starred/webmail
1
0
Fork 0
mirror of https://github.com/bulwarkmail/webmail.git synced 2026-11-02 16:15:39 +00:00
Code Issues Packages Projects Releases Wiki Activity
2,874 Commits 5 Branches 63 Tags
af07bb3cd369d2015008f17fb41d64e8dce79778
Commit Graph
6 Commits
Author SHA1 Message Date
Linus Rath 4f942417c8 fix: show pdf attachment previews in safari #1301 2026-10-20 21:08:01 +02:00
Linus Rath 1fd5d0558c fix: send HSTS on TLS requests and drop the X-Powered-By header 2026-10-19 01:32:27 +02:00
Linus Rath 02703d8b3d fix: stop not-found pages outside the app tree from being framed 
Paths the proxy skips (static files, `/_next`, `/api`) got no security
headers at all, so the not-found shell rendered for a missing
`/foo.html`, `/branding/x` or an unknown `/api` route could be framed
by any site. Skipped responses now carry `nosniff` and
`X-Frame-Options: DENY`, and non-API ones `frame-ancestors 'none'`;
API routes keep setting their own CSP.
 2026-09-26 16:22:49 +02:00
Linus Rath e7dc992721 fix: never let ALLOWED_FRAME_ANCESTORS frame the admin dashboard or setup 2026-09-26 16:21:02 +02:00
Linus Rath f086d21d84 docs: use framed standard-theme screenshots in the readme 2026-09-22 23:04:27 +02:00
Linus Rath 9bc54a4ef6 fix: keep security headers on dotted app paths and neutralise cid: blobs (GHSA-xvjh-v9c6-qcvc) 2026-09-17 21:08:37 +02:00