MailFlow v4.0.3
Admins can now choose which users may use AI, and the AI switches are enforced on the server. Also: newsletter images show in the body instead of as broken attachments, a crafted email can no longer freeze the tab when you run an AI action on it, and email can be translated by the browser again. Update when you can. Thanks to @Monkey7539, and to everyone who reported these.
Security
- AI access is enforced on the server (#644). Every signed-in user could use the AI an admin had set up, and the writing assistant and summaries switches only hid buttons, so a request could still be made directly. The server now checks both on every AI request, and users who aren't admins no longer see which ChatGPT account is connected or when its token expires.
- A crafted email could freeze the tab during an AI action. Turning an HTML email into text for Summarize or a custom action, or the composer's AI tools in HTML mode, could take about 30 seconds on a crafted message. It now takes milliseconds.
New
- Per-user AI access (#644). Admin > Users has an AI switch on each user, and Settings > AI has "Allow AI for new users". Turning AI off for a user refuses their AI requests (writing assistant, summaries and AI actions, AI recategorization, GTD gists), rather than only hiding the buttons. Existing users keep access after the update.
Fixes
- Newsletter images shown as broken attachments (#640). Images an email uses in its own layout were listed as attachments and shown as broken placeholders when the sender marked them as attachments or referred to them by file name. They now show in the body. Files that are genuinely attached stay in the list, and an attached photo the email also displays can still be downloaded. An email you've already opened is fetched again the next time you open it, so it fixes itself.
- Translating email in the browser (#645). MailFlow keeps the browser from translating its own interface, and that also stopped Chrome from translating HTML email. Email bodies can be translated again; the interface still isn't. A translated email shown dark no longer ends up with dark text after switching dark mode off and on.
- Pasting from an email kept its page colors (#638). In Chrome, text copied from an email and pasted into the composer brought the email's page background and colors along, so a recipient could get light text in a dark box. Those are now removed, while colors pasted from documents such as Word or Google Docs are kept.
- Emptying the Trash folder named it differently (#623). When the folder shown as "Trash" is a server folder named "Deleted Items", emptying or deleting it now says "Trash", as the sidebar does; Spam and mapped folders too.
Upgrading
ghcr.io/maathimself/mailflow-backend:latest points at 4.0.3, published for amd64 and arm64.
- One database migration (0067, the per-user AI switch), applied automatically when the backend starts. Existing users keep AI access.
- Reload open MailFlow tabs after updating. A tab opened before the update can still use AI while both the writing assistant and summaries are on.