MDS Live Chat and Helpdesk

Changelog

1.3.0

• Security: fixed a flaw where verify_customer_access() could not distinguish “no such chat” from “chat exists but its access token is empty/NULL” – both cases were treated as authorized. The check now fails closed: a chat with no token denies access rather than granting it. Affects the poll, send, mark-seen, and subscribe endpoints.
• Security: resume-by-ticket (used to reconnect to a chat via Ticket ID + email/phone, e.g. after clearing browser data) now has rate limiting, both per requesting IP and per ticket ID, after repeated failed attempts. This was previously guessable/brute-forceable since ticket IDs are sequential and the contact field alone isn’t a strong secret.
• Removed a “legacy chat” bypass in poll_messages/verify_customer_access that is no longer applicable (the plugin has no prior public release to remain compatible with) and was itself the source of the two issues above.
• Hardening: the admin menu now only registers at all for users who are agents/admins, instead of registering visibly for every logged-in WordPress user (e.g. customer accounts) and relying solely on a page-level check to turn them away. No change for actual agents/admins.
• Removed a leftover unused settings-save handler (admin-post.php action) from before the Settings page was moved to the REST API; the REST endpoint has handled saving for some time; this was dead code, not a live code path.
• Fix: removed an incorrect “Requires Plugins: woocommerce” declaration in the plugin header. WooCommerce is optional (order lookup is skipped gracefully when it isn’t installed, as already documented), but that header hard-blocks activation entirely on sites without WooCommerce – it contradicted the plugin’s actual, intended behavior.

1.2.1

• Fix: the “Start Chat” (and “Resume Ticket”) button had no protection against multiple clicks, so a double-click or a slow connection could fire the request more than once, creating several duplicate tickets from the same visitor. The button is now disabled with a loading label while the request is in progress, and a matching safety check was added on the server so an accidental rapid resubmission reuses the ticket that’s already being created instead of making a new one.

1.2.0

• New: Agents can now send photos and documents to customers from the admin chat panel (an attach button next to Send). Customers can view images inline and download any file – WhatsApp-style. This is admin-to-customer only; the customer-facing widget does not gain a file-upload option, by design.

1.1.0

• Security: customer-facing chat endpoints (poll, send, mark-seen, subscribe) now require proof of ownership of the specific chat before returning or accepting data, closing a gap that previously allowed any visitor to access another visitor’s conversation by guessing a chat ID.
• Renamed the plugin to MDS Live Chat and Helpdesk (slug: mds-live-chat-helpdesk) for WordPress.org compliance.
• Moved all inline JavaScript and inline event handlers out of PHP templates into properly enqueued external script files.
• Added translation support (text domain: mds-live-chat-helpdesk) across admin screens.
• General code cleanup for WordPress Coding Standards compliance.
• Pasted links in chat messages are now automatically rendered as clickable links, both in the customer widget and the admin dashboard.

1.0.0

• Initial release.