| - Installer: Add possibility to detsroy the installer session/cookie |
alec
as Aleksander Machniak
|
More...
|
6 days ago
|
| Update changelog |
alec
as Aleksander Machniak
|
More...
|
6 days ago
|
| CI: Use php 8.5 not 8.5-rc for the docker image |
alec
as Aleksander Machniak
|
More...
|
7 days ago
|
| CS fixes |
alec
as Aleksander Machniak
|
More...
|
7 days ago
|
| Fix SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4 addresses |
alec
as Aleksander Machniak
|
More...
|
7 days ago
|
| Fix remote-content blocker bypass via SVG SMIL src animation |
alec
as Aleksander Machniak
|
More...
|
7 days ago
|
| Fix remote content blocking bypass via CSS escapes in FuncIRI attributes |
alec
as Aleksander Machniak
|
More...
|
7 days ago
|
| Fix is_local_url() bypass via trailing-dot FQDN in stylesheet URL |
alec
as Aleksander Machniak
|
More...
|
7 days ago
|
| Fix cross-user access in contact group membership (add/remove) in the SQL address book |
alec
as Aleksander Machniak
|
More...
|
7 days ago
|
| Fix XSS in the HTML editor using text/enriched part content |
alec
as Aleksander Machniak
|
More...
|
7 days ago
|
| Fix zero-click stored XSS via TNEF MIME tag injection in the attachment URL |
alec
as Aleksander Machniak
|
More...
|
7 days ago
|
| Fix email header injection via identity's organization field |
alec
as Aleksander Machniak
|
More...
|
7 days ago
|
| Fix email header injection via C-escape \r in the recipient display name |
alec
as Aleksander Machniak
|
More...
|
7 days ago
|
| Fix email header injection via bare CR in subject Field |
alec
as Aleksander Machniak
|
More...
|
7 days ago
|
| Fix CSS property injection via body `background` attribute |
alec
as Aleksander Machniak
|
More...
|
7 days ago
|
| Fix CSS declaration smuggling via un-encoded ampersand emission |
alec
as Aleksander Machniak
|
More...
|
7 days ago
|
| zipdownload: Fix attachment filename sanitisation of backslash and control characters (#10325) |
alec
as Aleksander Machniak
|
More...
|
7 days ago
|
| Fix unnecessary hook registration/execution even when all newmail_notifier notification types are disabled (#10324) |
alec
as Aleksander Machniak
|
More...
|
7 days ago
|
| Fix BG localization of "Archive" folder name (#10310) |
alec
as Aleksander Machniak
|
More...
|
7 days ago
|
| Fix undefined variable in a rare case (#10301) |
alec
as Aleksander Machniak
|
More...
|
7 days ago
|
| Small code de-duplication |
alec
as Aleksander Machniak
|
More...
|
10 days ago
|
| Wrap html2text-converted text in plain message-part, not html (#10316) |
|
More...
|
10 days ago
|
| Drop two php-cs-fixer rules that a later duplicate key already overrides (#10318) |
|
More...
|
10 days ago
|
| Tests: MessageMock |
alec
as Aleksander Machniak
|
More...
|
18 days ago
|
| Password: Fix undefined array key warning when _curpasswd is not posted (#10309) |
|
More...
|
21 days ago
|
| Add CVE ids (#10311) |
|
More...
|
21 days ago
|
| Use `X-Content-Type-Options:nosniff` for attachment previews and downloads (#10308) |
alec
as Aleksander Machniak
|
More...
|
28 days ago
|
| Code improvements (#10306) |
|
More...
|
28 days ago
|
| Remove unused variable n (#10302) |
|
More...
|
28 days ago
|
| move LICENSE.md back to root so GitHub recognises it (#10299) |
|
More...
|
about 1 month ago
|
