mirror of
https://github.com/bulwarkmail/webmail.git
synced 2026-11-02 00:14:23 +00:00
Linus Rath
473e5c8bff
- An app password minted for a phone that never redeemed its code stayed valid (no expiry, full permissions, no TOTP) and used up one of the account's five app-password slots. It is now deleted, with its own credential, when its grant is discarded or expires. - Replaced codes were kept for twelve minutes each, so a session could grow the store, and the cost of every request, without bound; only the last three of a grant are kept now. - A session read that failed after the credential check was taken for a non-Stalwart server and handed the phone the account password; it now refuses the pairing instead.