mirror of
https://github.com/bulwarkmail/webmail.git
synced 2026-11-02 08:15:55 +00:00
KazNIISA IT
ad0cc108b4
Review follow-up on the shared-folder mutation routing. The owner lookup replaced the resolved client with any connected client whose JMAP account id matched. Account ids are opaque per-server values, and personal mailboxes carry an accountId too, so this ran on every folder mutation and could hand a mutation to a client of a different server that happens to issue the same id - where the bare mailbox id may exist and belong to someone else. Keep the resolved client when it already is the owner, and require a candidate to match the server URL as well as the account id. Recover the owner account and the bare mailbox id from the namespaced store id when no mailbox object is available. Previously the raw `accountId:id` went to the server as a mailbox id with the owner dropped, so the mutation targeted the active personal account; in setMailboxRole that cleared the personal role before failing. Drop the shared account header context menu when the account carries no usable id. buildMailboxTree groups shared mailboxes without an accountId under the placeholder "unknown", which cannot be a mutation target.