Linus Rath
eb2787bcc9
fix: end admin sessions on sign-out and when the admin password changes
2026-10-26 14:52:04 +01:00
Linus Rath
121d2d5e31
fix: stop buffering up to 100 MB of every unauthenticated request body before routing
2026-10-26 14:52:04 +01:00
Linus Rath
08969fde67
fix: stop reading a mail server's answer past a size limit in the JMAP, WebDAV, push preview and agenda routes
2026-10-26 14:52:04 +01:00
Linus Rath
07e6ecce1a
fix: show a plain new-mail notification instead of another login's message when two signed-in logins have the same account id
2026-10-26 14:52:04 +01:00
Linus Rath
885ecdaa07
fix: keep the server's path prefix in the CalDAV addresses shown in calendar settings
2026-10-26 14:52:04 +01:00
Linus Rath
e6c911899c
fix: refuse a session secret under 32 characters in the setup wizard, which broke admin sign-in afterwards
2026-10-26 11:48:39 +01:00
Linus Rath
fa3e76652f
fix: keep plugin credentials of a bare-name token sign-in under the account it resolved to
2026-10-26 11:36:57 +01:00
Linus Rath
5bd03d175d
fix: show all-day events on their own day in the Calendar Agenda for viewers west of the server's time zone
2026-10-26 11:33:38 +01:00
Linus Rath
b9fc9bc9c0
fix: stop synced settings from piling up a new file for every extra slash after the server address
2026-10-26 11:33:38 +01:00
Linus Rath
01a1dc47a6
fix: load push notification previews when the webmail reaches the mail server on an internal address
2026-10-26 11:33:37 +01:00
Linus Rath
1fc44b4813
fix: show the push notification for mail in an account shared into another signed-in login
2026-10-26 11:33:37 +01:00
Linus Rath
9ed3354550
fix: send a password and TOTP sign-in to the server the user typed, not the default one
2026-10-26 11:33:37 +01:00
Linus Rath
680742c3ef
fix: end a password and TOTP sign-in without remember me with the browser session
2026-10-26 11:33:37 +01:00
Linus Rath
ec0fed19cc
fix: stop reading a marketplace bundle download once it passes the package size limit
2026-10-26 11:29:37 +01:00
Linus Rath
cb51847ab3
fix: refuse plugin approval requests while user plugins or their review are turned off (GHSA-qc44-275p-gqw9)
2026-10-26 11:29:36 +01:00
Linus Rath
cf2c27157d
Merge branch 'main' into feat/stalwart-1.0
...
# Conflicts:
# components/contacts/contacts-app.tsx
# components/email/__tests__/composer-discard.test.tsx
# components/email/calendar-invitation-banner.tsx
# components/email/email-composer.tsx
# components/mail/mail-app.tsx
# components/pro/pro-compose-tab-body.tsx
# components/pro/pro-email-tab-body.tsx
# components/ui/__tests__/avatar.test.tsx
# components/ui/avatar.tsx
# hooks/use-mailbox-drop.ts
# lib/__tests__/calendar-alerts.test.ts
# lib/__tests__/jmap-calendar-tasks.test.ts
# lib/__tests__/jmap-send-threading.test.ts
# lib/demo/demo-client.ts
# lib/demo/fixtures/calendars.ts
# lib/jmap/client-interface.ts
# lib/jmap/client.ts
# lib/web-push.ts
# stores/__tests__/contact-store.test.ts
# stores/__tests__/email-store-thread-key.test.ts
# stores/calendar-store.ts
# stores/contact-store.ts
# stores/email-store.ts
2026-10-26 10:14:12 +01:00
Linus Rath
391ed6c018
Merge branch 'fix/security-audit-2026-10'
2026-10-19 12:58:50 +02:00
Linus Rath
9f3441c783
fix: accept both fetch response types in the capped feed reader
2026-10-19 01:36:16 +02:00
Linus Rath
546f34f47e
fix: cap concurrent upstream favicon fetches
2026-10-19 01:32:29 +02:00
Linus Rath
d13aada077
fix: bound how many CalDAV probes one discovery request can make
2026-10-19 01:32:29 +02:00
Linus Rath
703a15663f
fix: keep the extension directory URL off private addresses
2026-10-19 01:32:25 +02:00
Linus Rath
71036c1812
fix: validate the marketplace version and refuse a silent downgrade on update
2026-10-19 01:32:24 +02:00
Linus Rath
5632097971
fix: type the capped feed reader and the invitation sender lookup
2026-10-19 01:32:23 +02:00
Linus Rath
0b01a2d066
fix: ask before handing a sign-in to the mobile app and only to its own callback link
2026-10-19 01:22:19 +02:00
Linus Rath
044c98e6d2
fix: cap the size of a synced settings blob
2026-10-19 01:15:04 +02:00
Linus Rath
c0b6519136
fix: stop reading a calendar feed at the size cap instead of buffering it whole
2026-10-19 01:15:04 +02:00
Linus Rath
e6064f3476
fix: only connect and proxy plugin credentials that a plugin known to the server declares
2026-10-19 01:07:50 +02:00
Linus Rath
31326c7daf
fix: keep OAuth client secrets and the session secret out of the admin audit log, config API and dashboard writes
2026-10-19 00:50:16 +02:00
Linus Rath
f91b214719
fix: key synced settings on the account a token login resolves to, not on a bare claimed name
2026-10-19 00:45:11 +02:00
Linus Rath
89ef4d14f2
fix: budget failed sign-ins per client and forward the client address to the mail server
2026-10-19 00:43:00 +02:00
Linus Rath
8da659fd8c
feat: install any version from the marketplace and show updates, withdrawn versions and advisories
...
The marketplace now talks to the extension directory's v2 API only. The
detail page lists every version, previews the one picked, installs it,
and refuses a version the publisher withdrew unless the admin confirms,
or one outside the Bulwark range it supports. The listing gains sort, an
Installed view and an updates strip fed by the directory's updates check,
with notices for advisories, deprecations and suspensions.
A self-hosted directory older than 2026-10-14 has no v2 API and no
longer works with the marketplace.
2026-10-19 00:09:39 +02:00
Linus Rath
dd0da783c6
feat: keep replaced plugin and theme versions and roll back to them
2026-10-19 00:08:10 +02:00
Linus Rath
4adbad25f6
feat: end the provider session through a configured logout URL #1279
2026-10-18 13:46:48 +02:00
Linus Rath
8583c9efef
feat: hide the version from the connector probe when the login page hides it #896
2026-10-17 19:18:21 +02:00
Linus Rath
b611d9c028
feat: refresh sender icons that changed on the sender's website #960
2026-10-17 19:18:18 +02:00
Linus Rath
deb106736e
fix: load the admin panel when the config is read-only #1249
2026-10-17 19:17:48 +02:00
Linus Rath
a854447346
fix: apply admin policy defaults to user settings #1248
2026-10-17 19:17:46 +02:00
Linus Rath
20b0c9b0b5
fix: refuse OAuth auto-setup before touching Stalwart when the config is read-only #1250
2026-10-16 22:35:07 +02:00
Linus Rath
41a0716c50
Merge branch 'main' into feat/stalwart-1.0
2026-10-16 01:41:48 +02:00
Linus Rath
0b49d01a76
fix: keep synced calendar subscriptions from stale devices and past deletions #1064
2026-10-15 23:54:37 +02:00
Linus Rath
db2c0aff3d
perf: load conversation sizes with the folder page instead of in a second request
2026-10-15 00:14:57 +02:00
Linus Rath
e7bf3c6e42
test: add a benchmark-sized message corpus to the dev mock
2026-10-14 23:51:17 +02:00
Linus Rath
15edc5943b
feat: check the extension directory's signature before installing from the marketplace
2026-10-14 21:36:50 +02:00
Linus Rath
eba711bd54
Merge branch 'feat/plugin-system-audit'
2026-10-14 18:09:19 +02:00
Linus Rath
633df44090
fix: keep the sign-in response small enough for proxies with large OIDC tokens #1237
2026-10-14 13:59:41 +02:00
Linus Rath
607f1b2496
feat: let plugin notifications carry a link to the plugin's own server
2026-10-14 10:58:19 +02:00
Linus Rath
c3cf0ddcff
feat: tell plugins whether the admin has set up their accounts and keys
2026-10-14 08:24:28 +02:00
Linus Rath
49511dff38
feat: let plugins read their own non-secret admin settings without the admin permission
2026-10-14 06:23:10 +02:00
Linus Rath
5d9268c923
feat: let plugins add buttons, calendar day labels and pages, and use connected accounts from the sandbox
2026-10-14 04:31:43 +02:00
Linus Rath
022b83c005
feat: let plugins use accounts and API keys through the server without seeing them
...
Plugins that talk to Nextcloud, Paperless or an AI provider used to need
the password or key in their own settings, readable by the plugin and
stored in the browser. A plugin can now declare credentials in its
manifest and send requests "with credential X" through the server:
- `credentials` in the manifest: admin scope (secret and server from the
admin config) or user scope (the user connects an account; the server
address is fixed or chosen by the user)
- `/api/plugin-secrets`: the user's connected accounts, encrypted per
mail account under `PLUGIN_SECRETS_DIR`; listing never returns secrets
- `/api/plugin-proxy`: adds the secret and forwards only to the
credential's own origin, through the SSRF guard unless the admin set
the server up or listed it in `PLUGIN_PROXY_PRIVATE_ORIGINS`; no
redirects or WebDAV moves to other servers, streamed bodies capped at
512 MB up and 2 GB down, 300 requests a minute per plugin, 8 at once
per user, and one audit line per request without paths or bodies
- a capture mode that stores a secret from a sign-in response (Nextcloud
Login Flow v2) and removes it from what the plugin gets back
2026-10-14 04:00:36 +02:00
Linus Rath