Linus Rath b73d0dfabf fix: stop reflecting a user-chosen server's error body from the TOTP login ...

A failed TOTP login returned the first 500 bytes of the upstream error
body. With custom JMAP endpoints allowed and no server configured, the
upstream is any address the caller names, so the route read other
servers' responses on the caller's behalf. The detail is now only
passed on from an admin-configured server.

2026-09-26 15:08:35 +02:00

..

__tests__

fix: stop reflecting a user-chosen server's error body from the TOTP login

2026-09-26 15:08:35 +02:00

admin

fix: cap admin sign-in attempts across all clients (GHSA-7pj2-232x-6698)

2026-09-26 15:07:09 +02:00

auth

fix: key synced settings on the account a bearer token belongs to

2026-09-26 14:59:55 +02:00

connector

feat: resolve deep links to the local instance

2026-09-20 19:59:37 +02:00

demo

fix: keep an SVG attachment thumbnail from running script in the webmail origin

2026-09-26 14:30:19 +02:00

global-search

fix: send mail search terms as typed instead of with a fake prefix wildcard

2026-09-22 21:04:18 +02:00

impersonation

fix: keep the Stalwart master password out of impersonated sessions

2026-09-26 14:05:05 +02:00

jmap

fix: keep an SVG attachment thumbnail from running script in the webmail origin

2026-09-26 14:30:19 +02:00

oauth

fix: leave out the id token when sign-in cookies would overflow nginx's header buffer #1096

2026-09-24 18:23:11 +02:00

plugin-sandbox

fix: keep plugin http.post away from credentialed and admin routes

2026-09-26 15:01:42 +02:00

protocol-handlers

feat: deep links for mail, calendar, contacts, files, settings and improve screen reader support

2026-08-06 16:47:20 +02:00

security

fix: block loopback, CGNAT and IPv6 transition ranges in the SSRF guard

2026-09-26 14:00:01 +02:00

setup

feat: expose PWA, app identity, and extension directory keys in JSON config #312

2026-05-21 23:35:58 +02:00

sieve

fix: stop filter rule data from breaking out into the Sieve script

2026-09-26 14:56:01 +02:00

stalwart

fix: key synced settings on the account a bearer token belongs to

2026-09-26 14:59:55 +02:00

telemetry

fix: block loopback, CGNAT and IPv6 transition ranges in the SSRF guard

2026-09-26 14:00:01 +02:00

version-check

fix: invalidate persisted update status after an upgrade

2026-08-29 12:46:39 +02:00

webdav

fix: pin supported-calendar-component-set on created calendars #760

2026-08-25 19:16:20 +02:00

wopi

fix: stop office attachment launch hanging while checking the blob #1047

2026-09-23 19:03:37 +02:00

account-state-manager.ts

fix(files): reset the account-scoped Files drive on every account switch

2026-08-13 23:01:41 +02:00

account-utils.ts

fix: detect HTTP/2 from the initial navigation timing so accounts aren't capped at five

2026-09-10 10:14:25 +02:00

attachment-visibility.ts

fix: hide body-embedded cid parts declared as octet-stream from the attachment list

2026-09-10 10:45:45 +02:00

birthday-calendar.ts

chore: clear pre-commit eslint warnings (unused symbols, stale disables, test any)

2026-06-19 12:31:07 +02:00

browser-navigation.ts

feat: add Bulwark Lite build for Stalwart Applications

2026-09-19 00:53:53 +02:00

builtin-themes.ts

feat: add "Flat fields" theme

2026-09-19 13:01:07 +02:00

calendar-alerts.ts

fix: strike through cancelled events and mute their reminders #572

2026-07-07 23:26:36 +02:00

calendar-component-detection.ts

fix(calendar): hide tasks-only calendars from the event calendar UI

2026-08-16 21:18:57 +02:00

calendar-editability.ts

fix: rsvp controls

2026-09-03 22:12:15 -07:00

calendar-event-normalization.ts

feat: use Stalwart synthetic ids for recurring occurrences #140

2026-08-29 11:03:48 +02:00

calendar-ics-export.ts

i18n: add missing translation keys

2026-04-21 17:42:52 +02:00

calendar-invitation.ts

fix: export isCalendarMimeType for use in email attachment filtering

2026-04-16 16:54:09 +02:00

calendar-participants.ts

fix(calendar): dedupe participants, resolve contact names, show organizer status

2026-09-07 16:48:26 +08:00

calendar-scroll-window.ts

feat: setting to turn off free scrolling in the calendar

2026-09-09 18:27:01 +02:00

calendar-utils.ts

feat: freely scrolling month, week and day views #759

2026-09-09 16:38:55 +02:00

clear-cached-data.ts

fix: route multi-account email lookups and invitation parsing by source account #847

2026-08-25 18:50:50 +02:00

color-transform.ts

feat: add participant scheduling with iTIP invitations and inline calendar invitation banner

2026-02-17 01:09:57 +01:00

debug.ts

feat: store trusted senders in a dedicated JMAP address book #176

2026-04-12 01:10:28 +02:00

deep-link-handoff.ts

feat: open global search hits through the owning login on every surface #847

2026-09-01 20:55:13 +02:00

deep-links.ts

feat: open global search hits through the owning login on every surface #847

2026-09-01 20:55:13 +02:00

download-filename.ts

fix: never loop forever when deduping drag-out .eml names #1039

2026-09-17 21:42:16 +02:00

email-action-toast.ts

feat: add missing mail action toasts and show sonner toasts again

2026-09-21 20:52:02 +02:00

email-body-selection.ts

fix: render plain-text-only mail as text in the mobile thread view #489

2026-08-31 20:41:45 +02:00

email-composer-utils.ts

refactor: migrate icon set from Lucide to Tabler Icons

2026-09-19 13:32:41 +02:00

email-date.ts

fix: parse calendar invitations in directly viewed shared folders against the folder owner #867

2026-08-25 19:36:04 +02:00

email-fit-width.ts

fix: wrap text in fixed-width tables to the screen on iOS #1020

2026-09-23 19:41:44 +02:00

email-headers.ts

fix: stop a sender from faking a DMARC or DKIM pass in the security badges

2026-09-26 14:13:33 +02:00

email-sanitization.ts

fix: treat image-map links like anchors so they cannot keep the opener

2026-09-26 14:53:40 +02:00

email-source.ts

feat: add plugin hooks for email details, headers, and source

2026-06-25 01:04:26 +02:00

email-threading.ts

chore: update version to 1.6.2

2026-05-06 20:07:36 +02:00

eml-import.ts

feat: support importing emails from .zip archives

2026-05-22 15:22:33 +02:00

favicon-badge.ts

feat: redesign the unread favicon badge as a compact keyline badge

2026-08-20 16:49:31 +02:00

file-name-rules.ts

fix: handle the file names and types Stalwart refuses

2026-09-22 20:54:01 +02:00

file-preview.ts

fix: keep an SVG attachment thumbnail from running script in the webmail origin

2026-09-26 14:30:19 +02:00

folder-tree-dnd.ts

fix: folder drag & drop can move folders into other parents #855

2026-08-20 14:21:41 +02:00

forward-as-attachment.ts

fix: strip from/to names from forward-as-attachment filenames

2026-07-29 11:41:34 +12:00

html-to-text.ts

fix: preserve line breaks in generated text/plain alternative #421

2026-06-15 23:15:04 +02:00

idn.ts

fix: sign in and show addresses on internationalized domains #1100

2026-09-24 21:15:22 +02:00

iframe-bridge.ts

fix: pin parent origin in iframe-bridge to block cross-frame postMessage

2026-05-18 16:01:29 +02:00

jalali-utils.ts

feat: add Jalali (Persian/Shamsi) calendar support with Saturday as week start (#490)

2026-07-08 15:42:42 +02:00

keyboard.ts

fix: detect typing inside the QuotedHtml shadow island via composedPath #654

2026-07-21 23:26:51 +02:00

keyword-discovery.ts

feat: detect and import unrecognized JMAP keywords as tags #658

2026-08-06 18:44:14 +02:00

keyword-format.ts

feat: Add nesting of tags in a tree

2026-07-29 17:18:38 +02:00

keyword-nesting.ts

feat: allow hidden tags, either permanent or when there are no unread messages

2026-07-29 17:18:42 +02:00

list-attachments.ts

fix: load attachment chips lazily instead of in the message list #1089

2026-09-23 18:09:35 +02:00

lite-config.ts

feat: add OpenID Connect login to the Stalwart Lite bundle

2026-09-21 23:45:08 +02:00

lite-link-segments.ts

fix: harden Bulwark Lite login, deep-link replay and settings gating

2026-09-18 22:16:57 +02:00

lite-mounted-href.ts

feat: add Bulwark Lite build for Stalwart Applications

2026-09-19 00:53:53 +02:00

lite-static-params.ts

feat: add Bulwark Lite static export build

2026-09-17 23:54:33 +02:00

lite.ts

feat: add Bulwark Lite build for Stalwart Applications

2026-09-19 00:53:53 +02:00

logger.ts

feat: add contacts phase 2, advanced search, vacation responder, Docker & TOTP 2FA

2026-02-16 18:51:30 +01:00

mailbox-label.ts

fix: localize special-folder names by JMAP role #404

2026-06-24 19:32:13 +02:00

mdn.ts

fix: strip CR/LF from read-receipt header values (GHSA-w38p-hpqv-g89c)

2026-09-17 20:55:39 +02:00

message-list-order.ts

fix: keep bringing up unread mail past the first page in unread-first order

2026-09-23 21:01:48 +02:00

notification-sound.ts

Fix: notification sound preview - base-path prefix + longer default beep

2026-07-04 14:52:26 +02:00

pending-notification-store.ts

feat: surface CalendarEventNotification invitations and updates

2026-08-29 18:11:50 +02:00

plugin-hooks.ts

feat: OAuth handler for plugins; extended contacts and addressbook API

2026-08-31 09:55:06 +02:00

plugin-loader.ts

Feature: localizable sandboxed plugins (manifest locales + api.i18n.t)

2026-05-30 15:56:55 +02:00

plugin-oauth.ts

feat: OAuth handler for plugins; extended contacts and addressbook API

2026-08-31 09:55:06 +02:00

plugin-projection.ts

feat: add plugin hooks for email details, headers, and source

2026-06-25 01:04:26 +02:00

plugin-storage.ts

fix: fail fast when the plugin storage database is blocked #840

2026-09-07 22:34:47 +02:00

plugin-types.ts

fix: close theme CSS sanitizer bypasses and enforce :root/.dark selectors

2026-09-26 14:36:02 +02:00

plugin-validator.ts

fix: close theme CSS sanitizer bypasses and enforce :root/.dark selectors

2026-09-26 14:36:02 +02:00

push-relays.ts

feat: pick push relay from admin-defined list instead of a URL field

2026-08-16 23:04:22 +02:00

quote-collapse.ts

feat: collapse quoted reply text behind a "..." toggle #480

2026-07-22 19:17:23 +02:00

quote-header.ts

fix: HTML-escape sender/subject in reply/forward quote header (#482)

2026-06-25 00:25:28 +02:00

read-file-env.ts

feat: add SESSION_SECRET_FILE and OAUTH_CLIENT_SECRET_FILE env vars

2026-04-09 22:13:08 +02:00

recurrence-expansion.ts

fix: keep single-occurrence edits on that occurrence and keep its details

2026-09-23 13:40:01 +02:00

recurrence-instances.ts

fix: keep single-occurrence edits on that occurrence and keep its details

2026-09-23 13:40:01 +02:00

recurrence-overrides.ts

fix: keep single-occurrence edits on that occurrence and keep its details

2026-09-23 13:40:01 +02:00

recurrence-rule.ts

fix(calendar): drop default SKIP=OMIT from recurrence rules (DAVx5 sync)

2026-08-25 21:13:34 +02:00

reply-identity.ts

feat: choose exact-address or same-domain matching for reply from received address #1000

2026-09-09 19:27:08 +02:00

reply-recipients.ts

fix(reply): honour an external Reply-To even on a self-sent message

2026-08-16 21:12:21 +02:00

rfc5322-mailbox.ts

fix: split "Name <addr>" recipients into the JMAP name and email fields #672

2026-08-06 19:19:18 +02:00

search-scope-folders.ts

fix: include shared accounts in "All folders" mail search #1082

2026-09-22 17:25:43 +02:00

search-snippet.ts

feat: highlight search hits with SearchSnippet/get

2026-08-29 17:47:23 +02:00

search-suggestions.ts

feat: search suggestions with recent searches and contact autocomplete #845

2026-08-25 20:09:18 +02:00

server-auth-status.ts

fix: explain why calendar subscriptions fail with not authenticated #1073

2026-09-23 18:31:27 +02:00

settings-search.ts

fix: translate the themes settings panel

2026-09-26 12:54:30 +02:00

settings-sync.ts

feat: web setup wizard + admin config/state dir split (#226)

2026-05-09 17:37:41 +02:00

shared-calendar-colors.ts

Feature: per-viewer colors for shared calendars (#345)

2026-05-31 15:52:27 +02:00

sidebar-apps.ts

refactor: migrate icon set from Lucide to Tabler Icons

2026-09-19 13:32:41 +02:00

signature-utils.ts

fix: keep already written text when applying a template in compose #540

2026-08-16 22:20:49 +02:00

sub-addressing.ts

chore: update version to 1.6.2

2026-05-06 20:07:36 +02:00

subject-prefix.ts

fix: keep the fresh-compose tab title clear of the selected email subject

2026-08-18 15:48:05 +02:00

template-types.ts

feat(templates): add support for HTML templates

2026-07-19 10:10:31 +02:00

template-utils.ts

fix: keep already written text when applying a template in compose #540

2026-08-16 22:20:49 +02:00

theme-color-meta.ts

fix: sync PWA title bar colour with the active theme #671

2026-08-06 18:23:21 +02:00

theme-compiler.ts

fix: close theme CSS sanitizer bypasses and enforce :root/.dark selectors

2026-09-26 14:36:02 +02:00

theme-flat-fields.ts

refactor: migrate icon set from Lucide to Tabler Icons

2026-09-19 13:32:41 +02:00

theme-loader.ts

fix: close theme CSS sanitizer bypasses and enforce :root/.dark selectors

2026-09-26 14:36:02 +02:00

thread-routing.ts

fix: open right conversations in shared mailbox #814

2026-08-16 02:19:04 +02:00

thread-utils.ts

fix: scope thread identity to the owning account in unified views #1012

2026-09-18 18:33:02 +02:00

timezone.ts

fix: query calendar ranges in the right time zone and past the limits

2026-09-22 20:42:07 +02:00

tnef.ts

fix: stop a crafted winmail.dat from freezing the tab

2026-09-26 14:15:10 +02:00

unified-mailbox.ts

fix: a search inside a tag view narrows the tag instead of replacing it

2026-09-22 19:41:51 +02:00

upload-progress.ts

feat: real byte progress for attachment uploads, stock and plugin-offloaded

2026-08-23 19:44:56 +06:00

utils.ts

fix: keep the inbox rendering when a message has an unparsable date #1099

2026-09-24 17:47:33 +02:00

validation.ts

fix: show what a mailto unsubscribe sends and limit it to one recipient

2026-09-26 14:41:14 +02:00

vcard.ts

fix: set name.full on all contact write paths so vCards carry mandatory FN #430

2026-08-31 23:53:24 +02:00

version-compare.ts

feat: expose PWA, app identity, and extension directory keys in JSON config #312

2026-05-21 23:35:58 +02:00

web-push.ts

fix: keep inbox-only push working for accounts shared without an inbox #983

2026-09-23 05:56:28 +02:00