外掛說明

MLC Live Chat adds a live chat widget to your site that forwards visitor messages to your Bale bot, and lets you reply either from Bale itself or directly from the WordPress dashboard. The plugin stores all conversation data in your own WordPress database, ensuring full privacy and control.

Features

Live chat delivered through the Bale messenger
Dedicated conversations dashboard in wp-admin with direct reply support
Floating admin-bar/dashboard notification for new messages
Customizable chat widget (colors, position, welcome message)
Automatic or manual naming of guest conversations
Compatible with Elementor and other page builders — the widget does not load inside the live-preview editor to avoid conflicts

External services

This plugin connects to the Bale messenger’s Bot API (tapi.bale.ai), which is required for its core functionality: delivering visitor chat messages to your Bale bot and receiving the admin’s replies back to the visitor.

It sends data to this service in two situations:
* When a visitor sends a message through the chat widget, the message text is sent to tapi.bale.ai so it can be forwarded to the site owner’s Bale bot.
* When the site owner replies (from Bale or from the WordPress dashboard), the plugin calls tapi.bale.ai to deliver that reply, and Bale calls back a webhook URL on your own site to pass admin replies to the plugin.

No data is sent unless the plugin is enabled and a Bale bot token has been configured by the site owner in the plugin settings.

This service is provided by “Bale” (Sadad Informatics Corporation / Bank Melli Iran): Terms of Service, API documentation.

安裝方式

Upload the plugin folder to /wp-content/plugins/, or install it through the WordPress plugin installer.
Activate the plugin from the “Plugins” menu.
Go to the plugin settings, enter your Bale bot token and admin chat ID.
Click “Set webhook automatically” so the plugin registers the delivery URL with your bot.

常見問題集

Why aren’t messages being delivered to Bale?: Use the “Check current webhook status” button in the settings page to diagnose the connection between your server and the Bale API.
Is this plugin compatible with Elementor?: Yes. The chat widget is automatically disabled while editing in Elementor’s live preview (as well as Divi, Beaver Builder, and Visual Composer) to avoid interfering with the builder’s editing tools; it displays normally for visitors on the published site.

使用者評論

這個外掛目前沒有任何使用者評論。

參與者及開發者

以下人員參與了開源軟體〈MLC Live Chat〉的開發相關工作。

Hadi Shiri

將〈MLC Live Chat〉外掛本地化為台灣繁體中文版

對開發相關資訊感興趣？

任何人均可瀏覽程式碼、查看 SVN 存放庫，或透過 RSS 訂閱開發記錄。

變更記錄

2.3.2

Moved the debug log directory back under wp_upload_dir() (a randomized, per-site subfolder) instead of a custom path directly under WP_CONTENT_DIR, per the plugin directory’s guidance on determining writable locations correctly.
Replaced all direct file_put_contents()/file_get_contents() calls for log files with WP_Filesystem, for better compatibility across hosting environments.
Log files are now capped at 500KB (oldest entries are trimmed) to keep the read-then-write pattern required by WP_Filesystem fast.

2.3.1

Fixed the Bale “Reply” button (and /reply command) not delivering replies after upgrading from 2.2.x. The REST API namespace changed in 2.3.0, which left the webhook URL previously registered with Bale pointing to a route that no longer existed; the plugin now automatically re-registers the webhook on the new route the first time it runs after this update, without any action needed from the site owner. Sites still on 2.3.0 can also fix this immediately by clicking “Set webhook automatically” in the settings page.

2.3.0

Renamed all PHP classes, functions, constants, option names, AJAX actions, the REST API namespace, and JS globals from the mlc/MLC prefix (3 characters) to mlclich/MLCLICH, to comply with the WordPress.org plugin directory’s uniqueness requirements. The plugin slug and text domain (mlc-live-chat) are unchanged.
Security fix: the webhook signature check (verify_secret()) previously allowed requests through when no secret was configured yet; it now rejects them instead, closing a window where replies could be spoofed on a freshly-activated site.
Moved all inline <script>/<style> blocks in admin pages and the chat widget to properly enqueued files via wp_enqueue_script()/wp_enqueue_style(), wp_localize_script(), and wp_add_inline_style().
The register_setting() sanitize callback now fully sanitizes every settings field (previously only two of the fields were handled there, relying on the AJAX handler for the rest).
Lowered the admin menu position so it no longer competes with WordPress core menu items.
Moved the debug log files out of wp-content/uploads (a web-accessible directory) to a dedicated folder outside of it, with a randomized per-site filename, so log contents are not exposed regardless of web server type (this previously relied on .htaccess, which Nginx ignores by default).
Documented the plugin’s use of the Bale Bot API as an external service in the readme, per the plugin directory’s guidelines.

2.2.9

Fixed two unescaped/unprepared SQL warnings in the sessions-overview and new-messages queries by inlining the SQL directly into $wpdb->prepare() calls.
Added a lightweight object-cache layer (wp_cache_get()/wp_cache_set()) to frequently-read queries to reduce direct-database-query notices and improve performance; the cache is invalidated on every write.
Polling queries (new admin replies, live message count) remain intentionally uncached to keep the chat real-time.

2.2.8

Removed the temporary connectivity diagnostic tool (ping-test buttons and its unauthenticated logging endpoint) from the settings page.
Replaced remaining direct SQL string interpolation with $wpdb->prepare() identifier placeholders (%i), removing all direct-database-query warnings.
Bumped minimum required WordPress version to 6.2 (required by the %i placeholder) and updated “Tested up to” to the current release.

2.2.7

Plugin now supports the Bale messenger exclusively; other messenger integrations have been removed.
Security hardening: added missing input unslashing/sanitization, escaped all admin-page output, and reduced direct database query warnings.
Replaced direct filesystem calls with WordPress-recommended equivalents (wp_delete_file(), WP_Filesystem).
Removed the deprecated load_plugin_textdomain() call and the unused Domain Path header.

2.2.1

Fixed a critical bug where the settings sanitize function always returned “enabled” as active.
Fixed conflicts with Elementor’s live preview mode.
Added ABSPATH security guard to all PHP files.
Added readme.txt for release on the WordPress plugin repository.

2.1.0 – 2.2.0

Added the conversations dashboard, floating notification icon, automatic webhook detection, and various security and UI improvements.