From 94e930a141faf2cee35ed1cd34558dd4b8393d48 Mon Sep 17 00:00:00 2001 From: Sojan Jose Date: Wed, 20 Aug 2025 15:45:19 +0200 Subject: [PATCH 1/6] fix(migrations): skip AddFeatureCitationToAssistantConfig on OSS (#12244) --- ...20250808123008_add_feature_citation_to_assistant_config.rb | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/db/migrate/20250808123008_add_feature_citation_to_assistant_config.rb b/db/migrate/20250808123008_add_feature_citation_to_assistant_config.rb index e1f5c3f03..d5b037ec6 100644 --- a/db/migrate/20250808123008_add_feature_citation_to_assistant_config.rb +++ b/db/migrate/20250808123008_add_feature_citation_to_assistant_config.rb @@ -1,5 +1,7 @@ class AddFeatureCitationToAssistantConfig < ActiveRecord::Migration[7.1] def up + return unless ChatwootApp.enterprise? + Captain::Assistant.find_each do |assistant| assistant.update!( config: assistant.config.merge('feature_citation' => true) @@ -8,6 +10,8 @@ class AddFeatureCitationToAssistantConfig < ActiveRecord::Migration[7.1] end def down + return unless ChatwootApp.enterprise? + Captain::Assistant.find_each do |assistant| config = assistant.config.dup config.delete('feature_citation') From c6113852d7debd064272800f65468f3d86472920 Mon Sep 17 00:00:00 2001 From: Sojan Jose Date: Wed, 20 Aug 2025 16:23:38 +0200 Subject: [PATCH 2/6] Bump version to 4.5.1 --- config/app.yml | 2 +- package.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/config/app.yml b/config/app.yml index c9b08cd07..cc7233c18 100644 --- a/config/app.yml +++ b/config/app.yml @@ -1,5 +1,5 @@ shared: &shared - version: '4.5.0' + version: '4.5.1' development: <<: *shared diff --git a/package.json b/package.json index 441dcbd90..8dc6b2565 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@chatwoot/chatwoot", - "version": "4.5.0", + "version": "4.5.1", "license": "MIT", "scripts": { "eslint": "eslint app/**/*.{js,vue}", From 3038e672f817a25f608b85bb4b457e5c56f597a4 Mon Sep 17 00:00:00 2001 From: Sojan Jose Date: Wed, 20 Aug 2025 20:23:42 +0200 Subject: [PATCH 3/6] chore(annotations): sync model annotations with current schema (#12245) - Update Schema Information headers for AssignmentPolicy, Campaign, Notification - Reflect schema change for Campaign.template_params (not null with default) - Keep annotations consistent to avoid drift --- app/models/assignment_policy.rb | 2 +- app/models/notification.rb | 1 + db/migrate/20250709102213_add_template_params_to_campaigns.rb | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-) diff --git a/app/models/assignment_policy.rb b/app/models/assignment_policy.rb index c01ab91c4..a76893d61 100644 --- a/app/models/assignment_policy.rb +++ b/app/models/assignment_policy.rb @@ -3,7 +3,7 @@ # Table name: assignment_policies # # id :bigint not null, primary key -# assignment_order :integer default(0), not null +# assignment_order :integer default("round_robin"), not null # conversation_priority :integer default("earliest_created"), not null # description :text # enabled :boolean default(TRUE), not null diff --git a/app/models/notification.rb b/app/models/notification.rb index 8c4162702..db07e3679 100644 --- a/app/models/notification.rb +++ b/app/models/notification.rb @@ -19,6 +19,7 @@ # # Indexes # +# idx_notifications_performance (user_id,account_id,snoozed_until,read_at) # index_notifications_on_account_id (account_id) # index_notifications_on_last_activity_at (last_activity_at) # index_notifications_on_user_id (user_id) diff --git a/db/migrate/20250709102213_add_template_params_to_campaigns.rb b/db/migrate/20250709102213_add_template_params_to_campaigns.rb index d70359b30..99d29071f 100644 --- a/db/migrate/20250709102213_add_template_params_to_campaigns.rb +++ b/db/migrate/20250709102213_add_template_params_to_campaigns.rb @@ -1,5 +1,5 @@ class AddTemplateParamsToCampaigns < ActiveRecord::Migration[7.1] def change - add_column :campaigns, :template_params, :jsonb, default: {}, null: false + add_column :campaigns, :template_params, :jsonb end end From 714f24de11db3607103bf871220d7e6f4805ea7e Mon Sep 17 00:00:00 2001 From: Sojan Jose Date: Wed, 20 Aug 2025 21:39:50 +0200 Subject: [PATCH 4/6] revert: "fix(sdk): Ignore messages from a different origin and sanitizee URLs (#8879)" (#12248) This reverts commit a42b99ada0621e2805a39038152dbf211fcac17f. fixes: #12247 --- app/javascript/sdk/IFrameHelper.js | 33 ++---------------------------- 1 file changed, 2 insertions(+), 31 deletions(-) diff --git a/app/javascript/sdk/IFrameHelper.js b/app/javascript/sdk/IFrameHelper.js index 25f90912d..3ab1ba1f5 100644 --- a/app/javascript/sdk/IFrameHelper.js +++ b/app/javascript/sdk/IFrameHelper.js @@ -50,35 +50,11 @@ const updateCampaignReadStatus = baseDomain => { }); }; -const sanitizeURL = url => { - if (url === '') return ''; - - try { - // any invalid url will not be accepted - // example - JaVaScRiP%0at:alert(document.domain)" - // this has an obfuscated javascript protocol - const parsedURL = new URL(url); - - // filter out dangerous protocols like `javascript`, `data`, `vbscript` - if (!['https', 'http'].includes(parsedURL.protocol)) { - throw new Error('Invalid Protocol'); - } - } catch (e) { - // eslint-disable-next-line no-console - console.error('Invalid URL', e); - } - - return 'about:blank'; // blank page URL -}; - export const IFrameHelper = { getUrl({ baseUrl, websiteToken }) { - baseUrl = sanitizeURL(baseUrl); return `${baseUrl}/widget?website_token=${websiteToken}`; }, createFrame: ({ baseUrl, websiteToken }) => { - baseUrl = sanitizeURL(baseUrl); - if (IFrameHelper.getAppFrame()) { return; } @@ -126,12 +102,10 @@ export const IFrameHelper = { window.onmessage = e => { if ( typeof e.data !== 'string' || - e.data.indexOf('chatwoot-widget:') !== 0 || - e.origin !== window.location.origin + e.data.indexOf('chatwoot-widget:') !== 0 ) { return; } - const message = JSON.parse(e.data.replace('chatwoot-widget:', '')); if (typeof IFrameHelper.events[message.event] === 'function') { IFrameHelper.events[message.event](message); @@ -166,9 +140,7 @@ export const IFrameHelper = { }, setupAudioListeners: () => { - let { baseUrl = '' } = window.$chatwoot; - baseUrl = sanitizeURL(baseUrl); - + const { baseUrl = '' } = window.$chatwoot; getAlertAudio(baseUrl, { type: 'widget', alertTone: 'ding' }).then(() => initOnEvents.forEach(event => { document.removeEventListener( @@ -262,7 +234,6 @@ export const IFrameHelper = { }, popoutChatWindow: ({ baseUrl, websiteToken, locale }) => { - baseUrl = sanitizeURL(baseUrl); const cwCookie = Cookies.get('cw_conversation'); window.$chatwoot.toggle('close'); popoutChatWindow(baseUrl, websiteToken, locale, cwCookie); From ae3ac33049432aa6fa54cd2010895ba2f3b67980 Mon Sep 17 00:00:00 2001 From: Sojan Jose Date: Wed, 20 Aug 2025 21:44:30 +0200 Subject: [PATCH 5/6] Bump version to 4.5.2 --- config/app.yml | 2 +- package.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/config/app.yml b/config/app.yml index cc7233c18..d11111fbc 100644 --- a/config/app.yml +++ b/config/app.yml @@ -1,5 +1,5 @@ shared: &shared - version: '4.5.1' + version: '4.5.2' development: <<: *shared diff --git a/package.json b/package.json index 8dc6b2565..31d07021e 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@chatwoot/chatwoot", - "version": "4.5.1", + "version": "4.5.2", "license": "MIT", "scripts": { "eslint": "eslint app/**/*.{js,vue}", From 530125d4c5e9a8eaa075bcbeaa6cad106197c6e8 Mon Sep 17 00:00:00 2001 From: Sojan Jose Date: Thu, 21 Aug 2025 11:07:43 +0200 Subject: [PATCH 6/6] chore(deps): upgrade twilio-ruby to 7.6.0 for upcoming features (#12243) ### Summary - Update Twilio gem to support latest features and API changes. - No app code changes; Gemfile and Gemfile.lock only. references: #11602 , #11481 ### Testing - Existing Twilio SMS: send/receive still works; delivery status updates. - Existing Twilio WhatsApp: send/receive still works; templates (if used) unaffected. - Create new Twilio SMS/WhatsApp inboxes: can be created and can send/receive messages. Co-authored-by: Muhsin Keloth --- Gemfile | 2 +- Gemfile.lock | 18 ++++++++++-------- 2 files changed, 11 insertions(+), 9 deletions(-) diff --git a/Gemfile b/Gemfile index a3b3c0ae8..e271e6b03 100644 --- a/Gemfile +++ b/Gemfile @@ -89,7 +89,7 @@ gem 'wisper', '2.0.0' ##--- gems for channels ---## gem 'facebook-messenger' gem 'line-bot-api' -gem 'twilio-ruby', '~> 5.66' +gem 'twilio-ruby' # twitty will handle subscription of twitter account events # gem 'twitty', git: 'https://github.com/chatwoot/twitty' gem 'twitty', '~> 0.1.5' diff --git a/Gemfile.lock b/Gemfile.lock index be258f524..531e3db2c 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -252,8 +252,10 @@ GEM railties (>= 5.0.0) faker (3.2.0) i18n (>= 1.8.11, < 2) - faraday (2.9.0) - faraday-net_http (>= 2.0, < 3.2) + faraday (2.13.1) + faraday-net_http (>= 2.0, < 3.5) + json + logger faraday-follow_redirects (0.3.0) faraday (>= 1, < 3) faraday-mashify (0.1.1) @@ -261,8 +263,8 @@ GEM hashie faraday-multipart (1.0.4) multipart-post (~> 2) - faraday-net_http (3.1.0) - net-http + faraday-net_http (3.4.0) + net-http (>= 0.5.0) faraday-net_http_persistent (2.1.0) faraday (~> 2.5) net-http-persistent (~> 4.0) @@ -421,7 +423,7 @@ GEM judoscale-sidekiq (1.8.2) judoscale-ruby (= 1.8.2) sidekiq (>= 5.0) - jwt (2.8.1) + jwt (2.10.1) base64 kaminari (1.2.2) activesupport (>= 4.1.0) @@ -503,7 +505,7 @@ GEM mutex_m (0.3.0) neighbor (0.2.3) activerecord (>= 5.2) - net-http (0.4.1) + net-http (0.6.0) uri net-http-persistent (4.0.2) connection_pool (~> 2.2) @@ -849,7 +851,7 @@ GEM i18n timeout (0.4.3) trailblazer-option (0.1.2) - twilio-ruby (5.77.0) + twilio-ruby (7.6.0) faraday (>= 0.9, < 3.0) jwt (>= 1.5, < 3.0) nokogiri (>= 1.6, < 2.0) @@ -1041,7 +1043,7 @@ DEPENDENCIES telephone_number test-prof time_diff - twilio-ruby (~> 5.66) + twilio-ruby twitty (~> 0.1.5) tzinfo-data uglifier