EasyChat 1.4.0

Public OpenCart 2.3 and OpenCart 4 updates are temporarily withheld from this release. They require dedicated safe migrators for legacy data and active PHP code; use 1.4.0 only with the published OpenCart 3 package.

What changed

• EasyChat now opens reliably from the OpenCart admin with one click. A new store owner no longer needs to know or guess the password generated during installation.
• The protected OpenCart launch page now adds a modern framing ban alongside the compatibility header for older browsers. Clickjacking protection stays strict even when a hosting proxy weakens the older header through a global policy.
• Security headers are now guaranteed on the actual 302 transition into EasyChat as well: the one-time link cannot be cached, leaked through the Referer header or opened inside an embedded frame. This behavior is verified by a real HTTP E2E rather than source inspection alone. Operator console pages are also marked no-store, so protected HTML cannot be restored from browser history after sign-out.
• Regular WordPress and Webasyst integrations now use the same protected one-time sign-in. The initial password is no longer stored as plain text in CMS settings.
• OpenCart updates validate the complete published file set, prevent two versions from being copied concurrently, restore previous files after a failure, and clear obsolete PHP code and OPcache entries. The first upgrade from a legacy installation uses two safe steps with a roughly four-minute pause so old PHP workers can finish.
• Recovery recognizes every officially shipped legacy OpenCart file, including both widget template variants and leftover locale files. It preserves an unrelated or modified file and never treats that case as a completed update.
• When hosting cannot persist a protected session, EasyChat no longer reports a false successful login. The administrator receives a clear message and a safe retry action.
• Sign-in now works with secure shared-hosting cookie policies that enforce a root Path and SameSite=Strict, without weakening host-only, Secure or HttpOnly protections.
• EasyChat keeps operator sessions in its own protected directory even when hosting prevents changes to the global session.save_path. The update needs no database migration and remains compatible with current session files from the previous version. Server-side retention stays at 30 days, while cleanup skips an active locked session. The native sess_* format and PHP locking remain intact; an unknown, expired or unsafe session ID fails closed instead of falling back to shared storage.
• Retrying installation preserves the existing administrator, password, settings, keys and database table prefix.
• The admin is faster with fewer full-page reloads. CMS catalogue search and the first-run flow are easier to understand.
• The web admin, widget and Android app can now queue up to 10 photos, remove unwanted items and send the remaining set as one message with a shared caption.
• Conversations handle office documents and supported channel attachments more consistently.

Who should read this

• OpenCart store owners, especially when an unfamiliar username and password form appeared before.
• WordPress and Webasyst administrators who open EasyChat from their CMS.
• Teams updating EasyChat on shared hosting with OPcache enabled.
• Operators who need fast conversation navigation and reliable product and attachment workflows.

What to check after update

When upgrading from a version earlier than 1.4.0, open the EasyChat extension settings after uploading the package and click Update EasyChat safely. There is no need to refresh the global Modifications section: EasyChat uses its own protected recovery procedure.