webmail

mirror of https://github.com/bulwarkmail/webmail.git synced 2026-10-31 08:13:50 +00:00

Files

T

Linus Rath 6d2255ad0d fix: keep plugin http.post away from credentialed and admin routes

`http.post` attaches the user's Authorization header to any same-origin
path the plugin's own manifest lists in `apiPostPaths`. A plugin with
only `http:post` could list the JMAP passthrough and get full JMAP
access, or reach `/api/admin/*`, `/api/settings` and the other
credentialed routes. The host now refuses those paths whatever the
manifest says, checked on the decoded path the router sees. Plugins
keep reaching their own sidecar routes.

2026-09-26 15:01:42 +02:00

bundle-fetch.ts

fix(): refill missing managed bundles from the server #636

2026-09-07 16:52:20 +02:00

bundle-integrity.ts

fix(): refill missing managed bundles from the server #636

2026-09-07 16:52:20 +02:00

bundle-signing.ts

fix(): refill missing managed bundles from the server #636

2026-09-07 16:52:20 +02:00

consent.ts

fix(plugins): make attachment offload workable and keep the write gate closed