starred/webmail
1
0
Fork 0
mirror of https://github.com/bulwarkmail/webmail.git synced 2026-10-31 16:13:15 +00:00
Code Issues Packages Projects Releases Wiki Activity
3,910 Commits 5 Branches 63 Tags
main
Commit Graph
3 Commits
Author SHA1 Message Date
Linus Rath 7e1e2aabf8 test: use a sidecar path instead of the now-denied translate route in the plugin POST test 2026-10-19 01:44:29 +02:00
Linus Rath 2522dbd804 fix: keep the plugin denylist and unit tests from breaking Lite and Docker builds 2026-09-26 21:38:57 +02:00
Linus Rath 6d2255ad0d fix: keep plugin http.post away from credentialed and admin routes 
`http.post` attaches the user's Authorization header to any same-origin
path the plugin's own manifest lists in `apiPostPaths`. A plugin with
only `http:post` could list the JMAP passthrough and get full JMAP
access, or reach `/api/admin/*`, `/api/settings` and the other
credentialed routes. The host now refuses those paths whatever the
manifest says, checked on the decoded path the router sees. Plugins
keep reaching their own sidecar routes.
 2026-09-26 15:01:42 +02:00