ghaymah_dev/postal
1
1
Fork 0
mirror of https://github.com/postalserver/postal.git synced 2026-10-18 18:26:06 +00:00
Code Issues Packages Projects Releases Wiki Activity
661 Commits 5 Branches 31 Tags
030e450a30f11ccbac4106b9ef32ac26234b500f
Commit Graph
13 Commits
Author SHA1 Message Date
Adam Cooke cad2aa6808 fix(messages): sandbox rendered email HTML as extra XSS defence 
The app-wide CSP already blocks inline script execution, but the HTML
preview iframe for a stored email was same-origin and un-sandboxed, and
the html_raw response had no per-action hardening. Add a sandbox on the
iframe and tighten the CSP on html_raw to script-src 'none' with
nosniff and no-referrer so the preview has defence in depth against a
future CSP bypass or regression.

Relates to GHSA-f6g9-8555-cw28.
 2026-04-24 22:12:27 +01:00
Adam Cooke ecd09a2445 chore: upgrade rails to 7.0 and other dependencies 2024-02-23 22:51:37 +00:00
Adam Cooke 870b26c2f2 refactor: move Postal::QueryString to app/util/query_string 2024-02-23 22:51:35 +00:00
Adam Cooke dc8e895bfe feat: new background work process 
This removes all previous dependencies on RabbitMQ and the need to run separate cron and requeueing processes.
 2024-02-23 22:51:33 +00:00
Adam Cooke 278ef0886a style(rubocop): Lint/SuppressedException 2024-02-12 09:55:18 +00:00
Adam Cooke 7590a46234 style(rubocop): Lint/UselessAssignment 2024-02-10 17:18:24 +00:00
Adam Cooke 0e4ed5ca03 style(rubocop): Layout/EmptyLineAfterMagicComment 2024-02-10 17:18:23 +00:00
Adam Cooke 6ab36c09c9 style(rubocop): Style/FrozenStringLiteralComment 2024-02-10 17:18:22 +00:00
Charlie Smurthwaite 1e3622c49a Consistently treat tinyint(1) fields in message database as booleans (#2380) 
* Update mysql2 query call to cast booleans

* Treat messages:held field as boolean

* Treat messages:inspected field as boolean

* Treat messages:spam field as boolean

* Treat messages:threat field as boolean

* Treat messages:bounce field as boolean

* Treat messages:received_with_ssl field as boolean

* Treat deliveries:sent_with_ssl field as boolean
 2023-03-22 13:49:48 +00:00
Charlie Smurthwaite fd289c46fd style(rubocop): fix all safe auto correctable offenses 2023-03-16 15:50:53 +00:00
Adam Cooke 5f88ee85bf make sure to use the user's time zone when composing test messages 2018-01-13 19:06:44 +00:00
Charlie Smurthwaite 53475abf55 always allow emails to be redelivered 2017-12-05 10:54:47 +00:00
Adam Cooke 2fdba0ceb5 initial commit from appmail 2017-04-19 13:07:25 +01:00