3 Commits

Include renames

Author	SHA1	Message	Date
Linus Rath	7e1e2aabf8	test: use a sidecar path instead of the now-denied translate route in the plugin POST test	2026-10-19 01:44:29 +02:00
Linus Rath	2522dbd804	fix: keep the plugin denylist and unit tests from breaking Lite and Docker builds	2026-09-26 21:38:57 +02:00
Linus Rath	6d2255ad0d	fix: keep plugin http.post away from credentialed and admin routes ... `http.post` attaches the user's Authorization header to any same-origin path the plugin's own manifest lists in `apiPostPaths`. A plugin with only `http:post` could list the JMAP passthrough and get full JMAP access, or reach `/api/admin/*`, `/api/settings` and the other credentialed routes. The host now refuses those paths whatever the manifest says, checked on the decoded path the router sees. Plugins keep reaching their own sidecar routes.	2026-09-26 15:01:42 +02:00