Zender - WhatsApp and SMS Messaging Platform and use Android as SMS Gateways (SaaS) v3.11.3

Zender - WhatsApp and SMS Messaging Platform and use Android as SMS Gateways (SaaS) Changelog

Changelog v3.11.3

• Fixed a security flaw that let any signed-in account delete every voucher and every marketing record on the site, no matter who owned them. Deleting your own messages and contacts is unaffected.
• Fixed social sign-in treating an unverified email address as proof of identity. Signing up at a provider that hands back an unverified address could attach that login to somebody else's existing account.
• Fixed gateway callback addresses being generated from a predictable value. That address is the only thing guarding a gateway's delivery callback, so a guessed one could mark a message delivered and bill the sender for it. Existing gateways keep the address they already have.
• Fixed WhatsApp pairing tokens and admin-created API secrets being generated from a predictable value. Both act as credentials, so a guessed one could be used in place of the owner's key.
• Fixed payout approvals, message resends and translation saves being triggerable by a crafted link that a signed-in administrator clicked.
• Fixed a device's message-fetch request passing an unchecked value straight into a database query.
• Fixed unsubscribe links telling recipients they had opted out when nothing was recorded. Some mail clients rewrite the link in a way the old page could not read, so the person kept receiving messages after being told they had left the list.
• Fixed a gateway saved without a per-country price list stopping scheduled messages for every customer on the site, not only for that gateway.
• Fixed an installed plugin whose details file omits its version taking down every dashboard page, for every user, rather than just that plugin.
• Fixed the plugin settings screen and the plugin update showing a general error page instead of opening, or instead of finishing after the files had already been replaced.
• Fixed the subscription-expiring reminder email, which had never been sent on any install.
• Fixed EasySendSMS being sent the sender name in place of its password, and ClickSend being sent the API key in place of its username, so neither could authenticate with what the customer had entered.
• Fixed package limits accepting a negative number and silently treating it as unlimited.
• Fixed a failed save leaving the page locked, so nothing more could be edited or saved until it was reloaded.
• Fixed the confirmation dialog staying on screen after the action behind it had already failed.
• Fixed deleting a message that another tab had already deleted showing an error page instead of a plain notice.
• Fixed the Add Device dialog leaving an earlier QR code on screen when a new one was drawn.
• Fixed a checkout that cannot be priced telling the buyer "Invalid Request!" instead of explaining that the store could not convert the currency.
• Fixed the add-user form accepting an invalid credit amount that the edit form already rejected.
• Fixed the date-range picker showing its two dates the wrong way round in right-to-left languages.
• Improved dark mode across the dashboard. The overview chart no longer appears as a solid white block, and loading spinners, dropdown menus, notification popups, number and date controls, file pickers, the code editor and keyboard focus outlines are all readable on dark backgrounds.
• Improved text contrast on the dashboard, the public site and the offline documentation, so stat labels, placeholder text, secondary headings and links meet accessibility standards in both themes.
• Improved keyboard access and visible focus, including the flow builder's controls, primary buttons, and the action buttons on a selected table row.
• Added a hint inside every gateway and shortener credential box showing what belongs there, and the provider list now opens with a provider already chosen instead of an empty selection.
• Added a badge on bulk actions showing how many rows the action will apply to.
• Added an underline to links written inside explanatory text, so they can be told apart from the words around them.