SimpleLogin

Recent Commits

• Adrià Casajús(05 Oct 26)

  feat: suppress subscription-end reminders for partner subscription users Users with an active partner (Proton) subscription stay premium in SimpleLogin, so the 'Your subscription will end soon' emails sent by the daily cron for cancelled Paddle, manual and Coinbase subscriptions are misleading for them. Skip those three reminders when the user has an active PartnerSubscription (is_active() includes the 14-day grace period; lifetime partner subs suppress too). In the manual-subscription loop the check sits inside 'if need_reminder:' to avoid one extra query per manual subscription per day for users who never qualify for a reminder. Residual case accepted: a user who cancels their Proton subscription keeps it until the period end, so a manual/Coinbase reminder in that window is suppressed; once the partner row is removed the other subscription may end without a reminder. Rare and low impact. Tests assert per recipient (envelope_to) instead of global stored-email counts, replace the previous assertion-free test_notify_manual_sub_end, and cover active, lifetime and expired-past-grace partner subs across all three senders.

• Adrià Casajús(02 Oct 26)

  feat: add S3 object migration module and scripts/migrate_s3_objects.py Copy the objects the DB references (File.path, RefusedEmail.full_report_path and path) from the old public storage into the new S3 bucket, keyed identically so no DB row changes and no old object is deleted. iter_keys walks fixed id windows like scripts/sanitize_contact_names.py and skips refused emails the delete_refused_emails cron is about to clean up. migrate_key skips keys already at the destination (HEAD only, no GET), maps 404 to MISSING and any other error to FAILED so one bad object never stops the walk, and passes Content-Type / Content-Disposition through to s3.upload_raw, with an attachment fallback for .eml keys. The CLI is a dry run unless --apply is given, refuses http roots and a config still pointing at LOCAL_FILE_UPLOAD, and prints per-outcome counts.

• Adrià Casajús(01 Oct 26)

  feat: add exists and upload_raw helpers to app/s3.py The upcoming S3 migration script needs to check whether a key already exists in the target storage and to upload bytes while controlling ContentType and ContentDisposition independently, which the existing uploaders cannot do. - exists(): head_object in S3 mode (404/NoSuchKey/NotFound -> False, other ClientErrors re-raised); os.path.exists in local mode. - upload_raw(): put_object passing ContentType/ContentDisposition only when given; writes to UPLOAD_DIR like the existing uploaders in local mode. Existing functions are untouched.

• Adrià Casajús(25 Sept 26)

  tests

• Adrià Casajús(25 Sept 26)

  Ensure that there are mailbox to transfer

• Adrià Casajús(23 Sept 26)

  Fix oauth email creation

• Adrià Casajús(23 Sept 26)

  Do not skip the input path on oauth verification

• Adrià Casajús(23 Sept 26)

  Add contact name sanitization

• Adrià Casajús(23 Sept 26)

  Limit the amount of stored provider complaints

• Adrià Casajús(22 Sept 26)

  Make sure sudo is for the current user

• chrisblech(16 Sept 26)

  changes OIDC_SCOPES type from string to list, fixes https://github.com/simple-login/app/issues/2812

• Adrià Casajús(18 Sept 26)

  Test fixes

• Adrià Casajús(18 Sept 26)

  Proper VERP expiration check in the past, not in the future

• Adrià Casajús(18 Sept 26)

  Sign paddle user_id

• Adrià Casajús(18 Sept 26)

  On alias transfer clear up the directory

• Adrià Casajús(18 Sept 26)

  Avoid logging sensitive fields

• Adrià Casajús(18 Sept 26)

  Disable custom domain captchas by default

• Adrià Casajús(17 Sept 26)

  Allow to link proton account if the account is not linked

• Carlos Quintana(17 Sept 26)

  chore: add command for checking

• Carlos Quintana(17 Sept 26)

  chore: OIDC sub claim alias transfer

• Adrià Casajús(14 Sept 26)

  Look up ids directly in admin model view search flask-admin casts every searchable column to text and matches it with ILIKE '%term%', so searching a user id ran CAST(users.id AS VARCHAR) ILIKE '%123%' on both the list and the count query, sequentially scanning the whole users table. Override _apply_search on SLModelView so a plain integer term compares the integer columns directly and skips the text ones, and a non-integer term skips the integer columns, which can never match by equality. A term is now either an id lookup or a text search, never both, so bare numbers no longer substring-match email columns.

• Son Nguyen(09 Sept 26)

  referral page only accessible to users who have referral codes or payout

• Adrià Casajús(01 Sept 26)

  Escape message emails in js context

• Adrià Casajús(01 Sept 26)

  Escape data before injecting it

• Adrià Casajús(01 Sept 26)

  fix

• Adrià Casajús(01 Sept 26)

  Only allow to set default aliases for ownership AND mx verified domains

• Oliver Gordon(24 Aug 26)

  update support emails

• Carlos Quintana(17 Aug 26)

  chore: take an exclusive lock on alias transfer

• Carlos Quintana(17 Aug 26)

  chore: sanitize redirect uri params

• Carlos Quintana(11 Aug 26)

  fix: do not log entire payload if cannot decode