Linus Rath e57b7a2c18 fix: check plugin and theme packages the same way on every install path ...

The Settings upload, the admin upload, the marketplace install and the
marketplace preview each parsed the ZIP and manifest with their own copy
of the code, and the copies had drifted. A `permissions` string skipped
validation and was then matched by substring, a small ZIP could inflate
to hundreds of megabytes on the server, the Settings upload dropped
`locales` and took origin lists unchecked, and settings schemas were
never checked at all.

All of them now go through `lib/extension-package.ts`:
- every file is inflated through a byte cap, with a limit on entries
- one manifest check: types, permissions, entrypoint, version,
  minAppVersion, settingsSchema, configSchema, locales and origin lists
- only checked fields are stored

2026-10-14 01:43:43 +02:00

..

__tests__

feat: let users hide shared mail accounts from the sidebar #1228

2026-10-13 15:55:54 +02:00

account-security-store.ts

fix: reset the account security page when switching accounts

2026-09-26 15:34:13 +02:00

account-store.ts

feat: optional encrypted backup of the account list

2026-10-09 10:54:38 +02:00

admin-tab-store.ts

fix: collapse admin panel into single tabbed page

2026-05-05 18:50:57 +02:00

auth-store.ts

fix: stop calling a reload without Remember me an expired session

2026-10-11 20:15:45 +02:00

calendar-event-notification-store.ts

feat: surface CalendarEventNotification invitations and updates

2026-08-29 18:11:50 +02:00

calendar-notification-store.ts

feat(calendar): add event notifications with alert evaluation

2026-02-16 23:49:35 +01:00

calendar-store.ts

fix: stop the mail list hiding dividers between some rows

2026-09-30 00:21:21 +02:00

client-registry.ts

feat: expose PWA, app identity, and extension directory keys in JSON config #312

2026-05-21 23:35:58 +02:00

contact-store.ts

fix(contacts): show placeholders instead of "No contacts yet" while contacts load

2026-10-11 17:20:43 +02:00

email-store.ts

feat: let users turn off the prompt before deleting several messages #1225

2026-10-13 15:16:05 +02:00

file-store.ts

fix(files): show the loading skeleton instead of "No files yet" before the first listing

2026-10-11 17:00:56 +02:00

filter-store.ts

feat: out of office forwarding and recipients, filter rule periods

2026-10-02 11:29:32 +02:00

global-search-store.ts

feat: global search core: query parser, ranking, cross-account providers #641

2026-09-01 20:55:12 +02:00

identity-store.ts

fix(identity): sync default sender identity per account (#507)

2026-07-13 21:21:34 +02:00

locale-store.ts

fix: respect server-resolved locale on first visit #309

2026-05-20 23:53:44 +02:00

managed-account-store.ts

feat: manage shared/group account settings from Accounts page

2026-06-14 17:05:29 +02:00

message-list-tabs-store.ts

feat: let plugins run a message-list search with a JMAP filter #1024

2026-10-11 19:39:58 +02:00

plugin-store.ts

fix: check plugin and theme packages the same way on every install path

2026-10-14 01:43:43 +02:00

policy-store.ts

fix: stop handing instance details to visitors who are not signed in

2026-09-26 17:03:24 +02:00

pro-tab-store.ts

feat: open global search hits through the owning login on every surface #847

2026-09-01 20:55:13 +02:00

quick-rule-store.ts

feat: create filter rules from the message right-click menu

2026-09-30 13:52:41 +02:00

search-history-store.ts

feat: search suggestions with recent searches and contact autocomplete #845

2026-08-25 20:09:18 +02:00

settings-store.ts

feat: let users hide shared mail accounts from the sidebar #1228

2026-10-13 15:55:54 +02:00

share-notification-store.ts

feat: surface CalendarEventNotification invitations and updates

2026-08-29 18:11:50 +02:00

task-store.ts

fix: let tasks move into and live in calendars shared with you #1204

2026-10-12 07:36:46 +02:00

template-store.ts

fix: stop stale tabs and devices from dropping synced templates

2026-10-06 22:14:29 +02:00

theme-store.ts

fix: stop forcing a theme after the admin deletes or disables it

2026-10-14 01:34:40 +02:00

toast-store.ts

fix: hide Undo send when the delay is over and say when an undo fails

2026-10-11 19:13:10 +02:00

totp-reauth-store.ts

fix: handle 2FA/TOTP session expiry with basic auth #117

2026-03-30 16:37:07 +02:00

ui-store.ts

feat: add Reading Pane at Bottom mail layout #262

2026-05-11 15:35:43 +02:00

update-store.ts

feat: add Bulwark Lite static export build

2026-09-17 23:54:33 +02:00

vacation-store.ts

feat: out of office forwarding and recipients, filter rule periods

2026-10-02 11:29:32 +02:00

webdav-store.ts

feat: add WebDAV file browser with auth improvements

2026-03-15 05:24:27 +01:00