diff --git a/CHANGELOG.md b/CHANGELOG.md index 36485da..dfe6d9d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,19 @@ Notable changes to Mailpit will be documented in this file. +## [v1.28.2] + +### Security +- Prevent Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to message data [CVE-2026-22689](https://github.com/axllent/mailpit/security/advisories/GHSA-524m-q5m7-79mm) + +### Feature +- Allow default mail addresses to be set when releasing message ([#594](https://github.com/axllent/mailpit/issues/594)) + +### Chore +- Remove webkit warnings about missing template / render functions +- Avoid empty URL query parameter when returning to inbox from message view + + ## [v1.28.1] ### Security diff --git a/server/ui-src/components/AppBadge.vue b/server/ui-src/components/AppBadge.vue index 2b4046d..1acf13b 100644 --- a/server/ui-src/components/AppBadge.vue +++ b/server/ui-src/components/AppBadge.vue @@ -53,5 +53,10 @@ export default { navigator.setAppBadge(this.mailboxUnread); }, }, + + render() { + // to remove webkit warnings about missing template or render function + return false; + }, }; diff --git a/server/ui-src/components/AppFavicon.vue b/server/ui-src/components/AppFavicon.vue index 190286d..ed7b044 100644 --- a/server/ui-src/components/AppFavicon.vue +++ b/server/ui-src/components/AppFavicon.vue @@ -112,5 +112,10 @@ export default { this.favicon.href = canvas.toDataURL("image/png"); }, }, + + render() { + // to remove webkit warnings about missing template or render function + return false; + }, }; diff --git a/server/ui-src/components/AppSettings.vue b/server/ui-src/components/AppSettings.vue index 838be74..fefe15d 100644 --- a/server/ui-src/components/AppSettings.vue +++ b/server/ui-src/components/AppSettings.vue @@ -14,6 +14,9 @@ export default { timezones, chaosConfig: false, chaosUpdated: false, + defaultReleaseAddressesOptions: localStorage.getItem("defaultReleaseAddresses") + ? JSON.parse(localStorage.getItem("defaultReleaseAddresses")) + : [], // set with default release addresses }; }, @@ -45,11 +48,13 @@ export default { mounted() { this.setTheme(); - this.$nextTick(() => { - Tags.init("select.tz"); - }); - mailbox.skipConfirmations = !!localStorage.getItem("skip-confirmations"); + mailbox.skipConfirmations = localStorage.getItem("skip-confirmations"); + + window.setTimeout(() => { + Tags.init("select.tz"); + Tags.init("select.default-release-addresses"); + }, 500); }, methods: { @@ -98,7 +103,7 @@ export default {
-
+ +
+
+ +
+ You can designate the default "send to" addresses here, which will automatically + populate the field in the message release dialog. This setting applies only to your + browser. If this field is left empty, it will revert to the original recipients of + the message. +
+ +
Invalid email address
+
+
+
[ad.toLowerCase(), ad])).values()])); - this.addresses = this.allAddresses; + // include default release addresses from mailbox settings + const defaultAddr = mailbox.defaultReleaseAddresses; + for (const i in defaultAddr) { + if (!this.allAddresses.includes(defaultAddr[i])) { + this.allAddresses.push(defaultAddr[i]); + } + } + + if (defaultAddr.length === 0) { + // prefill with all addresses if no default is set + this.addresses = this.allAddresses; + } else { + this.addresses = defaultAddr; + } }, methods: { @@ -140,6 +153,13 @@ export default {
Invalid email address
+
+ Default release addresses can be configured in + + + Settings . +
diff --git a/server/ui-src/stores/mailbox.js b/server/ui-src/stores/mailbox.js index a6973ed..35b3d22 100644 --- a/server/ui-src/stores/mailbox.js +++ b/server/ui-src/stores/mailbox.js @@ -20,6 +20,9 @@ export const mailbox = reactive({ appInfo: {}, // application information uiConfig: {}, // configuration for UI lastMessage: false, // return scrolling + defaultReleaseAddresses: localStorage.getItem("defaultReleaseAddresses") + ? JSON.parse(localStorage.getItem("defaultReleaseAddresses")) + : [], // default release addresses for released messages // settings showTagColors: !localStorage.getItem("hideTagColors"), @@ -82,6 +85,17 @@ watch( }, ); +watch( + () => mailbox.defaultReleaseAddresses, + (v) => { + if (v.length) { + localStorage.setItem("defaultReleaseAddresses", JSON.stringify(v)); + } else { + localStorage.removeItem("defaultReleaseAddresses"); + } + }, +); + watch( () => mailbox.timeZone, (v) => { diff --git a/server/ui-src/views/MessageView.vue b/server/ui-src/views/MessageView.vue index efd2fb9..09247dc 100644 --- a/server/ui-src/views/MessageView.vue +++ b/server/ui-src/views/MessageView.vue @@ -442,7 +442,11 @@ export default { if (pagination.limit !== pagination.defaultLimit) { p.limit = pagination.limit.toString(); } - this.$router.push("/?" + new URLSearchParams(p).toString()); + if (p.start || p.limit) { + this.$router.push("/?" + new URLSearchParams(p).toString()); + } else { + this.$router.push("/"); + } } }, @@ -455,7 +459,6 @@ export default { window.setTimeout(() => { // delay to allow elements to load / focus this.$refs.ReleaseRef.initTags(); - document.querySelector('#ReleaseModal input[role="combobox"]').focus(); }, 500); }, }, diff --git a/server/websockets/client.go b/server/websockets/client.go index 231008e..7902dae 100644 --- a/server/websockets/client.go +++ b/server/websockets/client.go @@ -34,8 +34,7 @@ var ( var upgrader = websocket.Upgrader{ ReadBufferSize: 1024, WriteBufferSize: 1024, - CheckOrigin: func(r *http.Request) bool { return true }, // allow multi-domain - EnableCompression: true, // experimental compression + EnableCompression: true, } // Client is a middleman between the websocket connection and the hub.