Skip to content
This repository was archived by the owner on Jun 19, 2026. It is now read-only.

v1.1.0 — Delete Message + RTL + Security Fixes

Choose a tag to compare

View all tags
@erancybersec erancybersec released this 10 Apr 11:05
· 33 commits to master since this release
v1.1.0
f411096

What's New in v1.1.0

New Features

Delete Message

WhatsApp-style delete confirmation modal — right-click any message or use the multi-select toolbar.

  • Delete for everyone — unsends the message for all participants (only available for your own sent messages, within ~60 hours). Calls DELETE /message/delete/.
  • Delete for me — removes the message from your local view only. Calls DELETE /message/deleteMessage/ (best-effort; always removes locally).
  • Modal auto-dismisses when switching or closing conversations.
  • Escape key closes the modal.
  • Error toast shown if any message in a batch could not be deleted.

RTL / LTR Auto-Direction

Hebrew, Arabic, and other RTL text now renders correctly in every part of the UI. English stays left-to-right. No configuration needed — dir="auto" is applied per element, so mixed conversations work naturally.

Bug Fixes

Security

  • XSS: avatar onerror no longer uses innerHTML with unescaped text
  • XSS: quotedMsg.id sanitised before embedding in onclick attribute
  • XSS: image lightbox uses data-src instead of raw URL in inline handler
  • XSS: group name, subject, and description now escaped with chatEsc()

Crashes

  • chatState.allFetchedMessages was uninitialised — fixed with [] default
  • Location messages crashed on null m.text
  • Location coordinates were not URL-encoded before being put into a Maps URL
  • FileReader base64 split did not guard against a missing comma

API

  • chatApiCall was silently dropping the request body on DELETE calls — Evolution API delete endpoints require a JSON body

Lifecycle

  • Delete modal not dismissed on conversation switch → wrong JID could be used
  • Delete modal not dismissed when closing a conversation
  • chatCloseConversation did not reset select mode state
  • Both confirm functions now guard against activeJid being null

UI / State

  • Select toolbar delete button used a fragile attribute CSS selector; replaced with a stable id
  • Delete button started enabled before first chatUpdateSelectCount call
  • chatCopySelected / chatForwardSelected / chatDeleteSelected use Set.has() instead of Array.includes()

Full Changelog

See CHANGELOG.md for the complete history.

Assets 2
Loading