Ralph Slooten
9c2359eee5
Feature: Add filter functionality to message headers tab
...
This implementation is based on, and resolves, #626
2026-03-22 17:40:54 +13:00
Ralph Slooten
7b22d6a5f9
Fix: Refactor webhook delay & rate limit logic to ignore endpoint response times & prevent hardcoded 1000 message limit when set to 0 ( #656 )
2026-03-16 22:29:45 +13:00
Ralph Slooten
70037e96f4
Chore: Update Content-Disposition header to use inline display and escape filename
2026-03-10 12:03:35 +13:00
Ralph Slooten
140633718c
Chore: Limit subject length to 100 characters in browser notifications
2026-03-10 11:31:21 +13:00
Ralph Slooten
f40911c580
Security: Escape ContentID in HTML replacement to prevent regex injection
2026-03-10 11:27:47 +13:00
Ralph Slooten
3073ef9afe
Chore: Replace localStorage retrieval with a dedicated function for default release addresses
2026-03-10 11:20:33 +13:00
Ralph Slooten
804d49b7ca
Chore: Set margin & padding to HTML screenshot to prevent transparent top/left border
2026-03-10 11:09:28 +13:00
Ralph Slooten
7d29dff5e7
Security: Enhance HTML sanitization in screenshot generation
2026-03-10 10:24:40 +13:00
Ralph Slooten
bc8a737d4f
Chore: Simplify HTML decoding function in screenshot generation using DOMParser
2026-03-10 10:04:47 +13:00
Ralph Slooten
b99be839a0
Security: Enhance HTML sanitization in message view
2026-03-10 10:02:10 +13:00
Ralph Slooten
a72d42c8d4
Chore: Set timeout for HTTP client in webhook Send function
2026-03-09 12:34:50 +13:00
Ralph Slooten
f8052e1d56
Security: Limit proxy requests to 50MB to prevent OOM attacks
2026-03-09 12:31:17 +13:00
Ralph Slooten
267bf8b639
Security: Enhance CORS origin handling to respect host:port distinctions
2026-03-09 12:30:56 +13:00
Ralph Slooten
bb6bdf629d
Chore: Refactor events websocket middleware
2026-03-09 11:20:45 +13:00
Ralph Slooten
a0a4ebb943
Chore: Refactor API send authentication logic
2026-03-09 11:08:19 +13:00
Ville Skyttä
2afc52c6fe
Chore: Refactor code with go fix
...
Done with `go fix ./...` using go 1.26.0.
2026-03-03 16:03:28 +13:00
Ralph Slooten
7bb330a07a
Chore: Use last release + git hash in Docker edge versions
2026-03-02 22:38:38 +13:00
Ralph Slooten
10ad4df8cc
Security: Prevent Server-Side Request Forgery (SSRF) via Link Check API ([GHSA-mpf7-p9x7-96r3]( https://github.com/axllent/mailpit/security/advisories/GHSA-mpf7-p9x7-96r3 ))
...
By default all internal HTTP requests are now blocked, unless mailpit is started with the `--allow-internal-http-requests` flag (env `MP_ALLOW_INTERNAL_HTTP_REQUESTS=true`).
2026-02-24 14:22:02 +13:00
Ralph Slooten
08ed46fc46
Use const instead of let
2026-02-21 22:43:51 +13:00
Ralph Slooten
c8caa29e24
Fix: Enable "Mark all read" button (Inbox) when new message is received
2026-02-09 15:38:11 +13:00
Ralph Slooten
7d314d2b50
Chore: Add CORS error logging and update error messages for failed CORS requests
2026-02-08 11:19:54 +13:00
Ralph Slooten
9d2f30787a
Fix spelling
2026-02-08 11:17:17 +13:00
Ralph Slooten
e6fd638067
Detect if copy to clipboard is supported
2026-02-01 16:09:49 +13:00
Ralph Slooten
e2b1b2d0fe
Code cleanup
2026-02-01 15:58:31 +13:00
Ralph Slooten
9b4ec97483
Minor UI tweaks
2026-02-01 15:44:13 +13:00
Ralph Slooten
dd74d46880
Feature: Option to display/hide attachment information in message view in web UI including checksums, content type & disposition
...
Resolves #625
2026-02-01 15:34:06 +13:00
Ralph Slooten
0bfbb4cc5f
Feature: Include message attachment checksums (MD5, SHA1 & SHA254) in API message summary
2026-02-01 15:34:05 +13:00
Roman Urbanovich
9391b075d0
Chore: Add support for webhook delay ( #627 )
2026-02-01 15:33:54 +13:00
Ralph Slooten
8d18618e4a
Test: Add CORS tests
2026-02-01 15:33:53 +13:00
Ralph Slooten
a63bcd9bd3
Chore: Add support for multi-origin CORS settings and apply to events websocket ( #630 )
2026-02-01 15:33:53 +13:00
Ralph Slooten
b9f36312d7
Fix: Avoid error on image type assertion in thumbnail generation
...
Use imaging.Clone to ensure the image is always *image.NRGBA, preventing panics when decoding non-NRGBA images (e.g., JPEGs as *image.YCbCr).
2026-01-25 10:05:39 +13:00
Ralph Slooten
7cda4a36f1
Chore: Allow @ character in message tags & set max length to 100 characters per tag
2026-01-17 11:12:45 +13:00
Ralph Slooten
3108d82e06
Fix: Correctly render default addresses in release modal after settings change ( #594 )
2026-01-10 22:19:18 +13:00
Ralph Slooten
c5c9292863
More reliable handling for default release email editing
2026-01-10 15:56:19 +13:00
Ralph Slooten
6f1f4f34c9
Security: Prevent Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to message data [CVE-2026-22689]( https://github.com/axllent/mailpit/security/advisories/GHSA-524m-q5m7-79mm )
2026-01-10 15:42:14 +13:00
Ralph Slooten
877a9159ce
Delay bootstrap-tags init until after render
2026-01-08 16:23:24 +13:00
Ralph Slooten
c4582889ad
Update default release address wording
2026-01-08 16:20:00 +13:00
Ralph Slooten
392904fd23
Chore: Avoid empty URL query parameter when returning to inbox from message view
2026-01-08 16:03:35 +13:00
Ralph Slooten
f0160c0e29
Feature: Allow default mail addresses to be set when releasing message ( #594 )
2026-01-08 16:03:35 +13:00
Ralph Slooten
f9024d1f77
Chore: Remove webkit warnings about missing template / render functions
2026-01-08 16:03:34 +13:00
Ralph Slooten
3b9b470c09
Security: Restrict screenshot proxy to only support asset links contained in messages [CVE-2026-21859]( https://github.com/axllent/mailpit/security/advisories/GHSA-8v65-47jx-7mfr )
...
This fix prevents unrestricted network probing via the screenshot proxy by limiting requests to images, fonts and CSS links found within a message, and returns a generic HTTP error to the client when unsupported content types are requested, not found, or otherwise disallowed.
See CWE-918 Server-Side Request Forgery (SSRF)
2026-01-06 15:33:50 +13:00
Ralph Slooten
93088f3361
Chore: Add type assertion for value in imaging assignment
2025-11-09 11:33:51 +13:00
Ralph Slooten
5ad8619893
Fix: Prevent potential information disclosure via indirect expvar library (Prometheus)
...
This is a security fix which prevents potential information disclosure due to a pre-registered HTTP route. The Prometheus client imports the go stdlib expvar, which in turn is auto-registers `/debug/vars` on the default servemux. This fix ensures no default/global routes are inherited via the http library.
2025-10-08 17:32:05 +13:00
Ralph Slooten
99ab38fbba
Chore: Add tooltip to messages nav dropdown
2025-10-08 17:32:05 +13:00
Ralph Slooten
ae65312d02
Chore: Update navbar theme to use data-bs-theme attribute for consistency
2025-09-26 14:50:27 +12:00
Ralph Slooten
0770bd8d19
Chore: Add margin to icons in release and delete buttons for consistent spacing
2025-09-26 14:50:06 +12:00
Ralph Slooten
e2314fb3b9
Chore: UI tweaks to pagination layout for clearer navigation ( #568 )
2025-09-26 14:48:51 +12:00
Ralph Slooten
5a4d13b15a
Security: Prevent integer overflow conversion to uint64
2025-07-25 20:33:27 +12:00
Ralph Slooten
2a7aa33a0a
Fix: Do not check latest release for Prometheus statistics ( #522 )
2025-07-25 20:33:20 +12:00
Ralph Slooten
cce21854b9
Chore: Refactor JS functions and remove unused parameters
2025-07-24 17:27:11 +12:00
