X2Mail - Releases

Added

• Filters can be created and edited directly on the Filters settings page — the filter list with add, edit and delete is shown inline, with no separate window to open first

Changed

• Simple-mode filters are now written into the active Sieve script on the server instead of a separate script, preserving any existing rules in that script
• The visual filter builder now reads plain Sieve directly: existing scripts (including a server-side default) show up as editable filters, and saved scripts contain clean, human-readable Sieve with no base64 blocks or metadata comments. Filter rules the builder does not recognise are preserved unchanged

Removed

• Support for the unmaintained oidc_login app — user_oidc is the only supported SSO provider now (oidc_login does not support Nextcloud 34+). Existing oidc_login setups must migrate to user_oidc.

Added

• Optional extra scopes for OIDC token exchange — configurable in the setup wizard next to the token audience, via occ x2mail:setup --oidc-scopes "scope1 scope2", or directly: occ config:app:set x2mail oidc-exchange-scopes --value "scope1 scope2". The wizard's Test Login uses the typed scopes.
• Test Login diagnostics show which token was actually used: exchanged token (with audience, scopes and remaining lifetime), a warning when the token exchange fell back to the login token, or the plain login token

Security

• Bearer tokens are never sent over unencrypted connections to remote mail servers (loopback connections are exempt)

Fixed

• An expired or rejected token during SMTP authentication now terminates the SASL exchange cleanly (RFC 7628) and the mail server's error details are logged, instead of failing with a generic error
• Token exchange/refresh failures now log the identity provider's error response and the remaining token lifetime, making SSO issues diagnosable from the log
• The engine log no longer fills with CRITICAL: Caught SIGCHLD entries — these fired on every normal helper-process exit and were not errors
• The webmail UI keeps loading even if a future Nextcloud release removes the internal CSP nonce API (the self-generated fallback nonce is now correctly referenced by the app's content security policy)

Fixed

• Nextcloud 34 compatibility: the content security policy no longer depends on the allowEvalScript() API removed in NC 34. A leftover $evalScriptAllowed subclass property additionally crashed NC 34's reflection-based policy merge with an HTTP 500 on every page load; the property is gone and 'unsafe-eval' — required by the Knockout-based UI — is now added to script-src via the version-appropriate path (direct keyword on NC 34, allowEvalScript() on NC 33).

Changed

• CSP nonce lookup now degrades to a self-generated nonce if the internal ContentSecurityPolicyNonceManager is removed in a future release, turning a potential fatal error into a soft failure (no public nonce API exists yet — see #181).

Changed

• Authentication state now lives entirely in the Nextcloud session — X2Mail no longer stores its own authentication cookies

Security

• S/MIME certificates are now generated as per-user self-signed end-entity certificates, signed with their own key (no shared signing key)
• S/MIME signatures now report the signer identity and a trust state (trusted only for known signers) instead of marking every valid signature as verified
• External image proxy rejects URLs resolving to private, loopback, link-local or reserved addresses (SSRF hardening) and caps proxied response size
• Mail authentication offers only OAuth SASL mechanisms (OAUTHBEARER/XOAUTH2); password-based SASL fallbacks were removed so a malicious server cannot downgrade the connection

Fixed

• S/MIME certificate creation now works for identities without a display name

Removed

• Password/plain login — X2Mail is SSO/OIDC-only (--auth plain, occ x2mail:settings, and the manual password login form are no longer available)
• Legacy engine admin panel (/?admin) — all administration moves to Nextcloud Settings → X2Mail
• SnappyMail legacy domain blocklist seed (app/domains/disabled) — fresh installs no longer copy a public-provider deny list into engine data

Added

• Setup wizard Test Login — verifies live OAUTHBEARER login to IMAP, SMTP submission, and ManageSieve with the current SSO token
• Configurable ManageSieve in setup: --sieve-host, --sieve-port, --sieve-ssl (CLI) and matching fields in the setup wizard
• Allgemein + Info sections in Nextcloud Settings → X2Mail (attachment limits, OpenPGP/GnuPG, version info)
• Real OAUTHBEARER auth-test in the setup wizard (replaces the old engine connectivity test)

Changed

• Mail authentication is OAuth SASL only (OAUTHBEARER / XOAUTH2) for IMAP, SMTP, and Sieve
• Setup wizard is SSO-only (no password auth mode); SMTP authentication is enabled automatically in generated domain config
• Setup wizard mail server section: IMAP → SMTP → Sieve
• Updated bundled OpenPGP.js to 6.3.0 — modern WebCrypto/WebAssembly, smaller bundle (drops the legacy asm.js fallback)
• IMAP client supports IMAP4rev2 (RFC 9051) when the mail server advertises it — unread counts use ESEARCH instead of deprecated SELECT UNSEEN
• Updated bundled Sabre VObject (4.5.8) and Sabre Xml (4.0.6) for vCard/iCal parsing

Fixed

• ManageSieve setup and Test Login now use the configured Sieve host, port, and TLS mode (supports both STARTTLS and implicit TLS listeners)
• Sieve filtering works with the same OAuth SSO flow as IMAP and SMTP

Verified

• End-to-end Stalwart 0.16.6 with Keycloak + LDAP directory (IMAP/SMTP/Sieve OAUTHBEARER via setup wizard). See docs/configs/stalwart-oauthbearer.md.

Changed

• JS/CSS minification in build pipeline (terser + clean-css)
• Setup wizard and occ x2mail:setup now enforce one active domain profile and consolidate stale extra configs
• OAuth domain configs now advertise only OAUTHBEARER and XOAUTH2 SASL mechanisms by default

Fixed

• SMTP OAUTHBEARER authentication now works in SSO mode — useAuth is enforced when authType=oauth so SmtpClient::Login() is no longer skipped
• Preflight checks now perform real IMAP/SMTP STARTTLS negotiation instead of plain TCP reachability checks
• Preflight TLS checks now inherit current X2Mail SSL defaults and fall back to relaxed diagnostics with a visible warning instead of hard-failing selfhosted certificate setups
• SMTP OAuth capability is now validated when authenticated sending is enabled in SSO mode
• Setup wizard now writes the new active domain before cleaning up stale profiles and reports cleanup warnings instead of risking config loss
• Release defaults for autologout, contacts_autosave, show_login_alert, and identity handling are restored through targeted migration/default application
• occ x2mail:status now reports the actual IMAP/SMTP security mode and the stored OIDC provider selection
• occ x2mail:settings and password-login persistence now store secrets with sensitive/internal flags
• Repair step no longer wipes legacy passphrases on every update and no longer resets broad engine config on every post-update

Fixed

• SSO login works reliably after App Store upgrades
• Plugin updates no longer leave stale files that break the frontend

Added

• Dashboard widget: unread mails stay visible after OIDC token expiry (auto-refresh)
• Nextcloud search: mail search works reliably with OIDC token refresh
• Calendar save: duplicate detection — warns when event already exists, option to update or cancel
• Calendar save: visual feedback — shows Created/Updated/Error states on save button
• Contacts: address book name shown in contact detail view
• Setup Wizard: unified Mail-Server layout, domain tabs, OIDC provider visible by default
• Password auth: credentials persist across sessions (automatic on Nextcloud login)

Changed

• Auth type switch (SSO/Password) applies cleanly without re-login required
• Password encryption uses Nextcloud-native cryptography
• All 26 engine enumerations migrated to native PHP 8.1 enum types
• Engine static analysis raised from PHPStan Level 1 to Level 2
• Contacts detail font size reduced for cleaner layout

Fixed

• File attachments from Nextcloud Files work again (NC33 API migration)
• Save email/attachments to Nextcloud Files works again (NC33 API migration)
• Email address shown correctly in login field (was showing username only)
• Switching between SSO and password auth no longer causes authentication errors
• Calendar save to Nextcloud works reliably
• Setup wizard token diagnostics display correctly for all OIDC providers

Removed

• Manual email/password settings page (SSO handles authentication automatically)
• Admin panel: password/TOTP authentication removed (SSO-only)
• Engine dead code: ~14,000 lines removed (unused libraries, standalone contacts system, admin auth)

Added

• Filters can be created and edited directly on the Filters settings page — the filter list with add, edit and delete is shown inline, with no separate window to open first

Changed

• Simple-mode filters are now written into the active Sieve script on the server instead of a separate script, preserving any existing rules in that script
• The visual filter builder now reads plain Sieve directly: existing scripts (including a server-side default) show up as editable filters, and saved scripts contain clean, human-readable Sieve with no base64 blocks or metadata comments. Filter rules the builder does not recognise are preserved unchanged

Removed

• Support for the unmaintained oidc_login app — user_oidc is the only supported SSO provider now (oidc_login does not support Nextcloud 34+). Existing oidc_login setups must migrate to user_oidc.

Added

• Optional extra scopes for OIDC token exchange — configurable in the setup wizard next to the token audience, via occ x2mail:setup --oidc-scopes "scope1 scope2", or directly: occ config:app:set x2mail oidc-exchange-scopes --value "scope1 scope2". The wizard's Test Login uses the typed scopes.
• Test Login diagnostics show which token was actually used: exchanged token (with audience, scopes and remaining lifetime), a warning when the token exchange fell back to the login token, or the plain login token

Security

• Bearer tokens are never sent over unencrypted connections to remote mail servers (loopback connections are exempt)

Fixed

• An expired or rejected token during SMTP authentication now terminates the SASL exchange cleanly (RFC 7628) and the mail server's error details are logged, instead of failing with a generic error
• Token exchange/refresh failures now log the identity provider's error response and the remaining token lifetime, making SSO issues diagnosable from the log
• The engine log no longer fills with CRITICAL: Caught SIGCHLD entries — these fired on every normal helper-process exit and were not errors
• The webmail UI keeps loading even if a future Nextcloud release removes the internal CSP nonce API (the self-generated fallback nonce is now correctly referenced by the app's content security policy)

Fixed

• Nextcloud 34 compatibility: the content security policy no longer depends on the allowEvalScript() API removed in NC 34. A leftover $evalScriptAllowed subclass property additionally crashed NC 34's reflection-based policy merge with an HTTP 500 on every page load; the property is gone and 'unsafe-eval' — required by the Knockout-based UI — is now added to script-src via the version-appropriate path (direct keyword on NC 34, allowEvalScript() on NC 33).

Changed

• CSP nonce lookup now degrades to a self-generated nonce if the internal ContentSecurityPolicyNonceManager is removed in a future release, turning a potential fatal error into a soft failure (no public nonce API exists yet — see #181).

Changed

• Authentication state now lives entirely in the Nextcloud session — X2Mail no longer stores its own authentication cookies

Security

• S/MIME certificates are now generated as per-user self-signed end-entity certificates, signed with their own key (no shared signing key)
• S/MIME signatures now report the signer identity and a trust state (trusted only for known signers) instead of marking every valid signature as verified
• External image proxy rejects URLs resolving to private, loopback, link-local or reserved addresses (SSRF hardening) and caps proxied response size
• Mail authentication offers only OAuth SASL mechanisms (OAUTHBEARER/XOAUTH2); password-based SASL fallbacks were removed so a malicious server cannot downgrade the connection

Fixed

• S/MIME certificate creation now works for identities without a display name

Removed

• Password/plain login — X2Mail is SSO/OIDC-only (--auth plain, occ x2mail:settings, and the manual password login form are no longer available)
• Legacy engine admin panel (/?admin) — all administration moves to Nextcloud Settings → X2Mail
• SnappyMail legacy domain blocklist seed (app/domains/disabled) — fresh installs no longer copy a public-provider deny list into engine data

Added

• Setup wizard Test Login — verifies live OAUTHBEARER login to IMAP, SMTP submission, and ManageSieve with the current SSO token
• Configurable ManageSieve in setup: --sieve-host, --sieve-port, --sieve-ssl (CLI) and matching fields in the setup wizard
• Allgemein + Info sections in Nextcloud Settings → X2Mail (attachment limits, OpenPGP/GnuPG, version info)
• Real OAUTHBEARER auth-test in the setup wizard (replaces the old engine connectivity test)

Changed

• Mail authentication is OAuth SASL only (OAUTHBEARER / XOAUTH2) for IMAP, SMTP, and Sieve
• Setup wizard is SSO-only (no password auth mode); SMTP authentication is enabled automatically in generated domain config
• Setup wizard mail server section: IMAP → SMTP → Sieve
• Updated bundled OpenPGP.js to 6.3.0 — modern WebCrypto/WebAssembly, smaller bundle (drops the legacy asm.js fallback)
• IMAP client supports IMAP4rev2 (RFC 9051) when the mail server advertises it — unread counts use ESEARCH instead of deprecated SELECT UNSEEN
• Updated bundled Sabre VObject (4.5.8) and Sabre Xml (4.0.6) for vCard/iCal parsing

Fixed

• ManageSieve setup and Test Login now use the configured Sieve host, port, and TLS mode (supports both STARTTLS and implicit TLS listeners)
• Sieve filtering works with the same OAuth SSO flow as IMAP and SMTP

Verified

• End-to-end Stalwart 0.16.6 with Keycloak + LDAP directory (IMAP/SMTP/Sieve OAUTHBEARER via setup wizard). See docs/configs/stalwart-oauthbearer.md.

Changed

• JS/CSS minification in build pipeline (terser + clean-css)
• Setup wizard and occ x2mail:setup now enforce one active domain profile and consolidate stale extra configs
• OAuth domain configs now advertise only OAUTHBEARER and XOAUTH2 SASL mechanisms by default

Fixed

• SMTP OAUTHBEARER authentication now works in SSO mode — useAuth is enforced when authType=oauth so SmtpClient::Login() is no longer skipped
• Preflight checks now perform real IMAP/SMTP STARTTLS negotiation instead of plain TCP reachability checks
• Preflight TLS checks now inherit current X2Mail SSL defaults and fall back to relaxed diagnostics with a visible warning instead of hard-failing selfhosted certificate setups
• SMTP OAuth capability is now validated when authenticated sending is enabled in SSO mode
• Setup wizard now writes the new active domain before cleaning up stale profiles and reports cleanup warnings instead of risking config loss
• Release defaults for autologout, contacts_autosave, show_login_alert, and identity handling are restored through targeted migration/default application
• occ x2mail:status now reports the actual IMAP/SMTP security mode and the stored OIDC provider selection
• occ x2mail:settings and password-login persistence now store secrets with sensitive/internal flags
• Repair step no longer wipes legacy passphrases on every update and no longer resets broad engine config on every post-update

Fixed

• SSO login works reliably after App Store upgrades
• Plugin updates no longer leave stale files that break the frontend

Added

• Dashboard widget: unread mails stay visible after OIDC token expiry (auto-refresh)
• Nextcloud search: mail search works reliably with OIDC token refresh
• Calendar save: duplicate detection — warns when event already exists, option to update or cancel
• Calendar save: visual feedback — shows Created/Updated/Error states on save button
• Contacts: address book name shown in contact detail view
• Setup Wizard: unified Mail-Server layout, domain tabs, OIDC provider visible by default
• Password auth: credentials persist across sessions (automatic on Nextcloud login)

Changed

• Auth type switch (SSO/Password) applies cleanly without re-login required
• Password encryption uses Nextcloud-native cryptography
• All 26 engine enumerations migrated to native PHP 8.1 enum types
• Engine static analysis raised from PHPStan Level 1 to Level 2
• Contacts detail font size reduced for cleaner layout

Fixed

• File attachments from Nextcloud Files work again (NC33 API migration)
• Save email/attachments to Nextcloud Files works again (NC33 API migration)
• Email address shown correctly in login field (was showing username only)
• Switching between SSO and password auth no longer causes authentication errors
• Calendar save to Nextcloud works reliably
• Setup wizard token diagnostics display correctly for all OIDC providers

Removed

• Manual email/password settings page (SSO handles authentication automatically)
• Admin panel: password/TOTP authentication removed (SSO-only)
• Engine dead code: ~14,000 lines removed (unused libraries, standalone contacts system, admin auth)