Jot Security

Hello @Wise ,

Yes, the secret exists in the version that was uploaded to the Jot Server files on Git, but it hasn't been released yet. It's the very bottom option from your screen. I will try to release it during this week.

The two upper options, JWT token API ID and JWT token App secret, are related to the Jitsi integration and can be enabled when JWT is installed for Jitsi.

Hello @Wise ,

If you enable both Jitsi options and install Jitsi with JWT, then only users from your site will be able to create and join rooms on your Jitsi instance. The Jot Messenger JWT option allows users to connect to Jot Messenger using a JWT token.

Hello @Wise,

Domains option allows you to specify which IP addresses are permitted to connect to the server for the Jot Messenger module. Here's how it works:

If you want to allow specific IP addresses, you can list them one by one:

"domains": ["127.0.0.1", "127.0.0.2"]

In this example, only the IP addresses 127.0.0.1 and 127.0.0.2 are allowed to use the server. If you want to allow any IP address to connect to the server, you can use an asterisk (*):

  "domains": ["*"]

In this case, any domain or IP address can use your server for the Jot Messenger module. In summary, listing specific IPs restricts access to those IPs only, while using * opens access to all domains.

Hello!

Regarding the update: It will be finished next week. Thank you for your patience!

Regarding scaling Jot-server: By default, it can handle several thousand connections and work with multiple domains without any issues. We have never had problems with it overloading before.

About domains: You should use the IPs of the sites from which users are allowed to connect to the Jot-server. The GitHub version is not finished yet, but domains should work fine for the current version 1.0.3. I will prepare it next week, and it will work as expected for the latest version 1.0.4 as well.

Hello!

I've updated the version on GitHub. Feel free to test it. You no longer need to use an IP address. You may leave the option domains: "*" but make sure to define the JWT token with the secret word. It should work.

Regarding the log function: it doesn't log requests or responses. It is used when the server crashes and cannot start, or when there are exceptions or errors during server operation.

Yes, the dependencies have been updated to address vulnerabilities, so versions some of them have been changed. Anyway Node.js 14 is now also is not new compared to the latest stable version, Node.js 20.

Push notifications for Messenger are located in the Notifications module. You can disable them in the PUSH area under Studio -> Notifications.

Hello!

I suppose you may use silent_mode option to prevent sending push notifications.

1) In file modules/boonex/classes/BxMessngerModule.php find the method:

public function sendNotifications($iLotId, $iJotId, $aOnlineUsers = [], $aRecipients = [], $sType = BX_MSG_NTFS_MESSAGE)

and replace code:

bx_alert($sModule, !$bIsMention ? 'got_jot_ntfs' : 'got_mention_ntfs', $iLotId, $this->_iProfileId, array(
    'object_author_id' => $iPart,
    'recipient_id' => $iPart,
    'subobject_id' => $iJotId
));

with this code:

bx_alert($sModule, !$bIsMention ? 'got_jot_ntfs' : 'got_mention_ntfs', $iLotId, $this->_iProfileId, array(
    'object_author_id' => $iPart,
    'recipient_id' => $iPart,
    'subobject_id' => $iJotId,
    'silent_mode' => BX_NTFS_SLTMODE_SITE_PUSH
));

Good point! I have added it to the features list https://github.com/unacms/jot-client-una/issues/310

You may correct code in the same file modules/boonex/classes/BxMessngerModule.php.

Find the function serviceGetMessageContent($aEvent)

and replace this line:

$sAlterBody = $sTruncatedMessage ? $sTruncatedMessage : _t('_bx_messenger_txt_sample_email_push', html2txt($sMessage));

with this code:

$sAlterBody = $sTruncatedMessage ? 'New message waiting in talk' : _t('_bx_messenger_txt_sample_email_push', html2txt($sMessage));