Luca c8cb4c88ca harden(messages): SSRF guard on mailbox host, strict sandbox + sanitizer, per-account TLS ...

Pre-upstream review hardening:
- /accounts + /accounts/test now reject private/internal IMAP/SMTP hosts via
  isPrivateIP(), matching /config + /incoming-config (SSRF).
- QueueDetail body iframe uses sandbox="" (script-less, no same-origin) like the
  inbound pane, instead of allow-same-origin.
- /send sanitizer drops the <style> tag + data: scheme to match the stricter
  inbound sanitizeBody allowlist.
- Per-account SMTP transport sets tls.rejectUnauthorized explicitly.

2026-07-07 16:04:11 +02:00

..

__tests__

Merge remote-tracking branch 'origin/main' into refactor/codebase-cleanup

2026-07-03 11:54:01 +02:00

assets/fonts

feat(crm): backend code — services + routes + utilities + tests

2026-05-26 18:18:51 +02:00

docs

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

migrations

fix(messages): dynamic addresses, branding accent, compose/sync, per-identity SMTP

2026-07-07 11:58:41 +02:00

scripts

feat(auth): admin TOTP MFA — enrollment, login challenge, recovery, CLI reset

2026-07-03 11:33:38 +02:00

src

harden(messages): SSRF guard on mailbox host, strict sandbox + sanitizer, per-account TLS

2026-07-07 16:04:11 +02:00

.dockerignore

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

.env.example

feat(auth): admin TOTP MFA — enrollment, login challenge, recovery, CLI reset

2026-07-03 11:33:38 +02:00

.eslintrc.js

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

audit-backend.json

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

dependencies-backend.json

Upgrade nodemailer to 7.0.7 (GHSA-mm7p-fcc7-pg87)

2025-10-13 21:11:38 +02:00

Dockerfile

chore(security): bump backend npm 10 -> 11 to patch bundled sigstore/tar

2026-07-02 17:16:09 +02:00

Dockerfile.dev

fix(security): scan triage cleanup — drop dead deps, harden Docker/nginx/postMessage

2026-05-07 22:31:51 +02:00

ecosystem.config.js

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

jest.config.js

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

jest.setup.js

feat: overhaul public landing page and backup tooling

2025-09-19 16:39:18 +02:00

knexfile.js

Fix PicPeak regressions and close #22 #24 #25 #26 #27 #28

2025-09-21 22:03:07 +02:00

package-lock.json

feat(auth): admin TOTP MFA — enrollment, login challenge, recovery, CLI reset

2026-07-03 11:33:38 +02:00

package.json

chore(main): release 3.82.3-beta.0 (#758)

2026-07-06 09:53:29 +00:00

server.js

feat(setup): validate setup token at step 1 before advancing

2026-07-02 15:18:22 +02:00

test-filter.js

docs: fix deployment/admin routing and CORS guidance; add AGENTS.md; ignore AGENTS.md (refs #18)

2025-09-05 15:01:16 +02:00

wait-for-db.sh

feat: zero-config first run — in-browser admin bootstrap + auto-generated secrets

2026-07-01 14:49:18 +02:00