Merge branch 'master' of github.com:freescout-helpdesk/freescout into dist

Fix "Class Symfony\Component\Filesystem\Filesystem not found" in Helper::isAbasolutePath()

.editorconfig

@@ -0,0 +1,12 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_style = space
+indent_size = 4
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.json]
+insert_final_newline = false

.env.example

@@ -9,13 +9,34 @@
 # Application URL
 APP_URL=https://example.com
 
-# Use HTTP protocol and redirect to HTTPS
-#APP_FORCE_HTTPS=true
+# If you are using HTTPS, feel free to uncomment this line to improve security
+#SESSION_SECURE_COOKIE=true
+
+# Enter your proxy address here. It will be used to connect to all external URLs via CURL.
+# You may need to do specify proxy for example if api.freescout.net is not available from your server
+# (access to api.freescout.net is required to obtain official modules).
+#APP_PROXY=
+
+# Custom headers to add to all outgoing emails.
+#APP_CUSTOM_MAIL_HEADERS="IsTransactional:True;X-Custom-Header:value"
+
+# Uncomment if you have many folders and you are experiencing performance issues
+#APP_UPDATE_FOLDER_COUNTERS_IN_BACKGROUND=true
 
 # Timezones: https://github.com/freescout-helpdesk/freescout/wiki/PHP-Timezones
 # Comment it to use default timezone from php.ini
 #APP_TIMEZONE=Europe/London
 
+# Comma separated list of trusted proxies for proper IP detection in FreeScout.
+# To trust all proxies that connect to your server use single asterisk: *
+# To trust ALL proxies, including those that are in a chain of forwarding use double asterisk: **
+#APP_TRUSTED_PROXIES=192.168.1.1,192.168.1.2,192.168.1.3
+
+# Set this parameter when receiving "Domain or IP address is not allowed".
+# https://github.com/freescout-help-desk/freescout/wiki/Installation-Guide#-domain-or-ip-address-is-not-allowed
+# Example: "example.org,12.34.56.78"
+#APP_REMOTE_HOST_WHITE_LIST=""
+
 DB_CONNECTION=mysql
 DB_HOST=localhost
 DB_PORT=3306
@@ -29,4 +50,4 @@ DB_PASSWORD=
 APP_KEY=
 
 # Uncomment to see errors in your browser, don't forget to comment it back when debugging finished
-#APP_DEBUG=true
+#APP_DEBUG=true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1 @@
+blank_issues_enabled: false

.github/ISSUE_TEMPLATE/general_help_request.md

@@ -0,0 +1,25 @@
+---
+name: General Help Request
+about: Create a general help request
+
+---
+<!--
+* If you have some error the first thing you should do is to check "Manage » Logs » App Logs"! If there are any errors there - make sure to provide them in the issue.
+* Have you read FAQ? https://github.com/freescout-helpdesk/freescout/wiki/FAQ
+* If you have "Whoops something went wrong" error see: https://github.com/freescout-helpdesk/freescout/wiki/Installation-Guide#11-troubleshooting
+* Before creating an issue try to disable all non-official modules and remove all custom code from your FreeScout and see if the issue still persists.
+* Feature requests for modules should be posted here: https://freescout.net/request-feature/
+* Docker questions should go here: https://github.com/tiredofit/docker-freescout/issues
+* Create separate issues for different topics - no need to mix all your problems into one issue.
+* Questions on issues with payments for modules should be sent by email: https://freescout.net/contact-us/
+* Don't forget that you are not the project manager. Try to be humble, polite, friendly and positive. Otherwise your account may be banned (and it can't be undone).
+* Mentioning how much you've spent on modules is also the way to be banned.
+
+Still here? Well clean this out and go ahead :)
+-->
+
+PHP version: 
+FreeScout version: 
+Database: MySQL / PostgreSQL
+Are you using CloudFlare: Yes / No
+Are you using non-official modules: Yes / No

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,5 @@
+Pull requests should be sent to the `master` branch: https://github.com/freescout-helpdesk/freescout/wiki/Development-Guide#github-workflow
+
+Also one commit is preferable to several commits - it's easier to read and analize single commit.
+
+Now you can delete this text and type the description of your pull request...

.github/workflows/phpcs.yml

@@ -0,0 +1,23 @@
+name: PHP Code Sniffer
+
+on:
+  push:
+    branches:
+      - master
+  workflow_dispatch:
+
+jobs:
+  build:
+    name: Lint PHP
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: 8.3
+          tools: phpcs
+
+      - name: Run check
+        run: phpcs

.github/workflows/test-pgsql.yml

@@ -0,0 +1,60 @@
+name: Test App (PostgreSQL)
+
+on:
+  push:
+    branches:
+      - master
+  workflow_dispatch:
+
+jobs:
+  test:
+    name: Test App (PostgreSQL)
+    runs-on: ubuntu-latest
+
+    env:
+      DB_CONNECTION: testing_pgsql
+
+    services:
+      postgres:
+        image: postgres:latest
+        env:
+          POSTGRES_USER: freescout-test
+          POSTGRES_PASSWORD: freescout-test
+          POSTGRES_DB: freescout-test
+        ports:
+          - 5432:5432
+        # Set health checks to wait until postgres has started
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
+    strategy:
+      matrix:
+        php: ['7.4', '8.0', '8.1', '8.2', '8.3', '8.4', '8.5']
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php }}
+          extensions: pgsql, mbstring, xml, imap, zip, gd, curl, intl, json
+
+      - name: Install composer dependencies
+        run: composer install --ignore-platform-reqs --no-interaction
+
+      - name: Migrate and seed the database
+        run: |
+          php${{ matrix.php }} artisan migrate --force -n --database=testing_pgsql
+          php${{ matrix.php }} artisan db:seed --force -n --database=testing_pgsql
+        env:
+          DB_PORT: ${{ job.services.postgres.ports[5432] }}
+
+      - name: Run PHP tests
+        if: ${{ matrix.php < 8.4 }}
+        run: php${{ matrix.php }} ./vendor/bin/phpunit
+        env:
+          DB_PORT: ${{ job.services.postgres.ports[5432] }}

.github/workflows/test.yml

@@ -0,0 +1,46 @@
+name: Test App (MySQL)
+
+on:
+  push:
+    branches:
+      - master
+  workflow_dispatch:
+
+jobs:
+  test:
+    name: Test App (MySQL)
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        php: ['7.4', '8.0', '8.1', '8.2', '8.3', '8.4', '8.5']
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php }}
+          extensions: mysql, mbstring, xml, imap, zip, gd, curl, intl, json
+
+      - name: Start MySQL
+        run: |
+          sudo systemctl start mysql
+
+      - name: Setup database
+        run: |
+          mysql -uroot -proot -e 'CREATE DATABASE IF NOT EXISTS `freescout-test`;'
+          mysql -uroot -proot -e "CREATE USER 'freescout-test'@'localhost' IDENTIFIED WITH mysql_native_password BY 'freescout-test';"
+          mysql -uroot -proot -e "GRANT ALL ON \`freescout-test\`.* TO 'freescout-test'@'localhost';"
+          mysql -uroot -proot -e 'FLUSH PRIVILEGES;'
+
+      - name: Install composer dependencies
+        run: composer install --ignore-platform-reqs --no-interaction
+
+      - name: Migrate and seed the database
+        run: |
+          php${{ matrix.php }} artisan migrate --force -n --database=testing
+          php${{ matrix.php }} artisan db:seed --force -n --database=testing
+
+      - name: Run PHP tests
+        if: ${{ matrix.php < 8.4 }}
+        run: php${{ matrix.php }} ./vendor/bin/phpunit

.gitignore

@@ -14,7 +14,7 @@ Homestead.yaml
 npm-debug.log
 yarn-error.log
 .env
-
+app/Console/Commands/Test*
 /bootstrap/compiled.php
 composer.phar
 #composer.lock
@@ -27,8 +27,13 @@ Thumbs.db
 /Modules
 /Modules/**/.git
 /public/modules
+/public/docs
+/public/.dh-diag
 /storage/.ignore_locales
 /storage/.installed
 /tools
 .well-known
-/resources/lang/module.*
+/resources/lang/module.*
+.phpunit.result.cache
+/.phpunit.cache
+.env.testing

.htaccess

@@ -5,5 +5,6 @@
 	# On some hostings it does not work as "public/$1", but works as "/public/$1".
 	# But we can't write it as "/public/$1" because in this case it does not work
 	# when application is installed in subdirectory.
+	RewriteCond %{REQUEST_URI} !/\.well\-known/?.*
 	RewriteRule (.*) public/$1 [L]
 </IfModule>

.travis.yml

@@ -3,6 +3,8 @@ language: php
 php:
   - 7.0
   - 7.2
+  - 7.4
+  - 8.0
 
 before_script:
   - cp .env.travis .env

DOCUMENTATION.md

@@ -0,0 +1,3 @@
+# Documentation
+
+Documentation: https://github.com/freescout-help-desk/freescout/wiki

LICENSE

@@ -522,7 +522,7 @@ contain the covered work, unless you entered into that arrangement,
 or that patent license was granted, prior to 28 March 2007.
 
   Nothing in this License shall be construed as excluding or limiting
-any implied license or other defenses to infringement that may
+any implied license or other defences to infringement that may
 otherwise be available to you under applicable patent law.
 
   12. No Surrender of Others' Freedom.

README.md

@@ -2,93 +2,124 @@
 
 <div align="center">
 
-<img src="https://raw.githubusercontent.com/freescout-helpdesk/freescout/master/public/img/logo-300.png" width="180" height="180" />
-<br/><br/>
-
-[![PHP version](https://freescout-helpdesk.github.io/img/badges/PHP-7.0%2B-blue.svg)](https://github.com/freescout-helpdesk/freescout#requirements) [![Laravel version](https://freescout-helpdesk.github.io/img/badges/Laravel-5.5-blue.svg)](https://github.com/freescout-helpdesk/freescout#requirements) 
-[![Build Status](https://freescout-helpdesk.github.io/img/badges/travis.svg)](https://freescout-helpdesk.github.io/img/badges/travis.svg) [![HitCount](http://hits.dwyl.io/freescout-helpdesk/freescout.svg)](http://hits.dwyl.io/freescout-helpdesk/freescout)
+<img src="https://raw.githubusercontent.com/freescout-help-desk/freescout/master/public/img/logo-300.png" width="180" height="180" />
 
 </div>
 
-**FreeScout** is the super lightweight free open source help desk and shared inbox written in PHP7 (Laravel 5.5 framework) – self hosted clone of HelpScout. Now you can enjoy free Zendesk & Help Scout without giving up privacy or locking yourself into a service you don't control. FreeScout has been developed from scratch and is not using any copyrighted Help Scout or Zendesk materials.
+**FreeScout** is the super lightweight and powerful free open source help desk and shared inbox built with PHP (Laravel framework). Now you can enjoy free Zendesk & Help Scout without giving up privacy or locking yourself into a service you don't control. FreeScout has been developed from scratch and does not use any copyrighted Help Scout or Zendesk materials.
+
+If you want to support the project feel free to **star this repository**. It helps to increase the visibility of the project and let people know that it is valuable. Thanks for your support!
 
 ![FreeScout](https://freescout-helpdesk.github.io/img/screenshots/screenshot.png)
 
 ## Table of Contents
-   * [Features](#features)
    * [Demo](#demo)
+   * [Features](#features)
    * [Mobile Apps](#mobile-apps)
-   * [Modules](#modules)
    * [Requirements](#requirements)
-   * [News & Updates](#news--updates)
    * [Installation](#installation)
+   * [Images & One-Click Installs](#images--one-click-installs)
+   * [Modules](#modules)
+   * [Tools & Integrations](#tools--integrations)
+   * [News & Updates](#news--updates)
    * [Contributing](#contributing)
    * [Screenshots](#screenshots)
 
-## Features
-
-  * No limitations on the number of users, tickets, etc.
-  * 100% Mobile-friendly.
-  * Multilingual (English, French, Italian, Portuguese, Russian, Dutch).
-  * Seamless email integration.
-  * Web installer & updater.
-  * Starred conversations.
-  * Forwarding conversations.
-  * Moving conversations between mailboxes.
-  * Phone conversations.
-  * Sending new conversations to multiple recipients at once.
-  * Push notifications.
-  * Following a conversation.
-  * Auto reply.
-  * Notes.
-  * Pasting screenshots from the clipboard into the reply area.
-  * Configuring notifications on a per user basis.
-  * Open tracking.
-  * Editing threads.
-  * Search.
-
-Need anything else? Suggest features [here](https://freescout.net/request-feature/).
-
 ## Demo
 
 **[Live Demo](https://demo.freescout.net)**
 
+## Features
+
+  * Omnichannel — FreeScout centralizes in one place all customer conversations received by email, [WhatsApp](https://freescout.net/whatsapp/), Telegram, Facebook, Slack, Live Chat and more.
+  * [AI-powered](https://github.com/freescout-help-desk/AiIntegration) and super efficient.
+  * Unlimited support agents, tickets, mailboxes, etc.
+  * [Secure](https://freescout.net/security) by design.
+  * Mobile-friendly.
+  * Multilingual (translated into 33 languages).
+  * Seamless email integration (via SMTP, IMAP, POP3, etc).
+  * Modern OAuth authentication for Microsoft Office 365 and Google Workspace.
+  * Native [S3 storage](https://github.com/freescout-help-desk/S3Storage) support.
+  * Fully supports screen readers (for visually impaired).
+  * Web installer & updater.
+  * Starred conversations.
+  * Push notifications.
+  * Following conversations.
+  * Auto replies.
+  * Internal notes.
+  * Forwarding / Merging / Moving conversations.
+  * Phone conversations.
+  * Sending new conversations to multiple recipients at once.
+  * Collision detection – notice is shown when two agents open the same conversation.
+  * Automatic refreshing of the conversations list without the need to reload the page.
+  * Pasting screenshots from the clipboard into the reply area.
+  * Flexible notifications for user agents.
+  * Open tracking.
+  * Powerful search.
+
+A full list of features is available [here](https://freescout.net/#custom_html-3).
+
+Need anything else? [Suggest features](https://freescout.net/request-feature/).
+
 ## Mobile Apps
 
-<a href="https://freescout.net/android-app/" target="_blank"><img alt="Android App" src="https://freescout-helpdesk.github.io/img/apps/android.png" width="200px" /></a>
+Mobile apps support the same functionality and modules as the web version of your FreeScout installation. Both support agents and administrators can use mobile apps.
 
-## Modules
+<a href="https://freescout.net/android-app/" target="_blank" rel="nofollow"><img alt="Android App" src="https://freescout-helpdesk.github.io/img/apps/android.png" width="200px" /></a> <a href="https://freescout.net/ios-app/" target="_blank" rel="nofollow"><img alt="iOS App" src="https://freescout-helpdesk.github.io/img/apps/ios.png?v=1" width="200px" /></a>
 
-[Available modules](https://freescout.net/modules/)
+[MacOS Menu Bar App](https://github.com/jonalaniz/scouter)
 
 ## Requirements
 
-FreeScout is a pure PHP/MySQL application, so it can be easily deployed even on a shared hosting.
+FreeScout is a pure PHP/MySQL application, so it can be easily deployed even on a [shared hosting](https://github.com/freescout-help-desk/freescout/wiki/Choosing-a-Server).
 
   * Nginx / Apache / IIS
-  * PHP 7.0 - 7.3
+  * PHP 7.4 - 8.x
   * MySQL 5.0+ / MariaDB 5.0+ / PostgreSQL
 
-## News & Updates
-
-If you would like to be notified about new releases, news and updates you can subscribe [here](https://feedburner.google.com/fb/a/mailverify?uri=freescout)
+There are no minimum system requirements (CPU / RAM) – FreeScout will run on any system.
 
 ## Installation
 
-[Installation Guide](https://github.com/freescout-helpdesk/freescout/wiki/Installation-Guide)
+[Installation Guide](https://github.com/freescout-help-desk/freescout/wiki/Installation-Guide)
 
-Images & one-click installs:
+## Images & One-Click Installs
 
-* [Docker Image](http://freescout.net/docker/)
-* [Softaculous](http://www.softaculous.com/apps/customersupport/FreeScout) (cPanel, Plesk, ISPmanager, H-Sphere, DirectAdmin, InterWorx)
-* [Fantastico](http://ff3.netenberg.com/visitors/scripts/freescout/view) (cPanel, DirectAdmin, ISP Manager, ISP Config)
+* [Docker Image](https://freescout.net/docker/)
+* [Pikapods](https://freescout.net/pikapods/) — Open-source apps hosting (Fully managed)
+* [Zenith](https://freescout.net/zenith/) — Open-source apps hosting (Fully managed)
+* [Hostinger](https://freescout.net/hostinger/) — VPS with automatic backups included
+* [Softaculous](http://www.softaculous.com/apps/customersupport/FreeScout) — cPanel, Plesk, ISPmanager, H-Sphere, DirectAdmin, InterWorx
+* [Fantastico](http://ff3.netenberg.com/visitors/scripts/freescout/view) — cPanel, DirectAdmin, ISP Manager, ISP Config
+* [Cloudron](https://cloudron.io/store/net.freescout.cloudronapp.html)
+* [Ubuntu](https://github.com/freescout-help-desk/freescout/wiki/Installation-Guide#interactive-installation-bash-script-ubuntu) — Bash script
+
+[More one-click installs…](https://freescout.net/one-click-installs/)
+
+## Modules
+
+* [Official Modules](https://freescout.net/modules/)
+* [Community Modules](https://freescout.net/community-modules/)
+
+## Tools & Integrations
+  
+  * [API](https://api-docs.freescout.net/)
+  * [Migrate to FreeScout](http://freescout.net/migrate/) (from any help desk)
+  * [Zapier](https://freescout.net/zapier/)
+  * [Make](https://freescout.net/make-integration/) (Integromat)
+
+## News & Updates
+
+Don't miss news, updates and new modules!
+
+[Email Newsletter](https://freescout.net/subscribe/) | [Facebook](https://freescout.net/facebook/) | [Twitter](https://freescout.net/twitter/) | [YouTube](https://freescout.net/youtube/) | [Telegram](https://freescout.net/telegram/) | [RSS](https://freescout.net/feed/)
 
 ## Contributing
 
-* [Development Guide](https://github.com/freescout-helpdesk/freescout/wiki/Development-Guide)
-* [Todo list](https://github.com/freescout-helpdesk/freescout/labels/help%20wanted)
-* [Translate](https://github.com/freescout-helpdesk/freescout/wiki/Translate)
-* [Support project by leaving a feedback](https://github.com/freescout-helpdesk/freescout/wiki#support-project)
+* [Support the project by leaving a feedback](https://github.com/freescout-help-desk/freescout/issues/288)
+* [Development Guide](https://github.com/freescout-help-desk/freescout/wiki/Development-Guide)
+* [Todo list](https://github.com/freescout-help-desk/freescout/labels/help%20wanted)
+* [Translate](https://github.com/freescout-help-desk/freescout/wiki/Translate)
 
 ## Screenshots
 
@@ -100,10 +131,9 @@ Conversation:
 
 ![Conversation](https://freescout-helpdesk.github.io/img/screenshots/conversation.png)
 
+Drafting reply with AI:
 
-Mailbox connection settings page:
-
-![Mailbox connection settings page](https://freescout-helpdesk.github.io/img/screenshots/mailbox-connection.png)
+![Mailbox connection settings page](https://freescout-helpdesk.github.io/img/screenshots/draft-reply-with-ai.png)
 
 Notifications:
 

SECURITY.md

@@ -0,0 +1,17 @@
+# Security Policy
+
+Read about **[FreeScout's Security](https://freescout.net/security/)**.
+
+## Reporting a Vulnerability
+
+  * Report a security vulnerability in the **Application Core**: https://github.com/freescout-help-desk/freescout/security/advisories
+  * Report a security vulnerability in a **Module**: https://freescout.net/contact-us/
+
+## Guidelines
+
+  * One issue per Advisory — do not put several issues into one Advisory, as GitHub will not assign a CVE to such an Advisory.
+  * CVEs are requested after the fix for the vulnerability is released.
+  * If you found an issue related to the `APP_LIMIT_USER_CUSTOMER_VISIBILITY=true` mode, make sure to read the [FAQ](https://github.com/freescout-help-desk/freescout/wiki/FAQ#is-it-possible-to-have-separate-contactscustomers-per-mailbox).
+  * Support agents are allowed to move conversations to any mailbox, even to ones they don't have access to.
+  * Drafts are viewable/discardable by any member of the mailbox where they are created.
+  * FreeScout loads external images in received emails, and there is a Module allowing to disable loading external images: https://freescout.net/module/block-external-images/.

app/ActivityLog.php

@@ -64,7 +64,7 @@ class ActivityLog extends Activity
             case self::DESCRIPTION_EMAILS_SENDING_ERROR_ALERT:
                 return __('Error sending alert');
             case self::DESCRIPTION_EMAILS_SENDING_WRONG_EMAIL:
-                return __('Error sending email to the user who replied to notiication from wrong email');
+                return __('Error sending email to the user who replied to notification from wrong email');
             case self::DESCRIPTION_EMAILS_FETCHING_ERROR:
                 return __('Error fetching email');
             case self::DESCRIPTION_SYSTEM_ERROR:
@@ -96,7 +96,7 @@ class ActivityLog extends Activity
             case self::NAME_APP_LOGS:
                 return __('App Logs');
             default:
-                return ucfirst($log_name);
+                return ucwords(str_replace('_', ' ', $log_name));
         }
     }
 

app/Attachment.php

@@ -19,6 +19,18 @@ class Attachment extends Model
 
     const DIRECTORY = 'attachment';
 
+    const DISK = 'local_app';
+
+    const MIME_TYPE_MAX_LENGTH = 127;
+
+    // This token type was used for backward compatibility for some time
+    // and has been deprecated.
+    //const TOKEN_TYPE_LEGACY = 1;
+    // For backward compatibility.
+    const TOKEN_TYPE_MD5    = 2;
+    // Current way.
+    const TOKEN_TYPE_SHA256 = 3;
+
     // https://github.com/Webklex/laravel-imap/blob/master/src/IMAP/Attachment.php
     public static $types = [
         'message'     => self::TYPE_MESSAGE,
@@ -32,13 +44,8 @@ class Attachment extends Model
         'other'       => self::TYPE_OTHER,
     ];
 
-    /**
-     * Files with such extensions are being renamed on upload.
-     */
-    public static $restricted_extensions = [
-        'php.*',
-        'sh',
-        'pl',
+    public static $type_extensions = [
+        self::TYPE_VIDEO => ['flv', 'mp4', 'm3u8', 'ts', '3gp', 'mov', 'avi', 'wmv'],
     ];
 
     public $timestamps = false;
@@ -54,25 +61,65 @@ class Attachment extends Model
     /**
      * Save attachment to file and database.
      */
-    public static function create($file_name, $mime_type, $type, $content, $uploaded_file, $embedded = false, $thread_id = null, $user_id = null)
+    public static function create($file_name, $mime_type, $type, $content, $uploaded_file, $embedded = false, $thread_id = null, $user_id = null, $upload_mode = \Helper::UPLOAD_MODE_DEFAULT)
     {
         if (!$content && !$uploaded_file) {
             return false;
         }
 
-        // Check extension.
-        $extension = strtolower(pathinfo($file_name, PATHINFO_EXTENSION));
-        if (preg_match('/('.implode('|', self::$restricted_extensions).')/', $extension)) {
-            // Add underscore to the extension if file has restricted extension.
-            $file_name = $file_name.'_';
+        // Sanitize mime type.
+        // https://github.com/freescout-helpdesk/freescout/issues/3048
+        $mime_duplicate = strpos($mime_type, "application/vnd.openxmlformats", 1);
+        if ($mime_duplicate) {
+            $mime_type = substr($mime_type, $mime_duplicate);
         }
+        $mime_type = substr($mime_type, 0, self::MIME_TYPE_MAX_LENGTH);
+
+        $orig_extension = pathinfo($file_name, PATHINFO_EXTENSION);
+
+        // Add underscore to the extension if file has restricted extension.
+        $file_name = \Helper::sanitizeUploadedFileName($file_name, $uploaded_file, $content, $mime_type, $upload_mode);
 
         // Replace some symbols in file name.
         // Gmail can not load image if it contains spaces.
-        $file_name = preg_replace('/[ #]/', '-', $file_name);
+        $file_name = preg_replace('/[ #\/]/', '_', $file_name);
+        // Replace soft hyphens.
+        $file_name = str_replace(html_entity_decode('­'), '_', $file_name);
+
+        if (!$file_name) {
+            if (!$orig_extension) {
+                preg_match("/.*\/([^\/]+)$/", $mime_type, $m);
+                if (!empty($m[1])) {
+                    $orig_extension = $m[1];
+                }
+            }
+            $file_name = uniqid();
+            if ($orig_extension) {
+                $file_name .= '.'.$orig_extension;
+            }
+        }
+
+        // https://github.com/freescout-helpdesk/freescout/issues/2385
+        // Fix for webklex/php-imap.
+        if ($file_name == 'undefined' && $mime_type == 'message/rfc822') {
+            $file_name = 'RFC822.eml';
+        }
+
+        // https://github.com/freescout-helpdesk/freescout/issues/1412#issuecomment-1658881493
+        if ($file_name == 'undefined' && $mime_type == 'text/calendar') {
+            $file_name = 'calendar.ics';
+        }
+
+        if (strlen($file_name) > 255) {
+            $without_ext = pathinfo($file_name, PATHINFO_FILENAME);
+            $extension = pathinfo($file_name, PATHINFO_EXTENSION);
+            // 125 because file name may have unicode symbols.
+            $file_name = \Helper::substrUnicode($without_ext, 0, 125-strlen($extension)-1);
+            $file_name .= '.'.$extension;
+        }
 
         if (!$type) {
-            $type = self::detectType($mime_type);
+            $type = self::detectType($mime_type, $orig_extension);
         }
 
         $attachment = new self();
@@ -82,8 +129,24 @@ class Attachment extends Model
         $attachment->mime_type = $mime_type;
         $attachment->type = $type;
         $attachment->embedded = $embedded;
+        $attachment->token_type = self::TOKEN_TYPE_SHA256;
         $attachment->save();
 
+        $file_info = self::saveFileToDisk($attachment, $file_name, $content, $uploaded_file);
+
+        $attachment->file_dir = $file_info['file_dir'];
+        $attachment->size = self::getDisk()->size($file_info['file_path']);
+        $attachment->save();
+
+        return $attachment;
+    }
+
+    /**
+     * Save file to the disk and return file_dir.
+     * $content may be a resource pointing to the file in remote storage.
+     */
+    public static function saveFileToDisk($attachment, $file_name, $content, $uploaded_file)
+    {
         // Save file from content or copy file.
         // We have to keep file name as is, so if file exists we create extra folder.
         // Examples: 1/2/3
@@ -93,21 +156,29 @@ class Attachment extends Model
         do {
             $i++;
             $file_path = self::DIRECTORY.DIRECTORY_SEPARATOR.$file_dir.$i.DIRECTORY_SEPARATOR.$file_name;
-        } while (Storage::exists($file_path));
+        } while (self::getDisk()->exists($file_path));
 
         $file_dir .= $i.DIRECTORY_SEPARATOR;
 
-        if ($uploaded_file) {
-            $uploaded_file->storeAs(self::DIRECTORY.DIRECTORY_SEPARATOR.$file_dir, $file_name);
-        } else {
-            Storage::put($file_path, $content);
+        try {
+            if ($uploaded_file) {
+                $uploaded_file->storeAs(self::DIRECTORY.DIRECTORY_SEPARATOR.$file_dir, $file_name, self::getDiskName());
+            } else {
+                self::getDisk()->put($file_path, $content);
+            }
+        } catch (\Exception $e) {
+            \Helper::logException($e, '[Attachment::saveFileToDisk()]');
         }
 
-        $attachment->file_dir = $file_dir;
-        $attachment->size = Storage::size($file_path);
-        $attachment->save();
+        // $content may be a stream resource rather than a string; the SVG sanitizer needs
+        // actual string content, so let it re-read the just-written file in that case instead
+        // of treating the resource as file content.
+        \Helper::sanitizeUploadedFileData($file_path, is_resource($content) ? null : $content);
 
-        return $attachment;
+        return [
+            'file_dir'  => $file_dir,
+            'file_path' => $file_path,
+        ];
     }
 
     /**
@@ -149,13 +220,18 @@ class Attachment extends Model
      *
      * @return int
      */
-    public static function detectType($mime_type)
+    public static function detectType($mime_type, $extension = '')
     {
         if (preg_match("/^text\//", $mime_type)) {
             return self::TYPE_TEXT;
         } elseif (preg_match("/^message\//", $mime_type)) {
             return self::TYPE_MESSAGE;
         } elseif (preg_match("/^application\//", $mime_type)) {
+            // This is tricky mime type.
+            // For .mp4 mime type can be application/octet-stream
+            if (!empty($extension) && in_array(strtolower($extension), self::$type_extensions[self::TYPE_VIDEO])) {
+                return self::TYPE_VIDEO;
+            }
             return self::TYPE_APPLICATION;
         } elseif (preg_match("/^audio\//", $mime_type)) {
             return self::TYPE_AUDIO;
@@ -171,7 +247,7 @@ class Attachment extends Model
     }
 
     /**
-     * Conver type name to integer.
+     * Convert type name to integer.
      */
     public static function typeNameToInt($type_name)
     {
@@ -189,7 +265,55 @@ class Attachment extends Model
      */
     public function url()
     {
-        return Storage::url($this->getStorageFilePath());
+        $file_path = $this->getStorageFilePath();
+
+        // URL must contain only forward slashes.
+        $file_path = str_replace(DIRECTORY_SEPARATOR, '/', $file_path);
+
+        $file_url = self::getDisk()->url($file_path);
+
+        // Fix percents.
+        // https://github.com/freescout-helpdesk/freescout/issues/3530
+        $file_url = str_replace('%', '%25', $file_url);
+
+        return $file_url.'?id='.$this->id.'&token='.$this->getToken();
+    }
+
+    /**
+     * Get hashed security token for the attachment.
+     */
+    public function getToken()
+    {
+        // https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-89ww-mfww-5vr6
+        /*if ($this->token_type == self::TOKEN_TYPE_MD5) {
+            // Backward compatibility.
+            // \Hash::make() may contain . and / symbols which may cause problems.
+            return md5(config('app.key').$this->id.$this->size);
+        } else {*/
+
+        return hash_hmac('sha256', $this->id.$this->size.$this->file_name, config('app.key'));
+    }
+
+    /**
+     * Outputs the current Attachment as download
+     */
+    public function download($view = false, $headers = [])
+    {
+        // #533
+        //return self::getDisk()->download($this->getStorageFilePath(), \Str::ascii($this->file_name));
+        if ($view) {
+            $headers['Content-Disposition'] = '';
+        }
+        $file_name = $this->file_name;
+
+        if ($file_name == "RFC822"){
+            $file_name = $file_name.'.eml';
+        }
+
+        // Cache attachments in browser - 1 month.
+        $headers['Cache-Control'] = 'max-age=2592000';
+
+        return self::getDisk()->download($this->getStorageFilePath(), $file_name, $headers);
     }
 
     /**
@@ -202,14 +326,32 @@ class Attachment extends Model
         return self::formatBytes($this->size);
     }
 
+    /**
+     * attachment/...
+     */
     public function getStorageFilePath()
     {
         return self::DIRECTORY.DIRECTORY_SEPARATOR.$this->file_dir.$this->file_name;
     }
 
-    public function getLocalFilePath()
+    /**
+     * /var/html/storage/app/attachment/...
+     */
+    public function getLocalFilePath($full = true)
     {
-        return Storage::path(self::DIRECTORY.DIRECTORY_SEPARATOR.$this->file_dir.$this->file_name);
+        if ($full) {
+            return self::getDisk()->path(self::DIRECTORY.DIRECTORY_SEPARATOR.$this->file_dir.$this->file_name);
+        } else {
+            return DIRECTORY_SEPARATOR.'storage'.DIRECTORY_SEPARATOR.'app'.DIRECTORY_SEPARATOR.self::DIRECTORY.DIRECTORY_SEPARATOR.$this->file_dir.$this->file_name;
+        }
+    }
+
+    /**
+     * Check if the attachment file actually exists on the disk.
+     */
+    public function fileExists()
+    {
+        return self::getDisk()->exists(self::DIRECTORY.DIRECTORY_SEPARATOR.$this->file_dir.$this->file_name);
     }
 
     public static function formatBytes($size, $precision = 0)
@@ -260,7 +402,7 @@ class Attachment extends Model
     {
         // Delete from disk
         foreach ($attachments as $attachment) {
-            Storage::delete($attachment->getStorageFilePath());
+            self::getDisk()->delete($attachment->getStorageFilePath());
         }
 
         // Delete from DB
@@ -268,21 +410,113 @@ class Attachment extends Model
     }
 
     /**
-     * Generate dummy ID for attachment.
-     * Not used for now.
+     * Delete attachments and update Thread & Conversation.
      */
-    /*public static function genrateDummyId()
+    public static function deleteAttachments($attachments)
     {
-        if (!$this->id) {
-            // Math.random should be unique because of its seeding algorithm.
-            // Convert it to base 36 (numbers + letters), and grab the first 9 characters
-            // after the decimal.
-            $hash = mt_rand() / mt_getrandmax();
-            $hash = base_convert($hash, 10, 36);
-            $id = substr($hash, 2, 9);
-        } else {
-            $id = substr(md5($this->id), 0, 9);
+        if (!$attachments instanceof \Illuminate\Support\Collection) { 
+            $attachments = collect($attachments);
         }
-        return $id;
-    }*/
+
+        foreach ($attachments as $attachment) {
+            if ($attachment->thread_id && $attachment->thread
+                && count($attachment->thread->attachments) <= 1
+            ) {
+                $attachment->thread->has_attachments = false;
+                $attachment->thread->save();
+                // Update conversation.
+                $conversation = $attachment->thread->conversation;
+                foreach ($conversation->threads as $thread) {
+                    if ($thread->has_attachments) {
+                        break 2;
+                    }
+                }
+                $conversation->has_attachments = false;
+                $conversation->save();
+            }
+        }
+        Attachment::deleteForever($attachments);
+    }
+
+    /**
+     * Create a copy of the attachment and it's file.
+     */
+    public function duplicate($thread_id = null)
+    {
+        if (!$this->fileExists()) {
+            return null;
+        }
+
+        $new_attachment = $this->replicate();
+        
+        $new_attachment->thread_id = $thread_id;
+
+        $new_attachment->save();
+
+        try {
+            $content_stream = '';
+            $attachment_file = null;
+
+            if (\Helper::isLocalStorage()) {
+                $attachment_file = new \Illuminate\Http\UploadedFile(
+                    $this->getLocalFilePath(), $this->file_name,
+                    null, null, true
+                );
+            } else {
+                // File in remote storage.
+                $content_stream = $this->getFileStream();
+            }
+
+            $file_info = Attachment::saveFileToDisk($new_attachment, $new_attachment->file_name, $content_stream, $attachment_file);
+
+            if (!empty($file_info['file_dir'])) {
+                $new_attachment->file_dir = $file_info['file_dir'];
+                $new_attachment->save();
+            }
+        } catch (\Exception $e) {
+            \Helper::logException($e);
+        }
+
+        return $new_attachment;
+    }
+
+    public function getFileContents()
+    {
+        try {
+            return self::getDisk()->get($this->getStorageFilePath());
+        } catch (\Exception $e) {
+            // File not found at path:...
+            \Helper::logException($e, '[Attachment::getFileContents()]');
+            return '';
+        }
+    }
+
+    /**
+     * Same as getFileContents(), but as a stream instead of loading the whole
+     * file into memory - use this when the bytes are only being copied
+     * elsewhere (e.g. duplicating/forwarding an attachment).
+     */
+    public function getFileStream()
+    {
+        try {
+            return self::getDisk()->readStream($this->getStorageFilePath());
+        } catch (\Exception $e) {
+            \Helper::logException($e, '[Attachment::getFileStream()]');
+            return null;
+        }
+    }
+
+    public static function getDiskName()
+    {
+        if (\Helper::isLocalStorage()) {
+            return self::DISK;
+        } else {
+            return config('filesystems.default');
+        }
+    }
+
+    public static function getDisk()
+    {
+        return Storage::disk(self::getDiskName());
+    }
 }

app/Broadcasting/Broadcasters/PolycastBroadcaster.php

@@ -56,6 +56,10 @@ class PolycastBroadcaster extends Broadcaster
      */
     public function auth($request)
     {
+        if (!$request->user()) {
+            throw new AccessDeniedHttpException();
+        }
+
         // For connect request
         if (empty($request->channels)) {
             return true;
@@ -63,12 +67,9 @@ class PolycastBroadcaster extends Broadcaster
 
         // Check all channels
         foreach ($request->channels as $channel_name => $channel_info) {
-            // Copied from Illuminate\Broadcasting\Broadcasters\PusherBroadcaster
-            if (Str::startsWith($channel_name, ['private-', 'presence-']) &&
-                !$request->user()) {
 
-                throw new AccessDeniedHttpException();
-            }
+            // Copied from Illuminate\Broadcasting\Broadcasters\PusherBroadcaster
+            //if (Str::startsWith($channel_name, ['private-', 'presence-']) &&
 
             if (Str::startsWith($channel_name, ['private-', 'presence-'])) {
                 $channelName = Str::startsWith($channel_name, 'private-')

app/Console/Commands/AfterAppUpdate.php

@@ -40,5 +40,7 @@ class AfterAppUpdate extends Command
         $this->call('freescout:clear-cache');
         $this->call('migrate', ['--force' => true]);
         $this->call('queue:restart');
+
+        \Eventy::action('command.after_app_update');
     }
 }

app/Console/Commands/CheckRequirements.php

@@ -0,0 +1,63 @@
+<?php
+
+namespace App\Console\Commands;
+
+use Illuminate\Console\Command;
+
+class CheckRequirements extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'freescout:check-requirements';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'Check console version of PHP';
+
+    /**
+     * Create a new command instance.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+    }
+
+    /**
+     * Execute the console command.
+     *
+     * @return mixed
+     */
+    public function handle()
+    {
+        // PHP extensions.
+        $php_extensions = \Helper::checkRequiredExtensions();
+
+        $this->comment("PHP Version");
+        $this->line(' '.str_pad(phpversion(), 30, '.'). ' '.(version_compare(phpversion(), config('installer.core.minPhpVersion'), '>=') ? '<fg=green>OK</>' : '<fg=red>NOT FOUND</>'), false);
+
+        $this->comment("PHP Extensions");
+        $this->output($php_extensions);
+
+        // Functions.
+        $functions = \Helper::checkRequiredFunctions();
+
+        $this->comment("Functions");
+        $this->output($functions);
+        $this->line('');
+    }
+
+    public function output($items)
+    {
+        foreach ($items as $item => $status) {
+            $this->line(' '.str_pad($item, 30, '.'). ' '.($status ? '<fg=green>OK</>' : '<fg=red>NOT FOUND</>'), false);
+        }
+    }
+}

app/Console/Commands/CleanNotificationsTable.php

@@ -0,0 +1,48 @@
+<?php
+
+namespace App\Console\Commands;
+
+use Illuminate\Console\Command;
+
+class CleanNotificationsTable extends Command
+{
+    const PERIOD = '-6 months';
+
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'freescout:clean-notifications-table';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'Delete old read records from notifications table.';
+
+    /**
+     * Create a new command instance.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+    }
+
+    /**
+     * Execute the console command.
+     *
+     * @return mixed
+     */
+    public function handle()
+    {
+        \DB::table('notifications')->where('created_at', '<', \Carbon\Carbon::now()->modify(self::PERIOD))
+            ->whereNotNull('read_at')
+            ->delete();
+
+        $this->info('['.date('Y-m-d H:i:s').'] Deleted old read notifications for: '.self::PERIOD);
+    }
+}

app/Console/Commands/CleanSendLog.php

@@ -0,0 +1,46 @@
+<?php
+
+namespace App\Console\Commands;
+
+use Illuminate\Console\Command;
+
+class CleanSendLog extends Command
+{
+    const PERIOD = '-6 months';
+
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'freescout:clean-send-log';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'Delete old records from send log.';
+
+    /**
+     * Create a new command instance.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+    }
+
+    /**
+     * Execute the console command.
+     *
+     * @return mixed
+     */
+    public function handle()
+    {
+        $logs = \App\SendLog::where('created_at', '<', \Carbon\Carbon::now()->modify(self::PERIOD))->delete();
+
+        $this->info('['.date('Y-m-d H:i:s').'] Deleted send logs: '.self::PERIOD);
+    }
+}

app/Console/Commands/CleanTmp.php

@@ -0,0 +1,53 @@
+<?php
+
+namespace App\Console\Commands;
+
+use Illuminate\Console\Command;
+
+// When processing attachments FreeScout may create files in /tmp folder.
+// So it's good to clean this folder periodically.
+class CleanTmp extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'freescout:clean-tmp';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'Remove from system temp folder old FreeScout tempt files to avoid "No space left on device"';
+
+    /**
+     * Create a new command instance.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+    }
+
+    /**
+     * Execute the console command.
+     *
+     * @return mixed
+     */
+    public function handle()
+    {
+        // General cleaning.
+        // Remove 1 week old FreeScout files.
+        \Helper::shellExec('find '.\Helper::getTempDir().' -mtime +7 -type f -name '.\Helper::getTempFilePrefix().'* -exec rm -r -f {} \;');
+
+        // Remove temporary 1 day old SwiftMailer files.
+        // Example: /tmp/a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6/body
+        // https://github.com/freescout-help-desk/freescout/issues/5558
+        \Helper::shellExec('find '.\Helper::getTempDir().' -mtime +1 -type d -regextype posix-extended -regex ".*/[a-f0-9]{32}" -exec rm -r -f {} \;');
+
+        $this->comment("Done");
+    }
+}

app/Console/Commands/ClearCache.php

@@ -39,15 +39,47 @@ class ClearCache extends Command
     {
         $this->call('clear-compiled');
         $this->call('cache:clear');
+
+        // Remove files from /bootstrap/cache folder.
+        // https://github.com/freescout-help-desk/freescout/issues/4536
+        $files = new \Illuminate\Filesystem\Filesystem;
+        $files->delete($this->laravel->getCachedServicesPath());
+        $files->delete($this->laravel->getCachedPackagesPath());
+
         $this->call('view:clear');
         if ($this->option('doNotCacheConfig')) {
             $this->call('config:clear');
         } else {
             $this->call('config:cache');
+            // Laravel users `require` function to include config.php
+            // If opcache is being used for few seconds config.php is being cached.
+            if (function_exists('opcache_invalidate')) {
+                opcache_invalidate(app()->getCachedConfigPath());
+            }
         }
+
+        // In FreeScout routes caching does not increase performance
+        // but it increases memory consumption and may lead to problems
+        // during application updating or installing/updating modules.
+        // try {
+        //     $this->call('route:cache');
+        // } catch (\Exception $e) {
+        //     // Do nothing.
+        // }
+
+        // Clear JS and CSS builds (generated in prod environment).
+        \Helper::shellExec('find '.public_path('js/builds').' -type f -name "*.js" ! -name "vars.js" -exec rm -r -f {} \;');
+        \Helper::shellExec('find '.public_path('css/builds').' -type f -name "*.css" -exec rm -r -f {} \;');
+        $this->info("Cleared: JS and CSS builds");
+
         // Regenerate vars to get new data from .env
         if (!$this->option('doNotGenerateVars')) {
             $this->call('freescout:generate-vars');
         }
+
+        // This should not be done during installation.
+        if (\Helper::isInstalled()) {
+            \Helper::queueWorkerRestart();
+        }
     }
 }

app/Console/Commands/CreateUser.php

@@ -12,7 +12,7 @@ class CreateUser extends Command
      *
      * @var string
      */
-    protected $signature = 'freescout:create-user';
+    protected $signature = 'freescout:create-user {--role=} {--firstName=} {--lastName=} {--email=} {--password=}';
 
     /**
      * The console command description.
@@ -46,40 +46,57 @@ class CreateUser extends Command
             ).'.model'
         );
         $user = new $class();
-        $fillables = ['role', 'first_name', 'last_name', 'email', 'password'];
-        foreach ($fillables as $key => $fillable) {
-            if ($fillable == 'password') {
-                $user->$fillable = \Hash::make($this->secret(($key + 1).'/'.count($fillables)." User $fillable"));
-            } elseif ($fillable == 'role') {
-                $user->$fillable = $this->ask(($key + 1).'/'.count($fillables)." User $fillable (admin/user)", 'admin');
-                if (!$user->$fillable) {
-                    $user->$fillable = 'admin';
-                }
 
-                while (!in_array($user->$fillable, User::$roles)) {
-                    $this->error('Incorrect role');
-                    $user->$fillable = $this->ask('Please enter valid role');
-                }
-                $user->$fillable = array_flip(User::$roles)[$user->$fillable];
-            } else {
-                $user->$fillable = $this->ask(($key + 1).'/'.count($fillables)." User $fillable");
-
-                if ($fillable == 'email') {
-                    while (!filter_var($user->$fillable, FILTER_VALIDATE_EMAIL)) {
-                        $this->error('Incorrect email address');
-                        $user->$fillable = $this->ask('Please enter valid email address');
-                    }
-                }
+        $user->role = $this->option('role');
+        if ($user->role) {
+            if (!in_array($user->role, User::$roles)) {
+                $this->error('Invalid role');
+                return false;
+            }
+        } else {
+            $user->role = $this->ask('User role (admin/user)', 'admin');
+            while (!in_array($user->role, User::$roles)) {
+                $this->error('Invalid role');
+                $user->role = $this->ask('Please enter valid role');
             }
         }
+        $user->role = array_flip(User::$roles)[$user->role];
+
+        $user->first_name = $this->option('firstName') ? $this->option('firstName') : $this->ask('User first name');
+        $user->last_name = $this->option('lastName') ? $this->option('lastName') : $this->ask('User last name');
+
+        $user->email = $this->option('email');
+        if ($user->email) {
+            if (!filter_var($user->email, FILTER_VALIDATE_EMAIL)) {
+                $this->error('Invalid email address');
+                return false;
+            }
+        } else {
+            $user->email = $this->ask('User email address');
+            while (!filter_var($user->email, FILTER_VALIDATE_EMAIL)) {
+                $this->error('Incorrect email address');
+                $user->email = $this->ask('Please enter valid email address');
+            }
+        }
+
+        $user->password = \Hash::make($this->option('password') ? $this->option('password') : $this->secret('User password'));
+
         if ($this->confirm('Do you want to create the user?', true)) {
             if ($user->isAdmin()) {
                 $user->invite_state = User::INVITE_STATE_ACTIVATED;
             }
-            $user->save();
-            $this->info("User created (id: {$user->id})");
+
+            try {
+                $user->save();
+            } catch (\Exception $e) {
+                $this->line($e->getMessage());
+                $this->error('User already exists.');
+                return false;
+            }
         }
 
+        $this->info('User created with id: '.$user->id);
+
         return true;
     }
 }

app/Console/Commands/GenerateVars.php

@@ -49,24 +49,44 @@ class GenerateVars extends Command
             //$filesystem = new Filesystem();
 
             //$file_path = public_path('js/vars.js');
-            $file_path = storage_path('app/public/js/vars.js');
+            //$file_path = '/public/js/builds/vars.js';
+            $relative_path = 'js/builds/vars.js';
+            $file_path = public_path($relative_path);
 
             $content = view('js/vars', $params)->render();
 
-            //$filesystem->put($file_path, $content);
-            // Save vars only if content changed
+            // Escape quotes in json values.
+            // https://github.com/freescout-help-desk/freescout/issues/4369
+            $content = preg_replace_callback(
+                "#(:[ ]*\")(.*)(\"[,\r\n])#",
+                function ($v) {
+                    return $v[1].str_replace('"', '\"', $v[2]).$v[3];
+                },
+                $content
+            );
+
             try {
-                if (\Storage::exists('js/vars.js')) {
-                    $old_content = \Storage::get('js/vars.js');
+                if (!\File::exists(dirname($file_path))) {
+                    \File::makeDirectory(dirname($file_path), \Helper::DIR_PERMISSIONS);
+                }
+
+                // Save vars only if content has changed.
+                if (\File::exists($file_path)) {
+                    $old_content = \File::get($file_path);
                     if ($content != $old_content) {
-                        \Storage::put('js/vars.js', $content);
+                        \File::put($file_path, $content);
                     }
                 } else {
-                    \Storage::put('js/vars.js', $content);
+                    \File::put($file_path, $content);
                 }
-                $this->info("Created: ".substr($file_path, strlen(base_path())+1));
+
+                // Backward compatibility.
+                // Before vars.js was stored in /storage/app/public/js/vars.js
+                \Storage::put('js/vars.js', $content);
+
+                $this->info("Created: /".$relative_path);
             } catch (\Exception $e) {
-                $msg = "Error occured saving /storage/app/public/js/vars.js. ".\Helper::formatException($e);
+                $msg = "Error occurred saving $file_path. ".\Helper::formatException($e);
                 \Log::error($msg);
                 $this->error($msg);
             }

app/Console/Commands/LogoutUsers.php

@@ -0,0 +1,61 @@
+<?php
+
+namespace App\Console\Commands;
+
+use Illuminate\Console\Command;
+
+class LogoutUsers extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'freescout:logout-users';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'Logout all users';
+
+    /**
+     * Create a new command instance.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+    }
+
+    /**
+     * Execute the console command.
+     *
+     * @return mixed
+     */
+    public function handle()
+    {
+        try {
+            // Remove files from storage/frameworks/sessions
+            $files = \File::files(storage_path('framework/sessions'));
+            
+            $count = 0;
+
+            foreach ($files as $file) {
+                try {
+                    $deleted = \File::delete($file->getPathname());
+                    if ($deleted) {
+                        $count++;
+                    }
+                } catch (\Exception $e) {
+                    $this->error($e->getMessage());
+                }
+            }
+            $this->line('Deleted sessions: '.$count);
+        } catch (\Exception $e) {
+            $this->error($e->getMessage());
+        }
+    }
+}

app/Console/Commands/LogsMonitor.php

@@ -20,6 +20,35 @@ class LogsMonitor extends Command
      */
     protected $description = 'Send new log records by email';
 
+    /**
+     * Default minimum identical-error occurrences required for
+     * `fetch_errors` entries to be included in the digest. Used when
+     * the `alert_logs_fetch_min_occurrences` option is not set. The
+     * default is 1, which matches upstream behaviour (no filtering);
+     * raise it via the alerts settings page to suppress transient
+     * single-shot fetch errors.
+     */
+    const FETCH_ERRORS_MIN_OCCURRENCES_DEFAULT = 1;
+
+    /**
+     * Substrings that mark a `fetch_errors` row as transient. Rows
+     * matching any of these are dropped regardless of count, unless
+     * they appear at least the configured min-occurrences times.
+     */
+    const FETCH_ERRORS_TRANSIENT_PATTERNS = [
+        'connection setup failed',
+        'failed to fetch messages',
+        'failed to authenticate',
+        'Connection closed',
+        'Connection reset',
+        'Connection timed out',
+        'Connection refused',
+        'stream_socket_client',
+        'SSL operation failed',
+        'Temporary failure',
+        'no response',
+    ];
+
     /**
      * Create a new command instance.
      *
@@ -62,6 +91,8 @@ class LogsMonitor extends Command
             ->where('created_at', '<', $now->toDateTimeString())
             ->get();
 
+        $logs = $this->filterTransientFetchErrors($logs);
+
         if (!count($logs)) {
             $this->line('['.date('Y-m-d H:i:s').'] No new log records found for the last '.$options['alert_logs_period']);
 
@@ -72,18 +103,18 @@ class LogsMonitor extends Command
         $text = 'Logs having new records for the last '.$options['alert_logs_period'].':<ul>';
         foreach ($names as $name) {
             $text .= '<li>';
-            $text .= '<strong>'.\App\ActivityLog::getLogTitle($name).'</strong>';
+            $text .= '<strong>'.htmlspecialchars(\App\ActivityLog::getLogTitle($name)).'</strong>';
             $text .= '</li>';
         }
         $text .= '</ul>';
 
         foreach ($names as $name) {
-            $text .= '<br/><strong>'.\App\ActivityLog::getLogTitle($name).'</strong><br/>';
+            $text .= '<br/><strong>'.htmlspecialchars(\App\ActivityLog::getLogTitle($name)).'</strong><br/>';
             foreach ($logs as $log) {
                 if ($log->log_name != $name) {
                     continue;
                 }
-                $text .= '● ['.$log->created_at.'] '.$log->getEventDescription().' <code>'.$log->properties.'</code><br/>';
+                $text .= '● ['.$log->created_at.'] '.htmlspecialchars($log->getEventDescription()).' <code>'.htmlspecialchars($log->properties).'</code><br/>';
             }
         }
         // Send alert.
@@ -93,4 +124,87 @@ class LogsMonitor extends Command
 
         $this->info('['.date('Y-m-d H:i:s').'] Monitoring finished');
     }
+
+    /**
+     * Drop transient single-shot fetch errors. A fetch_errors row is
+     * considered transient when its error message matches one of the
+     * known transient patterns AND the same message appears fewer
+     * than the configured min-occurrences threshold within the window.
+     */
+    protected function filterTransientFetchErrors($logs)
+    {
+        $threshold = (int) \Option::get(
+            'alert_logs_fetch_min_occurrences',
+            self::FETCH_ERRORS_MIN_OCCURRENCES_DEFAULT
+        );
+
+        if ($threshold <= 1) {
+            return $logs;
+        }
+
+        $fetchLogName = \App\ActivityLog::NAME_EMAILS_FETCHING;
+
+        $counts = [];
+        foreach ($logs as $log) {
+            if ($log->log_name !== $fetchLogName) {
+                continue;
+            }
+            $key = $this->fetchErrorFingerprint($log);
+            $counts[$key] = ($counts[$key] ?? 0) + 1;
+        }
+
+        $kept = [];
+        $dropped = 0;
+        foreach ($logs as $log) {
+            if ($log->log_name === $fetchLogName) {
+                $message = $this->fetchErrorMessage($log);
+                if ($this->isTransientFetchError($message)) {
+                    $key = $this->fetchErrorFingerprint($log);
+                    if (($counts[$key] ?? 0) < $threshold) {
+                        $dropped++;
+                        continue;
+                    }
+                }
+            }
+            $kept[] = $log;
+        }
+
+        if ($dropped > 0) {
+            $this->line('['.date('Y-m-d H:i:s').'] Suppressed '.$dropped.' transient fetch_errors entries (threshold '.$threshold.')');
+        }
+
+        return collect($kept);
+    }
+
+    protected function fetchErrorMessage($log): string
+    {
+        $props = $log->properties;
+        if (is_object($props) && method_exists($props, 'toArray')) {
+            $props = $props->toArray();
+        } elseif (is_string($props)) {
+            $decoded = json_decode($props, true);
+            $props = is_array($decoded) ? $decoded : [];
+        }
+        return (string) ($props['error'] ?? '');
+    }
+
+    protected function fetchErrorFingerprint($log): string
+    {
+        $message = $this->fetchErrorMessage($log);
+        // Strip the trailing "; File: /path (line)" so the same error
+        // from different stack frames still groups together.
+        $message = preg_replace('/;\s*File:.*$/s', '', $message);
+        return trim($message);
+    }
+
+    protected function isTransientFetchError(string $message): bool
+    {
+        $lower = strtolower($message);
+        foreach (self::FETCH_ERRORS_TRANSIENT_PATTERNS as $needle) {
+            if (strpos($lower, strtolower($needle)) !== false) {
+                return true;
+            }
+        }
+        return false;
+    }
 }

app/Console/Commands/ModuleCheckLicenses.php

@@ -43,38 +43,60 @@ class ModuleCheckLicenses extends Command
 
         $this->info('Active modules found: '.count($modules));
 
+        $params = [
+            'url'          => \App\Module::getAppUrl(),
+            'data'          => [],
+        ];
+
         foreach ($modules as $module) {
             $license = $module->getLicense();
-
+        
             if (!$module->isOfficial() || !$license) {
                 continue;
             }
-            $params = [
-                'license'      => $license,
-                'module_alias' => $module->getAlias(),
-                'url'          => \App\Module::getAppUrl(),
-            ];
-            $result = WpApi::checkLicense($params);
-            if (!empty($result['status']) && $result['status'] != 'valid') {
-                $msg = 'Module '.$module->getName().' has been deactivated due to invalid license: '.json_encode($result);
 
-                $this->error($module->getName().': '.$msg);
+            $data['license'] = $license;
+            $data['module_alias'] = $module->getAlias();
 
-                // Deactive module
-                \App\Module::deactiveModule($module->getAlias(), true);
+            $params['data'][] = $data;
+        }
 
-                // Inform admin
-                \Log::error($msg);
-                activity()
-                    ->withProperties([
-                        'error'    => $msg,
-                     ])
-                    ->useLog(\App\ActivityLog::NAME_SYSTEM)
-                    ->log(\App\ActivityLog::DESCRIPTION_SYSTEM_ERROR);
-            } else {
-                $this->info($module->getName().': OK');
+        $result = WpApi::checkLicenses($params);
+
+        if (!empty($result['statuses'])) {
+            foreach ($modules as $module) {
+                $module_alias = $module->getAlias();
+
+                foreach ($result['statuses'] as $result_module_alias => $status) {
+                    if ($result_module_alias != $module_alias) {
+                        continue;
+                    }
+                    if (!empty($status) && $status != 'valid') {
+                        $msg = 'Module '.$module->getName().' has been deactivated due to invalid license: '.$status;
+
+                        $this->error($module->getName().': '.$msg);
+
+                        // Deactive module
+                        \App\Module::deactiveModule($module->getAlias(), true);
+
+                        // Inform admin
+                        \Log::error($msg);
+                        activity()
+                            ->withProperties([
+                                'error'    => $msg,
+                             ])
+                            ->useLog(\App\ActivityLog::NAME_SYSTEM)
+                            ->log(\App\ActivityLog::DESCRIPTION_SYSTEM_ERROR);
+                    } else {
+                        $this->info($module->getName().': OK');
+                    }
+                    continue 2;
+                }
+
+                $this->info($module->getName().': Unknown status');
             }
         }
+
         $this->info('Checking licenses finished');
     }
 }

app/Console/Commands/ModuleInstall.php

@@ -21,7 +21,7 @@ class ModuleInstall extends Command
      *
      * @var string
      */
-    protected $description = 'Install module or all modules (if module_alias is empty)';
+    protected $description = 'Install module or all modules (if module_alias is empty): run migrations and create a symlink';
 
     /**
      * Create a new command instance.
@@ -86,19 +86,53 @@ class ModuleInstall extends Command
         $this->call('freescout:clear-cache');
     }
 
+    // There is similar function in \App\Module.
     public function createModulePublicSymlink($module)
     {
         $from = public_path('modules').DIRECTORY_SEPARATOR.$module->alias;
         $to = $module->getExtraPath('Public');
 
-        if (file_exists($from)) {
-            return $this->info('Public symlink already exists');
-        }
-
+        // file_exists() may throw "open_basedir restriction in effect".
         try {
-            symlink($to, $from);
+            // If module's Public is symlink.
+            if (is_link($to)) {
+                @unlink($to);
+            }
+            
+            // Symlimk may exist but lead to the module folder in a wrong case.
+            // So we need first try to remove it.
+            if (!file_exists($from) || !is_link($from)) {
+                if (is_dir($from)) {
+                    @rename($from, $from.'_'.date('YmdHis'));
+                } else {
+                    @unlink($from);
+                }
+            }
+
+            if (file_exists($from)) {
+                return $this->info('Public symlink already exists');
+            }
+
+            // Check target.
+            if (!file_exists($to)) {
+                // Try to create Public folder.
+                try {
+                    \File::makeDirectory($to, \Helper::DIR_PERMISSIONS);
+                } catch (\Exception $e) {
+                    // If it's a broken symlink.
+                    if (is_link($to)) {
+                        @unlink($to);
+                    }
+                }
+            }
+
+            try {
+                symlink($to, $from);
+            } catch (\Exception $e) {
+                $this->error('Error occurred creating ['.$from.' » '.$to.'] symlink: '.$e->getMessage());
+            }
         } catch (\Exception $e) {
-            $this->error('Error occured creating ['.$from.'] symlink: '.$e->getMessage());
+            $this->error('Error occurred creating ['.$from.' » '.$to.'] symlink: '.$e->getMessage());
         }
 
         $this->info('The ['.$from.'] symlink has been created');

app/Console/Commands/ModuleLaroute.php

@@ -21,6 +21,12 @@ class ModuleLaroute extends Command
      */
     protected $description = 'Generate a laravel routes JS-file for a module or all modules (if module_alias is empty)';
 
+    public $routes;
+    
+    public $config;
+    
+    public $generator;
+
     /**
      * Create a new command instance.
      *

app/Console/Commands/ModuleMigrate.php

@@ -0,0 +1,96 @@
+<?php
+/**
+ * php artisan module:migrate modulename.
+ *
+ * Replaces the command from nwidart/laravel-modules, which passes the module's
+ * migrations folder to the migrate command after removing base_path() from it.
+ * Module::getPath() is a realpath(), so on installations where the Modules
+ * folder is a symlink leading outside of the application folder (a common
+ * container layout: /var/www/html/Modules -> /data/Modules) base_path() does
+ * not occur in that path. The value stays absolute, migrate prefixes
+ * base_path() to it anyway (Illuminate\Database\Console\Migrations\
+ * BaseCommand::getMigrationPaths()), the resulting folder does not exist and
+ * the migration reports "Nothing to migrate" with a zero exit code.
+ *
+ * https://github.com/freescout-help-desk/freescout/issues/5569
+ */
+
+namespace App\Console\Commands;
+
+use Nwidart\Modules\Commands\MigrateCommand;
+use Nwidart\Modules\Migrations\Migrator;
+use Nwidart\Modules\Module;
+
+class ModuleMigrate extends MigrateCommand
+{
+    /**
+     * Run the migrations of the specified module.
+     *
+     * @param Module $module
+     */
+    protected function migrate(Module $module)
+    {
+        $path = $this->getMigrationPath($module);
+
+        if ($this->option('subpath')) {
+            $path = $path.'/'.$this->option('subpath');
+        }
+
+        $this->call('migrate', [
+            '--path'     => $path,
+            '--database' => $this->option('database'),
+            '--pretend'  => $this->option('pretend'),
+            '--force'    => $this->option('force'),
+        ]);
+
+        if ($this->option('seed')) {
+            $this->call('module:seed', ['module' => $module->getName()]);
+        }
+    }
+
+    /**
+     * Get the module's migrations folder relative to base_path(), as the
+     * migrate command prepends base_path() to whatever --path receives.
+     *
+     * @param Module $module
+     *
+     * @return string
+     */
+    protected function getMigrationPath(Module $module)
+    {
+        $absolute_path = (new Migrator($module))->getPath();
+
+        $path = str_replace(base_path(), '', $absolute_path);
+
+        if ($path != $absolute_path) {
+            // The module is located inside of the application folder.
+            return $path;
+        }
+
+        // The module path is a realpath() leading outside of the application
+        // folder. Rebuild the path from the folder the module has been scanned
+        // from, which still contains the symlink and is therefore located
+        // inside of the application folder.
+        $module_path = $module->getPath();
+
+        if (method_exists($module, 'getScannedPath')
+            && $module_path
+            && strpos($absolute_path, $module_path) === 0
+        ) {
+            $scanned_path = str_replace(base_path(), '', $module->getScannedPath());
+            $scanned_path .= substr($absolute_path, strlen($module_path));
+
+            if (is_dir(base_path().DIRECTORY_SEPARATOR.$scanned_path)) {
+                return $scanned_path;
+            }
+        }
+
+        // Neither path is located inside of the application folder, so the
+        // migrate command can not resolve it. Tell the user instead of
+        // reporting "Nothing to migrate".
+        $this->error('Module migrations folder is located outside of the application folder: '.$absolute_path);
+        $this->error('Run "php artisan migrate" to apply the module migrations.');
+
+        return $path;
+    }
+}

app/Console/Commands/ModuleUpdate.php

@@ -0,0 +1,169 @@
+<?php
+/**
+ * php artisan freescout:module-install modulealias.
+ */
+
+namespace App\Console\Commands;
+
+use Illuminate\Console\Command;
+
+class ModuleUpdate extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'freescout:module-update {module_alias?}';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'Update all modules or a single module (if module_alias is set)';
+
+    /**
+     * Create a new command instance.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+    }
+
+    /**
+     * Execute the console command.
+     *
+     * @return mixed
+     */
+    public function handle()
+    {
+        $install_all = false;
+        $modules = [];
+
+        // We have to clear modules cache first to update modules cache
+        \Artisan::call('cache:clear');
+
+        // Create a symlink for the module (or all modules)
+        $module_alias = $this->argument('module_alias');
+        
+        $modules_directory = \WpApi::getModules();
+        if (\WpApi::$lastError) {
+            $this->error(__('Error occurred').': '.$lastError['message'].' ('.$lastError['code'].')');
+            return;
+        }
+
+        $installed_modules = \Module::all();
+
+        $counter = 0;
+        $found = false;
+        foreach ($modules_directory as $dir_module) {
+            // Update single module.
+            if ($module_alias && $dir_module['alias'] != $module_alias) {
+                continue;
+            }
+            
+            $found = true;
+
+            // Detect if new version is available.
+            foreach ($installed_modules as $module) {
+                if ($module->getAlias() != $dir_module['alias'] /*|| !$module->active()*/) {
+                    continue;
+                }
+                if (!empty($dir_module['version']) && version_compare($dir_module['version'], $module->get('version'), '>')) {
+
+                    $update_result = \App\Module::updateModule($dir_module['alias']);
+
+                    $this->info('['.$update_result['module_name'].' Module'.']');
+                    if ($update_result['status'] == 'success') {
+                        $this->line($update_result['msg_success']);
+                    } else {
+                        $msg = $update_result['msg'];
+                        if ($update_result['download_msg']) {
+                            $msg .= ' ('.$update_result['download_msg'].')';
+                        }
+                        $this->error('ERROR: '.$msg);
+                    }
+                    if (trim($update_result['output'])) {
+                        $this->line(preg_replace("#\n#", "\n> ", '> '.trim($update_result['output'])));
+                    }
+
+                    $counter++;
+                }
+            }
+        }
+
+        // Update custom modules.
+        // Loop through each installed module.
+        foreach ($installed_modules as $module) {
+            // Skip if the module is an official one
+            if (\App\Module::isOfficial($module->get('authorUrl'))) {
+                continue;
+            }
+
+            // Get the URL for the latest version of the module
+            $latest_version_number_url = $module->get('latestVersionUrl');
+            if (! $latest_version_number_url) {
+                continue;
+            }
+
+            // Create a new Guzzle HTTP client
+            $client = new \GuzzleHttp\Client();
+
+            try {
+                // Send a GET request to the latest version URL
+                $response = $client->request('GET', $latest_version_number_url, \Helper::setGuzzleDefaultOptions());
+
+                // Get the latest version number from the response body
+                $latest_version = trim((string) $response->getBody());
+
+                if (empty($latest_version)) {
+                    continue;
+                } else {
+                    // Get the current version of the module
+                    $current_version = $module->get('version');
+                }
+            } catch (\Exception $e) {
+                // If there's an exception, skip to the next iteration
+                continue;
+            }
+
+            // If the latest version is greater than the current version
+            if (version_compare($latest_version, $current_version, '>')) {
+                // Update the module
+                $update_result = \App\Module::updateModule($module->getAlias());
+
+                // Print the module name and status
+                $this->info('[' . $update_result['module_name'] . ' Module' . ']');
+                if ($update_result['status'] == 'success') {
+                    // If the update was successful, print the success message
+                    $this->line($update_result['msg_success']);
+                } else {
+                    // If the update failed, print the error message
+                    $msg = $update_result['msg'];
+                    if ($update_result['download_msg']) {
+                        $msg .= ' (' . $update_result['download_msg'] . ')';
+                    }
+                    $this->error('ERROR: ' . $msg);
+                }
+                // If there's any output from the update, print it
+                if (trim($update_result['output'])) {
+                    $this->line(preg_replace("#\n#", "\n> ", '> ' . trim($update_result['output'])));
+                }
+
+                // Increment the counter
+                $counter ++;
+            }
+        }
+
+        if ($module_alias && !$found) {
+            $this->error('Module with the following alias not found: '.$module_alias);
+        } elseif (!$counter) {
+            $this->line('All modules are up-to-date');
+        }
+
+        \Artisan::call('freescout:clear-cache');
+    }
+}

app/Console/Commands/ParseEml.php

@@ -0,0 +1,126 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Mailbox;
+use Webklex\PHPIMAP\IMAP;
+use Webklex\PHPIMAP\Message;
+use Illuminate\Console\Command;
+
+
+class ParseEml extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'freescout:parse-eml';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'Parse EML file';
+
+    /**
+     * Current mailbox.
+     *
+     * Used to process emails sent to multiple mailboxes.
+     */
+    public $mailbox;
+
+    /**
+     * Used to process emails sent to multiple mailboxes.
+     */
+    public $mailboxes;
+
+    public $extra_import = [];
+
+    /**
+     * Page size when requesting emails from mail server.
+     */
+    const PAGE_SIZE = 300;
+
+    /**
+     * Create a new command instance.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+    }
+
+    /**
+     * Execute the console command.
+     *
+     * @return mixed
+     */
+    public function handle()
+    {
+        $email = file_get_contents(storage_path('logs/email.eml'));
+
+        if (!str_contains($email, "\r\n")) {
+            $email = str_replace("\n", "\r\n", $email);
+        }
+
+        // $raw_header = substr($email, 0, strpos($email, "\r\n\r\n"));
+        // $raw_body = substr($email, strlen($raw_header)+4);
+
+        // $mailbox = Mailbox::find($this->option('mailbox'));
+
+        // //\Config::set('app.new_fetching_library', 'true');
+        // $client = \MailHelper::getMailboxClient($mailbox);
+        // $client->openFolder("INBOX");
+
+        // $message = Message::make(/*$this->option('uid')*/null, null, $client, $raw_header, $raw_body, [/*0 => "\\Seen"*/], IMAP::ST_UID);
+
+        $manager = new \Webklex\PHPIMAP\ClientManager([
+            // 'options' => [
+            //     "debug" => $_ENV["LIVE_MAILBOX_DEBUG"] ?? false,
+            // ],
+            // 'accounts' => [
+            //     'default' => [
+            //         'host'          => getenv("LIVE_MAILBOX_HOST"),
+            //         'port'          => getenv("LIVE_MAILBOX_PORT"),
+            //         'encryption'    => getenv("LIVE_MAILBOX_ENCRYPTION"),
+            //         'validate_cert' => getenv("LIVE_MAILBOX_VALIDATE_CERT"),
+            //         'username'      => getenv("LIVE_MAILBOX_USERNAME"),
+            //         'password'      => getenv("LIVE_MAILBOX_PASSWORD"),
+            //         'protocol'      => 'imap', //might also use imap, [pop3 or nntp (untested)]
+            //     ],
+            // ],
+        ]);
+        $message = \Webklex\PHPIMAP\Message::fromString($email);
+
+        $this->line('Headers: ');
+        $this->info($message->getHeader()->raw);
+        $this->line('From: ');
+        $this->info(json_encode($message->getFrom()[0] ?? [], JSON_UNESCAPED_UNICODE));
+        $this->line('Reply-To: ');
+        $this->info(json_encode($message->getReplyTo()[0] ?? [], JSON_UNESCAPED_UNICODE));
+        $this->line('In-Reply-To: ');
+        $this->info($message->getInReplyTo());
+        $this->line('References: ');
+        $this->info(json_encode(array_values(array_filter(preg_split('/[, <>]/', $message->getReferences() ?? ''))), JSON_UNESCAPED_UNICODE));
+        $this->line('Date: ');
+        $this->info($message->getDate());
+        $this->line('Subject: ');
+        $this->info($message->getSubject());
+        $this->line('Text Body: ');
+        $this->info($message->getTextBody());
+        $this->line('HTML Body: ');
+        $html_body = $message->getHTMLBody(false) ?? '';
+        $this->info($html_body);
+
+        $attachments = $message->getAttachments();
+        if (count($attachments)) {
+            $this->line('Attachments: ');
+            foreach ($attachments as $attachment) {
+                $this->info('— '.$attachment->getName().(strstr($html_body, 'cid:'.$attachment->id) ? ' (embedded)' : ''));
+            }
+        }
+    }
+}

app/Console/Commands/SendMonitor.php

@@ -0,0 +1,66 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Job;
+use Illuminate\Console\Command;
+
+class SendMonitor extends Command
+{
+    const CHECK_PERIOD = 12 * 3600; // 12 hours
+
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'freescout:send-monitor';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'Check if queue:work is processing emails queue and show an alert in the web interface if needed';
+
+    /**
+     * Create a new command instance.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+    }
+
+    /**
+     * Execute the console command.
+     *
+     * @return mixed
+     */
+    public function handle()
+    {
+        // Get SendReplyToCustomer jobs.
+        $pending_jobs = \App\Job::where('queue', 'emails')
+            ->where('payload', 'like', '{"displayName":"App\\\\\\\\Jobs\\\\\\\\SendReplyToCustomer"%')
+            ->where('available_at', '<', time() - self::CHECK_PERIOD)
+            ->exists();
+
+        // Check failed_jobs.
+        // No need - it can be done via Manage > Alerts > Logs Monitoring
+        // if (!$pending_jobs) {
+        //     $pending_jobs = \App\FailedJob::where('queue', 'emails')
+        //         ->where('payload', 'like', '{"displayName":"App\\\\\\\\Jobs\\\\\\\\SendReplyToCustomer"%')
+        //         ->where('created_at', '<', time() - self::CHECK_PERIOD)
+        //         ->exists();
+        // }
+
+        if ($pending_jobs) {
+            \Option::set('send_emails_problem', '1');
+            $this->error('['.date('Y-m-d H:i:s').'] There are problems with emails queue processing');
+        } else {
+            \Option::remove('send_emails_problem');
+            $this->info('['.date('Y-m-d H:i:s').'] Emails queue processing is working');
+        }
+    }
+}

app/Console/Commands/Update.php

@@ -55,7 +55,7 @@ class Update extends Command
                 \Updater::update();
                 $this->call('freescout:after-app-update');
             } catch (\Exception $e) {
-                $this->error('Error occured: '.$e->getMessage());
+                $this->error('Error occurred: '.$e->getMessage());
             }
         } else {
             $this->info('You have the latest version installed: '.config('app.version'));

app/Console/Kernel.php

@@ -22,6 +22,7 @@ class Kernel extends ConsoleKernel
 
     /**
      * Define the application's command schedule.
+     * If --no-interaction flag is set the script will not run 'queue:work' daemon.
      *
      * @param \Illuminate\Console\Scheduling\Schedule $schedule
      *
@@ -29,8 +30,11 @@ class Kernel extends ConsoleKernel
      */
     protected function schedule(Schedule $schedule)
     {
-        // Keep in mind that this function is also called on clearing cache.
-        
+        // https://github.com/freescout-helpdesk/freescout/issues/3970
+        if (!$this->isScheduleRun() && !\Helper::isRoute('system.cron')) {
+            return;
+        }
+
         // Remove failed jobs
         $schedule->command('queue:flush')
             ->weekly();
@@ -43,17 +47,35 @@ class Kernel extends ConsoleKernel
             ->everyMinute()
             ->withoutOverlapping();
 
+        $schedule->command('freescout:send-monitor')
+            // Every 10 minutes.
+            ->cron('*/10 * * * *')
+            ->withoutOverlapping();
+
         $schedule->command('freescout:update-folder-counters')
             ->hourly();
 
-        $schedule->command('freescout:module-check-licenses')
-            ->daily();
+        $app_key = config('app.key');
+        if ($app_key) {
+            $crc = crc32($app_key);
+            $schedule->command('freescout:module-check-licenses')
+                ->cron((int)($crc % 59).' '.(int)($crc % 23).' * * *');
+        }
 
         // Check if user finished viewing conversation.
         $schedule->command('freescout:check-conv-viewers')
             ->everyMinute()
             ->withoutOverlapping();
 
+        $schedule->command('freescout:clean-send-log')
+            ->monthly();
+
+        $schedule->command('freescout:clean-notifications-table')
+            ->weekly();
+
+        $schedule->command('freescout:clean-tmp')
+            ->daily();
+
         // Logs monitoring.
         $alert_logs_period = config('app.alert_logs_period');
         if (config('app.alert_logs') && $alert_logs_period) {
@@ -79,12 +101,71 @@ class Kernel extends ConsoleKernel
             }
         }
 
+        $fetch_unseen = (int)config('app.fetch_unseen');
+        $fetch_command_identifier = \Helper::getWorkerIdentifier('freescout:fetch-emails');
+        $fetch_command_name = 'freescout:fetch-emails'
+            . ' --identifier='.$fetch_command_identifier
+            . ' --unseen='.$fetch_unseen;
+
+        // Kill fetch commands running for too long.
+        // In shedule:run this code is executed every time $schedule->command() in this function is executed.
+        if (function_exists('shell_exec')) {
+            $fetch_command_pids = \Helper::getRunningProcesses($fetch_command_identifier);
+
+            // The name of the command here must be exactly the same as below!
+            // Otherwise long fetching will be killed and won't run longer than 1 mintue.
+            // $schedule->command() creates a new mutex, so we need to store mutex name in cache.
+            // $mutex_name = $schedule->command($fetch_command_name)
+            //     ->everyMinute() - this also need to be set
+            //     ->skip(function () {
+            //         return true;
+            //     })
+            //     ->mutexName();
+
+            $mutex_name = \Cache::get('fetch_mutex_name') ?? '';
+
+            // If there is no cache mutext but there are running fetch commands
+            // it means the mutex had expired after 'fetch_max_execution_time'
+            // and the existing command(s) is running longer than 'fetch_max_execution_time'.
+            if (count($fetch_command_pids) > 0 && !\Cache::get($mutex_name)) {
+                // Kill freescout:fetch-emails commands running for too long
+                shell_exec('kill '.implode(' | kill ', $fetch_command_pids));
+            } elseif (count($fetch_command_pids) == 0) {
+                // Make sure 'ps' command actually works.
+                $ps_works = \Helper::getRunningProcesses('schedule:run');
+
+                if (count($ps_works)) {
+                    // Previous freescout:fetch-emails may have been killed or errored and did not remove the mutex.
+                    // So here we are forcefully removing the mutex. Otherwise mutex will live for 24 hours.
+                    if (\Cache::has($mutex_name)) {
+                        \Cache::forget($mutex_name);
+
+                        // We could not remove the mutex from cache - something is wrong with permissions.
+                        if (\Cache::has($mutex_name)) {
+                            \Log::error('[schedule:run] Could not remove fetch mutex from cache (cache key: '.$mutex_name.'). Check file permissions.');
+                        }
+                    }
+                }
+            }
+        }
+
         // Fetch emails from mailboxes
-        $fetch_command = $schedule->command('freescout:fetch-emails')
-            ->withoutOverlapping()
+        $fetch_command = $schedule->command($fetch_command_name)
+            // withoutOverlapping() option creates a mutex in the cache
+            // which by default expires in 24 hours.
+            // So we are passing an 'expiresAt' parameter to withoutOverlapping() to
+            // prevent fetching from not being executed when fetching command by some reason
+            // does not remove the mutex from the cache.
+            ->withoutOverlapping($expiresAt = (int)config('app.fetch_max_execution_time') /* minutes */)
             ->sendOutputTo(storage_path().'/logs/fetch-emails.log');
 
         switch (config('app.fetch_schedule')) {
+            case Mail::FETCH_SCHEDULE_EVERY_TWO_MINUTES:
+                $fetch_command->cron('*/2 * * * *');
+                break;
+            case Mail::FETCH_SCHEDULE_EVERY_THREE_MINUTES:
+                $fetch_command->cron('*/3 * * * *');
+                break;
             case Mail::FETCH_SCHEDULE_EVERY_FIVE_MINUTES:
                 $fetch_command->everyFiveMinutes();
                 break;
@@ -104,26 +185,44 @@ class Kernel extends ConsoleKernel
                 $fetch_command->everyMinute();
                 break;
         }
+        \Cache::put('fetch_mutex_name', $fetch_command->mutexName(), (int)config('app.fetch_max_execution_time'));
 
         $schedule = \Eventy::filter('schedule', $schedule);
 
+        // If --no-daemonize flag is passed - do not run 'queue:work' daemon.
+        foreach ($_SERVER['argv'] ?? [] as $arg) {
+            if ($arg == '--no-interaction') {
+                return;
+            }
+        }
+
         // Command runs as subprocess and sets cache mutex. If schedule:run command is killed
         // subprocess does not clear the mutex and it stays in the cache until cache:clear is executed.
         // By default, the lock will expire after 24 hours.
 
+        $queue_work_params = Config('app.queue_work_params');
+        // Add identifier to avoid conflicts with other FreeScout instances on the same server.
+        $queue_work_params['--queue'] .= ','.\Helper::getWorkerIdentifier();
+
+        // $schedule->command('queue:work') command below has withoutOverlapping() option,
+        // which works via special mutex stored in the cache preventing several 'queue:work' to work at the same time.
+        // So when the cache is cleared the mutex indicating that the 'queue:work' is running is removed,
+        // and the second 'queue:work' command is launched by cron. When `artisan schedule:run` is executed it sees
+        // that there are two 'queue:work' processes running and kills them.
+        // After one minute 'queue:work' is executed by cron via `artisan schedule:run` and works in the background.
         if (function_exists('shell_exec')) {
-            $running_commands = $this->getRunningQueueProcesses();
+            $running_commands = \Helper::getRunningProcesses();
 
             if (count($running_commands) > 1) {
                 // Stop all queue:work processes.
                 // queue:work command is stopped by settings a cache key
-                \Helper::queueWorkRestart();
+                \Helper::queueWorkerRestart();
                 // Sometimes processes stuck and just continue running, so we need to kill them.
                 // Sleep to let processes stop.
                 sleep(1);
                 // Check processes again.
-                $worker_pids = $this->getRunningQueueProcesses();
-                
+                $worker_pids = \Helper::getRunningProcesses();
+
                 if (count($worker_pids) > 1) {
                     // Current process also has to be killed, as otherwise it "stucks"
                     // $current_pid = getmypid();
@@ -135,13 +234,31 @@ class Kernel extends ConsoleKernel
                     // }
                     shell_exec('kill '.implode(' | kill ', $worker_pids));
                 }
+            } elseif (count($running_commands) == 0) {
+                // Make sure 'ps' command actually works.
+                $ps_works = \Helper::getRunningProcesses('schedule:run');
+
+                if (count($ps_works)) {
+                    // Previous queue:work may have been killed or errored and did not remove the mutex.
+                    // So here we are forcefully removing the mutex.
+                    $mutex_name = $schedule->command('queue:work', $queue_work_params)
+                        ->skip(function () {
+                            return true;
+                        })
+                        ->mutexName();
+
+                    if (\Cache::has($mutex_name)) {
+                        \Cache::forget($mutex_name);
+
+                        // We could not remove the mutex from cache - something is wrong with permissions.
+                        if (\Cache::has($mutex_name)) {
+                            \Log::error('[schedule:run] Could not remove queue:work mutex from cache (cache key: '.$mutex_name.'). Check file permissions.');
+                        }
+                    }
+                }
             }
         }
 
-        $queue_work_params = Config('app.queue_work_params');
-        // Add identifier to avoid conflicts with other FreeScout instances on the same server.
-        $queue_work_params['--queue'] .= ','.\Helper::getWorkerIdentifier();
-
         $schedule->command('queue:work', $queue_work_params)
             ->everyMinute()
             ->withoutOverlapping()
@@ -149,26 +266,16 @@ class Kernel extends ConsoleKernel
     }
 
     /**
-     * Get pids of the queue:work processes.
-     * 
-     * @return [type] [description]
+     * This function is needed because every time $schedule->command() is executed
+     * the schedule() is executed also.
      */
-    protected function getRunningQueueProcesses()
+    public function isScheduleRun()
     {
-        $pids = [];
-
-        try {
-            $processes = preg_split("/[\r\n]/", shell_exec("ps aux | grep '".\Helper::getWorkerIdentifier()."'"));
-            foreach ($processes as $process) {
-                preg_match("/^[\S]+\s+([\d]+)\s+/", $process, $m);
-                if (!preg_match("/(sh \-c|grep )/", $process) && !empty($m[1])) {
-                    $pids[] = $m[1];
-                }
-            }
-        } catch (\Exception $e) {
-            // Do nothing
+        if (\Helper::isConsole()) {
+            return true;
+        } else {
+            return !empty($_SERVER['argv']) && in_array('schedule:run', $_SERVER['argv']);
         }
-        return $pids;
     }
 
     /**
@@ -180,6 +287,13 @@ class Kernel extends ConsoleKernel
     {
         $this->load(__DIR__.'/Commands');
 
+        // Swiftmailer uses $_SERVER['SERVER_NAME'] in transport_deps.php
+        // to set the host for EHLO command, if it is empty it uses [127.0.0.1].
+        // G Suite sometimes rejects emails with EHLO [127.0.0.1].
+        if (empty($_SERVER['SERVER_NAME'])) {
+            $_SERVER['SERVER_NAME'] = parse_url(config('app.url'), PHP_URL_HOST);
+        }
+
         require base_path('routes/console.php');
     }
 }

app/CustomerChannel.php

@@ -0,0 +1,58 @@
+<?php
+
+namespace App;
+
+use Illuminate\Database\Eloquent\Model;
+
+class CustomerChannel extends Model
+{
+    /**
+     * The table associated with the model.
+     *
+     * @var string
+     */
+    protected $table = 'customer_channel';
+
+    public $timestamps = false;
+
+    /**
+     * Cached communication channels.
+     */
+    public static $channels = null;
+
+    public function customer()
+    {
+        return $this->belongsTo('App\Customer');
+    }
+
+    public static function create($customer_id, $channel, $channel_id)
+    {
+        try {
+            $customer_channel = new self();
+            $customer_channel->customer_id = $customer_id;
+            $customer_channel->channel     = $channel;
+            $customer_channel->channel_id  = $channel_id;
+            $customer_channel->save();
+
+            return $customer_channel;
+        } catch (\Exception $e) {
+            // Already exists.
+            return null;
+        }
+    }
+
+    public function getChannelName()
+    {
+        return \Eventy::filter('channel.name', '', $this->channel);
+    }
+
+    public static function getChannels()
+    {
+        if (self::$channels !== null) {
+            return self::$channels;
+        } else {
+            self::$channels = \Eventy::filter('channels.list', []);
+            return self::$channels;
+        }
+    }
+}

app/Email.php

@@ -18,6 +18,8 @@ class Email extends Model
     const TYPE_HOME = 2;
     const TYPE_OTHER = 3;
 
+    const MAX_LENGTH = 191;
+
     public static $types = [
         self::TYPE_WORK  => 'work',
         self::TYPE_HOME  => 'home',
@@ -31,6 +33,14 @@ class Email extends Model
      */
     protected $guarded = ['id', 'customer_id'];
 
+    public function __construct(array $attributes = [])
+    {
+        if (!empty($attributes['email'])) {
+            $attributes['email'] = self::sanitizeLength($attributes['email']);
+        }
+        parent::__construct($attributes);
+    }
+
     /**
      * Get email's customer.
      */
@@ -52,7 +62,7 @@ class Email extends Model
         // Email validation is not recommended:
         // http://stackoverflow.com/questions/201323/using-a-regular-expression-to-validate-an-email-address/201378#201378
         // So we just check for @
-        if (!preg_match('/@/', $email)) {
+        if (!preg_match('/^.+@.+$/', $email ?? '')) {
             return false;
         }
         $email = filter_var($email, FILTER_SANITIZE_EMAIL);
@@ -69,4 +79,24 @@ class Email extends Model
     {
         return explode('@', $this->email)[0];
     }
+
+    public static function create($email, $customer_id, $type = self::TYPE_WORK)
+    {
+        try {
+            $email_obj = new Email();
+            $email_obj->email = $email;
+            $email_obj->type = array_key_exists($type, self::$types) ? $type : self::TYPE_WORK;
+            $email_obj->customer_id = $customer_id;
+            $email_obj->save();
+
+            return $email_obj;
+        } catch (\Exception $e) {
+            return null;
+        }
+    }
+
+    public static function sanitizeLength($email_address)
+    {
+        return substr($email_address, Email::MAX_LENGTH*(-1));
+    }
 }

app/Events/CustomerCreatedConversation.php

@@ -15,7 +15,7 @@ class CustomerCreatedConversation
      *
      * @return void
      */
-    public function __construct(Conversation $conversation, Thread $last_thread)
+    public function __construct(Conversation $conversation, $last_thread)
     {
         $this->conversation = $conversation;
         $this->last_thread = $last_thread;

app/Events/RealtimeChat.php

@@ -0,0 +1,111 @@
+<?php
+/**
+ * Fefresh chats list when new thread created in mailbox.
+ */
+namespace App\Events;
+
+use App\Conversation;
+use App\Mailbox;
+use Illuminate\Broadcasting\Channel;
+use Illuminate\Broadcasting\PrivateChannel;
+use Illuminate\Contracts\Broadcasting\ShouldBroadcastNow;
+use Illuminate\Queue\SerializesModels;
+
+class RealtimeChat implements ShouldBroadcastNow
+{
+    use SerializesModels;
+
+    /**
+     * The notification data.
+     *
+     * @var array
+     */
+    public $data = [];
+
+    /**
+     * Create a new event instance.
+     *
+     * @return void
+     */
+    public function __construct($data)
+    {
+        $this->data = $data;
+    }
+
+    /**
+     * Get the channels the event should broadcast on.
+     *
+     * @return Channel|array
+     */
+    public function broadcastOn()
+    {
+        return new \Illuminate\Broadcasting\Channel($this->channelName());
+    }
+
+    /**
+     * Get the data to broadcast.
+     *
+     * @return array
+     */
+    public function broadcastWith()
+    {
+        return $this->data;
+    }
+
+    /**
+     * Get the broadcast channel name for the event.
+     *
+     * @return string
+     */
+    protected function channelName()
+    {
+        if (!empty($this->data['mailbox_id'])) {
+            return 'chat.'.$this->data['mailbox_id'];
+        } else {
+            return 'chat.0';
+        }
+    }
+
+    /**
+     * Helper funciton.
+     */
+    public static function dispatchSelf($mailbox_id, $thread_id, $is_chat)
+    {
+        if (!\Helper::isChatModeAvailable()) {
+            return;
+        }
+        $notification_data = [
+            'mailbox_id' => $mailbox_id,
+            'thread_id'  => $thread_id,
+            'is_chat'    => (int)$is_chat,
+        ];
+        event(new \App\Events\RealtimeChat($notification_data));
+    }
+
+    public static function processPayload($payload)
+    {
+        $user = auth()->user();
+        $mailbox = Mailbox::rememberForever()->find($payload->mailbox_id);
+
+        // Check if user can listen to this event.
+        if (!$user || !$mailbox || !$user->can('viewCached', $mailbox)) {
+            return [];
+        }
+
+        // Chats are retrieved in the template.
+        $template_data = [
+            'mailbox' => $mailbox,
+        ];
+
+        $payload->chats_html = \View::make('mailboxes/partials/chat_list')->with($template_data)->render();
+
+        // Audio notification for chats.
+        if ((int)$payload->is_chat && $payload->thread_id) {
+            $payload->audio = [
+                'thread_id' => $payload->thread_id,
+            ];
+        }
+
+        return $payload;
+    }
+}

app/Events/RealtimeConvNewThread.php

@@ -88,30 +88,48 @@ class RealtimeConvNewThread implements ShouldBroadcastNow
     public static function processPayload($payload)
     {
         $user = auth()->user();
-        $mailbox = Mailbox::rememberForever()->find($payload->mailbox_id);
 
-        // Check if user can listen to this event.
-        if (!$user || !$mailbox || !$user->can('viewCached', $mailbox)) {
+        if (!$user) {
             return [];
         }
 
         $thread = Thread::find($payload->thread_id);
+
+        // Check if user can listen to this event.
+        // https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-w668-wq26-6c94
         if (!$thread) {
-            return $payload;
+            return [];
+        }
+
+        $conversation = $thread->conversation;
+
+        if (!$conversation) {
+            return [];
+        }
+
+        if (!$user->can('view', $conversation)) {
+            return [];
         }
 
         // Add thread html to the payload.
         $template_data = [
-            'conversation' => $thread->conversation,
-            'mailbox'      => $thread->conversation->mailbox,
+            'conversation' => $conversation,
+            'mailbox'      => $conversation->mailbox,
             'threads'      => [$thread],
         ];
 
         $payload->thread_html = \View::make('conversations/partials/threads')->with($template_data)->render();
-        $payload->conversation_user_id = $thread->conversation->user_id;
-        $payload->conversation_status = $thread->conversation->status;
-        $payload->conversation_status_class = Conversation::$status_classes[$thread->conversation->status];
-        $payload->conversation_status_icon = Conversation::$status_icons[$thread->conversation->status];
+        $payload->conversation_user_id = $conversation->user_id;
+        $payload->conversation_status = $conversation->status;
+        $payload->conversation_status_class = Conversation::$status_classes[$conversation->status];
+        $payload->conversation_status_icon = Conversation::$status_icons[$conversation->status];
+
+        // Audio notification for chats.
+        if ($conversation->isChat()) {
+            $payload->audio = [
+                'thread_id' => $thread->id,
+            ];
+        }
 
         return $payload;
     }

app/Events/RealtimeConvView.php

@@ -2,6 +2,7 @@
 
 namespace App\Events;
 
+use App\Conversation;
 use Illuminate\Broadcasting\Channel;
 //use Illuminate\Broadcasting\PrivateChannel;
 use Illuminate\Contracts\Broadcasting\ShouldBroadcastNow;
@@ -110,4 +111,18 @@ class RealtimeConvView implements ShouldBroadcastNow
         ];
         event(new \App\Events\RealtimeConvView($notification_data));
     }
+
+    // Check access.
+    public static function processPayload($payload)
+    {
+        $user = auth()->user();
+        $conversation = Conversation::find($payload->conversation_id);
+
+        // Check if user can listen to this event.
+        if (!$user || !$conversation || !$user->can('view', $conversation)) {
+            return [];
+        }
+
+        return $payload;
+    }
 }

app/Events/RealtimeConvViewFinish.php

@@ -4,6 +4,7 @@
  */
 namespace App\Events;
 
+use App\Conversation;
 use Illuminate\Broadcasting\Channel;
 use Illuminate\Broadcasting\PrivateChannel;
 use Illuminate\Contracts\Broadcasting\ShouldBroadcastNow;
@@ -59,4 +60,22 @@ class RealtimeConvViewFinish implements ShouldBroadcastNow
     {
         return 'conv';
     }
+
+    // Check access.
+    // $notification_data = [
+    //     'conversation_id' => $conversation_id,
+    //     'user_id'         => $user_id,
+    // ];
+    public static function processPayload($payload)
+    {
+        $user = auth()->user();
+        $conversation = Conversation::find($payload->conversation_id);
+
+        // Check if user can listen to this event.
+        if (!$user || !$conversation || !$user->can('view', $conversation)) {
+            return [];
+        }
+
+        return $payload;
+    }
 }

app/Events/RealtimeMailboxNewThread.php

@@ -70,10 +70,12 @@ class RealtimeMailboxNewThread implements ShouldBroadcastNow
     /**
      * Helper funciton.
      */
-    public static function dispatchSelf($mailbox_id)
+    public static function dispatchSelf($mailbox_id, $thread_id, $is_chat)
     {
         $notification_data = [
-            'mailbox_id'      => $mailbox_id
+            'mailbox_id' => $mailbox_id,
+            'thread_id'  => $thread_id,
+            'is_chat'    => (int)$is_chat,
         ];
         event(new \App\Events\RealtimeMailboxNewThread($notification_data));
     }
@@ -88,7 +90,11 @@ class RealtimeMailboxNewThread implements ShouldBroadcastNow
             return [];
         }
 
-        $folder = Folder::find(Conversation::getFolderParam());
+        $folder = null;
+        $foler_id = Conversation::getFolderParam();
+        if ($foler_id) {
+            $folder = Folder::find($foler_id);
+        }
         // Just in case.
         if (!$folder) {
             $folder = new Folder();
@@ -101,6 +107,13 @@ class RealtimeMailboxNewThread implements ShouldBroadcastNow
 
         $payload->folders_html = \View::make('mailboxes/partials/folders')->with($template_data)->render();
 
+        // Audio notification for chats.
+        if ((int)$payload->is_chat && $payload->thread_id) {
+            $payload->audio = [
+                'thread_id' => $payload->thread_id,
+            ];
+        }
+
         return $payload;
     }
 }

app/Events/UserCreatedConversation.php

@@ -15,7 +15,7 @@ class UserCreatedConversation
      *
      * @return void
      */
-    public function __construct(Conversation $conversation, Thread $last_thread)
+    public function __construct(Conversation $conversation, $last_thread)
     {
         $this->conversation = $conversation;
         $this->last_thread = $last_thread;

app/Events/UserMovedConversation.php

@@ -0,0 +1,28 @@
+<?php
+
+namespace App\Events;
+
+use App\Conversation;
+use App\Mailbox;
+use App\Thread;
+
+class UserMovedConversation
+{
+    public $conversation;
+    //public $last_thread;
+    public $caused_by_user_id;
+    public $from_mailbox;
+
+    /**
+     * Create a new event instance.
+     *
+     * @return void
+     */
+    public function __construct(Conversation $conversation, /*$last_thread,*/ $caused_by_user_id, Mailbox $from_mailbox)
+    {
+        $this->conversation = $conversation;
+        //$this->last_thread = $last_thread;
+        $this->caused_by_user_id = $caused_by_user_id;
+        $this->from_mailbox = $from_mailbox;
+    }
+}

app/FailedJob.php

@@ -10,4 +10,27 @@ class FailedJob extends Model
      * Automatically converted into Carbon dates.
      */
     protected $dates = ['failed_at'];
+
+	public $payload_decoded = null;
+
+    public function getPayloadDecoded()
+    {
+    	if ($this->payload_decoded !== null) {
+    		return $this->payload_decoded;
+    	}
+
+    	$this->payload_decoded = json_decode($this->payload, true);
+
+    	return $this->payload_decoded;
+    }
+
+    public function getCommand()
+    {
+    	return \App\Job::getPayloadCommand($this->getPayloadDecoded());
+    }
+
+    public static function retry($job_id)
+    {
+        \Artisan::call('queue:retry', ['id' => $job_id]);
+    }
 }

app/Folder.php

@@ -17,18 +17,18 @@ class Folder extends Model
     const TYPE_DRAFTS = 30;
     const TYPE_ASSIGNED = 40;
     const TYPE_CLOSED = 60;
+    const TYPE_DELETED = 70;
     const TYPE_SPAM = 80;
-    const TYPE_DELETED = 110;
 
     public static $types = [
         self::TYPE_UNASSIGNED => 'Unassigned',
         self::TYPE_MINE       => 'Mine',
+        self::TYPE_STARRED    => 'Starred',
         self::TYPE_DRAFTS     => 'Drafts',
         self::TYPE_ASSIGNED   => 'Assigned',
         self::TYPE_CLOSED     => 'Closed',
         self::TYPE_SPAM       => 'Spam',
         self::TYPE_DELETED    => 'Deleted',
-        self::TYPE_STARRED    => 'Starred',
     ];
 
     /**
@@ -152,7 +152,6 @@ class Folder extends Model
             case self::TYPE_STARRED:
                 $order_by[] = ['status' => 'asc'];
                 $order_by[] = ['last_reply_at' => 'desc'];
-                //$order_by = [['conversation_folder.id' => 'desc']];
                 break;
 
             case self::TYPE_DRAFTS:
@@ -161,6 +160,7 @@ class Folder extends Model
 
             case self::TYPE_CLOSED:
                 $order_by = [['closed_at' => 'desc']];
+                break;
 
             case self::TYPE_SPAM:
                 $order_by = [['last_reply_at' => 'desc']];
@@ -169,6 +169,30 @@ class Folder extends Model
             case self::TYPE_DELETED:
                 $order_by = [['user_updated_at' => 'desc']];
                 break;
+
+            default:
+                $order_by = \Eventy::filter('folder.conversations_order_by', $order_by, $this->type);
+                break;
+        }
+
+        // Process columns sorting.
+        $sorting = Conversation::getConvTableSorting();
+        if ($sorting['sort_by'] == 'date') {
+            if ($sorting['order'] != 'desc') {
+                foreach ($order_by as $block_i => $block) {
+                    foreach ($block as $field => $order) {
+                        if ($field == 'status') {
+                            unset($order_by[$block_i][$field]);
+                        } else {
+                            if ($order == 'desc') {
+                                $order_by[$block_i][$field] = 'asc';
+                            }
+                        }
+                    }
+                }
+            }
+        } else {
+            $order_by = [[$sorting['sort_by'] => $sorting['order']]];
         }
 
         return $order_by;
@@ -198,6 +222,17 @@ class Folder extends Model
     }
 
     public function updateCounters()
+    {
+        if (config('app.update_folder_counters_in_background')) {
+            if (!\Illuminate\Support\Facades\Cache::has("folder_update_lock_{$this->id}")) {
+                \App\Jobs\UpdateFolderCounters::dispatch($this);
+            }
+        } else {
+            $this->updateCountersNow();
+        }
+    }
+
+    public function updateCountersNow()
     {
         if (\Eventy::filter('folder.update_counters', false, $this)) {
             return;
@@ -205,8 +240,8 @@ class Folder extends Model
         if ($this->type == self::TYPE_MINE && $this->user_id) {
             $this->active_count = Conversation::where('user_id', $this->user_id)
                 ->where('mailbox_id', $this->mailbox_id)
-                ->where('status', Conversation::STATUS_ACTIVE)
                 ->where('state', Conversation::STATE_PUBLISHED)
+                ->where('status', Conversation::STATUS_ACTIVE)
                 ->count();
             $this->total_count = Conversation::where('user_id', $this->user_id)
                 ->where('mailbox_id', $this->mailbox_id)
@@ -248,7 +283,14 @@ class Folder extends Model
      */
     public function getCount($folders = [])
     {
-        if (\Eventy::filter('folder.counter', self::COUNTER_ACTIVE, $this, $folders) == self::COUNTER_TOTAL || $this->type == self::TYPE_STARRED || $this->type == self::TYPE_DRAFTS) {
+        $counter = \Eventy::filter('folder.counter', self::COUNTER_ACTIVE, $this, $folders);
+
+        $count = \Eventy::filter('folder.count', false, $this, $counter, $folders);
+        if ($count !== false) {
+            return $count;
+        }
+
+        if ($counter == self::COUNTER_TOTAL || $this->type == self::TYPE_STARRED || $this->type == self::TYPE_DRAFTS) {
             return $this->total_count;
         } else {
             return $this->getActiveCount($folders);
@@ -262,10 +304,14 @@ class Folder extends Model
     {
         $active_count = $this->active_count;
         if ($this->type == self::TYPE_ASSIGNED) {
-            if ($folders) {
-                $mine_folder = $folders->firstWhere('type', self::TYPE_MINE);
-            } else {
-                $mine_folder = $this->mailbox->folders()->where('type', self::TYPE_MINE)->first();
+            $mine_folder = \Eventy::filter('folder.active_count_mine_folder', null, $this, $folders);
+
+            if (!$mine_folder) {
+                if ($folders) {
+                    $mine_folder = $folders->firstWhere('type', self::TYPE_MINE);
+                } elseif ($this->mailbox_id) {
+                    $mine_folder = $this->mailbox->folders()->where('type', self::TYPE_MINE)->first();
+                }
             }
 
             if ($mine_folder) {
@@ -336,7 +382,77 @@ class Folder extends Model
         } elseif ($this->type == \App\Folder::TYPE_DELETED) {
             return 'user_updated_at';
         } else {
-            return'last_reply_at';
+            return 'last_reply_at';
+        }
+    }
+
+    public function url($mailbox_id)
+    {
+        return \Eventy::filter('folder.url', route('mailboxes.view.folder', ['id' => $mailbox_id, 'folder_id' => $this->id]), $mailbox_id, $this);
+    }
+
+    public static function create($data, $unique_per_user = true, $save = true)
+    {
+        if (!isset($data['mailbox_id']) || !isset($data['type'])) {
+            return null;
+        }
+        $folder = new Folder();
+        $folder->mailbox_id = $data['mailbox_id'];
+        $folder->type = $data['type'];
+
+        if (!empty($data['user_id'])) {
+            if ($unique_per_user) {
+                $user_folder = Folder::where('mailbox_id', $data['mailbox_id'])
+                    ->where('user_id', $data['user_id'])
+                    ->where('type', $data['type'])
+                    ->first();
+                // User folder already exists.
+                if ($user_folder) {
+                    return $user_folder;
+                }
+            }
+            $folder->user_id = $data['user_id'];
+        }
+
+        if ($save) {
+            $folder->save();
+        }
+
+        return $folder;
+    }
+
+    /**
+     * Get meta value.
+     */
+    public function getMeta($key, $default = null)
+    {
+        $metas = $this->meta;
+        if (isset($metas[$key])) {
+            return $metas[$key];
+        } else {
+            return $default;
+        }
+    }
+
+    /**
+     * Set meta value.
+     */
+    public function setMeta($key, $value)
+    {
+        $metas = $this->meta;
+        $metas[$key] = $value;
+        $this->meta = $metas;
+    }
+
+    /**
+     * Unset thread meta value.
+     */
+    public function unsetMeta($key)
+    {
+        $metas = $this->meta;
+        if (isset($metas[$key])) {
+            unset($metas[$key]);
+            $this->meta = $metas;
         }
     }
 }

app/Http/Controllers/Auth/ForgotPasswordController.php

@@ -4,6 +4,11 @@ namespace App\Http\Controllers\Auth;
 
 use App\Http\Controllers\Controller;
 use Illuminate\Foundation\Auth\SendsPasswordResetEmails;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Password;
+use Illuminate\Cache\RateLimiter;
+use Illuminate\Validation\ValidationException;
+use Illuminate\Auth\Events\Lockout;
 
 class ForgotPasswordController extends Controller
 {
@@ -20,6 +25,12 @@ class ForgotPasswordController extends Controller
 
     use SendsPasswordResetEmails;
 
+    // Max reset password attempts per period.
+    const THROTTLE_ATTEMPTS = 5;
+
+    // Minutes
+    const THROTTLE_PERIOD = 1;
+
     /**
      * Create a new controller instance.
      *
@@ -29,4 +40,73 @@ class ForgotPasswordController extends Controller
     {
         $this->middleware('guest');
     }
+
+    /**
+     * Send a reset link to the given user.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @return \Illuminate\Http\RedirectResponse|\Illuminate\Http\JsonResponse
+     */
+    public function sendResetLinkEmail(Request $request)
+    {
+        $this->validateEmail($request);
+
+        // https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-jvmv-2qcp-7855
+        if ($this->hasTooManyResetEmailAttempts($request)) {
+            event(new Lockout($request));
+            return $this->sendLockoutResponse($request);
+        }
+
+        // We will send the password reset link to this user. Once we have attempted
+        // to send the link, we will examine the response then see the message we
+        // need to show to the user. Finally, we'll send out a proper response.
+        $response = $this->broker()->sendResetLink(
+            $request->only('email')
+        );
+
+        if ($response == Password::RESET_LINK_SENT) {
+            $this->clearResetEmailAttempts($request);
+        } else {
+            $this->incrementResetEmailAttempts($request);
+        }
+
+        // For security purposes always return an identical response regardless of whether the email exists.
+        // return $response == Password::RESET_LINK_SENT
+        //             ? $this->sendResetLinkResponse($response)
+        //             : $this->sendResetLinkFailedResponse($request, $response);
+        return $this->sendResetLinkResponse(__('If an account exists for this email, you will receive a password reset link.'));
+    }
+
+    protected function hasTooManyResetEmailAttempts(Request $request)
+    {
+        return app(RateLimiter::class)->tooManyAttempts(
+            $this->throttleKey($request), 
+            self::THROTTLE_ATTEMPTS
+        );
+    }
+
+    protected function incrementResetEmailAttempts(Request $request)
+    {
+        app(RateLimiter::class)->hit(
+            $this->throttleKey($request), 
+            self::THROTTLE_PERIOD
+        );
+    }
+
+    protected function clearResetEmailAttempts(Request $request)
+    {
+        app(RateLimiter::class)->clear($this->throttleKey($request));
+    }
+
+    protected function throttleKey(Request $request)
+    {
+        return strtolower($request->ip()) . '|reset_email_password';
+    }
+
+    protected function sendLockoutResponse(Request $request)
+    {
+        throw ValidationException::withMessages([
+            'email' => [trans('auth.throttle', ['seconds' => self::THROTTLE_PERIOD*60])],
+        ])->status(423);
+    }
 }

app/Http/Controllers/Auth/LoginController.php

@@ -2,8 +2,10 @@
 
 namespace App\Http\Controllers\Auth;
 
+use Illuminate\Http\Request;
 use App\Http\Controllers\Controller;
 use Illuminate\Foundation\Auth\AuthenticatesUsers;
+use Illuminate\Validation\ValidationException;
 
 class LoginController extends Controller
 {
@@ -25,7 +27,9 @@ class LoginController extends Controller
      *
      * @var string
      */
-    protected $redirectTo = '/';
+    protected $redirectTo = '/home';
+
+    public $decayMinutes = 10; // minutes to lockout
 
     /**
      * Create a new controller instance.
@@ -36,4 +40,40 @@ class LoginController extends Controller
     {
         $this->middleware('guest')->except('logout');
     }
+
+    /**
+     * Handle a login request to the application.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @return \Illuminate\Http\RedirectResponse|\Illuminate\Http\Response|\Illuminate\Http\JsonResponse
+     */
+    public function login(Request $request)
+    {
+        $this->validateLogin($request);
+
+        // If the class is using the ThrottlesLogins trait, we can automatically throttle
+        // the login attempts for this application. We'll key this by the username and
+        // the IP address of the client making these requests into this application.
+        if ($this->hasTooManyLoginAttempts($request)) {
+            $this->fireLockoutEvent($request);
+
+            return $this->sendLockoutResponse($request);
+        }
+
+        $custom_errors = \Eventy::filter('login.custom_check', [], $request);
+        if ($custom_errors) {
+            throw ValidationException::withMessages($custom_errors);
+        }
+
+        if ($this->attemptLogin($request)) {
+            return $this->sendLoginResponse($request);
+        }
+
+        // If the login attempt was unsuccessful we will increment the number of attempts
+        // to login and redirect the user back to the login form. Of course, when this
+        // user surpasses their maximum number of attempts they will get locked out.
+        $this->incrementLoginAttempts($request);
+
+        return $this->sendFailedLoginResponse($request);
+    }
 }

app/Http/Controllers/Auth/ResetPasswordController.php

@@ -4,6 +4,14 @@ namespace App\Http\Controllers\Auth;
 
 use App\Http\Controllers\Controller;
 use Illuminate\Foundation\Auth\ResetsPasswords;
+use Illuminate\Support\Str;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Auth\Events\PasswordReset;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Password;
+use Illuminate\Cache\RateLimiter;
+use Illuminate\Validation\ValidationException;
+use Illuminate\Auth\Events\Lockout;
 
 class ResetPasswordController extends Controller
 {
@@ -20,6 +28,12 @@ class ResetPasswordController extends Controller
 
     use ResetsPasswords;
 
+    // Max reset password attempts per period.
+    const THROTTLE_ATTEMPTS = 5;
+
+    // Minutes
+    const THROTTLE_PERIOD = 1;
+
     /**
      * Where to redirect users after resetting their password.
      *
@@ -36,4 +50,97 @@ class ResetPasswordController extends Controller
     {
         $this->middleware('guest');
     }
+
+    /**
+     * Reset the given user's password.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @return \Illuminate\Http\RedirectResponse|\Illuminate\Http\JsonResponse
+     */
+    public function reset(Request $request)
+    {
+        $this->validate($request, $this->rules(), $this->validationErrorMessages());
+
+        if ($this->hasTooManyResetAttempts($request)) {
+            event(new Lockout($request));
+            return $this->sendLockoutResponse($request);
+        }
+
+        // Here we will attempt to reset the user's password. If it is successful we
+        // will update the password on an actual user model and persist it to the
+        // database. Otherwise we will parse the error and return the response.
+        $response = $this->broker()->reset(
+            $this->credentials($request), function ($user, $password) {
+                $this->resetPassword($user, $password);
+            }
+        );
+
+        if ($response == Password::PASSWORD_RESET) {
+            $this->clearResetAttempts($request);
+        } else {
+            $this->incrementResetAttempts($request);
+            // When user not found and token is invalid return same error for security reasons.
+            $response = Password::INVALID_USER;
+        }
+
+        // If the password was successfully reset, we will redirect the user back to
+        // the application's home authenticated view. If there is an error we can
+        // redirect them back to where they came from with their error message.
+        return $response == Password::PASSWORD_RESET
+                    ? $this->sendResetResponse($response)
+                    : $this->sendResetFailedResponse($request, $response);
+    }
+
+    /**
+     * Reset the given user's password.
+     *
+     * @param  \Illuminate\Contracts\Auth\CanResetPassword  $user
+     * @param  string  $password
+     * @return void
+     */
+    protected function resetPassword($user, $password)
+    {
+        $user->password = Hash::make($password);
+
+        $user->setRememberToken(Str::random(60));
+
+        $user->save();
+
+        event(new PasswordReset($user));
+
+        //$this->guard()->login($user);
+    }
+
+    protected function hasTooManyResetAttempts(Request $request)
+    {
+        return app(RateLimiter::class)->tooManyAttempts(
+            $this->throttleKey($request), 
+            self::THROTTLE_ATTEMPTS
+        );
+    }
+
+    protected function incrementResetAttempts(Request $request)
+    {
+        app(RateLimiter::class)->hit(
+            $this->throttleKey($request), 
+            self::THROTTLE_PERIOD
+        );
+    }
+
+    protected function clearResetAttempts(Request $request)
+    {
+        app(RateLimiter::class)->clear($this->throttleKey($request));
+    }
+
+    protected function throttleKey(Request $request)
+    {
+        return strtolower($request->ip()) . '|reset_password';
+    }
+
+    protected function sendLockoutResponse(Request $request)
+    {
+        throw ValidationException::withMessages([
+            'email' => [trans('auth.throttle', ['seconds' => self::THROTTLE_PERIOD*60])],
+        ])->status(423);
+    }
 }

app/Http/Controllers/CustomersController.php

@@ -23,10 +23,12 @@ class CustomersController extends Controller
     /**
      * Edit customer.
      */
-    public function update($id)
+    public function update(Request $request, $id)
     {
         $customer = Customer::findOrFail($id);
 
+        $this->checkLimitVisibility($customer);
+
         $customer_emails = $customer->emails;
         if (count($customer_emails)) {
             foreach ($customer_emails as $row) {
@@ -56,6 +58,8 @@ class CustomersController extends Controller
         $customer = Customer::findOrFail($id);
         $flash_message = '';
 
+        $this->checkLimitVisibility($customer);
+
         // First name or email must be specified
         $validator = Validator::make($request->all(), [
             'first_name' => 'nullable|string|max:255|required_without:emails.0',
@@ -67,12 +71,26 @@ class CustomersController extends Controller
             //'emails'     => 'array|required_without:first_name',
             //'emails.1'   => 'nullable|email|required_without:first_name',
             'emails.*'   => 'nullable|email|distinct|required_without:first_name',
+            'photo_url'   => 'nullable|image|mimes:jpeg,png,jpg,gif',
         ]);
         $validator->setAttributeNames([
-            //'emails.1'   => __('Email'),
+            'photo_url'   => __('Photo'),
             'emails.*'   => __('Email'),
         ]);
 
+        // Photo
+        $validator->after(function ($validator) use ($customer, $request) {
+            if ($request->hasFile('photo_url')) {
+                $path_url = $customer->savePhoto($request->file('photo_url')->getRealPath() ?: $request->file('photo_url')->getPathname(), $request->file('photo_url')->getMimeType());
+
+                if ($path_url) {
+                    $customer->photo_url = $path_url;
+                } else {
+                    $validator->errors()->add('photo_url', __('Error occurred processing the image. Make sure that PHP GD extension is enabled.'));
+                }
+            }
+        });
+
         if ($validator->fails()) {
             return redirect()->route('customers.update', ['id' => $id])
                         ->withErrors($validator)
@@ -95,6 +113,17 @@ class CustomersController extends Controller
         foreach ($new_emails as $new_email) {
             $email = Email::where('email', $new_email)->first();
             if ($email && $email->customer) {
+                // Prevent pulling in an out-of-scope customer by attaching one
+                // of that customer's emails to the current profile.
+                if ($email->customer_id !== $customer->id) {
+                    if (!$this->checkLimitVisibility($email->customer, true)) {
+                        $validator->errors()->add('email', __('The specified email belongs to a customer from an inaccessible mailbox.'));
+                        return redirect()->route('customers.update', ['id' => $id])
+                                    ->withErrors($validator)
+                                    ->withInput();
+                    }
+                }
+
                 // If customer whose email is removed does not have first name and other emails
                 // we have to create first name for this customer
                 if (!$email->customer->first_name && count($email->customer->emails) == 1) {
@@ -112,12 +141,12 @@ class CustomersController extends Controller
                     'email'           => $email->email,
                     'tag_email_begin' => '<strong>',
                     'tag_email_end'   => '</strong>',
-                    'customer'        => $email->customer->getFullName(),
-                    'a_begin'         => '<strong><a href="'.$email->customer->url().'" target="_blank">',
+                    'customer'        => htmlspecialchars($email->customer->getFullName()),
+                    'a_begin'         => '<strong><a href="'.$email->customer->url().'">',
                     'a_end'           => '</a></strong>',
                 ]).' ';
 
-                $new_emails_change_customer[] = $email->email;
+                $new_emails_change_customer[] = $email;
             }
         }
 
@@ -128,26 +157,46 @@ class CustomersController extends Controller
             }
         }
 
-        $customer->fill($request->all());
-        // Websites
-        if (!empty($request->websites)) {
-            $customer->setWebsites($request->websites);
+        $request_data = $request->all();
+
+        if (isset($request_data['photo_url'])) {
+            unset($request_data['photo_url']);
         }
+        $nonfillable_fields = [
+            'channel',
+            'channel_id',
+        ];
+        foreach ($nonfillable_fields as $field) {
+            if (isset($request_data[$field])) {
+                unset($request_data[$field]);
+            }
+        }
+
+        $customer->setData($request_data);
+        // Websites
+        // if (!empty($request->websites)) {
+        //     $customer->setWebsites($request->websites);
+        // }
         $customer->save();
 
         $customer->syncEmails($request->emails);
 
-        // Update customer_id in all conversations to the current customer
+        // Update customer_id in all conversations added to the current customer.
         foreach ($new_emails_change_customer as $new_email) {
-            $conversations_to_change_customer = Conversation::where('customer_email', $new_email)->get();
+            if ($new_email->customer_id) {
+                $conversations_to_change_customer = Conversation::where('customer_id', $new_email->customer_id)->get();
+            } else {
+                // This does not work for phone conversations.
+                $conversations_to_change_customer = Conversation::where('customer_email', $new_email->email)->get();
+            }
             foreach ($conversations_to_change_customer as $conversation) {
                 // We have to pass user to create line item and let others know that customer has changed.
                 // Conversation may be even in other mailbox where user does not have an access.
-                $conversation->changeCustomer($new_email, $customer, auth()->user());
+                $conversation->changeCustomer($new_email->email, $customer, auth()->user());
             }
         }
 
-        // Update customer in conversations for removed emails
+        // Update customer in conversations for emails removed from current customer.
         foreach ($removed_emails as $removed_email) {
             $email = Email::where('email', $removed_email)->first();
             if ($email) {
@@ -158,41 +207,29 @@ class CustomersController extends Controller
             }
         }
 
+        \Eventy::action('customer.updated', $customer);
+
         $flash_message = __('Customer saved successfully.').' '.$flash_message;
         \Session::flash('flash_success_unescaped', $flash_message);
+        
+        \Session::flash('customer.updated', 1);
 
         return redirect()->route('customers.update', ['id' => $id]);
     }
 
-    /**
-     * User mailboxes.
-     */
-    public function permissions($id)
+    public function checkLimitVisibility($customer, $return_result = false)
     {
-        $user = User::findOrFail($id);
-        $this->authorize('update', $user);
+        $user = auth()->user();
+        
+        if (!$user->can('view', $customer)) {
+            if (!$return_result) {
+                \Helper::denyAccess();
+            } else {
+                return false;
+            }
+        }
 
-        $mailboxes = Mailbox::all();
-
-        return view('users/permissions', ['user' => $user, 'mailboxes' => $mailboxes, 'user_mailboxes' => $user->mailboxes]);
-    }
-
-    /**
-     * Save user permissions.
-     *
-     * @param int                      $id
-     * @param \Illuminate\Http\Request $request
-     */
-    public function permissionsSave($id, Request $request)
-    {
-        $user = User::findOrFail($id);
-        $this->authorize('update', $user);
-
-        $user->mailboxes()->sync($request->mailboxes);
-
-        \Session::flash('flash_success', __('Permissions saved successfully'));
-
-        return redirect()->route('users.permissions', ['id' => $id]);
+        return true;
     }
 
     /**
@@ -204,10 +241,20 @@ class CustomersController extends Controller
     {
         $customer = Customer::findOrFail($id);
 
-        $conversations = $customer->conversations()
+        $this->checkLimitVisibility($customer);
+
+        $query = $customer->conversations()
             ->where('customer_id', $customer->id)
-            ->orderBy('created_at', 'desc')
-            ->paginate(Conversation::DEFAULT_LIST_SIZE);
+            ->whereIn('mailbox_id', auth()->user()->mailboxesIdsCanView())
+            ->orderBy('created_at', 'desc');
+
+        $user = auth()->user();
+
+        if ($user->canSeeOnlyAssignedConversations()) {
+            $query->where('user_id', '=', $user->id);
+        }
+
+        $conversations = $query->paginate(Conversation::DEFAULT_LIST_SIZE);
 
         return view('customers/conversations', [
             'customer'      => $customer,
@@ -227,6 +274,9 @@ class CustomersController extends Controller
 
         $q = $request->q;
 
+        $user = auth()->user();
+        $limited_visibility = config('app.limit_user_customer_visibility') && !$user->isAdmin();
+
         $join_emails = false;
         if ($request->search_by == 'all' || $request->search_by == 'email' || $request->exclude_email) {
             $join_emails = true;
@@ -234,7 +284,12 @@ class CustomersController extends Controller
 
         $select_list = ['customers.id', 'first_name', 'last_name'];
         if ($join_emails) {
-            $select_list[] = 'emails.email';
+            if ($limited_visibility) {
+                // https://github.com/freescout-help-desk/freescout/issues/5032
+                $select_list[] = \DB::raw('MAX('.\DB::getTablePrefix().'emails.email)');
+            } else {
+                $select_list[] = 'emails.email';
+            }
         }
         if ($request->show_fields == 'phone') {
             $select_list[] = 'phones';
@@ -249,18 +304,36 @@ class CustomersController extends Controller
             }
         }
 
-        if ($request->search_by == 'all' || $request->search_by == 'email') {
-            $customers_query->where('emails.email', 'like', '%'.$q.'%');
-        }
-        if ($request->exclude_email) {
-            $customers_query->where('emails.email', '<>', $request->exclude_email);
-        }
-        if ($request->search_by == 'all' || $request->search_by == 'name') {
-            $customers_query->orWhere('first_name', 'like', '%'.$q.'%')
-                ->orWhere('last_name', 'like', '%'.$q.'%');
-        }
-        if ($request->search_by == 'phone') {
-            $customers_query->where('customers.phones', 'like', '%'.$q.'%');
+        $customers_query->where(function ($query) use ($q, $request) {
+            if ($request->search_by == 'all' || $request->search_by == 'email') {
+                $query->where('emails.email', 'like', '%'.$q.'%');
+            }
+            if ($request->exclude_email) {
+                $query->where('emails.email', '<>', $request->exclude_email);
+            }
+            if ($request->exclude_id) {
+                $query->where('customers.id', '<>', $request->exclude_id);
+            }
+            if ($request->search_by == 'all' || $request->search_by == 'name') {
+                $query->orWhere('first_name', 'like', '%'.$q.'%')
+                    ->orWhere('last_name', 'like', '%'.$q.'%')
+                    ->orWhere(\Helper::isPgSql() ? \DB::raw('(first_name || \' \' || last_name)') : \DB::raw('CONCAT(first_name, " ", last_name)'), 'like', '%'.$q.'%');
+            }
+            if ($request->search_by == 'phone') {
+                $phone_numeric = \Helper::phoneToNumeric($q);
+                if (!$phone_numeric) {
+                    $phone_numeric = $q;
+                }
+                $query->where('customers.phones', 'like', '%'.$phone_numeric.'%');
+            }
+        });
+
+        if ($limited_visibility) {
+            $mailbox_ids = $user->mailboxesIdsCanView();
+            
+            $customers_query->join('conversations', 'conversations.customer_id', '=', 'customers.id');
+            $customers_query->whereIn('conversations.mailbox_id', $mailbox_ids);
+            $customers_query->groupby('customers.id');
         }
 
         $customers = $customers_query->paginate(20);
@@ -281,7 +354,8 @@ class CustomersController extends Controller
                         // Get phone which matches
                         $phones = $customer->getPhones();
                         foreach ($phones as $phone) {
-                            if (strstr($phone['value'], $q)) {
+                            $phone_numeric = \Helper::phoneToNumeric($q);
+                            if (strstr($phone['value'], $q) || strstr($phone['n'] ?? '', $phone_numeric)) {
                                 $text = $phone['value'];
                                 if ($customer->getFullName()) {
                                     $text .= ' — '.$customer->getFullName();
@@ -303,7 +377,8 @@ class CustomersController extends Controller
                 if (!empty($request->use_id)) {
                     $id = $customer->id;
                 } else {
-                    $id = $customer->email;
+                    // https://github.com/freescout-helpdesk/freescout/issues/4057
+                    $id = $customer->email ?? $customer->getMainEmail();
                 }
             }
             $response['results'][] = [
@@ -331,42 +406,117 @@ class CustomersController extends Controller
 
         switch ($request->action) {
 
-            // Change conversation user
+            // Change conversation customer.
             case 'create':
-                // First name or email must be specified
-                $validator = Validator::make($request->all(), [
+                $validator_config = [
                     'first_name' => 'required|string|max:255',
                     'last_name'  => 'nullable|string|max:255',
                     'email'      => 'required|email|unique:emails,email',
-                ]);
+                ];
+
+                $limited_visibility = config('app.limit_user_customer_visibility') && !$user->isAdmin();
+                if ($limited_visibility) {
+                    $validator_config['email'] = 'required|email';
+                }
+
+                // First name or email must be specified.
+                $validator = Validator::make($request->all(), $validator_config);
 
                 if ($validator->fails()) {
-                    foreach ($validator->errors()->getMessages()as $errors) {
+                    foreach ($validator->errors()->getMessages() as $errors) {
                         foreach ($errors as $field => $message) {
                             $response['msg'] .= $message.' ';
                         }
                     }
                 }
 
+                if (!$response['msg'] && $limited_visibility) {
+                    $existing_email = Email::where('email', $request->email)->first();
+
+                    if ($existing_email
+                        && $existing_email->customer
+                        && !$user->can('view', $existing_email->customer)
+                    ) {
+                        $response['msg'] .= __('The specified email belongs to a customer from an inaccessible mailbox.');
+                    }
+                }
+
                 if (!$response['msg']) {
-                   
                     $customer = Customer::create($request->email, $request->all());
                     if ($customer) {
+                        session()->put('user_created_customer', $customer->id);
+
                         $response['email']  = $request->email;
                         $response['status'] = 'success';
                     }
                 }
                 break;
 
+            // Conversations navigation
+            case 'customers_pagination':
+            
+                $customers = app('App\Http\Controllers\ConversationsController')->searchCustomers($request, $user);
+
+                $response['status'] = 'success';
+
+                $response['html'] = view('customers/partials/customers_table', [
+                    'customers' => $customers,
+                ])->render();
+                break;
+
             default:
                 $response['msg'] = 'Unknown action';
                 break;
         }
 
         if ($response['status'] == 'error' && empty($response['msg'])) {
-            $response['msg'] = 'Unknown error occured';
+            $response['msg'] = 'Unknown error occurred';
         }
 
         return \Response::json($response);
     }
-}
+
+    public function merge(Request $request, $id)
+    {
+        $customer = Customer::findOrFail($id);
+
+        $this->checkLimitVisibility($customer);
+
+        // $customers = Customer::where('id', '!=', $id)
+        //     ->orderBy('first_name')
+        //     ->orderBy('last_name')
+        //     ->get();
+
+        return view('customers/merge', ['customer' => $customer]);
+    }
+
+    /**
+     * Merge handling function.
+     */
+    public function mergeSave(Request $request, $id)
+    {
+        $request->validate([
+            'customer2_id' => 'required|exists:customers,id|not_in:'.$id,
+            //'keep_attributes' => 'array'
+        ], [], [
+            'customer2_id' => __('Merge With'),
+        ]);
+
+        $customer = Customer::findOrFail($id);
+        $customer2 = Customer::findOrFail($request->customer2_id);
+
+        $this->checkLimitVisibility($customer);
+        $this->checkLimitVisibility($customer2);
+
+        // Ensure customers are different
+        if ($id === $customer2->id) {
+            return redirect()->back()->with('error', __('Cannot merge the same customer'));
+        }
+
+        $customer->mergeWith($customer2/*, $request->keep_attributes ?? []*/);
+
+        \Session::flash('flash_success_floating', __('Customers merged successfully'));
+
+        return redirect()->route('customers.update', ['id' => $id]);
+    }
+}

app/Http/Controllers/ModulesController.php

@@ -28,12 +28,18 @@ class ModulesController extends Controller
     {
         $installed_modules = [];
         $modules_directory = [];
+        $third_party_modules = [];
+        $all_modules = [];
         $flashes = [];
         $updates_available = false;
 
         $flash = \Cache::get('modules_flash');
         if ($flash) {
-            $flashes[] = $flash;
+            if (is_array($flash) && !isset($flash['text'])) {
+                $flashes = $flash;
+            } else {
+                $flashes[] = $flash;
+            }
             \Cache::forget('modules_flash');
         }
 
@@ -53,8 +59,7 @@ class ModulesController extends Controller
         \Module::clearCache();
         $modules = \Module::all();
         foreach ($modules as $module) {
-            $img = '';
-            $installed_modules[] = [
+            $module_data = [
                 'alias'                        => $module->getAlias(),
                 'name'                         => $module->getName(),
                 'description'                  => $module->getDescription(),
@@ -66,14 +71,19 @@ class ModulesController extends Controller
                 'requiredPhpExtensions'        => $module->get('requiredPhpExtensions'),
                 'requiredPhpExtensionsMissing' => \App\Module::getMissingExtensions($module->get('requiredPhpExtensions')),
                 'requiredModulesMissing'       => \App\Module::getMissingModules($module->get('requiredModules'), $modules),
-                'img'                          => $img,
+                'img'                          => $module->get('img'),
                 'active'                       => $module->active(), //\App\Module::isActive($module->getAlias()),
                 'installed'                    => true,
                 'activated'                    => \App\Module::isLicenseActivated($module->getAlias(), $module->get('authorUrl')),
                 'license'                      => \App\Module::getLicense($module->getAlias()),
+                // Update configuration for third party modules
+                'latestVersionNumberUrl'       => $module->get('latestVersionUrl'),
+                'latestVersionZipUrl'          => $module->get('latestVersionZipUrl'),
                 // Determined later
                 'new_version'        => '',
             ];
+            $module_data = \App\Module::formatModuleData($module_data);
+            $installed_modules[] = $module_data;
         }
 
         // No need, as we update modules list on each page load
@@ -85,14 +95,25 @@ class ModulesController extends Controller
         // Prepare directory modules
         if (is_array($modules_directory)) {
             foreach ($modules_directory as $i_dir => $dir_module) {
+
+                $dir_module = \App\Module::formatModuleData($dir_module);
+                $modules_directory[$i_dir] = $dir_module;
+
                 // Remove modules without aliases
                 if (empty($dir_module['alias'])) {
                     unset($modules_directory[$i_dir]);
                 }
+
+                $all_modules[$dir_module['alias']] = $dir_module['name'];
+
                 foreach ($installed_modules as $i_installed => $module) {
+
                     if ($dir_module['alias'] == $module['alias']) {
                         // Set image from director
                         $installed_modules[$i_installed]['img'] = $dir_module['img'];
+
+                        $installed_modules[$i_installed] = \App\Module::formatModuleData($installed_modules[$i_installed]);
+
                         // Remove installed modules from modules directory.
                         unset($modules_directory[$i_dir]);
 
@@ -106,26 +127,94 @@ class ModulesController extends Controller
                     }
                 }
 
-                if (empty($dir_module['authorUrl']) || !\App\Module::isOfficial($dir_module['authorUrl'])) {
-                    unset($modules_directory[$i_dir]);
-                    continue;
-                }
-
                 if (!empty($dir_module['requiredPhpExtensions'])) {
                     $modules_directory[$i_dir]['requiredPhpExtensionsMissing'] = \App\Module::getMissingExtensions($dir_module['requiredPhpExtensions']);
                 }
                 $modules_directory[$i_dir]['active'] = \App\Module::isActive($dir_module['alias']);
                 $modules_directory[$i_dir]['activated'] = false;
+
+                // Do not show third-party modules in Modules Directory.
+                if (\App\Module::isThirdParty($dir_module)) {
+                    $third_party_modules[] = $modules_directory[$i_dir];
+                    unset($modules_directory[$i_dir]);
+                } elseif (empty($dir_module['authorUrl']) || !\App\Module::isOfficial($dir_module['authorUrl'])) {
+                    unset($modules_directory[$i_dir]);
+                    continue;
+                }
             }
         } else {
             $modules_directory = [];
         }
 
+        // Loop through each installed module
+        foreach ($installed_modules as $i_installed => $module) {
+            // Check if the module is an official one
+            if (\App\Module::isOfficial($module['authorUrl'])) {
+                continue;
+            }
+
+            // Get the URL for the latest version of the module
+            $latest_version_number_url = $module['latestVersionNumberUrl'] ?? null;
+            if (! $latest_version_number_url) {
+                continue;
+            }
+
+            // Create a new Guzzle HTTP client
+            $client = new \GuzzleHttp\Client();
+
+            try {
+                // Send a GET request to the latest version URL
+                $response = $client->request('GET', $latest_version_number_url, \Helper::setGuzzleDefaultOptions());
+
+                // Get the latest version number from the response body
+                $latest_version = trim((string) $response->getBody());
+
+                if (empty($latest_version)) {
+                    continue;
+                }
+
+                // If it is the module.json file - try to parse the body.
+                preg_match('#"version":[^"]*"([\d\.]+)"#', $latest_version, $m);
+                if (!empty($m[1])) {
+                    $latest_version = $m[1];
+                }
+
+                // Get the current version of the module
+                $current_version = $module['version'];
+            } catch (\Exception $e) {
+                // If there's an exception, skip to the next iteration
+                continue;
+            }
+
+            // If the latest version is greater than the current version
+            if (version_compare($latest_version, $current_version, '>')) {
+                // Update the installed module's version
+                $installed_modules[ $i_installed ]['new_version'] = $latest_version;
+                // Set the flag to indicate that updates are available
+                $updates_available = true;
+            }
+        }
+
+        // Check modules symlinks. Somestimes instead of symlinks folders with files appear.
+        $invalid_symlinks = \App\Module::checkSymlinks(
+            collect($installed_modules)->where('active', true)->pluck('alias')->toArray()
+        );
+
+        // Sort all modules.
+        asort($all_modules);
+
+        usort($third_party_modules, function ($a, $b) {
+            return strcasecmp($a['name'], $b['name']);
+        });
+
         return view('modules/modules', [
             'installed_modules' => $installed_modules,
             'modules_directory' => $modules_directory,
+            'third_party_modules' => $third_party_modules,
             'flashes'           => $flashes,
             'updates_available' => $updates_available,
+            'all_modules'       => $all_modules,
+            'invalid_symlinks'  => $invalid_symlinks,
         ]);
     }
 
@@ -141,10 +230,11 @@ class ModulesController extends Controller
 
         switch ($request->action) {
 
+            // Install module or activate license.
             case 'install':
             case 'activate_license':
                 $license = $request->license;
-                $alias = $request->alias;
+                $alias = preg_replace("#[^a-zA-Z0-9_\-]#", '', $request->alias);
 
                 if (!$license) {
                     $response['msg'] = __('Empty license key');
@@ -218,10 +308,10 @@ class ModulesController extends Controller
                                             \Session::flash('flash_error_floating', $response['msg']);
                                         }
 
-                                        \Session::flash('flash_error_unescaped', __('Error occured downloading the module. Please :%a_being%download:%a_end% module manually and extract into :folder', ['%a_being%' => '<a href="'.$license_details['download_link'].'" target="_blank">', '%a_end%' => '</a>', 'folder' => '<strong>'.\Module::getPath().'</strong>']));
+                                        \Session::flash('flash_error_unescaped', __('Error occurred downloading the module. Please :%a_being%download:%a_end% module manually and extract into :folder', ['%a_being%' => '<a href="'.$license_details['download_link'].'" target="_blank">', '%a_end%' => '</a>', 'folder' => '<strong>'.\Module::getPath().'</strong>']));
                                     }
                                 } else {
-                                    $response['msg'] = __('Error occured. Please try again later.');
+                                    $response['msg'] = __('Error occurred. Please try again later.');
                                 }
                             } else {
                                 // Just activate license
@@ -231,14 +321,17 @@ class ModulesController extends Controller
                                 $response['status'] = 'success';
                             }
                         } elseif (!empty($result['error'])) {
-                            $response['msg'] = $this->getErrorMessage($result['error'], $result);
+                            $response['msg'] = \App\Module::getErrorMessage($result['error'], $result);
                         } else {
-                            $response['msg'] = __('Error occured. Please try again later.');
+                            $response['msg'] = __('Error occurred. Please try again later.');
                         }
                     }
                 }
-                break;
-
+                // If everything is fine try to activate the Module.
+                if (!empty($response['msg'])) {
+                    break;
+                }
+                // Continue to activation.
             case 'activate':
                 $alias = $request->alias;
                 $module = \Module::findByAlias($alias);
@@ -251,7 +344,7 @@ class ModulesController extends Controller
                 if (!$response['msg']) {
                     if (!empty($module->get('authorUrl')) && $module->isOfficial()) {
                         $params = [
-                            'license'      => $module->getLicense(),
+                            'license'      => $request->license ?: $module->getLicense(),
                             'module_alias' => $alias,
                             'url'          => \App\Module::getAppUrl(),
                         ];
@@ -275,9 +368,73 @@ class ModulesController extends Controller
                                     break;
                                 case 'inactive':
                                     $response['msg'] = __('License key has not been activated yet');
-                                case 'site_inactive':
-                                    $response['msg'] = __('Your domain is deactivated');
                                     break;
+                                case 'site_inactive':
+                                    $response['msg'] = __('No activations left for this license key').' ('.__("Use 'Deactivate License' link above to transfer license key from another domain").')';
+                                    break;
+                            }
+                        } elseif (!empty($license_result['status']) && $license_result['status'] == 'inactive') {
+                            // Activate the license.
+                            $result = WpApi::activateLicense($params);
+                            if (WpApi::$lastError) {
+                                $response['msg'] = WpApi::$lastError['message'];
+                            } elseif (!empty($result['code']) && !empty($result['message'])) {
+                                $response['msg'] = $result['message'];
+                            } else {
+                                if (!empty($result['status']) && $result['status'] == 'valid') {
+                                    // Success.
+                                } elseif (!empty($result['error'])) {
+                                    $response['msg'] = \App\Module::getErrorMessage($result['error'], $result);
+                                } else {
+                                    // Some unknown error. Do nothing.
+                                }
+                            }
+                        }
+                    } else {
+                        // Check folder names for custom modules o avoid errors after activation:
+                        // Class "Modules\CustomModule\Providers\CustomModuleServiceProvider" not found.
+                        try {
+                            $old_path = '';
+                            $correct_path = '';
+                            foreach (\Module::getScanPaths() as $key => $path) {
+                                $manifests = \Module::getFiles()->glob("{$path}/module.json");
+
+                                is_array($manifests) || $manifests = [];
+
+                                // Determine correct module folder name from providers in module.json.
+                                // Each module must have at least on "provider" specified.
+                                foreach ($manifests as $manifest) {
+                                    $manifest_json = \Nwidart\Modules\Json::make($manifest);
+                                    if ($manifest_json->get('alias') != $alias) {
+                                        continue;
+                                    }
+
+                                    $providers = $manifest_json->get('providers');
+                                    $correct_folder_name = $providers[0] ?? '';
+                                    $correct_folder_name = preg_replace('#^Modules\\\\([^\\\\]+)\\\\.*#', '$1', $correct_folder_name);
+                                    if (!$correct_folder_name) {
+                                        break;
+                                    }
+                                    // Rename module's folder into correct name.
+                                    $old_path = str_replace('/module.json', '', $manifest);
+                                    $correct_path = \Module::getPath().'/'.$correct_folder_name;
+
+                                    if (\File::exists($old_path) && !\File::exists($correct_path)) {
+                                        \File::move($old_path, $correct_path);
+                                         // Re-scan and re-cache modules.
+                                        \Module::scan();
+                                    }
+                                    break;
+                                }
+                            }
+                        } catch (\Exception $e) {
+                            if ($old_path && $correct_path) {
+                                $response['msg'] = __('Rename ":old_path" into ":new_path"', [
+                                    'old_path' => str_replace(\Module::getPath(), '/Modules', $old_path),
+                                    'new_path' => str_replace(\Module::getPath(), '/Modules', $correct_path),
+                                ]);
+                            } else {
+                                \Helper::logException($e, '[Modules] Error occured checking module folder name on activation');
                             }
                         }
                     }
@@ -286,6 +443,8 @@ class ModulesController extends Controller
                 if (!$response['msg']) {
                     \App\Module::setActive($alias, true);
 
+                    $user_locale = app()->getLocale();
+
                     $outputLog = new BufferedOutput();
                     \Artisan::call('freescout:module-install', ['module_alias' => $alias], $outputLog);
                     $output = $outputLog->fetch();
@@ -296,8 +455,11 @@ class ModulesController extends Controller
                         $name = $module->getName();
                     }
 
+                    // After clearing cache the locale may be not set.
+                    \Helper::setUserLocale($user_locale);
+
                     $type = 'danger';
-                    $msg = __('Error occured activating ":name" module', ['name' => $name]);
+                    $msg = __('Error occurred activating ":name" module', ['name' => $name]);
                     if (session('flashes_floating') && is_array(session('flashes_floating'))) {
                         // If there was any error, module has been deactivated via modules.register_error filter
                         $msg = '';
@@ -308,22 +470,27 @@ class ModulesController extends Controller
                         $type = 'success';
                         $msg = __('":name" module successfully activated!', ['name' => $name]);
                     } else {
-                        // Deactivate module
+                        // Deactivate the module.
                         \App\Module::setActive($alias, false);
                         \Artisan::call('freescout:clear-cache');
                     }
 
                     // Check public folder.
                     if ($module && file_exists($module->getPath().DIRECTORY_SEPARATOR.'Public')) {
-                        $public_folder = public_path().\Module::getPublicPath($alias);
-                        if (!file_exists($public_folder)) {
+                        $symlink_path = public_path().\Module::getPublicPath($alias);
+                        if (!file_exists($symlink_path)) {
                             $type = 'danger';
-                            $msg = 'Error occured creating a module symlink ('.$public_folder.'). Please check folder permissions.';
+                            $msg = 'Error occurred creating a module symlink ('.$symlink_path.'). Please check folder permissions.';
                             \App\Module::setActive($alias, false);
                             \Artisan::call('freescout:clear-cache');
                         }
                     }
 
+                    if ($type == 'success') {
+                        // Migrate again, in case migration did not work in the moment the module was activated.
+                        \Artisan::call('migrate', ['--force' => true]);
+                    }
+
                     // \Session::flash does not work after BufferedOutput
                     $flash = [
                         'text'      => '<strong>'.$msg.'</strong><pre class="margin-top">'.$output.'</pre>',
@@ -340,6 +507,8 @@ class ModulesController extends Controller
                 $alias = $request->alias;
                 \App\Module::setActive($alias, false);
 
+                $user_locale = app()->getLocale();
+
                 $outputLog = new BufferedOutput();
                 \Artisan::call('freescout:clear-cache', [], $outputLog);
                 $output = $outputLog->fetch();
@@ -351,11 +520,14 @@ class ModulesController extends Controller
                     $name = $module->getName();
                 }
 
+                // After clearing cache the locale may be not set.
+                \Helper::setUserLocale($user_locale);
+
                 $type = 'danger';
-                $msg = __('Error occured deactivating :name module', ['name' => $name]);
+                $msg = __('Error occurred deactivating :name module', ['name' => $name]);
                 if (strstr($output, 'Configuration cached successfully')) {
                     $type = 'success';
-                    $msg = __('":name" module successfully DEactivated!', ['name' => $name]);
+                    $msg = __('":name" module successfully Deactivated!', ['name' => $name]);
                 }
 
                 // \Session::flash does not work after BufferedOutput
@@ -380,7 +552,7 @@ class ModulesController extends Controller
                     $params = [
                         'license'      => $license,
                         'module_alias' => $alias,
-                        'url'          => \App\Module::getAppUrl(),
+                        'url'          => (!empty($request->any_url) ? '*' : \App\Module::getAppUrl()),
                     ];
                     $result = WpApi::deactivateLicense($params);
 
@@ -390,16 +562,19 @@ class ModulesController extends Controller
                         $response['msg'] = $result['message'];
                     } else {
                         if (!empty($result['status']) && $result['status'] == 'success') {
-                            // Remove remembered license key and deactivate license in DB
-                            \App\Module::deactivateLicense($alias, '');
+                            $db_module = \App\Module::getByAlias($alias);
+                            if ($db_module && trim($db_module->license ?? '') == trim($license ?? '')) {
+                                // Remove remembered license key and deactivate license in DB
+                                \App\Module::deactivateLicense($alias, '');
 
-                            // Deactivate module
-                            \App\Module::setActive($alias, false);
-                            \Artisan::call('freescout:clear-cache', []);
+                                // Deactivate module
+                                \App\Module::setActive($alias, false);
+                                \Artisan::call('freescout:clear-cache', []);
+                            }
 
                             // Flash does not work here.
                             $flash = [
-                                'text'      => '<strong>'.__('License successfully DEactivated!').'</strong>',
+                                'text'      => '<strong>'.__('License successfully Deactivated!').'</strong>',
                                 'unescaped' => true,
                                 'type'      => 'success',
                             ];
@@ -407,9 +582,11 @@ class ModulesController extends Controller
 
                             $response['status'] = 'success';
                         } elseif (!empty($result['error'])) {
-                            $response['msg'] = $this->getErrorMessage($result['error'], $result);
+                            $response['msg'] = \App\Module::getErrorMessage($result['error'], $result);
+                        } elseif (!empty($result['status']) && $result['status'] == 'error') {
+                            $response['msg'] = __('License key does not exist');
                         } else {
-                            $response['msg'] = __('Error occured. Please try again later.');
+                            $response['msg'] = __('Error occurred. Please try again later.');
                         }
                     }
                 }
@@ -434,110 +611,34 @@ class ModulesController extends Controller
                 break;
 
             case 'update':
-                $alias = $request->alias;
-                $module = \Module::findByAlias($alias);
+                $update_result = \App\Module::updateModule($request->alias);
 
-                if (!$module) {
-                    $response['msg'] = __('Module not found').': '.$alias;
-                }
+                if ($update_result['download_error']) {
+                    $response['reload'] = true;
 
-                // Download new version
-                $download_error = false;
-                if (!$response['msg']) {
-                    $params = [
-                        'license'      => \App\Module::getLicense($alias),
-                        'module_alias' => $alias,
-                        'url'          => \App\Module::getAppUrl(),
-                    ];
-                    $license_details = WpApi::getVersion($params);
+                    if ($update_result['msg']) {
+                        \Session::flash('flash_error_floating', $update_result['msg']);
+                    }
 
-                    if (WpApi::$lastError) {
-                        $response['msg'] = WpApi::$lastError['message'];
-                    } elseif (!empty($license_details['code']) && !empty($license_details['message'])) {
-                        $response['msg'] = $license_details['message'];
-                    } elseif (!empty($license_details['required_app_version']) && !\Helper::checkAppVersion($license_details['required_app_version'])) {
-                        $response['msg'] = 'Module requires app version:'.' '.$license_details['required_app_version'];
-                    } elseif (!empty($license_details['download_link'])) {
-                        // Download module
-                        $module_archive = \Module::getPath().DIRECTORY_SEPARATOR.$alias.'.zip';
-
-                        try {
-                            \Helper::downloadRemoteFile($license_details['download_link'], $module_archive);
-                        } catch (\Exception $e) {
-                            $response['msg'] = $e->getMessage();
-                        }
-
-                        if (!file_exists($module_archive)) {
-                            $download_error = true;
-                        } else {
-                            // Extract
-                            try {
-                                \Helper::unzip($module_archive, \Module::getPath());
-                            } catch (\Exception $e) {
-                                // We will show this as floating message on page reload
-                                $response['msg'] = $e->getMessage();
-                            }
-                            // Check if extracted module exists
-                            \Module::clearCache();
-                            $module = \Module::findByAlias($alias);
-                            if (!$module) {
-                                $download_error = true;
-                            }
-                        }
-
-                        // Remove archive
-                        if (file_exists($module_archive)) {
-                            \File::delete($module_archive);
-                        }
-
-                        if ($download_error) {
-                            $response['reload'] = true;
-
-                            if ($response['msg']) {
-                                \Session::flash('flash_error_floating', $response['msg']);
-                            }
-
-                            \Session::flash('flash_error_unescaped', __('Error occured downloading the module. Please :%a_being%download:%a_end% module manually and extract into :folder', ['%a_being%' => '<a href="'.$license_details['download_link'].'" target="_blank">', '%a_end%' => '</a>', 'folder' => '<strong>'.\Module::getPath().'</strong>']));
-                        }
-                    } elseif ($license_details['status'] && $response['msg'] = $this->getErrorMessage($license_details['status'])) {
-                        //$response['msg'] = ;
-                    } else {
-                        $response['msg'] = __('Error occured. Please try again later.');
+                    if ($update_result['download_msg']) {
+                        \Session::flash('flash_error_unescaped', $update_result['download_msg']);
                     }
                 }
 
-                // Install updated module
-                if (!$response['msg'] && !$download_error) {
-                    $outputLog = new BufferedOutput();
-                    \Artisan::call('freescout:module-install', ['module_alias' => $alias], $outputLog);
-                    $output = $outputLog->fetch();
-
-                    // Get module name
-                    $name = '?';
-                    if ($module) {
-                        $name = $module->getName();
-                    }
+                // Install updated module.
+                if ($update_result['output'] || $update_result['status']) {
 
                     $type = 'danger';
-                    $msg = __('Error occured activating ":name" module', ['name' => $name]);
-                    if (session('flashes_floating') && is_array(session('flashes_floating'))) {
-                        // If there was any error, module has been deactivated via modules.register_error filter
-                        $msg = '';
-                        foreach (session('flashes_floating') as $flash) {
-                            $msg .= $flash['text'].' ';
-                        }
-                    } elseif (strstr($output, 'Configuration cached successfully')) {
+                    $msg = $update_result['msg'];
+
+                    if ($update_result['status'] == 'success') {
                         $type = 'success';
-                        $msg = __('":name" module successfully updated!', ['name' => $name]);
-                    } else {
-                        // Deactivate module
-                        \App\Module::setActive($alias, false);
-                        \Artisan::call('freescout:clear-cache');
+                        $msg = $update_result['msg_success'];
                     }
 
                     // \Session::flash does not work after BufferedOutput
                     $flash = [
-                        'text'      => '<strong>'.$msg.'</strong><pre class="margin-top">'.$output.'</pre>',
+                        'text'      => '<strong>'.$msg.'</strong><pre class="margin-top">'.$update_result['output'].'</pre>',
                         'unescaped' => true,
                         'type'      => $type,
                     ];
@@ -547,51 +648,50 @@ class ModulesController extends Controller
 
                 break;
 
+            case 'update_all':
+                $update_all_flashes = [];
+
+                foreach ($request->aliases as $alias) {
+                    $update_result = \App\Module::updateModule($alias);
+
+                    $type = 'danger';
+                    $msg = $update_result['msg'];
+
+                    if ($update_result['status'] == 'success') {
+                        $type = 'success';
+                        $msg = $update_result['msg_success'];
+                    } elseif ($update_result['download_msg']) {
+                        $msg .= '<br/>'.$update_result['download_msg'];
+                    }
+
+                    $text = '<strong>'.$update_result['module_name'].':</strong> '.$msg;
+                    if (trim($update_result['output'])) {
+                        $text .= '<pre class="margin-top">'.$update_result['output'].'</pre>';
+                    }
+
+                    // \Session::flash does not work after BufferedOutput
+                    $update_all_flashes[] = [
+                        'text'      => $text,
+                        'unescaped' => true,
+                        'type'      => $type,
+                    ];
+                }
+                if ($update_all_flashes) {
+                    \Cache::forever('modules_flash', $update_all_flashes);
+                }
+                $response['status'] = 'success';
+
+                break;
+
             default:
                 $response['msg'] = 'Unknown action';
                 break;
         }
 
         if ($response['status'] == 'error' && empty($response['msg'])) {
-            $response['msg'] = 'Unknown error occured';
+            $response['msg'] = 'Unknown error occurred';
         }
 
         return \Response::json($response);
     }
-
-    public function getErrorMessage($code, $result = null)
-    {
-        $msg = '';
-
-        switch ($code) {
-            case 'missing':
-                $msg = __('License key does not exist');
-                break;
-            case 'license_not_activable':
-                $msg = __("You have to activate each bundle's module separately");
-                break;
-            case 'disabled':
-                $msg = __('License key has been revoked');
-                break;
-            case 'no_activations_left':
-                $msg = __('No activations left for this license key');
-                break;
-            case 'expired':
-                $msg = __('License key has expired');
-                break;
-            case 'key_mismatch':
-                $msg = __('License key belongs to another module');
-                break;
-            case 'invalid_item_id':
-                $msg = __('Module not found in the modules directory');
-                break;
-            default:
-                if ($result && !empty($result['error'])) {
-                    $msg = __('Error code:'.' '.$result['error']);
-                }
-                break;
-        }
-
-        return $msg;
-    }
 }

app/Http/Controllers/OpenController.php

@@ -0,0 +1,342 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Attachment;
+use App\Conversation;
+use App\Option;
+use App\Thread;
+use App\User;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Validator;
+
+class OpenController extends Controller
+{
+    /**
+     * Create a new controller instance.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+    }
+
+    /**
+     * Setup user from invitation.
+     *
+     * @return \Illuminate\Http\Response
+     */
+    public function userSetup($hash, $invite_sent_at)
+    {
+        if (auth()->user()) {
+            return redirect()->route('dashboard');
+        }
+
+        // https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-jqj5-r72v-v29g
+        $hash = trim($hash);
+
+        $user = null;
+        if (strlen($hash) == User::INVITE_HASH_LENGTH) {
+            $user = User::where('invite_hash', $hash)->first();
+        }
+
+        if ($user && $user->locale) {
+            \Helper::setLocale($user->locale);
+        }
+
+        if ($user && !$this->isInviteExpirationValid($invite_sent_at, $user)) {
+            $user = null;
+        }
+
+        return view('open/user_setup', ['user' => $user]);
+    }
+
+    /**
+     * Save user from invitation.
+     */
+    public function userSetupSave($hash, $invite_sent_at, Request $request)
+    {
+        if (auth()->user()) {
+            return redirect()->route('dashboard');
+        }
+
+        // https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-jqj5-r72v-v29g
+        $hash = trim($hash);
+
+        $user = null;
+        if (strlen($hash) == User::INVITE_HASH_LENGTH) {
+            $user = User::where('invite_hash', $hash)->first();
+        }
+
+        if (!$user) {
+            abort(404);
+        }
+
+        if (!$this->isInviteExpirationValid($invite_sent_at, $user)) {
+            \Helper::denyAccess();
+        }
+
+        $validator = Validator::make($request->all(), [
+            'email'       => 'required|string|email|max:100|unique:users,email,'.$user->id,
+            'password'    => 'required|string|min:8|confirmed',
+            'job_title'   => 'max:100',
+            'phone'       => 'max:60',
+            'timezone'    => 'required|string|max:255',
+            'time_format' => 'required',
+            'photo_url'   => 'nullable|image|mimes:jpeg,png,jpg,gif',
+        ]);
+        $validator->setAttributeNames([
+            'photo_url'   => __('Photo'),
+        ]);
+
+        // Photo
+        $validator->after(function ($validator) use ($user, $request) {
+            if ($request->hasFile('photo_url')) {
+                $path_url = $user->savePhoto($request->file('photo_url'));
+
+                if ($path_url) {
+                    $user->photo_url = $path_url;
+                } else {
+                    $validator->errors()->add('photo_url', __('Error occurred processing the image. Make sure that PHP GD extension is enabled.'));
+                }
+            }
+        });
+
+        if ($validator->fails()) {
+            return redirect()->route('user_setup', ['hash' => $hash, 'invite_sent_at' => $invite_sent_at])
+                        ->withErrors($validator)
+                        ->withInput();
+        }
+
+        $request_data = [
+            'email' => $request->email,
+            'password' => $request->password,
+            'job_title' => $request->job_title,
+            'phone' => $request->phone,
+            'timezone' => $request->timezone,
+            'time_format' => $request->time_format,
+        ];
+
+        $user->fill($request_data);
+
+        $user->password = bcrypt($request->password);
+
+        $user->invite_state = User::INVITE_STATE_ACTIVATED;
+        $user->invite_hash = '';
+        
+        $user = \Eventy::filter('user.setup_save', $user, $request);
+        $user->save();
+
+        // Login user
+        Auth::guard()->login($user);
+
+        \Session::flash('flash_success_floating', __('Welcome to :company_name!', ['company_name' => htmlspecialchars(Option::getCompanyName())]));
+
+        return redirect()->route('dashboard');
+    }
+
+    public function isInviteExpirationValid($invite_sent_at_encrypted, $user)
+    {
+        $invite_sent_at = \Helper::decrypt($invite_sent_at_encrypted, $user->password);
+
+        if ($invite_sent_at == $invite_sent_at_encrypted) {
+            return false;
+        }
+
+        if (!$invite_sent_at 
+            || !is_numeric($invite_sent_at) 
+            || (int)$invite_sent_at < time() - User::INVITE_TTL_DAYS*86400
+        ) {
+            return false;
+        }
+
+        return true;
+    }
+
+    /*
+     * Set a thread as read by customer
+     */
+    public function setThreadAsRead($conversation_id, $thread_id, $hash)
+    {
+        $mark_as_read = true;
+
+        $conversation = Conversation::findOrFail($conversation_id);
+        $thread = Thread::findOrFail($thread_id);
+
+        if ((int)$thread->conversation_id !== (int)$conversation_id) {
+            $mark_as_read = false;
+        } elseif (!\Helper::hashEquals($hash, Thread::getOpenTrackingHash($thread, $conversation, $conversation->mailbox))) {
+            $mark_as_read = false;
+        }
+
+        // We only track the first opening
+        if ($mark_as_read && empty($thread->opened_at)) {
+            $thread->opened_at = date('Y-m-d H:i:s');
+            $thread->save();
+            \Eventy::action('thread.opened', $thread, $conversation);
+        }
+
+        // We return always the same result for security purposes.
+        // Create a 1x1 ttransparent pixel and return it
+        $pixel = sprintf('%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c', 71, 73, 70, 56, 57, 97, 1, 0, 1, 0, 128, 255, 0, 192, 192, 192, 0, 0, 0, 33, 249, 4, 1, 0, 0, 0, 0, 44, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2, 2, 68, 1, 0, 59);
+        $response = \Response::make($pixel, 200);
+        $response->header('Content-type', 'image/gif');
+        $response->header('Content-Length', 42);
+        $response->header('Cache-Control', 'private, no-cache, no-cache=Set-Cookie, proxy-revalidate');
+        $response->header('Expires', 'Wed, 11 Jan 2000 12:59:00 GMT');
+        $response->header('Last-Modified', 'Wed, 11 Jan 2006 12:59:00 GMT');
+        $response->header('Pragma', 'no-cache');
+
+        return $response;
+    }
+
+    /**
+     * Download an attachment.
+     */
+    public function downloadAttachment($dir_1, $dir_2, $dir_3, $file_name, Request $request)
+    {
+        $id = $request->query('id', '');
+        $token = $request->query('token', '');
+        $attachment = null;
+
+        // Old attachments can not be requested by id.
+        if (!$token && $id) {
+            return \Helper::denyAccess();
+        }
+
+        // Get attachment by id.
+        if ($id) {
+            $attachment = Attachment::findOrFail($id);
+        }
+        
+        if (!$attachment) {
+            $attachment = Attachment::where('file_dir', $dir_1.DIRECTORY_SEPARATOR.$dir_2.DIRECTORY_SEPARATOR.$dir_3.DIRECTORY_SEPARATOR)
+                ->where('file_name', $file_name)
+                ->firstOrFail();
+        }
+
+        // Check attachment name.
+        if (mb_strtolower(trim($attachment->file_name)) != mb_strtolower(trim($file_name))) {
+            return \Helper::denyAccess();
+        }
+
+        // Links to atachments without token have been disabled.
+        // https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-wg74-ww4w-2qpc
+        //if ($token != $attachment->getToken() && $attachment->token_type != Attachment::TOKEN_TYPE_LEGACY) {
+        if (!\Helper::hashEquals($token, $attachment->getToken())) {
+            return \Helper::denyAccess();
+        }
+
+        $view_attachment = false;
+        $file_ext = strtolower(pathinfo($attachment->file_name, PATHINFO_EXTENSION));
+
+        // Some file type should be viewed in the browser instead of downloading.
+        if (in_array($file_ext, config('app.viewable_attachments'))) {
+            $view_attachment = true;
+        }
+        // If HTML file is renamed into .txt for example it will be shown by the browser as HTML.
+        if ($view_attachment && $attachment->mime_type) {
+            $allowed_mime_type = false;
+
+            foreach (config('app.viewable_mime_types') as $mime_type) {
+                if (preg_match('#^'.$mime_type.'$#', $attachment->mime_type)) {
+                    $allowed_mime_type = true;
+                    break;
+                }
+            }
+            if ($allowed_mime_type) {
+                foreach (config('app.non_viewable_mime_types') as $mime_type) {
+                    if (preg_match('#^'.$mime_type.'$#', $attachment->mime_type)) {
+                        $allowed_mime_type = false;
+                        break;
+                    }
+                }
+            }
+            if (!$allowed_mime_type) {
+                $view_attachment = false;
+            }
+        }
+
+        // CSP header for extra security.
+        $csp_header_value = "script-src 'none'; frame-src 'none'; object-src 'none'; font-src 'none'; connect-src 'none'; media-src 'self'; form-action 'none'; base-uri 'none'; sandbox";
+
+        // https://github.com/freescout-help-desk/freescout/issues/5281
+        //
+        // The bare sandbox directive gives the attachment document an opaque
+        // ("null") origin. The media element the browser's built-in player creates
+        // then requests the file cross-origin and is blocked by CORS, so the player
+        // appears but never plays. allow-same-origin keeps the real origin.
+        // nosniff replaces the protection sandbox was providing here: the browser
+        // is not allowed to reinterpret an audio/* response as HTML.
+        // https://github.com/freescout-help-desk/freescout/pull/5597
+        if (preg_match('#^audio/.*$#', $attachment->mime_type)) {
+             //$csp_header_value .= ' allow-scripts';
+            $csp_header_value .= ' allow-same-origin';
+        }
+
+        // Send file.
+        if (config('app.download_attachments_via') == 'apache') {
+            // Send using Apache mod_xsendfile.
+            $response = response(null)
+               ->header('Content-Type', $attachment->mime_type)
+               // Laravel adds 'nosniff' by itself.
+               //->header('X-Content-Type-Options', 'nosniff')
+               ->header('X-Sendfile', $attachment->getLocalFilePath());
+
+            if (!$view_attachment) {
+                $response->header('Content-Disposition', 'attachment; filename="'.$attachment->file_name.'"');
+            } else {
+                $response->header('Content-Security-Policy', $csp_header_value);
+            }
+        } elseif (config('app.download_attachments_via') == 'nginx') {
+            // Send using Nginx.
+            $response = response(null)
+               ->header('Content-Type', $attachment->mime_type)
+               // Laravel adds 'nosniff' by itself.
+               //->header('X-Content-Type-Options', 'nosniff')
+               ->header('X-Accel-Redirect', $attachment->getLocalFilePath(false));
+               
+            if (!$view_attachment) {
+                $response->header('Content-Disposition', 'attachment; filename="'.$attachment->file_name.'"');
+            } else {
+                $response->header('Content-Security-Policy', $csp_header_value);
+            }
+        } else {
+            // Send via PHP.
+            // In this case whether the file is viewed or downloaded is controlled
+            // via the web server config or /storage/app/public/.htaccess.
+            $headers = [
+                'Content-Type' => $attachment->mime_type,
+                // Laravel adds 'nosniff' by itself.
+                //'X-Content-Type-Options' => 'nosniff',
+            ];
+            if ($view_attachment) {
+                $headers['Content-Security-Policy'] = $csp_header_value;
+            }
+            // Storage::download() returns a StreamedResponse, which does not
+            // implement HTTP Range requests: no Accept-Ranges, no 206 responses.
+            // Browsers disable seeking without it, so audio and video attachments
+            // can not be rewound or fast forwarded. BinaryFileResponse handles
+            // Range requests, so use it whenever the file is shown in the browser.
+            if ($view_attachment && \Helper::isLocalStorage() && $attachment->fileExists()) {
+                $response = response()->file(
+                    $attachment->getLocalFilePath(),
+                    $headers
+                );
+            } else {
+                $response = $attachment->download($view_attachment, $headers);
+            }
+        }
+
+        return $response;
+    }
+
+    /**
+     * Needed for the mobile app.
+     */
+    // public function mobilePing()
+    // {
+    //     echo file_get_contents(public_path('installer/css/fontawesome.css'));
+    // }
+}

app/Http/Controllers/PublicController.php

@@ -1,137 +0,0 @@
-<?php
-
-namespace App\Http\Controllers;
-
-use App\Conversation;
-use App\Option;
-use App\Thread;
-use App\User;
-use Illuminate\Http\Request;
-use Illuminate\Support\Facades\Auth;
-use Validator;
-
-class PublicController extends Controller
-{
-    /**
-     * Create a new controller instance.
-     *
-     * @return void
-     */
-    public function __construct()
-    {
-    }
-
-    /**
-     * Setup user from invitation.
-     *
-     * @return \Illuminate\Http\Response
-     */
-    public function userSetup($hash)
-    {
-        if (auth()->user()) {
-            return redirect()->route('dashboard');
-        }
-        $user = User::where('invite_hash', $hash)->first();
-
-        return view('public/user_setup', ['user' => $user]);
-    }
-
-    /**
-     * Save user from invitation.
-     */
-    public function userSetupSave($hash, Request $request)
-    {
-        if (auth()->user()) {
-            return redirect()->route('dashboard');
-        }
-        $user = User::where('invite_hash', $hash)->first();
-
-        if (!$user) {
-            abort(404);
-        }
-
-        $validator = Validator::make($request->all(), [
-            'email'       => 'required|string|email|max:100|unique:users,email,'.$user->id,
-            'password'    => 'required|string|min:8|confirmed',
-            'job_title'   => 'max:100',
-            'phone'       => 'max:60',
-            'timezone'    => 'required|string|max:255',
-            'time_format' => 'required',
-            'photo_url'   => 'nullable|image|mimes:jpeg,png,jpg,gif',
-        ]);
-        $validator->setAttributeNames([
-            'photo_url'   => __('Photo'),
-        ]);
-
-        // Photo
-        $validator->after(function ($validator) use ($user, $request) {
-            if ($request->hasFile('photo_url')) {
-                $path_url = $user->savePhoto($request->file('photo_url'));
-
-                if ($path_url) {
-                    $user->photo_url = $path_url;
-                } else {
-                    $validator->errors()->add('photo_url', __('Error occured processing the image. Make sure that PHP GD extension is enabled.'));
-                }
-            }
-        });
-
-        if ($validator->fails()) {
-            return redirect()->route('user_setup', ['hash' => $hash])
-                        ->withErrors($validator)
-                        ->withInput();
-        }
-
-        $request_data = $request->all();
-        // Do not allow user to set his role
-        if (isset($request_data['role'])) {
-            unset($request_data['role']);
-        }
-        if (isset($request_data['photo_url'])) {
-            unset($request_data['photo_url']);
-        }
-        $user->fill($request_data);
-
-        $user->password = bcrypt($request->password);
-
-        $user->invite_state = User::INVITE_STATE_ACTIVATED;
-        $user->invite_hash = '';
-
-        $user->save();
-
-        // Login user
-        Auth::guard()->login($user);
-
-        \Session::flash('flash_success_floating', __('Welcome to :company_name!', ['company_name' => Option::getCompanyName()]));
-
-        return redirect()->route('dashboard');
-    }
-
-    /*
-     * Set a thread as read by customer
-     */
-    public function setThreadAsRead($conversation_id, $thread_id)
-    {
-        $conversation = Conversation::findOrFail($conversation_id);
-        $thread = Thread::findOrFail($thread_id);
-
-        // We only track the first opening
-        if (empty($thread->opened_at)) {
-            $thread->opened_at = date('Y-m-d H:i:s');
-            $thread->save();
-            \Eventy::action('thread.opened', $thread, $conversation);
-        }
-
-        // Create a 1x1 ttransparent pixel and return it
-        $pixel = sprintf('%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%', 71, 73, 70, 56, 57, 97, 1, 0, 1, 0, 128, 255, 0, 192, 192, 192, 0, 0, 0, 33, 249, 4, 1, 0, 0, 0, 0, 44, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2, 2, 68, 1, 0, 59);
-        $response = \Response::make($pixel, 200);
-        $response->header('Content-type', 'image/gif');
-        $response->header('Content-Length', 42);
-        $response->header('Cache-Control', 'private, no-cache, no-cache=Set-Cookie, proxy-revalidate');
-        $response->header('Expires', 'Wed, 11 Jan 2000 12:59:00 GMT');
-        $response->header('Last-Modified', 'Wed, 11 Jan 2006 12:59:00 GMT');
-        $response->header('Pragma', 'no-cache');
-
-        return $response;
-    }
-}

app/Http/Controllers/SecureController.php

@@ -3,6 +3,7 @@
 namespace App\Http\Controllers;
 
 use App\ActivityLog;
+use App\Misc\Helper;
 use App\SendLog;
 use App\Thread;
 use App\User;
@@ -27,7 +28,12 @@ class SecureController extends Controller
      */
     public function dashboard()
     {
-        $mailboxes = auth()->user()->mailboxesCanView();
+        $user = auth()->user();
+
+        $mailboxes = $user->mailboxesCanViewWithSettings();
+
+        // Sort by name.
+        $mailboxes = \Eventy::filter('dashboard.mailboxes', $mailboxes->sortBy('name'));
 
         return view('secure/dashboard', ['mailboxes' => $mailboxes]);
     }
@@ -103,12 +109,16 @@ class SecureController extends Controller
                 'type',
                 'email',
                 'status',
-                'conversation',
+                'message',
                 'user',
                 'customer',
             ];
 
-            $activities = SendLog::orderBy('created_at', 'desc')->paginate($page_size);
+            $activities_query = SendLog::orderBy('created_at', 'desc');
+            if ($request->get('thread_id')) {
+                $activities_query->where('thread_id', $request->get('thread_id'));
+            }
+            $activities = $activities_query->paginate($page_size);
 
             foreach ($activities as $record) {
                 $conversation = '';
@@ -119,6 +129,12 @@ class SecureController extends Controller
                 $status = $record->getStatusName();
                 if ($record->status_message) {
                     $status .= '. '.$record->status_message;
+                    if ($record->status == SendLog::STATUS_SEND_ERROR) {
+                        $status .= '. Message-ID: '.$record->message_id;
+                    }
+                }
+                if ($record->smtp_queue_id) {
+                    $status .= '. SMTP ID: '.$record->smtp_queue_id;
                 }
 
                 $logs[] = [
@@ -126,7 +142,7 @@ class SecureController extends Controller
                     'type'          => $record->getMailTypeName(),
                     'email'         => $record->email,
                     'status'        => $status,
-                    'conversation'  => $conversation,
+                    'message'       => $conversation,
                     'user'          => $record->user,
                     'customer'      => $record->customer,
                 ];
@@ -158,7 +174,7 @@ class SecureController extends Controller
 
         $name = '';
         if (!empty($request->name)) {
-            $activities = ActivityLog::inLog($request->name)->orderBy('created_at', 'desc')->get();
+            //$activities = ActivityLog::inLog($request->name)->orderBy('created_at', 'desc')->get();
             $name = $request->name;
         } elseif (count($names = ActivityLog::select('log_name')->distinct()->get()->pluck('log_name'))) {
             $name = ActivityLog::NAME_OUT_EMAILS;
@@ -177,4 +193,51 @@ class SecureController extends Controller
 
         return redirect()->route('logs', ['name' => $name]);
     }
+
+    /**
+     * Upload files and images.
+     */
+    public function upload(Request $request)
+    {
+        // 'jpg','gif','png'
+        $response = [
+            'status' => 'error',
+            'msg'    => '', // this is error message
+        ];
+
+        $user = auth()->user();
+
+        if (!$user) {
+            $response['msg'] = __('Please login to upload file');
+        }
+
+        if (!$request->hasFile('file') || !$request->file('file')->isValid() || !$request->file) {
+            $response['msg'] = __('Error occurred uploading file');
+        }
+
+        if (!$response['msg']) {
+
+            $uploaded_file_path = '';
+            try {
+                $uploaded_file_path = Helper::uploadFile($request->file);
+            } catch (\Exception $e) {
+                if ($e->getCode() == \Helper::EXCEPTION_NOT_ALLOWED_FILE_EXTENSION) {
+                    $response['msg'] = $e->getMessage();
+                }
+            }
+
+            if (!$response['msg']) {
+                $filename = basename($uploaded_file_path);
+
+                if ($uploaded_file_path) {
+                    $response['status'] = 'success';
+                    $response['url'] = Helper::uploadedFileUrl($filename);
+                } else {
+                    $response['msg'] = __('Error occurred uploading file');
+                }
+            }
+        }
+
+        return \Response::json($response);
+    }
 }

app/Http/Controllers/SettingsController.php

@@ -4,6 +4,7 @@ namespace App\Http\Controllers;
 
 use App\Conversation;
 use App\Option;
+use App\Subscription;
 use App\User;
 use Illuminate\Http\Request;
 use Validator;
@@ -93,6 +94,7 @@ class SettingsController extends Controller
                         ],
                     ],
                     'validator_rules' => [
+                        'settings.mail_host' => 'safehost',
                         'settings.mail_from' => 'required|email',
                     ],
                     'settings' => [
@@ -100,27 +102,60 @@ class SettingsController extends Controller
                             'env' => 'APP_FETCH_SCHEDULE',
                         ],
                         'mail_password' => [
-                            'safe_password' => true
-                        ]
+                            'safe_password' => true,
+                            'encrypt' => true,
+                        ],
+                        // 'use_mail_date_on_fetching' => [
+                        //     'env' => 'APP_USE_MAIL_DATE_ON_FETCHING',
+                        // ],
                     ],
                 ];
                 break;
             case 'general':
                 $params = [
                     'settings' => [
+                        'custom_number' => [
+                            'env' => 'APP_CUSTOM_NUMBER',
+                        ],
+                        'max_message_size' => [
+                            'env' => 'APP_MAX_MESSAGE_SIZE',
+                        ],
+                        'email_conv_history' => [
+                            'env' => 'APP_EMAIL_CONV_HISTORY',
+                        ],
+                        'email_user_history' => [
+                            'env' => 'APP_EMAIL_USER_HISTORY',
+                        ],
                         'locale' => [
                             'env' => 'APP_LOCALE',
                         ],
                         'timezone' => [
                             'env' => 'APP_TIMEZONE',
                         ],
+                        'user_permissions' => [
+                            'env' => 'APP_USER_PERMISSIONS',
+                            'env_encode' => true,
+                        ],
+                        'limit_user_customer_visibility' => [
+                            'env' => 'APP_LIMIT_USER_CUSTOMER_VISIBILITY',
+                        ],
                     ],
                 ];
                 break;
             case 'alerts':
+                $subscriptions_defaults = Subscription::getDefaultSubscriptions();
+                $subscriptions = array();
+                foreach ($subscriptions_defaults as $medium => $subscriptions_for_medium) {
+                    foreach ($subscriptions_defaults[$medium] as $subscription) {
+                        $subscriptions[] = (object) array("medium" => $medium, "event" => $subscription);
+                    }
+                }
                 $params = [
                     'template_vars' => [
                         'logs' => \App\ActivityLog::getAvailableLogs(),
+                        'person' => null,
+                        'subscriptions' => $subscriptions,
+                        'mobile_available' => \Eventy::filter('notifications.mobile_available', false),
                     ],
                     'settings' => [
                         'alert_logs' => [
@@ -145,6 +180,8 @@ class SettingsController extends Controller
                 break;
         }
 
+        $params = \Eventy::filter('settings.alter_section_params', $params, $section);
+
         if ($param) {
             if (isset($params[$param])) {
                 return $params[$param];
@@ -165,9 +202,14 @@ class SettingsController extends Controller
                 $settings = [
                     'company_name'         => Option::get('company_name', \Config::get('app.name')),
                     'next_ticket'          => (Option::get('next_ticket') >= Conversation::max('number') + 1) ? Option::get('next_ticket') : Conversation::max('number') + 1,
-                    'user_permissions'     => Option::get('user_permissions', []),
+                    'custom_number'        => (int)config('app.custom_number'),
+                    'user_permissions'     => User::getGlobalUserPermissions(),
+                    'limit_user_customer_visibility' => (int)config('app.limit_user_customer_visibility'),
                     'email_branding'       => Option::get('email_branding'),
                     'open_tracking'        => Option::get('open_tracking'),
+                    'email_conv_history'   => config('app.email_conv_history'),
+                    'max_message_size'     => config('app.max_message_size'),
+                    'email_user_history'   => config('app.email_user_history'),
                     'enrich_customer_data' => Option::get('enrich_customer_data'),
                     'time_format'          => Option::get('time_format', User::TIME_FORMAT_24),
                     'locale'               => \Helper::getRealAppLocale(),
@@ -181,9 +223,10 @@ class SettingsController extends Controller
                     'mail_host'       => Option::get('mail_host', \Config::get('mail.host')),
                     'mail_port'       => Option::get('mail_port', \Config::get('mail.port')),
                     'mail_username'   => Option::get('mail_username', \Config::get('mail.username')),
-                    'mail_password'   => Option::get('mail_password', \Config::get('mail.password')),
+                    'mail_password'   => \Helper::decrypt(Option::get('mail_password', \Config::get('mail.password'))),
                     'mail_encryption' => Option::get('mail_encryption', \Config::get('mail.encryption')),
                     'fetch_schedule'  => config('app.fetch_schedule'),
+                    //'use_mail_date_on_fetching'             => config('app.use_mail_date_on_fetching'),
                 ];
                 break;
             case 'alerts':
@@ -194,10 +237,13 @@ class SettingsController extends Controller
                     'alert_logs',
                     'alert_logs_names',
                     'alert_logs_period',
+                    'alert_logs_fetch_min_occurrences',
+                    'subscription_defaults',
                 ], [
-                    'alert_logs_names'  => [],
-                    'alert_logs'        => config('app.alert_logs'),
-                    'alert_logs_period' => config('app.alert_logs_period'),
+                    'alert_logs_names'                 => [],
+                    'alert_logs'                       => config('app.alert_logs'),
+                    'alert_logs_period'                => config('app.alert_logs_period'),
+                    'alert_logs_fetch_min_occurrences' => \App\Console\Commands\LogsMonitor::FETCH_ERRORS_MIN_OCCURRENCES_DEFAULT,
                 ]);
                 break;
             default:
@@ -205,6 +251,8 @@ class SettingsController extends Controller
                 break;
         }
 
+        $settings = \Eventy::filter('settings.alter_section_settings', $settings, $section);
+
         return $settings;
     }
 
@@ -267,15 +315,34 @@ class SettingsController extends Controller
             // Option has to be saved to .env file.
             if (!empty($settings_params[$option_name]) && !empty($settings_params[$option_name]['env'])) {
                 $env_value = $request->settings[$option_name] ?? '';
+
+                if (is_array($env_value)) {
+                    $env_value = json_encode($env_value);
+                }
+
+                if ($env_value !== '' && !empty($settings_params[$option_name]['encrypt'])) {
+                    $env_value = encrypt($env_value);
+                }
+
+                if (!empty($settings_params[$option_name]['env_encode'])) {
+                    $env_value = base64_encode($env_value);
+                }
+
                 \Helper::setEnvFileVar($settings_params[$option_name]['env'], $env_value);
+
                 config($option_name, $env_value);
                 $cc_required = true;
                 continue;
             }
 
             // By some reason isset() does not work for empty elements.
-            if (array_key_exists($option_name, $request->settings)) {
+            if (isset($request->settings) && array_key_exists($option_name, $request->settings)) {
                 $option_value = $request->settings[$option_name];
+
+                if (!empty($settings_params[$option_name]['encrypt'])) {
+                    $option_value = encrypt($option_value);
+                }
+
                 Option::set($option_name, $option_value);
             } else {
                 // If option does not exist, default will be used,
@@ -296,13 +363,20 @@ class SettingsController extends Controller
         }
 
         // Clear cache if some options have been saved to .env file.
+        // Clearing the cache also restarts queue:work as it also
+        // needs to get new .env parameters.
         if ($cc_required) {
             \Helper::clearCache(['--doNotGenerateVars' => true]);
         }
 
-        \Session::flash('flash_success_floating', __('Settings updated'));
+        // \Helper::clearCache prevents \Session::flash() from displaying.
+        $request->session()->flash('flash_success_floating', __('Settings updated'));
 
-        return redirect()->route('settings', ['section' => $section]);
+        $response = redirect()->route('settings', ['section' => $section]);
+
+        $response = \Eventy::filter('settings.after_save', $response, $request, $section, $settings);
+
+        return $response;
     }
 
     /**
@@ -327,17 +401,22 @@ class SettingsController extends Controller
                 }
 
                 if (!$response['msg']) {
-                    $test_result = false;
+                    $test_result = [
+                        'status' => 'error',
+                    ];
 
                     try {
                         $test_result = \MailHelper::sendTestMail($request->to);
                     } catch (\Exception $e) {
-                        $response['msg'] = $e->getMessage();
+                        $test_result['msg'] = $e->getMessage();
                     }
 
-                    if (!$test_result && !$response['msg']) {
-                        $response['msg'] = __('Error occurend sending email. Please check your mail server logs for more details.');
+                    if ($test_result['status'] == 'error') {
+                        $response['msg'] = $test_result['msg']
+                            ?: __('Error occurred sending email. Please check your mail server logs for more details.');
                     }
+
+                    $response['log'] = $test_result['log'] ?? '';
                 }
 
                 if (!$response['msg']) {
@@ -356,7 +435,7 @@ class SettingsController extends Controller
         }
 
         if ($response['status'] == 'error' && empty($response['msg'])) {
-            $response['msg'] = 'Unknown error occured';
+            $response['msg'] = 'Unknown error occurred';
         }
 
         return \Response::json($response);

app/Http/Controllers/SystemController.php

@@ -4,6 +4,7 @@ namespace App\Http\Controllers;
 
 use App\Option;
 use App\User;
+use App\FailedJob;
 use Carbon\Carbon;
 use Illuminate\Http\Request;
 use Symfony\Component\Console\Output\BufferedOutput;
@@ -19,7 +20,9 @@ class SystemController extends Controller
      */
     public function __construct()
     {
-        $this->middleware('auth');
+        $this->middleware('auth', ['except' => [
+            'cron'
+        ]]);
     }
 
     /**
@@ -27,21 +30,11 @@ class SystemController extends Controller
      */
     public function status(Request $request)
     {
-        // PHP extensions
-        $php_extensions = [];
-        foreach (\Config::get('app.required_extensions') as $extension_name) {
-            $alternatives = explode('/', $extension_name);
-            if ($alternatives) {
-                foreach ($alternatives as $alternative) {
-                    $php_extensions[$extension_name] = extension_loaded(trim($alternative));
-                    if ($php_extensions[$extension_name]) {
-                        break;
-                    }
-                }
-            } else {
-                $php_extensions[$extension_name] = extension_loaded($extension_name);
-            }
-        }
+        // PHP extensions.
+        $php_extensions = \Helper::checkRequiredExtensions();
+
+        // Functions.
+        $functions = \Helper::checkRequiredFunctions();
 
         // Permissions.
         $permissions = [];
@@ -56,6 +49,24 @@ class SystemController extends Controller
                 'value'  => $value,
             ];
         }
+
+        // Check if cache files are writable.
+        $non_writable_cache_file = '';
+        if (function_exists('shell_exec')) {
+            $non_writable_cache_file = \Helper::shellExec('find '.base_path('storage/framework/cache/data/').' -type f | xargs -I {} sh -c \'[ ! -w "{}" ] && echo {}\' 2>&1 | head -n 1');
+            if ($non_writable_cache_file === false) {
+                $non_writable_cache_file = 'Could not execute command via shell_exec()';
+            } else {
+                $non_writable_cache_file = trim($non_writable_cache_file ?? '');
+                // Leave only one line (in case head -n 1 does not work)
+                $non_writable_cache_file = preg_replace("#[\r\n].+#m", '', $non_writable_cache_file);
+                if (!strstr($non_writable_cache_file, base_path('storage/framework/cache/data/'))) {
+                    $non_writable_cache_file = '';
+                }
+            }
+        }
+        
+
         // Check if public symlink exists, if not, try to create.
         $public_symlink_exists = true;
         $public_path = public_path('storage');
@@ -73,14 +84,14 @@ class SystemController extends Controller
         $env_is_writable = is_writable(base_path('.env'));
 
         // Jobs
-        $queued_jobs = \App\Job::orderBy('created_at', 'desc')->get();
-        $failed_jobs = \App\FailedJob::orderBy('failed_at', 'desc')->get();
+        $queued_jobs = \App\Job::orderBy('created_at', 'desc')->limit(100)->get();
+        $failed_jobs = \App\FailedJob::orderBy('failed_at', 'desc')->limit(100)->get();
         $failed_queues = $failed_jobs->pluck('queue')->unique();
 
         // Commands
         $commands_list = [
-            'freescout:fetch-emails' => 'freescout:fetch-emails', 
-            \Helper::getWorkerIdentifier() => 'queue:work'
+            'freescout:fetch-emails' => 'freescout:fetch-emails',
+            \Helper::getWorkerIdentifier() => 'queue:work',
         ];
         foreach ($commands_list as $command_identifier => $command_name) {
             $status_texts = [];
@@ -90,13 +101,29 @@ class SystemController extends Controller
                 $running_commands = 0;
 
                 try {
-                    $processes = preg_split("/[\r\n]/", shell_exec("ps aux | grep '{$command_identifier}'"));
-                    $pids = [];
-                    foreach ($processes as $process) {
-                        preg_match("/^[\S]+\s+([\d]+)\s+/", $process, $m);
-                        if (!preg_match("/(sh \-c|grep )/", $process) && !empty($m[1])) {
-                            $running_commands++;
-                            $pids[] = $m[1];
+                    $ps_output = \Helper::shellExec("ps auxww | grep '{$command_identifier}'");
+
+                    if ($ps_output === false) {
+                        $commands[] = [
+                            'name'        => $command_name,
+                            'status'      => 'error',
+                            'status_text' => __h('Could not execute command via shell_exec()'),
+                        ];
+                    } else {
+                        $processes = preg_split("/[\r\n]/", $ps_output);
+                        $pids = [];
+                        foreach ($processes as $process) {
+                            $process = trim($process);
+                            preg_match("/^[\S]+\s+([\d]+)\s+/", $process, $m);
+                            if (empty($m)) {
+                                // Another format (used in Docker image).
+                                // 1713 nginx     0:00 /usr/bin/php82...
+                                preg_match("/^([\d]+)\s+[\S]+\s+/", $process, $m);
+                            }
+                            if (!preg_match("/(sh \-c|grep )/", $process) && !empty($m[1])) {
+                                $running_commands++;
+                                $pids[] = $m[1];
+                            }
                         }
                     }
                 } catch (\Exception $e) {
@@ -106,24 +133,24 @@ class SystemController extends Controller
                     $commands[] = [
                         'name'        => $command_name,
                         'status'      => 'success',
-                        'status_text' => __('Running'),
+                        'status_text' => __h('Running'),
                     ];
                     continue;
                 } elseif ($running_commands > 1) {
                     // queue:work command is stopped by settings a cache key
                     if ($command_name == 'queue:work') {
-                        \Helper::queueWorkRestart();
+                        \Helper::queueWorkerRestart();
                         $commands[] = [
                             'name'        => $command_name,
                             'status'      => 'error',
-                            'status_text' => __(':number commands were running at the same time. Commands have been restarted', ['number' => $running_commands]),
+                            'status_text' => __h(':number commands were running at the same time. Commands have been restarted', ['number' => htmlspecialchars($running_commands)]),
                         ];
                     } else {
                         unset($pids[0]);
                         $commands[] = [
                             'name'        => $command_name,
                             'status'      => 'error',
-                            'status_text' => __(':number commands are running at the same time. Please stop extra commands by executing the following console command:', ['number' => $running_commands]).' kill '.implode(' | kill ', $pids),
+                            'status_text' => __h(':number commands are running at the same time. Please stop extra commands by executing the following console command:', ['number' => htmlspecialchars($running_commands)]).' kill '.implode(' | kill ', $pids),
                         ];
                     }
                     continue;
@@ -138,7 +165,7 @@ class SystemController extends Controller
                 $date = Carbon::createFromTimestamp($last_run);
                 $date_text = User::dateFormat($date);
             }
-            $status_texts[] = __('Last run:').' '.$date_text;
+            $status_texts[] = __h('Last run:').' '.htmlspecialchars($date_text);
 
             $date_text = '?';
             $last_successful_run = Option::get($option_name.'_last_successful_run');
@@ -146,7 +173,7 @@ class SystemController extends Controller
                 $date_ = Carbon::createFromTimestamp($last_successful_run);
                 $date_text = User::dateFormat($date);
             }
-            $status_texts[] = __('Last successful run:').' '.$date_text;
+            $status_texts[] = __h('Last successful run:').' '.htmlspecialchars($date_text);
 
             $status = 'error';
             if ($last_successful_run && $last_run && (int) $last_successful_run >= (int) $last_run) {
@@ -156,7 +183,7 @@ class SystemController extends Controller
 
             // If queue:work is not running, clear cache to let it start if something is wrong with the mutex
             if ($command_name == 'queue:work' && !$last_successful_run) {
-                $status_texts[] = __('Try to :%a_start%clear cache:%a_end% to force command to start.', ['%a_start%' => '<a href="'.route('system.tools').'" target="_blank">', '%a_end%' => '</a>']);
+                $status_texts[] = __h('Try to :%a_start%clear cache:%a_end% to force command to start.', ['%a_start%' => '<a href="'.route('system.tools').'" target="_blank">', '%a_end%' => '</a>']);
                 // This sometimes makes Status page open as non logged in user.
                 //\Artisan::call('freescout:clear-cache', ['--doNotGenerateVars' => true]);
             }
@@ -168,39 +195,63 @@ class SystemController extends Controller
             ];
         }
 
-        // Check new version
+        // Check new version if enabled
         $new_version_available = false;
-        $latest_version = \Cache::remember('latest_version', 15, function () {
-            try {
-                return \Updater::getVersionAvailable();
-            } catch (\Exception $e) {
-                SystemController::$latest_version_error = $e->getMessage();
-                return '';
-            }
-        });
+        if (!\Config::get('app.disable_updating')) {
+            $latest_version = \Cache::remember('latest_version', 15, function () {
+                try {
+                    return \Updater::getVersionAvailable();
+                } catch (\Exception $e) {
+                    SystemController::$latest_version_error = $e->getMessage();
+                    return '';
+                }
+            });
 
-        if ($latest_version && version_compare($latest_version, \Config::get('app.version'), '>')) {
-            $new_version_available = true;
+            if ($latest_version && version_compare($latest_version, \Config::get('app.version'), '>')) {
+                $new_version_available = true;
+            }
+        } else {
+            $latest_version = \Config::get('app.version');
         }
 
+        // Detect missing migrations.
+        $migrations_output = \Helper::runCommand('migrate:status');
+        preg_match_all("#\| N    \| ([^\|]+)\|#", $migrations_output, $migrations_m);
+        $missing_migrations = $migrations_m[1] ?? [];
+
         return view('system/status', [
             'commands'              => $commands,
             'queued_jobs'           => $queued_jobs,
             'failed_jobs'           => $failed_jobs,
             'failed_queues'         => $failed_queues,
             'php_extensions'        => $php_extensions,
+            'functions'             => $functions,
             'permissions'           => $permissions,
             'new_version_available' => $new_version_available,
             'latest_version'        => $latest_version,
             'latest_version_error'  => SystemController::$latest_version_error,
             'public_symlink_exists' => $public_symlink_exists,
             'env_is_writable'       => $env_is_writable,
+            'non_writable_cache_file' => $non_writable_cache_file,
+            'missing_migrations'    => $missing_migrations,
+            'invalid_symlinks'      => \App\Module::checkSymlinks(),
         ]);
     }
 
     public function action(Request $request)
     {
         switch ($request->action) {
+            case 'cancel_job':
+                \App\Job::where('id', $request->job_id)->delete();
+                \Session::flash('flash_success_floating', __('Done'));
+                break;
+
+            case 'retry_job':
+                \App\Job::where('id', $request->job_id)->update(['available_at' => time()]);
+                sleep(1);
+                \Session::flash('flash_success_floating', __('Done'));
+                break;
+
             case 'delete_failed_jobs':
                 \App\FailedJob::where('queue', $request->failed_queue)->delete();
                 \Session::flash('flash_success_floating', __('Failed jobs deleted'));
@@ -253,12 +304,17 @@ class SystemController extends Controller
                 $params = [];
                 $params['--days'] = (int)$request->days;
                 $params['--unseen'] = (int)$request->unseen;
+                $params['--debug'] = (int)$request->debug;
                 \Artisan::call('freescout:fetch-emails', $params, $outputLog);
                 break;
 
             case 'migrate_db':
                 \Artisan::call('migrate', ['--force' => true], $outputLog);
                 break;
+
+            case 'logout_users':
+                \Artisan::call('freescout:logout-users', [], $outputLog);
+                break;
         }
 
         $output = $outputLog->fetch();
@@ -287,10 +343,10 @@ class SystemController extends Controller
             case 'update':
                 try {
                     $status = \Updater::update();
-                    
+
                     // Artisan::output()
                 } catch (\Exception $e) {
-                    $response['msg'] = __('Error occured. Please try again or try another :%a_start%update method:%a_end%', ['%a_start%' => '<a href="'.config('app.freescout_url').'/docs/update/" target="_blank">', '%a_end%' => '</a>']);
+                    $response['msg'] = __('Error occurred. Please try again or try another :%a_start%update method:%a_end%', ['%a_start%' => '<a href="'.config('app.freescout_url').'/docs/update/" target="_blank">', '%a_end%' => '</a>']);
                     $response['msg'] .= '<br/><br/>'.$e->getMessage();
 
                     \Helper::logException($e);
@@ -303,14 +359,18 @@ class SystemController extends Controller
                 break;
 
             case 'check_updates':
-                try {
-                    $response['new_version_available'] = \Updater::isNewVersionAvailable(config('app.version'));
-                    $response['status'] = 'success';
-                } catch (\Exception $e) {
-                    $response['msg'] = __('Error occured').': '.$e->getMessage();
-                }
-                if (!$response['msg'] && !$response['new_version_available']) {
-                    // Adding session flash is useless as cache is cleated
+                if (!\Config::get('app.disable_updating')) {
+                    try {
+                        $response['new_version_available'] = \Updater::isNewVersionAvailable(config('app.version'));
+                        $response['status'] = 'success';
+                    } catch (\Exception $e) {
+                        $response['msg'] = __('Error occurred').': '.$e->getMessage();
+                    }
+                    if (!$response['msg'] && !$response['new_version_available']) {
+                        // Adding session flash is useless as cache is cleated
+                        $response['msg_success'] = __('You have the latest version installed');
+                    }
+                } else {
                     $response['msg_success'] = __('You have the latest version installed');
                 }
                 break;
@@ -321,9 +381,57 @@ class SystemController extends Controller
         }
 
         if ($response['status'] == 'error' && empty($response['msg'])) {
-            $response['msg'] = 'Unknown error occured';
+            $response['msg'] = 'Unknown error occurred';
         }
 
         return \Response::json($response);
     }
+
+    /**
+     * Web Cron.
+     */
+    public function cron(Request $request)
+    {
+        if (empty($request->hash) || !\Helper::hashEquals($request->hash, \Helper::getWebCronHash())) {
+            abort(404);
+        }
+        $outputLog = new BufferedOutput();
+        \Artisan::call('schedule:run', [], $outputLog);
+        $output = $outputLog->fetch();
+
+        preg_match_all("#'artisan'\s+([^\s>]+)#", $output ?? '', $m);
+
+        $commands = $m[1] ?? [];
+        $result = count($commands)." commands executed:\r\n".(count($commands) ? '- ' : '').implode("\r\n- ", $commands);
+
+        return response($result, 200)->header('Content-Type', 'text/plain');
+    }
+
+    /**
+     * Ajax HTML.
+     * Content Security Policy header is sent via ContentSecurityPolicy middleware.
+     */
+    public function ajaxHtml(Request $request)
+    {
+        switch ($request->action) {
+            case 'job_details':
+                $job = \App\FailedJob::find($request->param);
+                if (!$job) {
+                    abort(404);
+                }
+
+                $html = '';
+                $payload = json_decode($job->payload, true);
+
+                if (!empty($payload['data']['command'])) {
+                    $html .= '<pre>'.\Helper::stripDangerousTags(print_r(unserialize($payload['data']['command'], ['allowed_classes' => false]), 1)).'</pre>';
+                }
+                
+                $html .= '<pre>'.\Helper::stripDangerousTags($job->exception).'</pre>';
+
+                return response($html);
+        }
+
+        abort(404);
+    }
 }

app/Http/Controllers/TranslateController.php

@@ -2,6 +2,7 @@
 
 namespace App\Http\Controllers;
 
+use \Barryvdh\TranslationManager\Models\Translation;
 use Barryvdh\TranslationManager\Controller as BaseController;
 
 class TranslateController extends BaseController
@@ -15,6 +16,13 @@ class TranslateController extends BaseController
     {
         $result = false;
 
+        // Count changed translations.
+        $changed_data = Translation::select(['locale', 'group', \DB::raw('count(*) as changed')])
+            ->where('status', Translation::STATUS_CHANGED)
+            ->groupBy(['locale', 'group'])
+            ->get()
+            ->toArray();
+
         $this->manager->exportTranslations('*', false);
 
         // Archive langs folder
@@ -31,7 +39,7 @@ class TranslateController extends BaseController
             $attachments[] = $archive_path;
 
             // Send archive to developers
-            $result = \MailHelper::sendEmailToDevs('Translations', '', $attachments, auth()->user());
+            $result = \MailHelper::sendEmailToDevs('Translations', json_encode($changed_data), $attachments, auth()->user());
         }
 
         if ($result) {
@@ -61,9 +69,13 @@ class TranslateController extends BaseController
     public function postDownload()
     {
         $this->manager->exportTranslations('*', false);
-        $file_name = 'lang.zip';
+
         // Archive langs folder
-        $archive_path = \Helper::createZipArchive(base_path().DIRECTORY_SEPARATOR.'resources/lang', $file_name, 'lang');
+        $archive_path = \Helper::createZipArchive(base_path().DIRECTORY_SEPARATOR.'resources/lang', 'lang.zip', 'lang');
+
+        $hash = substr(\Helper::hmacHash($archive_path), 0, 10);
+        $file_name = 'lang_'.$hash.'.zip';
+
         $public_path = storage_path('app/public/'.$file_name);
 
         \File::copy($archive_path, $public_path);

app/Http/Controllers/UsersController.php

@@ -2,7 +2,6 @@
 
 namespace App\Http\Controllers;
 
-use App\Events\UserDeleted;
 use App\Folder;
 use App\Mailbox;
 use App\Subscription;
@@ -33,7 +32,14 @@ class UsersController extends Controller
     {
         $this->authorize('create', 'App\User');
 
-        $users = User::nonDeleted()->get();
+        $users_query = User::nonDeleted();
+
+        // Exclude admins from list for non-admins.
+        if (!auth()->user()->isAdmin()) {
+            $users_query->where('role', User::ROLE_USER);
+        }
+
+        $users = $users_query->get();
         $users = User::sortUsers($users);
 
         return view('users/users', ['users' => $users]);
@@ -45,7 +51,7 @@ class UsersController extends Controller
     public function create()
     {
         $this->authorize('create', 'App\User');
-        $mailboxes = Mailbox::all();
+        $mailboxes = auth()->user()->mailboxesCanView();
 
         return view('users/create', ['mailboxes' => $mailboxes]);
     }
@@ -57,38 +63,73 @@ class UsersController extends Controller
      */
     public function createSave(Request $request)
     {
+        $invalid = false;
         $this->authorize('create', 'App\User');
+        $auth_user = auth()->user();
 
         $rules = [
-            'role'       => 'integer',
             'first_name' => 'required|string|max:20',
-            'last_name'  => 'required|string|max:30',
+            'last_name'  => 'max:30',
             'email'      => 'required|string|email|max:100|unique:users',
-            'role'       => ['required', Rule::in(array_keys(User::$roles))],
+            //'role'       => ['required', Rule::in(array_keys(User::$roles))],
         ];
+        if ($auth_user->isAdmin()) {
+            $rules['role'] = ['required', Rule::in(array_keys(User::$roles))];
+        }
         if (empty($request->send_invite)) {
             $rules['password'] = 'required|string|max:255';
         }
         $validator = Validator::make($request->all(), $rules);
 
-        if ($validator->fails()) {
+        if (User::mailboxEmailExists($request->email)) {
+            $invalid = true;
+            $validator->errors()->add('email', __('There is a mailbox with such email. Users and mailboxes can not have the same email addresses.'));
+        }
+
+        if ($invalid || $validator->fails()) {
             return redirect()->route('users.create')
                         ->withErrors($validator)
                         ->withInput();
         }
 
-        $user = new User();
-        $user->fill($request->all());
+        $password = '';
         if (empty($request->send_invite)) {
-            // Set password from request
-            $user->password = Hash::make($request->password);
+            // Set password from request.
+            $password = $request->password;
         } else {
-            // Set some random password before sending invite
-            $user->password = Hash::make($user->generateRandomPassword());
+            // Set some random password before sending invite.
+            $password = User::generateRandomPassword();
         }
+
+        $data = [
+            'first_name' => $request->first_name,
+            'last_name' => $request->last_name ?? '',
+            'email' => $request->email,
+            'password' => $password,
+        ];
+
+        $user = User::create($data);
+
+        if (!$auth_user->can('changeRole', $user)) {
+            $user->role = User::ROLE_USER;
+        } elseif (array_key_exists($request->role, User::$roles)) {
+            $user->role = $request->role;
+        }
+
+        // Set system timezone.
+        $user->timezone = config('app.timezone') ?: User::DEFAULT_TIMEZONE;
+        $user = \Eventy::filter('user.create_save', $user, $request);
         $user->save();
 
-        $user->mailboxes()->sync($request->mailboxes);
+        $mailbox_ids = $request->mailboxes ?: [];
+
+        if (!$auth_user->isAdmin()) {
+            // Exlude mailboxes to which current user has no access.
+            // https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-w36p-9vhj-x273
+            $mailbox_ids = array_intersect($mailbox_ids, $auth_user->mailboxesIdsCanView());
+        }
+
+        $user->mailboxes()->sync($mailbox_ids);
         $user->syncPersonalFolders($request->mailboxes);
 
         // Send invite
@@ -97,7 +138,7 @@ class UsersController extends Controller
                 $user->sendInvite(true);
             } catch (\Exception $e) {
                 // Admin is allowed to see exceptions
-                \Session::flash('flash_error_floating', $e->getMessage());
+                \Session::flash('flash_error_floating', $e->getMessage().' — '.__('Check mail settings in "Manage » Settings » Mail Settings"'));
             }
         }
 
@@ -126,7 +167,7 @@ class UsersController extends Controller
     public function getUsersForSidebar($except_id)
     {
         if (auth()->user()->isAdmin()) {
-            return User::sortUsers(User::nonDeleted()->get());/*->except($except_id)*/;
+            return User::sortUsers(User::nonDeleted()->get()); // ->except($except_id);
         } else {
             return [];
         }
@@ -141,15 +182,19 @@ class UsersController extends Controller
      */
     public function profileSave($id, Request $request)
     {
+        $invalid = false;
+
         $user = User::findOrFail($id);
         $this->authorize('update', $user);
 
+        $auth_user = auth()->user();
+
         // This is also present in PublicController::userSetup
         $validator = Validator::make($request->all(), [
             'first_name'  => 'required|string|max:20',
-            'last_name'   => 'required|string|max:30',
+            'last_name'   => 'max:30',
             'email'       => 'required|string|email|max:100|unique:users,email,'.$id,
-            'emails'      => 'max:100',
+            //'emails'      => 'max:100',
             'job_title'   => 'max:100',
             'phone'       => 'max:60',
             'timezone'    => 'required|string|max:255',
@@ -169,7 +214,8 @@ class UsersController extends Controller
                 if ($path_url) {
                     $user->photo_url = $path_url;
                 } else {
-                    $validator->errors()->add('photo_url', __('Error occured processing the image. Make sure that PHP GD extension is enabled.'));
+                    $invalid = true;
+                    $validator->errors()->add('photo_url', __('Error occurred processing the image. Make sure that PHP GD extension is enabled.'));
                 }
             }
 
@@ -177,19 +223,25 @@ class UsersController extends Controller
             if ($user->isAdmin() && isset($request->role) && $request->role != User::ROLE_ADMIN) {
                 $admins_count = User::where('role', User::ROLE_ADMIN)->count();
                 if ($admins_count < 2) {
+                    $invalid = true;
                     $validator->errors()->add('role', __('Role of the only one administrator can not be changed.'));
                 }
             }
         });
 
-        if ($validator->fails()) {
+        if (User::mailboxEmailExists($request->email)) {
+            $invalid = true;
+            $validator->errors()->add('email', __('There is a mailbox with such email. Users and mailboxes can not have the same email addresses.'));
+        }
+
+        if ($invalid || $validator->fails()) {
             return redirect()->route('users.profile', ['id' => $id])
                         ->withErrors($validator)
                         ->withInput();
         }
 
         // Save language into session.
-        if (auth()->user()->id == $id && $request->locale) {
+        if ($auth_user->id == $id && $request->locale) {
             session()->put('user_locale', $request->locale);
         }
 
@@ -198,15 +250,65 @@ class UsersController extends Controller
         if (isset($request_data['photo_url'])) {
             unset($request_data['photo_url']);
         }
-        if (!auth()->user()->can('changeRole', $user)) {
+        if (!$auth_user->can('changeRole', $user)) {
             unset($request_data['role']);
         }
-        $user->fill($request_data);
-
-        if (empty($request->input('enable_kb_shortcuts'))) {
-            $user->enable_kb_shortcuts = false;
+        if ($user->status != User::STATUS_DELETED) {
+            if (!empty($request_data['disabled'])) {
+                $request_data['status'] = User::STATUS_DISABLED;
+            } else {
+                $request_data['status'] = User::STATUS_ACTIVE;
+            }
         }
 
+        // Sanitize $request_data array.
+        // $allowed_fields = [
+        //     'first_name',
+        //     'last_name',
+        //     'email', 
+        //     'emails',
+        //     'job_title',
+        //     'phone',
+        //     'locale',
+        //     'timezone'
+        //     'time_format',
+        //     'photo_url',
+        // ];
+        $admin_fields = [
+            'role',
+            'status',
+            'email',
+            'only_assigned_tickets',
+        ];
+        $nonfillable_fields = [
+            'type',
+            'password',
+        ];
+        if (!$auth_user->isAdmin()) {
+            foreach ($admin_fields as $field) {
+                if (isset($request_data[$field])) {
+                    unset($request_data[$field]);
+                }
+            }
+        }
+        foreach ($nonfillable_fields as $field) {
+            if (isset($request_data[$field])) {
+                unset($request_data[$field]);
+            }
+        }
+
+        $user->setData($request_data);
+
+        if ($auth_user->isAdmin() && !$user->isAdmin()) {
+            if (!empty($request_data['only_assigned_tickets'])) {
+                $user->addPermission(User::PERM_ONLY_ASSIGNED_TICKETS, false);
+            } else {
+                $user->removePermission(User::PERM_ONLY_ASSIGNED_TICKETS, false);
+            }
+        }
+
+        $user = \Eventy::filter('user.save_profile', $user, $request);
+
         $user->save();
 
         \Session::flash('flash_success_floating', __('Profile saved successfully'));
@@ -226,7 +328,11 @@ class UsersController extends Controller
 
         $user = User::findOrFail($id);
 
-        $mailboxes = Mailbox::all();
+        if ($user->isDeleted()) {
+            abort(404);
+        }
+
+        $mailboxes = Mailbox::all()->sortBy('name');
 
         $users = $this->getUsersForSidebar($id);
 
@@ -253,9 +359,24 @@ class UsersController extends Controller
 
         $user = User::findOrFail($id);
 
-        $user->mailboxes()->sync($request->mailboxes);
+        $user->mailboxes()->sync($request->mailboxes ?: []);
         $user->syncPersonalFolders($request->mailboxes);
 
+        // Save permissions.
+        $user_permissions = $request->user_permissions ?? [];
+        $permissions = [];
+
+        foreach (User::getUserPermissionsList() as $permission_id) {
+            $new_has_permission = in_array($permission_id, $user_permissions);
+
+            if ($user->hasPermission($permission_id, false) != $new_has_permission) {
+                $permissions[$permission_id] = (int)(bool)$new_has_permission;
+                $save_user = true;
+            }
+        }
+        $user->permissions = $permissions;
+        $user->save();
+
         \Session::flash('flash_success_floating', __('Permissions saved successfully'));
 
         return redirect()->route('users.permissions', ['id' => $id]);
@@ -267,8 +388,12 @@ class UsersController extends Controller
     public function notifications($id)
     {
         $user = User::findOrFail($id);
-        $this->authorize('update', $user);
+        $this->authorize('updateNotifications', $user);
 
+        if ($user->isDeleted()) {
+            abort(404);
+        }
+        
         $subscriptions = $user->subscriptions()->select('medium', 'event')->get();
 
         $person = '';
@@ -296,7 +421,7 @@ class UsersController extends Controller
     public function notificationsSave($id, Request $request)
     {
         $user = User::findOrFail($id);
-        $this->authorize('update', $user);
+        $this->authorize('updateNotifications', $user);
 
         Subscription::saveFromArray($request->subscriptions, $user->id);
 
@@ -342,8 +467,8 @@ class UsersController extends Controller
 
                         $response['status'] = 'success';
                     } catch (\Exception $e) {
-                        // Admin is allowed to see exceptions
-                        $response['msg'] = $e->getMessage();
+                        // Admin is allowed to see exceptions.
+                        $response['msg'] = $e->getMessage().' — '.__('Check mail settings in "Manage » Settings » Mail Settings"');
                     }
                 }
                 break;
@@ -431,96 +556,26 @@ class UsersController extends Controller
                     $response['msg'] = __('User not found');
                 } elseif (!$auth_user->can('delete', $user)) {
                     $response['msg'] = __('Not enough permissions');
+                } elseif ($auth_user->id == $user->id) {
+                    // Do not allow admin delete himself.
+                    $response['msg'] = __('Not enough permissions');
                 }
 
                 // Check if the user is the only one admin
-                if (!$response['msg'] && $user->isAdmin()) {
-                    $admins_count = User::where('role', User::ROLE_ADMIN)->count();
-                    if ($admins_count < 2) {
-                        $response['msg'] = __('Administrator can not be deleted');
-                    }
-                }
+                // - not needed as only admin can delete  users and
+                // current admin can not delete himself.
+                // if (!$response['msg'] && $user->isAdmin()) {
+                //     $admins_count = User::where('role', User::ROLE_ADMIN)->count();
+                //     if ($admins_count < 2) {
+                //         $response['msg'] = __('Administrator can not be deleted');
+                //     }
+                // }
 
                 if (!$response['msg']) {
 
-                    // We have to process conversations one by one to move them to Unassigned folder,
-                    // as conversations may be in different mailboxes
-                    // $user->conversations()->update(['user_id' => null, 'folder_id' => ]);
-                    $mailbox_unassigned_folders = [];
+                    $user->deleteUser($auth_user, $request->assign_user);
 
-                    $user->conversations->each(function ($conversation) use ($auth_user, $request) {
-                        // We don't fire ConversationUserChanged event to avoid sending notifications to users
-                        if (!empty($request->assign_user) && !empty($request->assign_user[$conversation->mailbox_id]) && (int) $request->assign_user[$conversation->mailbox_id] != -1) {
-                            // Set assignee.
-                            $conversation->user_id = $request->assign_user[$conversation->mailbox_id];
-                        // In this case conversation stays assigned, just assignee changes.
-                        } else {
-                            // Set assignee.
-                            $conversation->user_id = null;
-
-                            // Change conversation folder to ANASSIGNED.
-                            $folder_id = null;
-                            if (!empty($mailbox_unassigned_folders[$conversation->mailbox_id])) {
-                                $folder_id = $mailbox_unassigned_folders[$conversation->mailbox_id];
-                            } else {
-                                $folder = $conversation->mailbox->folders()
-                                    ->where('type', Folder::TYPE_UNASSIGNED)
-                                    ->first();
-
-                                if ($folder) {
-                                    $folder_id = $folder->id;
-                                    $mailbox_unassigned_folders[$conversation->mailbox_id] = $folder_id;
-                                }
-                            }
-                            if ($folder_id) {
-                                $conversation->folder_id = $folder_id;
-                            }
-                        }
-
-                        $conversation->save();
-
-                        // Create lineitem thread
-                        $thread = new Thread();
-                        $thread->conversation_id = $conversation->id;
-                        $thread->user_id = $conversation->user_id;
-                        $thread->type = Thread::TYPE_LINEITEM;
-                        $thread->state = Thread::STATE_PUBLISHED;
-                        $thread->status = Thread::STATUS_NOCHANGE;
-                        $thread->action_type = Thread::ACTION_TYPE_USER_CHANGED;
-                        $thread->source_via = Thread::PERSON_USER;
-                        $thread->source_type = Thread::SOURCE_TYPE_WEB;
-                        $thread->customer_id = $conversation->customer_id;
-                        $thread->created_by_user_id = $auth_user->id;
-                        $thread->save();
-                    });
-
-                    // Recalculate counters for folders
-                    //if ($user->isAdmin()) {
-                    // Admin has access to all mailboxes
-                    Mailbox::all()->each(function ($mailbox) {
-                        $mailbox->updateFoldersCounters();
-                    });
-                    // } else {
-                    //     $user->mailboxes->each(function ($mailbox) {
-                    //         $mailbox->updateFoldersCounters();
-                    //     });
-                    // }
-
-                    // Disconnect user from mailboxes.
-                    $user->mailboxes()->sync([]);
-                    $user->folders()->delete();
-
-                    $user->status = \App\User::STATUS_DELETED;
-                    // Update email.
-                    $email_suffix = '_deleted'.date('YmdHis');
-                    // We have to truncate email to avoid "Data too long" error.
-                    $user->email = mb_substr($user->email, 0, User::EMAIL_MAX_LENGTH - mb_strlen($email_suffix)).$email_suffix;
-
-                    $user->save();
-
-                    event(new UserDeleted($user, $auth_user));
-
-                    \Session::flash('flash_success_floating', __('User deleted').': '.$user->getFullName());
+                    \Session::flash('flash_success_floating', __('User deleted').': '.htmlspecialchars($user->getFullName()));
 
                     $response['status'] = 'success';
                 }
@@ -528,11 +583,12 @@ class UsersController extends Controller
 
             default:
                 $response['msg'] = 'Unknown action';
+		        $response = \Eventy::filter('users.ajax.response_default', $response, $request);
                 break;
         }
 
         if ($response['status'] == 'error' && empty($response['msg'])) {
-            $response['msg'] = 'Unknown error occured';
+            $response['msg'] = 'Unknown error occurred';
         }
 
         return \Response::json($response);

app/Http/Kernel.php

@@ -18,8 +18,8 @@ class Kernel extends HttpKernel
         \Illuminate\Foundation\Http\Middleware\ValidatePostSize::class,
         \App\Http\Middleware\TrimStrings::class,
         \Illuminate\Foundation\Http\Middleware\ConvertEmptyStringsToNull::class,
+        \App\Http\Middleware\TrustHosts::class,
         \App\Http\Middleware\TrustProxies::class,
-        // todo: These two may need to be moved into 'web' not to be called in 'api'.
         \App\Http\Middleware\ResponseHeaders::class,
         \App\Http\Middleware\TerminateHandler::class,
     ];
@@ -40,15 +40,25 @@ class Kernel extends HttpKernel
             \App\Http\Middleware\VerifyCsrfToken::class,
             \Illuminate\Routing\Middleware\SubstituteBindings::class,
             \App\Http\Middleware\HttpsRedirect::class,
+            \App\Http\Middleware\CheckBrowser::class,
             \App\Http\Middleware\Localize::class,
             \App\Http\Middleware\LogoutIfDeleted::class,
+            \App\Http\Middleware\FrameGuard::class,
+            \App\Http\Middleware\CustomHandle::class,
+            \App\Http\Middleware\ContentSecurityPolicy::class,
+        ],
+
+        'open' => [
+            \Illuminate\Routing\Middleware\SubstituteBindings::class,
+            \App\Http\Middleware\HttpsRedirect::class,
+            \App\Http\Middleware\FrameGuard::class,
             \App\Http\Middleware\CustomHandle::class,
         ],
 
-        'api' => [
-            'throttle:60,1',
-            'bindings',
-        ],
+        // 'api' => [
+        //     'throttle:60,1',
+        //     'bindings',
+        // ],
     ];
 
     /**

app/Http/Middleware/CheckBrowser.php

@@ -0,0 +1,33 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Redirect;
+
+class CheckBrowser
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param \Illuminate\Http\Request $request
+     * @param \Closure                 $next
+     * @param string|null              $guard
+     *
+     * @return mixed
+     */
+    public function handle($request, Closure $next, $guard = null)
+    {
+        $result = \Helper::checkBrowser($request);
+        if ($result['msg']) {
+            if (config('app.disable_browser_check')) {
+                //\Log::error($result['msg']);
+            } else {
+                abort(403, __($result['msg'].'[display]'));
+            }
+        }
+
+        return $next($request);
+    }
+}

app/Http/Middleware/ContentSecurityPolicy.php

@@ -0,0 +1,34 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Redirect;
+
+/**
+ * On regular pages CSP is added via <meta> tag.
+ * For /ajax-html/ requests CSP is added as a response header.
+ */
+class ContentSecurityPolicy
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param \Illuminate\Http\Request $request
+     * @param \Closure                 $next
+     * @param string|null              $guard
+     *
+     * @return mixed
+     */
+    public function handle($request, Closure $next, $guard = null)
+    {
+        $response = $next($request);
+
+        if (str_contains($request->path(), '/ajax-html/')) {
+            $response->header('Content-Security-Policy', \Helper::getCspValue());
+        }
+
+        return $response;
+    }
+}

app/Http/Middleware/CustomHandle.php

@@ -16,9 +16,14 @@ class CustomHandle
      */
     public function handle($request, Closure $next)
     {
+        // Enable/disable chat mode
+        if ($request->exists('chat_mode')) {
+            \Helper::setChatMode((int)$request->chat_mode);
+        }
+
         // Hook.
         \Eventy::action('middleware.web.custom_handle', $request);
 
-        return $next($request);
+        return \Eventy::filter('middleware.web.custom_handle.response', $next($request), $request, $next);
     }
 }

app/Http/Middleware/EncryptCookies.php

@@ -12,6 +12,7 @@ class EncryptCookies extends Middleware
      * @var array
      */
     protected $except = [
-        'in_app'
+        'in_app',
+        'customers_view',
     ];
 }

app/Http/Middleware/FrameGuard.php

@@ -0,0 +1,32 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+
+class FrameGuard
+{
+    /**
+     * Handle the given request and get the response.
+     */
+    public function handle($request, Closure $next)
+    {
+        $response = $next($request);
+
+        $x_frame_options = config('app.x_frame_options');
+
+        if (false !== $x_frame_options 
+            && $x_frame_options !== 'false'
+            && $x_frame_options !== '0'
+        ) {
+            $value = 'SAMEORIGIN';
+
+            if (is_string($x_frame_options) && preg_match("#(DENY|SAMEORIGIN|ALLOW-FROM)#i", $x_frame_options)) {
+                $value = $x_frame_options;
+            }
+            $response->headers->set('X-Frame-Options', $value, false);
+        }
+
+        return $response;
+    }
+}

app/Http/Middleware/HttpsRedirect.php

@@ -11,33 +11,38 @@ use Closure;
 use Illuminate\Support\Facades\App;
 use Illuminate\Http\Request;
 
-class HttpsRedirect {
-
+class HttpsRedirect
+{
     /**
      * The current proxy header mappings.
      *
      * @var array
      */
-    protected $headers = [
-        Request::HEADER_FORWARDED         => 'FORWARDED',
-        Request::HEADER_X_FORWARDED_FOR   => 'X_FORWARDED_FOR',
-        Request::HEADER_X_FORWARDED_HOST  => 'X_FORWARDED_HOST',
-        Request::HEADER_X_FORWARDED_PORT  => 'X_FORWARDED_PORT',
-        Request::HEADER_X_FORWARDED_PROTO => 'X_FORWARDED_PROTO',
-    ];
+    // protected $headers = [
+    //     Request::HEADER_FORWARDED         => 'FORWARDED',
+    //     Request::HEADER_X_FORWARDED_FOR   => 'X_FORWARDED_FOR',
+    //     Request::HEADER_X_FORWARDED_HOST  => 'X_FORWARDED_HOST',
+    //     Request::HEADER_X_FORWARDED_PORT  => 'X_FORWARDED_PORT',
+    //     Request::HEADER_X_FORWARDED_PROTO => 'X_FORWARDED_PROTO',
+    // ];
 
     public function handle($request, Closure $next)
     {
-        if (\Config::get('app.force_https') == 'true') {
-            $request->setTrustedProxies( [ $request->getClientIp() ], array_keys($this->headers)); 
-
-            if (!$request->secure() && strtolower($_SERVER['HTTPS'] ?? '') != 'on' 
-                && ($_SERVER['HTTP_X_FORWARDED_PROTO'] ?? '') != 'https'
-                && ($_SERVER['HTTP_CF_VISITOR'] ?? '') != '{"scheme":"https"}'
-            ) {
+        if (\Helper::isHttps() && !\Helper::isConsole()) {
+            //$request->setTrustedProxies( [ $request->getClientIp() ], array_keys($this->headers)); 
+            //!$request->secure()
+            if (!\Helper::isCurrentUrlHttps()) {
                 return redirect()->secure($request->getRequestUri());
             }
         }
+
+        // Correct protocol in $_SERVER
+        if (\Helper::isHttps() 
+            //&& !$request->secure() 
+            && strtolower($_SERVER['HTTPS'] ?? '') != 'on'
+        ) {
+            $_SERVER['HTTPS'] = 'on';
+        }
         return $next($request);
     }
-}
+}

app/Http/Middleware/Localize.php

@@ -19,12 +19,9 @@ class Localize
         // Interface language is set automatically, as locale is stored in .env file.
 
         // Set user language if user logged in.
-        $user_locale = session('user_locale');
+        $user_locale = \Eventy::filter('locale', session('user_locale'));
         if ($user_locale) {
-            // app()->setLocale() also dynamically changes config('app.locale'),
-            // so we have to remember current locale in real_locale parameter.
-            \Config::set('app.real_locale', config('app.locale'));
-            app()->setLocale($user_locale);
+            \Helper::setLocale($user_locale);
         }
 
         return $next($request);

app/Http/Middleware/LogoutIfDeleted.php

@@ -20,7 +20,7 @@ class LogoutIfDeleted
     public function handle($request, Closure $next, $guard = null)
     {
         $user = Auth::user();
-        if ($user && $user->status == \App\User::STATUS_DELETED) {
+        if ($user && ($user->isDeleted() || $user->isDisabled())) {
             Auth::logout();
             return Redirect::route('login');
         }

app/Http/Middleware/ResponseHeaders.php

@@ -6,11 +6,30 @@ use Closure;
 
 class ResponseHeaders
 {
+    private $unwanted_headers = [
+        'X-Powered-By',
+        'Server',
+    ];
+
     public function handle($request, Closure $next)
     {
+        $this->removeUnwantedHeaders($this->unwanted_headers);
+
         $response = $next($request);
 
-        // Disable caching
+        // Secure headers.
+        //$response->headers->set('Referrer-Policy', 'no-referrer-when-downgrade');
+        $response->headers->set('X-Content-Type-Options', 'nosniff');
+        // $response->headers->set('X-XSS-Protection', '1; mode=block');
+        // $response->headers->set('X-Frame-Options', 'DENY');
+        //$response->headers->set('Content-Security-Policy', "style-src 'self'");
+        
+        // Instruct browsers to always use HTTPS for all future requests.
+        if (\Helper::isHttps()) {
+            $response->headers->set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains; preload');
+        }
+
+        // Disable caching.
         if (method_exists($response, 'header')) {
             $response->header('Pragma', 'no-cache');
             $response->header('Cache-Control', 'no-cache, max-age=0, must-revalidate, no-store');
@@ -18,4 +37,11 @@ class ResponseHeaders
 
         return $response;
     }
+
+    private function removeUnwantedHeaders($headerList)
+    {
+        foreach ($headerList as $header) {
+            header_remove($header);
+        }
+    }
 }

app/Http/Middleware/TerminateHandler.php

@@ -14,7 +14,7 @@ class TerminateHandler
 
     public function terminate($request, $response)
     {
-        // Process events which occured
+        // Process events which occurred
         Subscription::processEvents();
     }
 }

app/Http/Middleware/TokenAuth.php

@@ -17,14 +17,31 @@ class TokenAuth
      */
     public function handle($request, Closure $next)
     {
-        if (!$request->user() && !empty($request->auth_token) && $request->cookie('in_app')) {
-            try {
-                $user = User::where(\DB::raw('md5(CONCAT(id, "'.config('app.key').'"))') , $request->auth_token)
-                    ->first();
-            } catch (\Exception $e) {
-                \Helper::logException($e, '[TokenAuth]');
+        // This is needed to restore authentication when app session expires.
+        if (!$request->user() && !empty($request->auth_token) && is_string($request->auth_token) && \Helper::isInApp($request)) {
+        
+            // Decode token (format: urlencode(base64_encode(user_id:expiry:hash)))
+            $parts = explode(':', urldecode(base64_decode($request->auth_token)));
+            if (count($parts) !== 3) {
+                return $next($request);
             }
-            if (!empty($user)) {
+            list($user_id, $expiry, $token_hash) = $parts;
+
+            // Check expiration.
+            if (time() > (int)$expiry) {
+                return $next($request);
+            }
+
+            // Get user.
+            $user = User::find($user_id);
+            if (!$user) {
+                return $next($request);
+            }
+
+            // Verify hash.
+            $hash = hash_hmac('sha256', $user_id.':'.$expiry, config('app.key').$user->password);
+
+            if (hash_equals($hash, $token_hash)) {
                 \Auth::login($user);
             }
         }

app/Http/Middleware/TrustHosts.php

@@ -0,0 +1,98 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Illuminate\Contracts\Foundation\Application;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Exception\SuspiciousOperationException;
+
+/**
+ * https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-822g-7rw5-53xj
+ */
+class TrustHosts
+{
+    /**
+     * The application instance.
+     *
+     * @var \Illuminate\Contracts\Foundation\Application
+     */
+    protected $app;
+
+    /**
+     * The trusted hosts that have been configured to always be trusted.
+     */
+    protected static $trusted_hosts;
+
+
+    /**
+     * Create a new middleware instance.
+     *
+     * @param  \Illuminate\Contracts\Foundation\Application  $app
+     */
+    public function __construct(Application $app)
+    {
+        $this->app = $app;
+    }
+
+    /**
+     * Handle the incoming request.
+     */
+    public function handle(Request $request, $next)
+    {
+        if (//! $this->app->environment('local') &&
+            $this->app->runningUnitTests()
+        ) {
+            return $next($request);
+        }
+
+        // Check if current host matches APP_URL.
+        list($current_host) = explode(':', request()->getHttpHost());
+        $current_host = mb_strtolower($current_host);
+
+        $app_host = mb_strtolower(\Helper::getDomain());
+
+        // Do not check during installation process.
+        if ($app_host == 'example.com' && preg_match("#^install/#", $request->path())) {
+            return $next($request);
+        }
+
+        if ($current_host == $app_host) {
+            return $next($request);
+        }
+
+        // Check hosts from APP_TRUSTED_HOSTS.
+        $trusted_hosts = explode(',', config('app.trusted_hosts'));
+        foreach ($trusted_hosts as $host) {
+            $host = mb_strtolower(trim($host));
+            if ($host && $current_host == $host) {
+                return $next($request);
+            }
+        }
+        
+        $is_trusted_host = \Eventy::filter('app.is_trusted_host', false, $current_host);
+
+        if ($is_trusted_host) {
+            return $next($request);
+        }
+ 
+        // Throws: Untrusted Host...
+        //Request::setTrustedHosts([$current_host]);
+        //throw new SuspiciousOperationException(sprintf('Untrusted Host "%s".', $host));
+
+        \Helper::denyAccess("Untrusted Host: {$current_host}. Add the following to your .env file and clear cache: APP_TRUSTED_HOSTS ='$current_host'", true);
+
+        //return $next($request);
+    }
+
+    /**
+     * Get a regular expression matching the application URL and all of its subdomains.
+     *
+     * @return string|null
+     */
+    // protected function allSubdomainsOfAppUrl()
+    // {
+    //     if ($host = parse_url($this->app['config']->get('app.url'), PHP_URL_HOST)) {
+    //         return '^(.+\.)?'.preg_quote($host).'$';
+    //     }
+    // }
+}

app/Job.php

@@ -2,12 +2,72 @@
 
 namespace App;
 
+use App\Thread;
 use Illuminate\Database\Eloquent\Model;
 
 class Job extends Model
 {
+	const UPDATED_AT = null;
+
+	public $payload_decoded = null;
+
     /**
      * Automatically converted into Carbon dates.
      */
     protected $dates = ['created_at', 'available_at', 'reserved_at'];
+
+    public function getPayloadDecoded()
+    {
+    	if ($this->payload_decoded !== null) {
+    		return $this->payload_decoded;
+    	}
+
+    	$this->payload_decoded = json_decode($this->payload, true);
+
+    	return $this->payload_decoded;
+    }
+
+    public function getCommand($allowed_classes = [])
+    {
+    	return self::getPayloadCommand($this->getPayloadDecoded(), $allowed_classes);
+    }
+
+    public function getCommandLastThread()
+    {
+	    $command = $this->getCommand();
+        if ($command && !empty($command->threads)) {
+            return Thread::getLastThread($command->threads);
+        }
+
+        return null;
+    }
+
+    public static function getPayloadCommand($payload, $allowed_classes = [])
+    {
+    	if (empty($payload['data']) || empty($payload['data']['command'])) {
+    		return null;
+    	}
+        if (!$allowed_classes) {
+            $allowed_classes = [
+                'App\Jobs\SendReplyToCustomer',
+                'App\Jobs\SendNotificationToUsers',
+                'App\Jobs\SendAutoReply',
+                'App\Jobs\SendAlert',
+                'App\Jobs\SendEmailReplyError',
+                'Illuminate\Contracts\Database\ModelIdentifier',
+            ];
+        }
+        try {
+            // If some record has been deleted from DB, there will be an error:
+            // No query results for model [App\Conversation].
+            return unserialize($payload['data']['command'], ['allowed_classes' => $allowed_classes]);
+        } catch (\Exception $e) {
+            return null;
+        }
+    }
+
+    public static function getTriggerActionName($payload)
+    {
+        return preg_replace('/^.*?action";s:\d+:"([^"]+)".*$/s', '$1', $payload['data']['command'] ?? '');
+    }
 }

app/Jobs/RestartQueueWorker.php

@@ -0,0 +1,41 @@
+<?php
+/**
+ * Used to stop current queue:work in order to start a new one.
+ * https://github.com/freescout-helpdesk/freescout/issues/2507#issuecomment-1376006247
+ */
+
+namespace App\Jobs;
+
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Bus\Dispatchable;
+use Illuminate\Queue\InteractsWithQueue;
+use Illuminate\Queue\SerializesModels;
+
+class RestartQueueWorker implements ShouldQueue
+{
+    use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;
+
+    /**
+     * Create a new job instance.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        
+    }
+
+    /**
+     * Execute the job.
+     *
+     * @return void
+     */
+    public function handle()
+    {
+        $this->delete();
+        // register_shutdown_function() is called on exit(),
+        // so commands mutexes are removed.
+        exit();
+    }
+}

app/Jobs/SendAlert.php

@@ -20,8 +20,17 @@ class SendAlert implements ShouldQueue
     use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;
 
     public $text;
+
     public $title;
 
+    /**
+     * The number of seconds the job can run before timing out.
+     * fwrite() function in /vendor/swiftmailer/swiftmailer/lib/classes/Swift/Transport/StreamBuffer.php
+     * in some cases may stuck and continue infinitely. This blocks queue:work and no other jobs are processed.
+     * So we need to set the timeout. On timeout the whole queue:work process is being killed by Laravel.
+     */
+    public $timeout = 120;
+
     /**
      * Create a new job instance.
      *
@@ -43,18 +52,17 @@ class SendAlert implements ShouldQueue
         // Configure mail driver according to Mailbox settings
         \MailHelper::setSystemMailDriver();
 
-        $recipients = [];
-
-        $super_admin = User::getSuperAdmin();
-        if ($super_admin) {
-            $recipients[] = $super_admin->email;
-        }
+        $recipients = User::nonDeleted()
+            ->where('role', User::ROLE_ADMIN)
+            ->where('invite_state', User::INVITE_STATE_ACTIVATED)
+            ->pluck('email')
+            ->toArray();
 
         $extra = \MailHelper::sanitizeEmails(\Option::get('alert_recipients'));
         if ($extra) {
             $recipients = array_unique(array_merge($recipients, $extra));
         }
-
+      
         foreach ($recipients as $recipient) {
             $exception = null;
 

app/Jobs/SendAutoReply.php

@@ -23,6 +23,14 @@ class SendAutoReply implements ShouldQueue
 
     public $customer;
 
+    /**
+     * The number of seconds the job can run before timing out.
+     * fwrite() function in /vendor/swiftmailer/swiftmailer/lib/classes/Swift/Transport/StreamBuffer.php
+     * in some cases may stuck and continue infinitely. This blocks queue:work and no other jobs are processed.
+     * So we need to set the timeout. On timeout the whole queue:work process is being killed by Laravel.
+     */
+    public $timeout = 120;
+
     /**
      * Create a new job instance.
      *
@@ -43,25 +51,49 @@ class SendAutoReply implements ShouldQueue
      */
     public function handle()
     {
+        // Auto reply disabled.
+        if (!empty($this->conversation->meta['ar_off'])) {
+            return;
+        }
+
         // Configure mail driver according to Mailbox settings
-        \App\Misc\Mail::setMailDriver($this->mailbox);
+        \App\Misc\Mail::setMailDriver($this->mailbox, null, $this->conversation);
 
         // Auto reply appears as reply in customer's mailbox
         $headers['In-Reply-To'] = '<'.$this->thread->message_id.'>';
         $headers['References'] = '<'.$this->thread->message_id.'>';
 
         // Create Message-ID for the auto reply
-        $message_id = \App\Misc\Mail::MESSAGE_ID_PREFIX_AUTO_REPLY.'-'.$this->thread->id.'-'.md5($this->thread->id).'@'.$this->mailbox->getEmailDomain();
+        $message_id = \App\Misc\Mail::MESSAGE_ID_PREFIX_AUTO_REPLY.'-'.$this->thread->id.'-'.\MailHelper::getMessageIdHash($this->thread->id).'@'.$this->mailbox->getEmailDomain();
         $headers['Message-ID'] = $message_id;
 
         $customer_email = $this->conversation->customer_email;
+
+        if (!$customer_email) {
+            // When message is received via Chat, customer has no email adddress.
+            return;
+        }
         $recipients = [$customer_email];
         $failures = [];
         $exception = null;
 
+        // Reply from the alias the customer emailed (if "Allow to reply from aliases" is enabled).
+        $from_alias = '';
+        $aliases = $this->mailbox->getAliases(true, true);
+        if (count($aliases)) {
+            $original_recipients = array_merge($this->thread->getToArray(), $this->thread->getCcArray());
+            foreach ($original_recipients as $original_recipient) {
+                $original_recipient = \App\Email::sanitizeEmail($original_recipient);
+                if ($original_recipient && array_key_exists($original_recipient, $aliases)) {
+                    $from_alias = $original_recipient;
+                    break;
+                }
+            }
+        }
+
         try {
             Mail::to([['name' => $this->customer->getFullName(), 'email' => $customer_email]])
-                ->send(new AutoReply($this->conversation, $this->mailbox, $this->customer, $headers));
+                ->send(new AutoReply($this->conversation, $this->mailbox, $this->customer, $headers, $from_alias));
         } catch (\Exception $e) {
             // We come here in case SMTP server unavailable for example
             activity()

app/Jobs/SendEmailReplyError.php

@@ -24,16 +24,27 @@ class SendEmailReplyError implements ShouldQueue
 
     public $mailbox;
 
+    public $text;
+
+    /**
+     * The number of seconds the job can run before timing out.
+     * fwrite() function in /vendor/swiftmailer/swiftmailer/lib/classes/Swift/Transport/StreamBuffer.php
+     * in some cases may stuck and continue infinitely. This blocks queue:work and no other jobs are processed.
+     * So we need to set the timeout. On timeout the whole queue:work process is being killed by Laravel.
+     */
+    public $timeout = 120;
+
     /**
      * Create a new job instance.
      *
      * @return void
      */
-    public function __construct($from, $user, $mailbox)
+    public function __construct($from, $user, $mailbox, $text = null)
     {
         $this->from = $from;
         $this->user = $user;
         $this->mailbox = $mailbox;
+        $this->text = $text;
     }
 
     /**
@@ -50,7 +61,7 @@ class SendEmailReplyError implements ShouldQueue
 
         try {
             Mail::to([['name' => '', 'email' => $this->from]])
-                ->send(new UserEmailReplyError());
+                ->send(new UserEmailReplyError($this->text));
         } catch (\Exception $e) {
             // We come here in case SMTP server unavailable for example
             activity()

app/Jobs/SendNotificationToUsers.php

@@ -16,15 +16,23 @@ class SendNotificationToUsers implements ShouldQueue
 {
     use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;
 
-    // Max retries + 1
-    public $tries = 168; // One per hour
-
     public $users;
 
     public $conversation;
 
     public $threads;
 
+    // Max retries + 1
+    public $tries = 168; // One per hour
+
+    /**
+     * The number of seconds the job can run before timing out.
+     * fwrite() function in /vendor/swiftmailer/swiftmailer/lib/classes/Swift/Transport/StreamBuffer.php
+     * in some cases may stuck and continue infinitely. This blocks queue:work and no other jobs are processed.
+     * So we need to set the timeout. On timeout the whole queue:work process is being killed by Laravel.
+     */
+    public $timeout = 120;
+
     /**
      * Create a new job instance.
      *
@@ -47,31 +55,67 @@ class SendNotificationToUsers implements ShouldQueue
         $mailbox = $this->conversation->mailbox;
 
         // Configure mail driver according to Mailbox settings
-        \App\Misc\Mail::setMailDriver($mailbox);
+        \App\Misc\Mail::setMailDriver($mailbox, null, $this->conversation);
 
         // Threads has to be sorted here, if sorted before, they come here in wrong order
-        $this->threads = $this->threads->sortByDesc(function ($item, $key) {
-            return $item->created_at;
-        });
+        $this->threads = Thread::sortThreads($this->threads);
 
         $headers = [];
         $last_thread = $this->threads->first();
 
+        if (!$last_thread) {
+            return;
+        }
+
         // If thread is draft, it means it has been undone
         if ($last_thread->isDraft()) {
             return;
         }
 
+        // Do not send email notifications to support agents
+        // if the email is a bounce and mail server send limit reached.
+        // https://github.com/freescout-help-desk/freescout/issues/4806
+        if ($last_thread->isBounce() && strstr($last_thread->body, 'message limit exceeded')) {
+            return;
+        }
+
+        // Limit conversation history
+        if (config('app.email_user_history') == 'last') {
+            $this->threads = $this->threads->slice(0, 2);
+        }
+
+        if (config('app.email_user_history') == 'none') {
+            $this->threads = $this->threads->slice(0, 1);
+        }
+
         // All notification for the same conversation has same dummy Message-ID
         $prev_message_id = \App\Misc\Mail::MESSAGE_ID_PREFIX_NOTIFICATION_IN_REPLY.'-'.$this->conversation->id.'-'.md5($this->conversation->id).'@'.$mailbox->getEmailDomain();
         $headers['In-Reply-To'] = '<'.$prev_message_id.'>';
         $headers['References'] = '<'.$prev_message_id.'>';
+        // https://github.com/freescout-helpdesk/freescout/issues/2488
+        $headers['X-Auto-Response-Suppress'] = 'All';
 
         // We throw an exception if any of the send attempts throws an exception (connection error, etc)
-        $global_exception = null;
+        $last_send_exception = null;
 
         foreach ($this->users as $user) {
 
+            // https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-2j2c-g32w-96vm
+            $user->refresh();
+
+            // User can ne deleted from DB.
+            if (!isset($user->id)) {
+                continue;
+            }
+
+            if ($user->isDeleted()) {
+                continue;
+            }
+
+            if (!$user->can('view', $this->conversation)) {
+                continue;
+            }
+
             // If for one user sending fails the job is marked as failed and retried after some time.
             // So we have to check if notification email has already been successfully sent to this user.
             if ($this->attempts() > 1) {
@@ -86,13 +130,16 @@ class SendNotificationToUsers implements ShouldQueue
                 }
             }
 
-            $message_id = \App\Misc\Mail::MESSAGE_ID_PREFIX_NOTIFICATION.'-'.$last_thread->id.'-'.$user->id.'-'.time().'@'.$mailbox->getEmailDomain();
+            $message_id = \App\Misc\Mail::MESSAGE_ID_PREFIX_NOTIFICATION.'-'.$last_thread->id.'-'.$user->id.'-'.\MailHelper::getMessageIdHash($last_thread->id).'@'.$mailbox->getEmailDomain();
             $headers['Message-ID'] = $message_id;
 
             // If this is notification on message from customer, set customer as sender name
             $from_name = '';
             if ($last_thread->type == Thread::TYPE_CUSTOMER) {
-                $from_name = $last_thread->customer->getFullName();
+                $from_name = '';
+                if ($last_thread->customer) {
+                    $from_name = $last_thread->customer->getFullName(true, true);
+                }
                 if ($from_name) {
                     $from_name = $from_name.' '.__('via').' '.$mailbox->name;
                 }
@@ -105,23 +152,27 @@ class SendNotificationToUsers implements ShouldQueue
             // Set user language
             app()->setLocale($user->getLocale());
 
+            $headers['X-FreeScout-Mail-Type'] = 'user.notification';
+            $headers = \Eventy::filter('jobs.send_reply_to_customer.headers', $headers, $user, $mailbox, $this->conversation, $this->threads, $from);
+
             $exception = null;
 
             try {
                 Mail::to([['name' => $user->getFullName(), 'email' => $user->email]])
                     ->send(new UserNotification($user, $this->conversation, $this->threads, $headers, $from, $mailbox));
             } catch (\Exception $e) {
-                // We come here in case SMTP server unavailable for example
+                // We come here if SMTP server unavailable for example
                 activity()
                     ->causedBy($user)
                     ->withProperties([
                         'error'    => $e->getMessage().'; File: '.$e->getFile().' ('.$e->getLine().')',
+                        'conversation'   => '#'.$this->conversation->number.'-'.($last_thread ? $last_thread->id : ''),
                      ])
                     ->useLog(\App\ActivityLog::NAME_EMAILS_SENDING)
                     ->log(\App\ActivityLog::DESCRIPTION_EMAILS_SENDING_ERROR_TO_USER);
 
                 $exception = $e;
-                $global_exception = $e;
+                $last_send_exception = $e;
             }
 
             $status_message = '';
@@ -142,15 +193,33 @@ class SendNotificationToUsers implements ShouldQueue
             SendLog::log($last_thread->id, $message_id, $user->email, SendLog::MAIL_TYPE_USER_NOTIFICATION, $status, null, $user->id, $status_message);
         }
 
-        if ($global_exception) {
+        if ($last_send_exception) {
             // Retry job with delay.
             // https://stackoverflow.com/questions/35258175/how-can-i-create-delays-between-failed-queued-job-attempts-in-laravel
-            if ($this->attempts() < $this->tries) {
-                $this->release(3600);
+            // We do not try to resend Bounce messages: https://github.com/freescout-helpdesk/freescout/issues/3156
+            if ($this->attempts() < $this->tries && !$last_thread->isBounce()) {
+                if ($this->attempts() == 1) {
+                    // Second attempt after 5 min.
+                    $this->release(300);
+                } else {
+                    // Mail data has been passed to the mail server but after that
+                    // we have not receved a response from the mail server (due to timeout).
+                    // So we may consider that the email has been successfully sent.
+                    // Otherwise this email may be sent again and again.
+                    if ($this->attempts() >= 3
+                        && preg_match("#^Connection to .* Timed Out$#", $last_send_exception->getMessage())
+                        && \MailHelper::$smtp_data_sent
+                    ) {
+                        $this->fail($last_send_exception);
+                    }
 
-                throw $global_exception;
+                    // Others - after 1 hour.
+                    $this->release(3600);
+                }
+
+                throw $last_send_exception;
             } else {
-                $this->fail($global_exception);
+                $this->fail($last_send_exception);
 
                 return;
             }

app/Jobs/SendReplyToCustomer.php

@@ -3,34 +3,49 @@
 namespace App\Jobs;
 
 use App\Mail\ReplyToCustomer;
+use App\Customer;
 use App\SendLog;
 use App\Thread;
+use App\Misc\SwiftGetSmtpQueueId;
 use Illuminate\Bus\Queueable;
 use Illuminate\Contracts\Queue\ShouldQueue;
 use Illuminate\Foundation\Bus\Dispatchable;
 use Illuminate\Queue\InteractsWithQueue;
 use Illuminate\Queue\SerializesModels;
 use Mail;
+//use Webklex\IMAP\Client;
 
 class SendReplyToCustomer implements ShouldQueue
 {
     use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;
 
-    // Number of retries + 1
-    public $tries = 168; // one per hour
-
     public $conversation;
 
     public $threads;
 
+    // Recipient.
     public $customer;
 
+    // Needed to show proper signature when conversation is being moved between mailboxes.
+    public $mailbox_change_history = [];
+
     private $failures = [];
     private $recipients = [];
     private $last_thread = null;
     private $message_id = '';
     private $customer_email = '';
 
+    // Number of retries + 1
+    public $tries = 168; // one per hour
+    
+    /**
+     * The number of seconds the job can run before timing out.
+     * fwrite() function in /vendor/swiftmailer/swiftmailer/lib/classes/Swift/Transport/StreamBuffer.php
+     * in some cases may stuck and continue infinitely. This blocks queue:work and no other jobs are processed.
+     * So we need to set the timeout. On timeout the whole queue:work process is being killed by Laravel.
+     */
+    public $timeout = 120;
+    
     /**
      * Create a new job instance.
      *
@@ -40,6 +55,7 @@ class SendReplyToCustomer implements ShouldQueue
     {
         $this->conversation = $conversation;
         $this->threads = $threads;
+        // Recipient.
         $this->customer = $customer;
     }
 
@@ -51,6 +67,7 @@ class SendReplyToCustomer implements ShouldQueue
     public function handle()
     {
         $send_previous_messages = false;
+        $is_forward = false;
 
         // When forwarding conversation is undone, new conversation is deleted.
         if (!$this->conversation) {
@@ -59,17 +76,20 @@ class SendReplyToCustomer implements ShouldQueue
 
         $mailbox = $this->conversation->mailbox;
 
+        // Mailbox may be deleted.
+        if (!$mailbox) {
+            return;
+        }
+
         // Add forwarded conversation replies.
         if ($this->conversation->threads_count == 1 && count($this->threads) == 1) {
             $forward_child_thread = $this->threads[0];
             if ($forward_child_thread->isForwarded() && $forward_child_thread->getForwardParentConversation()) {
-                
+
                 // Add replies from original conversation.
-                $forwarded_replies = $forward_child_thread->getForwardParentConversation()->getReplies();
-                $forwarded_replies = $forwarded_replies->sortByDesc(function ($item, $key) {
-                    return $item->created_at;
-                });
-                $forward_parent_thread = Thread::find($forward_child_thread->getMeta('forward_parent_thread_id'));
+                $forwarded_replies = $forward_child_thread->getForwardParentConversation()->getThreads(null, null, [Thread::TYPE_CUSTOMER, Thread::TYPE_MESSAGE, Thread::TYPE_LINEITEM]);
+                $forwarded_replies = Thread::sortThreads($forwarded_replies);
+                $forward_parent_thread = Thread::find($forward_child_thread->getMetaFw(Thread::META_FORWARD_PARENT_THREAD_ID));
 
                 if ($forward_parent_thread) {
                     // Remove threads created after forwarding.
@@ -79,19 +99,38 @@ class SendReplyToCustomer implements ShouldQueue
                         }
                     }
                     $this->threads = $this->threads->merge($forwarded_replies);
-                    $send_previous_messages = true;
+                    $is_forward = true;
+
+                    // In order to show proper signature.
+                    // https://github.com/freescout-help-desk/freescout/issues/5419
+                    $new_mailbox_id = null;
+                    foreach ($this->threads as $reply) {
+                        if ($reply->action_type == Thread::ACTION_TYPE_MOVED_FROM_MAILBOX && is_numeric($reply->action_data)) {
+                            $new_mailbox_id = (int)$reply->action_data;
+                        }
+                        if ($reply->isReply() && $new_mailbox_id !== null) {
+                            $this->mailbox_change_history[$reply->id] = $new_mailbox_id;
+                            $new_mailbox_id = null;
+                        }
+                    }
+
+                    // Now remove line items.
+                    $this->threads = $this->threads->whereIn('type', [Thread::TYPE_CUSTOMER, Thread::TYPE_MESSAGE]);
                 }
             }
         }
 
         // Threads has to be sorted here, if sorted before, they come here in wrong order
-        $this->threads = $this->threads->sortByDesc(function ($item, $key) {
-            return $item->created_at;
-        });
+        $this->threads = Thread::sortThreads($this->threads);
 
         $new = false;
         $headers = [];
+
         $this->last_thread = $this->threads->first();
+
+        if ($this->last_thread === null) {
+            return;
+        }
         $last_customer_thread = null;
 
         // If thread is draft, it means it has been undone
@@ -99,6 +138,17 @@ class SendReplyToCustomer implements ShouldQueue
             return;
         }
 
+        // After sending an email we are saving it into "IMAP Folder To Save Outgoing Replies".
+        // This process may stuck or make SendReplyToCustomer job die with
+        // "Allowed memory size of NNN bytes exhausted" error.
+        // https://github.com/freescout-helpdesk/freescout/issues/3632
+        if ($this->attempts() >= 1 && 
+            ($this->last_thread->send_status == SendLog::STATUS_ACCEPTED
+                || $this->last_thread->isSendStatusSuccess())
+        ) {
+            return;
+        }
+
         if (count($this->threads) == 1) {
             $new = true;
         }
@@ -113,25 +163,158 @@ class SendReplyToCustomer implements ShouldQueue
             }
         }
 
+        // In-Reply-To and References headers.
+        $references = '';
+        if (!$new && !empty($last_customer_thread) && $last_customer_thread->message_id) {
+
+            // Always put real Message-ID into In-Reply-To field.
+            // https://github.com/freescout-help-desk/freescout/issues/5620
+            $headers['In-Reply-To'] = '<'.$last_customer_thread->getMessageId().'>';
+            //$headers['References'] = '<'.$last_customer_thread->message_id.'>';
+            // https://github.com/freescout-helpdesk/freescout/issues/3175
+            $i = 0;
+            $references_array = [];
+            foreach ($this->threads as $thread) {
+                if ($i > 0) {
+                    $reference = $thread->getMessageId();
+                    if ($reference) {
+                        $references_array[] = $reference;
+                    }
+                }
+                $i++;
+            }
+            if ($references_array) {
+                // Trim the list of References: some SMTP relays reject messages
+                // whose headers block exceeds 4096 chars.
+                // Preserve the first and the last reference.
+                // https://github.com/freescout-help-desk/freescout/issues/5542
+                $max_references_length = 1500;
+                $recent = [];
+                $recent[] = $references_array[0];
+                $length = strlen($references_array[0]) + 3;
+
+                foreach ($references_array as $i => $reference) {
+                    // The first and the last Reference are added manually.
+                    if ($i == 0 || $i == count($references_array)-1) {
+                        continue;
+                    }
+                    $length += strlen($reference) + 3;
+                    if ($length > $max_references_length) {
+                        break;
+                    }
+                    $recent[] = $reference;
+                }
+
+                // Append the last.
+                if (!empty($references_array[count($references_array)-1])) {
+                    $recent[] = $references_array[count($references_array)-1];
+                }
+
+                // Oldest first, per RFC 5322 3.6.4.
+                $references_array = array_reverse($recent);
+
+                $references = '<'.implode('> <', $references_array).'>';
+            }
+            if ($references) {
+                $headers['References'] = $references;
+            }
+        }
+
+        // For Outlook threading.
+        // https://github.com/freescout-help-desk/freescout/issues/4922
+        if ($last_customer_thread) {
+            $outloook_thread_index = $last_customer_thread->getHeader('Thread-Index');
+            if (!empty($outloook_thread_index)) {
+                // A reply must extend the parent's conversation index with
+                // a 5-byte child block (MS-OXOMSG 2.2.1.3) rather than echo
+                // it verbatim, otherwise Outlook files the reply as a new
+                // conversation and the customer's original message is left
+                // on its own. Falls back to the verbatim copy if the value
+                // does not decode as a conversation index.
+                $headers['Thread-Index'] = self::extendThreadIndex($outloook_thread_index);
+                $outloook_thread_topic = $last_customer_thread->getHeader('Thread-Topic');
+                if ($outloook_thread_topic) {
+                    $headers['Thread-Topic'] = $outloook_thread_topic;
+                }
+            }
+        }
+
+        // Conversation history.
+        $email_conv_history = config('app.email_conv_history');
+
+        $threads_count = count($this->threads);
+
+        $meta_conv_history = $this->last_thread->getMeta(Thread::META_CONVERSATION_HISTORY);
+        if (!empty($meta_conv_history)) {
+            $email_conv_history = $meta_conv_history;
+        }
+
+        if ($is_forward && $email_conv_history == 'global') {
+            $email_conv_history = 'full';
+        }
+
+        if ($is_forward && $email_conv_history == 'none') {
+            $email_conv_history = 'full';
+        }
+
+        if ($email_conv_history == 'full') {
+            $send_previous_messages = true;
+        }
+
+        if ($email_conv_history == 'last') {
+            $send_previous_messages = true;
+            $this->threads = $this->threads->slice(0, 2);
+        }
+
+        if ($email_conv_history == 'none') {
+            $send_previous_messages = false;
+        }
+
+        if (!$is_forward) {
+            $send_previous_messages = \Eventy::filter('jobs.send_reply_to_customer.send_previous_messages', $send_previous_messages, $this->last_thread, $this->threads, $this->conversation, $this->customer);
+        }
+
         // Remove previous messages.
         if (!$send_previous_messages) {
             $this->threads = $this->threads->slice(0, 1);
         }
 
         // Configure mail driver according to Mailbox settings
-        \App\Misc\Mail::setMailDriver($mailbox, $this->last_thread->created_by_user);
+        \MailHelper::setMailDriver($mailbox, $this->last_thread->created_by_user, $this->conversation, $this->last_thread);
 
-        // Get penultimate email Message-Id if reply
-        if (!$new && !empty($last_customer_thread) && $last_customer_thread->message_id) {
-
-            $headers['In-Reply-To'] = '<'.$last_customer_thread->message_id.'>';
-            $headers['References'] = '<'.$last_customer_thread->message_id.'>';
+        // https://github.com/freescout-helpdesk/freescout/issues/3330
+        if (!\MailHelper::$smtp_queue_id_plugin_registered) {
+            \Mail::getSwiftMailer()->registerPlugin(new SwiftGetSmtpQueueId());
+            \MailHelper::$smtp_queue_id_plugin_registered = true;
         }
-        
-        $this->message_id = \App\Misc\Mail::MESSAGE_ID_PREFIX_REPLY_TO_CUSTOMER.'-'.$this->last_thread->id.'-'.md5($this->last_thread->id).'@'.$mailbox->getEmailDomain();
+
+        $this->message_id = $this->last_thread->getMessageId($mailbox);
         $headers['Message-ID'] = $this->message_id;
 
-        $this->customer_email = $this->conversation->customer_email;
+        // https://github.com/freescout-help-desk/freescout/issues/5121
+        if ($this->customer->id == $this->conversation->customer_id) {
+            $this->customer_email = $this->conversation->customer_email;
+        } else {
+            $this->customer_email = $this->last_thread->getToArray()[0] ?: $this->conversation->customer_email;
+        }
+
+        // For phone conversations we may need to get customer email.
+        // https://github.com/freescout-helpdesk/freescout/issues/3270
+        if (!$this->customer_email && $this->conversation->isPhone()) {            
+            $this->customer_email = $this->conversation->customer->getMainEmail();
+            if (!$this->customer_email) {
+                return;
+            }
+        }
+
+        // Try to get customer by email
+        if (!$this->customer) {
+            $this->customer = Customer::getByEmail($this->customer_email);
+            if (!$this->customer) {
+                return;
+            }
+        }
+
         $to_array = $mailbox->removeMailboxEmailsFromList($this->last_thread->getToArray());
         $cc_array = $mailbox->removeMailboxEmailsFromList($this->last_thread->getCcArray());
         $bcc_array = $mailbox->removeMailboxEmailsFromList($this->last_thread->getBccArray());
@@ -168,11 +351,29 @@ class SendReplyToCustomer implements ShouldQueue
         //     $bcc_array = [];
         // }
 
+        $subject = $this->conversation->subject;
+        if (!$new && !$is_forward) {
+            $subject = 'Re: '.$subject;
+        }
+        $subject = \Eventy::filter('email.reply_to_customer.subject', $subject, $this->conversation, $this->last_thread);
+        $this->threads = \Eventy::filter('email.reply_to_customer.threads', $this->threads, $this->conversation, $mailbox);
+
+        $headers['X-FreeScout-Mail-Type'] = 'customer.message';
+
+        $reply_mail = new ReplyToCustomer($this->conversation, $this->threads, $headers, $mailbox, $subject, $threads_count, $this->mailbox_change_history);
+
+        $smtp_queue_id = null;
+        
         try {
             Mail::to($to)
                 ->cc($cc_array)
                 ->bcc($bcc_array)
-                ->send(new ReplyToCustomer($this->conversation, $this->threads, $headers, $mailbox));
+                ->send($reply_mail);
+
+            $this->last_thread->send_status = SendLog::STATUS_ACCEPTED;
+            $this->last_thread->save();
+
+            $smtp_queue_id = SwiftGetSmtpQueueId::$last_smtp_queue_id;
         } catch (\Exception $e) {
             // We come here in case SMTP server unavailable for example
             if ($this->attempts() == 1) {
@@ -180,6 +381,8 @@ class SendReplyToCustomer implements ShouldQueue
                     ->causedBy($this->customer)
                     ->withProperties([
                         'error'    => $e->getMessage().'; File: '.$e->getFile().' ('.$e->getLine().')',
+                        'to'       => $this->customer_email,
+                        'conversation'   => '#'.$this->conversation->number.'-'.$this->last_thread->id,
                      ])
                     ->useLog(\App\ActivityLog::NAME_EMAILS_SENDING)
                     ->log(\App\ActivityLog::DESCRIPTION_EMAILS_SENDING_ERROR_TO_CUSTOMER);
@@ -194,15 +397,38 @@ class SendReplyToCustomer implements ShouldQueue
                 $this->saveToSendLog($e->getMessage());
             }
 
+            $error_message = $e->getMessage();
+
+            // Remove stack trace from error message.
+            $error_message = preg_replace('#[\r\n]*" in /.*#s', '"', $error_message);
+
+            // SMTP response code is stored in the exception message:
+            // Expected response code 235 but got code "535", with message...
+            preg_match('#but got code "(\d+)",#', $error_message, $response_m);
+            $response_code = (int)($response_m[1] ?? 0);
+
             // Retry job with delay.
             // https://stackoverflow.com/questions/35258175/how-can-i-create-delays-between-failed-queued-job-attempts-in-laravel
-            if ($this->attempts() < $this->tries) {
-                $this->release(3600);
+            if ($this->attempts() < $this->tries && !preg_match("/".config("app.no_retry_mail_errors")."/i", $error_message)) {
+                if ($this->attempts() == 1) {
+                    // Second attempt after 5 min.
+                    $this->release(300);
+                } else {
+                    // Others - after 1 hour.
+                    $this->release(3600);
+                }
+
+                // If an email has not been sent after 1 hour - show an error message to support agent.
+                if ($this->attempts() >= 3 || $response_code >= 500) {
+                    $this->last_thread->send_status = SendLog::STATUS_SEND_INTERMEDIATE_ERROR;
+                    $this->last_thread->updateSendStatusData(['msg' => $error_message]);
+                    $this->last_thread->save();
+                }
 
                 throw $e;
             } else {
                 $this->last_thread->send_status = SendLog::STATUS_SEND_ERROR;
-                $this->last_thread->updateSendStatusData(['msg' => $e->getMessage()]);
+                $this->last_thread->updateSendStatusData(['msg' => $error_message]);
                 $this->last_thread->save();
 
                 // This executes $this->failed().
@@ -212,6 +438,149 @@ class SendReplyToCustomer implements ShouldQueue
             }
         }
 
+        SwiftGetSmtpQueueId::$last_smtp_queue_id = null;
+
+        // Clean error message if email finally has been sent.
+        if ($this->last_thread->send_status == SendLog::STATUS_SEND_ERROR) {
+            $this->last_thread->send_status = null;
+            $this->last_thread->updateSendStatusData(['msg' => '']);
+            $this->last_thread->save();
+        }
+
+        $imap_sent_folder = $mailbox->imap_sent_folder;
+
+        if ($imap_sent_folder && \MailHelper::$smtp_mime_message) {
+            try {
+                $client = \MailHelper::getMailboxClient($mailbox);
+                
+                $client->connect();
+
+                // $mail_from = $mailbox->getMailFrom($this->last_thread->created_by_user ?? null, $this->conversation);
+
+                // if (!empty($mail_from['name'])) {
+                //     $envelope['from'] = '"'.$mail_from['name'].'" <'.$mail_from['address'].'>';
+                // } else {
+                //     $envelope['from'] = $mail_from['address'];
+                // }
+                // if (is_array($to) && !empty($to[0]) && !empty($to[0]['name']) && !empty($to[0]['email'])) {
+                //     $envelope['to'] = '"'.$to[0]['name'].'" <'.$to[0]['email'].'>';
+                // } else {
+                //     $envelope['to'] = $this->customer_email;
+                // }
+                // $envelope['subject'] = $subject;
+                // $envelope['date'] = now()->toRfc2822String();
+                // $envelope['message_id'] = $this->message_id;
+
+                // // CC.
+                // if (count($cc_array)) {
+                //     $envelope['cc'] = implode(',', $cc_array);
+                // }
+
+                // // Get penultimate email Message-Id if reply
+                // if (!$new && !empty($last_customer_thread) && $last_customer_thread->message_id) {
+                //     $envelope['custom_headers'] = [
+                //         'In-Reply-To: <'.$last_customer_thread->message_id.'>',
+                //         'References: '.$references,
+                //     ];
+                // }
+                // // Remove new lines to avoid "imap_mail_compose(): header injection attempt in subject".
+                // foreach ($envelope as $i => $envelope_value) {
+                //     $envelope[$i] = preg_replace("/[\r\n]/", '', $envelope_value);
+                // }
+
+                // $parts = [];
+
+                // // Multipart flag.
+                // if ($this->last_thread->has_attachments) {
+                //     $multipart = [];
+                //     $multipart["type"] = \Webklex\PHPIMAP\IMAP::TYPEMULTIPART;
+                //     $multipart["subtype"] = "mixed";
+                //     // https://github.com/freescout-helpdesk/freescout/issues/3934
+                //     //$multipart["subtype"] = "alternative";
+                //     $parts[] = $multipart;
+                // }
+
+                // // Body.
+                // $part_body['type'] = \Webklex\PHPIMAP\IMAP::TYPETEXT;
+                // $part_body['subtype'] = 'html';
+                // $part_body['contents.data'] = $reply_mail->render();
+                // $part_body['charset'] = 'utf-8';
+
+                // $parts[] = $part_body;
+
+                // // Add attachments.
+                // if ($this->last_thread->has_attachments) {
+
+                //     foreach ($this->last_thread->attachments as $attachment) {
+
+                //         if ($attachment->embedded) {
+                //             continue;
+                //         }
+
+                //         if ($attachment->fileExists()) {
+                //             $part = [];
+                //             $part["type"] = 'APPLICATION';
+                //             $part["encoding"] = \Webklex\PHPIMAP\IMAP::ENCBASE64;
+                //             $part["subtype"] = "octet-stream";
+                //             $part["description"] = $attachment->file_name;
+                //             $part['disposition.type'] = 'attachment';
+                //             $part['disposition'] = array('filename' => $attachment->file_name);
+                //             $part['type.parameters'] = array('name' => $attachment->file_name);
+                //             $part["description"] = '';
+                //             $part["contents.data"] = base64_encode($attachment->getFileContents());
+                            
+                //             $parts[] = $part;
+                //         } else {
+                //             \Log::error('[IMAP Folder To Save Outgoing Replies] Thread: '.$this->last_thread->id.'. Attachment file not find on disk: '.$attachment->getLocalFilePath());
+                //         }
+                //     }
+                // }
+
+                try {
+                    // https://github.com/freescout-helpdesk/freescout/issues/3502
+                    $imap_sent_folder = mb_convert_encoding($imap_sent_folder, "UTF7-IMAP", "UTF-8");
+
+                    // https://github.com/Webklex/php-imap/issues/380
+                    if (method_exists($client, 'getFolderByPath')) {
+                        $folder = $client->getFolderByPath($imap_sent_folder);
+                    } else {
+                        $folder = $client->getFolder($imap_sent_folder);
+                    }
+                    // Get folder method does not work if sent folder has spaces.
+                    if ($folder) {
+                        try {
+                            //$save_result = $this->saveEmailToFolder($client, $folder, $envelope, $parts, $bcc_array);
+                            $save_result = $this->saveEmailToFolder($folder, \MailHelper::$smtp_mime_message);
+                            \MailHelper::$smtp_mime_message = '';
+
+                            // Sometimes emails with attachments by some reason are not saved.
+                            // https://github.com/freescout-helpdesk/freescout/issues/2749
+                            // if (!$save_result) {
+                            //     // Save without attachments.
+                            //     $save_result = $this->saveEmailToFolder($client, $folder, $envelope, [$part_body], $bcc_array);
+                            if (!$save_result) {
+                                \Log::error($this->getImapSaveErrorPrefix($mailbox).'Could not save outgoing reply to the IMAP folder (check folder name and make sure IMAP folder does not have spaces - folders with spaces do not work): '.$imap_sent_folder);
+                            }
+                            //}
+                        } catch (\Exception $e) {
+                            // Just log error and continue.
+                            \Helper::logException($e, $this->getImapSaveErrorPrefix($mailbox).'Could not save outgoing reply to the IMAP folder: ');
+                        }
+                    } else {
+                        \Log::error($this->getImapSaveErrorPrefix($mailbox).'Could not save outgoing reply to the IMAP folder (check folder name and make sure IMAP folder does not have spaces - folders with spaces do not work): '.$imap_sent_folder);
+                    }
+                } catch (\Exception $e) {
+                    // Just log error and continue.
+                    \Helper::logException($e, $this->getImapSaveErrorPrefix($mailbox).'Could not save outgoing reply to the IMAP folder, IMAP folder not found: '.$imap_sent_folder.' - ');
+                    //$this->saveToSendLog('['.date('Y-m-d H:i:s').'] Could not save outgoing reply to the IMAP folder: '.$imap_sent_folder);
+                }
+            } catch (\Exception $e) {
+                // Just log error and continue.
+                //$this->saveToSendLog('['.date('Y-m-d H:i:s').'] Could not get mailbox IMAP folder: '.$imap_sent_folder);
+                \Helper::logException($e, $this->getImapSaveErrorPrefix($mailbox).'Could not save outgoing reply to the IMAP folder: '.$imap_sent_folder.' - ');
+            }
+        }
+
         // In message_id we are storing Message-ID of the incoming email which created the thread
         // Outcoming message_id can be generated for each thread by thread->id
         // $this->last_thread->message_id = $message_id;
@@ -221,9 +590,42 @@ class SendReplyToCustomer implements ShouldQueue
         $this->failures = Mail::failures();
 
         // Save to send log
-        $this->saveToSendLog();
+        $this->saveToSendLog('', $smtp_queue_id);
     }
 
+    public function getImapSaveErrorPrefix($mailbox)
+    {
+        return '['.$mailbox->name.' » Connection Settings » Fetching Emails » IMAP Folder To Save Outgoing Replies] ';
+    }
+
+    // Save an email to IMAP folder.
+    public function saveEmailToFolder($folder, $message_str)
+    {
+        return $folder->appendMessage($message_str, ['\Seen'], now()->format('d-M-Y H:i:s O'));
+    }
+
+    // public function saveEmailToFolder($client, $folder, $envelope, $parts, $bcc = [])
+    // {
+    //     $envelope_str = imap_mail_compose($envelope, $parts);
+
+    //     // Add BCC.
+    //     // https://stackoverflow.com/questions/47353938/php-imap-append-with-bcc
+    //     if (!empty($bcc)) {
+    //         // There will be a "To:" parameter for sure.
+    //         $to_pos = strpos($envelope_str , "To:");
+    //         if ($to_pos !== false) {
+    //             $bcc_str = "Bcc: " . implode(',', $bcc) . "\r\n";
+    //             $envelope_str = substr_replace($envelope_str , $bcc_str, $to_pos, 0);
+    //         }
+    //     }
+
+    //     if (get_class($client) == 'Webklex\PHPIMAP\Client') {
+    //         return $folder->appendMessage($envelope_str, ['\Seen'], now()->format('d-M-Y H:i:s O'));
+    //     } else {
+    //         return $folder->appendMessage($envelope_str, '\Seen', now()->format('d-M-Y H:i:s O'));
+    //     }
+    // }
+
     /**
      * The job failed to process.
      * This method is called after attempts had finished.
@@ -235,11 +637,18 @@ class SendReplyToCustomer implements ShouldQueue
      */
     public function failed(\Exception $e)
     {
+        // failed() is called by unserializing the original queue payload.
+        if (!$this->last_thread && $this->threads && count($this->threads)) {
+            $this->threads = Thread::sortThreads($this->threads);
+            $this->last_thread = $this->threads->first();
+        }
+
         activity()
            ->causedBy($this->customer)
            ->withProperties([
                 'error'    => $e->getMessage().'; File: '.$e->getFile().' ('.$e->getLine().')',
                 'to'       => $this->customer_email,
+                'conversation'   => '#'.$this->conversation->number.'-'.($this->last_thread ? $this->last_thread->id : ''),
             ])
            ->useLog(\App\ActivityLog::NAME_EMAILS_SENDING)
            ->log(\App\ActivityLog::DESCRIPTION_EMAILS_SENDING_ERROR_TO_CUSTOMER);
@@ -250,7 +659,7 @@ class SendReplyToCustomer implements ShouldQueue
     /**
      * Save emails to send log.
      */
-    public function saveToSendLog($error_message = '')
+    public function saveToSendLog($error_message = '', $smtp_queue_id = '')
     {
         foreach ($this->recipients as $recipient) {
             if (in_array($recipient, $this->failures)) {
@@ -265,7 +674,44 @@ class SendReplyToCustomer implements ShouldQueue
             } else {
                 $customer_id = null;
             }
-            SendLog::log($this->last_thread->id, $this->message_id, $recipient, SendLog::MAIL_TYPE_EMAIL_TO_CUSTOMER, $status, $customer_id, null, $status_message);
+            SendLog::log($this->last_thread->id, $this->message_id, $recipient, SendLog::MAIL_TYPE_EMAIL_TO_CUSTOMER, $status, $customer_id, null, $status_message, $smtp_queue_id);
         }
     }
+
+    /**
+     * Append a 5-byte child block to an Outlook conversation index
+     * (Thread-Index header, MS-OXOMSG 2.2.1.3) so the reply nests under the
+     * customer's message instead of being read by Outlook as a new
+     * conversation. Header = 0x01 + 5 bytes of FILETIME (bits 16-55) + 16-byte
+     * GUID; each child = code(1 bit) + time delta(31) + random(4) + sequence(4).
+     * Returns the input unchanged when it does not decode as a valid index.
+     * https://github.com/freescout-help-desk/freescout/issues/4922
+     */
+    public static function extendThreadIndex($thread_index)
+    {
+        $raw = base64_decode(trim((string)$thread_index), true);
+        if ($raw === false || strlen($raw) < 22 || (strlen($raw) - 22) % 5 !== 0) {
+            return $thread_index;
+        }
+        // Header timestamp: FILETIME bits 16-55, big-endian, in bytes 1-5.
+        $hdr = unpack('Nhi/Clo', substr($raw, 1, 5));
+        $hdr_bits = ($hdr['hi'] << 8) | $hdr['lo'];
+        $now_ft = (int) round((microtime(true) + 11644473600) * 10000000);
+        $now_bits = ($now_ft >> 16) & 0xFFFFFFFFFF;
+        $delta = ($now_bits - $hdr_bits) << 16;
+        if ($delta < 0) {
+            $delta = 0;
+        }
+        $code = 0;
+        $diff = $delta >> 18;
+        if ($diff > 0x7FFFFFFF) {
+            $code = 1;
+            $diff = min($delta >> 23, 0x7FFFFFFF);
+        }
+        // 40-bit child block: code(1) | diff(31) | random(4) | sequence(4)=0
+        $block = (($code << 39) | ($diff << 8) | (random_int(0, 15) << 4)) & 0xFFFFFFFFFF;
+        $bytes = pack('C5', ($block >> 32) & 0xFF, ($block >> 24) & 0xFF, ($block >> 16) & 0xFF, ($block >> 8) & 0xFF, $block & 0xFF);
+
+        return base64_encode($raw.$bytes);
+    }
 }

app/Jobs/UpdateFolderCounters.php

@@ -0,0 +1,46 @@
+<?php
+
+namespace App\Jobs;
+
+use App\Folder;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Bus\Queueable;
+use Illuminate\Queue\SerializesModels;
+use Illuminate\Queue\InteractsWithQueue;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Bus\Dispatchable;
+
+class UpdateFolderCounters implements ShouldQueue
+{
+    use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;
+
+    private $folder;
+
+    // Cache lock key
+    private $lockKey;
+
+    public function __construct(Folder $folder)
+    {
+        $this->folder = $folder;
+        $this->lockKey = "folder_update_lock_{$folder->id}";
+    }
+
+    public function handle()
+    {
+        // Check if another job is processing this folder
+        if (Cache::has($this->lockKey)) {
+            return; // Exit if already processing
+        }
+
+        // Set lock with a timeout of 5 minutes (adjust as needed)
+        Cache::put($this->lockKey, true, now()->addMinutes(5));
+
+        try {
+            // Perform the folder update logic
+            $this->folder->updateCountersNow();
+        } finally {
+            // Release the lock after processing
+            Cache::forget($this->lockKey);
+        }
+    }
+}

app/Listeners/LogFailedLogin.php

@@ -25,6 +25,8 @@ class LogFailedLogin
      */
     public function handle(Failed $event)
     {
+        \Eventy::action('listeners.failed_login', $event);
+
         activity()
            //->causedBy($event->user)
            ->withProperties(['ip' => app('request')->ip(), 'email' => request()->email])

app/Listeners/LogLockout.php

@@ -26,8 +26,8 @@ class LogLockout
     public function handle(Lockout $event)
     {
         activity()
-           ->causedBy($event->user)
-           ->withProperties(['ip' => app('request')->ip()])
+           //->causedBy($event->user)
+           ->withProperties(['ip' => app('request')->ip(), 'email' => $event->request->email])
            ->useLog(\App\ActivityLog::NAME_USER)
            ->log(\App\ActivityLog::DESCRIPTION_USER_LOCKED);
     }

app/Listeners/ProcessSwiftMessage.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace App\Listeners;
+
+class ProcessSwiftMessage
+{
+
+    /**
+     * Create the event listener.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        //
+    }
+
+    /**
+     * Handle the event.
+     */
+    public function handle($event)
+    {
+        return \Eventy::filter('mail.process_swift_message', true, $event->message);
+    }
+}

app/Listeners/RefreshConversations.php

@@ -0,0 +1,33 @@
+<?php
+
+namespace App\Listeners;
+
+use App\Conversation;
+
+class RefreshConversations
+{
+    /**
+     * Create the event listener.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        //
+    }
+
+    /**
+     * Handle the event.
+     *
+     * @param  $event
+     *
+     * @return void
+     */
+    public function handle($event)
+    {
+        $thread = $event->thread ?? $event->last_thread;
+        if ($thread) {
+            Conversation::refreshConversations($event->conversation, $thread);
+        }
+    }
+}

app/Listeners/RestartSwiftMailer.php

@@ -0,0 +1,30 @@
+<?php
+
+namespace App\Listeners;
+
+class RestartSwiftMailer
+{
+
+    /**
+     * Create the event listener.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        //
+    }
+
+    /**
+     * Handle the event.
+     */
+    public function handle($event)
+    {
+        // Destroy Swift mailer to make it clean temp files.
+        // https://github.com/freescout-helpdesk/freescout/issues/2949
+        // https://github.com/swiftmailer/swiftmailer/issues/1287#issuecomment-833505298        
+        \App::forgetInstance('mailer');
+        \App::forgetInstance('swift.mailer');
+        \App::forgetInstance('swift.transport');
+    }
+}

app/Listeners/SendAutoReply.php

@@ -2,10 +2,14 @@
 
 namespace App\Listeners;
 
+use App\Conversation;
+use App\Mailbox;
 use App\SendLog;
 
 class SendAutoReply
 {
+    const CHECK_PERIOD = 180; // min
+
     /**
      * Create the event listener.
      *
@@ -23,7 +27,11 @@ class SendAutoReply
     {
         $conversation = $event->conversation;
 
-        if (/*!$conversation->imported &&*/ $conversation->mailbox->auto_reply_enabled) {
+        // no_autoreply meta value is checked in the SendAutoReply job.
+
+        if (!$conversation->imported 
+            && $conversation->mailbox->auto_reply_enabled
+        ) {
             $thread = $conversation->threads()->first();
 
             // Do not send auto reply to auto responders.
@@ -35,20 +43,52 @@ class SendAutoReply
                 return;
             }
 
+            // Do not send auto replies to spam messages.
+            if ($conversation->isSpam()) {
+                return;
+            }
+
+            if (!\Eventy::filter('autoreply.should_send', true, $conversation)) {
+                return;
+            }
+
             // We can not send auto reply to incoming bounce messages, as it will lead to the infinite loop:
             // application will be sending auto replies and mail server will be sending bounce messages to auto replies.
             // Bounce detection can not be 100% reliable.
             // So to prevent infinite loop, we are checking number of auto replies sent to the customer recently.
-            $created_at = \Illuminate\Support\Carbon::now()->subMinutes(10);
+            $created_at = \Illuminate\Support\Carbon::now()->subMinutes(self::CHECK_PERIOD);
+
             $auto_replies_sent = SendLog::where('customer_id', $conversation->customer_id)
                 ->where('mail_type', SendLog::MAIL_TYPE_AUTO_REPLY)
                 ->where('created_at', '>', $created_at)
                 ->count();
 
-            if ($auto_replies_sent >= 3) {
+            if ($auto_replies_sent >= 10) {
                 return;
             }
 
+            if ($auto_replies_sent >= 2) {
+                // Find conversations from this customer 
+                $prev_conversations = Conversation::select('subject', 'id')
+                    ->where('customer_id', $conversation->customer_id)
+                    ->where('created_at', '>', $created_at)
+                    ->get();
+
+                foreach ($prev_conversations as $prev_conv) {
+                    if ($prev_conv->subject == $conversation->subject && $prev_conv->id != $conversation->id) {
+                        return;
+                    }
+                }
+            }
+
+            // Do not send autoreplies to own mailboxes.
+            if ($conversation->customer_email) {
+                $is_internal_email = Mailbox::where('email', $conversation->customer_email)->exists();
+                if ($is_internal_email) {
+                    return;
+                }
+            }
+
             // 24h limit has been disabled: https://github.com/freescout-helpdesk/freescout/pull/95
             // Send auto reply once in 24h
             /*$created_at = \Illuminate\Support\Carbon::now()->subDays(1);

app/Listeners/SendNotificationToUsers.php

@@ -26,6 +26,7 @@ class SendNotificationToUsers
     {
         $event_type = null;
         $caused_by_user_id = null;
+        $extra_data = [];
 
         // Detect event type by event class
         switch (get_class($event)) {
@@ -47,7 +48,7 @@ class SendNotificationToUsers
                 break;
             case 'App\Events\CustomerCreatedConversation':
                 // Do not send notification if conversation is spam.
-                if ($event->conversation->status != Conversation::STATUS_SPAM) {
+                if (!$event->conversation->isSpam()) {
                     $event_type = Subscription::EVENT_TYPE_NEW;
                 }
                 break;
@@ -55,20 +56,31 @@ class SendNotificationToUsers
                 $caused_by_user_id = $event->user->id;
                 $event_type = Subscription::EVENT_TYPE_ASSIGNED;
                 break;
+            case 'App\Events\UserMovedConversation':
+                $caused_by_user_id = $event->caused_by_user_id;
+                $extra_data['from_mailbox'] = $event->from_mailbox;
+                $event_type = Subscription::EVENT_TYPE_USER_MOVED;
+                break;
             case 'App\Events\CustomerReplied':
+                // Do not send notifications to users if customer sent a reply
+                // to the conversation marked as Spam.
+                if (!empty($event->conversation) && $event->conversation->isSpam()) {
+                    return;
+                }
                 $event_type = Subscription::EVENT_TYPE_CUSTOMER_REPLIED;
                 break;
         }
         if (empty($event->conversation) || !$event_type) {
             return;
         }
+
+        // Ignore imported threads.
+        if (!empty($event->thread) && $event->thread->imported) {
+            return;
+        }
         $conversation = $event->conversation;
 
-        // We can not check imported here, as after conversation has been imported via API
-        // notifications has to be sent.
-        //if (!$conversation->imported) {
-
         // Using the last argument you can make event to be processed immediately
-        Subscription::registerEvent($event_type, $conversation, $caused_by_user_id/*, true*/);
+        Subscription::registerEvent($event_type, $conversation, $caused_by_user_id, $extra_data);
     }
 }

app/Listeners/SendReplyToCustomer.php

@@ -3,6 +3,8 @@
 namespace App\Listeners;
 
 use App\Conversation;
+use App\Customer;
+use App\Thread;
 
 class SendReplyToCustomer
 {
@@ -23,16 +25,94 @@ class SendReplyToCustomer
     {
         $conversation = $event->conversation;
 
-        // Do not send email if this is a Phone conversation.
+        $main_customer_email = $conversation->customer->getMainEmail();
+
+        // Do not send email if this is a Phone conversation and customer has no email.
         if ($conversation->isPhone()) {
+            if (!$main_customer_email) {
+                return;
+            }
+        }
+
+        // Get threads with line items, line items are needed
+        // to show proper signature when conversation is being moved
+        // between mailboxes.
+        //$replies = $conversation->getReplies();
+        $replies = $conversation->getThreads(null, null, [Thread::TYPE_CUSTOMER, Thread::TYPE_MESSAGE, Thread::TYPE_LINEITEM]);
+
+        // Ignore imported messages.
+        if ($replies && $replies->first() && $replies->first()->imported) {
+            return;
+        }
+
+        // Remove threads added after this event had fired.
+        $thread = $event->last_thread ?? $event->thread ?? null;
+        if ($thread) {
+            foreach ($replies as $i => $reply) {
+                if ($reply->id == $thread->id) {
+                    break;
+                } else {
+                    $replies->forget($i);
+                }
+            }
+        } else {
+            // If thread is not provided - stop.
+            // It allows to trigger event but avoid sending an email to customer.
+            return;
+        }
+
+        // In order to show proper signature.
+        // https://github.com/freescout-help-desk/freescout/issues/5419
+        $mailbox_change_history = [];
+        $new_mailbox_id = null;
+        foreach ($replies as $i => $reply) {
+            if ($reply->action_type == Thread::ACTION_TYPE_MOVED_FROM_MAILBOX && is_numeric($reply->action_data)) {
+                $new_mailbox_id = (int)$reply->action_data;
+            }
+            if ($reply->isReply() && $new_mailbox_id !== null) {
+                $mailbox_change_history[$reply->id] = $new_mailbox_id;
+                $new_mailbox_id = null;
+            }
+        }
+
+        // Now remove line items.
+        $replies = $replies->whereIn('type', [Thread::TYPE_CUSTOMER, Thread::TYPE_MESSAGE]);
+
+        // Allow to cancel mail sending if needed.
+        $skip_send = \Eventy::filter('conversation.skip_send_reply_to_customer', false, $conversation, $replies);
+        if ($skip_send) {
+             return;
+        }
+
+        // Chat conversation.
+        if ($conversation->isChat()) {
+            \Helper::backgroundAction('chat_conversation.send_reply', [$conversation, $replies, $conversation->customer], now()->addSeconds(Conversation::UNDO_TIMOUT));
             return;
         }
 
         // We can not check imported here, as after conversation has been imported via API
         // notifications has to be sent.
         //if (!$conversation->imported) {
-        \App\Jobs\SendReplyToCustomer::dispatch($conversation, $conversation->getReplies(), $conversation->customer)
-            ->delay(now()->addSeconds(Conversation::UNDO_TIMOUT))
+        $delay = \Eventy::filter('conversation.send_reply_to_customer_delay', now()->addSeconds(Conversation::UNDO_TIMOUT), $conversation, $replies);
+
+        $recipient_customer = $conversation->customer;
+
+        // The reply may be sent to some other customer from previous threads.
+        // https://github.com/freescout-help-desk/freescout/pull/5199
+        if ($thread 
+            && ($to_array = $thread->getToArray())
+            && !empty($to_array[0])
+            && ($customer_email = $to_array[0])
+            && $customer_email != $main_customer_email
+        ) {
+            $other_customer = Customer::getByEmail($customer_email);
+            if ($other_customer) {
+                $recipient_customer = $other_customer;
+            }
+        }
+
+        \App\Jobs\SendReplyToCustomer::dispatch($conversation, $replies, $recipient_customer)
+            ->delay($delay)
             ->onQueue('emails');
     }
 }

app/Mail/Alert.php

@@ -32,6 +32,8 @@ class Alert extends Mailable
      */
     public function build()
     {
+        \MailHelper::prepareMailable($this);
+        
         $subject = '['.\Config::get('app.name').'] ';
         if (!empty($this->title)) {
             $subject .= $this->title;

app/Mail/AutoReply.php

@@ -26,15 +26,21 @@ class AutoReply extends Mailable
      */
     public $headers = [];
 
+    /**
+     * Mailbox alias to send From (empty to use mailbox default email).
+     */
+    public $from_alias = '';
+
     /**
      * Create a new message instance.
      */
-    public function __construct($conversation, $mailbox, $customer, $headers)
+    public function __construct($conversation, $mailbox, $customer, $headers, $from_alias = '')
     {
         $this->conversation = $conversation;
         $this->mailbox = $mailbox;
         $this->customer = $customer;
         $this->headers = $headers;
+        $this->from_alias = $from_alias;
     }
 
     /**
@@ -44,6 +50,8 @@ class AutoReply extends Mailable
      */
     public function build()
     {
+        \MailHelper::prepareMailable($this);
+        
         $view_params = [];
 
         // Set headers
@@ -56,8 +64,10 @@ class AutoReply extends Mailable
         ];
 
         // Set variables
-        $subject = \App\Misc\Mail::replaceMailVars($this->mailbox->auto_reply_subject, $data);
-        $view_params['auto_reply_message'] = \App\Misc\Mail::replaceMailVars($this->mailbox->auto_reply_message, $data);
+        $subject = \MailHelper::replaceMailVars($this->mailbox->auto_reply_subject, $data);
+        $view_params['auto_reply_message'] = \MailHelper::replaceMailVars($this->mailbox->auto_reply_message, $data);
+
+        $subject = \Eventy::filter('email.auto_reply.subject', $subject, $this->conversation);
 
         $message = $this->subject($subject)
                     ->view('emails/customer/auto_reply', $view_params)
@@ -73,15 +83,54 @@ class AutoReply extends Mailable
     public function setHeaders()
     {
         $new_headers = $this->headers;
-        if (!empty($new_headers)) {
-            $this->withSwiftMessage(function ($swiftmessage) use ($new_headers) {
-                if (!empty($new_headers['Message-ID'])) {
-                    $swiftmessage->setId($new_headers['Message-ID']);
+        $from_alias = $this->from_alias;
+        if (!empty($new_headers) || $from_alias) {
+            $mailbox = $this->mailbox;
+            $conversation = $this->conversation;
+            $this->withSwiftMessage(function ($swiftmessage) use ($new_headers, $from_alias, $mailbox, $conversation) {
+                $headers = null;
+
+                if (!empty($new_headers)) {
+                    if (!empty($new_headers['Message-ID'])) {
+                        $swiftmessage->setId($new_headers['Message-ID']);
+                    }
+                    $headers = $swiftmessage->getHeaders();
+                    foreach ($new_headers as $header => $value) {
+                        if ($header != 'Message-ID') {
+                            $headers->addTextHeader($header, $value);
+                        }
+                    }
                 }
-                $headers = $swiftmessage->getHeaders();
-                foreach ($new_headers as $header => $value) {
-                    if ($header != 'Message-ID') {
-                        $headers->addTextHeader($header, $value);
+
+                if (!empty($from_alias)) {
+                    $aliases = $mailbox->getAliases();
+
+                    if (array_key_exists($from_alias, $aliases)) {
+                        $from_alias_name = $aliases[$from_alias] ?? '';
+
+                        // Take into account mailbox From Name setting.
+                        $mailbox_mail_from = $mailbox->getMailFrom(null, $conversation);
+                        if ($mailbox_mail_from['name'] == $mailbox->name && $from_alias_name) {
+                            // Use name from alias.
+                        } else {
+                            $from_alias_name = $mailbox_mail_from['name'];
+                        }
+
+                        if (!$headers) {
+                            $headers = $swiftmessage->getHeaders();
+                        }
+
+                        $swift_from = $headers->get('From');
+
+                        if ($from_alias_name) {
+                            $swift_from->setNameAddresses([
+                                $from_alias => $from_alias_name,
+                            ]);
+                        } else {
+                            $swift_from->setAddresses([
+                                $from_alias,
+                            ]);
+                        }
                     }
                 }
 

app/Mail/PasswordChanged.php

@@ -26,6 +26,8 @@ class PasswordChanged extends Mailable
      */
     public function build()
     {
+        \MailHelper::prepareMailable($this);
+        
         $message = $this->subject(__('Password Changed'))
                     ->view('emails/user/password_changed')
                     ->text('emails/user/password_changed_text');

app/Mail/ReplyToCustomer.php

@@ -38,17 +38,35 @@ class ReplyToCustomer extends Mailable
      */
     public $mailbox;
 
+    /**
+     * Subject.
+     */
+    public $subject;
+
+    /**
+     * Number of threads.
+     */
+    public $threads_count;
+
+    /**
+     * Needed to show proper signature when conversation is being moved between mailboxes.
+     */
+    public $mailbox_change_history;
+
     /**
      * Create a new message instance.
      *
      * @return void
      */
-    public function __construct($conversation, $threads, $headers, $mailbox)
+    public function __construct($conversation, $threads, $headers, $mailbox, $subject, $threads_count = 1, $mailbox_change_history = [])
     {
         $this->conversation = $conversation;
         $this->threads = $threads;
         $this->headers = $headers;
         $this->mailbox = $mailbox;
+        $this->subject = $subject;
+        $this->threads_count = $threads_count;
+        $this->mailbox_change_history = $mailbox_change_history;
     }
 
     /**
@@ -58,39 +76,99 @@ class ReplyToCustomer extends Mailable
      */
     public function build()
     {
+        \MailHelper::prepareMailable($this);
+
+        $thread = $this->threads->first();
+        $from_alias = trim($thread->from ?? '');
+
         // Set Message-ID
         // Settings via $this->addCustomHeaders does not work
         $new_headers = $this->headers;
-        if (!empty($new_headers)) {
-            $this->withSwiftMessage(function ($swiftmessage) use ($new_headers) {
-                if (!empty($new_headers['Message-ID'])) {
-                    $swiftmessage->setId($new_headers['Message-ID']);
-                }
-                $headers = $swiftmessage->getHeaders();
-                foreach ($new_headers as $header => $value) {
-                    if ($header != 'Message-ID') {
-                        $headers->addTextHeader($header, $value);
+        if (!empty($new_headers) || $from_alias) {
+            $mailbox = $this->mailbox;
+            $this->withSwiftMessage(function ($swiftmessage) use ($new_headers, $from_alias, $mailbox, $thread) {
+                \MailHelper::$smtp_mime_message = '';
+
+                $headers = null;
+
+                if (!empty($new_headers)) {
+                    if (!empty($new_headers['Message-ID'])) {
+                        $swiftmessage->setId($new_headers['Message-ID']);
                     }
+                    $headers = $swiftmessage->getHeaders();
+                    foreach ($new_headers as $header => $value) {
+                        if ($header != 'Message-ID') {
+                            $headers->addTextHeader($header, $value);
+                        }
+                    }
+                }
+                if (!empty($from_alias)) {
+                    $aliases = $mailbox->getAliases();
+
+                    // Make sure that the From contains a mailbox alias,
+                    // as user thread may have From specified when a user
+                    // replies to an email notification.
+                    if (array_key_exists($from_alias, $aliases)) {
+
+                        $from_alias_name = $aliases[$from_alias] ?? '';
+
+                        // Take into account mailbox From Name setting.
+                        $mailbox_mail_from = $mailbox->getMailFrom($thread->created_by_user, $thread->conversation);
+                        if ($mailbox_mail_from['name'] == $mailbox->name && $from_alias_name) {
+                            // Use name from alias.
+                        } else {
+                            // User name or custom.
+                            $from_alias_name = $mailbox_mail_from['name'];
+                        }
+
+                        if (!$headers) {
+                            $headers = $swiftmessage->getHeaders();
+                        }
+
+                        $swift_from = $headers->get('From');
+
+                        if ($from_alias_name) {
+                            $swift_from->setNameAddresses([
+                                $from_alias => $from_alias_name,
+                            ]);
+                        } else {
+                            $swift_from->setAddresses([
+                                $from_alias,
+                            ]);
+                        }
+                    }
+                }
+
+                \Eventy::action('email.reply_to_customer.swiftmessage', $swiftmessage, $from_alias, $thread, $mailbox);
+
+                if ($mailbox->imap_sent_folder) {
+                    \MailHelper::$smtp_mime_message = $swiftmessage->toString();
                 }
 
                 return $swiftmessage;
             });
         }
 
-        $subject = $this->conversation->subject;
-        if (count($this->threads) > 1) {
-            $subject = 'Re: '.$subject;
-        }
+        $template_html = \Eventy::filter('email.reply_to_customer.template_name_html', 'emails/customer/reply_fancy');
+        $template_text = \Eventy::filter('email.reply_to_customer.template_name_text', 'emails/customer/reply_fancy_text');
 
         // from($this->from) Sets only email, name stays empty.
         // So we set from in Mail::setMailDriver
-        $message = $this->subject($subject)
-                    ->view('emails/customer/reply_fancy')
-                    ->text('emails/customer/reply_fancy_text');
+        $message = $this->subject($this->subject)
+                    ->view($template_html)
+                    ->text($template_text);
 
-        if ($this->threads->first()->has_attachments) {
-            foreach ($this->threads->first()->attachments as $attachment) {
-                $message->attach($attachment->getLocalFilePath());
+        if ($thread->has_attachments) {
+            foreach ($thread->attachments as $attachment) {
+                if (\Helper::isLocalStorage()) {
+                    if ($attachment->fileExists()) {
+                        $message->attach($attachment->getLocalFilePath());
+                    } else {
+                        \Log::error('[ReplyToCustomer] Thread: '.$thread->id.'. Attachment file not find on disk: '.$attachment->getLocalFilePath());
+                    }
+                } else {
+                    \Eventy::filter('email.reply_to_customer.attach', false, $message, $attachment, $thread->id);
+                }
             }
         }
 

app/Mail/Test.php

@@ -23,6 +23,15 @@ class Test extends Mailable
      */
     public function build()
     {
+        \MailHelper::prepareMailable($this);
+        
+        $this->withSwiftMessage(function ($swiftmessage) {
+            $headers = $swiftmessage->getHeaders();
+            $headers->addTextHeader('X-FreeScout-Mail-Type', 'test.mailbox');
+
+            return $swiftmessage;
+        });
+
         $message = $this->subject(__(':app_name Test Email', ['app_name' => \Config::get('app.name')]));
         if ($this->mailbox) {
             $message->view('emails/user/test', ['mailbox' => $this->mailbox]);