src-advisory/SRCmail
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
805 Commits 8 Branches 39 Tags
dfe886636b40e0748912ce00a2e2334a6456c130
Commit Graph
59 Commits
Author SHA1 Message Date
Linus Rath f499e87d2a chore: update version to 1.6.5 2026-05-13 14:38:00 +02:00
Linus Rath 869ee07ebc chore: bump next to 16.2.6 for security advisories 2026-05-11 20:11:05 +02:00
Linus Rath 2ad2bb1e09 chore: update version to 1.6.4 2026-05-11 20:00:55 +02:00
Linus Rath 090399a308 chore: update version to 1.6.3 2026-05-08 21:10:21 +02:00
Linus Rath 178922323d chore: update version to 1.6.2 2026-05-06 20:07:36 +02:00
Linus Rath 1b0ca8967e feat: bundle plugin src/ on demand via esbuild 2026-05-05 18:35:22 +02:00
Linus Rath d1c5dba7d7 chore: update version to 1.6.1 2026-05-04 12:34:53 +02:00
Linus Rath 4be7176802 chore: update version to 1.6.0 2026-05-01 21:56:53 +02:00
Linus Rath 6a8ad525f1 chore: update version to 1.5.4 2026-05-01 02:17:33 +02:00
Linus Rath 25de7d996c feat: add tables to composer #236 2026-04-30 15:16:51 +02:00
Linus Rath 8935b81f12 chore: update version to 1.5.3 2026-04-28 17:34:06 +02:00
Linus Rath fe1d4861bb feat: composer-sidebar slot + plugin-declared frame-src origins 2026-04-25 18:40:54 +02:00
Linus Rath 0913dbd3e4 chore: update version to 1.5.1 2026-04-25 16:34:45 +02:00
Linus Rath 16fe92d2e9 chore: update version to 1.5.0 2026-04-22 23:31:32 +02:00
Linus Rath 3544e6a9e7 chore: bump dependencies to latest compatible versions 2026-04-22 23:03:05 +02:00
Linus Rath 794001fdbd feat: migrate Stalwart management API to JMAP x: methods (0.16) 
Drops the 0.15 REST management API and routes all account/auth/crypto/
principal operations through Stalwart 0.16's schema-driven JMAP
endpoint via a single passthrough (/api/account/stalwart/jmap).

- New client helper `stalwartJmap` + typed `requireResult`
- account-security-store rewritten against x:AccountPassword, x:AppPassword,
  x:AccountSettings, x:Account (with currentSecret for TOTP ops)
- Client-side TOTP setup via `otpauth`; server-generated app password
  secrets shown once on create
- Admin check switched to /api/account permissions
  (sysAccountQuery/sysTenantQuery/sysSystemSettingsGet)
- Removed sieve vacation-overwrite workaround (fixed upstream #1251)
- Deleted old REST routes, StalwartClient, stale tests; added new
  tests for passthrough + store
 2026-04-21 17:29:23 +02:00
Linus Rath 8bdadc7ba3 fix: standardize punctuation 2026-04-16 19:07:42 +02:00
Linus Rath e63ce25f5f chore: update version to 1.4.14 2026-04-16 18:59:23 +02:00
Linus Rath b9c9901643 chore: update version to 1.4.13 2026-04-12 02:13:55 +02:00
Linus Rath 23870801fc chore: update version to 1.4.12 2026-04-09 20:04:06 +02:00
Linus Rath be2e0f2b68 chore: update version to 1.4.11 2026-03-31 18:24:25 +02:00
Linus Rath aa40c8be26 fix: harden proxy auth and SSRF defenses 2026-03-31 17:47:09 +02:00
Linus Rath 68214c3e91 chore: update version to 1.4.10 2026-03-31 00:51:36 +02:00
Linus Rath 9b25b6d03e fix: adjust contact and calendar page for mobile layout #103 2026-03-26 16:30:20 +01:00
Linus Rath 76b21147e4 feat: add plugin/theme harness and admin dashboard 
Plugin & Theme System:
- Add plugin type definitions, permissions (30+), and validation constants
- Add IndexedDB storage layer for plugin code, theme CSS, and previews
- Add theme CSS sanitization, injection, and safety validation
- Add HookBus event system with 130+ hooks across 20 domains
- Add plugin ZIP extraction and manifest validation with JS security checks
- Add sandboxed PluginAPI factory with scoped storage, logging, and permission gating
- Add plugin loader with blob URL dynamic import and auto-disable circuit breaker
- Add 3 built-in themes (Nord, Catppuccin, Solarized)
- Add Zustand plugin store with install/uninstall/enable/disable lifecycle
- Add PluginSlot, PluginSlotRenderer, and PluginErrorBoundary components
- Add plugins and themes settings UI panels
- Integrate plugin slots into email viewer, composer, navigation rail, sidebar, and context menu
- Extend theme store with custom theme installation and activation

Admin Dashboard:
- Add admin authentication with scrypt password hashing and AES-256-GCM sessions
- Add rate-limited login (5 attempts/15min per IP)
- Add config manager with admin override > env var > default priority
- Add settings policy system with feature gates and per-setting restrictions
- Add audit logging with rotation
- Add admin API routes (login, logout, config, policy, audit, password change)
- Add admin UI pages (login, dashboard, config, policy, audit)
- Add policy store for client-side feature gate enforcement
- Wire admin password initialization into server instrumentation

Tests:
- Add 139 tests across 10 test files covering all plugin/theme modules
 2026-03-25 00:44:03 +01:00
Linus Rath 55c8d430ca chore: update version to 1.4.8 2026-03-23 16:59:24 +01:00
Linus Rath f7ee204262 feat: add support for marking emails as answered or forwarded and update UI accordingly 2026-03-23 15:45:37 +01:00
Linus Rath 31eee4bab9 chore: bump version to 1.4.7 2026-03-21 20:45:57 +01:00
Linus Rath df272e38ef feat: add resizable image component and rich text editor with image upload support 2026-03-21 20:45:23 +01:00
Linus Rath 6ed8ae5812 chore: bump version to 1.4.6 2026-03-21 03:08:19 +01:00
Linus Rath d68b81e6b8 chore: bump version to 1.4.5 2026-03-20 18:10:00 +01:00
Linus Rath 0c9e60db8b fix: update flatted to 3.4.2 2026-03-19 19:01:40 +01:00
Linus Rath 44896dee3e chore: bump version to 1.4.4 2026-03-19 18:12:16 +01:00
Linus Rath 2edf2fab89 chore: bump version to 1.4.3 2026-03-19 10:16:47 +01:00
Linus Rath fb8c9db716 chore: bump version to 1.4.2 2026-03-19 01:38:23 +01:00
Linus Rath 5a3f9faafe fix: update dompurify to version 3.3.3 and elliptic to version 6.6.1, add undici override 2026-03-18 16:10:47 +01:00
Linus Rath 38c04099e2 Bump version to 1.4.1 2026-03-18 15:42:37 +01:00
Linus Rath 8a2ef5a6c5 feat: integrate webcrypto-liner for legacy algorithm support in S/MIME handling 2026-03-18 14:29:29 +01:00
Linus Rath 84abfe79dd feat: update changelog for version 1.4.0 with new features and fixes 
feat: update README.md to reflect version 1.4.0 and new features
chore: bump version to 1.4.0 in VERSION and package files
feat: implement identity refresh behavior in identity management
feat: add TNEF support for Outlook emails and archive organization modes
feat: enhance UI with configurable sidebar apps and branding options
refactor: remove unused addon-plugin-theme-concept.md file
 2026-03-18 00:18:48 +01:00
Linus Rath 070eeeecee feat: add translation key collection utility and update test for completeness 2026-03-17 20:20:44 +01:00
Linus Rath de35d1d8e8 feat: add S/MIME store for managing key records and public certificates 
- Implemented Zustand store for S/MIME functionality, including state management for key records and public certificates.
- Added methods for importing PKCS#12 files and public certificates, binding identities to keys, and managing unlocked keys.
- Introduced session storage for remembering unlocked keys across sessions.
- Enhanced error handling and loading states during data operations.
 2026-03-17 20:14:01 +01:00
Linus Rath 54f4d37595 fix: update author information in package.json 2026-03-17 15:14:06 +01:00
Linus Rath a834528bc1 chore: update version to 1.3.0 and enhance changelog with new features and fixes 2026-03-16 22:58:13 +01:00
Linus Rath 119bfed1eb feat: update licensing information to AGPL-3.0-only and add NOTICE file for fork lineage 2026-03-16 16:46:45 +01:00
Linus Rath 86673a7b45 chore: update version to 1.2.4 2026-03-14 17:17:22 +01:00
Linus Rath 099434a125 chore: release v1.2.3 
Bump version to 1.2.3 across package.json, VERSION, README badge,
and login page. Add changelog entry for features and fixes since v1.1.2.
 2026-03-13 14:48:32 +01:00
Linus Rath e85d0b946e chore: rename JMAP Webmail to Bulwark Webmail and update all URLs 2026-03-13 13:14:08 +01:00
Matthieu MALVACHEandMatthieu MALVACHE 58b9b70871 fix: resolve context menu submenu and move-to-folder issues (#19) 2026-03-02 09:10:03 +01:00
Matthieu MALVACHEandMatthieu MALVACHE 92620fb790 fix: details toggle UX, Edge Runtime warnings, minimatch CVE 
- Keep show/hide details button in place when expanded (#18)
- Use i18n translations for details toggle text
- Split instrumentation for Edge Runtime compatibility
- Patch minimatch ReDoS (CVE-2026-27903)
 2026-02-28 21:03:02 +01:00
Matthieu MALVACHEandMatthieu MALVACHE a3fe9deaa6 feat: add server-side version update check 
Logs current version on startup and checks GitHub for newer releases.
Only runs in production, output stays in server logs (no client exposure).
 2026-02-28 14:59:11 +01:00