Linus Rath b73d0dfabf fix: stop reflecting a user-chosen server's error body from the TOTP login ...

A failed TOTP login returned the first 500 bytes of the upstream error
body. With custom JMAP endpoints allowed and no server configured, the
upstream is any address the caller names, so the route read other
servers' responses on the caller's behalf. The detail is now only
passed on from an admin-configured server.

2026-09-26 15:08:35 +02:00

..

account/stalwart/jmap

fix: reject cross-origin writes to the JMAP passthrough and other cookie-authed routes (GHSA-9mvj-98f5-9q6g)

2026-09-26 14:08:44 +02:00

admin

fix: close theme CSS sanitizer bypasses and enforce :root/.dark selectors

2026-09-26 14:36:02 +02:00

auth

fix: stop reflecting a user-chosen server's error body from the TOTP login

2026-09-26 15:08:35 +02:00

caldav/discover

fix: reject cross-origin writes to the JMAP passthrough and other cookie-authed routes (GHSA-9mvj-98f5-9q6g)

2026-09-26 14:08:44 +02:00

calendar-agenda

fix: reject cross-origin writes to the JMAP passthrough and other cookie-authed routes (GHSA-9mvj-98f5-9q6g)

2026-09-26 14:08:44 +02:00

config

feat: add a server-side switch for the Stalwart JMAP passthrough #904

2026-09-07 22:34:47 +02:00

connector/capabilities

feat: resolve deep links to the local instance

2026-09-20 19:59:37 +02:00

dev-jmap/[...path]

fix: list every file when the account exceeds maxObjectsInGet #1069

2026-09-22 00:17:44 +02:00

favicon

Fix: no more 404 console spam for missing sender favicons

2026-05-30 16:58:46 +02:00

fetch-ical

fix: reject cross-origin writes to the JMAP passthrough and other cookie-authed routes (GHSA-9mvj-98f5-9q6g)

2026-09-26 14:08:44 +02:00

health

fix: enhance health check functionality with detailed memory diagnostics and stable liveness probe

2026-03-19 18:50:59 +01:00

og-image

fix: don't export OG_WIDTH/OG_HEIGHT from the og-image route

2026-08-17 00:18:59 +02:00

plugin-approval-status

fix: reject cross-origin writes to the JMAP passthrough and other cookie-authed routes (GHSA-9mvj-98f5-9q6g)

2026-09-26 14:08:44 +02:00

plugin-signing-pubkey

feat: expose PWA, app identity, and extension directory keys in JSON config #312

2026-05-21 23:35:58 +02:00

plugins

feat: add privileged same-origin plugin tier + crypto API surface

2026-06-28 16:51:42 +02:00

push/preview

fix: resolve push previews for shared and group mailboxes #839

2026-09-07 22:34:47 +02:00

pwa-icon/[size]

feat: branded OpenGraph/Twitter link previews with generated card image

2026-08-16 23:40:25 +02:00

pwa-screenshot/[variant]

feat: branded OpenGraph/Twitter link previews with generated card image

2026-08-16 23:40:25 +02:00

settings

fix: key synced settings on the account a bearer token belongs to

2026-09-26 14:59:55 +02:00

setup

fix: pin resolved IP for stored custom JMAP endpoints and branding URLs

2026-08-26 23:02:19 +02:00

system/update-status

fix: invalidate persisted update status after an upgrade

2026-08-29 12:46:39 +02:00

translate

fix: reject cross-origin writes to the JMAP passthrough and other cookie-authed routes (GHSA-9mvj-98f5-9q6g)

2026-09-26 14:08:44 +02:00

webdav

fix: reject cross-origin writes to the JMAP passthrough and other cookie-authed routes (GHSA-9mvj-98f5-9q6g)

2026-09-26 14:08:44 +02:00

wopi

fix: serve WOPI file downloads as inert attachments

2026-09-26 14:16:42 +02:00