webmail

mirror of https://github.com/bulwarkmail/webmail.git synced 2026-10-31 00:12:39 +00:00

Files

T

Linus Rath ad84588f6a fix: keep an SVG attachment thumbnail from running script in the webmail origin

Attachment thumbnails were object URLs typed with the sender's MIME
type. Object URLs share the webmail origin, so an `image/svg+xml`
attachment opened from its thumbnail ("Open image in new tab", or
dragged to the tab strip) ran the sender's script as the webmail in
Chromium and Firefox. The drag-out URL and Files thumbnails had the
same shape.

`fetchBlobAsObjectUrl` now re-types every blob to an inert type, and
image thumbnails in mail and Files go through `imageBlobUrl`, which
hands an SVG over as a `data:` URL: it still renders in the `<img>`,
but opened on its own it gets an opaque origin.

2026-09-26 14:30:19 +02:00

__tests__

fix: gate first-touch calendar/contacts requests to stop duplicate default calendars #907

2026-08-25 19:07:01 +02:00

client-interface.ts

fix: use the from override as envelope sender where the server allows it #1009

2026-09-23 19:58:26 +02:00

client.ts

fix: keep an SVG attachment thumbnail from running script in the webmail origin

2026-09-26 14:30:19 +02:00

contact-wire.ts

fix: save contacts with calendar links and cleared fields correctly