4.61v Security fixes

Last modification: 2025-05-12 05:47:33

Multiple XSS vulnerabilities were fixed (all required operator login to exploit)

These were minor security issues that couldn't be exploited by anonymous visitors

Reported by:

* Name: Manojkumar Jaganathan (TheWhiteEvil)
* LinkedIn: https://www.linkedin.com/in/manojkumar-j-7ba35b202/
* HackerOne Profile: https://hackerone.com/the-white-evil?type=user
* Company: HackerBro Technologies
* Their website https://www.hackerbro.net

Specific fixes included:
    1. Properly escaping operator names in the dropdown filtering box
    2. Escaping bot usernames in the Telegram module
    3. Escaping operator names in the change owner window
    4. Escaping "Alias nick" field in department assignment modals
    5. Escaping Facebook page "Name" fields
    6. Escaping canned message content in chat window flows
New Features
    1. Added logging capability for chat priority rules application
    2. Added support for passing chat_id and chat_hash parameters
    3. Improved UI to show which siteaccess is being used for translated text in widget themes

For update just follow standard update procedure. For manual update it's update_329.sql

Support project

Developing application takes a lot of time. You can support application by donating. There is no company behind this application and it takes away my free time. Every donation matters and does not matter how small it is!


Paypal, one time donation
Monthly donation
Bitcoin
bc1q6gkl2hcwtn2g26em6axc7jehmn2hd9x8g7nzx9

USDT (Ethereum network)
0x45b92C4aa29EFD3252fD04fcDDe3e6Ef8b399D75