kevinveenbirkenbachandClaude Opus 5 e7c9049df3 fix(web-app-mailu): drop the token ip field Mailu never reads ...

Mailu 2024.06's token endpoint models AuthorizedIP as a list of CIDRs and declares its expect without validate=True; the POST handler assigns token_new.ip from data['AuthorizedIP'] and never from data['ip']. The 'ip' key this role sent was therefore discarded, and every token it created has always been unrestricted.

The value behind it was a forbidden substantive default on networks.internet.ip4, introduced as drive-by collateral in 087175a3c, a commit about the token comment. Removing both is behaviour-preserving and restores the original intent.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-08-01 14:27:13 +02:00

..

create_user_token.yml

…