Gnous/mailcow
2
0
Fork 0
Code Issues Pull Requests 1 Packages Projects Releases Wiki Activity

autodiscover: use generalized error logging instead of specific to prevent user enumeration

Browse Source
This commit is contained in:
DerLinkman 2025-12-18 16:54:45 +01:00
parent b005803fe0
commit 5ca900749c
No known key found for this signature in database
GPG Key ID: AA4A82514748F5A9
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
data/web/autodiscover.php
View File

@ -165,7 +165,7 @@ catch(PDOException $e) {
exit(0); exit(0);
} }
// Mailbox not found or not active - return error // Mailbox not found or not active - return generic error to prevent user enumeration
if (empty($MailboxData)) { if (empty($MailboxData)) {
try { try {
$json = json_encode( $json = json_encode(
@ -188,7 +188,7 @@ if (empty($MailboxData)) {
<Response> <Response>
<Error Time="<?=date('H:i:s', $sec) . substr($usec, 0, strlen($usec) - 2);?>" Id="<?=rand(1000000000, 9999999999);?>"> <Error Time="<?=date('H:i:s', $sec) . substr($usec, 0, strlen($usec) - 2);?>" Id="<?=rand(1000000000, 9999999999);?>">
<ErrorCode>600</ErrorCode> <ErrorCode>600</ErrorCode>
<Message>Mailbox not found</Message> <Message>Invalid Request</Message>
<DebugData /> <DebugData />
</Error> </Error>
</Response> </Response>