poste.io 2.5.1 → 2.5.20
18 releases · 1 breaking change · 30 security fixes · 0 advisories fixed
30security1breaking1deprecated8feature46fix
Breaking changes
- breaking removed hardcoded list of locales in 2.5.6
Security changes
- security security upgrade to PHP 8.2.35 in 2.5.20
- security Roundcube 1.7.4 (webmail database is migrated on first start, no way back to 1.6) in 2.5.19
- security webmail serves only the Roundcube entry points in 2.5.19
- security Roundcube 1.6.19 in 2.5.17
- security security: add CSRF protection to state-changing log/dkim/filter/quarantine actions in 2.5.15
- security security: enforce log tenant scoping structurally, not via query string in 2.5.15
- security security: require current password for self-service password change in 2.5.15
- security security: sandbox BIMI logo SVG to prevent stored XSS in 2.5.15
- security security: enforce ownership check on box/domain quota endpoints in 2.5.15
- security Roundcube 1.6.17 in 2.5.14
- security Roundcube 1.6.16 in 2.5.13
- security security: fix SRS using a predictable secret (could allow SRS address forgery and mail relay) in 2.5.13
- security security: harden mailserver helpers against shell command injection in 2.5.13
- security fix #1198 add GID limits for Dovecot configuration in 2.5.12
- security fix Dovecot auth cache rollback in 2.5.12
- security Roundcube 1.6.15 in 2.5.11
- security fix Dovecot password caching, try no 2 in 2.5.11
- security Roundcube 1.6.14 in 2.5.10
- security fix Dovecot password caching in 2.5.10
- security fix Dovecot repository download in 2.5.10
- security Roundcube 1.6.13 in 2.5.9
- security add Dovecot high-performance mode configuration in 2.5.9
- security add Dovecot service status to server status page in 2.5.9
- security add security headers to nginx (X-Frame-Options, Content-Security-Policy) in 2.5.9
- security tune Dovecot password cache settings in 2.5.9
- security Roundcube 1.6.12 in 2.5.8
- security fix #1144 Roundcube passkey plugin use HTTP_PORT and follow redirects in 2.5.4
- security fix #1145 Roundcube 1.6.11 in 2.5.3
- security fix #1144 Roundcube Poste.io passkey plugin localhost -> 127.0.0.1 in 2.5.3
- security Passkeys implemented to Roundcube as plugin in 2.5.2
Deprecations
- deprecated fixed multiple deprecations in 2.5.2
Every release in between
securitysecurity upgrade to PHP 8.2.35
otherPHP session.upload_progress is disabled
securityRoundcube 1.7.4 (webmail database is migrated on first start, no way back to 1.6)
otherfile permissions in the image are now set at build time
securitywebmail serves only the Roundcube entry points
fixfix spam learning from the Junk folder - moving mail to/from Junk now trains rspamd and affects classification
fixfix temporary files of reported spam/ham left in /tmp
fixfix "503 Bad sequence of commands" shown in the delivery log for accepted messages
fixfix system alerts not delivered to internal-only mailboxes
fixfix DMARC reports page failing on malformed reports or many reports
fixfix connection diagnostics staying grey on PHP 8.5
fixfix low inodes notice shown when only disk space was low
fixadministration: fix layout regressions after the move to Bootstrap 5
securityRoundcube 1.6.19
othermaximum message size can now be set up to 2 GB; nginx and php-fpm limits follow that setting instead of staying at 100 MB, so large attachments finally reach webmail
otherLet's encrypt: renewal is due once less than a third of the certificate lifetime is left, and the CA's own renewal info (ARI) overrides that when available
fixLet's encrypt: fix renewals that took the slow path - valid authorizations are no longer re-challenged, the order is polled instead of re-POSTed, badNonce is retried, and the certificate download has a timeout
otherLet's encrypt: the issuing log is no longer deleted by the run that writes it
otherLet's encrypt: a failed renewal alerts after three attempts in a row, not the first
featureLet's encrypt: new certificates use P-256 keys and the private key is written with 0600
otherremote monitoring: the health endpoint answers 200 even when a check is critical, so a monitoring system reads the body instead of a transport error
otherremote monitoring: the heartbeat is sent at a fixed offset from the start of the measurement
otherremote monitoring: every stage of a heartbeat run is traced
otheradministration moved from Bootstrap 3 to Bootstrap 5
otherconsole entrypoints drop to the mail user when started as root, so they stop leaving root-owned logs and caches behind
fixfix nginx rate limiting putting every public client into one shared bucket
otherremote monitoring: authenticated read-only health API and metrics
otherremote monitoring: optional outbound heartbeat posting
securitysecurity: add CSRF protection to state-changing log/dkim/filter/quarantine actions
securitysecurity: enforce log tenant scoping structurally, not via query string
securitysecurity: require current password for self-service password change
securitysecurity: sandbox BIMI logo SVG to prevent stored XSS
securitysecurity: enforce ownership check on box/domain quota endpoints
otherrate limit requests and block common scanner paths to prevent server overload
otheradvise to create virtual domain of hostname of mailserver and create DKIM
fixfix header_storage.js helper
fixfix admin bruteforce policy
fixfix daily cron noise about disabled mailboxes (doveadm -A now skips them)
fixfix Elasticsearch date handling in connection and transaction logs
feature"Do not log connections" moved from Advanced to the new Monitoring tab
securityRoundcube 1.6.17
featureadd option to keep a copy of outgoing mail in the Sent folder (per mailbox)
securityRoundcube 1.6.16
securitysecurity: fix SRS using a predictable secret (could allow SRS address forgery and mail relay)
securitysecurity: harden mailserver helpers against shell command injection
othermigrate Haraka to the @haraka/email-address library
otherimprove SRS for multi-hop forwarding: compact stateful addresses (RFC-5321 64-octet local-part compliance) and hop-by-hop bounce return
otherfaster startup detection in the container health check
fixfix #1190 add Sieve editheader extension
securityfix #1198 add GID limits for Dovecot configuration
fixfix #1199 Redis memory configuration via environment variables
fixfix SRS handling for multiple Sieve redirect headers
securityfix Dovecot auth cache rollback
fixfix rights of sensitive folders
securityRoundcube 1.6.15
fixfix login redirect when using passkey
securityfix Dovecot password caching, try no 2
otherraise limit for csv export
otherNode.js 24
securityRoundcube 1.6.14
fixfix #1193 dns "custom" record color and icon, fix not locally set BIMI dns detection
fixfix #1191 internal passkey port
securityfix Dovecot password caching
securityfix Dovecot repository download
fixfix invalid quota-status socket path
fixfix csv export multiple newline chars escaping
fixfix translation
securityRoundcube 1.6.13
securityadd Dovecot high-performance mode configuration
securityadd Dovecot service status to server status page
featureadd REST API for Logs (GET /logs, /logs/{id}, /logs/search, /logs/raw), PRO only
securityadd security headers to nginx (X-Frame-Options, Content-Security-Policy)
securitytune Dovecot password cache settings
otheruse poste.io/api/ip instead of ifconfig.me for getting remote IP
otheradjust elasticsearch query to match only partial string
fixfix trash script
securityRoundcube 1.6.12
fixfix #1177 change passkeys local auth port according to HTTP_PORT env
fixfix missing php-fpm log
fixfix autodiscover.xml.php error message
fixfix missing aliases for internal messages
fixfix #1172 make dmarc-reports@ reserved
fixfix missing next() at bounce hook
fixfix delivery lmtp socket path
fixfix #1173 discard not working
featureadd neutral to the blacklist/whitelist to prevent bad actor to block shared IP
otherallowing disabled box to login but not sending messages (submission, smtp)
otherrefactor cron logic and more debug to syslog
featureadd button discard all for quarantine
featureadd strictFromDisable to API
fixfix missing logrotate
fixfix #1164 and #1165 not working changing email size limit
otheroption to ignore logging defined IPs
otherenable custom haraka inis (same as custom plugins but wihtout js files)
otherfully remove localhost relay
fixfix outbound clamd for authenticated users
breakingremoved hardcoded list of locales
fixfix passkey login for custom HTTP ports
fixfix whitelist overriding invalid user
fixfix error in API for user quota
fixfix crontab newline warn
fixfix internal passkey redirect fix
fixfix #1111 add domain storage usage to API (domain quota)
securityfix #1144 Roundcube passkey plugin use HTTP_PORT and follow redirects
fixfix #1138 disable redis protected mode - redis listens only on unix socket now
fixfix #1142 BIMI hostname from javascript rather from server
securityfix #1145 Roundcube 1.6.11
securityfix #1144 Roundcube Poste.io passkey plugin localhost -> 127.0.0.1
fixfix #1143 missing command in FREE generating daily errors
securityPasskeys implemented to Roundcube as plugin
featurePasskeys implemented to administration
deprecatedfixed multiple deprecations
othermoved password form outside user settings (prevents unintentionally changing password when changing settings)
fixfix remote port test diagnostics