Bernd Rodler
a622e3755b
fix: Phase 1 critical+high fixes (17/18 items)
...
CRITICAL fixes:
- C1: Error swallowing - throw TransportError on network failure in getEmails/searchEmails
- C2: Recurrence expansion ID delimiter changed from ':' to '::occurrence::'
- C3: Cross-account calendar event UID dedup after multi-account aggregation
- C4: Admin session token revocation via JTI blacklist on logout
- C6: FTS5 schema-drop - add warning log for automatic reindex trigger
- C7: Settings lock - gate updateSetting() with isSettingLocked() check
- C8: Offline push pause - add offline event handler that closes push transports
HIGH fixes:
- H1: Push handler - add ContactCard and FileNode branches
- H2: WS fallback - await state snapshot before reconcileAfterWebSocketFallback
- H3: Auth rate limiting - add checkUserAuthRateLimit to session and token routes
- H4: OAuth logs - strip access_token from error log context
- H7: Template XSS - apply DOMPurify to HTML template body on import
- H8: Secure cookie - derive from x-forwarded-proto, not NODE_ENV
- H9: bcrypt fix - remove bcrypt prefixes from isHashed() so scrypt-only
- H13: calendarTasksEnabled - apply admin gate at runtime in calendar page
- H14: Task mutations - add try/catch error handling to update/delete/toggle
- H18: autoSelectReplyIdentity default changed from false to true
Deferred: P1.3 (C5 auth localStorage encryption) - requires custom Zustand persist adapter.
2026-08-07 12:17:41 +02:00
Linus Rath
fae15f073e
fix: honor cookieSameSite admin config override #284
2026-05-14 21:49:37 +02:00
Linus Rath
9571f2e185
fix: skip upstream JMAP reverify for trusted URLs #237
2026-05-11 19:22:37 +02:00
Linus Rath
5f464d4ee2
feat: lift 5-account cap on HTTP/2
2026-05-07 12:28:33 +02:00
Linus Rath
178922323d
chore: update version to 1.6.2
2026-05-06 20:07:36 +02:00
Linus Rath
d3d79be64c
feat: multi-server JMAP support
2026-05-06 17:33:55 +02:00
Linus Rath
45a4db1c22
fix: pin JMAP auth verification to configured server URL #237
2026-04-30 15:34:14 +02:00
Linus Rath
dafc8ace3c
feat: track unique logins
2026-04-28 08:19:46 +02:00
Linus Rath
da103ff06f
feat: implement OAuth auto-setup functionality for Stalwart integration
2026-04-25 01:37:18 +02:00
Linus Rath
8bdadc7ba3
fix: standardize punctuation
2026-04-16 19:07:42 +02:00
Linus Rath
aa40c8be26
fix: harden proxy auth and SSRF defenses
2026-03-31 17:47:09 +02:00
Linus Rath
66fe7fd359
fix: enhance security by blocking plugins with dangerous JS patterns and enforcing strict session secret length
2026-03-31 15:56:32 +02:00
Linus Rath
5da0e2bdf1
fix: patch critical auth bypass and credential leak vulnerabilities
2026-03-31 00:46:15 +02:00
Linus Rath
83a0a1e235
feat: add non-interactive SSO login flow for embedded/iframe deployments ( closes #69 )
2026-03-21 20:45:19 +01:00
Linus Rath
d493bb17dc
feat: implement account switcher component and state management
...
- Add AccountSwitcher component for managing user accounts with UI for switching, adding, and logging out.
- Create account state manager to handle snapshots of account-specific states for efficient switching.
- Introduce utility functions for account management, including ID generation and avatar color assignment.
- Implement Zustand store for account management, supporting addition, removal, and state retrieval of accounts.
2026-03-19 10:08:57 +01:00
Linus Rath
b090bf6d52
feat: add support for OAuth-only login mode and update configuration handling
2026-03-12 22:05:29 +01:00
Matthieu MALVACHE and Matthieu MALVACHE
1b0e3e41c6
feat: add "Remember me" session persistence and simplify 2FA UX
2026-02-26 00:47:53 +01:00
Bernd Rodler