webmail

mirror of https://github.com/bulwarkmail/webmail.git synced 2026-11-04 08:15:41 +00:00

Files

T

Linus Rath 2edd6b5ea7 fix: hold forced policies against spoofed plugins, recommended values and stopped servers

A forced value could be got around from inside the app. Only a forced
value may now decide what's allowed: the keys that do are forced-only,
so a recommended one no longer acts as forced. With a plugin list a
package can name any id, so uploads are refused and only managed
plugins can match. A server taken off AllowedJmapServers stops its
accounts without signing out: client, push and sync stop, the switcher
drops them, restore and refresh answer 403 with the cookie kept, and
listing it again resumes with no sign-in. OAuth and SSO starts check
the list too.

- `policy.onWipeOfflineData` is gone from the bridge: main runs the wipe
- `KeystoreAllowedOrigins` added, and `POLICY_CONSUMERS` names who acts
  on each key or who still owes it
- a Bulwark server's name must be plain after parsing, a wildcard in the
  auth lists needs a domain of two labels

2026-11-03 12:06:21 +01:00

cookie-config.ts

feat: offer remember me on the sso-only login and apply it to every sso path #1437

2026-10-29 20:06:44 +01:00

custom-upstream.ts

fix: hold forced policies against spoofed plugins, recommended values and stopped servers

2026-11-03 12:06:21 +01:00

discovery.ts

fix: stop OAuth discovery from reading a well-known document off another host

2026-10-19 01:32:24 +02:00

end-session.ts

feat: let admins keep the refresh token valid on sign-out so Stalwart keeps the consent #1388