webmail

starred/webmail

Fork 0

mirror of https://github.com/bulwarkmail/webmail.git synced 2026-11-02 08:15:55 +00:00

Commit Graph

Author	SHA1	Message	Date
Linus Rath	2522dbd804	fix: keep the plugin denylist and unit tests from breaking Lite and Docker builds	2026-09-26 21:38:57 +02:00
Linus Rath	6d2255ad0d	fix: keep plugin http.post away from credentialed and admin routes `http.post` attaches the user's Authorization header to any same-origin path the plugin's own manifest lists in `apiPostPaths`. A plugin with only `http:post` could list the JMAP passthrough and get full JMAP access, or reach `/api/admin/*`, `/api/settings` and the other credentialed routes. The host now refuses those paths whatever the manifest says, checked on the decoded path the router sees. Plugins keep reaching their own sidecar routes.	2026-09-26 15:01:42 +02:00

Author

SHA1

Message

Date

Linus Rath

2522dbd804

fix: keep the plugin denylist and unit tests from breaking Lite and Docker builds

2026-09-26 21:38:57 +02:00

Linus Rath

6d2255ad0d

fix: keep plugin http.post away from credentialed and admin routes

`http.post` attaches the user's Authorization header to any same-origin
path the plugin's own manifest lists in `apiPostPaths`. A plugin with
only `http:post` could list the JMAP passthrough and get full JMAP
access, or reach `/api/admin/*`, `/api/settings` and the other
credentialed routes. The host now refuses those paths whatever the
manifest says, checked on the decoded path the router sees. Plugins
keep reaching their own sidecar routes.

2026-09-26 15:01:42 +02:00