mirror of
https://github.com/bulwarkmail/webmail.git
synced 2026-10-31 00:12:39 +00:00
`api.storage` kept one `plugin:<id>:` namespace for everyone signed in to the browser and left it behind after signing out, so a plugin read what it had stored for the previous account, such as quick-notes' notes on someone else's mail. Keys now carry the account (`plugin:<id>:@<account>:<key>`). Signing an account out or removing it deletes its keys, and a full sign-out deletes all plugin storage. Keys written before this change are handed to the first account that uses the plugin. Uninstalling a plugin still removes everything under its prefix.