sysopsandClaude Sonnet 4.6 22cbfb5df6 fix(security): Email-Matching, LDAP-Validierung, Auditor-Isolation ...

- mailBelongsToUser: net/mail.ParseAddressList statt strings.Contains
  verhindert False-Positives durch Display-Namen in Mail-Headern
- LDAP mail-Attribut: net/mail.ParseAddress-Validierung vor Übernahme,
  Fallback auf username / username@ldap.local bei ungültiger Adresse
- handleSearch: Auditor-Rolle in userEmailFilter-Check eingeschlossen,
  sodass Auditoren im Search-Pfad dieselbe Mail-Isolation erhalten wie User

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-04-04 01:18:34 +02:00

..

admin_handlers.go

refactor: server.go in separate Handler-Dateien aufgeteilt

2026-03-18 11:55:21 +01:00

api_test.go

fix(security): behebe F-01/F-02/W-03/W-04 aus Security-Audit + PROJ-24 TOTP 2FA

2026-03-18 00:54:00 +01:00

auth_handlers.go

refactor: server.go in separate Handler-Dateien aufgeteilt

2026-03-18 11:55:21 +01:00

cert_handlers.go

feat: Dark Mode + Zertifikat-Verwaltung im Superadmin

2026-03-20 00:14:43 +01:00

dashboard_handlers.go

feat: Dashboard-Metriken nach Mailpiler-Vorbild (Uptime, Aktivität, Prognose)

2026-03-31 10:44:02 +02:00

export.go

fix(SEC-29): Rollen-Trennung Admins/Auditoren, domain_auditor Rolle

2026-03-31 01:09:19 +02:00

imap_settings_handlers.go

feat(PROJ-33): IMAP UID-Stabilität + Shared/Personal-Modus

2026-03-31 09:46:52 +02:00

import_handlers.go

fix(PROJ-30): ListFolders — c.Client statt c uebergeben (imap.Conn vs *imapclient.Client)

2026-04-03 21:21:20 +02:00

invite_handlers.go

feat(PROJ-28): Self-Service Onboarding — Signup, Verify, Password Reset, Invites

2026-03-31 21:54:11 +02:00

label_handlers.go

feat(PROJ-9): implement labels backend - DB schema, labelstore, API handlers, Xapian integration

2026-03-18 08:32:30 +01:00

ldap_sync.go

chore: weitere Code-Aufteilung (api.ts, hooks, ldap_sync)

2026-03-20 13:05:19 +01:00

ldap_tenants.go

chore: weitere Code-Aufteilung (api.ts, hooks, ldap_sync)

2026-03-20 13:05:19 +01:00

onboarding_handlers.go

fix(SEC): Signup-Enumeration durch Always-Send-Email schließen

2026-03-31 22:00:43 +02:00

profile_handlers.go

fix(security): W-02 Secure-Cookie-Flag + W-03 TrustedProxies für X-Forwarded-For

2026-03-18 01:10:24 +01:00

quota_handlers.go

feat(PROJ-29): Tenant-Quotas & Usage-Limits

2026-03-31 21:21:11 +02:00

retention_handlers.go

fix: retention_handlers.go — getSession/audlog.Log-Signatur korrigiert

2026-03-31 10:47:18 +02:00

search_handlers.go

fix(security): Email-Matching, LDAP-Validierung, Auditor-Isolation

2026-04-04 01:18:34 +02:00

server.go

feat(PROJ-30): Xapian → Manticore Search Migration

2026-04-03 21:19:36 +02:00

smtpout_handlers.go

feat(PROJ-28): SMTP-Out Relay — DB-Konfiguration + Admin-Tab

2026-03-31 22:36:57 +02:00

totp_handlers.go

fix(security): W-02 Secure-Cookie-Flag + W-03 TrustedProxies für X-Forwarded-For

2026-03-18 01:10:24 +01:00

upload.go

fix(security): behebe F-01/F-02/W-03/W-04 aus Security-Audit + PROJ-24 TOTP 2FA

2026-03-18 00:54:00 +01:00

version_handlers.go

feat: App-Version 0.9.1 + Modulversionsnummern

2026-03-31 01:12:51 +02:00