2023-12-13 18:39:21 +01:00
|
|
|
FROM alpine:3.19
|
2023-05-30 16:20:35 +02:00
|
|
|
LABEL maintainer "The Infrastructure Company GmbH <info@servercow.de>"
|
2019-06-16 17:36:22 +02:00
|
|
|
|
2023-12-13 18:39:21 +01:00
|
|
|
ARG PIP_BREAK_SYSTEM_PACKAGES=1
|
2019-06-16 17:36:22 +02:00
|
|
|
WORKDIR /app
|
|
|
|
|
|
2019-06-25 18:52:05 +02:00
|
|
|
#RUN addgroup -S olefy && adduser -S olefy -G olefy \
|
2021-02-18 08:25:30 +01:00
|
|
|
RUN apk add --virtual .build-deps gcc musl-dev python3-dev libffi-dev openssl-dev cargo \
|
|
|
|
|
&& apk add --update --no-cache python3 py3-pip openssl tzdata libmagic \
|
2019-06-16 17:36:22 +02:00
|
|
|
&& pip3 install --upgrade pip \
|
2020-10-21 19:00:53 +02:00
|
|
|
&& pip3 install --upgrade asyncio python-magic \
|
🐄 Moorch Update 2022 - ClamAV, Dovecot & Olefy Update (#4497)
* [API] Fix minor issue in api docs
* [GH-Actions][stale] Add neverstale label to exempt list
* [Web] add github version tag
* [Web] add github version tag
* [Web] add github version tag
* [Web] add github version tag
* [Web] add github version tag
* [Web] add github version tag error handling
* [Web] add github version tag error handling
* Passwordless SOGo auth: support for calendar invitations and calendar/contacts subscriptions
Inviting someone to a calendar event triggers a request to /SOGo/so/otheruser@example.com/freebusy.ifb/ajaxRead. Subscribing to someone's calendar/contacts triggers a request to /SOGo/so/otheruser@example.com/foldersSearch. The email address in the URL is different from the logged-in user, which needs to be handled appropriately by sogo-auth.php.
* [Web] add github version tag - adjust css
* [Compose] Update SOGo Autoreply Schedule to 5m
Based on the advice of inverse (SOGo developer). Thanks to https://github.com/jmber
Closes: https://github.com/mailcow/mailcow-dockerized/issues/4436
* [Web] add github version tag - move twig globals
* [Web] add github version tag - missing </div>
* Passwordless SOGo auth: improvements for when accessing other users
* [WebAuthn] fido2 passwordless auth - fix (#4440)
* [WebAuthn] fido2 revert
* [WebAuthn] set UV flags to 'discouraged'
* [WebAuthn] revert - set UV flags to 'discouraged'
* Update clamav to 0.104.2
* Update clamav to 0.104.2
* Update dovecot to 2.3.18
Update gosu to 1.14
Use debian bullseye as base
* [Web] Updated lang.es.json [CI SKIP] (#4453)
Co-authored-by: Fijxu <fijxu@zzls.xyz>
Co-authored-by: milkmaker <milkmaker@mailcow.de>
Co-authored-by: Fijxu <fijxu@zzls.xyz>
* Fix broken documentation links (#4458)
* Fix broken documentation links
* Fix a few more broken documentation links
* Fix broken documentation links in translation files
* Fall back to empty string if WATCHDOG_NOTIFY_EMAIL undefined (#4457)
By default, `.env` (`mailcow.conf`) does not define `WATCHDOG_NOTIFY_EMAIL`.
Using it in `docker-compose.yml` without having it defined leads to Compose v2 displaying this warning on startup:
> WARNING: The WATCHDOG_NOTIFY_EMAIL variable is not set. Defaulting to a blank string.
Related to https://github.com/mailcow/mailcow-dockerized/issues/4315
* [Web] Updated lang.sk.json [CI SKIP] (#4461)
Co-authored-by: Lukáš Matula <lukas@gbely.net>
Co-authored-by: milkmaker <milkmaker@mailcow.de>
Co-authored-by: Lukáš Matula <lukas@gbely.net>
* oletools: disable template injection detection (#4464)
Seems to be causing a lot of false positives lately
* Fix minor typo in comment (#4466)
Correction of the comment, so that the explanation is correct and can be understood.
* Update issue templates to issue forms (#4465)
This PR updates the issue templates to GitHubs new issue forms
* [Web] Fix padding issue in UI admin panel (#4481)
* [Web] fix admin panel padding issue
* [Web] fix admin panel padding issue
* [Web] Updated lang.sk.json [CI SKIP] (#4489)
Co-authored-by: Lukáš Matula <lukas@gbely.net>
Co-authored-by: milkmaker <milkmaker@mailcow.de>
Co-authored-by: Lukáš Matula <lukas@gbely.net>
* increase opcache.interned_strings_buffer to 16 (#4487)
since version 23.0.2 Nextcloud recommends having a value greater than 8 for `opcache.interned_strings_buffer`. As this memory will be only used when needed this should have no impact on installations that are not using nextcloud.
related discussion: https://help.nextcloud.com/t/nextcloud-23-02-opcache-interned-strings-buffer/134007/19
related nextcloud issue: https://github.com/nextcloud/server/issues/31223
* nextcloud - add missing redirections (#4366)
adds missing location directives to the nginx configuration of nextcloud 22, to prevent warnings in nextcloud admin center of missing redirections
* Update imapsync to 2.178 (#4491)
* Update and fix oletools (#4479)
As noticed by @MAGICCC (#4464 (comment)), our olefy image does not work anymore if you rebuild it. This is because @HeinleinSupport recently updated their repository with the changes from @decalage2's repository, which renamed olvba3 to olevba. Since @HeinleinSupport does not recommend using its own patched branch and is very slow in pulling in changes from upstream (@decalage2), let's switch to the latter. This also allowed me to revert #4464.
Finally, a minor patch to rspamd is necessary. While the documentation says
In the extended mode the oletools module will not trigger on specific categories, but will always set a threat string with all found flags when at least a macro was found.
This is not actually true -- it only sets it when suspicious or autoexec threats were detected. But it's a one-line patch to make rspamd behave as documented and we should submit that patch to @rspamd too. With this patch, I have confirmed that Mailcow will reject any incoming, non-whitelisted message containing attachments with macros.
* [Web] Fix excluded domain list in quaratine view
Previously excluded domains from quarantine were not shown.
* [Dovecot] Update syslogng Version to 3.28 (#4496)
Co-authored-by: Niklas Meyer <niklas.meyer@tinc.gmbh>
Co-authored-by: ntimo <git@nowitzki.me>
Co-authored-by: Peter <magic@kthx.at>
Co-authored-by: FreddleSpl0it <patschul@posteo.de>
Co-authored-by: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com>
Co-authored-by: Michael Kuron <mkuron@users.noreply.github.com>
Co-authored-by: milkmaker <milkmaker@mailcow.de>
Co-authored-by: Fijxu <fijxu@zzls.xyz>
Co-authored-by: Slavi Pantaleev <slavi@devture.com>
Co-authored-by: Lukáš Matula <lukas@gbely.net>
Co-authored-by: Max <mail@heavygale.de>
Co-authored-by: Michael Cramer <michael@bigmichi1.de>
Co-authored-by: Robert Christian <soulsymphonies@users.noreply.github.com>
Co-authored-by: André <andre.peters@debinux.de>
Co-authored-by: Niklas Meyer <niklas.meyer@tinc.gmbh>
2022-03-02 16:32:17 +01:00
|
|
|
&& pip3 install --upgrade https://github.com/decalage2/oletools/archive/master.zip \
|
2020-10-21 19:00:53 +02:00
|
|
|
&& apk del .build-deps
|
🐄 Moorch Update 2022 - ClamAV, Dovecot & Olefy Update (#4497)
* [API] Fix minor issue in api docs
* [GH-Actions][stale] Add neverstale label to exempt list
* [Web] add github version tag
* [Web] add github version tag
* [Web] add github version tag
* [Web] add github version tag
* [Web] add github version tag
* [Web] add github version tag error handling
* [Web] add github version tag error handling
* Passwordless SOGo auth: support for calendar invitations and calendar/contacts subscriptions
Inviting someone to a calendar event triggers a request to /SOGo/so/otheruser@example.com/freebusy.ifb/ajaxRead. Subscribing to someone's calendar/contacts triggers a request to /SOGo/so/otheruser@example.com/foldersSearch. The email address in the URL is different from the logged-in user, which needs to be handled appropriately by sogo-auth.php.
* [Web] add github version tag - adjust css
* [Compose] Update SOGo Autoreply Schedule to 5m
Based on the advice of inverse (SOGo developer). Thanks to https://github.com/jmber
Closes: https://github.com/mailcow/mailcow-dockerized/issues/4436
* [Web] add github version tag - move twig globals
* [Web] add github version tag - missing </div>
* Passwordless SOGo auth: improvements for when accessing other users
* [WebAuthn] fido2 passwordless auth - fix (#4440)
* [WebAuthn] fido2 revert
* [WebAuthn] set UV flags to 'discouraged'
* [WebAuthn] revert - set UV flags to 'discouraged'
* Update clamav to 0.104.2
* Update clamav to 0.104.2
* Update dovecot to 2.3.18
Update gosu to 1.14
Use debian bullseye as base
* [Web] Updated lang.es.json [CI SKIP] (#4453)
Co-authored-by: Fijxu <fijxu@zzls.xyz>
Co-authored-by: milkmaker <milkmaker@mailcow.de>
Co-authored-by: Fijxu <fijxu@zzls.xyz>
* Fix broken documentation links (#4458)
* Fix broken documentation links
* Fix a few more broken documentation links
* Fix broken documentation links in translation files
* Fall back to empty string if WATCHDOG_NOTIFY_EMAIL undefined (#4457)
By default, `.env` (`mailcow.conf`) does not define `WATCHDOG_NOTIFY_EMAIL`.
Using it in `docker-compose.yml` without having it defined leads to Compose v2 displaying this warning on startup:
> WARNING: The WATCHDOG_NOTIFY_EMAIL variable is not set. Defaulting to a blank string.
Related to https://github.com/mailcow/mailcow-dockerized/issues/4315
* [Web] Updated lang.sk.json [CI SKIP] (#4461)
Co-authored-by: Lukáš Matula <lukas@gbely.net>
Co-authored-by: milkmaker <milkmaker@mailcow.de>
Co-authored-by: Lukáš Matula <lukas@gbely.net>
* oletools: disable template injection detection (#4464)
Seems to be causing a lot of false positives lately
* Fix minor typo in comment (#4466)
Correction of the comment, so that the explanation is correct and can be understood.
* Update issue templates to issue forms (#4465)
This PR updates the issue templates to GitHubs new issue forms
* [Web] Fix padding issue in UI admin panel (#4481)
* [Web] fix admin panel padding issue
* [Web] fix admin panel padding issue
* [Web] Updated lang.sk.json [CI SKIP] (#4489)
Co-authored-by: Lukáš Matula <lukas@gbely.net>
Co-authored-by: milkmaker <milkmaker@mailcow.de>
Co-authored-by: Lukáš Matula <lukas@gbely.net>
* increase opcache.interned_strings_buffer to 16 (#4487)
since version 23.0.2 Nextcloud recommends having a value greater than 8 for `opcache.interned_strings_buffer`. As this memory will be only used when needed this should have no impact on installations that are not using nextcloud.
related discussion: https://help.nextcloud.com/t/nextcloud-23-02-opcache-interned-strings-buffer/134007/19
related nextcloud issue: https://github.com/nextcloud/server/issues/31223
* nextcloud - add missing redirections (#4366)
adds missing location directives to the nginx configuration of nextcloud 22, to prevent warnings in nextcloud admin center of missing redirections
* Update imapsync to 2.178 (#4491)
* Update and fix oletools (#4479)
As noticed by @MAGICCC (#4464 (comment)), our olefy image does not work anymore if you rebuild it. This is because @HeinleinSupport recently updated their repository with the changes from @decalage2's repository, which renamed olvba3 to olevba. Since @HeinleinSupport does not recommend using its own patched branch and is very slow in pulling in changes from upstream (@decalage2), let's switch to the latter. This also allowed me to revert #4464.
Finally, a minor patch to rspamd is necessary. While the documentation says
In the extended mode the oletools module will not trigger on specific categories, but will always set a threat string with all found flags when at least a macro was found.
This is not actually true -- it only sets it when suspicious or autoexec threats were detected. But it's a one-line patch to make rspamd behave as documented and we should submit that patch to @rspamd too. With this patch, I have confirmed that Mailcow will reject any incoming, non-whitelisted message containing attachments with macros.
* [Web] Fix excluded domain list in quaratine view
Previously excluded domains from quarantine were not shown.
* [Dovecot] Update syslogng Version to 3.28 (#4496)
Co-authored-by: Niklas Meyer <niklas.meyer@tinc.gmbh>
Co-authored-by: ntimo <git@nowitzki.me>
Co-authored-by: Peter <magic@kthx.at>
Co-authored-by: FreddleSpl0it <patschul@posteo.de>
Co-authored-by: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com>
Co-authored-by: Michael Kuron <mkuron@users.noreply.github.com>
Co-authored-by: milkmaker <milkmaker@mailcow.de>
Co-authored-by: Fijxu <fijxu@zzls.xyz>
Co-authored-by: Slavi Pantaleev <slavi@devture.com>
Co-authored-by: Lukáš Matula <lukas@gbely.net>
Co-authored-by: Max <mail@heavygale.de>
Co-authored-by: Michael Cramer <michael@bigmichi1.de>
Co-authored-by: Robert Christian <soulsymphonies@users.noreply.github.com>
Co-authored-by: André <andre.peters@debinux.de>
Co-authored-by: Niklas Meyer <niklas.meyer@tinc.gmbh>
2022-03-02 16:32:17 +01:00
|
|
|
# && sed -i 's/template_injection_detected = True/template_injection_detected = False/g' /usr/lib/python3.9/site-packages/oletools/olevba.py
|
2019-06-16 17:36:22 +02:00
|
|
|
|
2022-01-18 20:55:44 +01:00
|
|
|
ADD olefy.py /app/
|
2019-06-25 18:52:05 +02:00
|
|
|
|
|
|
|
|
RUN chown -R nobody:nobody /app /tmp
|
|
|
|
|
|
|
|
|
|
USER nobody
|
2019-06-16 17:36:22 +02:00
|
|
|
|
|
|
|
|
CMD ["python3", "-u", "/app/olefy.py"]
|