Linus Rath
8bcb487442
feat: name dragged/exported .eml files as "date (from-to) subject" with ASCII-only chars
2026-05-22 14:28:36 +02:00
Linus Rath
8810a63262
feat: drag emails out to file explorer as .eml
2026-05-22 14:04:52 +02:00
Linus Rath
d3778e6521
fix: handle malformed event dates in calendar route #316
2026-05-22 14:04:02 +02:00
Linus Rath
ac4a89120d
fix: preserve inline images when replying #163
2026-05-22 12:06:55 +02:00
Linus Rath
1c02970ae1
fix: use canonical INBOX in Sieve filter paths #313
2026-05-22 11:51:25 +02:00
Linus Rath
fc5f6f43d6
feat: expose PWA, app identity, and extension directory keys in JSON config #312
2026-05-21 23:35:58 +02:00
Linus Rath
dbc0eea148
feat: group composer From dropdown by account in Pro shell
2026-05-21 23:07:02 +02:00
Linus Rath
e80412b6fd
feat: show contacts from all logged-in accounts in Pro shell
2026-05-21 22:32:17 +02:00
Linus Rath
7076f1ded8
feat: show calendars from all logged-in accounts in Pro shell
2026-05-21 18:48:55 +02:00
Linus Rath
e6782e61a8
fix: sync plugin slot iframe height with reported content height
2026-05-21 17:59:24 +02:00
Linus Rath
1756f5ac1c
feat: enable search in unified mailbox in pro mode
2026-05-21 17:12:06 +02:00
Linus Rath
628966d3b5
fix: split app into (main)/(sandbox) route groups so plugin iframe hydrates properly
2026-05-20 23:41:49 +02:00
Linus Rath
1c44f59ba1
feat: allow setup wizard over plain HTTP with dismissable warning gate
2026-05-20 19:01:46 +02:00
Linus Rath
d530d9614b
fix: serialize draft autosave with send to stop replies stalling in Drafts #303
2026-05-19 23:33:11 +02:00
Linus Rath
7003020855
fix: prevent duplication of Bulwark rules with literal braces in values
2026-05-18 23:58:21 +02:00
Linus Rath
ecd0467ffa
fix: stop pulling node:dns into client bundle via OAuth discovery
2026-05-18 19:31:38 +02:00
Linus Rath
cf9292262d
feat: pluggable reply/forward quote header #295
2026-05-18 17:53:23 +02:00
Linus Rath
b2d24670ff
fix: scope iCal subscriptions per JMAP account and fix refresh/clear
2026-05-18 16:39:02 +02:00
Linus Rath
fa261fecfd
fix: omit empty cc/bcc from Email/set so server does not emit bare Cc: header #301
2026-05-18 16:36:45 +02:00
Linus Rath
400703154e
fix: ignore plugin-supplied target in ui.openExternalUrl to block host-frame hijack
2026-05-18 16:18:00 +02:00
Linus Rath
3ceada7b8a
fix: tighten HTML sanitization at plain-text email + signature + i18n render sites
2026-05-18 16:07:34 +02:00
Linus Rath
eb0643d887
fix: pin parent origin in iframe-bridge to block cross-frame postMessage
2026-05-18 16:01:29 +02:00
Linus Rath
1fc670138b
fix: update bundleHash to full SHA-256 for integrity verification and migrate legacy hashes
2026-05-18 15:57:52 +02:00
Linus Rath
313a1fcce9
fix: stop persisting S/MIME passphrases in sessionStorage
2026-05-18 15:32:04 +02:00
Linus Rath
7efd8d59bf
fix: escape print-window fields and re-sanitize body to block XSS
2026-05-18 13:24:52 +02:00
Linus Rath
c2eb2c081b
fix: gate admin routes against cross-origin CSRF
2026-05-18 13:21:01 +02:00
Linus Rath
b299a0b602
fix: validate plugin/theme id in marketplace install to block path traversal
2026-05-18 13:03:49 +02:00
Linus Rath
f275fbe2e4
fix: bind stalwart auth context to credential, not cookie-claimed username
2026-05-18 13:00:40 +02:00
Linus Rath
f134766fd1
fix: validate OAuth discovery endpoints against SSRF
2026-05-18 12:53:43 +02:00
Linus Rath
6ebf720688
fix: block script-bearing MIME types from inline attachment preview
2026-05-18 12:47:44 +02:00
Linus Rath
b1eb2b3c9b
fix: correct regex for valid API post path validation
2026-05-18 12:44:54 +02:00
Linus Rath
48aa607b56
feat: lock down plugin runtime in sandbox + signing + approval
2026-05-18 12:44:23 +02:00
Linus Rath
088810bd20
feat: harden plugin sandbox and migrate in-tree plugins
2026-05-18 12:17:54 +02:00
Linus Rath
e16f572252
fix: use plugin slot offer snapshots for useSyncExternalStore
2026-05-18 11:00:05 +02:00
Linus Rath
9f312aa556
feat: sandbox plugins in null-origin iframes with postMessage RPC
2026-05-18 10:50:49 +02:00
Linus Rath
ed6b5d5f33
fix: clear identity signature fields when emptied
2026-05-18 00:53:54 +02:00
Linus Rath
92127e2f00
fix: allow table-based layouts in HTML signature sanitizer
2026-05-18 00:24:08 +02:00
Linus Rath
bb7e1c4538
fix: per-account push subscriptions so multi-account notifications work #298
2026-05-16 22:50:01 +02:00
Linus Rath
997bedc91b
feat: allow admin password overwrite during setup recovery
2026-05-16 18:21:48 +02:00
Linus Rath
307e6d5d34
fix: warn + block install when app version is below plugin's minAppVersion
2026-05-16 18:11:52 +02:00
Linus Rath
ca1108f455
feat: master-user impersonation route + app-top-banner plugin slot
2026-05-16 17:59:07 +02:00
Linus Rath
f39366b470
fix: read OAUTH_SCOPES at runtime instead of build time
2026-05-15 20:37:00 +02:00
Linus Rath
b725000f4d
feat: implement vCard 4.0 parsing and generation support
2026-05-15 20:10:18 +02:00
Timo Streule and Linus Rath
55a408e810
feat: allow img in HTML identity signatures
...
- Restricts src to https: URLs or base64-embedded raster data: URIs (png/jpeg/gif/webp).
- SVG is excluded for safety reasons.
- Images with a disallowed src are removed entirely so they don't render as broken-image icons.
2026-05-15 14:46:43 +02:00
Linus Rath
fae15f073e
fix: honor cookieSameSite admin config override #284
2026-05-14 21:49:37 +02:00
Linus Rath
c646c87030
fix: standardize punctuation in tooltips and comments across multiple locales and code files
2026-05-14 21:44:24 +02:00
Linus Rath
b4a76bc4d1
chore: expand demo fixtures with more emails, contacts, and portrait photos
2026-05-14 15:19:24 +02:00
Linus Rath
b46a1a69e8
chore: unblock pre-commit lint hook
2026-05-13 00:34:35 +02:00
Lucas Gaitzsch and Linus Rath
3f444a8912
Feature/protocol handlers
...
* Added account selection for protocol links when multiple connected accounts are available, including mailto: links
* Added support for handling mailto: links in an already-open PWA/session instead of always opening a new tab
* Added webcal: protocol handling for calendar links
* Added account selection for webcal: links when multiple calendar-capable accounts are connected
* Added an import-or-subscribe choice for detected webcal calendars
* Added protocol handler settings for registering mail and calendar handlers and choosing the open mode
* Added service worker/session coordination for passing protocol requests between browser/PWA contexts
* Added tests and translations for the new protocol handler flows
2026-05-12 20:49:05 +02:00
Linus Rath
f9f8af2f11
fix: preserve signature styling and reactivity in above-quote mode #272
2026-05-12 16:03:10 +02:00
Linus Rath