Linus Rath
a191ef8b02
feat: let plugins search mail with api.email.search
2026-10-20 18:16:29 +02:00
Linus Rath
ad3e529b8e
feat: tell reader plugin frames whether they are on a phone, a tablet or a desktop
2026-10-20 17:21:13 +02:00
Linus Rath
95003fd28b
feat: let a plugin panel start folded until the user or the plugin opens it
2026-10-20 17:21:13 +02:00
Linus Rath
95bfb1681c
feat: let a plugin's panel frame fill the panel and scroll inside
2026-10-20 17:21:13 +02:00
Linus Rath
2bb5a62ac4
feat: let a plugin open, close and toggle the panel its slot sits in
2026-10-20 17:21:13 +02:00
Linus Rath
8deb887e95
feat: let plugins see and act on text selected in a message, with a right-click menu and the side panel's selection
2026-10-20 17:21:12 +02:00
Linus Rath
00142540f6
feat: let plugins add entries to the right-click menu on selected text in the composer
2026-10-20 17:21:12 +02:00
Linus Rath
a2136319fb
feat: hand composer plugin panels the composer id, the draft and the selected text
2026-10-20 17:21:12 +02:00
Linus Rath
10b4d2a9db
feat: rework the admin panel around a settings-style sidebar and one URL per page
...
The old panel kept its active tab in a store, so every page sat at
/admin, the sidebar duplicated the webmail rail by hand, and each page
was a stack of boxed cards with their own save buttons. Plugin settings
were only reachable through a gear icon in a row of five.
- one catch-all route for the whole panel; pages switch through
history.pushState, so `/admin/plugins/<id>`, the back button, bookmarks
and connector links all work without a route transition
- sidebar laid out like the user settings: back to mail, search over
pages and their sections, two group headings, change password and
sign out at the bottom; the phone shows a list, then the page
- pages use SettingsSection rows instead of nested cards, with one page
header, one flash message and one save bar at the bottom (Discard,
Save, Ctrl+S); the unsaved-changes prompt still guards leaving
- plugins and themes are lists of rows with a toggle each; a row opens
the extension's own page with its settings, force-on, permissions,
kept versions and removal
- overview shows stat tiles, server facts and recent activity
- old `/admin?tab=x` links redirect; the tab store is gone and the
connector registry resolves admin links to the page URL
- `NEXT_TURBOPACK_ROOT` overrides the Turbopack root so `next dev` runs
from a worktree with a junctioned node_modules
2026-10-20 15:16:05 +02:00
Linus Rath
6a59faf127
feat: add numeric date, day, month and year template placeholders #1284
2026-10-19 18:41:44 +02:00
Linus Rath
b5964ac544
fix: find the invited attendee under any sending identity when answering an invite #1283
2026-10-19 18:41:05 +02:00
Linus Rath
6b0c345cf7
fix: keep push notifications silent when the notification sound is off #1289
2026-10-19 18:40:06 +02:00
Linus Rath
401d49471e
feat: let settings links name a section and add a jump row to each page
2026-10-19 18:14:01 +02:00
Linus Rath
dc521e11ca
refactor: combine sidebar apps and plugins into add-ons, about and debug into backup and reset
2026-10-19 18:03:42 +02:00
Linus Rath
0b3bd26c9c
refactor: fold download naming into reading as an advanced section
2026-10-19 17:59:30 +02:00
Linus Rath
f8aca5bb25
refactor: put folders and tags on one page
2026-10-19 17:57:38 +02:00
Linus Rath
c57f82f0a7
refactor: group composing into sections and fold templates and a signatures link into it
2026-10-19 17:55:12 +02:00
Linus Rath
a591ae0683
refactor: merge language, default apps and the tour into a general page
2026-10-19 17:51:26 +02:00
Linus Rath
58f968a48c
refactor: lead notifications with new mail, move the tab badge in and invitation parsing to calendar
2026-10-19 17:48:57 +02:00
Linus Rath
d86aa1d12b
refactor: group security into sign-in, other apps and devices, and encryption
2026-10-19 17:46:42 +02:00
Linus Rath
b1fa88841d
refactor: move identities, sub-addressing and multi-account options onto the account page
2026-10-19 17:44:11 +02:00
Linus Rath
5b1d056eef
feat: split the message list out of reading and fold content and senders into it
2026-10-19 17:40:52 +02:00
Linus Rath
1025c1973d
refactor: fold the layout and themes tabs into appearance as sections
2026-10-19 17:33:39 +02:00
Linus Rath
391ed6c018
Merge branch 'fix/security-audit-2026-10'
2026-10-19 12:58:50 +02:00
Linus Rath
7e1e2aabf8
test: use a sidecar path instead of the now-denied translate route in the plugin POST test
2026-10-19 01:44:29 +02:00
Linus Rath
29b33eb46c
fix: show attachment names without directional override characters
2026-10-19 01:32:30 +02:00
Linus Rath
546f34f47e
fix: cap concurrent upstream favicon fetches
2026-10-19 01:32:29 +02:00
Linus Rath
d13aada077
fix: bound how many CalDAV probes one discovery request can make
2026-10-19 01:32:29 +02:00
Linus Rath
f35ed6fb02
fix: give every upstream mail server request a deadline
2026-10-19 01:32:28 +02:00
Linus Rath
1f11cc7249
fix: stop talking to a plugin frame once it has navigated to another document
2026-10-19 01:32:27 +02:00
Linus Rath
1fd5d0558c
fix: send HSTS on TLS requests and drop the X-Powered-By header
2026-10-19 01:32:27 +02:00
Linus Rath
703a15663f
fix: keep the extension directory URL off private addresses
2026-10-19 01:32:25 +02:00
Linus Rath
735b37b812
fix: refuse an extension directory keyring older than the newest one seen
2026-10-19 01:32:25 +02:00
Linus Rath
71036c1812
fix: validate the marketplace version and refuse a silent downgrade on update
2026-10-19 01:32:24 +02:00
Linus Rath
e4a9027b30
fix: stop OAuth discovery from reading a well-known document off another host
2026-10-19 01:32:24 +02:00
Linus Rath
5632097971
fix: type the capped feed reader and the invitation sender lookup
2026-10-19 01:32:23 +02:00
Linus Rath
0b01a2d066
fix: ask before handing a sign-in to the mobile app and only to its own callback link
2026-10-19 01:22:19 +02:00
Linus Rath
0f1fc2bb5d
fix: sanitise imported and synced HTML templates before the composer previews them
2026-10-19 01:15:39 +02:00
Linus Rath
8ed621914e
fix: only count an SPF or DKIM pass aligned with the From domain as sender verification
2026-10-19 01:15:05 +02:00
Linus Rath
044c98e6d2
fix: cap the size of a synced settings blob
2026-10-19 01:15:04 +02:00
Linus Rath
c0b6519136
fix: stop reading a calendar feed at the size cap instead of buffering it whole
2026-10-19 01:15:04 +02:00
Linus Rath
9e64d9a026
fix: drop remote images from plugin-authored HTML so a plugin cannot beacon past its allowed origins
2026-10-19 01:15:04 +02:00
Linus Rath
e6064f3476
fix: only connect and proxy plugin credentials that a plugin known to the server declares
2026-10-19 01:07:50 +02:00
Linus Rath
685ce7f469
fix: keep plugin POSTs off the plugin proxy, secrets, agenda, ical and translate routes
2026-10-19 01:04:45 +02:00
Linus Rath
c02aadd6a9
fix: preview HTML attachments as sanitised text in a locked frame instead of a same-origin blob document
2026-10-19 00:58:31 +02:00
Linus Rath
29cb6b7f61
fix: keep a crafted style attribute or read-receipt header from freezing the message view
2026-10-19 00:54:24 +02:00
Linus Rath
f8eee3b12d
fix: keep a crafted mail body or subject from stalling the reader in the verification code search
2026-10-19 00:54:24 +02:00
Linus Rath
31326c7daf
fix: keep OAuth client secrets and the session secret out of the admin audit log, config API and dashboard writes
2026-10-19 00:50:16 +02:00
Linus Rath
f91b214719
fix: key synced settings on the account a token login resolves to, not on a bare claimed name
2026-10-19 00:45:11 +02:00
Linus Rath
89ef4d14f2
fix: budget failed sign-ins per client and forward the client address to the mail server
2026-10-19 00:43:00 +02:00
Linus Rath