diff --git a/qrcode/qrconfig.php b/qrcode/qrconfig.php
index 31469d09..8a489096 100644
--- a/qrcode/qrconfig.php
+++ b/qrcode/qrconfig.php
@@ -5,12 +5,12 @@
  * Config file, feel free to modify
  */
 
-    define('QR_CACHEABLE', true);                                                               // use cache - more disk reads but less CPU power, masks and format templates are stored there
-    define('QR_CACHE_DIR', dirname(__FILE__).DIRECTORY_SEPARATOR.'cache'.DIRECTORY_SEPARATOR);  // used when QR_CACHEABLE === true
-    //define('QR_LOG_DIR', dirname(__FILE__).DIRECTORY_SEPARATOR);                                // default error logs dir
+define('QR_CACHEABLE', false);                                                               // use cache - more disk reads but less CPU power, masks and format templates are stored there
+define('QR_CACHE_DIR', dirname(__FILE__) . DIRECTORY_SEPARATOR . 'cache' . DIRECTORY_SEPARATOR);  // used when QR_CACHEABLE === true
+//define('QR_LOG_DIR', dirname(__FILE__).DIRECTORY_SEPARATOR);                                // default error logs dir
+define('QR_LOG_DIR', false);
+define('QR_FIND_BEST_MASK', true);                                                          // if true, estimates best mask (spec. default, but extremally slow; set to false to significant performance boost but (propably) worst quality code
+define('QR_FIND_FROM_RANDOM', false);                                                       // if false, checks all masks available, otherwise value tells count of masks need to be checked, mask id are got randomly
+define('QR_DEFAULT_MASK', 2);                                                               // when QR_FIND_BEST_MASK === false
 
-    define('QR_FIND_BEST_MASK', true);                                                          // if true, estimates best mask (spec. default, but extremally slow; set to false to significant performance boost but (propably) worst quality code
-    define('QR_FIND_FROM_RANDOM', false);                                                       // if false, checks all masks available, otherwise value tells count of masks need to be checked, mask id are got randomly
-    define('QR_DEFAULT_MASK', 2);                                                               // when QR_FIND_BEST_MASK === false
-
-    define('QR_PNG_MAXIMUM_SIZE',  1024);                                                       // maximum allowed png image width (in pixels), tune to make sure GD and PHP can handle such big images
+define('QR_PNG_MAXIMUM_SIZE',  1024);                                                       // maximum allowed png image width (in pixels), tune to make sure GD and PHP can handle such big images
diff --git a/system/controllers/accounts.php b/system/controllers/accounts.php
index a0bb1fa9..2454d1d3 100644
--- a/system/controllers/accounts.php
+++ b/system/controllers/accounts.php
@@ -25,44 +25,42 @@ switch ($action) {
         $password = _post('password');
         run_hook('customer_change_password'); #HOOK
         if ($password != '') {
-            $d = ORM::for_table('tbl_customers')->where('username', $user['username'])->find_one();
-            if ($d) {
-                $d_pass = $d['password'];
-                $npass = _post('npass');
-                $cnpass = _post('cnpass');
+            $d_pass = $d['password'];
+            $npass = _post('npass');
+            $cnpass = _post('cnpass');
 
-                if (Password::_uverify($password, $d_pass) == true) {
-                    if (!Validator::Length($npass, 15, 2)) {
-                        r2(U . 'accounts/change-password', 'e', 'New Password must be 3 to 14 character');
-                    }
-                    if ($npass != $cnpass) {
-                        r2(U . 'accounts/change-password', 'e', 'Both Password should be same');
-                    }
+            if (Password::_uverify($password, $d_pass) == true) {
+                if (!Validator::Length($password, 36, 2)) {
+                    r2(U . 'accounts/change-password', 'e', 'New Password must be 2 to 35 character');
+                }
+                if ($npass != $cnpass) {
+                    r2(U . 'accounts/change-password', 'e', 'Both Password should be same');
+                }
 
-                    $c = ORM::for_table('tbl_user_recharges')->where('username', $user['username'])->find_one();
-                    if ($c) {
-                        // if has active plan, change the password to devices
-                        $p = ORM::for_table('tbl_plans')->where('id', $c['plan_id'])->find_one();
+                $tur = ORM::for_table('tbl_user_recharges')->where('customer_id', $user['id'])->find_one();
+                if ($tur) {
+                    // if has active plan, change the password to devices
+                    if ($tur['status'] == 'on') {
+                        $p = ORM::for_table('tbl_plans')->where('id', $tur['plan_id'])->find_one();
                         $dvc = Package::getDevice($p);
                         if ($_app_stage != 'demo') {
                             if (file_exists($dvc)) {
                                 require_once $dvc;
-                                (new $p['device'])->remove_customer($c, $p);
+                                (new $p['device'])->remove_customer($user, $p);
+                                (new $p['device'])->add_customer($user, $p);
                             } else {
                                 new Exception(Lang::T("Devices Not Found"));
                             }
                         }
                     }
-                    $d->password = $npass;
-                    $d->save();
-
-                    _msglog('s', Lang::T('Password changed successfully, Please login again'));
-                    _log('[' . $user['username'] . ']: Password changed successfully', 'User', $user['id']);
-
-                    r2(U . 'login');
-                } else {
-                    r2(U . 'accounts/change-password', 'e', Lang::T('Incorrect Current Password'));
                 }
+                $user->password = $npass;
+                $user->save();
+
+                _msglog('s', Lang::T('Password changed successfully, Please login again'));
+                _log('[' . $user['username'] . ']: Password changed successfully', 'User', $user['id']);
+
+                r2(U . 'login');
             } else {
                 r2(U . 'accounts/change-password', 'e', Lang::T('Incorrect Current Password'));
             }
@@ -130,7 +128,7 @@ switch ($action) {
         break;
 
     case 'phone-update-otp':
-        $phone = _post('phone');
+        $phone = Lang::phoneFormat(_post('phone'));
         $username = $user['username'];
         $otpPath = $CACHE_PATH . '/sms/';
 
@@ -181,7 +179,7 @@ switch ($action) {
         break;
 
     case 'phone-update-post':
-        $phone = _post('phone');
+        $phone = Lang::phoneFormat(_post('phone'));
         $otp_code = _post('otp');
         $username = $user['username'];
         $otpPath = $CACHE_PATH . '/sms/';
diff --git a/system/controllers/customers.php b/system/controllers/customers.php
index c00f478f..4a2b25c6 100644
--- a/system/controllers/customers.php
+++ b/system/controllers/customers.php
@@ -332,7 +332,7 @@ switch ($action) {
             ORM::for_table('tbl_customers_fields')->where('customer_id', $id)->delete_many();
             //Delete active package
             $turs = ORM::for_table('tbl_user_recharges')->where('username', $c['username'])->find_many();
-            foreach($turs as $tur){
+            foreach ($turs as $tur) {
                 $p = ORM::for_table('tbl_plans')->find_one($tur['plan_id']);
                 if ($p) {
                     $dvc = Package::getDevice($p);
@@ -359,10 +359,10 @@ switch ($action) {
         break;
 
     case 'add-post':
-        $username = _post('username');
+        $username = alphanumeric(_post('username'), "+_.");
         $fullname = _post('fullname');
-        $password = _post('password');
-        $pppoe_password = _post('pppoe_password');
+        $password = trim(_post('password'));
+        $pppoe_password = trim(_post('pppoe_password'));
         $email = _post('email');
         $address = _post('address');
         $phonenumber = _post('phonenumber');
@@ -380,11 +380,11 @@ switch ($action) {
 
         run_hook('add_customer'); #HOOK
         $msg = '';
-        if (Validator::Length($username, 35, 2) == false) {
-            $msg .= 'Username should be between 3 to 55 characters' . '<br>';
+        if (Validator::Length($username, 55, 2) == false) {
+            $msg .= 'Username should be between 3 to 54 characters' . '<br>';
         }
-        if (Validator::Length($fullname, 36, 2) == false) {
-            $msg .= 'Full Name should be between 3 to 25 characters' . '<br>';
+        if (Validator::Length($fullname, 36, 1) == false) {
+            $msg .= 'Full Name should be between 2 to 25 characters' . '<br>';
         }
         if (!Validator::Length($password, 36, 2)) {
             $msg .= 'Password should be between 3 to 35 characters' . '<br>';
@@ -394,10 +394,9 @@ switch ($action) {
         if ($d) {
             $msg .= Lang::T('Account already axist') . '<br>';
         }
-
         if ($msg == '') {
             $d = ORM::for_table('tbl_customers')->create();
-            $d->username = Lang::phoneFormat($username);
+            $d->username = $username;
             $d->password = $password;
             $d->pppoe_password = $pppoe_password;
             $d->email = $email;
@@ -439,11 +438,11 @@ switch ($action) {
         break;
 
     case 'edit-post':
-        $username = Lang::phoneFormat(_post('username'));
+        $username = alphanumeric(_post('username'), "+_.");
         $fullname = _post('fullname');
         $account_type = _post('account_type');
-        $password = _post('password');
-        $pppoe_password = _post('pppoe_password');
+        $password = trim(_post('password'));
+        $pppoe_password = trim(_post('pppoe_password'));
         $email = _post('email');
         $address = _post('address');
         $phonenumber = Lang::phoneFormat(_post('phonenumber'));
@@ -457,30 +456,25 @@ switch ($action) {
         $zip = _post('zip');
         run_hook('edit_customer'); #HOOK
         $msg = '';
-        if (Validator::Length($username, 35, 2) == false) {
-            $msg .= 'Username should be between 3 to 15 characters' . '<br>';
+        if (Validator::Length($username, 55, 2) == false) {
+            $msg .= 'Username should be between 3 to 54 characters' . '<br>';
         }
         if (Validator::Length($fullname, 36, 1) == false) {
             $msg .= 'Full Name should be between 2 to 25 characters' . '<br>';
         }
-        if ($password != '') {
-            if (!Validator::Length($password, 36, 2)) {
-                $msg .= 'Password should be between 3 to 15 characters' . '<br>';
-            }
-        }
 
         $id = _post('id');
         $c = ORM::for_table('tbl_customers')->find_one($id);
 
+        if (!$c) {
+            $msg .= Lang::T('Data Not Found') . '<br>';
+        }
+
         //lets find user Customers Attributes using id
         $customFields = ORM::for_table('tbl_customers_fields')
             ->where('customer_id', $id)
             ->find_many();
 
-        if (!$c) {
-            $msg .= Lang::T('Data Not Found') . '<br>';
-        }
-
         $oldusername = $c['username'];
         $oldPppoePassword = $c['password'];
         $oldPassPassword = $c['pppoe_password'];
@@ -488,8 +482,8 @@ switch ($action) {
         $pppoeDiff = false;
         $passDiff = false;
         if ($oldusername != $username) {
-            $c = ORM::for_table('tbl_customers')->where('username', $username)->find_one();
-            if ($c) {
+            $cx = ORM::for_table('tbl_customers')->where('username', $username)->find_one();
+            if ($cx) {
                 $msg .= Lang::T('Account already exist') . '<br>';
             }
             $userDiff = true;
@@ -570,19 +564,26 @@ switch ($action) {
             }
 
             if ($userDiff || $pppoeDiff || $passDiff) {
-                $tur = ORM::for_table('tbl_user_recharges')->where('username', ($userDiff) ? $oldusername : $username)->find_one();
+                $tur = ORM::for_table('tbl_user_recharges')->where('customer_id', $c['id'])->find_one();
                 if ($tur) {
                     $tur->username = $username;
                     $tur->save();
                     $p = ORM::for_table('tbl_plans')->find_one($tur['plan_id']);
                     $dvc = Package::getDevice($p);
                     if ($_app_stage != 'demo') {
-                        if (file_exists($dvc)) {
-                            require_once $dvc;
-                            (new $p['device'])->remove_customer($c, $p);
-                            (new $p['device'])->add_customer($c, $p);
-                        } else {
-                            new Exception(Lang::T("Devices Not Found"));
+                        // if has active package
+                        if ($tur['status'] == 'on') {
+                            if (file_exists($dvc)) {
+                                require_once $dvc;
+                                if ($userDiff) {
+                                    $c->username = $oldusername;
+                                    (new $p['device'])->remove_customer($c, $p);
+                                    $c->username = $username;
+                                }
+                                (new $p['device'])->add_customer($c, $p);
+                            } else {
+                                new Exception(Lang::T("Devices Not Found"));
+                            }
                         }
                     }
                 }
diff --git a/system/lan/indonesia.json b/system/lan/indonesia.json
index aabce314..cc2756e3 100644
--- a/system/lan/indonesia.json
+++ b/system/lan/indonesia.json
@@ -527,5 +527,13 @@
     "warning": "peringatan",
     "Created___Expired": "Dibuat \/ Kedaluwarsa",
     "Login___Activate_Voucher": "Masuk \/ Aktifkan Voucher",
-    "Voucher_activation_success__now_you_can_login": "Aktivasi voucher berhasil, sekarang Anda dapat login"
+    "Voucher_activation_success__now_you_can_login": "Aktivasi voucher berhasil, sekarang Anda dapat login",
+    "Customer_cannot_login_again": "Pelanggan tidak dapat login lagi",
+    "Customer_can_login_but_cannot_buy_internet_plan__Admin_cannot_recharge_customer": "Pelanggan dapat login tetapi tidak dapat membeli paket internet, Admin tidak dapat mengisi ulang pelanggan",
+    "Don_t_forget_to_deactivate_all_active_plan_too": "Jangan lupa untuk menonaktifkan semua paket aktif juga",
+    "Attributes": "Atribut",
+    "Additional_Information": "informasi tambahan",
+    "City_of_Resident": "Kota Residen",
+    "State_of_Resident": "Negara Bagian Tempat Tinggal",
+    "Zip_Code": "Kode Pos"
 }
\ No newline at end of file