 Linus Rath
|
50b3ddccec
|
feat: let admins keep the refresh token valid on sign-out so Stalwart keeps the consent #1388
|
2026-10-29 20:47:18 +01:00 |
|
|
Linus Rath
|
0b4e501142
|
feat: make the login email placeholder configurable #1423
|
2026-10-29 20:24:26 +01:00 |
|
|
Linus Rath
|
d875714f35
|
feat: offer remember me on the sso-only login and apply it to every sso path #1437
|
2026-10-29 20:06:44 +01:00 |
|
|
Linus Rath
|
623c9e1792
|
feat: let operators set accessibility statement, barrier report, help, Easy Read and sign language links
|
2026-10-29 18:27:35 +01:00 |
|
|
Linus Rath
|
f12a13e1fd
|
feat: create documents in the formats the document editor can edit from New file #1393
|
2026-10-29 00:01:13 +01:00 |
|
|
Linus Rath
|
d10d6b60ce
|
fix: tell admins the OAuth setup needs a webmail sign-in and disable it until there is one
|
2026-10-28 17:40:26 +01:00 |
|
|
Linus Rath
|
9e809a31db
|
Merge branch 'feat/org-features' into feat/org-thirdparty
|
2026-10-28 05:27:58 +01:00 |
|
|
Linus Rath
|
1a747ac9dd
|
feat: limit the page's CSP to the configured hosts with no third-party traffic #903
|
2026-10-28 04:30:41 +01:00 |
|
|
Linus Rath
|
031d94635c
|
refactor: keep the outgoing host descriptions out of the browser bundle and scan every URL form #903
|
2026-10-28 04:30:23 +01:00 |
|
|
Linus Rath
|
defe4e93f3
|
fix: bind the sign-in time to the refresh token and count unstamped sessions from a fixed time
|
2026-10-28 03:42:19 +01:00 |
|
|
Linus Rath
|
cefb20db4e
|
test: give the plugin proxy route test the config reader the mode needs #903
|
2026-10-28 03:10:14 +01:00 |
|
|
Linus Rath
|
6e5d8faec6
|
feat: refuse to restore or renew sessions older than the admin-set maximum length
|
2026-10-28 02:30:32 +01:00 |
|
|
Linus Rath
|
92c9110f3c
|
feat: show the third-party traffic switch and what stays reachable in Organisation > Security #903
|
2026-10-28 02:24:13 +01:00 |
|
|
Linus Rath
|
553f1e9149
|
feat: add a switch that stops all third-party traffic #903
|
2026-10-28 02:19:06 +01:00 |
|
|
Linus Rath
|
084cf3cf3a
|
fix: fetch the policy again only for an account of a domain it doesn't cover
|
2026-10-28 01:08:56 +01:00 |
|
|
Linus Rath
|
4004b9be7c
|
feat: let admins export and import the whole user policy as one file
|
2026-10-28 00:44:31 +01:00 |
|
|
Linus Rath
|
4b69f1307f
|
feat: let admins scope the user policy per domain or group
|
2026-10-28 00:29:02 +01:00 |
|
|
Linus Rath
|
67982b19bf
|
fix: register the webmail as a first-party OAuth client on Stalwart 1.0 so SSO users keep full access
|
2026-10-26 20:25:43 +01:00 |
|
|
Linus Rath
|
004f0948d5
|
fix: ask Stalwart 1.0 for mail, contacts, calendar and file access when signing in with SSO
|
2026-10-26 20:25:42 +01:00 |
|
|
Linus Rath
|
8860dde005
|
fix: sign in with password and TOTP on Stalwart 1.0
|
2026-10-26 20:25:42 +01:00 |
|
|
Linus Rath
|
8a3351bbc9
|
fix: refuse an oversized plugin approval upload before reading it
|
2026-10-26 15:15:58 +01:00 |
|
|
Linus Rath
|
42117da498
|
fix: stop replaying a stored credential the mail server refused, so a stale session cannot get the webmail banned (GHSA-g6c7-r7wq-xrm2)
|
2026-10-26 15:00:56 +01:00 |
|
|
Linus Rath
|
ae897b42a4
|
fix: make the impersonation handoff really clear the previous account list and ignore ?impersonated=1 links from elsewhere
|
2026-10-26 14:58:31 +01:00 |
|
|
Linus Rath
|
eb2787bcc9
|
fix: end admin sessions on sign-out and when the admin password changes
|
2026-10-26 14:52:04 +01:00 |
|
|
Linus Rath
|
121d2d5e31
|
fix: stop buffering up to 100 MB of every unauthenticated request body before routing
|
2026-10-26 14:52:04 +01:00 |
|
|
Linus Rath
|
08969fde67
|
fix: stop reading a mail server's answer past a size limit in the JMAP, WebDAV, push preview and agenda routes
|
2026-10-26 14:52:04 +01:00 |
|
|
Linus Rath
|
07e6ecce1a
|
fix: show a plain new-mail notification instead of another login's message when two signed-in logins have the same account id
|
2026-10-26 14:52:04 +01:00 |
|
|
Linus Rath
|
885ecdaa07
|
fix: keep the server's path prefix in the CalDAV addresses shown in calendar settings
|
2026-10-26 14:52:04 +01:00 |
|
|
Linus Rath
|
e6c911899c
|
fix: refuse a session secret under 32 characters in the setup wizard, which broke admin sign-in afterwards
|
2026-10-26 11:48:39 +01:00 |
|
|
Linus Rath
|
fa3e76652f
|
fix: keep plugin credentials of a bare-name token sign-in under the account it resolved to
|
2026-10-26 11:36:57 +01:00 |
|
|
Linus Rath
|
5bd03d175d
|
fix: show all-day events on their own day in the Calendar Agenda for viewers west of the server's time zone
|
2026-10-26 11:33:38 +01:00 |
|
|
Linus Rath
|
b9fc9bc9c0
|
fix: stop synced settings from piling up a new file for every extra slash after the server address
|
2026-10-26 11:33:38 +01:00 |
|
|
Linus Rath
|
01a1dc47a6
|
fix: load push notification previews when the webmail reaches the mail server on an internal address
|
2026-10-26 11:33:37 +01:00 |
|
|
Linus Rath
|
1fc44b4813
|
fix: show the push notification for mail in an account shared into another signed-in login
|
2026-10-26 11:33:37 +01:00 |
|
|
Linus Rath
|
9ed3354550
|
fix: send a password and TOTP sign-in to the server the user typed, not the default one
|
2026-10-26 11:33:37 +01:00 |
|
|
Linus Rath
|
680742c3ef
|
fix: end a password and TOTP sign-in without remember me with the browser session
|
2026-10-26 11:33:37 +01:00 |
|
|
Linus Rath
|
ec0fed19cc
|
fix: stop reading a marketplace bundle download once it passes the package size limit
|
2026-10-26 11:29:37 +01:00 |
|
|
Linus Rath
|
cb51847ab3
|
fix: refuse plugin approval requests while user plugins or their review are turned off (GHSA-qc44-275p-gqw9)
|
2026-10-26 11:29:36 +01:00 |
|
|
Linus Rath
|
cf2c27157d
|
Merge branch 'main' into feat/stalwart-1.0
# Conflicts:
# components/contacts/contacts-app.tsx
# components/email/__tests__/composer-discard.test.tsx
# components/email/calendar-invitation-banner.tsx
# components/email/email-composer.tsx
# components/mail/mail-app.tsx
# components/pro/pro-compose-tab-body.tsx
# components/pro/pro-email-tab-body.tsx
# components/ui/__tests__/avatar.test.tsx
# components/ui/avatar.tsx
# hooks/use-mailbox-drop.ts
# lib/__tests__/calendar-alerts.test.ts
# lib/__tests__/jmap-calendar-tasks.test.ts
# lib/__tests__/jmap-send-threading.test.ts
# lib/demo/demo-client.ts
# lib/demo/fixtures/calendars.ts
# lib/jmap/client-interface.ts
# lib/jmap/client.ts
# lib/web-push.ts
# stores/__tests__/contact-store.test.ts
# stores/__tests__/email-store-thread-key.test.ts
# stores/calendar-store.ts
# stores/contact-store.ts
# stores/email-store.ts
|
2026-10-26 10:14:12 +01:00 |
|
|
Linus Rath
|
391ed6c018
|
Merge branch 'fix/security-audit-2026-10'
|
2026-10-19 12:58:50 +02:00 |
|
|
Linus Rath
|
9f3441c783
|
fix: accept both fetch response types in the capped feed reader
|
2026-10-19 01:36:16 +02:00 |
|
|
Linus Rath
|
546f34f47e
|
fix: cap concurrent upstream favicon fetches
|
2026-10-19 01:32:29 +02:00 |
|
|
Linus Rath
|
d13aada077
|
fix: bound how many CalDAV probes one discovery request can make
|
2026-10-19 01:32:29 +02:00 |
|
|
Linus Rath
|
703a15663f
|
fix: keep the extension directory URL off private addresses
|
2026-10-19 01:32:25 +02:00 |
|
|
Linus Rath
|
71036c1812
|
fix: validate the marketplace version and refuse a silent downgrade on update
|
2026-10-19 01:32:24 +02:00 |
|
|
Linus Rath
|
5632097971
|
fix: type the capped feed reader and the invitation sender lookup
|
2026-10-19 01:32:23 +02:00 |
|
|
Linus Rath
|
0b01a2d066
|
fix: ask before handing a sign-in to the mobile app and only to its own callback link
|
2026-10-19 01:22:19 +02:00 |
|
|
Linus Rath
|
044c98e6d2
|
fix: cap the size of a synced settings blob
|
2026-10-19 01:15:04 +02:00 |
|
|
Linus Rath
|
c0b6519136
|
fix: stop reading a calendar feed at the size cap instead of buffering it whole
|
2026-10-19 01:15:04 +02:00 |
|
|
Linus Rath
|
e6064f3476
|
fix: only connect and proxy plugin credentials that a plugin known to the server declares
|
2026-10-19 01:07:50 +02:00 |
|