  Linus RathandAlmost-Senseless-Coder
|
b88397dfd2
|
fix: renew a background OAuth account with its own token instead of the active account's #989
Co-authored-by: Almost-Senseless-Coder <109462027+Almost-Senseless-Coder@users.noreply.github.com>
|
2026-10-26 14:58:31 +01:00 |
|
|
Linus Rath
|
72faa57367
|
fix: keep the app files in the Docker image read-only for the user it runs as
|
2026-10-26 14:52:04 +01:00 |
|
|
Linus Rath
|
eb2787bcc9
|
fix: end admin sessions on sign-out and when the admin password changes
|
2026-10-26 14:52:04 +01:00 |
|
|
Linus Rath
|
121d2d5e31
|
fix: stop buffering up to 100 MB of every unauthenticated request body before routing
|
2026-10-26 14:52:04 +01:00 |
|
|
Linus Rath
|
08969fde67
|
fix: stop reading a mail server's answer past a size limit in the JMAP, WebDAV, push preview and agenda routes
|
2026-10-26 14:52:04 +01:00 |
|
|
Linus Rath
|
07e6ecce1a
|
fix: show a plain new-mail notification instead of another login's message when two signed-in logins have the same account id
|
2026-10-26 14:52:04 +01:00 |
|
|
Linus Rath
|
885ecdaa07
|
fix: keep the server's path prefix in the CalDAV addresses shown in calendar settings
|
2026-10-26 14:52:04 +01:00 |
|
|
Linus Rath
|
f8c429f217
|
fix: re-prompt for a pasted session secret under 32 characters in setup.sh, which broke admin sign-in and remember-me
|
2026-10-26 14:52:04 +01:00 |
|
|
Linus Rath
|
fb793220b7
|
fix: keep plugin switches from shrinking next to long labels, like the app's settings switches
|
2026-10-26 14:52:04 +01:00 |
|
|
Linus Rath
|
ff3e088cbb
|
fix: update undici to 7.30.1 for a decompression denial of service (GHSA-xjj6-f33q-929c)
|
2026-10-26 14:52:04 +01:00 |
|
|
Linus Rath
|
e314e56661
|
fix: keep the own and a group's scheduled mail apart when their ids are the same
|
2026-10-26 12:26:58 +01:00 |
|
|
Linus Rath
|
d355e45b77
|
fix: stop Send now from dropping a group identity's delayed mail back into Drafts
|
2026-10-26 12:26:58 +01:00 |
|
|
Linus Rath
|
3508412b8b
|
fix: stop reply and send from slowing down on deeply nested quotes
|
2026-10-26 12:26:58 +01:00 |
|
|
Linus Rath
|
8c9cf8e63e
|
test: check draft account and threading headers in createDraft's options after the merge
|
2026-10-26 12:26:57 +01:00 |
|
|
Linus Rath
|
dcde570ebe
|
fix: say the directory can't be browsed instead of that a refresh failed when the server lists only the people you know
|
2026-10-26 12:25:32 +01:00 |
|
|
Linus Rath
|
5b4db7f1d8
|
fix: keep emoji and organizer names with a colon intact in exported events
|
2026-10-26 12:25:32 +01:00 |
|
|
Linus Rath
|
292ccce9ee
|
fix: delete, move and change groups of another signed-in account's contacts in that account
|
2026-10-26 12:25:31 +01:00 |
|
|
Linus Rath
|
4cfdc877d1
|
fix: keep a contact created in a shared address book from being mistaken for an own contact with the same id
|
2026-10-26 12:25:31 +01:00 |
|
|
Linus Rath
|
b038c82dcc
|
fix: only offer to apply a counter proposal sent by one of the meeting's participants
|
2026-10-26 12:25:31 +01:00 |
|
|
Linus Rath
|
82de3c8df1
|
fix: translate the strings Estonian was missing after the Stalwart 1.0 merge
|
2026-10-26 12:25:31 +01:00 |
|
|
Linus Rath
|
7e0be4625a
|
test: copy a file the reworked demo drive still has in the mock server tests
|
2026-10-26 12:25:31 +01:00 |
|
|
Linus Rath
|
02e8541571
|
test: search the reworked demo calendar in the demo search tests
|
2026-10-26 12:25:31 +01:00 |
|
|
Linus Rath
|
cd2bcc0520
|
fix: load the calendar range once, not twice, after creating a recurring event
|
2026-10-26 12:25:31 +01:00 |
|
|
Linus Rath
|
33c5ca8125
|
test: check bulk moves against the per-login routing
|
2026-10-26 12:25:09 +01:00 |
|
|
Linus Rath
|
72e5af2c52
|
fix: take a shared folder's Trash from the viewed folder list when bulk deleting
|
2026-10-26 12:25:09 +01:00 |
|
|
Linus Rath
|
88b960d605
|
fix: stop deleting the active account's mail after removing the account whose folder is open
|
2026-10-26 12:25:08 +01:00 |
|
|
Linus Rath
|
eeb6ccc4db
|
fix: create each account's Archive when bulk archiving in the unified inbox
|
2026-10-26 12:25:08 +01:00 |
|
|
Linus Rath
|
e6c911899c
|
fix: refuse a session secret under 32 characters in the setup wizard, which broke admin sign-in afterwards
|
2026-10-26 11:48:39 +01:00 |
|
|
Linus Rath
|
863aa81d1c
|
fix: stop a synced settings file from passing as an admin session
|
2026-10-26 11:48:39 +01:00 |
|
|
Linus Rath
|
30cb676fad
|
fix: write the admin config, password hash and setup token readable only by the app's own user
|
2026-10-26 11:48:38 +01:00 |
|
|
Linus Rath
|
3036769645
|
fix: let the allowed frame ancestors saved in the admin dashboard reach the frame-ancestors header
|
2026-10-26 11:48:38 +01:00 |
|
|
Linus Rath
|
a4c6d7867a
|
test: expect the plugin sandbox assets among the CORS-enabled static paths
|
2026-10-26 11:48:38 +01:00 |
|
|
Linus Rath
|
0f0ebc906b
|
fix: stop trusting the unprefixed sidebar-app frame cookie when COOKIE_SECURE=true (GHSA-cjm9-m826-mh78)
|
2026-10-26 11:48:38 +01:00 |
|
|
Linus Rath
|
fa3e76652f
|
fix: keep plugin credentials of a bare-name token sign-in under the account it resolved to
|
2026-10-26 11:36:57 +01:00 |
|
|
Linus Rath
|
5bd03d175d
|
fix: show all-day events on their own day in the Calendar Agenda for viewers west of the server's time zone
|
2026-10-26 11:33:38 +01:00 |
|
|
Linus Rath
|
b9fc9bc9c0
|
fix: stop synced settings from piling up a new file for every extra slash after the server address
|
2026-10-26 11:33:38 +01:00 |
|
|
Linus Rath
|
01a1dc47a6
|
fix: load push notification previews when the webmail reaches the mail server on an internal address
|
2026-10-26 11:33:37 +01:00 |
|
|
Linus Rath
|
1fc44b4813
|
fix: show the push notification for mail in an account shared into another signed-in login
|
2026-10-26 11:33:37 +01:00 |
|
|
Linus Rath
|
9ed3354550
|
fix: send a password and TOTP sign-in to the server the user typed, not the default one
|
2026-10-26 11:33:37 +01:00 |
|
|
Linus Rath
|
f9ccc6adf1
|
fix: clear the refresh token of an OAuth account that could not be restored
|
2026-10-26 11:33:37 +01:00 |
|
|
Linus Rath
|
192d32819c
|
fix: stop a bare login name from claiming an address on another domain
|
2026-10-26 11:33:37 +01:00 |
|
|
Linus Rath
|
680742c3ef
|
fix: end a password and TOTP sign-in without remember me with the browser session
|
2026-10-26 11:33:37 +01:00 |
|
|
Linus Rath
|
ec0fed19cc
|
fix: stop reading a marketplace bundle download once it passes the package size limit
|
2026-10-26 11:29:37 +01:00 |
|
|
Linus Rath
|
e762943f7b
|
fix: let a plugin move a single message that is not in the open list
|
2026-10-26 11:29:37 +01:00 |
|
|
Linus Rath
|
8e66c9f6ad
|
fix: keep plugin approval requests that several users send at once
|
2026-10-26 11:29:37 +01:00 |
|
|
Linus Rath
|
c4a399f5b8
|
fix: stop plugin moves from filing another account's messages while its folder is open
|
2026-10-26 11:29:37 +01:00 |
|
|
Linus Rath
|
cb51847ab3
|
fix: refuse plugin approval requests while user plugins or their review are turned off (GHSA-qc44-275p-gqw9)
|
2026-10-26 11:29:36 +01:00 |
|
|
Linus Rath
|
b5c6b67ba4
|
fix: keep a link in a printed message from redirecting the webmail tab
|
2026-10-26 11:22:10 +01:00 |
|
|
Linus Rath
|
3f2f27321c
|
fix: keep an unquoted cid: image from swallowing the rest of the message
|
2026-10-26 11:22:10 +01:00 |
|
|
Linus Rath
|
6014142358
|
fix: show conversation and attached-message attachment names without directional override characters
|
2026-10-26 11:22:10 +01:00 |
|