Linus Rath
b5e92ba176
Merge branch 'feat/org-features' into feat/org-templates
...
# Conflicts:
# lib/admin/restriction-keys.ts
2026-10-28 07:10:25 +01:00
Linus Rath
87e41f0403
feat: share team templates in a group mailbox
2026-10-28 06:24:46 +01:00
Linus Rath
47c47b4f08
feat: keep personal templates in the account on Stalwart 1.0
2026-10-28 06:13:47 +01:00
Linus Rath
57065d7ef2
feat: show an organisation template library from the admin
2026-10-28 05:53:50 +01:00
Linus Rath
795faceee7
Merge branch 'feat/org-thirdparty' into feat/org-features
2026-10-28 05:51:22 +01:00
Linus Rath
687cd89346
Merge branch 'feat/org-external' into feat/org-features
...
# Conflicts:
# lib/outgoing/quick-reply.ts
# lib/outgoing/send-pipeline.ts
2026-10-28 05:46:11 +01:00
Linus Rath
9e809a31db
Merge branch 'feat/org-features' into feat/org-thirdparty
2026-10-28 05:27:58 +01:00
Linus Rath
823da8c810
Merge branch 'feat/org-features' into feat/org-external
...
# Conflicts:
# components/email/email-viewer.tsx
# components/mail/mail-app.tsx
2026-10-28 05:19:21 +01:00
Linus Rath
2ace501871
Merge branch 'feat/org-features' into feat/org-signatures
2026-10-28 04:51:22 +01:00
Linus Rath
89f0cd7e92
fix: say that {company} takes the branding of the web address Bulwark is opened on
2026-10-28 04:37:24 +01:00
Linus Rath
1a747ac9dd
feat: limit the page's CSP to the configured hosts with no third-party traffic #903
2026-10-28 04:30:41 +01:00
Linus Rath
031d94635c
refactor: keep the outgoing host descriptions out of the browser bundle and scan every URL form #903
2026-10-28 04:30:23 +01:00
Linus Rath
65e83e4b0d
fix: show the session warning above every overlay and count the server's sign-in time
2026-10-28 03:53:56 +01:00
Linus Rath
defe4e93f3
fix: bind the sign-in time to the refresh token and count unstamped sessions from a fixed time
2026-10-28 03:42:19 +01:00
Linus Rath
0154e24ffc
feat: add an admin disclaimer to every sent message
2026-10-28 03:17:03 +01:00
Linus Rath
cefb20db4e
test: give the plugin proxy route test the config reader the mode needs #903
2026-10-28 03:10:14 +01:00
Linus Rath
6e5d8faec6
feat: refuse to restore or renew sessions older than the admin-set maximum length
2026-10-28 02:30:32 +01:00
Linus Rath
92c9110f3c
feat: show the third-party traffic switch and what stays reachable in Organisation > Security #903
2026-10-28 02:24:13 +01:00
Linus Rath
65e3d0d2d4
feat: let admins set an organisation signature with user details per domain or group #908
...
Admins write an HTML and a plain-text signature with placeholders on
Organisation > Signatures, per scope. Users fill in the details it asks
for once, under Settings > Account. Without a lock it is the default for
addresses without a signature of their own; locked or hidden, it
replaces every signature.
- `lib/org-signature.ts` fills the templates: values escaped, lines whose
placeholders are all empty dropped
- the composer applies it right before the plugin signature, so new mail,
replies, forwards, re-opened drafts, plain text and identity swaps all
take it the way they take an identity signature; quick reply too
- a send finaliser puts a locked signature back once when it was deleted
- the identity editor shows the filled-in signature read-only with "Set
by your organisation" when locked, and no editor when hidden
- `signatureDetails` is a synced setting
2026-10-28 02:23:55 +01:00
Linus Rath
553f1e9149
feat: add a switch that stops all third-party traffic #903
2026-10-28 02:19:06 +01:00
Linus Rath
45cc6988e0
feat: sign out after an admin-set idle time or session length, with a warning first
2026-10-28 02:18:07 +01:00
Linus Rath
2855ca0010
feat: confirm before sending to recipients outside the organisation
2026-10-28 01:59:13 +01:00
Linus Rath
084cf3cf3a
fix: fetch the policy again only for an account of a domain it doesn't cover
2026-10-28 01:08:56 +01:00
Linus Rath
4004b9be7c
feat: let admins export and import the whole user policy as one file
2026-10-28 00:44:31 +01:00
Linus Rath
e76490580d
feat: add an Organisation area to the admin panel with domain and group scopes
2026-10-28 00:40:56 +01:00
Linus Rath
0738f6f999
feat: say "Set by your organisation" next to settings an admin locked
2026-10-28 00:29:03 +01:00
Linus Rath
4b69f1307f
feat: let admins scope the user policy per domain or group
2026-10-28 00:29:02 +01:00
Linus Rath
d610312483
fix: update the open calendar and show reminders on time when events change elsewhere #1349
2026-10-26 20:35:52 +01:00
Linus Rath
67982b19bf
fix: register the webmail as a first-party OAuth client on Stalwart 1.0 so SSO users keep full access
2026-10-26 20:25:43 +01:00
Linus Rath
004f0948d5
fix: ask Stalwart 1.0 for mail, contacts, calendar and file access when signing in with SSO
2026-10-26 20:25:42 +01:00
Linus Rath
8860dde005
fix: sign in with password and TOTP on Stalwart 1.0
2026-10-26 20:25:42 +01:00
Linus Rath
4bfaf8abce
Merge pull request #1363 from lucamzanon/feat/account-archive-restore-prompt
2026-10-26 19:26:13 +01:00
Linus Rath
8a3351bbc9
fix: refuse an oversized plugin approval upload before reading it
2026-10-26 15:15:58 +01:00
Linus Rath
42117da498
fix: stop replaying a stored credential the mail server refused, so a stale session cannot get the webmail banned (GHSA-g6c7-r7wq-xrm2)
2026-10-26 15:00:56 +01:00
Linus Rath
ae897b42a4
fix: make the impersonation handoff really clear the previous account list and ignore ?impersonated=1 links from elsewhere
2026-10-26 14:58:31 +01:00
Linus Rath
eb2787bcc9
fix: end admin sessions on sign-out and when the admin password changes
2026-10-26 14:52:04 +01:00
Linus Rath
121d2d5e31
fix: stop buffering up to 100 MB of every unauthenticated request body before routing
2026-10-26 14:52:04 +01:00
Linus Rath
08969fde67
fix: stop reading a mail server's answer past a size limit in the JMAP, WebDAV, push preview and agenda routes
2026-10-26 14:52:04 +01:00
Linus Rath
07e6ecce1a
fix: show a plain new-mail notification instead of another login's message when two signed-in logins have the same account id
2026-10-26 14:52:04 +01:00
Linus Rath
885ecdaa07
fix: keep the server's path prefix in the CalDAV addresses shown in calendar settings
2026-10-26 14:52:04 +01:00
lucamzanon
2f8c6e13bf
feat: offer to restore the saved account list on a new device
...
Part 3 of 3 of the account archive (#1198 ). Signing in on a browser that
knows no other account, with a list saved for that account, opens a dialog
asking for the backup password and restores the list as Settings does.
Not now hides the offer for that account in this browser; the restore
stays in Settings.
2026-10-26 12:23:18 +01:00
Linus Rath
e6c911899c
fix: refuse a session secret under 32 characters in the setup wizard, which broke admin sign-in afterwards
2026-10-26 11:48:39 +01:00
Linus Rath
fa3e76652f
fix: keep plugin credentials of a bare-name token sign-in under the account it resolved to
2026-10-26 11:36:57 +01:00
Linus Rath
5bd03d175d
fix: show all-day events on their own day in the Calendar Agenda for viewers west of the server's time zone
2026-10-26 11:33:38 +01:00
Linus Rath
b9fc9bc9c0
fix: stop synced settings from piling up a new file for every extra slash after the server address
2026-10-26 11:33:38 +01:00
Linus Rath
01a1dc47a6
fix: load push notification previews when the webmail reaches the mail server on an internal address
2026-10-26 11:33:37 +01:00
Linus Rath
1fc44b4813
fix: show the push notification for mail in an account shared into another signed-in login
2026-10-26 11:33:37 +01:00
Linus Rath
9ed3354550
fix: send a password and TOTP sign-in to the server the user typed, not the default one
2026-10-26 11:33:37 +01:00
Linus Rath
680742c3ef
fix: end a password and TOTP sign-in without remember me with the browser session
2026-10-26 11:33:37 +01:00
Linus Rath
ec0fed19cc
fix: stop reading a marketplace bundle download once it passes the package size limit
2026-10-26 11:29:37 +01:00
Linus Rath
lucamzanon