starred/webmail
1
0
Fork 0
mirror of https://github.com/bulwarkmail/webmail.git synced 2026-10-31 00:12:39 +00:00
Code Issues Packages Projects Releases Wiki Activity
1,802 Commits 5 Branches 62 Tags
e055ee8201c3ae548a8750dd3f746237d99a72f3
Commit Graph
1802 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Linus Rath e055ee8201 fix: verify credentials upstream before minting identity cookies (GHSA-wxcm-j4jc-9fxq) 2026-09-17 20:48:42 +02:00
Linus Rath d5c0996519 fix: bind the plugin sandbox to its framing window (GHSA-96cx-gx36-3g79) 2026-09-17 20:31:39 +02:00
Linus Rath b7f53a3a8b fix: bind a purpose into encrypted payloads (GHSA-cqqx-mjcf-mh55) 2026-09-17 20:16:51 +02:00
Linus Rath c6c94239ba Merge branch 'main' of https://github.com/bulwarkmail/webmail 2026-09-17 20:02:37 +02:00
Linus Rath e908aee994 fix: reject cross-site requests to /api/auth/* to stop session fixation (GHSA-qvr9-m8cq-7wvg) 2026-09-17 20:01:35 +02:00
Linus Rath 2df64024bd Merge pull request #1031 from GyroGearl00se/i18n/german_translation 
i18n: Update German translation
 2026-09-14 19:44:22 +02:00
GyroGearl00se ffebd0bcd5 i18n: Update German translation 2026-09-14 12:39:57 +02:00
Linus Rath b526eb1405 Merge pull request #1017 from ctaoist/fix/label-view-refresh 
fix: preserve label filtering during mailbox refreshes
 2026-09-12 17:30:02 +02:00
Ctaoist fc812c9b23 fix: preserve label filtering during mailbox refreshes 2026-09-12 09:40:44 +08:00
Linus Rath 73c7002a5b Merge pull request #1016 from dulinux/i18n/forward_as_attachment 
i18n: Updates translations for “Forward as attachment” in various languages
 2026-09-12 00:44:52 +02:00
Luis Felipe Marzagao d241170f83 i18n: Updates translations for “Forward as attachment” in various language files 2026-09-11 18:10:34 -03:00
Linus Rath d6c923f20e Merge pull request #947 from shukiv/feat/list-attachment-chips 
feat(list): show attachments on list rows and open them from there
 2026-09-11 17:05:08 +02:00
Linus Rath 79a1687536 Merge pull request #927 from hildebrandttk/docs/clarify-unified-mailbox-empty-section 
docs: clarify why the Unified Mailbox section can look empty (#843)
 2026-09-11 12:02:09 +02:00
Linus Rath 51b2198f3f Merge pull request #1003 from lucamzanon/fix/navigation-protocol-account-limit 
fix: detect HTTP/2 from the initial navigation timing so accounts aren't capped at five
 2026-09-11 11:59:43 +02:00
Linus Rath 60b3d86004 Merge pull request #1005 from dealerweb/fix/hide-body-referenced-cid-parts 
fix: hide body-embedded cid parts declared as octet-stream from the attachment list
 2026-09-11 11:59:32 +02:00
Linus Rath 0b704f61e0 Merge pull request #1008 from Almost-Senseless-Coder/fix/list-label-accessibility 
fix(a11y): Improved accessibility of the email list
 2026-09-11 11:59:14 +02:00
dealerweb 1c00812ab7 fix: hide body-embedded cid parts declared as octet-stream from the attachment list 
Some senders ship the images their HTML body embeds via cid: as
application/octet-stream with no Content-Disposition and no filename.
The body rendered them fine, but the "hide inline images" check only
recognised parts declared inline with an image/* type, so they also
showed up as nameless "Attachment" chips next to the real files.

Both viewers now scan the HTML they actually render for cid: references
(the same pattern the renderer rewrites to blob URLs) and hide a
referenced part when it is an image or generically typed. An explicit
attachment disposition always keeps its chip, as does a referenced part
with a real non-image type, since that chip is its only download. Plain
text rendering references nothing, so nothing is hidden there. The
shared rule lives in lib/attachment-visibility.ts so the desktop viewer,
the thread view and the decrypted-message path cannot drift apart.
 2026-09-10 10:45:45 +02:00
lucamzanon 335347a56f fix: detect HTTP/2 from the initial navigation timing so accounts aren't capped at five 
isHttp2Available() only inspected "resource" timing entries, which can be
empty right after a fresh login or session restore, before any subresource
finishes loading. On an HTTP/2 page this made getMaxAccounts() fall back to
the HTTP/1.1 cap of five accounts. Include the "navigation" timing entry,
whose nextHopProtocol is known immediately, so h2/h3 is recognized on first
load. Environments without timing data still return false (no h2 assumed).
 2026-09-10 10:14:25 +02:00
Linus Rath fb24ef5d24 feat: sort contacts by last name #963 2026-09-09 19:47:33 +02:00
Almost-Senseless-Coder 4947c6c7a4 Improved accessibility of the email list 2026-09-09 19:37:43 +02:00
Linus Rath 565d5c1095 feat: choose exact-address or same-domain matching for reply from received address #1000 2026-09-09 19:27:08 +02:00
Linus Rath c395226926 fix: reject wrong passwords server-side so the browser never shows its Basic Auth dialog #969 2026-09-09 19:21:40 +02:00
Linus Rath b91b438076 test: keep stray fetches and timers from leaking across resilience tests 2026-09-09 18:56:51 +02:00
Linus Rath 9796b0b14d fix: index newer settings and flat calendar toggles in the settings search 2026-09-09 18:40:15 +02:00
Linus Rath 8d8ef7e2f1 fix: unreadable native <select> option lists in dark themes #999 
The browser paints a native <select>'s option list itself, so the
bg-muted / text-foreground classes on the control never reach it. Themes
whose --color-muted is translucent (Aurora Glass dark uses
rgba(255,255,255,0.05)) composited to a light popup with near-white
text, leaving every unselected option almost invisible.

Pin option background/colour to the popover tokens, which every built-in
theme defines as an opaque surface, and set color-scheme: dark on
selects under .dark so Safari (which ignores option colours) renders a
dark popup too. Fixes all ~40 native selects at once.

Adds a stylesheet test that locks the rules and asserts every built-in
theme's --color-popover stays opaque in each variant.
 2026-09-09 18:30:59 +02:00
Linus Rath ae403b06af feat: setting to turn off free scrolling in the calendar 2026-09-09 18:27:01 +02:00
Linus Rath 15a5497a12 feat: freely scrolling month, week and day views #759 2026-09-09 16:38:55 +02:00
Linus Rath 60e05c0041 feat: infinite scroll for the calendar agenda view 2026-09-09 15:19:53 +02:00
Linus Rath 4a057b2348 Merge pull request #990 from rotterp/fix/pro-compose-from-account 
fix(pro): default the compose tab's From to the open mailbox
 2026-09-07 22:39:04 +02:00
Linus Rath 26358c7a63 Merge pull request #991 from rotterp/fix/shared-mailbox-send-identity 
fix(composer): send from the address a message was delivered to
 2026-09-07 22:38:51 +02:00
Linus Rath 049a1a1292 Merge pull request #663 from shukiv/fix/read-view-auto-direction 
fix(rtl): auto-detect text direction in read, print and plain-text views
 2026-09-07 22:36:25 +02:00
Linus Rath d4d3f317a5 fix: stop retrying token refreshes that fail permanently #972 2026-09-07 22:34:47 +02:00
Linus Rath f349500546 fix: preserve task alarms that the edit dialog does not show #504 2026-09-07 22:34:47 +02:00
Linus Rath 80dadfbbd4 fix: open search hits from shared folders in the right account #923 2026-09-07 22:34:47 +02:00
Linus Rath 8477acf217 fix: keep the mobile actions panel below the status bar #936 2026-09-07 22:34:47 +02:00
Linus Rath d28d8dcd86 fix: report calendar clear failures instead of counting zero #434 2026-09-07 22:34:47 +02:00
Linus Rath f3f0127c9d fix: only show the unified mailbox section when it can be populated #843 2026-09-07 22:34:47 +02:00
Linus Rath 07bbde4786 fix: make the iCal subscription size limit configurable and show the real error #692 2026-09-07 22:34:47 +02:00
Linus Rath 8e4296ae5b fix: add the missing scheduled folder role label #495 2026-09-07 22:34:47 +02:00
Linus Rath fb77adafc6 fix: use Simplified Chinese for the selected-messages label #786 2026-09-07 22:34:47 +02:00
Linus Rath 12416d9c47 fix: wire the x shortcut to thread expansion #683 2026-09-07 22:34:47 +02:00
Linus Rath f4d2fd950c fix: sort folders in the role assignment dropdown #984 2026-09-07 22:34:47 +02:00
Linus Rath c633ce1ff4 fix: keep the reading-mode toggle mounted so toolbar buttons stop jumping #964 2026-09-07 22:34:47 +02:00
Linus Rath ab4bf91b20 fix: let sender tables keep their own max-width #790 2026-09-07 22:34:47 +02:00
Linus Rath 928e2e3794 feat: add a server-side switch for the Stalwart JMAP passthrough #904 2026-09-07 22:34:47 +02:00
Linus Rath e98109b80d fix: require a session for the translate API #903 2026-09-07 22:34:47 +02:00
Linus Rath afd8b64813 feat: run the test suite in CI #647 2026-09-07 22:34:47 +02:00
Linus Rath 21cc086c2e fix: add missing zh-TW managed sidebar-app keys #647 2026-09-07 22:34:47 +02:00
Linus Rath b85ba9603d fix: upload composer attachments through the composing identity's account #943 2026-09-07 22:34:47 +02:00
Linus Rath 0efde2e61d fix: set the answered flag when the reply is sent with a delay #985 2026-09-07 22:34:47 +02:00