Vishnu NarayananandGitHub 1e7218d439 fix: compare HMAC identity hashes securely (#14945) ...

This switches widget and public inbox HMAC identity checks from direct
string equality to constant-time comparison with a length guard.

Fixes
[https://linear.app/chatwoot/issue/CW-6937](https://linear.app/chatwoot/issue/CW-6937)
Fixes
[https://linear.app/chatwoot/issue/CW-7464](https://linear.app/chatwoot/issue/CW-7464)
Fixes
[https://linear.app/chatwoot/issue/CW-7227](https://linear.app/chatwoot/issue/CW-7227)

2026-07-07 17:37:22 +05:30

..

integrations

feat: migrate dyte integration to cloudflare realtimekit (#14752)

2026-06-24 11:04:08 +04:00

base_controller.rb

feat: show ReplyTo in widget UI (#8094)

2023-10-27 13:35:02 +05:30

campaigns_controller.rb

fix: Show campaigns only if the feature is enabled (#11420)

2025-05-05 19:41:28 -07:00

configs_controller.rb

feat: allow configuring attachment upload limit (#12835)

2025-11-17 14:03:08 -08:00

contacts_controller.rb

fix: compare HMAC identity hashes securely (#14945)

2026-07-07 17:37:22 +05:30

conversations_controller.rb

fix: disable email transcript for free plans (#13509)

2026-02-11 21:21:36 +05:30

direct_uploads_controller.rb

Feat: authenticate direct upload (#4160)

2022-03-16 13:54:18 +05:30

events_controller.rb

feat: Builder for creating Campaign conversations (#2192)

2021-05-03 20:23:09 +05:30

inbox_members_controller.rb

fix: Improve performance of most hit APIs in widget (#11089)

2025-03-14 17:37:36 -07:00

labels_controller.rb

chore: Prevent i18n config bleeding across requests (#1214)

2020-10-05 17:55:46 +05:30

messages_controller.rb

fix: incorrect scope across controllers (#14459)

2026-05-14 20:34:18 +05:30