Zuora Release 2022.09.R2

Resolved: Formula Injection vulnerability issue when exporting product list data

Previously, Formula Injection vulnerability existed when you exported product catalog data files in Excel (.xlsx) by clicking the Export icon on the Products page and then selecting ProductCatalog Sheet on the Exports page through the Zuora UI.

The Formula Injection vulnerability issue has now been resolved. If you export a product catalog data file using the abovementioned method, some fields in the exported data might now begin with an apostrophe character (’).

For more information, see Notes and limitations in data exports and Data Exports.

Rolling release to enable Orders Harmonization for remaining Subscribe and Amend customers

As of Zuora Release 2022.09.R2, we have started rolling out Orders Harmonization to the remaining Subscribe and Amend tenants in both sandbox and production environments. You are a Subscribe and Amend tenant if you see Amendments under Customers in the left navigation menu or if you have the Amendment button on the top right of the subscription details page in your Zuora Billing UI.

We will continue to roll out Orders Harmonization to customers who meet the preceding criteria throughout the remainder of 2022. Please contact Zuora Global Support or your CSM if this feature has not been enabled for your environment and you would like to know when it will be enabled or if you would like it enabled now.

The benefits of enabling Orders Harmonization for your environment include the following:

• You can choose when you want to utilize Orders functionality for new Zuora features. New functionalities based on the Orders framework include Order Line Items, Ramps, CPQ X, Prepaid with Drawdown, and much more!
• Orders can be seamlessly leveraged through Orders Harmonization without migrating or refactoring your existing integrations from the Subscribe and Amend APIs to the new Orders APIs. None of your existing Subscribe and Amend integrations will break with Orders Harmonization enabled.
• You can optionally use the Orders API and UI to manage your subscriptions. Orders support a high volume of subscription creations and amendments in one API call.

For more information, see FAQs about Orders Harmonization.

More joined objects available in data sources for Flexible Billing

When using each of the following data sources to export data, you can now select the Subscription Bill To Contact and Subscription Bill To Contact Snapshot joined objects to export bill-to contact information:

• Order Action data source
• Order Tcb data source
• Order Elp data source
• Order Mrr data source
• Order Tcv data source
• Order Quantity data source

As specifying bill-to contact information is supported at the subscription level, the contact information is also displayed on order metrics accordingly. Therefore, these data source changes are introduced for reporting purposes.

Note that this change is available only if you have both Orders and Flexible Billing enabled.

Enhancements to Order Action data source

The Order Action data source has been enhanced with the following joined objects:

• Add Rate Plan
• Remove Rate Plan
• Update Rate Plan

At the same time, the enhanced Order Action data source can be used in the following features:

• ZOQL queries of AQuA

• Email Templates in the Administration settings > Setup Profiles, Notifications and Email Templates and the Billing settings > Setup Profiles, Notifications and Email Templates.

For more information, see Order Action Data Source and Export ZOQL.

Resolved: automatic generation of orders for amendments in Orders Harmonization tenants

We have resolved the following issues regarding the automatic generation of orders for amendments in an Orders Harmonization tenant:

• Previously, when a pending amendment was activated, no corresponding order was generated for the amendment. This issue has now been resolved. An order is automatically generated when a pending amendment is activated.
• Previously, when a subscription had an associated pending amendment, for any further amendment to the subscription, no corresponding order was generated. This issue has now been resolved. An order is automatically generated for the further amendment to a subscription when a pending amendment exists.

Accounts API enhancements to purchase order number query

You can now use any of the following operations to retrieve the purchase order number provided by your customer for services or products:

• Retrieve an account
• Retrieve an account summary

You can view the value from the basicInfo > purchaseOrderNumber field returned in the response schema.

Changes to list view of All Bill Runs page

To improve the page performance and maintain consistency with other list view pages, we have made the following changes to the list view of the All Bill Runs page:

• In the Bill Run Views section, removed the counters on each status view.
• In the upper right of the list view table, removed the total number of records.

More objects and fields available in Reporting for Flexible Billing

When creating reports through the Zuora UI, you can now select the following objects and fields for reporting:

• Subscription: Subscription Bill To
• Subscription: Subscription Bill To Snapshot
• Subscription.Payment Term
• Rate Plan Charge: Bill To Contact Snapshot
• Rate Plan Charge: Sold To Contact Snapshot
• Rate Plan Charge: Subscription Bill To
• Rate Plan Charge: Subscription Bill To Snapshot
• Rate Plan Charge.Payment Term Snapshot
• Rate Plan Charge: Subscription.Payment Term
• Order Action:Order Action Bill To
• Order Action: Subscription Bill To
• Order Action: Subscription Bill To Snapshot
• Order Action: Subscription.Payment Term
• Order Action.Clearing Existing Bill To Contact
• Order Action.Clearing Existing Payment Term
• Order Action.Payment Term
• Invoice: Invoice Bill To Contact
• Invoice: Invoice Sold To Contact
• Invoice.Payment Term
• Invoice Item: Invoice Bill To Contact
• Invoice Item: Invoice Sold To Contact
• Invoice Item: Invoice.Payment Term
• Credit Memo: Credit Memo Bill To Contact
• Credit Memo Item: Credit Memo Bill To Contact
• Credit Taxation Item: Credit Memo Bill To Contact
• Debit Memo: Debit Memo Bill To Contact
• Debit Memo.PaymentTerm
• Debit Memo Item: Debit Memo Bill To Contact
• Debit Memo Item: Debit Memo.PaymentTerm
• Order Tcb: Subscription Bill To 
• Order Tcb: Subscription Bill To Snapshot
• Order Tcb: Subscription.Payment Term
• Order Elp: Subscription Bill To 
• Order Elp: Subscription Bill To Snapshot
• Order Elp: Subscription.Payment Term
• Order Mrr: Subscription Bill To 
• Order Mrr: Subscription Bill To Snapshot
• Order Mrr: Subscription.Payment Term
• Order Tcv: Subscription Bill To 
• Order Tcv: Subscription Bill To Snapshot
• Order Tcv: Subscription.Payment Term
• Order Quantity: Subscription Bill To 
• Order Quantity: Subscription Bill To Snapshot
• Order Quantity: Subscription.Payment Term

Note that this change is available only if you have both Orders and Flexible Billing enabled.

Zuora Quotes 

We recently released patch releases on top of Zuora Quotes version 10.10. The latest version is 10.10.1.

For the release notes of Zuora Quotes, see Zuora Quotes version 10 release notes.

 Back to Table of Contents

Update on minimum value for Risk Score Threshold of Google reCAPTCHA Enterprise

For enhanced security for the hosted payment pages, we have increased the minimum value allowed for the Risk Score Threshold setting of Google reCAPTCHA Enterprise. You can find details about the allowed value in the UI tooltips for both tenant-level and page-level Risk Score Threshold settings.

This change takes effect for new payment pages created from now on. For the existing payment pages, if your current Risk Score Threshold value is less than the allowed minimum value, you will be prompted to update it with a valid value when you edit the payment page. We strongly recommend that you update your payment page configuration to set the Risk Score Threshold value according to the allowed value requirements.

For more information about the Risk Score Threshold setting, see Configure Google reCAPTCHA Enterprise for Payment Pages 2.0.

Support for mandate PDF for Direct Entry AU type of Payment Pages 2.0 on GoCardless

We have improved the Direct Entry AU type of Payment Pages 2.0 for the GoCardless gateway integrations to meet the mandate PDF compliance requirements. A new setting called Retrieve Mandate PDF is now available on the Page Configuration page. With this setting enabled, the confirmation dialog contains all the required consent information and a link to the mandate PDF file.

For more information, see Configure Bank Transfer type Payment Pages 2.0.

Support for canceling authorization on CyberSource v2.0

The Cancel authorization API operation is now available for use with the Cybersource, Payment API v2.0 payment gateway. After you authorize a payment amount before capturing the payment, as the alternative to capturing the authorized amount, you can now cancel the authorization.

Support for onboarding merchants on PayPal Commerce Platform gateways

We now support onboarding a merchant on the PayPal Commerce Platform gateway by linking your Merchant ID and storing it in Zuora. You can create the Merchant ID in Zuora Payments Settings and use it as the credential to access the PayPal Commerce Platform gateway.

For more information, see the following articles:

• Payment Gateway Authentication
• PayPal Commerce Platform Gateway

Support for passing customized metadata to Adyen payment gateways 

We have enhanced Adyen Integration v2.0 to support passing customized metadata for the following objects to the Adyen payment gateway:

• Payment
• Payment Method

You can define your customized fields for each object when you configure an Adyen v2.0 payment gateway instance. Your self-defined fields will be added to the request body and passed to the Adyen gateway. You can use this data for further analysis, reporting, or building custom rules to enhance your fraud protection.

For more information, see Additional metadata for Adyen v2.0.

Enhancement to confirmation dialogs for Payment Pages 2.0

We have enhanced confirmation dialogs of Payment Pages 2.0 to support the id attribute in the HTML template. 

For more information about the confirmation dialog template, see Create and configure Payment Pages 2.0 for different payment method types.

totalAmount field available on Payment Schedule object

The totalAmount field is now available on the Payment Schedule object. This field is currently only available if you use the REST API to interact with payment schedules.

When creating recurring payment schedules, you can use the totalAmount field to specify the total amount that a recurring payment schedule will process. The amount passed to totalAmount will be evenly divided by the value of the occurrences field and then be passed as the amount of each payment schedule item.

Note that the totalAmount field introduces the following behavior changes:

• When creating recurring payment schedules, you have two options to specify amounts:
  • Specify totalAmount and occurrences, amount will be calculated.
  • Specify amount and occurrences, totalAmount will be calculated.
• When updating the amount or occurrences field of a payment schedule, the totalAmount field will be automatically recalculated to reflect the updated total amount of the payment schedule.
• When canceling a payment schedule or its payment schedule items, the totalAmount field will be recalculated to reflect the total amount that is processed.
• For payment schedules that generate standalone payments, the totalAmount field is always null , as the standalone payments generated by a payment schedule can be in different currencies.

 Back to Table of Contents

Support for managing custom events and custom scheduled events through Zuora UI

You can now create, edit, view, clone, inactivate, or delete custom events and custom scheduled events through the Zuora UI. Previously, you could only manage them through the API.

For more information, see Manage custom events and custom scheduled events.

Behavior change of Billing and Payment Settings API Read operations

For a better user experience, Zuora no longer checks the user permissions on Billing and Payment Settings API Read operations, indicating HTTP GET requests. The behavior remains unchanged for other Billing and Payment operations, such as Create, Update, or Delete.

New System Health dashboards available 

We have now released the following dashboard:

 Back to Table of Contents