Linus Rath a5583aa8e8 fix: re-check a paired phone's token endpoint against the current config ...

The token proxy trusted the endpoint sealed into a phone's refresh token
for good: after a server was removed or its provider moved, it kept
posting there with the plain fetch and whichever secret the server id
now maps to. Trust is now re-derived on every renewal; an endpoint the
webmail is no longer configured for gets neither the secret nor the
unguarded fetch.

2026-09-27 04:50:38 +02:00

..

account/stalwart/jmap

fix: reject cross-origin writes to the JMAP passthrough and other cookie-authed routes (GHSA-9mvj-98f5-9q6g)

2026-09-26 14:08:44 +02:00

admin

fix: stop handing instance details to visitors who are not signed in

2026-09-26 17:03:24 +02:00

auth

fix: re-check a paired phone's token endpoint against the current config

2026-09-27 04:50:38 +02:00

caldav/discover

fix: reject cross-origin writes to the JMAP passthrough and other cookie-authed routes (GHSA-9mvj-98f5-9q6g)

2026-09-26 14:08:44 +02:00

calendar-agenda

fix: reject cross-origin writes to the JMAP passthrough and other cookie-authed routes (GHSA-9mvj-98f5-9q6g)

2026-09-26 14:08:44 +02:00

config

fix: stop handing instance details to visitors who are not signed in

2026-09-26 17:03:24 +02:00

connector/capabilities

feat: resolve deep links to the local instance

2026-09-20 19:59:37 +02:00

dev-jmap/[...path]

fix: keep the mock JMAP server out of release builds

2026-09-26 17:07:31 +02:00

favicon

fix: serve sender favicons only as inert raster images

2026-09-26 16:24:11 +02:00

fetch-ical

fix: reject cross-origin writes to the JMAP passthrough and other cookie-authed routes (GHSA-9mvj-98f5-9q6g)

2026-09-26 14:08:44 +02:00

health

fix: stop handing instance details to visitors who are not signed in

2026-09-26 17:03:24 +02:00

og-image

fix: don't export OG_WIDTH/OG_HEIGHT from the og-image route

2026-08-17 00:18:59 +02:00

plugin-approval-status

fix: reject cross-origin writes to the JMAP passthrough and other cookie-authed routes (GHSA-9mvj-98f5-9q6g)

2026-09-26 14:08:44 +02:00

plugin-signing-pubkey

feat: expose PWA, app identity, and extension directory keys in JSON config #312

2026-05-21 23:35:58 +02:00

plugins

fix: stop handing instance details to visitors who are not signed in

2026-09-26 17:03:24 +02:00

push/preview

fix: open a push notification's message in the account it came from

2026-09-26 16:12:20 +02:00

pwa-icon/[size]

feat: branded OpenGraph/Twitter link previews with generated card image

2026-08-16 23:40:25 +02:00

pwa-screenshot/[variant]

feat: branded OpenGraph/Twitter link previews with generated card image

2026-08-16 23:40:25 +02:00

settings

fix: key synced settings on the account a bearer token belongs to

2026-09-26 14:59:55 +02:00

setup

fix: pin resolved IP for stored custom JMAP endpoints and branding URLs

2026-08-26 23:02:19 +02:00

system/update-status

fix: stop handing instance details to visitors who are not signed in

2026-09-26 17:03:24 +02:00

translate

fix: reject cross-origin writes to the JMAP passthrough and other cookie-authed routes (GHSA-9mvj-98f5-9q6g)

2026-09-26 14:08:44 +02:00

webdav

fix: reject cross-origin writes to the JMAP passthrough and other cookie-authed routes (GHSA-9mvj-98f5-9q6g)

2026-09-26 14:08:44 +02:00

wopi

fix: open and save files shared with you in the office editor #1094

2026-09-26 22:28:34 +02:00