Linus Rath 8860dde005 fix: sign in with password and TOTP on Stalwart 1.0

2026-10-26 20:25:42 +01:00

..

impersonate

fix: make the impersonation handoff really clear the previous account list and ignore ?impersonated=1 links from elsewhere

2026-10-26 14:58:31 +01:00

oauth/metadata

fix: discover OIDC metadata server-side to avoid CORS failures #382

2026-06-02 00:15:50 +02:00

pair

fix: say up front when the mobile app cannot use an http mail server

2026-09-27 04:53:49 +02:00

reauth/sso/complete

fix: refuse a pairing re-auth the identity provider did not make fresh

2026-09-27 04:49:54 +02:00

session

fix: key synced settings on the account a token login resolves to, not on a bare claimed name

2026-10-19 00:45:11 +02:00

sso

fix: ask before handing a sign-in to the mobile app and only to its own callback link

2026-10-19 01:22:19 +02:00

stalwart-context

fix: stop replaying a stored credential the mail server refused, so a stale session cannot get the webmail banned (GHSA-g6c7-r7wq-xrm2)

2026-10-26 15:00:56 +01:00

token

fix: sign in with password and TOTP on Stalwart 1.0

2026-10-26 20:25:42 +01:00

totp-token-exchange

fix: sign in with password and TOTP on Stalwart 1.0

2026-10-26 20:25:42 +01:00

verify

fix: budget failed sign-ins per client and forward the client address to the mail server

2026-10-19 00:43:00 +02:00