mis-click could grant someone admin rights.
• Toggles and buttons in privacy, team and SMS settings are now named for screen readers.

Fixes

• Clearing the auto-mask timer field dropped it to 0 instantly — turning off automatic masking of personal data.
• The settings home page fetched data even for unauthorized users before redirecting; it now checks permission first and reads only the fields it needs.
• The daily export limit accepted fractional values.

Improvements

• Disabling two-factor authentication, regenerating recovery codes and removing a trusted device are now recorded in the audit log. These operations previously left no trace at all for post-compromise investigation.
• Removing all trusted devices now asks for confirmation.
• Password fields are now marked up to work properly with browsers and password managers.

Fixes

• When removing a trusted device failed, nothing was reported; the device stayed in the list while the user believed it was removed.
• After regenerating recovery codes, the "codes remaining" count kept showing the old value.
• Fixed missing Turkish characters in a notice on the security page.

Improvements

• The portal preview no longer reloads on every keystroke; it updates when you stop typing (removing flicker and focus loss).
• Dropdowns and text fields in portal settings are now associated with their labels; clicking a label focuses the field and screen readers announce it.
• Character limits were added for the welcome message, footer and tab names — overly long text broke both the guest page layout and the downloaded router template.
• Removing the background image now asks for confirmation (logo removal already did).

Fixes

• While sponsor approval was required, the SMS switch appeared "off"; removing the requirement silently turned SMS back on. It now shows the real state and explains why it is hidden. Email verification follows the same rule.
• The guest page's default heading was written as "Misafir Internet"; corrected to "Misafir İnternet" and the existing record was updated.
• Clearing the email code expiry and attempt-count fields snapped them to the default immediately; typing now behaves as expected.

New

• You are now warned before leaving a settings page with unsaved changes.

Improvements

• Switching tabs in portal customization no longer discards your unsaved changes.
• Login-method toggles can now be operated with a keyboard and screen reader.
• Template variables are now channel-aware: a variable SMS does not support no longer looks "known", and variables email does support no longer trigger a false warning.
• Deleting a guest profile now asks for confirmation and explains the impact.
• Resending an invitation email now has a 5-minute cooldown.
• Webhook delivery now runs in parallel with a shorter timeout, so guest logins are not held up in organizations with several webhooks.
• The log sources page counts with a single query and opens far faster thanks to new indexes.
• Hotel reservation search no longer fires a request on every keystroke.

Fixes

• Default guest profile names and descriptions were missing Turkish characters; existing records were corrected.
• The webhook logs page was entirely hardcoded Turkish; it now renders correctly in English too.
• Errors when removing a member, changing a role or resending an invitation were silently swallowed on the team page; they are now shown.
• When the team list failed to load, the page said "no members yet"; it now shows an error.
• Typing an invalid page number in the address bar crashed the audit log page.
• Portal "reset to defaults" showed the image as deleted even when the request failed.
• The NAS IP field accepted invalid addresses such as 999.999.999.999, and the 802.1X switch address was never validated.
• Missing Turkish characters in server error messages were corrected.

New

• Critical settings changes are now recorded in the audit log: webhook target and signing secret, MAC entry status, guest profile deletion, hotel PMS configuration, scheduled reports, connectors, license upload, log source deletion and signed archive downloads.

Improvements

• Scheduled reports are now sent in your organization's timezone. Reports for organizations outside Türkiye were arriving hours late; existing schedules were corrected too.
• The minute you pick for a scheduled report (00/15/30/45) is now actually honoured; previously only the hour was considered.
• 802.1X logs, VPN logins, SMS history, hotel reservations, connector and license dates are now shown in your organization's timezone.
• Date filters on 5651 log search, raw logs and reports now follow your organization's timezone — previously part of the selected day never appeared in results.
• The log retention setting now actually applies, with a 730-day floor kept for 5651 compliance.
• SMS delivery records are no longer kept indefinitely; they are cleaned up automatically.

Fixes

• On installations using KamuSM timestamps, the log verification screen incorrectly marked every day as "tampered".
• Deleting a log source that contributed to signed days is now blocked; it permanently broke the 5651 evidence chain.
• A MAC whitelist entry's expiry shifted hours earlier every time the record was opened and saved.
• The TLS switch in SMTP settings had no effect; your choice is now applied.
• SUPERADMIN could not save template settings ("no permission" error).
• Template test sends wrote the phone number and email address to the audit log unmasked.
• CSV cells in log exports could execute as formulas; they now use the shared safe formatter.
• The RADIUS "logins today" counter was calculated on the server's day.

New

• The 802.1X switch shared secret is now fetched only when you click "Show" or "Copy", not when the page loads.

Improvements

• Permission checks across settings pages were tightened: unauthorized users can no longer reach webhook logs, portal settings, the hotel reservation list, RADIUS keys or SMS settings through any path.
• Removing a brand image now deletes the file from the server; previously the record was cleared but the image stayed reachable by URL.
• Webhook target addresses are now validated: internal and private IP addresses are rejected, and credential-carrying custom headers are blocked.

Fixes

• MAC whitelist entries were never written to RADIUS — devices shown as "active" could not actually bypass the portal. Fixed, and existing entries were re-synced.
• Deleting a MAC whitelist entry also deleted another organization's entry for the same MAC.
• Two-factor confirmation for account deletion did not work: users entering the correct code got an "invalid verification" error.
• Assigning a default login method to a new guest profile also cleared unrelated defaults on other profiles (e.g. assigning SMS wiped another profile's email default).
• A deleted guest profile's speed and time limits kept being applied on the network; linked devices are now re-synced when a profile is deleted.
• The "Target URL" column in the webhook log list was always empty.
• Unexpected fields could be written when saving branding settings; this is now prevented.
• Custom CSS is now sanitized in the portal preview, removing the behaviour gap between preview and the live page.

New

• The reports page is now a "Report Center": pick a ready-made template (Summary · Guests · Sessions · Sponsors · Network/NAS), choose range, access point, language and format (PDF · Excel · CSV) and download.
• Reports can be emailed (to yourself or your team) and turned into a scheduled report in one click.
• PDF reports are now generated on the server: correct Turkish characters, business logo, summary cards, a daily activity chart and page footers.
• Excel (XLSX) output is available from the panel too, with a cover sheet, frozen header row and filters.
• Export history card: which report was downloaded/sent, by whom, when and whether it was masked.
• Scheduled reports card: active reports, last run status and a "Send now" button.
• Before downloading you see the row count and approximate size; very large ranges show a warning and suggest a scheduled report.

Improvements

• Report dates, file names and the daily unmasked-report allowance now follow the tenant timezone.
• CSV/Excel/PDF headers, status labels and watermarks are in the selected language, with Turkish characters fixed.
• Identities in the session report are masked by type (phone, email, username, voucher code handled separately).
• Report downloads and sends are stored under the correct audit action; PDF downloads are audited too.
• Unmasked reports are limited to a 90-day range and an organisation-wide daily cap.
• Scheduled reports use the same content and formatting as the panel; report language follows the tenant language.
• Masked report downloads are restricted to manager roles; charts now live in one place (Analytics).

Fixes

• Dates in report CSVs were written in server time (3 hours off) — fixed.
• Emails and usernames in the session report were half-masked with the phone mask — fixed.
• "Total guests" counted all time while the adjacent "new" counted the period; the cards now use the same period.
• The "SMS sent" figure included email logins — only real SMS sends are counted now.
• The PDF menu said "charts included" but had none, and PDF errors were swallowed silently — fixed.
• The top sponsors list ignored the selected date range — fixed.

New

• Sponsor approval in one core: approving from the admin panel, mobile app, email link or the new sponsor inbox now creates the guest, writes the WiFi credential and sends login details by SMS (or email); the delivery status is shown.
• Sponsor inbox: sponsor emails include a personal link where all pending requests can be approved or rejected on one page.
• Portal: while waiting for approval the page tracks the request; on approval the guest is logged in automatically, on rejection the reason is shown.
• Requests page: status tabs (pending · approved · rejected · expired), search, pagination, sponsor filter; confirmation dialog for approval, preset reasons + guest notification for rejection; resend the email to the sponsor; jump from an approved request to the guest.
• Sponsor list: search, department/status filter, sorting, pagination; edit dialog; daily approval limit; test email; summary tiles with approvals this month and average response time.
• Reminder email to the sponsor after 2 hours without a response; expired requests are moved to "expired" automatically.
• Rejected guests are notified by SMS/email; when no SMS service is configured, login details are sent by email.

Improvements

• Sponsor request endpoint rate limiting and duplicate check: with an open request to the same sponsor the email is resent instead of creating a new request (max 2 times).
• The public sponsor approval page uses the tenant language and timezone with a second confirmation step; sponsor emails show dates in the tenant timezone and guest fields safely.
• Deleting a sponsor keeps the request history (sponsor name is recorded); deactivating closes open requests.
• Turkish character fixes on the sponsor pages; error messages in the selected language; CSV export is Excel-safe and audited.

Fixes

• Sponsor requests approved from the admin panel or mobile app did not grant guest access (only the status changed) — fixed.
• Double-clicking a request could create two guests/SMS — fixed (atomic status transition).
• Expired requests could be approved from the panel — fixed.
• The search box on the sponsor list did nothing — fixed.

New

• Local user list: search (username/name/email/phone/note), status filter (active · online · expiring · expired · inactive · missing in RADIUS), sorting and pagination; summary tiles apply the filter when clicked.
• Send login details by SMS or email, and one-click password reset (new password shown once, connected session terminated).
• Expiry extension: bulk in the list and +7 / +30 / +90 days on the detail page; dashboard alert for users expiring within 7 days.
• Action bar on the user detail (edit, send, reset password, extend, disconnect, activate/deactivate, delete) and device/browser info.
• After CSV import the generated username/password list is shown (download CSV / copy); skipped rows are listed with reasons.
• RADIUS consistency card: shows orphaned (owner deleted or legacy unprefixed) RADIUS credential rows and cleans them with confirmation; orphaned prefixed rows are removed by automatic maintenance.

Improvements

• Expired local users' RADIUS record and connected session are removed by automatic maintenance; session counters and last login are synced from accounting (portal verification no longer increments the counter).
• "Online now" badge in the list; tiles distinguish active/online and expiring/expired.

Fixes

• Local user "total sessions" did not match actual accounting records — fixed.
• Deleting a tenant now fully purges its RADIUS credential, session and log rows (including orphaned rows of already-deleted identities); all three deletion paths (admin panel, mobile, account closure) share the same cleaner.

New

• Local users: deactivating, deleting or changing the password now terminates the connected WiFi session immediately (CoA + RADIUS credential); the confirmation shows the impact.
• Passwords in the local user list are masked; "Show password" and "Copy credentials" are audited and auto-hidden after the portal setting's delay.
• Users whose RADIUS record is missing (cannot log in) are flagged in the list and can be repaired with one click.
• After creating a user, a credentials card (username / password / copy) is shown.
• Edit dialog supports profile / manual settings and custom session duration (minutes/hours/days).

Improvements

• Local user CSV export is restricted to admin roles and audited; headers in the selected language, dates in the tenant timezone, Excel-safe cells.
• Username and password generation uses a cryptographic RNG; usernames accept only lowercase letters, digits and . _ -; email/phone are validated.
• Bulk deactivate/delete write a single audit entry; audit entries never contain passwords.
• Web and mobile app share the same local user core (RADIUS attributes are now consistent).
• Turkish character fixes on the local users page; error messages in the selected language; portal login errors in the tenant language.

Fixes

• The edit dialog shifted the expiry date by 3 hours on every save (UTC/browser timezone mix-up) — fixed; dates are in the tenant timezone.
• When the RADIUS record could not be written the user appeared "created" but could not log in — the operation is now rolled back and an error shown.
• Editing a profile-based user dropped the idle timeout and profile settings — fixed.
• Dates and daily/hourly charts on the user detail ignored the tenant timezone — fixed; the summary is no longer limited to the last 50 sessions.
• Expired users were counted as "Active" — tiles and badges fixed.

New

• Vouchers: revoke and reactivate individual codes (lost/stolen tickets) — a revoked code's session is terminated; multiple codes can be revoked with bulk selection.
• Voucher group editing: name and expiry date can be changed (RADIUS expiry of active codes is updated too); codes can be added to an existing group ("+N codes").
• Live usage panel on the voucher group detail: active sessions, total sessions/time/traffic, unique devices and a daily usage chart for the last 30 days (tenant timezone).
• Voucher printing reworked: in-page printing (no pop-up needed), logo/business name option, print selected codes and download an A4 PDF with QR codes.
• Send a voucher code to a guest by SMS or email (front-desk scenario).
• Voucher list: search by group name/prefix, status filter (active · expired · exhausted), sorting and pagination; group detail has status tabs, code search and pagination.
• Custom duration input (minutes/hours/days), simultaneous device count and data quota (MB) when creating vouchers.

Improvements

• Voucher delete and revoke confirmations use an in-app dialog instead of the browser prompt and show the impact (codes and connected sessions).
• Voucher summary tiles show "used today"; group rows have a layered active/used/revoked progress bar.
• Voucher codes are now unique across the tenant; list and detail pages open much faster for large groups.
• Voucher page loading skeleton matches the real layout.

Fixes

• Voucher printing silently did nothing when the pop-up blocker was active — printing now happens in the same page.

New

• Voucher groups page: refreshed summary tiles (active groups, available codes, used, active now); group rows show "Expired" / "Exhausted" badges, profile name and active code count.
• Group creation: the form explains what validity, session duration and usage limit mean; the expiry date is interpreted in the tenant timezone; after creation you land on the group detail.
• Printed vouchers now include an "enter the code as username and password" hint, session duration, validity window and group expiry together.
• Deleting a voucher group now also terminates connected guest sessions (CoA + RADIUS credential) and shows the impact in the confirmation.
• Automatic voucher status maintenance: expired codes become "Expired", exhausted codes become "Used"; the "Revoked" status is shown in lists.

Improvements

• Voucher CSV export: headers and statuses in the selected language, dates in the tenant timezone, Excel-friendly safe cells; exports and prints are written to the audit log.
• Voucher durations are shown in one consistent format across list, detail and print (e.g. 1 h 30 min).
• Voucher codes are generated with a cryptographic RNG; the portal verification endpoint is rate limited.
• Voucher page permissions: only authorized roles can create/delete groups; viewing, downloading and printing codes is restricted to manager roles.
• Timezone-difference notice and voucher page texts fixed for Turkish characters; error messages in the selected language.

Fixes

• Sessions of guests connected with a voucher were missing from Sessions/Dashboard and could not be terminated (RADIUS username was written without the tenant prefix) — fixed.
• Codes of a deleted voucher group stayed in RADIUS and could still log in — fixed.
• The "session duration" setting was ignored and the validity period was used as session length; multi-use codes were extended on every login — fixed (validity is a fixed window from first use).
• Expired vouchers stayed "Active" forever — fixed.
• Dates on the voucher detail page ignored the tenant timezone — fixed.
• Portal voucher error messages (e.g. "Invalid voucher code") are shown with proper characters and in the portal language.

Improvements

• Guests: the list is now masked on the server in line with KVKK — roles without permission to view personal data (user/manager) only receive masked phone, e-mail and name; admins reveal with the eye icon and every reveal is audited. The "View details" dialog was removed; the detail page applies the same masking rules.
• Guests: search is case-insensitive and also matches e-mail and MAC address; filters persist in the address bar; a "Clear" button; the Anonymized status in the filter and badges; "Last visit" is relative ("3 hours ago", full date in the tooltip). Roles without permission no longer see block/delete buttons; blocking and disconnecting ask for confirmation; error messages follow the user's language.
• Guests: CSV export is now limited to the list's filter, masked as required by KVKK, Excel-friendly (BOM, semicolon, formula protection), dates in the tenant time zone, and every export is audited. For full (unmasked) data use the MFA-verified flow on the Reports page.
• Guest detail: the action menu is translated, role-aware and shows notifications; an authentication-method badge was added; average session duration uses closed sessions only ("—" when none).

Fixes

• Blocking now really blocks: a blocked guest can no longer request a new SMS/e-mail code from the portal and log in again (previously nothing checked it and a new request silently lifted the block); blocking immediately disconnects the open session and revokes the password (previously the wrong username was searched, so the password stayed valid).
• Guest delete/block operations run through a single core (web, bulk and mobile behave the same), in one transaction, and each is written to the audit log — previously none were.
• The personal-data reveal audit record uses the tenant from the session instead of the one sent by the client.
• Guests: e-mail logins now show as "Online" and their session history appears on the detail page; the online definition matches the Sessions page.
• Guest detail: daily/hourly charts and dates follow the tenant time zone (previously UTC / server time).
• Guests: invalid page/status parameters showed the page as "no guests"; search text broke in links; bulk-action notifications show the real count; the selection is cleared after deleted records.
• Guest delete/block is now rejected in read-only license mode.

New

• Active Sessions: the list is now live — refreshes every 30 seconds (paused while the tab is in the background), durations tick every second, and sessions with no NAS signal for 5 minutes are flagged "no response".
• Active Sessions: NAS / access point and authentication-method filters, sorting (newest, longest, most data) and a NAS column; filters persist in the address bar. The table can be downloaded as CSV in one click.
• Active Sessions: "block guest and disconnect" quick action on guest rows.
• Session termination rewritten: the record is closed, a CoA/Disconnect request is sent to the NAS from within the app (no external tool; on-premise installations drop the device immediately) and the RADIUS identity is revoked — SMS/e-mail passwords are deleted, local users and vouchers keep their passwords but are rejected for 15 minutes. So even when the NAS is unreachable from the cloud, the session ends at the device's next re-authentication. The outcome is reported honestly: "NAS dropped the connection" / "NAS unreachable, credentials revoked".

Improvements

• Active Sessions: "Total download/upload" now sums all active sessions matching the filter (previously only the 20 rows on the page). Search is case-insensitive, MAC addresses match regardless of separators, and searching by name also covers e-mail logins. Roles without permission no longer see terminate buttons; single termination asks for confirmation; error messages follow the user's language.
• Active Sessions: the page stays light even with ~50k guests — it now loads sessions first and only then the identities of those rows.
• Termination actions are rate-limited (30 per minute per user; "terminate all" 3).

Fixes

• Terminating a session deleted the permanent password of local users and vouchers — the user could not log in until a password reset; fixed.
• An already-closed session could be "terminated" again, overwriting the real stop data sent by the NAS; only open sessions are closed now.
• "Disconnect" from the guest list / dashboard never worked in the cloud deployment ("No active session"); fixed, including e-mail logins.
• Bulk termination silently skipped hotel (PMS) sessions and reported the wrong count.
• "Terminate all" also closed stale sessions not shown on screen; now only the visible active set.
• Sessions for which the NAS never sent a stop record stayed open forever; they are now closed automatically after 60 minutes without a signal (new maintenance job).
• Hotel sessions showed "-" in the authentication column; "Hotel (PMS)" and the room number are shown.
• Invalid page/search parameters blanked the page and search text broke in links ("+90" → space); fixed.

Improvements

• Dashboard: the "Average Session" card now shows the typical (median) duration of closed sessions in the last 7 days; a single very long session no longer skews it, open sessions are excluded, and "—" is shown when there is no data.
• Dashboard: dismissed system alerts stay hidden for 24 hours and the dismissed setup checklist stays hidden permanently, without flashing on page load.
• Dashboard: the weekly, hourly and RADIUS charts show "No data yet" instead of empty axes; charts and the progress bar are labelled for screen readers; the alert dismiss button is translated.

Fixes

• Scheduled reports (e-mail attachments): dates/times and the "last N days" window now follow the tenant's selected time zone — previously they used the server clock (UTC) and the report day started mid-day. CSV/Excel and the e-mail body use proper Turkish characters; the PDF uses ASCII equivalents due to a font limitation.
• Dashboard: guests who logged in by e-mail never appeared as "online" in Recent Logins; fixed.
• Dashboard: the setup checklist's "login method" step only checked SMS — installations using e-mail, local users, vouchers or hotel PMS could never complete it.
• Dashboard: the loading skeleton is now aligned with the content (no shift when loading finishes).

New

• Analytics: a new KPI row at the top — total sessions, unique users, average session duration and total traffic, with the percentage change versus the previous period of the same length (arrow and colour). The previous period's dates are shown in a tooltip.
• Analytics: NAS / access point filter — pick a NAS and every session-based card (KPIs, funnel, returning visitors, average duration, heatmap, duration distribution, NAS table) is computed for that device only. The Device/OS table comes from portal registration and is not affected; a note says so.
• Analytics: a "Custom" range in the date picker — choose start/end days and apply; all calculations use those calendar days in the tenant time zone. Card subtitles show the selected range.
• Analytics: a "CSV" button on the Device/OS and NAS tables — download the table data in one click.

Improvements

• Analytics: "New / Returning visitors" is now a single card with its definition, placed next to the conversion funnel, instead of four separate cards.

Fixes

• Scheduled reports: weekday names in the day-of-week selector were written without Turkish characters in Turkish; fixed.

New

• Analytics: a "Conversion Funnel" card was added — portal opened → authentication started → code verified → connected to WiFi, with the drop-off at each step. The card had been ready in the code for a long time but never shown on the page.

Improvements

• The analytics page is much faster: average duration and heatmap calculations moved into the database (even with "All time" selected, the tenant's whole history is no longer pulled into server memory), all cards are cached for 5 minutes; a skeleton is shown while loading instead of a blank screen and the date-range buttons respond immediately.
• Analytics heatmap: the week starts on Monday, hours are shown as "00:00", colour steps are distinguishable in dark mode too, the legend shows the daily average of the busiest hour, and the map states that it follows the tenant time zone. The overflow that made the page scroll sideways on wide screens is gone.
• Analytics charts are readable in dark mode: grid and axis labels follow the theme and all tooltips share one style. Heatmap cells and table headers are labelled for screen readers.

Fixes

• Analytics: device/OS parsing is now done in a single place for the dashboard, analytics and portal registration — a device recognised on one page no longer shows as "Other" on another.
• Date-range buttons added a browser history entry on every click (the back button returned to the same page); fixed.

Improvements

• Analytics: "Returning visitors" is now computed from real session records (RADIUS) — new = first session in this period, returning = seen before and connected again in this period. The two sets no longer overlap, and the Reports page's "Return rate" uses the same definition (previously the two pages showed different rates).
• Analytics: the "Session Duration Distribution" and "Busiest NAS" subtitles now reflect the selected range ("Last 7 days", "All time") instead of always saying "Last 30 days".
• Analytics: if a section fails to load, a warning appears at the top of the page; previously an error looked like "No data available yet".

Fixes

• Analytics: every "last N days" window is now aligned to calendar days in the tenant's selected time zone (N full days including today). Previously it counted back from the server's current moment, the first day came in partial, and the peak-hours heatmap over-counted some weekdays; the heatmap now shows average sessions per day.
• Analytics: average session duration and the duration distribution counted open/stuck sessions (a single 8-day record could skew a day's average); now only closed sessions are used, capped at 24 hours. The average shows one decimal ("0.4 min" instead of "0 min").
• Analytics: weekday names in the heatmap were written without Turkish characters in Turkish; fixed.
• Analytics: in the Device/OS table percentages did not add up to 100 and entries beyond the top 10 disappeared; there is now an "Other" row and percentages sum to exactly 100. Android and iPad showed a desktop icon; contradictory rows like "iOS | Unknown" were fixed.
• Analytics: an invalid date range (e.g. typed into the address bar) could blank the page or keep the server busy for a long time; only 7/30/90/365 days and "All time" are accepted. The Reports page uses the same guard.
• Analytics: decimal numbers (average visits, traffic size) now use the locale's decimal separator.

New

• New "System & NAS Health" card on the dashboard, replacing the old System Status card. RADIUS now shows a real signal instead of "configured / not configured": last authentication time, whether accounting is arriving, and per-NAS status (Healthy / Idle / Not responding / Silent) with open session count and last-seen time. Traffic from an IP that is not in your NAS list is flagged.
• New "Capacity" card: this month's new guests and SMS sent against your plan limit with progress bars, local user / sponsor / voucher counts and unused voucher stock. A warning appears at 80% of a limit, along with the billing period end date. On-premise installations and deployments with billing disabled see usage only.
• Quick actions in the Recent Logins card: "Disconnect" (when online) and "Block / Unblock" straight from a guest row, without opening the guest list. Shown according to role (blocking: admin and manager; disconnecting: admin).

Improvements

• The dashboard layout was reordered by operational priority: alerts and the setup checklist on top, then live counters, pending approvals, system/NAS health and capacity, then who is connected and RADIUS monitoring; the 30-day distribution charts moved to the bottom. The half-width lonely RADIUS card and the empty right column are gone.

Improvements

• The dashboard loads much lighter: queries that ran repeatedly for the same page were consolidated (~70 → ~30), the 30-day distribution cards are served from a 5-minute cache, and extra database indexes were added for growing installations.
• Live refresh got smarter: a background tab no longer keeps the server busy and refreshes immediately when brought to the front; if the connection drops, the retry interval backs off gradually; if your session has expired you are sent to the login page instead of seeing "No connection". The "Last update" label now actually ticks.
• The "Pending Approvals" card now updates live (it used to stay frozen until a page reload).

Fixes

• Dashboard: the SMS gateway status could show "Connected" even when the service was disabled with a key entered; the check was corrected.

Improvements

• Hundreds of Turkish UI strings written without proper Turkish characters were corrected (e.g. "Basarili" → "Başarılı", "Dogrulama" → "Doğrulama"); menus, settings pages, alerts and dashboard cards now render in correct Turkish.
• Dashboard: if a section fails to load, a warning now appears at the top of the page and the System Status card shows "Unknown"; previously a transient error looked like zero guests / a red "No connection".
• Dashboard charts are now readable in dark mode: grid lines and axis labels follow the theme, and the Safari bar no longer disappears on a dark background.

Fixes

• Dashboard: guest charts (weekly, hourly, yesterday vs today) and the "Today's Logins" card are now counted from real session records (RADIUS accounting) — distinct users who connected at least once that day. Previously they used each guest's "last visit" date, so a returning guest shrank yesterday's count and inflated today's, and the guest and session lines never matched. The mobile app uses the same definition.
• Dashboard: a system alert ("NAS Is Not Sending Accounting") now appears when the NAS authenticates users but sends no accounting — previously active sessions and charts silently stayed at zero.
• Dashboard: the RADIUS "Recent Activity" list showed phone numbers and e-mails in the clear even when "Mask personal data in the panel" was on; it now applies the same masking as the Recent Logins card.
• Dashboard: the RADIUS card mixed a "today" window for the counters with a rolling "last 24 hours" window for the hourly chart, so the chart total never matched the counters. Everything now uses today (tenant time zone).
• Dashboard: with no authentication attempts the success rate showed "100%"; it now shows "—".
• Dashboard: in the Yesterday vs Today card any increase from zero showed "+100%"; it now shows a "New" label.
• Dashboard: Mobile vs Desktop percentages did not add up to 100 because of other devices; an "Other" row was added. Pie chart percentages now sum to exactly 100 (no more 99/101).
• Dashboard: weekday labels in the weekly chart were off by one day for tenants in American time zones.
• Dashboard: the "Other" device type was not translated in Turkish; the browser chart tooltip started with a stray " : "; the green pulse on the Active Sessions card blinked outside the card.

Fixes

• On the Portal Customization page, opening the desktop preview in full screen left the section jump menu (Login Methods, Form Fields, etc.) and the bottom save bar showing on top of the preview; the full-screen preview now opens above everything.

New

• The Portal Customization page has been redesigned: Login Methods now sit at the top of the page — SMS, e-mail, sponsor, user login, voucher and hotel login each live in their own expandable card, and status badges (e.g. "SMTP: required", "PMS: configured") instantly show why a method is locked.
• The new "Texts & Labels" section gathers tab names, footer and copyright texts (Turkish/English) in one place; colors, theme and layout options live under "Brand & Appearance", with fine-grained style options in their own section.
• A sticky save bar counts how many changes are unsaved; success, error and "re-download your template" notices now appear right next to the save button.
• The preview panel can switch between mobile and desktop views, and a jump menu at the top of the page moves quickly between sections.

Improvements

• After picking a color preset, a "Restore previous colors" link brings back your old colors with one click.
• The "Reset to Defaults" confirmation now clearly states that the uploaded logo and background image will also be deleted.

Fixes

• Clicking the eye icon next to masked personal data no longer accidentally opens the detail page — the icon only reveals or hides the value.
• The dark side menu's scrollbar appeared white when the light theme was selected — it now matches the menu.

New

• The portal now shows a single, tab-free form for businesses using one sign-in method — for example, hotels using room-number login give guests a clean single screen. SMS and user login can be disabled individually under Settings → Portal, and you can choose which tab opens first. Remember to re-download your portal template after changing method settings.
• Privacy: administrators can now view masked personal data via the eye icon next to it, with every view recorded in the audit log; the new 'auto re-mask' duration in Privacy settings re-masks the data automatically when it expires.

Fixes

• When the PMS integration was disabled, a non-working Hotel tab could remain on the portal — it is now hidden (including in the preview).