From cc4011003a6206e4486091d70eb98813c767e3aa Mon Sep 17 00:00:00 2001
From: Kenny Stimson <kenny_stimson@yahoo.com>
Date: Fri, 1 May 2026 18:40:37 -0700
Subject: [PATCH 1/3] Add cachebuster to webtexting.umd.js

---
 threadlist.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/threadlist.php b/threadlist.php
index 2f9b314..e9a4e5b 100644
--- a/threadlist.php
+++ b/threadlist.php
@@ -256,7 +256,7 @@ class='fas fa-check fa-fw'></span><span class='button-label never pad'>Start</sp
 
 ?>
 <script src="https://cdn.jsdelivr.net/npm/popper.js@1.14.3/dist/umd/popper.min.js"></script>
-<script src="js/webtexting.umd.js"></script>
+<script src="js/webtexting.umd.js?v=<?php echo filemtime(__DIR__ . '/js/webtexting.umd.js'); ?>"></script>
 <script type="text/javascript">
 window.notification_data = <?php echo json_encode(array("extension_uuid" => $extension['extension_uuid'])); ?>;
 

From 2c17511c24a34fe55fadd67239345a9d179305e8 Mon Sep 17 00:00:00 2001
From: Kenny Stimson <kenny_stimson@yahoo.com>
Date: Fri, 1 May 2026 21:52:30 -0700
Subject: [PATCH 2/3] Fix Lua encoder / outbound-hook decoder consistency: RFC
 3986 throughout
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

lua/index.lua's uriescape was mixed-style: it correctly escaped literal `+`
to `%2B` (RFC 3986), but encoded whitespace as `+` (form-urlencoded). This
created ambiguity since mod_curl decodes `%XX` but leaves `+` literal —
both space-as-`+` and `+`-from-`%2B` arrived at PHP indistinguishable.

outbound-hook.php's urldecode (form-urlencoded) then mangled all `+` to
space, corrupting DB-stored Content-Type fields like
`application/vnd.gsma.rcs-ft-http+xml` to `... xml` (literal space).

Fix is coupled across both files:
- lua/index.lua line 12: spaces → %20 (RFC 3986) instead of `+`
- outbound-hook.php lines 32, 33, 40: rawurldecode (RFC 3986) instead of urldecode

Both must change together — see comments in each file. Web UI branch is
unaffected (frontend sends raw JSON, so rawurldecode is a no-op there
and incidentally fixes a latent `+`-mangle bug for user-typed messages).
---
 lua/index.lua     |  7 ++++++-
 outbound-hook.php | 22 +++++++++++++++++++---
 2 files changed, 25 insertions(+), 4 deletions(-)

diff --git a/lua/index.lua b/lua/index.lua
index 512e6c2..8543824 100644
--- a/lua/index.lua
+++ b/lua/index.lua
@@ -9,7 +9,12 @@ function uriescape (s)
             return '%'..string.format("%02X", string.byte(c));
         end
     );
-    s = string.gsub(s, "%s", "+");
+    -- Encode whitespace as %20 (RFC 3986), not "+" (form-urlencoded). Together with the
+    -- first gsub above (which escapes literal "+" to %2B), this gives a fully RFC 3986–
+    -- consistent encoding. mod_curl decodes %XX in transit but leaves "+" literal, so the
+    -- receiving side (outbound-hook.php) must use rawurldecode (RFC 3986) to match.
+    -- Do NOT change to "+" without coordinating the decoder change in outbound-hook.php.
+    s = string.gsub(s, "%s", "%%20");
     return s;
 end
 
diff --git a/outbound-hook.php b/outbound-hook.php
index adb6c63..e0ac997 100644
--- a/outbound-hook.php
+++ b/outbound-hook.php
@@ -25,19 +25,35 @@
 
 // ── Normalize fields based on payload source ──
 // Web UI sends extensionUUID (camelCase); FS event has extension_uuid (set by chatplan user_data)
+//
+// rawurldecode (RFC 3986) used on both branches:
+//
+// - FS-event branch: paired with lua/index.lua's `uriescape`, which encodes literal `+` as
+//   `%2B` (step 1) and whitespace as `%20` (step 2 — see Lua comment there). mod_curl
+//   decodes `%XX` in transit but leaves `+` literal. rawurldecode here is the matching
+//   decoder; effectively a no-op for properly-encoded bodies, defensive against residue.
+//   IMPORTANT: do NOT switch to urldecode without also reverting the Lua line-12 fix —
+//   the encoder and decoder must be consistent (RFC 3986 throughout). Mismatched
+//   urldecode form-urlencoded behavior would mangle literal `+` to space.
+//
+// - Web UI branch: frontend sends raw JSON (no `encodeURIComponent`/`encodeURI`), so
+//   $event->body and $event->id arrive as raw values from json_decode. rawurldecode is
+//   a no-op for these; chosen for consistency and to incidentally fix a latent
+//   `+`-corruption bug where urldecode would have mangled user-entered literal `+`.
+
 if (isset($event->extensionUUID)) {
     // Web UI payload (Ian's webtexting)
     $to = $event->to;
     $contentType = $event->contentType;
-    $body = urldecode($event->body);
-    $dedupeID = urldecode($event->id);
+    $body = rawurldecode($event->body);
+    $dedupeID = rawurldecode($event->id);
     $extensionUUID = $event->extensionUUID;
 } else {
     // FreeSWITCH event payload (from chatplan Lua via mod_curl)
     // extension_uuid set by chatplan: ${user_data(${from_user}@${from_host} var extension_uuid)}
     $to = $event->to_user;
     $contentType = isset($event->type) ? $event->type : 'text/plain';
-    $body = isset($event->_body) ? urldecode($event->_body) : '';
+    $body = isset($event->_body) ? rawurldecode($event->_body) : '';
     $dedupeID = isset($event->{'sip_h_X-Message-ID'}) ? $event->{'sip_h_X-Message-ID'} : uuid();
     $extensionUUID = $event->extension_uuid;
 }

From f3f4366662972e64aea146b5ff5f58236ffde6fc Mon Sep 17 00:00:00 2001
From: Kenny Stimson <kenny_stimson@yahoo.com>
Date: Sat, 2 May 2026 01:01:48 -0700
Subject: [PATCH 3/3] Normalize CRLF endings before splitting on \n\n

---
 frontend/lib/CPIM.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/frontend/lib/CPIM.ts b/frontend/lib/CPIM.ts
index 74667de..34eaa9e 100644
--- a/frontend/lib/CPIM.ts
+++ b/frontend/lib/CPIM.ts
@@ -21,7 +21,8 @@ export class CPIM {
     static fromString(raw: string): CPIM {
         let cpim = new CPIM();
 
-        let parts = raw.split("\n\n");
+        // CRLF normalization — Linphone-emitted CPIM uses CRLF per RFC 3862; mirrors PHP-side fix in src/CPIM.php
+        let parts = raw.replace(/\r\n/g, "\n").split("\n\n");
         cpim.addHeaders(parts[0]);
         cpim.addHeaders(parts[1]);