webmail

mirror of https://github.com/bulwarkmail/webmail.git synced 2026-11-01 08:12:43 +00:00

Files

T

Shuki Vaknin 322274fff8 fix: let a mailbox be opened through the handoff more than five times

Each impersonation handoff makes an app password on the target mailbox
that expires after 8 hours. Stalwart keeps an app password after its
expiresAt and counts it against the mailbox's limit (5 by default), and
nothing deleted the expired ones, so after five handoffs every further
one failed with "You have exceeded your quota of 5 app passwords" and the
mailbox could no longer be opened that way.

Before making a new one, the handoff now lists the mailbox's app
passwords and deletes its own expired ones, recognised by the
"Support session " description. The user's own app passwords and a
session still running are never touched. It is best effort: if the list
or the delete fails, the handoff tries to create the password as before.

2026-10-29 16:37:06 +00:00

impersonate

fix: let a mailbox be opened through the handoff more than five times

2026-10-29 16:37:06 +00:00

oauth/metadata

fix: discover OIDC metadata server-side to avoid CORS failures #382

2026-06-02 00:15:50 +02:00

pair

fix: say up front when the mobile app cannot use an http mail server

2026-09-27 04:53:49 +02:00

reauth/sso/complete

fix: refuse a pairing re-auth the identity provider did not make fresh