Changeset 3751971 for mxchat-basic/trunk/js/chat-script.js

Timestamp:

10/17/2026 01:47:11 PM (12 days ago)

Author:

mxchat

Message:

Release 3.2.26 - security hardening, new models (GPT-6.1 Sol, Claude 5.5 family, Grok 4.7, Gemini 4 Argon, DeepSeek Flash), automatic moves off discontinued models, token usage in Transcripts, page-builder and ACF Blocks imports

File:

• mxchat-basic/trunk/js/chat-script.js (modified) (13 diffs)

mxchat-basic/trunk/js/chat-script.js

@@ -1065 +1065 @@
             if (response.data && response.data.chat_mode) {
                 updateChatModeIndicator(response.data.chat_mode, botId);
+            }
+
+            // Server-side pre-chat gate (f2cce2): this session has not completed
+            // the form, so show it again instead of an error bubble.
+            if (response.status === 'lead_capture_required') {
+                getElement(botId, 'chat-box').find('.bot-message.temporary-message').remove();
+                enableChatInput(botId);
+                if (typeof showEmailFormForBot === 'function') { showEmailFormForBot(botId); }
+                return;
             }
 
@@ -1566 +1575 @@
     // NOTE: Don't remove temporary message here - let replaceLastMessage handle it
     // This prevents a visual gap between thinking dots disappearing and content appearing
+
+    // Server-side pre-chat gate (f2cce2): show the form again, no error bubble.
+    if (data.status === 'lead_capture_required') {
+        getElement(botId, 'chat-box').find('.bot-message.temporary-message').remove();
+        enableChatInput(botId);
+        if (typeof showEmailFormForBot === 'function') { showEmailFormForBot(botId); }
+        return;
+    }
 
     // SECURITY FIX: Check for errors FIRST
@@ -2678 +2695 @@
     });
     
+    // Fenced code blocks go back last (M7a)
+    processedText = literals.restoreBlocks(processedText);
+
     return processedText;
 }
@@ -2689 +2709 @@
     function protectLiterals(text) {
         const store = [];
-        const out = String(text).replace(/\\([\\`*_~])|(```[\s\S]*?```)|(`[^`\n]+`)/g, function(match, escaped) {
+        const out = String(text).replace(/\\([\\`*_~])|(```[\s\S]*?```)|(`[^`\n]+`)/g, function(match, escaped, fenced) {
             store.push(escaped !== undefined ? escaped : formatCodeBlocks(match));
-            return '\uE000' + (store.length - 1) + '\uE001';
+            return (fenced !== undefined ? '\uE002' : '\uE000') + (store.length - 1) + '\uE001';
         });
         return {
@@ -2697 +2717 @@
             restore: function(t) {
                 return String(t).replace(/\uE000(\d+)\uE001/g, function(m, i) {
+                    return store[Number(i)];
+                });
+            },
+            // Fenced blocks have their own mark and go back last, after the
+            // table, paragraph and link rules (M7a): none of those may reach
+            // inside the code, so a blank line no longer splits the block and
+            // Copy gets the code as written.
+            restoreBlocks: function(t) {
+                return String(t).replace(/\uE002(\d+)\uE001/g, function(m, i) {
                     return store[Number(i)];
                 });
@@ -2797 +2826 @@
 }
     function formatCodeBlocks(text) {
-        // Handle fenced code blocks with language specification (```language)
-        text = text.replace(/```(\w+)?\n?([\s\S]*?)```/g, (match, language, code) => {
-            const lang = language || 'text';
-            const escapedCode = escapeHtml(code.trim());
-            return `<div class="mxchat-code-block-container">
-                <div class="mxchat-code-header">
-                    <span class="mxchat-code-language">${lang}</span>
-                    <button class="mxchat-copy-button" aria-label="Copy to clipboard">Copy</button>
-                </div>
-                <pre class="mxchat-code-block"><code class="language-${lang}">${escapedCode}</code></pre>
-            </div>`;
+        // Fenced code blocks (```language) and inline code in ONE pass (M7a):
+        // the inline rule used to run over the finished block and turn a
+        // backtick inside the code into an inline-code span.
+        text = text.replace(/```(\w+)?\n?([\s\S]*?)```|`([^`\n]+)`/g, (match, language, code, inline) => {
+            if (inline !== undefined) {
+                return '<code class="mxchat-inline-code">' + escapeInlineCode(inline) + '</code>';
+            }
+            return codeBlockHtml(language || 'text', escapeHtml(code.trim()));
         });
-
-        // Handle inline code with single backticks
-        text = text.replace(/`([^`\n]+)`/g, '<code class="mxchat-inline-code">$1</code>');
 
         // Handle raw PHP tags (legacy support)
         text = text.replace(/(<\?php[\s\S]*?\?>)/g, (match) => {
-            const escapedCode = escapeHtml(match);
-            return `<div class="mxchat-code-block-container">
-                <div class="mxchat-code-header">
-                    <span class="mxchat-code-language">php</span>
-                    <button class="mxchat-copy-button" aria-label="Copy to clipboard">Copy</button>
-                </div>
-                <pre class="mxchat-code-block"><code class="language-php">${escapedCode}</code></pre>
-            </div>`;
+            return codeBlockHtml('php', escapeHtml(match));
         });
 
         return text;
+    }
+
+    // The code box as one line of markup (M7a): .bot-message keeps newlines
+    // (white-space: pre-line), so the indented template it was built from
+    // drew an empty band above the header and another under it.
+    function codeBlockHtml(lang, escapedCode) {
+        return '<div class="mxchat-code-block-container">' +
+            '<div class="mxchat-code-header">' +
+                '<span class="mxchat-code-language">' + lang + '</span>' +
+                '<button class="mxchat-copy-button" aria-label="Copy to clipboard">Copy</button>' +
+            '</div>' +
+            '<pre class="mxchat-code-block"><code class="language-' + lang + '">' + escapedCode + '</code></pre>' +
+        '</div>';
     }
 
@@ -2897 +2926 @@
     }
 
+    // Text and attribute safe: the result also lands in alt="" for image
+    // search results, so quotes are escaped too (CVE-2026-110662 follow-up).
     function sanitizeUserInput(text) {
-        const div = document.createElement('div');
-        div.textContent = text;
-        return div.innerHTML;
+        if (text === null || typeof text === 'undefined') return '';
+        return String(text)
+            .replace(/&/g, '&amp;')
+            .replace(/</g, '&lt;')
+            .replace(/>/g, '&gt;')
+            .replace(/"/g, '&quot;')
+            .replace(/'/g, '&#039;');
     }
 
@@ -2920 +2955 @@
 
     function escapeHtml(unsafe) {
-        // Skip escaping if it's already escaped or contains HTML code block markup
-        if (unsafe.includes('&lt;') || unsafe.includes('&gt;') || 
-            unsafe.includes('<pre><code') || unsafe.includes('</code></pre>')) {
-            return unsafe;
+        // Code text is escaped exactly once (M7a). Code that arrives already
+        // escaped (&lt; / &gt;) is decoded first, so it shows the same
+        // characters as before; it used to be returned unescaped, so raw
+        // markup next to an entity was inserted as markup.
+        if (unsafe.includes('&lt;') || unsafe.includes('&gt;')) {
+            unsafe = decodeHTMLEntities(unsafe);
         }
         
@@ -2934 +2971 @@
     }
     
+    // Inline code text, escaped exactly once like a code block's (M7b), so it
+    // shows the characters as written. Quotes stay as typed: the span goes back
+    // before the link rules, and a URL after &quot; would be linked where one
+    // after a quote is not.
+    function escapeInlineCode(code) {
+        if (code.includes('&lt;') || code.includes('&gt;')) {
+            code = decodeHTMLEntities(code);
+        }
+        return code
+            .replace(/&/g, "&amp;")
+            .replace(/</g, "&lt;")
+            .replace(/>/g, "&gt;");
+    }
+
     function decodeHTMLEntities(text) {
         var textArea = document.createElement('textarea');
@@ -3528 +3579 @@
     function initializeChatVisibility(botId) {
         botId = botId || 'default';
-        const complianzEnabled = mxchatChat.complianz_toggle === 'on' ||
-                                mxchatChat.complianz_toggle === '1' ||
-                                mxchatChat.complianz_toggle === 1;
+        // The Complianz setting arrives as "1" from the normal loader
+        // (wp_localize_script), as a JSON true from the delayed and On User
+        // Interaction loader, or as "on" as the settings store it: every
+        // loading mode asks for consent the same way (M7g).
+        const complianzToggle = mxchatChat.complianz_toggle;
+        const complianzEnabled = complianzToggle === true ||
+                                complianzToggle === 'on' ||
+                                complianzToggle === '1' ||
+                                complianzToggle === 1;
 
         if (complianzEnabled && typeof cmplz_has_consent === "function" && typeof complianz !== 'undefined') {
@@ -3541 +3598 @@
             });
         } else {
-            // If Complianz is not enabled, always show
+            // If Complianz is not enabled (or its script is not on the page),
+            // always show. The window's no-consent mark is cleared with the
+            // launcher's, so once this script has run both marks mean the same
+            // thing in every loading mode: consent is needed and not given.
             getElement(botId, 'floating-chatbot-button')
                 .css('display', 'flex')
                 .removeClass('hidden no-consent')
                 .fadeTo(500, 1);
+            getElement(botId, 'floating-chatbot').removeClass('no-consent');
 
             // Also check pre-chat message when Complianz is not enabled
@@ -4133 +4194 @@
         if (visitorName && visitorName.trim()) {
             // Escape HTML to prevent XSS
-            var safeName = $('<div>').text(visitorName.trim()).html();
+            var safeName = $('<div>').text(visitorName.trim()).html().replace(/"/g, '&quot;').replace(/'/g, '&#039;');
             html = html.replace(/\{visitor_name\}/gi, safeName);
         } else {
@@ -4631 +4692 @@
     initializeAllInstances();
 
-    // Legacy initialization for single bot compatibility
+    // Legacy initialization for single bot compatibility. A launcher kept back
+    // for cookie consent (no-consent) is left to initializeChatVisibility():
+    // un-hiding it here painted it for the length of its fade-out (M7g).
     $('.floating-chatbot.hidden').each(function() {
         var botId = getBotIdFromElement(this);
-        getElement(botId, 'floating-chatbot-button').removeClass('hidden');
+        getElement(botId, 'floating-chatbot-button').not('.no-consent').removeClass('hidden');
     });