Commit Graph
1456 Commits
Author SHA1 Message Date
Linus Rath ae897b42a4 fix: make the impersonation handoff really clear the previous account list and ignore ?impersonated=1 links from elsewhere 2026-10-26 14:58:31 +01:00
Linus Rath f02e96b47a fix: stop the password and TOTP sign-in from re-posting the password to another host when the mail server redirects 2026-10-26 14:58:31 +01:00
Linus Rath eb2787bcc9 fix: end admin sessions on sign-out and when the admin password changes 2026-10-26 14:52:04 +01:00
Linus Rath 121d2d5e31 fix: stop buffering up to 100 MB of every unauthenticated request body before routing 2026-10-26 14:52:04 +01:00
Linus Rath 08969fde67 fix: stop reading a mail server's answer past a size limit in the JMAP, WebDAV, push preview and agenda routes 2026-10-26 14:52:04 +01:00
Linus Rath 07e6ecce1a fix: show a plain new-mail notification instead of another login's message when two signed-in logins have the same account id 2026-10-26 14:52:04 +01:00
Linus Rath 885ecdaa07 fix: keep the server's path prefix in the CalDAV addresses shown in calendar settings 2026-10-26 14:52:04 +01:00
Linus Rath fb793220b7 fix: keep plugin switches from shrinking next to long labels, like the app's settings switches 2026-10-26 14:52:04 +01:00
Linus Rath e314e56661 fix: keep the own and a group's scheduled mail apart when their ids are the same 2026-10-26 12:26:58 +01:00
Linus Rath d355e45b77 fix: stop Send now from dropping a group identity's delayed mail back into Drafts 2026-10-26 12:26:58 +01:00
Linus Rath 3508412b8b fix: stop reply and send from slowing down on deeply nested quotes 2026-10-26 12:26:58 +01:00
Linus Rath 5b4db7f1d8 fix: keep emoji and organizer names with a colon intact in exported events 2026-10-26 12:25:32 +01:00
Linus Rath 7e0be4625a test: copy a file the reworked demo drive still has in the mock server tests 2026-10-26 12:25:31 +01:00
Linus Rath 02e8541571 test: search the reworked demo calendar in the demo search tests 2026-10-26 12:25:31 +01:00
Linus Rath 88b960d605 fix: stop deleting the active account's mail after removing the account whose folder is open 2026-10-26 12:25:08 +01:00
Linus Rath 863aa81d1c fix: stop a synced settings file from passing as an admin session 2026-10-26 11:48:39 +01:00
Linus Rath 30cb676fad fix: write the admin config, password hash and setup token readable only by the app's own user 2026-10-26 11:48:38 +01:00
Linus Rath 3036769645 fix: let the allowed frame ancestors saved in the admin dashboard reach the frame-ancestors header 2026-10-26 11:48:38 +01:00
Linus Rath a4c6d7867a test: expect the plugin sandbox assets among the CORS-enabled static paths 2026-10-26 11:48:38 +01:00
Linus Rath 0f0ebc906b fix: stop trusting the unprefixed sidebar-app frame cookie when COOKIE_SECURE=true (GHSA-cjm9-m826-mh78) 2026-10-26 11:48:38 +01:00
Linus Rath fa3e76652f fix: keep plugin credentials of a bare-name token sign-in under the account it resolved to 2026-10-26 11:36:57 +01:00
Linus Rath 5bd03d175d fix: show all-day events on their own day in the Calendar Agenda for viewers west of the server's time zone 2026-10-26 11:33:38 +01:00
Linus Rath b9fc9bc9c0 fix: stop synced settings from piling up a new file for every extra slash after the server address 2026-10-26 11:33:38 +01:00
Linus Rath 01a1dc47a6 fix: load push notification previews when the webmail reaches the mail server on an internal address 2026-10-26 11:33:37 +01:00
Linus Rath 1fc44b4813 fix: show the push notification for mail in an account shared into another signed-in login 2026-10-26 11:33:37 +01:00
Linus Rath 9ed3354550 fix: send a password and TOTP sign-in to the server the user typed, not the default one 2026-10-26 11:33:37 +01:00
Linus Rath 192d32819c fix: stop a bare login name from claiming an address on another domain 2026-10-26 11:33:37 +01:00
Linus Rath 680742c3ef fix: end a password and TOTP sign-in without remember me with the browser session 2026-10-26 11:33:37 +01:00
Linus Rath ec0fed19cc fix: stop reading a marketplace bundle download once it passes the package size limit 2026-10-26 11:29:37 +01:00
Linus Rath e762943f7b fix: let a plugin move a single message that is not in the open list 2026-10-26 11:29:37 +01:00
Linus Rath 8e66c9f6ad fix: keep plugin approval requests that several users send at once 2026-10-26 11:29:37 +01:00
Linus Rath c4a399f5b8 fix: stop plugin moves from filing another account's messages while its folder is open 2026-10-26 11:29:37 +01:00
Linus Rath 3f2f27321c fix: keep an unquoted cid: image from swallowing the rest of the message 2026-10-26 11:22:10 +01:00
Linus Rath afdd79b29d fix: keep a mail full of bare blockquotes from freezing the reader 2026-10-26 11:22:10 +01:00
Linus Rath 3caa83f1a6 fix: download winmail.dat parts whose type a browser would drop instead of opening them 2026-10-26 11:22:10 +01:00
Linus Rath cf2c27157d Merge branch 'main' into feat/stalwart-1.0
# Conflicts:
#	components/contacts/contacts-app.tsx
#	components/email/__tests__/composer-discard.test.tsx
#	components/email/calendar-invitation-banner.tsx
#	components/email/email-composer.tsx
#	components/mail/mail-app.tsx
#	components/pro/pro-compose-tab-body.tsx
#	components/pro/pro-email-tab-body.tsx
#	components/ui/__tests__/avatar.test.tsx
#	components/ui/avatar.tsx
#	hooks/use-mailbox-drop.ts
#	lib/__tests__/calendar-alerts.test.ts
#	lib/__tests__/jmap-calendar-tasks.test.ts
#	lib/__tests__/jmap-send-threading.test.ts
#	lib/demo/demo-client.ts
#	lib/demo/fixtures/calendars.ts
#	lib/jmap/client-interface.ts
#	lib/jmap/client.ts
#	lib/web-push.ts
#	stores/__tests__/contact-store.test.ts
#	stores/__tests__/email-store-thread-key.test.ts
#	stores/calendar-store.ts
#	stores/contact-store.ts
#	stores/email-store.ts
2026-10-26 10:14:12 +01:00
Max Hao 5430b9e446 fix: honor borderless Outlook-style HTML quotes 2026-10-25 22:22:41 -04:00
Jacob ZeitzandClaude Opus 5.5 fc438c275f feat: open the message a plugin's search result names
An entry of onProvideSearchResults may carry email: { id, accountId? }.
A click on it opens the message in the reader through the login that
reaches the account, as a list row does, and marks the entry while it
is open; any other click stays onAction.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-25 15:22:38 +01:00
Jacob ZeitzandClaude Opus 5.5 d02988f431 feat: show the results plugins provide through onProvideSearchResults
The hook was called on every search, but nothing showed its entries,
the list waited for it, and an entry's onClick could not cross from the
plugin's sandbox. Its entries are now drawn as a block above the
search's message list, a group per plugin and source.

Each plugin is asked on its own (HookBus.collect) beside the search, so
the list no longer waits, and the answer to a search that was replaced
is dropped. The answer is checked: at most 20 entries, a key and a
title, plain text cut to its limits. A click goes to the plugin that
gave the entry as onAction with surface "search-results", the entry's
key and the query; ExternalSearchResult loses onClick.

Closes #1336

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-25 15:22:33 +01:00
Jacob Zeitz 4a130bc1f9 feat: let plugins show a count on their buttons
An action declared with ui.setActions may carry a badge, a whole number
from 0. On buttons it is drawn as the search's filter button draws its
count: the button tinted, the number in a bubble at its corner, "99+"
past two digits. In menus it follows the label, as the mobile header's
notification count does. 0 shows none.
2026-10-25 14:36:01 +01:00
Linus Rath 7845b2caea fix: place calendar events at their clock time on DST change days 2026-10-25 14:17:59 +01:00
Linus Rath f7a4087c91 feat: split the Mountain View inbox into Unread and Everything else, as Gmail's unread first 2026-10-25 13:13:46 +01:00
Linus Rath 5a9c318ec5 fix: keep mails that paint their own page background from flashing white in dark mode 2026-10-25 12:39:28 +01:00
Linus Rath 171fd1ea4c perf: load React DOM and the UI kit only in plugin frames that draw 2026-10-25 02:56:14 +01:00
Linus Rath f20892ccec fix: start plugins when the sign-in races the first plugin start 2026-10-25 02:24:41 +01:00
Linus Rath 5edbbf0816 perf: start plugin slot frames without waiting for the plugin's own frame 2026-10-25 02:24:08 +01:00
Linus Rath e38e326efb perf: load plugin frames as a plain page instead of a Next app
Every plugin iframe loaded /plugin-sandbox, a force-dynamic Next page.
Each frame then fetched, parsed and hydrated Next's client router on top
of React and the runtime, and the server rendered the page once per
frame, one after another when a dozen plugins started together.
Sandboxed frames have opaque origins, so the browser's code cache never
helps, and they run on the host page's main thread: with 12 plugins
the frames took 2.5-3 s to come up after the app had loaded.

The sandbox routes now return a small HTML page with the UI kit's
stylesheet and the runtime as an ES module, both built ahead of time:

- `scripts/build-plugin-sandbox.mjs` bundles the runtime with esbuild
  and compiles `plugin-kit.css` with the app's Tailwind setup into
  `public/plugin-sandbox-assets/`, with a manifest. Named Tabler imports
  are pointed at the icons' own files, so the full icon set stays in a
  chunk that only loads for an icon name the kit doesn't ship.
- `npm run build`, `npm run dev`, the Dockerfile and the perf-guard
  workflow run it before `next build`.
- `lib/plugin-sandbox/sandbox-document.ts` writes the page; proxy.ts
  still sets the sandbox CSP and the script carries its nonce.
- The assets are served from public/ with CORS and immutable caching.

A frame on an idle page is ready in 255 ms instead of 362 ms, eleven at
once in 1.0 s instead of 2.1 s.
2026-10-25 02:01:47 +01:00
Linus Rath 181a0d7d88 perf: send plugin frames only the translations of the current language 2026-10-25 02:26:17 +02:00
Linus Rath 52959e8135 fix: stop plugin panels flashing white in the dark theme 2026-10-25 02:22:59 +02:00
Linus Rath c066d40180 perf: check cached plugin bundles without reading them, and download in parallel 2026-10-25 02:18:18 +02:00