Bug Reports

Agents are in hoory but they go offline which leads to lost chats

Hello, I have identified a security issue related to Open Redirect using HTML Injection (HTMLi) in the name field of the profile section. Below are the steps to reproduce the issue: Steps to Reproduce: 1. Go to your Profile Settings page. 2. Change your name to the following payload: <a href=" https://evil.com">ClickMe</a> 3. Save the changes. 4. Open a Private Window (Incognito Mode) and log in to the same account. 5. Return to the normal browser session and log in again. 6. Hoory sends an email notification with the following message: Dear ClickMe, Your session has expired. You have been logged out because your account was accessed from another device or browser. If this wasn't you, please secure your account immediately. Reset your password. 7. When clicking on “ClickMe” in the email, the user is redirected to evil.com , confirming the Open Redirect vulnerability. Impact: • An attacker could exploit this to redirect users to malicious websites, potentially leading to phishing attacks or malware distribution. Best regards, Abdelali chekiel

Sometimes the response from the bot to the widget does not come immediately, and the user can see it only after the page is refreshed. The user can’t see the answer and can’t send a new message anymore because the dialog is closed (which he also doesn’t see) Example of such dialogue: https://app.hoory.com/app/accounts/3099/conversations/6847 Screenshot of widget in attachment It is important that the bot and operator responses are immediately passed to the source, and are available for viewing by the user

We see a lot of dialogues where the bot responds in a language different from the one the user is talking to. Our users write in Russian, while the bot responds in Belarusian or English. Examples of such dialogues: https://app.hoory.com/app/accounts/3099/conversations/8806 https://app.hoory.com/app/accounts/3099/conversations/8808 https://app.hoory.com/app/accounts/3099/conversations/8813 https://app.hoory.com/app/accounts/3099/conversations/8829 This is a critical issue for us as we have configured integration between Hoory and our CRM system, and operator connection events are working in our CRM by key words that are only available in the bot’s Russian replies

We have configured the integration of Hoory with our CRM system. When a user writes in Hoory widget, the CRM receives events "message_created" that are used to create tasks. When a user puts an evaluation in the form of CSAT, the CRM receives event "message_updated" Recently in some dialogs have started to come the extra events "message_updated", so our CRM is duplicating messages/chats. List of such dialogs: https://app.hoory.com/app/accounts/3099/conversations/4445 https://app.hoory.com/app/accounts/3099/conversations/8248 https://app.hoory.com/app/accounts/3099/conversations/8279 Could you help please, what are these updates related to in the chats? Can you fix this?

Our sources have the option to send a Dialogue Evaluation Form (CSAT). Despite this, the form is often not gone, so there is no way to track customer satisfaction Examples of chats where the form is not sent: https://app.hoory.com/app/accounts/3099/conversations/8584 https://app.hoory.com/app/accounts/3099/conversations/8581 https://app.hoory.com/app/accounts/3099/conversations/8579 https://app.hoory.com/app/accounts/3099/conversations/8576

Open a chat with regular chat widget Click on 3 dots and open in a new window Start a chat from a new windows This will create too different tickets and the client will see massages from both tickets in one chat. https://drive.google.com/file/d/1XuH3O0IQUNgBFUoxkL7-8_nIPo-GuV3U/view?usp=sharing https://app-eu1.hoory.com/app/accounts/5/conversations/3875933 https://app-eu1.hoory.com/app/accounts/5/conversations/3875931 Please request an access for the video.

Please see the messages about Asian handicap which are not related to the conversation and sent to the customer in the middle of the conversation: 1. https://app-eu1.hoory.com/app/accounts/5/conversations/3500106?messageId=62026316 2. https://app-eu1.hoory.com/app/accounts/5/conversations/3506767?messageId=62149490

The search results for customer messages do not work correctly. Not all conversations with the customer are shown. Please check and fix the problem. Can we get a link to the email that was sent to the customer on 3.01.2025 by 1202355837 kudriavtsevvalentin88@gmail.com ? This email is important but does not appear in search results The email was sent to a customer on request on 3.01.2025 and the email does not appear in the search