Adam Cooke cad2aa6808 fix(messages): sandbox rendered email HTML as extra XSS defence ...

The app-wide CSP already blocks inline script execution, but the HTML
preview iframe for a stored email was same-origin and un-sandboxed, and
the html_raw response had no per-action hardening. Add a sandbox on the
iframe and tighten the CSP on html_raw to script-src 'none' with
nosniff and no-referrer so the preview has defence in depth against a
future CSP bypass or regression.

Relates to GHSA-f6g9-8555-cw28.

2026-04-24 22:12:27 +01:00

..

address_endpoints

a sad sad day in postal-land, no more puns.

2017-05-02 13:33:17 +01:00

app_mailer

feat: new configuration system (and schema) (#2819)

2024-02-26 12:41:57 +00:00

credentials

fix: typo in the credentials page

2024-10-31 17:53:20 +00:00

domains

feat: new configuration system (and schema) (#2819)

2024-02-26 12:41:57 +00:00

help

feat: new configuration system (and schema) (#2819)

2024-02-26 12:41:57 +00:00

http_endpoints

Change seperate/seperately to separate/separately in 2 forms

2018-03-16 12:39:40 +00:00

ip_addresses

docs: update docs for how IP address allocation works

2024-02-23 22:51:35 +00:00

ip_pool_rules

fixes bug with IP rules list

2017-05-12 17:06:35 +01:00

ip_pools

feat: add priorities to IP address assignment

2021-07-28 14:18:40 +00:00

layouts

chore(ui): display branch in footer if present

2024-03-20 14:30:32 +00:00

messages

fix(messages): sandbox rendered email HTML as extra XSS defence

2026-04-24 22:12:27 +01:00

organization_ip_pools

a sad sad day in postal-land, no more puns.

2017-05-02 13:33:17 +01:00

organizations

fix: don't use authentication on org & server deletion

2024-03-14 14:14:59 +00:00

routes

Minor typo fix

2019-02-25 11:49:18 +00:00

servers

fix: don't use authentication on org & server deletion

2024-03-14 14:14:59 +00:00

sessions

feat: openid connect support (#2873)

2024-03-12 17:40:07 +00:00

shared

initial commit from appmail

2017-04-19 13:07:25 +01:00

smtp_endpoints

a sad sad day in postal-land, no more puns.

2017-05-02 13:33:17 +01:00

track_domains

fix: update wording about tracking domain cnames

2024-03-04 16:55:36 +00:00

user

feat: openid connect support (#2873)

2024-03-12 17:40:07 +00:00

users

feat: openid connect support (#2873)

2024-03-12 17:40:07 +00:00

webhooks

a sad sad day in postal-land, no more puns.

2017-05-02 13:33:17 +01:00