Paul LütznerandClaude Opus 5.5 9c20aa8183 fix(compose): undo, unschedule, discard and attachment POSTs need a token ...

Six state-changing compose routes checked ownership and nothing else, so
any page the user visited could call off a send, discard a draft or add
and remove attachments. They now require the shared 'ajax' token, and
every fetch() caller in the compose controllers sends it in the
X-CSRF-Token header (unschedule's caller already did).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-09-23 19:09:08 +02:00

..

ai

feat(ai): summarise a conversation, when somebody asks

2026-08-27 14:43:59 +02:00

compose

fix(calendar): an event that runs over days says both of them

2026-08-27 18:33:51 +02:00

controllers

fix(compose): undo, unschedule, discard and attachment POSTs need a token

2026-09-23 19:09:08 +02:00

emoji

feat(compose): wire the emoji picker and inline images

2026-08-12 17:39:16 +02:00

fonts

feat(compose): wire the emoji picker and inline images

2026-08-12 17:39:16 +02:00

images/backgrounds

…

styles

feat(search): show which words a result matched on

2026-09-22 17:18:08 +02:00

app.js

feat: failed requests raise a toast instead of breaking the page

2026-09-23 18:22:21 +02:00

client_errors.js

Report browser errors to the admin panel, in a card of their own

2026-09-04 16:02:42 +02:00

clock_format.js

fix(compose): a link popover, a themed emoji picker, and clocks that follow the setting

2026-08-12 22:03:48 +02:00

confirm.js

fix(mail): the message frame can measure itself again

2026-08-24 12:51:18 +02:00

controllers.json

…

csrf.js

fix(js): a listener that outlived its window, and one place to read the CSRF token

2026-08-17 11:25:39 +02:00

mail_writes.js

fix(mail): the unread badges follow mail that is read, not only mail acted on

2026-08-21 13:08:40 +02:00

motion.js

fix(motion): a list already on screen animated itself in again on every visit

2026-08-26 15:11:36 +02:00

nav_origin.js

feat(calendar): mail-bound navigation and the pane finally agree

2026-08-11 09:34:26 +02:00

password_manager_ignore.js

…

pdf_geometry.d.ts

feat: sign a PDF by drawing on it, and reply with the signed copy

2026-08-25 15:54:36 +02:00

pdf_geometry.js

feat: sign a PDF by drawing on it, and reply with the signed copy

2026-08-25 15:54:36 +02:00

request_errors.js

feat: failed requests raise a toast instead of breaking the page

2026-09-23 18:22:21 +02:00

schedule_options.js

fix(compose): the send-later bounds stop reading the clock as a number

2026-08-21 13:09:04 +02:00

snooze_options.js

fix(mail): the snooze menu says which day, and the Snoozed list says when

2026-08-22 17:30:21 +02:00

stimulus_bootstrap.js

fix(accounts,sidebar): ordering a list stops deciding who you are

2026-08-13 13:01:40 +02:00

toast.js

feat: failed requests raise a toast instead of breaking the page

2026-09-23 18:22:21 +02:00