sysops f32f83ff8e fix(PROJ-28): Invite-Token Pflicht bei Signup — TOCTOU + Enumeration-Leak schließen ...

- Signup ohne Invite-Token gibt 400 zurück (war: optional)
- Use() statt Peek() vor User-Erstellung: verhindert TOCTOU bei parallelen
  Requests mit demselben Token und Enumeration via "Token noch gültig?"
- invite_used Audit-Eintrag ergänzt
- Doppeltes IsConfigured()-Check entfernt
- Frontend: ohne ?invite= im URL wird Formular nicht gerendert

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-29 18:20:07 +02:00

..

admin_handlers.go

chore: Modulname github.com/archivmail → archivmail

2026-04-05 20:37:35 +02:00

api_test.go

chore: Modulname github.com/archivmail → archivmail

2026-04-05 20:37:35 +02:00

apikey_handlers.go

feat(PROJ-13,PROJ-42): REST API v1 + Gespeicherte Suchanfragen

2026-04-06 10:54:26 +02:00

auth_handlers.go

chore: Modulname github.com/archivmail → archivmail

2026-04-05 20:37:35 +02:00

cert_handlers.go

fix(sec): Authorization-Bypässe und Path-Traversal schließen, Xapian-Doku bereinigen

2026-05-28 23:55:31 +02:00

dashboard_handlers.go

feat(PROJ-40,PROJ-41): Prometheus Metriken + Dashboard Zeitreihe

2026-04-05 21:10:42 +02:00

ediscovery.go

fix(PROJ-39): sanitizeFilename-Konflikt beheben — in ediscovery.go umbenannt

2026-04-05 20:56:27 +02:00

export.go

chore: Modulname github.com/archivmail → archivmail

2026-04-05 20:37:35 +02:00

imap_settings_handlers.go

chore: Modulname github.com/archivmail → archivmail

2026-04-05 20:37:35 +02:00

import_handlers.go

chore: Modulname github.com/archivmail → archivmail

2026-04-05 20:37:35 +02:00

invite_handlers.go

chore: Modulname github.com/archivmail → archivmail

2026-04-05 20:37:35 +02:00

ldap_sync.go

chore: Modulname github.com/archivmail → archivmail

2026-04-05 20:37:35 +02:00

ldap_tenants.go

chore: Modulname github.com/archivmail → archivmail

2026-04-05 20:37:35 +02:00

metrics_handlers.go

feat(PROJ-40,PROJ-41): Prometheus Metriken + Dashboard Zeitreihe

2026-04-05 21:10:42 +02:00

ocr_handlers.go

fix(PROJ-44): OCR-Tenant-Routing nutzt kanonische DB-tenant_id

2026-05-10 23:13:57 +02:00

onboarding_handlers.go

fix(PROJ-28): Invite-Token Pflicht bei Signup — TOCTOU + Enumeration-Leak schließen

2026-05-29 18:20:07 +02:00

openapi.yaml

feat(PROJ-13): OpenAPI 3.0 Spec + GET /api/v1/docs Endpoint

2026-05-29 18:03:58 +02:00

profile_handlers.go

chore: Modulname github.com/archivmail → archivmail

2026-04-05 20:37:35 +02:00

quota_handlers.go

chore: Modulname github.com/archivmail → archivmail

2026-04-05 20:37:35 +02:00

retention_handlers.go

chore: Modulname github.com/archivmail → archivmail

2026-04-05 20:37:35 +02:00

saved_search_handlers.go

feat(PROJ-13,PROJ-42): REST API v1 + Gespeicherte Suchanfragen

2026-04-06 10:54:26 +02:00

search_handlers.go

fix: Date-Parsing-Fallback für nicht-standard MTA-Datumsformate

2026-05-11 23:36:18 +02:00

server.go

feat(PROJ-13): OpenAPI 3.0 Spec + GET /api/v1/docs Endpoint

2026-05-29 18:03:58 +02:00

smtpout_handlers.go

chore: Modulname github.com/archivmail → archivmail

2026-04-05 20:37:35 +02:00

system_info_handler.go

fix: IMAP-Serveradresse dynamisch aus Backend laden

2026-04-06 11:06:58 +02:00

thread_handlers.go

chore: Modulname github.com/archivmail → archivmail

2026-04-05 20:37:35 +02:00

totp_handlers.go

chore: Modulname github.com/archivmail → archivmail

2026-04-05 20:37:35 +02:00

upload.go

chore: Modulname github.com/archivmail → archivmail

2026-04-05 20:37:35 +02:00

v1_docs_handler.go

feat(PROJ-13): OpenAPI 3.0 Spec + GET /api/v1/docs Endpoint

2026-05-29 18:03:58 +02:00

v1_handlers.go

fix(sec): Authorization-Bypässe und Path-Traversal schließen, Xapian-Doku bereinigen

2026-05-28 23:55:31 +02:00

version_handlers.go

feat: App-Version 0.9.1 + Modulversionsnummern

2026-03-31 01:12:51 +02:00