Linus Rath 32280b9cc1 fix: cap admin sign-in attempts across all clients (GHSA-7pj2-232x-6698) ...

The admin login limit keys on the client IP taken from
X-Forwarded-For. With no reverse proxy in front, that header is
whatever the client sends (Next only fills it from the socket when the
request carries none), so each forged address got a fresh bucket of
five guesses. Route handlers cannot see the socket address, so the
limiter now also stops at 50 attempts per 15 minutes across all
clients. `.env.example` says why a proxy that appends the header is
still needed for trustworthy per-IP limits and audit addresses.

2026-09-26 15:07:09 +02:00

..

__tests__

feat(unified-mailbox): account-bounded Unified Mailbox with opt-in cross-account

2026-07-11 21:14:34 +02:00

audit.ts

feat: web setup wizard + admin config/state dir split (#226)

2026-05-09 17:37:41 +02:00

branding-asset.ts

fix: pin resolved IP for stored custom JMAP endpoints and branding URLs

2026-08-26 23:02:19 +02:00

config-manager.ts

feat: default sidebar apps for all users #931

2026-08-29 12:31:17 +02:00

csp-frame-origins.ts

fix: correct regex for valid API post path validation

2026-05-18 12:44:54 +02:00

domain-branding.ts

fix: use callable .get to detect Headers in pickRequestHost

2026-07-09 13:51:12 +02:00

jmap-servers.ts

fix: sign in and show addresses on internationalized domains #1100

2026-09-24 21:15:22 +02:00

migrate.ts

feat(unified-mailbox): account-bounded Unified Mailbox with opt-in cross-account

2026-07-11 21:14:34 +02:00

password.ts

feat: add passwordHashFile to admin.json

2026-06-02 23:48:03 +02:00

paths.ts

feat: web setup wizard + admin config/state dir split (#226)

2026-05-09 17:37:41 +02:00

plugin-approvals.ts

feat: expose PWA, app identity, and extension directory keys in JSON config #312

2026-05-21 23:35:58 +02:00

plugin-config.ts

feat: web setup wizard + admin config/state dir split (#226)

2026-05-09 17:37:41 +02:00

plugin-dev.ts

feat: expose PWA, app identity, and extension directory keys in JSON config #312

2026-05-21 23:35:58 +02:00

plugin-registry.ts

feat: add privileged same-origin plugin tier + crypto API surface

2026-06-28 16:51:42 +02:00

plugin-signing.ts

feat: expose PWA, app identity, and extension directory keys in JSON config #312

2026-05-21 23:35:58 +02:00

rate-limit.ts

fix: cap admin sign-in attempts across all clients (GHSA-7pj2-232x-6698)

2026-09-26 15:07:09 +02:00

session.ts

fix: reject cross-site requests to /api/auth/* to stop session fixation (GHSA-qvr9-m8cq-7wvg)

2026-09-17 20:01:35 +02:00

stalwart-admin-access.ts

feat: make Stalwart admin access to the dashboard configurable #870

2026-08-25 18:39:07 +02:00

types.ts

fix: end the identity provider session on sign-out #905

2026-09-23 20:44:46 +02:00