sysops fa9f77782c fix(sec): Authorization-Bypässe und Path-Traversal schließen, Xapian-Doku bereinigen ...

- SEC: requireMailAccess auf GET /api/threads/{threadID} — superadmin/domain_admin konnten Mail-Metadaten lesen
- SEC: requireMailAccess auf POST /api/export/ediscovery — superadmin/domain_admin konnten bis zu 10k EML exportieren
- SEC: V1-API user-role Keys müssen 'contact=' angeben — verhindert vollständige Tenant-Enumeration
- SEC: Domain-Regex-Validierung in handleCertACME vor filepath.Join und certbot-Aufruf
- docs: README und config.test.yml auf Manticore Search aktualisiert (kein Xapian mehr)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-28 23:55:31 +02:00

..

admin_handlers.go

chore: Modulname github.com/archivmail → archivmail

2026-04-05 20:37:35 +02:00

api_test.go

chore: Modulname github.com/archivmail → archivmail

2026-04-05 20:37:35 +02:00

apikey_handlers.go

feat(PROJ-13,PROJ-42): REST API v1 + Gespeicherte Suchanfragen

2026-04-06 10:54:26 +02:00

auth_handlers.go

chore: Modulname github.com/archivmail → archivmail

2026-04-05 20:37:35 +02:00

cert_handlers.go

fix(sec): Authorization-Bypässe und Path-Traversal schließen, Xapian-Doku bereinigen

2026-05-28 23:55:31 +02:00

dashboard_handlers.go

feat(PROJ-40,PROJ-41): Prometheus Metriken + Dashboard Zeitreihe

2026-04-05 21:10:42 +02:00

ediscovery.go

fix(PROJ-39): sanitizeFilename-Konflikt beheben — in ediscovery.go umbenannt

2026-04-05 20:56:27 +02:00

export.go

chore: Modulname github.com/archivmail → archivmail

2026-04-05 20:37:35 +02:00

imap_settings_handlers.go

chore: Modulname github.com/archivmail → archivmail

2026-04-05 20:37:35 +02:00

import_handlers.go

chore: Modulname github.com/archivmail → archivmail

2026-04-05 20:37:35 +02:00

invite_handlers.go

chore: Modulname github.com/archivmail → archivmail

2026-04-05 20:37:35 +02:00

ldap_sync.go

chore: Modulname github.com/archivmail → archivmail

2026-04-05 20:37:35 +02:00

ldap_tenants.go

chore: Modulname github.com/archivmail → archivmail

2026-04-05 20:37:35 +02:00

metrics_handlers.go

feat(PROJ-40,PROJ-41): Prometheus Metriken + Dashboard Zeitreihe

2026-04-05 21:10:42 +02:00

ocr_handlers.go

fix(PROJ-44): OCR-Tenant-Routing nutzt kanonische DB-tenant_id

2026-05-10 23:13:57 +02:00

onboarding_handlers.go

chore: Modulname github.com/archivmail → archivmail

2026-04-05 20:37:35 +02:00

profile_handlers.go

chore: Modulname github.com/archivmail → archivmail

2026-04-05 20:37:35 +02:00

quota_handlers.go

chore: Modulname github.com/archivmail → archivmail

2026-04-05 20:37:35 +02:00

retention_handlers.go

chore: Modulname github.com/archivmail → archivmail

2026-04-05 20:37:35 +02:00

saved_search_handlers.go

feat(PROJ-13,PROJ-42): REST API v1 + Gespeicherte Suchanfragen

2026-04-06 10:54:26 +02:00

search_handlers.go

fix: Date-Parsing-Fallback für nicht-standard MTA-Datumsformate

2026-05-11 23:36:18 +02:00

server.go

fix(sec): Authorization-Bypässe und Path-Traversal schließen, Xapian-Doku bereinigen

2026-05-28 23:55:31 +02:00

smtpout_handlers.go

chore: Modulname github.com/archivmail → archivmail

2026-04-05 20:37:35 +02:00

system_info_handler.go

fix: IMAP-Serveradresse dynamisch aus Backend laden

2026-04-06 11:06:58 +02:00

thread_handlers.go

chore: Modulname github.com/archivmail → archivmail

2026-04-05 20:37:35 +02:00

totp_handlers.go

chore: Modulname github.com/archivmail → archivmail

2026-04-05 20:37:35 +02:00

upload.go

chore: Modulname github.com/archivmail → archivmail

2026-04-05 20:37:35 +02:00

v1_handlers.go

fix(sec): Authorization-Bypässe und Path-Traversal schließen, Xapian-Doku bereinigen

2026-05-28 23:55:31 +02:00

version_handlers.go

feat: App-Version 0.9.1 + Modulversionsnummern

2026-03-31 01:12:51 +02:00