SwissUpLabs Logo
Home > Magento 2.x > Extensions > Helpdesk > Helpdesk Changelog

Changelog

Version 1.4.11

October 16, 2026

  • Security: Medium — message text is run through the CMS template filter only when it was written by an administrator in the backend. Authorship is now recorded on the message (is_backend_authored) instead of being inferred from the data.
  • Note on is_backend_authored: there is no backfill. Messages that already exist keep the column empty and are treated as customer-authored; the flag is set only on messages created from this version on. This is deliberate — the authorship of old messages cannot be reconstructed without guessing.
  • Security: Medium — the attachment upload endpoint now requires POST, a valid form key and passes the rate limit. Files are uploaded one at a time and the upload stops at the first refusal.
  • Security: Medium — attachment links are signed with a real secret and are refused outright when no crypt key is configured. The visitor is checked against the ticket before an attachment is served, documents are no longer previewed inline, and PDF preview is kept out of the CSP sandbox. A new Attachment Link Lifetime (days) option (helpdesk/security/attachment_link_lifetime, default 0 — no expiry) makes signed links expire; links that were signed under a longer lifetime age out when the value is lowered.
  • Security: Medium — a staff reply picked up from e-mail no longer loses its author in _afterSave(). Such replies are now internal by default; the new Send staff e-mail replies to the customer option (helpdesk/mail/staff_reply_to_customer, default No) delivers them to the customer as before.
  • Added: every ticket carries an unguessable access token. Customer notification links carry the token, a guest who opens such a link is no longer asked for the e-mail address, and the token is dropped from the URL once it has been presented. The token is withdrawn when the ticket is moved to another e-mail address and is never written to the ticket archive file. Existing tickets receive a token from a data patch.
  • Security: Low — rate limiting is keyed on the visitor rather than the remote address, the session id is hashed before it is used as a rate-limit identifier, and an address block takes effect again after re-keying. Attachments that receive no content inspection are logged, the ticket grid controller requires its ACL resource, and an upload no longer fails because a log line could not be written.
  • Improved: inbound e-mail — the Message-Id is stored and the duplicate check matches on it, so a message picked up twice no longer creates a second ticket. A failing message or mailbox no longer aborts the pickup for the remaining ones.
  • Fix: the attachment download header states the filename as RFC 6266, the preview MIME type is compared strictly, and the uploader’s error text is set rather than interpolated into HTML.
  • Fix: a malformed upload payload is answered with the JSON error on both the storefront and the admin endpoint instead of an HTML 500.
  • Fix: the auto-close cron no longer notifies staff as if the customer had updated the ticket.
  • Documentation: inbound e-mail security depends on SPF, DKIM and DMARC being enforced at the MTA — the e-mail setup documentation now states this.
  • PHP 8.4 compatibility: an implicitly nullable test parameter is typed explicitly.

Version 1.4.10

October 14, 2026

  • Security: High — ticket replies are now accepted only from the customer or guest the ticket belongs to.
  • Security: High — an inbound e-mail is added to an existing ticket only when its sender belongs to that ticket; the sender address is taken from the parsed message header rather than the raw text, and a staff reply is recognised only for the department that owns the ticket.
  • Improved: inbound email — a message with a missing or unreadable sender no longer stops the mailbox pickup for the remaining departments.

Version 1.4.9

October 8, 2026

  • Security: High — improved protection against unintended file exposure through ticket and message attachments.
  • Security: High — strengthened validation of attachments submitted with tickets and messages.
  • Improved: inbound email — the mailbox pickup is now skipped with a log message when the required mail library is not installed (Magento 2.4.8 no longer ships it). laminas/laminas-mail is now a suggested package.

Version 1.4.8

May 18, 2026

  • Fix: show error message when attachment file is missing instead of throwing an exception (close #63).

Version 1.4.7

May 15, 2026

  • PHP 8.5 compatibility.
  • Minimum PHP version requirement updated to 8.1

Version 1.4.5

Apr 2, 2026

Fixes:

  • Fixed deprecated functionality for PHP 8.4 compatibility.
  • Fixed file upload security: validate MIME type and content before saving attachments — rejects polyglot files, fake PDFs, and invalid images.
  • Fixed safe default extensions fallback — returns ['gif','jpeg','jpg','png','txt','pdf'] when allowed_extension config is empty.

Version 1.4.4

Apr 2, 2026

Fixes:

  • Fixed false positive “Mass Assignment attack” security log entries on every legitimate admin ticket save — split forbidden fields into context-aware lists: frontend vs admin.
  • Fixed TicketDataFilter to use empty FORBIDDEN_ADMIN_FIELDS (whitelist is the actual defense in admin context).
  • Fixed missing keys in ADMIN_ADDITIONAL_FIELDS that caused admin replies to never create TicketMessage records.

Version 1.4.3

Mar 2, 2026

Fixes:

  • Fixed: Admin replies to tickets never created a TicketMessage record and never sent email notifications to customers — swissup_helpdesk_ticket_message, http, website, and ftp keys were silently stripped by filterAdminData() before reaching ResourceModel.
  • Fixed: Saving an existing ticket from the admin panel failed with a “field is required” validation error — required-field check now runs only when creating a new ticket, not on every edit.
  • Fixed: Enricher no longer overwrites store_id, status, and priority when editing an existing ticket.
  • Fixed: Removed rate-limit remaining count from the ticket creation success message.

Version 1.4.2

Mar 2, 2026

Fixes:

  • Fixed: False positive “Mass Assignment attack” log entries on every legitimate admin message save — message_id and email_message_id are expected hidden form fields and must not be treated as forbidden (the whitelist filter already blocks them).

Version 1.4.1

Mar 2, 2026

Fixes:

  • Fixed: Admin replies via AJAX form did not send email notifications to customers — user_id from the backend auth session is now set before saving the message so the CustomerNotification observer fires correctly.
  • Fixed: Apply MessageDataFilter whitelist to admin AJAX message save to prevent mass assignment of forbidden message fields; forbidden field attempts are logged via SecurityLogger.

Version 1.4.0

Feb 16, 2026

Security Enhancements:

  • Fixed: Prevent unauthorized modification of ticket fields (status, priority, department)
  • Added: Automatic protection against spam and bot attacks with rate limiting
    • IP-based limits: 5 tickets/15min (logged-in), 3 tickets/15min (guests), 10 messages/15min
    • Automatic IP blocking after 10 violations (1 hour block)
    • Privacy-friendly: IP addresses are hashed using SHA-256
  • Added: Whitelist-based input filtering for better security
  • Added: Security logging for blocked attempts (mass assignment and rate limits)

New Features:

  • Add admin security warnings for guest tickets without CAPTCHA protection
  • Show remaining rate limit attempts in success messages for transparency
  • Add rate limiting admin panel with enable/disable toggle
  • Add CAPTCHA status detection (reCAPTCHA + native Magento CAPTCHA)

Improvements:

  • Replace json_* functions with Magento SerializerInterface for better error handling
  • Replace direct $_SERVER access with Magento HTTP\Header API
  • Add Statistics API for rate limiting monitoring (getStats method)
  • Improve security context logging with ticket_id and admin_user tracking

Technical:

  • New services: TicketDataFilter, TicketDataValidator, TicketDataEnricher, MessageDataFilter, SecurityLogger, RateLimiter
  • Backend validation model for guest ticket configuration
  • Cache-based rate limiting with sliding window algorithm
  • Compatible with Redis/File/Memcached cache backends

Version 1.3.13

Sep 12, 2025

  • Fix: Resolve Symfony MIME header compatibility issues in email notifications.

Version 1.3.12

Sep 8, 2025

  • Fix: Compilation from source: LESS file is empty jquery.fileupload-ui.less.

Version 1.3.11

Jul 1, 2025

  • Fix: Guest ticket error (close #58).

Version 1.3.10

Jun 23, 2025

  • Fix: main. CRITICAL: TypeError: Swissup\Helpdesk\Model\TicketViewers::remove(): Argument 1 (ticketId) must be of type int, null given (close #56).
  • Removed textarea animation styles (close #57).

Version 1.3.9

Jun 16, 2025

  • Fix CRITICAL: Error: Call to a member function getNumber() on bool (close #55).
  • Fix: AbstractNotification::sendEmail(): Argument 1 must be of type array, string given.

Version 1.3. 8

Jun 12, 2025

  • Fix XssTemplate.FoundUnescaped (close #53).
  • Use correct template escaper.

Version 1.3.7

Jun 9, 2025

  • Add Symfony mail message supporting for Magento 2.4.8.

Version 1.3.6

Jun 6, 2025

  • Supress error reporting in file action (close #52).

Version 1.3.5

Jun 4, 2025

  • Fix: Fatal error: Declaration of Swissup\Helpdesk\Mail\Message methods compatibility with Magento\Framework\Mail\Message.
  • Fix: Class Laminas\Mail\Message not found.
  • Fix addBcc for 2.4.8.
  • Fix splitBody logic.

Version 1.3.4

May 30, 2025

  • Add correct page title for each ticket on frontend. Add page.main.title custom blocks (close #51).
  • Add ‘People currently checking this ticket’ like in M1 version (close #46).

Version 1.3.3

April 9, 2025

  • PHP 8.4 support added.
  • Magento 2.4.8 support added.

Version 1.3.1

Sep 20, 2024

  • Added integration with oauth2.

Version 1.3.0

Sep 4, 2024

  • Added integration with Swissup_GDPR module.
  • Removed empty spaces from textarea in ticket and message forms.

Version 1.2.43

Mar 28, 2024

  • Remove psr/log:^1 dependency. We support all psr/log versions now.

Version 1.2.42

Mar 1, 2024

  • Fix: Argument 1 (array) must be of type array, null given
  • Replace \Zend\ namespace to \Laminas\ cb10ab

Version 1.2.41

Jan 26, 2024

  • Add priority(and status) color to frontend (close #43)
  • Force customers to pick department (close #44)
  • Add and integrate sort order field for Departments (close #42)
  • Show admin name to clients (close #41)

Version 1.2.40

Dec 1, 2023

  • Fix phpstan error - ‘Undefined variable: $formId’
  • Integration with Google ReCaptcha

Version 1.2.39

Oct 16, 2023

  • Fix: File upload doesn’t work on Breeze

Version 1.2.38

Sep 12, 2023

  • Add mass actions (delete/change status/change priority) for the tickets grid
  • Add massSuspend action for the tickets grid

Version 1.2.37

Aug 21, 2023

  • Fix: Incorrect DATETIME format

Version 1.2.36

May 27, 2023

  • Refactor email expression in TicketMessage collection select query
  • Fix (sync) ui-select component code

Version 1.2.35

May 1, 2023

  • Fixed 404 error when viewing ticket for logged-in customer
  • Refactor Ticket View Controller to improve readability

Version 1.2.34

Apr 27, 2023

  • Fix too late FLAG_NO_DISPATCH setting
  • Fix: Deprecated Functionality: preg_match(): Passing null to parameter #2

Version 1.2.33

Mar 31, 2023

  • Replace \Zend_Mail (zf1) for 2.4.6 compatability
  • Replace \Zend_Validate (zf1) for 2.4.6 compatability
  • Fixed passing null to parameter 2 of preg_match
  • Replace \Zend_Date => \DateTime

Version 1.2.32

Mar 14, 2023

  • Stability improvements.

Version 1.2.30

Oct 19, 2022

Fixes

  • Fix email messages pickup logic(s)
  • Fix mime type detection in email message parser
  • Fix getTicket logic for new tickets
  • Update composer requirements

Version 1.2.29

Oct 4, 2022

Fixes

  • Fix fatal error in generate number logic

Version 1.2.28

Aug 22, 2022

Fixes

  • Fix ‘Deprecated Functionality: explode(): Passing null to parameter (close #37)
  • Fix UCT ‘critical’ errors
  • Prevent null to string converting errors

Version 1.2.27

Jul 18, 2022

Fixes

  • Improve code quality
  • Fix MCS warnings

Version 1.2.26

May 26, 2022

Fixes

  • Remove file extension part in url for some nginx conf

Version 1.2.25

May 17, 2022

Fixes

  • Fix: PHP 8.1 compatibility. count expect countable argument, boolean given.
  • Fixed php error in CloudCommerce on PHP 8.1 (Fixed missing nameInLayout)

Version 1.2.24

Mar 9, 2022

Fixes

  • Fix: ‘Duplicate entry ‘1’ for key ‘PRIMARY’, query was: INSERT INTO’

Version 1.2.23

Feb 10, 2022

Fixes

  • Fix: array_combine(): Both parameters should have an equal number of elements

Version 1.2.22

Feb 10, 2022

Fixes

  • Fix: Item with the same ID “” already exists.
  • Fix: Fix: array_merge(): Expected parameter 2 to be an array, null given

Version 1.2.21

Feb 8, 2022

Fixes

  • Fix: initial setup data patch does’t work with setup_version
  • Fix: in unArchivate action add prevention for error like ‘same ID already exists’
  • Fix: ‘NOTICE: TRYING TO ACCESS ARRAY OFFSET ON VALUE OF TYPE BOOL IN ABSTRACTNOTIFICATION.PHP ON LINE 94’

Version 1.2.20

Jan 25, 2022

Fixes

  • Fix: InstallData scripts are obsolete.
  • Fix: InstallSchema scripts are obsolete.
  • Fix: Avoid using self-closing tag with non-void html element
  • Add custom frontname(module_name) for helpdesk page(s) (close #36)

Version 1.2.17

Nov 3, 2021

Fixes

  • Remove old zend composer requirement (close #35)

Version 1.2.16

Aug 30, 2021

Fixes

  • Fixed broken customer edit page at backend

Version 1.2.15

Aug 19, 2021

Fixes

  • Fix potential php warnings/errors (phpstan)
  • Use separate group for merged css. This makes global bundle persistent across all site.

Version 1.2.14

Jan 20, 2021

Features

  • Added short messages about status, department, priority, etc. changes

Version 1.2.13

Nov 20, 2020

Fixes

  • Fix: disable strong email hostname validation (close #34)

Version 1.2.12

Nov 19, 2020

Fixes

  • Add dynamic_id:true in wysiwig for fix hiding broken ‘Show/Hide Editor’ (close #33)
  • Hide My Tickets tab in account if extension disabled
  • Fix :Column ‘created_at’ in where clause is ambiguous

Version 1.2.11

Nov 18, 2020

Fixes

  • Fix unarchive CONSTRAINT errors
  • Rename AutoClose button
  • Prevent to delete a department if this department is assigned to the ticket.
  • Fix ‘The department is displayed at the storefront if it disable.’

Version 1.2.10

Nov 13, 2020

Fixes

  • Added disabling behavior for submit button to prevent many cloned tickets (close #30)
  • Fix Deprecated Functionality: strpos() Non-string needles
  • Fix Warning rand with 1 argument
  • Add checking imap functions support
  • Disable some file uploading exceptions
  • Small grammar improvments.
  • Rename title column to subject (close #29)
  • Hide ecrypted text in subject column

Version 1.2.8

Nov 9, 2020

Fixes

  • Fixed Undefined index: text in Ui/Component/Listing/Column/Title.php:66 (#28).

Version 1.2.7

Nov 7, 2020

Fixes

  • Fix :Column ‘store_id’ in where clause is ambiguous (#27).

Version 1.2.6

Nov 2, 2020

Fixes

  • Fix :Column ‘email’ in where clause is ambiguous (#26 1)
  • In Ticket Form the Field ‘email’ is required now (#26 2).

Version 1.2.5

Oct 30, 2020

Fixes

  • Fix customer searching logic (#24)
  • Fix order searching action (#24)

Version 1.2.4

Oct 28, 2020

Fixes

  • Fix file allowed extension logic (close #23)
  • Implement IdentityInterface in abstract ticket block
  • Add cacheable=false for ticketMessage listing block
  • Set open status for ticket when customer add new answer (close #22)

Version 1.2.3

Oct 15, 2020

Fixes

  • Fix wysiwyg add_images: false bug
  • Add toggle_button:false (disable wysiwyg editor)
  • Disable pagebuilder integration (#20)
  • Fix saving empty message text but with adding files

Version 1.2.2

Oct 9, 2020

Fixes

  • Fix archive.csv file doesn’t exist (close #19)
  • Fix null given to string convertation error

Version 1.2.1

Sep 25, 2020

Fixes

  • Remove Mail/Message code dublicate; replace at Reflection (close #18)

Features

  • Smaller icon and match other icons color df97dd
  • Do not show notification count when empty be2df1

Version 1.2.0

Sep 14, 2020

Fixes

  • Fix message plain_text not update after ajaxSave
  • Fix double intallation bug
  • Fix message plain_text not update after ajaxSave
  • Fix ‘enable’ single-checkbox set value wrong behaviour
  • Fix save message button not work

Features

  • Change ticket edit interface layout (2column-right)
  • Add store encrypted data in db (#17)
  • Add ticket archivate/restore action and interfaces (#16)
  • Add etc/db_schema.xml

Version 1.1.10

Aug 5, 2020

  • Magento 2.4 compatibility (Error on contacts page)
  • Improve contact form styles
  • Translations updated

Version 1.1.8

Jul 22, 2020

Fixes

  • Removed add session param to url: 2.3.5 compatibility
  • Remove wrong data-mage-init in notifications

Features

  • Add custom grid severity styles
  • Add ticket preview (#15)
  • Add new ticket indicating

Version 1.1.7

Mar 2, 2020

Fixes

  • Fix Call to undefined method ‘addBcc’

Version 1.1.6

Feb 13, 2020

Fixes

  • Add i18n translates for statuses,priotity,department
  • Improve translate on frontend (#14)
  • Email backward compatability with 2.3(3-4)
  • Marketplace data added 90fe85

Version 1.1.5

Jan 16, 2020

Fixes

  • Add AuthorName in email templates (re close #9)

Version 1.1.4

Nov 15, 2019

Fixes

  • Meqp improvements (severity 8)
  • Fix typo
  • Fix filename conflict for apache %2f+ AllowEncodedSlashes On (close #10)
  • Fix typo in department::addStoreIdFilter

Version 1.1.3

Oct 25, 2019

Fixes

  • MEQP2 Fix: md5 => sha1
  • Possible fix for store silter
  • Revert gravatar url
  • Installation instructions for clients added

Version 1.1.2

Sep 12, 2019

Fixes

  • Add param deparment for select by default in form
  • Add store filter(s)

Version 1.1.1

Jul 8, 2019

Fixes

  • Fix ‘No captcha at default contacts form’ #11
  • Fix get relitive path logic for attachments #10

Version 1.1.0

Jun 7, 2019

Features

  • Add author_name column

Fixes

  • Fix ‘No contacts form when module disabled’

Version 1.0.5

Apr 25, 2019

Fixes

  • Fix Call to undefined method CurrentCustomer::getEmail() in ResourceModel/Ticket.php:206
  • Fix comma typos in email templates

Version 1.0.4

Apr 16, 2019

Fixes

  • Add Mail/Message::setFromAddress for 2.3.1 compataqbility

Version 1.0.3

Mar 18, 2019

Features

  • Added nl2br

Fixes

  • Fixed customer and order ui-select (s) js freezing

Version 1.0.2

Mar 11, 2019

Features

  • Added footer link
  • Added translations
  • Make priority labels translatable

Fixes

  • Fixed table prefix bug
  • Fixed in ‘Warning: array_merge()’ Model/Ticket/Source/Order.php:44
  • Fixed ‘Warning: Invalid argument supplied for foreach’ ResourceModel/Ticket.php:351

Version 1.0.0

  • Initial Release
Edit this Page