MDS Live Chat and Helpdesk
| 开发者 | nagendrarm |
|---|---|
| 更新时间 | 2026年8月4日 22:57 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.0.2 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
MDS Live Chat and Helpdesk adds a professional customer support chat system to your WooCommerce store, featuring a WhatsApp-style support dashboard for managing conversations.
安装:
- Upload the
mds-live-chat-helpdeskfolder to the/wp-content/plugins/directory, or install the plugin zip directly through the Plugins screen. - Activate the plugin through the "Plugins" screen in WordPress.
- Go to MDS Live Chat and Helpdesk → Settings to configure the widget's appearance, position, and push notification icon.
- Go to MDS Live Chat and Helpdesk → Add Users / Roles to add support agents.
- Visit your site - the chat icon should appear according to your settings.
屏幕截图:
常见问题:
Does this require WooCommerce?
WooCommerce is recommended so the order-history and order-value features work, but the core chat functionality works without it.
Do I need a third-party push notification service?
No. MDS Live Chat and Helpdesk generates its own Web Push (VAPID) keys automatically on activation and sends notifications directly through each browser's native Web Push service - no external account or API key required. See the "External Services" section above for details on how this works.
Can customers attach files?
Not currently. Agents can send photos and documents to customers from the admin chat panel, and customers can view/download them, but there is no upload option in the customer-facing widget itself.
Does this work for guests as well as logged-in customers?
Yes. Guests provide a name, email, and mobile number to start a chat; logged-in customers' details are used automatically.
更新日志:
1.3.0
- Security: fixed a flaw where verify_customer_access() could not distinguish "no such chat" from "chat exists but its access token is empty/NULL" - both cases were treated as authorized. The check now fails closed: a chat with no token denies access rather than granting it. Affects the poll, send, mark-seen, and subscribe endpoints.
- Security: resume-by-ticket (used to reconnect to a chat via Ticket ID + email/phone, e.g. after clearing browser data) now has rate limiting, both per requesting IP and per ticket ID, after repeated failed attempts. This was previously guessable/brute-forceable since ticket IDs are sequential and the contact field alone isn't a strong secret.
- Removed a "legacy chat" bypass in poll_messages/verify_customer_access that is no longer applicable (the plugin has no prior public release to remain compatible with) and was itself the source of the two issues above.
- Hardening: the admin menu now only registers at all for users who are agents/admins, instead of registering visibly for every logged-in WordPress user (e.g. customer accounts) and relying solely on a page-level check to turn them away. No change for actual agents/admins.
- Removed a leftover unused settings-save handler (admin-post.php action) from before the Settings page was moved to the REST API; the REST endpoint has handled saving for some time; this was dead code, not a live code path.
- Fix: removed an incorrect "Requires Plugins: woocommerce" declaration in the plugin header. WooCommerce is optional (order lookup is skipped gracefully when it isn't installed, as already documented), but that header hard-blocks activation entirely on sites without WooCommerce - it contradicted the plugin's actual, intended behavior.
- Fix: the "Start Chat" (and "Resume Ticket") button had no protection against multiple clicks, so a double-click or a slow connection could fire the request more than once, creating several duplicate tickets from the same visitor. The button is now disabled with a loading label while the request is in progress, and a matching safety check was added on the server so an accidental rapid resubmission reuses the ticket that's already being created instead of making a new one.
- New: Agents can now send photos and documents to customers from the admin chat panel (an attach button next to Send). Customers can view images inline and download any file - WhatsApp-style. This is admin-to-customer only; the customer-facing widget does not gain a file-upload option, by design.
- Security: customer-facing chat endpoints (poll, send, mark-seen, subscribe) now require proof of ownership of the specific chat before returning or accepting data, closing a gap that previously allowed any visitor to access another visitor's conversation by guessing a chat ID.
- Renamed the plugin to MDS Live Chat and Helpdesk (slug: mds-live-chat-helpdesk) for WordPress.org compliance.
- Moved all inline JavaScript and inline event handlers out of PHP templates into properly enqueued external script files.
- Added translation support (text domain: mds-live-chat-helpdesk) across admin screens.
- General code cleanup for WordPress Coding Standards compliance.
- Pasted links in chat messages are now automatically rendered as clickable links, both in the customer widget and the admin dashboard.
- Initial release.