Linus Rath e57b7a2c18 fix: check plugin and theme packages the same way on every install path ...

The Settings upload, the admin upload, the marketplace install and the
marketplace preview each parsed the ZIP and manifest with their own copy
of the code, and the copies had drifted. A `permissions` string skipped
validation and was then matched by substring, a small ZIP could inflate
to hundreds of megabytes on the server, the Settings upload dropped
`locales` and took origin lists unchecked, and settings schemas were
never checked at all.

All of them now go through `lib/extension-package.ts`:
- every file is inflated through a byte cap, with a limit on entries
- one manifest check: types, permissions, entrypoint, version,
  minAppVersion, settingsSchema, configSchema, locales and origin lists
- only checked fields are stored

2026-10-14 01:43:43 +02:00

..

(main)

fix: restore the full screen height when the iOS app resumes #1226

2026-10-13 14:53:23 +02:00

(sandbox)

feat: add privileged same-origin plugin tier + crypto API surface

2026-06-28 16:51:42 +02:00

api

fix: check plugin and theme packages the same way on every install path

2026-10-14 01:43:43 +02:00

global-error.tsx

fix: load app styles on the global error page

2026-09-22 19:39:39 +02:00

globals.css

fix: stop the panes sliding when animations are turned off #1215

2026-10-12 01:55:57 +02:00

manifest.ts

Feature: configurable PWA install screenshots (per-domain)

2026-05-30 15:45:59 +02:00