Ralph Slooten 78fa3db33e Don't print allowed CORS origins when there are none (empty)

2026-06-11 16:22:24 +12:00

..

apiv1

Security: Extend request body size cap to all JSON API endpoints (GHSA-28pq-6qxg-wg5r)

2026-05-28 19:41:32 +12:00

handlers

Security: Fix concurrent map read & write in proxy CSS rewriter (GHSA-w4vj-r5pg-3722)

2026-05-14 15:02:07 +12:00

ui

Feature: Include message attachment checksums (MD5, SHA1 & SHA254) in API message summary

2026-02-01 15:34:05 +13:00

ui-src

Feature: New loading indicator, reduce flash during message transitions (#682)

2026-05-12 15:27:12 +12:00

webhook

Fix: Refactor webhook delay & rate limit logic to ignore endpoint response times & prevent hardcoded 1000 message limit when set to 0 (#656)

2026-03-16 22:29:45 +13:00

websockets

Handle error in writePump when sending ping messages

2026-05-09 17:06:14 +12:00

cors_test.go

Security: Enhance CORS origin handling to respect host:port distinctions

2026-03-09 12:30:56 +13:00

cors.go

Don't print allowed CORS origins when there are none (empty)

2026-06-11 16:22:24 +12:00

embed.go

Fix: Include font/woff content type to embedded controller

2025-02-13 22:16:46 +13:00

server_test.go

Security: Set a default 50MB p/m limit to prevent DoS via unlimited SMTP DATA and /api/v1/send body sizes (GHSA-fpxj-m5q8-fphw)

2026-05-12 17:22:00 +12:00

server.go

Security: Extend request body size cap to all JSON API endpoints (GHSA-28pq-6qxg-wg5r)

2026-05-28 19:41:32 +12:00