Skip to content

v5.2.3

v5.2.3: fix(mails): sandbox the mail preview and harden its response headers
@markvaneijk markvaneijk tagged this 25 Aug 06:53 
Port the remaining parts of backstagephp/mails#86 that 5.x did not pick
up in #299.

- Render stored email HTML in a sandboxed iframe via srcdoc instead of
  pointing the iframe at the preview route
- Serve the preview with a sandboxing Content-Security-Policy plus
  Referrer-Policy and X-Frame-Options
- Type the controller responses and read the mail model with
  Config::string()
- Cover the new headers and the sandboxed render in the security test

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Assets 2
Loading