Linus Rath
a2877173a1
fix: drop the admin save bar when a field is put back to its saved value, empty included
2026-10-28 12:52:23 +01:00
Linus Rath
326aac46b8
fix: report an admin branding upload without "successfully"
2026-10-28 10:52:40 +01:00
Linus Rath
1934584eb6
fix: show short, accurate placeholders with a tooltip on the admin branding fields of a domain
2026-10-28 10:26:32 +01:00
Linus Rath
e3fd576543
fix: hide the next heartbeat and consent date in admin usage stats while heartbeats are off
2026-10-28 10:24:34 +01:00
Linus Rath
62ab48aee4
fix: ask "discard changes?" with keep editing and discard in settings editors and the admin pages, as in calendar and contacts
2026-10-28 10:19:10 +01:00
Linus Rath
aa8dfb783b
fix: show the variable, URL and path in the setup wizard texts as code
2026-10-28 06:20:40 +01:00
Linus Rath
a06c1531a5
feat: show the setup wizard in the browser's language, translated into all 29 languages
2026-10-28 05:49:37 +01:00
Linus Rath
6dbaa0fd30
Merge branch 'main' into ux/settings-admin
2026-10-28 04:50:27 +01:00
Linus Rath
5335c409a7
fix: translate the page a connector link lands on when it can't be opened
2026-10-28 04:37:46 +01:00
Linus Rath
c9975eef3f
fix: report admin results in the app's toasts instead of a banner under the page header
2026-10-28 04:05:51 +01:00
Linus Rath
51b678dc19
fix: let every admin switch on a page with a save bar wait for Save, plugins, themes and telemetry included
2026-10-28 03:59:44 +01:00
Linus Rath
5d013f7669
fix: give Calendar, Contacts, Files and Settings their own error boundary and show one error fallback with Try again everywhere
2026-10-28 03:56:04 +01:00
Linus Rath
f4cade224c
fix: ask in the app's own dialogs instead of browser confirm boxes in the admin panel
2026-10-28 03:54:36 +01:00
Linus Rath
9ee767f576
fix: show a translated 404 to a signed-in user who mistypes a URL instead of the login page
2026-10-28 03:52:40 +01:00
Linus Rath
5ab27a996d
fix: ask before browser Back or the back gesture leaves an admin page with unsaved changes
2026-10-28 03:50:06 +01:00
Linus Rath
b5dcb04c53
fix: mirror the login page's theme button and password toggle, and the rail badges, in right-to-left languages
2026-10-28 03:36:01 +01:00
Linus Rath
57c283e730
fix: translate the login page's subtitle, theme menu and version details, and open the version details from the keyboard
2026-10-28 03:35:12 +01:00
Linus Rath
fd3e66e64b
fix: ask for a fresh 2FA code in every app, not only in Mail, and translate the prompt
2026-10-28 03:27:03 +01:00
Linus Rath
295c0d6c49
fix: show menus and dialogs at once with reduced motion on, so they take focus
2026-10-28 02:31:58 +01:00
Linus Rath
a4d8192f9c
fix: point the reply and forward arrows the right way in right-to-left languages
2026-10-28 01:49:22 +01:00
Linus Rath
03304a3cdc
fix: show toasts above the phone's bottom bars, newest at the bottom, and let a swipe dismiss them
2026-10-28 01:48:36 +01:00
Linus Rath
cbea8755d6
fix: let border colours from the theme utilities show in the standard theme
2026-10-28 01:26:19 +01:00
Linus Rath
d610312483
fix: update the open calendar and show reminders on time when events change elsewhere #1349
2026-10-26 20:35:52 +01:00
Linus Rath
67982b19bf
fix: register the webmail as a first-party OAuth client on Stalwart 1.0 so SSO users keep full access
2026-10-26 20:25:43 +01:00
Linus Rath
004f0948d5
fix: ask Stalwart 1.0 for mail, contacts, calendar and file access when signing in with SSO
2026-10-26 20:25:42 +01:00
Linus Rath
8860dde005
fix: sign in with password and TOTP on Stalwart 1.0
2026-10-26 20:25:42 +01:00
Linus Rath
4bfaf8abce
Merge pull request #1363 from lucamzanon/feat/account-archive-restore-prompt
2026-10-26 19:26:13 +01:00
Linus Rath
8a3351bbc9
fix: refuse an oversized plugin approval upload before reading it
2026-10-26 15:15:58 +01:00
Linus Rath
42117da498
fix: stop replaying a stored credential the mail server refused, so a stale session cannot get the webmail banned (GHSA-g6c7-r7wq-xrm2)
2026-10-26 15:00:56 +01:00
Linus Rath
ae897b42a4
fix: make the impersonation handoff really clear the previous account list and ignore ?impersonated=1 links from elsewhere
2026-10-26 14:58:31 +01:00
Linus Rath
eb2787bcc9
fix: end admin sessions on sign-out and when the admin password changes
2026-10-26 14:52:04 +01:00
Linus Rath
121d2d5e31
fix: stop buffering up to 100 MB of every unauthenticated request body before routing
2026-10-26 14:52:04 +01:00
Linus Rath
08969fde67
fix: stop reading a mail server's answer past a size limit in the JMAP, WebDAV, push preview and agenda routes
2026-10-26 14:52:04 +01:00
Linus Rath
07e6ecce1a
fix: show a plain new-mail notification instead of another login's message when two signed-in logins have the same account id
2026-10-26 14:52:04 +01:00
Linus Rath
885ecdaa07
fix: keep the server's path prefix in the CalDAV addresses shown in calendar settings
2026-10-26 14:52:04 +01:00
lucamzanon
2f8c6e13bf
feat: offer to restore the saved account list on a new device
...
Part 3 of 3 of the account archive (#1198 ). Signing in on a browser that
knows no other account, with a list saved for that account, opens a dialog
asking for the backup password and restores the list as Settings does.
Not now hides the offer for that account in this browser; the restore
stays in Settings.
2026-10-26 12:23:18 +01:00
Linus Rath
e6c911899c
fix: refuse a session secret under 32 characters in the setup wizard, which broke admin sign-in afterwards
2026-10-26 11:48:39 +01:00
Linus Rath
fa3e76652f
fix: keep plugin credentials of a bare-name token sign-in under the account it resolved to
2026-10-26 11:36:57 +01:00
Linus Rath
5bd03d175d
fix: show all-day events on their own day in the Calendar Agenda for viewers west of the server's time zone
2026-10-26 11:33:38 +01:00
Linus Rath
b9fc9bc9c0
fix: stop synced settings from piling up a new file for every extra slash after the server address
2026-10-26 11:33:38 +01:00
Linus Rath
01a1dc47a6
fix: load push notification previews when the webmail reaches the mail server on an internal address
2026-10-26 11:33:37 +01:00
Linus Rath
1fc44b4813
fix: show the push notification for mail in an account shared into another signed-in login
2026-10-26 11:33:37 +01:00
Linus Rath
9ed3354550
fix: send a password and TOTP sign-in to the server the user typed, not the default one
2026-10-26 11:33:37 +01:00
Linus Rath
680742c3ef
fix: end a password and TOTP sign-in without remember me with the browser session
2026-10-26 11:33:37 +01:00
Linus Rath
ec0fed19cc
fix: stop reading a marketplace bundle download once it passes the package size limit
2026-10-26 11:29:37 +01:00
Linus Rath
cb51847ab3
fix: refuse plugin approval requests while user plugins or their review are turned off (GHSA-qc44-275p-gqw9)
2026-10-26 11:29:36 +01:00
Linus Rath
cf2c27157d
Merge branch 'main' into feat/stalwart-1.0
...
# Conflicts:
# components/contacts/contacts-app.tsx
# components/email/__tests__/composer-discard.test.tsx
# components/email/calendar-invitation-banner.tsx
# components/email/email-composer.tsx
# components/mail/mail-app.tsx
# components/pro/pro-compose-tab-body.tsx
# components/pro/pro-email-tab-body.tsx
# components/ui/__tests__/avatar.test.tsx
# components/ui/avatar.tsx
# hooks/use-mailbox-drop.ts
# lib/__tests__/calendar-alerts.test.ts
# lib/__tests__/jmap-calendar-tasks.test.ts
# lib/__tests__/jmap-send-threading.test.ts
# lib/demo/demo-client.ts
# lib/demo/fixtures/calendars.ts
# lib/jmap/client-interface.ts
# lib/jmap/client.ts
# lib/web-push.ts
# stores/__tests__/contact-store.test.ts
# stores/__tests__/email-store-thread-key.test.ts
# stores/calendar-store.ts
# stores/contact-store.ts
# stores/email-store.ts
2026-10-26 10:14:12 +01:00
Linus Rath
e38e326efb
perf: load plugin frames as a plain page instead of a Next app
...
Every plugin iframe loaded /plugin-sandbox, a force-dynamic Next page.
Each frame then fetched, parsed and hydrated Next's client router on top
of React and the runtime, and the server rendered the page once per
frame, one after another when a dozen plugins started together.
Sandboxed frames have opaque origins, so the browser's code cache never
helps, and they run on the host page's main thread: with 12 plugins
the frames took 2.5-3 s to come up after the app had loaded.
The sandbox routes now return a small HTML page with the UI kit's
stylesheet and the runtime as an ES module, both built ahead of time:
- `scripts/build-plugin-sandbox.mjs` bundles the runtime with esbuild
and compiles `plugin-kit.css` with the app's Tailwind setup into
`public/plugin-sandbox-assets/`, with a manifest. Named Tabler imports
are pointed at the icons' own files, so the full icon set stays in a
chunk that only loads for an icon name the kit doesn't ship.
- `npm run build`, `npm run dev`, the Dockerfile and the perf-guard
workflow run it before `next build`.
- `lib/plugin-sandbox/sandbox-document.ts` writes the page; proxy.ts
still sets the sandbox CSP and the script carries its nonce.
- The assets are served from public/ with CORS and immutable caching.
A frame on an idle page is ready in 255 ms instead of 362 ms, eleven at
once in 1.0 s instead of 2.1 s.
2026-10-25 02:01:47 +01:00
Jacob Zeitz and Claude Opus 5.5
96526c1b41
feat: admin policy gate to list the Tags above the shared mailboxes
...
A new feature gate, tagsAboveSharedEnabled (default off, so the sidebar
keeps its order), lists the Tags section above the shared mailboxes
instead of below them. With many shared mailboxes expanded, the tags
otherwise end up out of sight. In Mountain View the tags then follow the
Labels list directly, also when More is open.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-24 08:54:23 +02:00
Linus Rath
310f910a6a
fix: hand a mobile sign-in to the app when the browser was already signed in
2026-10-22 08:02:08 +02:00
Linus Rath
lucamzanon
Jacob ZeitzandClaude Opus 5.5