Linus Rath
512adab7e3
feat: add privileged same-origin plugin tier + crypto API surface
2026-06-28 16:51:42 +02:00
dealerweb and Linus Rath
2ba0003e16
Feature: localizable sandboxed plugins (manifest locales + api.i18n.t)
...
The plugin runtime received the active locale (init payload + 'locale-change')
and plugins could declare a `locales` map, but none of it was usable: the
locales never reached the runtime, and buildPluginApi exposed no i18n. So
plugin code calling pluginApi.i18n.t(...) (as the External Link Warning plugin
does) always got undefined and fell back to English.
Thread plugin locales end to end and surface an i18n API:
- ServerPlugin gains `locales`; the upload route persists manifest.locales
(alongside configSchema/settingsSchema), and /api/plugins surfaces it to the
client so it flows registry -> client -> sandbox host-bridge -> runtime.
- runtime sets __PLUGIN_LOCALE__ at init (not only on later 'locale-change')
and buildPluginApi exposes `i18n.locale` + `i18n.t(key, vars)` resolving
against the plugin's declared locales (manifest.locales) with English/key
fallback and {placeholder} interpolation.
Lets any sandboxed plugin localize its strings from its manifest.
2026-05-30 15:56:55 +02:00
Linus Rath
628966d3b5
fix: split app into (main)/(sandbox) route groups so plugin iframe hydrates properly
2026-05-20 23:41:49 +02:00
Linus Rath
c2eb2c081b
fix: gate admin routes against cross-origin CSRF
2026-05-18 13:21:01 +02:00
Linus Rath
48aa607b56
feat: lock down plugin runtime in sandbox + signing + approval
2026-05-18 12:44:23 +02:00
Linus Rath
c5ac68e137
fix: prevent plugin config leak to non-admin users
2026-05-18 10:24:29 +02:00
Linus Rath
09302684da
fix: propagate settingsSchema
2026-05-06 01:48:49 +02:00
Linus Rath
0885d3c13e
feat: http:fetch permission + httpOrigins manifest field
2026-05-05 21:50:04 +02:00
Linus Rath
265908b05b
fix: resolve PLUGIN_DEV_DIR plugins in admin config route
2026-05-05 20:17:45 +02:00
Linus Rath
1b0ca8967e
feat: bundle plugin src/ on demand via esbuild
2026-05-05 18:35:22 +02:00
Linus Rath
3e336d459c
feat: plugin hot-reload + dev-folder loading
2026-05-05 18:05:17 +02:00
Linus Rath
90acf181f3
fix: harden plugin config, TOTP token exchange, and branding file serving
2026-04-28 01:44:37 +02:00
Linus Rath
fe1d4861bb
feat: composer-sidebar slot + plugin-declared frame-src origins
2026-04-25 18:40:54 +02:00
Linus Rath
8bdadc7ba3
fix: standardize punctuation
2026-04-16 19:07:42 +02:00
Linus Rath
66fe7fd359
fix: enhance security by blocking plugins with dangerous JS patterns and enforcing strict session secret length
2026-03-31 15:56:32 +02:00
Linus Rath
5da0e2bdf1
fix: patch critical auth bypass and credential leak vulnerabilities
2026-03-31 00:46:15 +02:00
Linus Rath
aaa283357e
feat: implemented plugin configuration UI and calendar event action slot
...
- Add configSchema support to plugin manifest and ServerPlugin registry
- Add schema-driven admin config page (string, secret, boolean, number, select fields)
- Add per-plugin config storage backend (JSON files + REST API)
- Add calendar-event-actions and admin-plugin-page slot names to plugin store
- Add registerCalendarEventAction and registerAdminPage to plugin API
- Add calendarFormHooks (onCalendarEventFormOpen/Save) to hook bus
- Add PluginSlot in calendar event modal for plugin action buttons
- Style calendar event action buttons to match Bulwark outline button design
- Add Configure link per plugin in admin plugins dashboard
- Add Jitsi Meet plugin with tests (repos/plugins/jitsi-meet)
- Exclude data/admin/plugins from ESLint (deployed plugin bundles)
2026-03-30 21:12:05 +02:00
Linus Rath
37bc88dbad
feat: implement force enable/disable functionality for plugins and themes
2026-03-26 18:59:30 +01:00
Linus Rath
29a222eef4
feat: add plugin/theme disable gates and move policy controls to their admin pages
...
- Add `pluginsEnabled` and `themesEnabled` master feature gates to FeatureGates
- Move theme policy UI (default theme, built-in/admin theme toggles, user uploads toggle) from policy page to themes admin page
- Add plugin policy UI (plugins enabled toggle) to plugins admin page
- Remove theme policy section and plugin/theme gates from policy page (with note directing to respective pages)
- Hide Themes and Plugins settings tabs when their feature gate is disabled
- Fix dark mode visibility of all admin toggle switches (bg-white → bg-background, increase off-state track opacity)
2026-03-25 00:44:04 +01:00
Linus Rath