Paulhenry Saux
7969fd09eb
fix(plugins): prevent a privileged plugin to get PRF secret of another privileged plugin
2026-07-29 11:30:12 +02:00
Paulhenry Saux
2245ad2024
fix(plugins): use correct method name for message errors in host-api.ts
2026-07-22 20:28:32 +02:00
Paulhenry Saux
7bf62e4bdc
feat: add contact methods in plugin API
2026-07-22 19:34:45 +02:00
Linus Rath
5105e000f5
feat: add message-list category tabs
2026-07-22 17:22:20 +02:00
Paulhenry Saux
07c473e057
feat: add new plugin ui.rerenderFetchedEmails method
2026-07-22 13:39:21 +02:00
Paulhenry Saux and Linus Rath
b4739c111f
feat: add new plugin API to submit without moving to box mail and import to box
2026-07-21 20:55:52 +02:00
Paulhenry Saux and Linus Rath
a679d82cc3
feat: add download file method for files generated by plugin
2026-07-13 21:18:36 +02:00
Paulhenry Saux and Linus Rath
a08a9e9ed3
feat(plugins) : add new api api method : webauthn.getOrCreate
2026-07-13 21:17:45 +02:00
Linus Rath
d3f77ef9cf
feat: add plugin ui.rerenderEmail API and restyle read-receipt banner
2026-07-09 16:04:33 +02:00
Linus Rath
5ccba83129
Merge branch 'main' of https://github.com/bulwarkmail/webmail
...
# Conflicts:
# lib/plugin-sandbox/host-api.ts
2026-07-09 14:57:36 +02:00
752e71198c
feat: add 3 new plugin hooks : onBeforeBlobUpload, onBeforeDraftAutoSave, onBeforeEditDraft ( #586 )
...
Co-authored-by: Linus Rath <minipixxelinfo@gmail.com >
2026-07-09 14:55:34 +02:00
Linus Rath
9ab7339320
feat: add plugin ui.prompt dialog and first-class settings-section tabs
2026-07-09 14:51:17 +02:00
Linus Rath
512adab7e3
feat: add privileged same-origin plugin tier + crypto API surface
2026-06-28 16:51:42 +02:00
dealerweb and Linus Rath
f0d87d594a
Fix: honour basePath in plugin sandbox, http.post proxy, and branding
...
Upstream 1.7.2 prefixes most hand-written URLs with basePath via apiFetch /
withBasePath, but four subpath-relevant spots were missed:
- host-bridge: the sandbox iframe src was a bare "/plugin-sandbox" -> 404
under NEXT_PUBLIC_BASE_PATH, breaking all plugins. Wrap in withBasePath.
- host-api doHttpPost: the same-origin /api/* plugin proxy used raw fetch on
url.pathname -> 404 under a subpath. Route it through apiFetch.
- admin branding preview <img>: unprefixed src -> broken thumbnail.
- (sandbox) layout: drop the Geist font + globals.css imports. The sandbox
runs with an opaque origin, so those assets are CORS-blocked; the plugin
bundle and all host API calls travel over the postMessage bridge, so no
same-origin asset fetch happens there.
2026-05-30 15:31:08 +02:00
Linus Rath
fc5f6f43d6
feat: expose PWA, app identity, and extension directory keys in JSON config #312
2026-05-21 23:35:58 +02:00
Linus Rath
400703154e
fix: ignore plugin-supplied target in ui.openExternalUrl to block host-frame hijack
2026-05-18 16:18:00 +02:00
Linus Rath
48aa607b56
feat: lock down plugin runtime in sandbox + signing + approval
2026-05-18 12:44:23 +02:00
Linus Rath
088810bd20
feat: harden plugin sandbox and migrate in-tree plugins
2026-05-18 12:17:54 +02:00
Linus Rath
9f312aa556
feat: sandbox plugins in null-origin iframes with postMessage RPC
2026-05-18 10:50:49 +02:00
Paulhenry Saux