-
v0.1.2 — security audit follow-ups Pre-release
released this
2026-05-20 17:51:20 +02:00 | 101 commits to main since this releasePre-release. Hardening follow-ups from the post-public-release security audit. No data migrations, no schema changes — safe to upgrade in place.
What changed
- Captcha fails closed on misconfiguration. When a configured captcha route can't resolve (deleted identity, inactive identity, AUTH_KEY rotated since credentials were saved), submissions are now rejected with a clear error message instead of silently passing — the previous behaviour let bots bypass a captcha the admin thought was active.
- Admin notice for broken captcha routes. A persistent warning banner now appears on every admin page when any routing-map entry can't resolve, with a one-click link to the Captcha settings page. Admins learn about misconfiguration immediately instead of via support tickets.
- Defense-in-depth CR/LF stripping on email resend.
Resender::build_headers()now sanitises every stored header component before reconstructing outbound headers. Not exploitable today (PHPMailer normalises on the way in) but the same code path will be reused by the upcoming IMAP-save / mail-receive features which will introduce attacker-controlled data into those columns — closing the vector now.
Upgrade
Drop-in. No DB changes, no settings changes, no feature toggles.
If the upgrade surfaces a "Captcha misconfiguration" admin notice immediately after activation, that's the new health check doing its job — open the Captcha settings page and either re-pick a working challenge or re-enter the affected provider's credentials.
Downloads
-
Source code (ZIP)
0 downloads
-
Source code (TAR.GZ)
0 downloads