4.82v Security updates, expanded widget mode

1. Notable changes since 4.81v
   • Security/file handling: enhanced MIME type validation across file download endpoints (downloadfile.php, inlinedownload.php, REST API file.php); MIME type constants added in mail conversation parser; all operator/visitor uploads validated against var folder path; resolved security issues L01, L02, L04, L05, L06, L11, L13.
   • Widget: added expand mode with configurable width/height ratios and new shrink_text/expand_text UI fields; widget communication updated to include user session prefill variables in sent messages; fixed reloadWidget function; updated wrapper version.
   • Chat search/statistics: added message count filters (operators, visitors, bots) to search panel and statistics tabs; added total messages count input field; added search by message ID range.
   • Chat tab visibility: operators can toggle chat tab visibility (show/hide chat tabs) via quick actions in user settings.
   • User settings: added auto-accept chats option and alert preference for transferred chats.
   • Variables/prefill: support for passing custom back-office vars as lhc_var variables; encrypted prefilled variables always applied; variable only set when replaceable variable is non-empty; proactive invitations now update vars when custom vars are passed.
   • Theme/translations: widget theme translate method accepts user context; REST API modules (checkchatstatus, getinvitation, initchat, onlinesettings, settings) use user context for theme translations; multilanguage support for custom fields; fetchByVid includes caching option.
   • Canned messages: refactored retrieval with getCannedMessages method; added auto_send filter and ignore_subjects parameter.
   • Extensions: support for extensions to contribute custom side-menu items.
   • Configuration: folder/directory write-permission checks added to the configuration page with per-directory success/error indicators.
   • Bot: support for background workers in REST API bot action; improved bot detection filtering.
   • Message history: previous-message loading always uses all messages when the page limit is not reached; safe inclusion of all chat messages.
2. Summary
   • This release strengthens file handling security with MIME type validation, file path checks, and resolves multiple L-series security issues.
   • Operator UX improvements include widget expand mode, chat tab visibility toggles, and richer user settings (auto-accept, transfer alerts).
   • Search and statistics gain new message count filters; extensions gain custom side-menu support; theme translations now respect user context.
3. Contributors
   • L01: SSRF via incoming webhook image download (CWE-918)
   • L06: Mass assignment in REST API file PUT leading to arbitrary file read (CWE-915, CWE-22)
   • L11: Stored XSS via Content-Type spoofing in file upload (CWE-79, CWE-345)
   • L13: Unsafe deserialization in configuration loader (CWE-502)

Vulnerability Researcher: Pedro J. Núñez-Cacho Fuentes (https://blogs.tunelko.com)

For update just follow standard update procedure. For manual update it's update_349.sql

**Full Changelog**: ;https://github.com/LiveHelperChat/livehelperchat/compare/4.81v...4.82v

4.81v One-Time proactive invitations

1. Notable changes since 4.80v
   - One-time proactive chat invitations: new DB table `lh_abstract_proactive_chat_invitation_one_time` tracks which visitors have already seen an invitation, preventing repeat displays.
   - Proactive invitations: cleanup logic added for stale one-time invitation records; widget now records when a one-time invitation is shown; edit module enhanced with custom actions for proactive invitations.
   - Captcha: added provider-based captcha support — Google reCAPTCHA v3 and Cloudflare Turnstile are now both supported with a shared validation layer (`CaptchaValidator`, `erLhcoreClassUserValidator`).
   - Captcha admin UI: provider selector with provider-specific field sections; shared key labels across providers; CSRF redirect fix.
   - Translation system: UX improvements for automatic translations; operator and visitor message translation differentiated; messages with existing translations are now skipped; translation configuration UI updated.
   - Bot/Widget: custom HTML buttons and bot buttons are now disabled when a form is in progress status; alert messages added; placeholder for name field in widget start form.
   - Editor: fixed infinite loop issue in the new rich-text editor (LHCEditor).
   - Dashboard: removed legacy old dashboard; cleaned up related options and switch logic.
   - Security/permissions: added permission access checks in block user, hold action, transfer chat, and chat widget closed flows.
   - PHP 8.5 compatibility: resolved deprecation and compatibility issues.
   - Translations: updated translation catalogs including new captcha-related and translation-workflow keys.

2. Summary
   - This release introduces one-time proactive chat invitations, a flexible multi-provider captcha system, and several translation workflow improvements.
   - Includes editor stability fixes, dashboard cleanup, PHP 8.5 compatibility, and stricter permission checks across chat action endpoints.

For update just follow standard update procedure. For manual update it's update_348.sql

**Full Changelog**: https://github.com/LiveHelperChat/livehelperchat/compare/4.80v...4.81v

4.80v Guardrails multilanguage

1. Notable changes since 4.79v
   - Message content protection: added language-specific warning message support for ghosting/masking rules.
   - UI (back office): redesigned message protection warning editor with multilingual tabs and per-language message fields.
   - Runtime masking: warning text can now be translated by chat locale (full locale and short locale fallback).
   - Data/model layer: added `languages` persistence support in `lh_abstract_msg_protection` model/POS mapping.
   - Frontend cleanup: simplified multilingual tab content rendering in Svelte component used by admin forms.

2. Summary
   - This release extends message protection rules with localized warning messages and wires the full stack (DB, model, UI, and runtime locale resolution).

For update just follow standard update procedure. For manual update it's update_346.sql

## What's Changed
**Full Changelog**: https://github.com/LiveHelperChat/livehelperchat/compare/4.79v...4.80v

4.79v Conditions checking improvements

1. Notable changes since 4.78v
   - Abstract/Back office: added subject filter options (Name, Pinned, Internal) and corrected autoresponder filter form routing.
   - Cloning: added generic abstract object cloning support and user clone action in user list.
   - Bot & proactive invitations: expanded condition operator support (`(` and `||`) and added more proactive invitation condition checks.
   - Mail conversations: improved reliability of ticket fetch/send flow, better scheduled-state handling, and replaceable variable support for send e-mail templates.
   - Chat/Webhooks: enhanced chat state tracking and logging across chat validators, dispatchers, and webhook handlers.
   - Forms & UI: added reusable custom form args, extension-specific login sizing, theme existence checks, online users attribute fixes, and widget cache/version updates.
   - Translations: updated translation packs, including Japanese language/default translation updates.

2. Summary
   - This release focuses on reliability improvements in mail/chat workflows and stronger bot/proactive condition handling.
   - It also includes operator-facing UX improvements (filtering and cloning) and broad translation/frontend update refreshes.

For update just follow standard update procedure. For manual update it's update_346.sql

## What's Changed
**Full Changelog**: https://github.com/LiveHelperChat/livehelperchat/compare/4.78v...4.79v

4.78v Bot short name

1. Notable changes since 4.77v
   - Bot: support for bot short name.
   - Message masking: mask last message from visitor.
   - Webhooks/Conditions: support additional comparison variables and accept all params for condition checks.
   - Events: included more information for main chat attributes change event.
   - Debugging: added debug message handling inside chat messages.
   - Guardrails: added whitelist support for phone guardrails.
   - Misc: small typo fixes.

2. Summary
   - Improvements across bot, webhooks, and message masking to increase reliability and observability.
   - Several small bug fixes and developer-facing debug improvements.

For update just follow standard update procedure. For manual update it's update_345.sql

## What's Changed
**Full Changelog**: https://github.com/LiveHelperChat/livehelperchat/compare/4.77v...4.78v