Merge branch 'develop' into fix/url-sanitizer

Extends liquid template processing to WhatsApp `template_params`,
allowing dynamic variable substitution in template parameter values.

Users can now use liquid variables in WhatsApp template parameters:

```
{
  "template_params": {
    "name": "greet",
    "category": "MARKETING",
    "language": "en",
    "processed_params": {
      "body": {
        "customer_name": "{{contact.name}}",
        "customer_email": "{{contact.email | default: 'no-email@example.com'}}"
      }
    }
  }
}

```

When the message is saved, {{contact.name}} gets replaced with the
actual contact name.

Supported Variables

- {{contact.name}}, {{contact.email}}, {{contact.phone_number}}
- {{agent.name}}, {{agent.first_name}}
- {{account.name}}, {{inbox.name}}
- {{conversation.display_id}}
- Custom attributes: {{contact.custom_attribute.key_name}}
- Liquid filters: {{ contact.email | default: "fallback@example.com" }}

Gemfile

@@ -89,7 +89,7 @@ gem 'wisper', '2.0.0'
 ##--- gems for channels ---##
 gem 'facebook-messenger'
 gem 'line-bot-api'
-gem 'twilio-ruby', '~> 5.66'
+gem 'twilio-ruby'
 # twitty will handle subscription of twitter account events
 # gem 'twitty', git: 'https://github.com/chatwoot/twitty'
 gem 'twitty', '~> 0.1.5'

Gemfile.lock

@@ -252,8 +252,10 @@ GEM
       railties (>= 5.0.0)
     faker (3.2.0)
       i18n (>= 1.8.11, < 2)
-    faraday (2.9.0)
-      faraday-net_http (>= 2.0, < 3.2)
+    faraday (2.13.1)
+      faraday-net_http (>= 2.0, < 3.5)
+      json
+      logger
     faraday-follow_redirects (0.3.0)
       faraday (>= 1, < 3)
     faraday-mashify (0.1.1)
@@ -261,8 +263,8 @@ GEM
       hashie
     faraday-multipart (1.0.4)
       multipart-post (~> 2)
-    faraday-net_http (3.1.0)
-      net-http
+    faraday-net_http (3.4.0)
+      net-http (>= 0.5.0)
     faraday-net_http_persistent (2.1.0)
       faraday (~> 2.5)
       net-http-persistent (~> 4.0)
@@ -421,7 +423,7 @@ GEM
     judoscale-sidekiq (1.8.2)
       judoscale-ruby (= 1.8.2)
       sidekiq (>= 5.0)
-    jwt (2.8.1)
+    jwt (2.10.1)
       base64
     kaminari (1.2.2)
       activesupport (>= 4.1.0)
@@ -503,7 +505,7 @@ GEM
     mutex_m (0.3.0)
     neighbor (0.2.3)
       activerecord (>= 5.2)
-    net-http (0.4.1)
+    net-http (0.6.0)
       uri
     net-http-persistent (4.0.2)
       connection_pool (~> 2.2)
@@ -849,7 +851,7 @@ GEM
       i18n
     timeout (0.4.3)
     trailblazer-option (0.1.2)
-    twilio-ruby (5.77.0)
+    twilio-ruby (7.6.0)
       faraday (>= 0.9, < 3.0)
       jwt (>= 1.5, < 3.0)
       nokogiri (>= 1.6, < 2.0)
@@ -1041,7 +1043,7 @@ DEPENDENCIES
   telephone_number
   test-prof
   time_diff
-  twilio-ruby (~> 5.66)
+  twilio-ruby
   twitty (~> 0.1.5)
   tzinfo-data
   uglifier

VERSION_CWCTL

@@ -1 +1 @@
-3.4.2
+3.4.3

app/javascript/sdk/IFrameHelper.js

@@ -127,12 +127,27 @@ export const IFrameHelper = {
     window.onmessage = e => {
       if (
         typeof e.data !== 'string' ||
-        e.data.indexOf('chatwoot-widget:') !== 0 ||
-        e.origin !== window.location.origin
+        e.data.indexOf('chatwoot-widget:') !== 0
       ) {
         return;
       }
 
+      // Validate origin - allow messages from either:
+      // 1. The widget origin (widget -> parent communication)
+      // 2. The current page origin (same-origin messages)
+      const widgetOrigin = window.$chatwoot?.baseUrl
+        ? new URL(window.$chatwoot.baseUrl).origin
+        : null;
+      const parentOrigin = window.location.origin;
+
+      const isValidOrigin =
+        e.origin === parentOrigin ||
+        (widgetOrigin && e.origin === widgetOrigin);
+
+      if (!isValidOrigin) {
+        return;
+      }
+
       const message = JSON.parse(e.data.replace('chatwoot-widget:', ''));
       if (typeof IFrameHelper.events[message.event] === 'function') {
         IFrameHelper.events[message.event](message);

app/models/assignment_policy.rb

@@ -3,7 +3,7 @@
 # Table name: assignment_policies
 #
 #  id                       :bigint           not null, primary key
-#  assignment_order         :integer          default(0), not null
+#  assignment_order         :integer          default("round_robin"), not null
 #  conversation_priority    :integer          default("earliest_created"), not null
 #  description              :text
 #  enabled                  :boolean          default(TRUE), not null

app/models/concerns/liquidable.rb

@@ -3,6 +3,7 @@ module Liquidable
 
   included do
     before_create :process_liquid_in_content
+    before_create :process_liquid_in_template_params
   end
 
   private
@@ -35,4 +36,61 @@ module Liquidable
     # We don't want to process liquid in code blocks
     content.gsub(/`(.*?)`/m, '{% raw %}`\\1`{% endraw %}')
   end
+
+  def process_liquid_in_template_params
+    return unless template_params_present? && liquid_processable_template_params?
+
+    processed_params = process_liquid_in_hash(template_params_data['processed_params'])
+
+    # Update the additional_attributes with processed template_params
+    self.additional_attributes = additional_attributes.merge(
+      'template_params' => template_params_data.merge('processed_params' => processed_params)
+    )
+  rescue Liquid::Error
+    # If there is an error in the liquid syntax, we don't want to process it
+  end
+
+  def template_params_present?
+    additional_attributes&.dig('template_params', 'processed_params').present?
+  end
+
+  def liquid_processable_template_params?
+    message_type == 'outgoing' || message_type == 'template'
+  end
+
+  def template_params_data
+    additional_attributes['template_params']
+  end
+
+  def process_liquid_in_hash(hash)
+    return hash unless hash.is_a?(Hash)
+
+    hash.transform_values { |value| process_liquid_value(value) }
+  end
+
+  def process_liquid_value(value)
+    case value
+    when String
+      process_liquid_string(value)
+    when Hash
+      process_liquid_in_hash(value)
+    when Array
+      process_liquid_array(value)
+    else
+      value
+    end
+  end
+
+  def process_liquid_array(array)
+    array.map { |item| process_liquid_value(item) }
+  end
+
+  def process_liquid_string(string)
+    return string if string.blank?
+
+    template = Liquid::Template.parse(string)
+    template.render(message_drops)
+  rescue Liquid::Error
+    string
+  end
 end

app/models/notification.rb

@@ -19,6 +19,7 @@
 #
 # Indexes
 #
+#  idx_notifications_performance                   (user_id,account_id,snoozed_until,read_at)
 #  index_notifications_on_account_id               (account_id)
 #  index_notifications_on_last_activity_at         (last_activity_at)
 #  index_notifications_on_user_id                  (user_id)

config/app.yml

@@ -1,5 +1,5 @@
 shared: &shared
-  version: '4.5.0'
+  version: '4.5.2'
 
 development:
   <<: *shared

db/migrate/20250709102213_add_template_params_to_campaigns.rb

@@ -1,5 +1,5 @@
 class AddTemplateParamsToCampaigns < ActiveRecord::Migration[7.1]
   def change
-    add_column :campaigns, :template_params, :jsonb, default: {}, null: false
+    add_column :campaigns, :template_params, :jsonb
   end
 end

db/migrate/20250808123008_add_feature_citation_to_assistant_config.rb

@@ -1,5 +1,7 @@
 class AddFeatureCitationToAssistantConfig < ActiveRecord::Migration[7.1]
   def up
+    return unless ChatwootApp.enterprise?
+
     Captain::Assistant.find_each do |assistant|
       assistant.update!(
         config: assistant.config.merge('feature_citation' => true)
@@ -8,6 +10,8 @@ class AddFeatureCitationToAssistantConfig < ActiveRecord::Migration[7.1]
   end
 
   def down
+    return unless ChatwootApp.enterprise?
+
     Captain::Assistant.find_each do |assistant|
       config = assistant.config.dup
       config.delete('feature_citation')

deployment/setup_20.04.sh

@@ -2,7 +2,7 @@
 
 # Description: Install and manage a Chatwoot installation.
 # OS: Ubuntu 20.04 LTS, 22.04 LTS, 24.04 LTS
-# Script Version: 3.4.2
+# Script Version: 3.4.3
 # Run this script as root
 
 set -eu -o errexit -o pipefail -o noclobber -o nounset
@@ -19,7 +19,7 @@ fi
 # option --output/-o requires 1 argument
 LONGOPTS=console,debug,help,install,Install:,logs:,restart,ssl,upgrade,Upgrade:,webserver,version,web-only,worker-only,convert:
 OPTIONS=cdhiI:l:rsuU:wvWK
-CWCTL_VERSION="3.3.0"
+CWCTL_VERSION="3.4.3"
 pg_pass=$(head /dev/urandom | tr -dc A-Za-z0-9 | head -c 15 ; echo '')
 CHATWOOT_HUB_URL="https://hub.2.chatwoot.com/events"
 
@@ -430,7 +430,7 @@ function configure_systemd_services() {
 
   if [ "$DEPLOYMENT_TYPE" == "web" ]; then
     echo "Setting up web-only deployment"
-    
+
     # Stop and disable existing services if converting
     if [ "$existing_full_deployment" = true ]; then
       echo "Converting from full deployment to web-only"
@@ -449,14 +449,14 @@ function configure_systemd_services() {
 
     cp /home/chatwoot/chatwoot/deployment/chatwoot-web.1.service /etc/systemd/system/chatwoot-web.1.service
     cp /home/chatwoot/chatwoot/deployment/chatwoot-web.target /etc/systemd/system/chatwoot-web.target
-    
+
     systemctl daemon-reload
     systemctl enable chatwoot-web.target
     systemctl start chatwoot-web.target
-    
+
   elif [ "$DEPLOYMENT_TYPE" == "worker" ]; then
     echo "Setting up worker-only deployment"
-    
+
     # Stop and disable existing services if converting
     if [ "$existing_full_deployment" = true ]; then
       echo "Converting from full deployment to worker-only"
@@ -475,14 +475,14 @@ function configure_systemd_services() {
 
     cp /home/chatwoot/chatwoot/deployment/chatwoot-worker.1.service /etc/systemd/system/chatwoot-worker.1.service
     cp /home/chatwoot/chatwoot/deployment/chatwoot-worker.target /etc/systemd/system/chatwoot-worker.target
-    
+
     systemctl daemon-reload
     systemctl enable chatwoot-worker.target
     systemctl start chatwoot-worker.target
-    
+
   else
     echo "Setting up full deployment (web + worker)"
-    
+
     # Stop existing specialized deployments if converting back to full
     if [ -f "/etc/systemd/system/chatwoot-web.target" ]; then
       echo "Converting from web-only to full deployment"
@@ -494,7 +494,7 @@ function configure_systemd_services() {
       systemctl stop chatwoot-worker.target || true
       systemctl disable chatwoot-worker.target || true
     fi
-    
+
     cp /home/chatwoot/chatwoot/deployment/chatwoot-web.1.service /etc/systemd/system/chatwoot-web.1.service
     cp /home/chatwoot/chatwoot/deployment/chatwoot-worker.1.service /etc/systemd/system/chatwoot-worker.1.service
     cp /home/chatwoot/chatwoot/deployment/chatwoot.target /etc/systemd/system/chatwoot.target
@@ -538,7 +538,7 @@ function setup_ssl() {
   cd chatwoot
   sed -i "s/http:\/\/0.0.0.0:3000/https:\/\/$domain_name/g" .env
 EOF
-  
+
   # Restart the appropriate chatwoot target
   if [ -f "/etc/systemd/system/chatwoot-web.target" ]; then
     systemctl restart chatwoot-web.target
@@ -1005,7 +1005,7 @@ EOF
   upgrade_redis
   upgrade_node
   get_pnpm
-  
+
   sudo -i -u chatwoot << EOF
 
   # Navigate to the Chatwoot directory
@@ -1098,16 +1098,16 @@ function restart() {
 ##############################################################################
 function convert_deployment() {
   echo "Converting Chatwoot deployment to: $DEPLOYMENT_TYPE"
-  
+
   # Check if Chatwoot is installed
   if [ ! -d "/home/chatwoot/chatwoot" ]; then
     echo "Chatwoot installation not found. Use --install first."
     exit 1
   fi
-  
+
   # Run the systemd service configuration which handles conversion logic
   configure_systemd_services
-  
+
   echo "Deployment converted successfully to: $DEPLOYMENT_TYPE"
 }
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chatwoot/chatwoot",
-  "version": "4.5.0",
+  "version": "4.5.2",
   "license": "MIT",
   "scripts": {
     "eslint": "eslint app/**/*.{js,vue}",

spec/models/concerns/liquidable_shared.rb

@@ -69,4 +69,159 @@ shared_examples_for 'liqudable' do
       end
     end
   end
+
+  context 'when liquid is present in template_params' do
+    let(:contact) do
+      create(:contact, name: 'john', email: 'john@example.com', phone_number: '+912883', custom_attributes: { customer_type: 'platinum' })
+    end
+    let(:conversation) { create(:conversation, id: 1, contact: contact, custom_attributes: { priority: 'high' }) }
+
+    context 'when message is outgoing with template_params' do
+      let(:message) { build(:message, conversation: conversation, message_type: 'outgoing') }
+
+      it 'replaces liquid variables in template_params body' do
+        message.additional_attributes = {
+          'template_params' => {
+            'name' => 'greet',
+            'category' => 'MARKETING',
+            'language' => 'en',
+            'processed_params' => {
+              'body' => {
+                'customer_name' => '{{contact.name}}',
+                'customer_email' => '{{contact.email}}'
+              }
+            }
+          }
+        }
+        message.save!
+
+        body_params = message.additional_attributes['template_params']['processed_params']['body']
+        expect(body_params['customer_name']).to eq 'John'
+        expect(body_params['customer_email']).to eq 'john@example.com'
+      end
+
+      it 'replaces liquid variables in nested template_params' do
+        message.additional_attributes = {
+          'template_params' => {
+            'name' => 'test_template',
+            'processed_params' => {
+              'header' => {
+                'media_url' => 'https://example.com/{{contact.name}}.jpg'
+              },
+              'body' => {
+                'customer_name' => '{{contact.name}}',
+                'priority' => '{{conversation.custom_attribute.priority}}'
+              },
+              'footer' => {
+                'company' => '{{account.name}}'
+              }
+            }
+          }
+        }
+        message.save!
+
+        processed = message.additional_attributes['template_params']['processed_params']
+        expect(processed['header']['media_url']).to eq 'https://example.com/John.jpg'
+        expect(processed['body']['customer_name']).to eq 'John'
+        expect(processed['body']['priority']).to eq 'high'
+        expect(processed['footer']['company']).to eq conversation.account.name
+      end
+
+      it 'handles arrays in template_params' do
+        message.additional_attributes = {
+          'template_params' => {
+            'name' => 'test_template',
+            'processed_params' => {
+              'buttons' => [
+                { 'type' => 'url', 'parameter' => 'https://example.com/{{contact.name}}' },
+                { 'type' => 'text', 'parameter' => 'Hello {{contact.name}}' }
+              ]
+            }
+          }
+        }
+        message.save!
+
+        buttons = message.additional_attributes['template_params']['processed_params']['buttons']
+        expect(buttons[0]['parameter']).to eq 'https://example.com/John'
+        expect(buttons[1]['parameter']).to eq 'Hello John'
+      end
+
+      it 'handles custom attributes in template_params' do
+        message.additional_attributes = {
+          'template_params' => {
+            'name' => 'test_template',
+            'processed_params' => {
+              'body' => {
+                'customer_type' => '{{contact.custom_attribute.customer_type}}',
+                'priority' => '{{conversation.custom_attribute.priority}}'
+              }
+            }
+          }
+        }
+        message.save!
+
+        body_params = message.additional_attributes['template_params']['processed_params']['body']
+        expect(body_params['customer_type']).to eq 'platinum'
+        expect(body_params['priority']).to eq 'high'
+      end
+
+      it 'handles missing email with default filter in template_params' do
+        contact.update!(email: nil)
+        message.additional_attributes = {
+          'template_params' => {
+            'name' => 'test_template',
+            'processed_params' => {
+              'body' => {
+                'customer_email' => '{{ contact.email | default: "no-email@example.com" }}'
+              }
+            }
+          }
+        }
+        message.save!
+
+        body_params = message.additional_attributes['template_params']['processed_params']['body']
+        expect(body_params['customer_email']).to eq 'no-email@example.com'
+      end
+
+      it 'handles broken liquid syntax in template_params gracefully' do
+        message.additional_attributes = {
+          'template_params' => {
+            'name' => 'test_template',
+            'processed_params' => {
+              'body' => {
+                'broken_liquid' => '{{contact.name}  {{invalid}}'
+              }
+            }
+          }
+        }
+        message.save!
+
+        body_params = message.additional_attributes['template_params']['processed_params']['body']
+        expect(body_params['broken_liquid']).to eq '{{contact.name}  {{invalid}}'
+      end
+
+      it 'does not process template_params when message is incoming' do
+        incoming_message = build(:message, conversation: conversation, message_type: 'incoming')
+        incoming_message.additional_attributes = {
+          'template_params' => {
+            'name' => 'test_template',
+            'processed_params' => {
+              'body' => {
+                'customer_name' => '{{contact.name}}'
+              }
+            }
+          }
+        }
+        incoming_message.save!
+
+        body_params = incoming_message.additional_attributes['template_params']['processed_params']['body']
+        expect(body_params['customer_name']).to eq '{{contact.name}}'
+      end
+
+      it 'does not process template_params when not present' do
+        message.additional_attributes = { 'other_data' => 'test' }
+        expect { message.save! }.not_to raise_error
+      end
+    end
+  end
 end