The problem went away when I cleared my cookies.

Bootbox is used to show modals and alerts. You can test it by running bootbox.alert('hello') in your browser console. The vulnerability mentioned comes from bootbox allowing any html to be passed in. For example bootbox.alert('hello<script>alert("ok")</script>') This will execute the javascript in the text. So it has to be sanitized before passing it to bootbox. bootbox.alert(utils.escapeHTML('hello<script>alert("ok")</script>')) For the full discussion you can check https://github.com/makeusabrew/bootbox/issues/661

@pitaj Works great! Thanks!

@julian Works (once I upgraded to a compatible NodeBB)! Thanks again!

@waugh have you considered upgrading nodebb to the latest version? I think that will fix your issue

@waugh I've marked it solved for you you can do so from the topic tools menu

@waugh said in Hooking Up to Mail: @julian Do you engage in a more intimate relationship with Haraka? Niche third party platforms would be far less likely. Postfix is built into nearly all production platforms and configured out of the box for most usages (standard SMTP relay.) His point was that they don't get their hands dirty with any specific email implementation and leave that for the admins, they just send email out on whatever protocol or API is selected and the rest is up to the email admin to configure.