Skip to main content

Changelog

Follow new updates and improvements to Wevion.

A More Reliable Workflow for Catalogs and Rules

This week's update focuses on platform stability and bug fixes. We resolved a critical issue to prevent accidental data deletion during catalog syncs, ensuring your product information is always safe. We also fixed several bugs in the rule editor where changes would not appear correctly after saving, making rule management more reliable.

🇮🇹 Italiano

L'aggiornamento di questa settimana è dedicato alla stabilità della piattaforma e alla risoluzione di bug. Abbiamo risolto un problema critico per prevenire la cancellazione accidentale di dati durante le sincronizzazioni dei cataloghi, assicurando che le informazioni sui tuoi prodotti siano sempre al sicuro. Abbiamo anche corretto diversi bug nell'editor delle regole, dove le modifiche non venivano visualizzate correttamente dopo il salvataggio, rendendo la gestione delle regole più affidabile.

Fixed

Select multiple items in tables more reliably

We fixed a bug where using Shift + Click to select a range of items could behave unexpectedly after you sorted or filtered a table. Your selections will now always accurately reflect the current data view. This makes bulk-editing campaigns, ad sets, and ads faster and more predictable.

🇮🇹 Italiano

Abbiamo corretto un bug che causava un comportamento imprevisto quando si utilizzava Maiusc + Clic per selezionare un intervallo di elementi dopo aver ordinato o filtrato una tabella. Ora le selezioni rifletteranno sempre con precisione la vista corrente dei dati, rendendo la modifica massiva di campagne, gruppi di inserzioni e annunci più rapida e prevedibile.

Fixed

Security Hardening — 30 Vulnerabilities Fixed

🔒 Security

  • SSRF Protection — All external URL fetches (image provider, bulk helpers) now use ssrfSafeFetch with strict timeouts and domain validation
  • Token Encryption — Meta API tokens encrypted at rest with AES-256. Refresh workers use encrypted storage exclusively
  • RBAC Enforcement — Billing endpoints (cancel, change-plan, extra-users) now require proper role authorization. Finance role removed from cross-tenant admin bypass
  • Tenant Isolation — Worker run status endpoints now enforce session-based data isolation. Added ownership checks on thumbnail/video URL signing
  • HMAC Verification — Public postback endpoints validate HMAC signatures. OAuth state comparison uses timing-safe equality
  • CORS Hardening — Wildcard origin rejected in non-local environments. Strict origin validation in production
  • Meta API Auth Migration — All Meta API calls migrated from URL query params to Bearer header authorization. Plaintext token fallback rejected in production
  • Input Validation — TypeBox schema validation hardened across all endpoints. Mass assignment prevention on user-modifiable objects

✨ Improved

  • TLS Verification — PostgreSQL connections now require TLS certificate verification in production
  • Credit System — Row-level locking (FOR UPDATE) on AI chat credit deduction prevents race conditions
  • Multipart Uploads — Permission check reset on folder change prevents unauthorized file access
Fixed