vmanne-poc/Postak
1
0
Fork 0
Code Issues 13 Pull requests Projects Releases 15 Packages Wiki Activity Actions
15 releases 15 tags
  • v0.12.0 2445086a7f

    v0.12.0 — Phase 11: Sign-up Forms Stable

    vmanne-poc released this 2026-10-15 09:32:11 -04:00 | 27 commits to main since this release

    Merged in PR #53. Closes #39–#42.

    Upgrading: back up the database first. One migration gives each form a sender (existing forms get the project's oldest sender, as before). nginx now forwards /f/ to the backend. Set PUBLIC_URL to your public https address. Confirmation links in double opt-in emails now open a page with a Confirm subscription button.

    Added

    • Hosted sign-up page and embed code (#39): each form gets its own page with a shareable link, an iframe snippet and a plain HTML snippet. You can show a thank-you message or redirect to your own page, and choose whether other websites may use the form.
    • Form editor (#40) with a live preview:
      • heading, intro, button label and fine print
      • fields: email, names and your own custom fields, each required or optional, in any order
      • colours, font and corner radius
    • Confirmation and welcome emails (#41):
      • Choose the sender, write the confirmation email, and pick where people go after confirming.
      • An optional welcome email includes an unsubscribe link.
      • A double opt-in form without a sender now says it can't accept sign-ups, instead of silently sending nothing.
    • Spam protection (#42):
      • A hidden honeypot field, and a minimum fill time on every hosted form.
      • An optional captcha that the visitor's browser solves invisibly, with no third-party service.
      • Rejected submissions look the same as real ones to bots.

    Security

    • Contact details are escaped in emails. A name submitted through a public form could add HTML or links to campaign emails. This is now fixed.
    • Confirmation needs a button press, so link scanners can't confirm subscriptions on someone's behalf.
    • Form pages use a strict Content Security Policy.
    • Confirmation emails are limited to one per person per form every 2 minutes.

    Verified

    • Tests: backend 72 unit and 51 end-to-end; frontend 67.
    • Live through nginx and Mailpit:
      • full double opt-in with a custom field
      • the welcome email and its unsubscribe link
      • spam dropped
      • captcha solved and replay refused
    • A real browser solved the captcha on the hosted page.

    Full details are in CHANGELOG.md.

    Downloads