Commit Graph
7 Commits
Author SHA1 Message Date
Linus Rath 42117da498 fix: stop replaying a stored credential the mail server refused, so a stale session cannot get the webmail banned (GHSA-g6c7-r7wq-xrm2) 2026-10-26 15:00:56 +01:00
Linus Rath 08969fde67 fix: stop reading a mail server's answer past a size limit in the JMAP, WebDAV, push preview and agenda routes 2026-10-26 14:52:04 +01:00
Linus Rath 01a1dc47a6 fix: load push notification previews when the webmail reaches the mail server on an internal address 2026-10-26 11:33:37 +01:00
Linus Rath 39efd8af3c fix: preview the named message when the inbox lookups beside it fail #1041
Any failed method in the preview request answered 502, so when the
server named the delivered message and it was read fine, a failing
Inbox query still turned the notification into a generic "New mail".
The named message is now a complete preview on its own.

A response without the optional `total` was also treated as a failure;
it now counts the returned ids.
2026-10-02 10:32:22 +02:00
lucamzanon 4bc5d48888 fix(push): keep notification previews truthful when a lookup fails
A JMAP method error comes back with HTTP 200. The preview route read a
failed Mailbox/query or Email/query as an empty Inbox and answered
"nothing unread", so the service worker dropped the push in silence.
It now answers 502, and the worker shows its generic notification.

When the server names the message that arrived and it cannot be read -
deleted since, or filed where this login cannot see it - the route no
longer substitutes the newest unread message in the Inbox, which was
some other mail announced as if it had just arrived. It names no
message; the unread total still comes back for the generic toast.
2026-10-01 12:44:14 +02:00
Linus Rath 4858eb0915 fix: open a push notification's message in the account it came from
Clicking a new-mail notification opened `/mail/message/<id>` in
whichever account was active. With several accounts signed in, that
looked the id up in the wrong account: nothing opened, or a different
message did and was marked read.

The preview API now returns the cookie slot of the login that owns the
notified account, the service worker adds it to the permalink (or links
that account's Inbox for a group notification), and the app switches to
the login on that slot before opening the message.
2026-09-26 16:12:20 +02:00
Linus Rath b4f12b6786 fix: resolve push previews for shared and group mailboxes #839 2026-09-07 22:34:47 +02:00