Linus Rath
be3debdcb4
fix: never send a message when a plugin that checks it before sending fails or does not answer
2026-10-14 02:11:59 +02:00
Linus Rath
592db209db
fix: sign plugin bundles when they are installed and require the signature for privileged plugins
2026-10-14 02:05:47 +02:00
Linus Rath
e720be7e17
feat: let users install their own plugins, with admin review of the actual code
...
The admin page offered "User Plugin Uploads" and "Require Admin
Approval", but nothing in Settings used them: there was no upload, no
uninstall and no way to ask for approval, and the admin had no list of
requests. The approval code that existed pinned a hash of the code only
and showed the admin a manifest the browser sent, never the code.
Now:
- Settings > Plugins has an install button (when uploads are allowed),
a remove button for the user's own plugins, and lists in plain
language what each plugin may do, high-risk items first
- an install sends the ZIP to the server, which reads the manifest and
code itself and pins the request to a hash of both
- the admin Plugins tab lists requests with the code and approves or
denies them; a user may have 10 open requests
- a user plugin is checked again on every start, so a revoked approval
or turning user plugins off takes effect
- the consent dialog and the plugin settings are translated, use the
theme colours, and show the sites a plugin may send data to
2026-10-14 02:03:26 +02:00
Linus Rath
e9f87c7970
fix: install Theme API v2 themes and their skins from the admin page and the marketplace
2026-10-14 01:47:58 +02:00
Linus Rath
e57b7a2c18
fix: check plugin and theme packages the same way on every install path
...
The Settings upload, the admin upload, the marketplace install and the
marketplace preview each parsed the ZIP and manifest with their own copy
of the code, and the copies had drifted. A `permissions` string skipped
validation and was then matched by substring, a small ZIP could inflate
to hundreds of megabytes on the server, the Settings upload dropped
`locales` and took origin lists unchecked, and settings schemas were
never checked at all.
All of them now go through `lib/extension-package.ts`:
- every file is inflated through a byte cap, with a limit on entries
- one manifest check: types, permissions, entrypoint, version,
minAppVersion, settingsSchema, configSchema, locales and origin lists
- only checked fields are stored
2026-10-14 01:43:43 +02:00
Linus Rath
0dd04ed21d
fix: stop forcing a theme after the admin deletes or disables it
2026-10-14 01:34:40 +02:00
Linus Rath
468c1aac0c
fix: refuse marketplace bundles whose id differs from the directory entry
2026-10-14 01:32:44 +02:00
Linus Rath
c45533646e
fix: give slot plugins the message, event or contact only with the matching read permission
2026-10-14 01:31:30 +02:00
Linus Rath
9bff740a89
fix: keep plugin network access to the origins in its manifest
2026-10-14 01:27:02 +02:00
Linus Rath
67a36c59d9
fix: keep the contact name readable when the detail pane is narrow
2026-10-14 00:40:18 +02:00
Linus Rath
c9d2ba3d03
fix: stop offering ISO timestamps as verification codes #1236
2026-10-14 00:15:08 +02:00
Linus Rath
e99a633379
fix: translate the calendar default reminder strings into all languages #1209
2026-10-13 17:09:36 +02:00
Linus Rath
2a2caaaa90
Merge branch 'main' of https://github.com/bulwarkmail/webmail
2026-10-13 16:59:53 +02:00
Linus Rath
3138c2bd04
fix: stop dropped files from inserting their path into the message body
2026-10-13 16:58:19 +02:00
mmmeon
d35654cadb
fix: set the sender's Message-ID on calendar invitations and replies
2026-10-13 16:32:25 +02:00
Linus Rath
e0f60c0946
Merge branch 'main' of https://github.com/bulwarkmail/webmail
2026-10-13 15:58:52 +02:00
Linus Rath
c878e51fce
fix: clear a calendar's default reminders with an empty list instead of null #1209
2026-10-13 15:56:10 +02:00
Linus Rath
82450f3345
feat: apply the current calendar defaults when an event switches back to them #1209
2026-10-13 15:56:10 +02:00
Linus Rath
3e202e73fd
feat: list every reminder and the calendar defaults in the event popover #1209
2026-10-13 15:56:10 +02:00
Linus Rath
1730d7bab4
feat: set default reminders for each calendar in calendar management #1209
2026-10-13 15:56:10 +02:00
Linus Rath
8181f5ba0c
feat: start new events on the calendar's default reminders #1209
2026-10-13 15:56:10 +02:00
Linus Rath
4e983e3e4e
feat: choose notification or email for each event reminder #1209
2026-10-13 15:56:09 +02:00
Linus Rath
87c6b6762c
feat: add helpers for calendar default alerts and email alert rows #1209
2026-10-13 15:56:09 +02:00
Linus Rath
3788446271
feat: let users hide shared mail accounts from the sidebar #1228
2026-10-13 15:55:54 +02:00
Linus Rath
e09676126b
feat: keep the selection while reading a message in mountain view #1231
2026-10-13 15:40:13 +02:00
Linus Rath
9cae33e3cb
feat: keep the mountain view compose window open while reading other mail #1229
2026-10-13 15:25:56 +02:00
Linus Rath
693d9613c0
feat: let users turn off the prompt before deleting several messages #1225
2026-10-13 15:16:05 +02:00
Linus Rath
435c1e0929
fix: select the rows shown between the two ends on shift-click #1230
2026-10-13 15:02:21 +02:00
Linus Rath
25cbbf8c10
fix: restore the full screen height when the iOS app resumes #1226
2026-10-13 14:53:23 +02:00
Linus Rath
8daa316c18
fix: show a mountain view message together with its conversation #1223
2026-10-13 14:48:58 +02:00
Linus Rath
6f281ef10a
fix: open mountain view threads as a conversation on the phone #1224
2026-10-13 14:35:12 +02:00
Linus Rath
ddab7c781f
feat: open several messages of a conversation at once in mountain view #1222
2026-10-13 14:24:47 +02:00
Linus Rath
94095cf86a
fix: paste a cell range as a table instead of an image #1233
2026-10-13 13:57:30 +02:00
Linus Rath
4d733aa598
chore: remove unused exports and the dead plugin error boundary
2026-10-13 13:36:51 +02:00
Linus Rath
8ad072e458
feat: generate a session secret on first start when none is configured
2026-10-13 13:17:34 +02:00
Linus Rath
3da46b5a0d
feat: remember every sign-in unless the admin shows the remember me box
2026-10-13 13:13:56 +02:00
Linus Rath
5f2d26f2e1
chore: release 1.14.2
2026-10-12 07:49:08 +02:00
Linus Rath
37440e02b0
fix: let tasks move into and live in calendars shared with you #1204
2026-10-12 07:36:46 +02:00
Linus Rath
19797b4c65
fix: sort the message list by date sent when that order is picked #1219
2026-10-12 07:22:00 +02:00
Linus Rath
c587ad459e
fix: keep the dark body backdrop full width in Mountain View and show Gmail's help button
2026-10-12 02:00:02 +02:00
Linus Rath
f160dae25c
fix: stop the panes sliding when animations are turned off #1215
2026-10-12 01:55:57 +02:00
Linus Rath
66122ae652
feat: order Mountain View's bulk actions like Gmail's and search the Move to menu
2026-10-12 01:54:15 +02:00
Linus Rath
0a82835626
feat: lay out Mountain View's account card like Gmail's
2026-10-12 01:53:19 +02:00
Linus Rath
5efe718cf0
feat: order Mountain View's message menu like Gmail's and add Find emails from
2026-10-12 01:45:35 +02:00
Linus Rath
986daef90b
feat: add Gmail's side panel with calendar, tasks and contacts to Mountain View
2026-10-12 01:40:30 +02:00
Linus Rath
cedac10c29
feat: use Gmail's advanced search form in Mountain View
2026-10-12 01:34:02 +02:00
Linus Rath
78e68e8886
feat: write Mountain View replies in place under the conversation
2026-10-12 01:29:55 +02:00
Linus Rath
c652fec371
feat: give Mountain View's compose window Gmail's title bar and bottom bar
2026-10-12 01:26:03 +02:00
Linus Rath
943a92bd42
feat: show the whole conversation around the open message in Mountain View
2026-10-12 01:16:15 +02:00
Linus Rath
1980de68c8
feat: give Mountain View's open message Gmail's toolbar, pager and header
2026-10-12 01:10:10 +02:00
Linus Rath
mmmeon