starred/webmail
1
0
Fork 0
mirror of https://github.com/bulwarkmail/webmail.git synced 2026-11-05 08:16:22 +00:00
Code Issues Packages Projects Releases Wiki Activity
4,652 Commits 6 Branches 64 Tags
984e6fa8d9d9256cd4a6fdb275d4101060eda616
Commit Graph
8 Commits
Author SHA1 Message Date
Linus Rath a9b6a05841 feat: enforce the desktop app's OS policies for plugins, mail servers and offline mail 2026-11-03 10:15:15 +01:00
Linus Rath e65f7fe31f feat: let the desktop app reach LAN and plain http mail servers the user approved 2026-11-03 06:32:28 +01:00
Linus Rath 388daf767b feat: count sign-in, pre-check, pair step-up and hand-off limits across every instance #1066 2026-10-31 23:04:05 +01:00
Linus Rath 89ef4d14f2 fix: budget failed sign-ins per client and forward the client address to the mail server 2026-10-19 00:43:00 +02:00
Linus Rath 29c74c3b77 feat: sign in with an access token 2026-10-01 00:24:47 +02:00
Linus Rath a2253982e5 fix: limit wrong passwords tried through the login pre-check 
`/api/auth/verify` checked any username and password against the JMAP
server without a limit. Every probe reaches the server from the
webmail's own address, so the route was a password oracle and enough
wrong passwords could trip Stalwart's authentication ban against the
webmail itself, locking out every user.

Wrong passwords now use up a budget of five per client and thirty
across all clients per fifteen minutes; right ones are refunded. Over
budget the route answers `inconclusive` and the browser probes the JMAP
server itself, as it did before the pre-check existed.
 2026-09-26 16:36:58 +02:00
Linus Rath e908aee994 fix: reject cross-site requests to /api/auth/* to stop session fixation (GHSA-qvr9-m8cq-7wvg) 2026-09-17 20:01:35 +02:00
Linus Rath c395226926 fix: reject wrong passwords server-side so the browser never shows its Basic Auth dialog #969 2026-09-09 19:21:40 +02:00