rodrigo/iachat
1
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity
44dc9ba18e
iachat/app/models
History
Pranav de4430ea5d
feat: Introduce allowed_domains for web widget (#12450) 
We wanted to provide an option for users to specify the domains on which
they can show the website. The rest of the sites shouldn't see the
widget at all.

It's not possible generally through Origin because you can't get Origin
when loading via an iframe. What I've done is add frame ancestors for
the domains specified in allowed domains. I hope this solves most of the
problems.

This is added in a way that it won't affect existing widgets. Only If
they have configured allowed domains, it will start blocking. Otherwise,
it would follow the previous behavior without any changes.

This change supports called wild card domains as well. You can add a
comma‑separated list of domains, either wild card or regular domains.


---

To test, deploy to staging. Call the following API to update the
allowed_domains list.

```
URL: PATCH /api/v1/accounts/<account-id>/inboxes/<inbox-id>

Payload:
{
   "channel": { "allowed_domains": "*.chatwoot.dev,chatwoot.com" }
}

```



Fixes https://github.com/chatwoot/chatwoot/issues/1985
2025-09-17 10:01:27 +05:30
..
channel feat: Introduce allowed_domains for web widget (#12450) 2025-09-17 10:01:27 +05:30
concerns chore: Account switching issue in newly added accounts (#12403) 2025-09-10 14:12:22 +05:30
integrations feat: Add user attribution to Linear integration with actor authorization (#11774) 2025-07-01 16:49:26 +05:30
access_token.rb Feature: Access tokens for API access (#604) 2020-03-11 00:02:15 +05:30
account_user.rb feat: Add migration files for assignment v2 (#12147) 2025-08-11 21:44:38 -07:00
account.rb chore: remove unused telegram bot model (#12417) 2025-09-11 22:25:26 +05:30
agent_bot_inbox.rb Feature: Access tokens for API access (#604) 2020-03-11 00:02:15 +05:30
agent_bot.rb feat: Implement UI for Agent Bots in settings and remove CSML support (#11276) 2025-04-16 18:02:49 +05:30
application_record.rb chore: fix sla email notifications (#9192) 2024-04-04 21:16:49 +05:30
article.rb feat: improve article search ranking (#11640) 2025-06-03 12:01:17 +05:30
assignment_policy.rb chore(annotations): sync model annotations with current schema (#12245) 2025-08-20 20:23:42 +02:00
attachment.rb fix: cw-5411 handle unrepresentable image attachments (#12178) 2025-08-12 19:26:58 -07:00
automation_rule.rb feat: Add private note action to automations (#11926) 2025-07-16 09:57:35 +05:30
campaign.rb feat: WhatsApp campaigns (#11910) 2025-07-16 09:04:02 +05:30
canned_response.rb chore: Apply fixes for items in rubocop_todo [CW-1806] (#8864) 2024-02-07 13:36:04 +04:00
category.rb chore: Increase Category index per-page limit to 1000 (#12282) 2025-08-22 12:41:38 -07:00
contact_inbox.rb feat: Add job to remove stale contact inboxes (#8096) 2023-11-06 20:24:30 -08:00
contact.rb feat: Introduce the crm_v2 feature flag for CRM changes (#12014) 2025-07-23 17:07:02 +04:00
conversation_participant.rb chore: Add controllers for conversation participants (#6462) 2023-02-15 16:33:31 -08:00
conversation.rb fix: Reply time calculation for re-opened conversations (#11787) 2025-06-27 10:48:07 +05:30
csat_survey_response.rb chore: Apply fixes for items in rubocop_todo [CW-1806] (#8864) 2024-02-07 13:36:04 +04:00
custom_attribute_definition.rb chore: Ability to filter conversations with priority (#10967) 2025-03-03 16:38:22 +05:30
custom_filter.rb fix: Revert the changes for SyncCustomFilterCountJob (#8238) 2023-10-27 10:45:48 -07:00
dashboard_app.rb fix: validate url for Dashboard Apps [CW-2979] (#8736) 2024-01-18 17:48:30 +05:30
data_import.rb chore: Add delay before running dataimport job (#8039) 2023-10-03 22:18:57 -07:00
email_template.rb chore: upgrade ruby version to 3.4.4 (#11524) 2025-05-21 19:40:07 +05:30
folder.rb feat: Portal endpoint (#4633) 2022-05-16 13:59:59 +05:30
inbox_assignment_policy.rb feat: Add assignment policies controllers with jbuilder views (#12199) 2025-08-18 19:15:21 -07:00
inbox_member.rb feat: auditlog for team and inbox member updates (#7516) 2023-08-15 19:55:19 -07:00
inbox.rb feat: Add QR codes for WhatsApp, Messenger, and Telegram on inbox finish page (#12257) 2025-08-27 11:53:03 +05:30
installation_config.rb chore: upgrade ruby version to 3.4.4 (#11524) 2025-05-21 19:40:07 +05:30
integrations.rb Feature: Slack integration (#783) 2020-06-12 23:12:47 +05:30
jsonb_attributes_length_validator.rb Fix: added validation for custom and additional attribute (#4260) 2022-03-24 15:38:28 +05:30
kbase.rb Feature: Knowledge Base APIs (#1002) 2020-09-26 02:32:34 +05:30
label.rb feat: multiple UX improvements to labels (#7358) 2023-06-25 18:49:49 +05:30
macro.rb feat: Add webhook event support for macros (#11235) 2025-04-02 20:26:55 -07:00
mention.rb fix: Notification page breakages (#5236) 2022-08-10 13:46:46 +02:00
message.rb feat(voice): Incoming voice calls [EE] (#12361) 2025-09-08 22:35:23 +05:30
note.rb feat(ee): Add Captain features (#10665) 2025-01-14 16:15:47 -08:00
notification_setting.rb fix: Specify external db with non-standard port (#2711) 2021-07-28 19:36:51 +05:30
notification_subscription.rb fix: Change the column identifier from string to text to avoid overflow (#9073) 2024-03-07 11:13:01 +05:30
notification.rb chore(annotations): sync model annotations with current schema (#12245) 2025-08-20 20:23:42 +02:00
platform_app_permissible.rb fix: SuperAdmin Improvements (#3733) 2022-01-11 19:00:00 -08:00
platform_app.rb Chore: Replaced dependent destroy with dependent destroy_async in all models (#3249) 2021-11-18 10:32:29 +05:30
portal.rb chore: Automate SSL with Cloudflare (#12021) 2025-07-24 13:09:06 +04:00
related_category.rb feat: CRUD operation for associated articles to current article (#4912) 2022-07-04 20:29:44 +05:30
reporting_event.rb feat: add index to reporting events [CW-1960] (#7294) 2023-06-12 18:23:42 +05:30
super_admin.rb chore: Remove message_signature_enabled from users (#3982) 2022-02-15 12:10:53 +05:30
team_member.rb feat: auditlog for team and inbox member updates (#7516) 2023-08-15 19:55:19 -07:00
team.rb feat: invalidate cache after inbox members or team members update (#10869) 2025-02-20 21:28:38 -08:00
user.rb feat: SAML authentication controllers [CW-2958] (#12319) 2025-09-10 20:02:27 +05:30
webhook.rb feat: Add support for typing events in webhooks (#11423) 2025-05-08 17:28:35 -07:00
working_hour.rb chore: Replace deprecated functions (#5611) 2022-10-12 14:55:59 -07:00