Enhance security and features in version 4.82v 🚀🔒

- Strengthened file handling with enhanced MIME type validation across download endpoints.
- Improved user experience with new widget expand mode and chat tab visibility toggles.
- Added message count filters and search by message ID range in chat statistics.
- Introduced support for custom back-office variables and improved theme translations.
- Updated database version to 349 and added necessary SQL for indexing.
- Resolved multiple security issues (L01, L02, L04, L05, L06, L11, L13) for better protection. 🛡️

Author: remdex

lhc_web/doc/CHANGELOG.txt

@@ -1,3 +1,35 @@
+4.82v
+
+1. Notable changes since 4.81v
+   - Security/file handling: enhanced MIME type validation across file download endpoints (`downloadfile.php`, `inlinedownload.php`, REST API `file.php`); MIME type constants added in mail conversation parser; all operator/visitor uploads validated against `var` folder path; resolved security issues L01, L02, L04, L05, L06, L11, L13.
+   - Widget: added expand mode with configurable width/height ratios and new `shrink_text`/`expand_text` UI fields; widget communication updated to include user session prefill variables in sent messages; fixed `reloadWidget` function; updated wrapper version.
+   - Chat search/statistics: added message count filters (operators, visitors, bots) to search panel and statistics tabs; added total messages count input field; added search by message ID range.
+   - Chat tab visibility: operators can toggle chat tab visibility (show/hide chat tabs) via quick actions in user settings.
+   - User settings: added auto-accept chats option and alert preference for transferred chats.
+   - Variables/prefill: support for passing custom back-office vars as `lhc_var` variables; encrypted prefilled variables always applied; variable only set when replaceable variable is non-empty; proactive invitations now update vars when custom vars are passed.
+   - Theme/translations: widget theme `translate` method accepts user context; REST API modules (`checkchatstatus`, `getinvitation`, `initchat`, `onlinesettings`, `settings`) use user context for theme translations; multilanguage support for custom fields; `fetchByVid` includes caching option.
+   - Canned messages: refactored retrieval with `getCannedMessages` method; added `auto_send` filter and `ignore_subjects` parameter.
+   - Extensions: support for extensions to contribute custom side-menu items.
+   - Configuration: folder/directory write-permission checks added to the configuration page with per-directory success/error indicators.
+   - Bot: support for background workers in REST API bot action; improved bot detection filtering.
+   - Message history: previous-message loading always uses all messages when the page limit is not reached; safe inclusion of all chat messages.
+
+2. Summary
+   - This release strengthens file handling security with MIME type validation, file path checks, and resolves multiple L-series security issues.
+   - Operator UX improvements include widget expand mode, chat tab visibility toggles, and richer user settings (auto-accept, transfer alerts).
+   - Search and statistics gain new message count filters; extensions gain custom side-menu support; theme translations now respect user context.
+
+3. Contributors
+
+- L01: SSRF via incoming webhook image download (CWE-918)
+- L06: Mass assignment in REST API file PUT leading to arbitrary file read (CWE-915, CWE-22)
+- L11: Stored XSS via Content-Type spoofing in file upload (CWE-79, CWE-345)
+- L13: Unsafe deserialization in configuration loader (CWE-502)
+
+Vulnerability Researcher: Pedro J. Núñez-Cacho Fuentes (https://blogs.tunelko.com)
+
+execute doc/update_db/update_349.sql for update
+
 4.81v
 
 1. Notable changes since 4.80v

lhc_web/doc/update_db/update_349.sql

@@ -0,0 +1 @@
+ALTER TABLE `lh_abstract_proactive_chat_campaign_conv` ADD INDEX `inv_vid` (`invitation_id`,`invitation_status`,`vid_id`);

lhc_web/lib/core/lhcore/lhupdate.php

@@ -2,8 +2,8 @@
 
 class erLhcoreClassUpdate
 {
-    const DB_VERSION = 348;
-    const LHC_RELEASE = 481;
+    const DB_VERSION = 349;
+    const LHC_RELEASE = 482;
 
 	public static function doTablesUpdate($definition){
 		$updateInformation = self::getTablesStatus($definition);

lhc_web/modules/lhinstall/install.php

@@ -1590,7 +1590,7 @@
                 ('preload_iframes','0','0','Preload widget. It will avoid loading delay after clicking widget','0'),
                 ('product_show_departament','0','0','Enable products show by departments', '1'),
                 ('paidchat_data','','0','Paid chat configuration','1'),
-                ('version_updates',	'348',	0,	'',	1),
+                ('version_updates',	'349',	0,	'',	1),
                 ('del_on_close_no_msg','0','0','Delete chat on close if there are no messages from the visitor','0'),
                 ('mheight_op','200','0','Messages box height for operator','0'),
                 ('listd_op','10','0','Default number of online operators to show','0'),