From 8a65b9d1c6549cd451a3d145461ee465bf87c1e8 Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Thu, 19 Mar 2026 12:41:47 +0100 Subject: [PATCH 001/123] add missing access control --- data/web/inc/functions.fwdhost.inc.php | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/data/web/inc/functions.fwdhost.inc.php b/data/web/inc/functions.fwdhost.inc.php index d7ac2567..52c75159 100644 --- a/data/web/inc/functions.fwdhost.inc.php +++ b/data/web/inc/functions.fwdhost.inc.php @@ -108,6 +108,14 @@ function fwdhost($_action, $_data = null) { } break; case 'delete': + if ($_SESSION['mailcow_cc_role'] != "admin") { + $_SESSION['return'][] = array( + 'type' => 'danger', + 'log' => array(__FUNCTION__, $_action, $_data_log), + 'msg' => 'access_denied' + ); + return false; + } $hosts = (array)$_data['forwardinghost']; foreach ($hosts as $host) { try { From ecb848493b0bd5ee79528bf8643239d120574438 Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Thu, 19 Mar 2026 12:42:45 +0100 Subject: [PATCH 002/123] add missing object-level access control --- data/web/inc/functions.mailbox.inc.php | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/data/web/inc/functions.mailbox.inc.php b/data/web/inc/functions.mailbox.inc.php index 9506bbf1..49642163 100644 --- a/data/web/inc/functions.mailbox.inc.php +++ b/data/web/inc/functions.mailbox.inc.php @@ -2062,6 +2062,14 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) { return false; } foreach ($usernames as $username) { + if (!hasMailboxObjectAccess($_SESSION['mailcow_cc_username'], $_SESSION['mailcow_cc_role'], $username)) { + $_SESSION['return'][] = array( + 'type' => 'danger', + 'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr), + 'msg' => 'access_denied' + ); + continue; + } if ($_data['spam_score'] == "default") { $stmt = $pdo->prepare("DELETE FROM `filterconf` WHERE `object` = :username AND (`option` = 'lowspamlevel' OR `option` = 'highspamlevel')"); From 84e3c32f13d397e47ea0d443ce1621742f78f401 Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Thu, 19 Mar 2026 12:44:00 +0100 Subject: [PATCH 003/123] escape HTML in last logins --- data/web/js/site/user.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/data/web/js/site/user.js b/data/web/js/site/user.js index 5eecf208..288e7abd 100644 --- a/data/web/js/site/user.js +++ b/data/web/js/site/user.js @@ -98,8 +98,8 @@ jQuery(function($){ var local_datetime = datetime.toLocaleDateString(undefined, {year: "numeric", month: "2-digit", day: "2-digit", hour: "2-digit", minute: "2-digit", second: "2-digit"}); var service = '
' + item.service.toUpperCase() + '
'; var app_password = item.app_password ? ' ' + escapeHtml(item.app_password_name || "App") + '' : ''; - var real_rip = item.real_rip.startsWith("Web") ? item.real_rip : '' + item.real_rip + ""; - var ip_location = item.location ? ' ' : ''; + var real_rip = item.real_rip.startsWith("Web") ? escapeHtml(item.real_rip) : '' + escapeHtml(item.real_rip) + ""; + var ip_location = item.location ? ' ' : ''; var ip_data = real_rip + ip_location + app_password; $(".last-sasl-login").append(` From edde35156d9a55e59c805a60d1d81790f120e2f4 Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Thu, 19 Mar 2026 12:44:30 +0100 Subject: [PATCH 004/123] escape HTML in qitem details --- data/web/js/site/quarantine.js | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/data/web/js/site/quarantine.js b/data/web/js/site/quarantine.js index fbf4fe86..8334ff50 100644 --- a/data/web/js/site/quarantine.js +++ b/data/web/js/site/quarantine.js @@ -226,18 +226,18 @@ jQuery(function($){ } if (typeof data.fuzzy_hashes === 'object' && data.fuzzy_hashes !== null && data.fuzzy_hashes.length !== 0) { $.each(data.fuzzy_hashes, function (index, value) { - $('#qid_detail_fuzzy').append('

' + value + '

'); + $('#qid_detail_fuzzy').append('

' + escapeHtml(value) + '

'); }); } else { $('#qid_detail_fuzzy').append('-'); } if (typeof data.score !== 'undefined' && typeof data.action !== 'undefined') { if (data.action == "add header") { - $('#qid_detail_score').append('' + data.score + ' - ' + lang.junk_folder + ''); + $('#qid_detail_score').append('' + escapeHtml(data.score) + ' - ' + lang.junk_folder + ''); } else if (data.action == "reject") { - $('#qid_detail_score').append('' + data.score + ' - ' + lang.rejected + ''); + $('#qid_detail_score').append('' + escapeHtml(data.score) + ' - ' + lang.rejected + ''); } else if (data.action == "rewrite subject") { - $('#qid_detail_score').append('' + data.score + ' - ' + lang.rewrite_subject + ''); + $('#qid_detail_score').append('' + escapeHtml(data.score) + ' - ' + lang.rewrite_subject + ''); } } if (typeof data.recipients !== 'undefined') { @@ -254,8 +254,8 @@ jQuery(function($){ qAtts.text(''); $.each(data.attachments, function(index, value) { qAtts.append( - '

' + value[0] + ' (' + value[1] + ')' + - ' - ' + lang.check_hash + '

' + '

' + escapeHtml(value[0]) + ' (' + escapeHtml(value[1]) + ')' + + ' - ' + lang.check_hash + '

' ); }); } From 95bf46c1e4f3efe304857074bfa7d324d9f85fe9 Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Thu, 19 Mar 2026 12:44:50 +0100 Subject: [PATCH 005/123] escape HTML in autodiscover logs --- data/web/js/site/dashboard.js | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/data/web/js/site/dashboard.js b/data/web/js/site/dashboard.js index 760e878f..aee36171 100644 --- a/data/web/js/site/dashboard.js +++ b/data/web/js/site/dashboard.js @@ -1128,6 +1128,11 @@ jQuery(function($){ item.ua = escapeHtml(item.ua); } item.ua = '' + item.ua + ''; + if (item.user == null) { + item.user = 'unknown'; + } else { + item.user = escapeHtml(item.user); + } if (item.service == "activesync") { item.service = 'ActiveSync'; } From 8c039f694fe3cd7a736249b4e017def1414c47e9 Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Thu, 19 Mar 2026 12:48:43 +0100 Subject: [PATCH 006/123] Improve template URI escaping and parameter handling --- data/web/inc/header.inc.php | 2 +- data/web/inc/twig.inc.php | 4 +++- data/web/templates/base.twig | 2 +- 3 files changed, 5 insertions(+), 3 deletions(-) diff --git a/data/web/inc/header.inc.php b/data/web/inc/header.inc.php index d2ce6f3d..e5737b63 100644 --- a/data/web/inc/header.inc.php +++ b/data/web/inc/header.inc.php @@ -89,7 +89,7 @@ $globalVariables = [ 'app_links' => $app_links, 'app_links_processed' => $app_links_processed, 'is_root_uri' => (parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH) == '/'), - 'uri' => $_SERVER['REQUEST_URI'], + 'uri' => parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH) ?: '/', ]; foreach ($globalVariables as $globalVariableName => $globalVariableValue) { diff --git a/data/web/inc/twig.inc.php b/data/web/inc/twig.inc.php index a3bc02d9..c4d0669d 100644 --- a/data/web/inc/twig.inc.php +++ b/data/web/inc/twig.inc.php @@ -13,7 +13,9 @@ $twig = new Environment($loader, [ // functions $twig->addFunction(new TwigFunction('query_string', function (array $params = []) { - return http_build_query(array_merge($_GET, $params)); + $allowed = ['lang', 'mobileconfig']; + $filtered = array_intersect_key($_GET, array_flip($allowed)); + return http_build_query(array_merge($filtered, $params)); })); $twig->addFunction(new TwigFunction('is_uri', function (string $uri, string $where = null) { diff --git a/data/web/templates/base.twig b/data/web/templates/base.twig index e1708950..9e20b08a 100644 --- a/data/web/templates/base.twig +++ b/data/web/templates/base.twig @@ -193,7 +193,7 @@ $(window).scroll(function() { }); // Select language and reopen active URL without POST function setLang(sel) { - $.post( '{{ uri }}', {lang: sel} ); + $.post( '{{ uri|escape("js") }}', {lang: sel} ); window.location.href = window.location.pathname + window.location.search; } // FIDO2 functions From 5a00b5124b58c4399b6320270947683efb080e89 Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Sun, 29 Mar 2026 12:08:45 +0200 Subject: [PATCH 007/123] [Web][Dovecot] Add parameterized queries and input validation for quarantine_category --- data/Dockerfiles/dovecot/quarantine_notify.py | 15 ++++++----- data/web/inc/functions.mailbox.inc.php | 27 +++++++++++++++++++ data/web/lang/lang.de-de.json | 1 + data/web/lang/lang.en-gb.json | 1 + docker-compose.yml | 2 +- 5 files changed, 39 insertions(+), 7 deletions(-) diff --git a/data/Dockerfiles/dovecot/quarantine_notify.py b/data/Dockerfiles/dovecot/quarantine_notify.py index a681c1fd..5757cdf5 100755 --- a/data/Dockerfiles/dovecot/quarantine_notify.py +++ b/data/Dockerfiles/dovecot/quarantine_notify.py @@ -47,7 +47,7 @@ try: if max_score == "": max_score = 9999.0 - def query_mysql(query, headers = True, update = False): + def query_mysql(query, params = None, headers = True, update = False): while True: try: cnx = MySQLdb.connect(user=os.environ.get('DBUSER'), password=os.environ.get('DBPASS'), database=os.environ.get('DBNAME'), charset="utf8mb4", collation="utf8mb4_general_ci") @@ -57,7 +57,10 @@ try: else: break cur = cnx.cursor() - cur.execute(query) + if params: + cur.execute(query, params) + else: + cur.execute(query) if not update: result = [] columns = tuple( [d[0] for d in cur.description] ) @@ -76,7 +79,7 @@ try: def notify_rcpt(rcpt, msg_count, quarantine_acl, category): if category == "add_header": category = "add header" - meta_query = query_mysql('SELECT `qhash`, id, subject, score, sender, created, action FROM quarantine WHERE notified = 0 AND rcpt = "%s" AND score < %f AND (action = "%s" OR "all" = "%s")' % (rcpt, max_score, category, category)) + meta_query = query_mysql('SELECT `qhash`, id, subject, score, sender, created, action FROM quarantine WHERE notified = 0 AND rcpt = %s AND score < %s AND (action = %s OR "all" = %s)', (rcpt, max_score, category, category)) print("%s: %d of %d messages qualify for notification" % (rcpt, len(meta_query), msg_count)) if len(meta_query) == 0: return @@ -130,7 +133,7 @@ try: server.sendmail(msg['From'], [str(redirect)] + [str(bcc)], text) server.quit() for res in meta_query: - query_mysql('UPDATE quarantine SET notified = 1 WHERE id = "%d"' % (res['id']), update = True) + query_mysql('UPDATE quarantine SET notified = 1 WHERE id = %s', (res['id'],), update = True) r.hset('Q_LAST_NOTIFIED', record['rcpt'], time_now) break except Exception as ex: @@ -138,7 +141,7 @@ try: print('%s' % (ex)) time.sleep(3) - records = query_mysql('SELECT IFNULL(user_acl.quarantine, 0) AS quarantine_acl, count(id) AS counter, rcpt FROM quarantine LEFT OUTER JOIN user_acl ON user_acl.username = rcpt WHERE notified = 0 AND score < %f AND rcpt in (SELECT username FROM mailbox) GROUP BY rcpt' % (max_score)) + records = query_mysql('SELECT IFNULL(user_acl.quarantine, 0) AS quarantine_acl, count(id) AS counter, rcpt FROM quarantine LEFT OUTER JOIN user_acl ON user_acl.username = rcpt WHERE notified = 0 AND score < %s AND rcpt in (SELECT username FROM mailbox) GROUP BY rcpt', (max_score,)) for record in records: attrs = '' @@ -156,7 +159,7 @@ try: except Exception as ex: print('Could not determine last notification for %s, assuming never' % (record['rcpt'])) last_notification = 0 - attrs_json = query_mysql('SELECT attributes FROM mailbox WHERE username = "%s"' % (record['rcpt'])) + attrs_json = query_mysql('SELECT attributes FROM mailbox WHERE username = %s', (record['rcpt'],)) attrs = attrs_json[0]['attributes'] if isinstance(attrs, str): # if attr is str then just load it diff --git a/data/web/inc/functions.mailbox.inc.php b/data/web/inc/functions.mailbox.inc.php index 49642163..adb330ea 100644 --- a/data/web/inc/functions.mailbox.inc.php +++ b/data/web/inc/functions.mailbox.inc.php @@ -1111,6 +1111,15 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) { $relayhost = (isset($_data['relayhost'])) ? intval($_data['relayhost']) : 0; $quarantine_notification = (isset($_data['quarantine_notification'])) ? strval($_data['quarantine_notification']) : strval($MAILBOX_DEFAULT_ATTRIBUTES['quarantine_notification']); $quarantine_category = (isset($_data['quarantine_category'])) ? strval($_data['quarantine_category']) : strval($MAILBOX_DEFAULT_ATTRIBUTES['quarantine_category']); + // Validate quarantine_category + if (!in_array($quarantine_category, array('add_header', 'reject', 'all'))) { + $_SESSION['return'][] = array( + 'type' => 'danger', + 'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr), + 'msg' => 'quarantine_category_invalid' + ); + return false; + } $quota_b = ($quota_m * 1048576); $attribute_hash = (!empty($_data['attribute_hash'])) ? $_data['attribute_hash'] : ''; if (in_array($authsource, array('keycloak', 'generic-oidc', 'ldap'))){ @@ -1733,6 +1742,15 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) { $attr["tagged_mail_handler"] = (!empty($_data['tagged_mail_handler'])) ? $_data['tagged_mail_handler'] : strval($MAILBOX_DEFAULT_ATTRIBUTES['tagged_mail_handler']); $attr["quarantine_notification"] = (!empty($_data['quarantine_notification'])) ? $_data['quarantine_notification'] : strval($MAILBOX_DEFAULT_ATTRIBUTES['quarantine_notification']); $attr["quarantine_category"] = (!empty($_data['quarantine_category'])) ? $_data['quarantine_category'] : strval($MAILBOX_DEFAULT_ATTRIBUTES['quarantine_category']); + // Validate quarantine_category + if (!in_array($attr["quarantine_category"], array('add_header', 'reject', 'all'))) { + $_SESSION['return'][] = array( + 'type' => 'danger', + 'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_extra), + 'msg' => 'quarantine_category_invalid' + ); + return false; + } $attr["rl_frame"] = (!empty($_data['rl_frame'])) ? $_data['rl_frame'] : "s"; $attr["rl_value"] = (!empty($_data['rl_value'])) ? $_data['rl_value'] : ""; $attr["force_pw_update"] = isset($_data['force_pw_update']) ? intval($_data['force_pw_update']) : intval($MAILBOX_DEFAULT_ATTRIBUTES['force_pw_update']); @@ -3798,6 +3816,15 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) { $attr["tagged_mail_handler"] = (!empty($_data['tagged_mail_handler'])) ? $_data['tagged_mail_handler'] : $is_now['tagged_mail_handler']; $attr["quarantine_notification"] = (!empty($_data['quarantine_notification'])) ? $_data['quarantine_notification'] : $is_now['quarantine_notification']; $attr["quarantine_category"] = (!empty($_data['quarantine_category'])) ? $_data['quarantine_category'] : $is_now['quarantine_category']; + // Validate quarantine_category + if (!in_array($attr["quarantine_category"], array('add_header', 'reject', 'all'))) { + $_SESSION['return'][] = array( + 'type' => 'danger', + 'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_extra), + 'msg' => 'quarantine_category_invalid' + ); + continue; + } $attr["rl_frame"] = (!empty($_data['rl_frame'])) ? $_data['rl_frame'] : $is_now['rl_frame']; $attr["rl_value"] = (!empty($_data['rl_value'])) ? $_data['rl_value'] : $is_now['rl_value']; $attr["force_pw_update"] = isset($_data['force_pw_update']) ? intval($_data['force_pw_update']) : $is_now['force_pw_update']; diff --git a/data/web/lang/lang.de-de.json b/data/web/lang/lang.de-de.json index 487300fe..3672762d 100644 --- a/data/web/lang/lang.de-de.json +++ b/data/web/lang/lang.de-de.json @@ -512,6 +512,7 @@ "pushover_credentials_missing": "Pushover Token und/oder Key fehlen", "pushover_key": "Pushover Key hat das falsche Format", "pushover_token": "Pushover Token hat das falsche Format", + "quarantine_category_invalid": "Quarantäne-Kategorie muss eine der folgenden sein: add_header, reject, all", "quota_not_0_not_numeric": "Speicherplatz muss numerisch und >= 0 sein", "recipient_map_entry_exists": "Eine Empfängerumschreibung für Objekt \"%s\" existiert bereits", "recovery_email_failed": "E-Mail zur Wiederherstellung konnte nicht gesendet werden. Bitte wenden Sie sich an Ihren Administrator.", diff --git a/data/web/lang/lang.en-gb.json b/data/web/lang/lang.en-gb.json index eb26e3fc..e786bcbe 100644 --- a/data/web/lang/lang.en-gb.json +++ b/data/web/lang/lang.en-gb.json @@ -513,6 +513,7 @@ "pushover_credentials_missing": "Pushover token and or key missing", "pushover_key": "Pushover key has a wrong format", "pushover_token": "Pushover token has a wrong format", + "quarantine_category_invalid": "Quarantine category must be one of: add_header, reject, all", "quota_not_0_not_numeric": "Quota must be numeric and >= 0", "recipient_map_entry_exists": "A Recipient map entry \"%s\" exists", "recovery_email_failed": "Could not send a recovery email. Please contact your administrator.", diff --git a/docker-compose.yml b/docker-compose.yml index edddc655..0a9578de 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -252,7 +252,7 @@ services: - sogo dovecot-mailcow: - image: ghcr.io/mailcow/dovecot:2.3.21.1-1 + image: ghcr.io/mailcow/dovecot:2.3.21.1-2 depends_on: - mysql-mailcow - netfilter-mailcow From 08278a8be9f8e44357516250a8a5993458c737f5 Mon Sep 17 00:00:00 2001 From: Dmitriy Alekseev <1865999+dragoangel@users.noreply.github.com> Date: Mon, 30 Mar 2026 23:51:05 +0200 Subject: [PATCH 008/123] Update RSPAMD version to 4.0.0 in Dockerfile --- data/Dockerfiles/rspamd/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/Dockerfiles/rspamd/Dockerfile b/data/Dockerfiles/rspamd/Dockerfile index d0c71042..aed261ab 100644 --- a/data/Dockerfiles/rspamd/Dockerfile +++ b/data/Dockerfiles/rspamd/Dockerfile @@ -2,7 +2,7 @@ FROM debian:trixie-slim LABEL maintainer="The Infrastructure Company GmbH " ARG DEBIAN_FRONTEND=noninteractive -ARG RSPAMD_VER=rspamd_3.14.3-1~236eb65 +ARG RSPAMD_VER=rspamd_4.0.0-1~4a2ab73 ARG CODENAME=trixie ENV LC_ALL=C From dc15994d4014a0b0cad2d408090aae9e7fbea3cd Mon Sep 17 00:00:00 2001 From: milkmaker Date: Thu, 2 Apr 2026 11:50:05 +0200 Subject: [PATCH 009/123] update postscreen_access.cidr (#7177) --- data/conf/postfix/postscreen_access.cidr | 98 ++++++++++++++++++++---- 1 file changed, 85 insertions(+), 13 deletions(-) diff --git a/data/conf/postfix/postscreen_access.cidr b/data/conf/postfix/postscreen_access.cidr index de38fe39..2f7891cd 100644 --- a/data/conf/postfix/postscreen_access.cidr +++ b/data/conf/postfix/postscreen_access.cidr @@ -1,6 +1,6 @@ -# Whitelist generated by Postwhite v3.4 on Sun Mar 1 00:29:01 UTC 2026 +# Whitelist generated by Postwhite v3.4 on Wed Apr 1 00:33:31 UTC 2026 # https://github.com/stevejenkins/postwhite/ -# 2174 total rules +# 2246 total rules 2a00:1450:4000::/36 permit 2a01:111:f400::/48 permit 2a01:111:f403:2800::/53 permit @@ -31,8 +31,10 @@ 2a02:a60:0:5::/64 permit 2a0f:f640::/56 permit 2c0f:fb50:4000::/36 permit +2.207.151.32/27 permit 2.207.151.53 permit 2.207.217.30 permit +2.207.223.160/27 permit 3.64.237.68 permit 3.65.3.180 permit 3.70.123.177 permit @@ -58,8 +60,8 @@ 8.40.222.0/23 permit 8.40.222.250/31 permit 12.130.86.238 permit -13.107.213.51 permit -13.107.246.51 permit +13.107.213.38 permit +13.107.246.38 permit 13.108.16.0/20 permit 13.110.208.0/21 permit 13.110.209.0/24 permit @@ -368,6 +370,7 @@ 64.132.88.0/23 permit 64.132.92.0/24 permit 64.181.194.190 permit +64.181.213.254 permit 64.207.219.7 permit 64.207.219.8 permit 64.207.219.9 permit @@ -453,7 +456,11 @@ 66.218.75.252/31 permit 66.218.75.254 permit 66.220.144.128/25 permit +66.220.144.178 permit +66.220.144.179 permit 66.220.155.0/24 permit +66.220.155.178 permit +66.220.155.179 permit 66.220.157.0/25 permit 66.231.80.0/20 permit 66.240.227.0/24 permit @@ -518,6 +525,8 @@ 69.162.98.0/24 permit 69.169.224.0/20 permit 69.171.232.0/24 permit +69.171.232.180 permit +69.171.232.181 permit 69.171.244.0/23 permit 70.42.149.35 permit 72.3.185.0/24 permit @@ -639,6 +648,7 @@ 77.238.189.148/30 permit 79.135.106.0/24 permit 79.135.107.0/24 permit +80.225.160.128/25 permit 81.169.146.243 permit 81.169.146.245 permit 81.169.146.246 permit @@ -657,6 +667,9 @@ 82.165.159.45 permit 82.165.159.130 permit 82.165.159.131 permit +84.8.68.0/25 permit +84.8.192.128/25 permit +84.8.224.128/25 permit 85.9.206.169 permit 85.9.210.45 permit 85.158.136.0/21 permit @@ -1408,6 +1421,20 @@ 129.146.88.28 permit 129.146.147.105 permit 129.146.236.58 permit +129.148.135.0/25 permit +129.148.148.0/25 permit +129.148.164.0/25 permit +129.148.180.0/25 permit +129.148.215.0/25 permit +129.149.6.0/25 permit +129.149.22.0/25 permit +129.149.38.0/25 permit +129.149.52.0/25 permit +129.149.68.0/25 permit +129.149.84.0/25 permit +129.149.100.0/25 permit +129.149.118.0/25 permit +129.149.126.0/25 permit 129.151.67.221 permit 129.153.62.216 permit 129.153.104.71 permit @@ -1420,16 +1447,19 @@ 129.159.22.159 permit 129.159.87.137 permit 129.213.195.191 permit +130.35.116.0/25 permit 130.61.9.72 permit 130.162.39.83 permit 130.248.172.0/24 permit 130.248.173.0/24 permit +131.186.12.0/25 permit 131.253.30.0/24 permit 131.253.121.0/26 permit 132.145.13.209 permit 132.226.26.225 permit 132.226.49.32 permit 132.226.56.24 permit +134.98.248.128/25 permit 134.128.64.0/19 permit 134.128.96.0/19 permit 134.170.27.8 permit @@ -1460,6 +1490,10 @@ 136.147.182.0/24 permit 136.147.224.0/20 permit 136.179.50.206 permit +136.248.224.128/25 permit +136.248.232.128/25 permit +138.1.108.0/25 permit +138.1.170.0/24 permit 139.60.152.0/22 permit 139.138.35.44 permit 139.138.46.121 permit @@ -1468,6 +1502,7 @@ 139.138.57.55 permit 139.138.58.119 permit 139.167.79.86 permit +139.177.108.0/25 permit 139.180.17.0/24 permit 140.238.148.191 permit 141.148.55.217 permit @@ -1506,6 +1541,9 @@ 146.88.28.0/24 permit 146.148.116.76 permit 147.154.32.0/25 permit +147.154.63.0/24 permit +147.154.126.0/24 permit +147.154.191.0/24 permit 147.243.1.47 permit 147.243.1.48 permit 147.243.1.153 permit @@ -1517,12 +1555,16 @@ 149.72.234.184 permit 149.72.248.236 permit 149.97.173.180 permit +149.118.160.128/25 permit 150.136.21.199 permit 150.230.98.160 permit 151.145.38.14 permit 152.67.105.195 permit 152.69.200.236 permit 152.70.155.126 permit +155.248.135.128/25 permit +155.248.140.0/25 permit +155.248.148.0/25 permit 155.248.208.51 permit 155.248.220.138 permit 155.248.234.149 permit @@ -1531,10 +1573,14 @@ 157.58.30.128/25 permit 157.58.196.96/29 permit 157.58.249.3 permit +157.137.32.128/25 permit +157.137.96.128/25 permit 157.151.208.65 permit 157.255.1.64/29 permit 158.101.211.207 permit 158.247.16.0/20 permit +158.247.100.0/25 permit +159.13.4.0/25 permit 159.92.154.0/24 permit 159.92.155.0/24 permit 159.92.157.0/24 permit @@ -1568,6 +1614,7 @@ 161.71.64.0/20 permit 162.88.4.0/23 permit 162.88.8.0/24 permit +162.88.24.0/23 permit 162.88.24.0/24 permit 162.88.25.0/24 permit 162.88.36.0/24 permit @@ -1585,10 +1632,12 @@ 164.152.23.32 permit 164.152.25.241 permit 164.177.132.168/30 permit +165.1.100.0/25 permit 165.173.128.0/24 permit 165.173.180.1 permit 165.173.180.250/31 permit 165.173.182.250/31 permit +165.173.189.205 permit 166.78.68.0/22 permit 166.78.68.221 permit 166.78.69.169 permit @@ -1607,9 +1656,12 @@ 167.89.75.126 permit 167.89.75.136 permit 167.89.75.164 permit -167.89.101.2 permit -167.89.101.192/28 permit 167.220.67.232/29 permit +168.107.248.128/25 permit +168.110.160.128/25 permit +168.110.248.128/25 permit +168.129.184.128/25 permit +168.129.248.128/25 permit 168.138.5.36 permit 168.138.73.51 permit 168.138.77.31 permit @@ -1745,8 +1797,24 @@ 192.18.139.154 permit 192.18.145.36 permit 192.18.152.58 permit +192.22.32.128/25 permit +192.22.96.128/25 permit +192.22.160.128/25 permit +192.22.224.128/25 permit 192.28.128.0/18 permit +192.29.24.0/25 permit +192.29.44.0/25 permit +192.29.72.0/25 permit +192.29.88.0/25 permit 192.29.103.128/25 permit +192.29.134.0/25 permit +192.29.151.128/25 permit +192.29.172.0/25 permit +192.29.178.0/25 permit +192.29.200.0/25 permit +192.29.216.0/25 permit +192.29.232.0/25 permit +192.29.248.0/25 permit 192.30.252.0/22 permit 192.161.144.0/20 permit 192.162.87.0/24 permit @@ -1754,11 +1822,6 @@ 192.237.159.42 permit 192.237.159.43 permit 192.254.112.0/20 permit -192.254.112.60 permit -192.254.112.98/31 permit -192.254.113.10 permit -192.254.113.101 permit -192.254.114.176 permit 193.109.254.0/23 permit 193.122.128.100 permit 193.123.56.63 permit @@ -1927,6 +1990,7 @@ 207.211.30.128/25 permit 207.211.31.0/25 permit 207.211.41.113 permit +207.211.132.0/25 permit 207.218.90.0/24 permit 207.218.90.122 permit 207.250.68.0/24 permit @@ -1934,6 +1998,8 @@ 208.43.21.28/30 permit 208.43.21.64/29 permit 208.43.21.72/30 permit +208.56.9.224 permit +208.56.13.196 permit 208.64.132.0/22 permit 208.71.40.63 permit 208.71.40.64/31 permit @@ -1960,6 +2026,7 @@ 208.71.42.214 permit 208.72.249.240/29 permit 208.75.120.0/22 permit +208.76.62.0/23 permit 208.76.62.0/24 permit 208.76.63.0/24 permit 208.82.237.96/29 permit @@ -2120,6 +2187,7 @@ 216.136.168.80/28 permit 216.139.64.0/19 permit 216.145.221.0/24 permit +216.146.32.0/23 permit 216.146.32.0/24 permit 216.146.33.0/24 permit 216.198.0.0/18 permit @@ -2140,6 +2208,7 @@ 223.165.120.0/23 permit 2001:0868:0100:0600::/64 permit 2001:4860:4000::/36 permit +2001:4860:4864::/56 permit 2001:748:100:40::2:0/112 permit 2001:748:400:1300::3 permit 2001:748:400:1300::4 permit @@ -2157,10 +2226,12 @@ 2001:748:400:3301::3 permit 2001:748:400:3301::4 permit 2404:6800:4000::/36 permit +2404:6800:4864::/56 permit 2607:13c0:0001:0000:0000:0000:0000:7000/116 permit 2607:13c0:0002:0000:0000:0000:0000:1000/116 permit 2607:13c0:0004:0000:0000:0000:0000:0000/116 permit 2607:f8b0:4000::/36 permit +2607:f8b0:4864::/56 permit 2620:109:c003:104::/64 permit 2620:109:c003:104::215 permit 2620:109:c006:104::/64 permit @@ -2172,8 +2243,9 @@ 2620:10d:c09c:400::8:1 permit 2620:119:50c0:207::/64 permit 2620:119:50c0:207::215 permit -2620:1ec:46::51 permit -2620:1ec:bdf::51 permit +2620:1ec:46::38 permit +2620:1ec:bdf::38 permit 2800:3f0:4000::/36 permit +2800:3f0:4864::/56 permit 49.12.4.251 permit # checks.mailcow.email 2a01:4f8:c17:7906::10 permit # checks.mailcow.email From 694d7519155cdc9365fc1c886b6eab8e2e537197 Mon Sep 17 00:00:00 2001 From: Dmitriy Alekseev <1865999+dragoangel@users.noreply.github.com> Date: Mon, 6 Apr 2026 17:28:14 +0200 Subject: [PATCH 010/123] Update RSPAMD version in Dockerfile --- data/Dockerfiles/rspamd/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/Dockerfiles/rspamd/Dockerfile b/data/Dockerfiles/rspamd/Dockerfile index aed261ab..4a666613 100644 --- a/data/Dockerfiles/rspamd/Dockerfile +++ b/data/Dockerfiles/rspamd/Dockerfile @@ -2,7 +2,7 @@ FROM debian:trixie-slim LABEL maintainer="The Infrastructure Company GmbH " ARG DEBIAN_FRONTEND=noninteractive -ARG RSPAMD_VER=rspamd_4.0.0-1~4a2ab73 +ARG RSPAMD_VER=rspamd_4.0.-1~8700333 ARG CODENAME=trixie ENV LC_ALL=C From b0873edb6a49d3ff0ffd2043d3ce3b8b9e856ac8 Mon Sep 17 00:00:00 2001 From: Dmitriy Alekseev <1865999+dragoangel@users.noreply.github.com> Date: Mon, 6 Apr 2026 17:28:32 +0200 Subject: [PATCH 011/123] Update RSPAMD version in Dockerfile --- data/Dockerfiles/rspamd/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/Dockerfiles/rspamd/Dockerfile b/data/Dockerfiles/rspamd/Dockerfile index 4a666613..ab9aaa5a 100644 --- a/data/Dockerfiles/rspamd/Dockerfile +++ b/data/Dockerfiles/rspamd/Dockerfile @@ -2,7 +2,7 @@ FROM debian:trixie-slim LABEL maintainer="The Infrastructure Company GmbH " ARG DEBIAN_FRONTEND=noninteractive -ARG RSPAMD_VER=rspamd_4.0.-1~8700333 +ARG RSPAMD_VER=rspamd_4.0.1-1~8700333 ARG CODENAME=trixie ENV LC_ALL=C From 886dbcc4196e0660912d843a98ab089fe75a8e7a Mon Sep 17 00:00:00 2001 From: milkmaker Date: Sat, 11 Apr 2026 21:25:03 +0200 Subject: [PATCH 012/123] Translations update from Weblate (#7190) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * [Web] Updated lang.az-az.json [Web] Added lang.az-az.json Co-authored-by: Nemoralis Co-authored-by: Peter Co-authored-by: milkmaker * [Web] Updated lang.si-si.json Co-authored-by: Matjaž Tekavec * [Web] Updated lang.pt-br.json Co-authored-by: André Ribas --------- Co-authored-by: Nemoralis Co-authored-by: Peter Co-authored-by: Matjaž Tekavec Co-authored-by: André Ribas --- data/web/lang/lang.az-az.json | 5 +++ data/web/lang/lang.pt-br.json | 58 ++++++++++++++++++++++------------- data/web/lang/lang.si-si.json | 3 +- 3 files changed, 43 insertions(+), 23 deletions(-) create mode 100644 data/web/lang/lang.az-az.json diff --git a/data/web/lang/lang.az-az.json b/data/web/lang/lang.az-az.json new file mode 100644 index 00000000..0862f691 --- /dev/null +++ b/data/web/lang/lang.az-az.json @@ -0,0 +1,5 @@ +{ + "acl": { + "login_as": "E-poçt qutusu istifadəçisi olaraq daxil ol" + } +} diff --git a/data/web/lang/lang.pt-br.json b/data/web/lang/lang.pt-br.json index b01d9765..24105db1 100644 --- a/data/web/lang/lang.pt-br.json +++ b/data/web/lang/lang.pt-br.json @@ -111,7 +111,8 @@ "validation_success": "Validado com sucesso", "dry": "Simular sincronização", "internal": "Interno", - "internal_info": "Aliases internos são acessíveis apenas a partir do próprio domínio ou alias de domínio." + "internal_info": "Aliases internos são acessíveis apenas a partir do próprio domínio ou alias de domínio.", + "sender_allowed": "Permitir enviar como este alias" }, "admin": { "access": "Acesso", @@ -151,7 +152,7 @@ "arrival_time": "Hora de chegada (hora do servidor)", "authed_user": "Usuário autoritário", "ays": "Tem certeza de que deseja continuar?", - "ban_list_info": "Veja uma lista de IPs banidos abaixo: rede (tempo restante de banimento) - [ações].
Os IPs na fila para serem desbanidos serão removidos da lista de banimentos ativos em alguns segundos.
Rótulos vermelhos indicam proibições permanentes ativas na lista negra.", + "ban_list_info": "Veja abaixo a lista de IPs banidos: rede (tempo restante do banimento) - [ações].
IPs na fila para serem desbanidos serão removidos da lista de banimentos ativos em alguns segundos.
Rótulos vermelhos indicam banimentos permanentes ativos na lista de bloqueio.", "change_logo": "Alterar logotipo", "logo_normal_label": "Normal", "logo_dark_label": "Invertido para o modo escuro", @@ -188,9 +189,9 @@ "excludes": "Exclui esses destinatários", "f2b_ban_time": "Tempo (s) de proibição", "f2b_ban_time_increment": "O tempo de banimento é incrementado com cada banimento", - "f2b_blacklist": "Redes/hosts na lista negra", + "f2b_blacklist": "Redes/hosts na lista de bloqueio", "f2b_filter": "Filtros Regex", - "f2b_list_info": "Um host ou rede na lista negra sempre superará uma entidade na lista branca. As atualizações da lista levarão alguns segundos para serem aplicadas.", + "f2b_list_info": "Um host ou rede na lista de bloqueio sempre terá prioridade sobre uma entidade na lista de permissões. As atualizações das listas levarão alguns segundos para serem aplicadas.", "f2b_manage_external": "Gerenciar Fail2Ban externamente", "f2b_manage_external_info": "O Fail2ban ainda manterá a lista de banimentos, mas não definirá ativamente regras para bloquear o tráfego. Use a lista de banimento gerada abaixo para bloquear externamente o tráfego.", "f2b_max_attempts": "Máximo de tentativas", @@ -200,7 +201,7 @@ "f2b_parameters": "Parâmetros do Fail2ban", "f2b_regex_info": "Registros considerados: SoGo, Postfix, Dovecot, PHP-FPM.", "f2b_retry_window": "Repita a (s) janela (s) para o máximo de tentativas", - "f2b_whitelist": "Redes/hosts incluídos na lista branca", + "f2b_whitelist": "Redes/hosts na lista de permissões", "filter_table": "Tabela de filtros", "forwarding_hosts": "Anfitriões de encaminhamento", "forwarding_hosts_add_hint": "Você pode especificar endereços IPv4/IPv6, redes em notação CIDR, nomes de host (que serão resolvidos para endereços IP) ou nomes de domínio (que serão resolvidos para endereços IP consultando registros SPF ou, na ausência deles, registros MX).", @@ -320,8 +321,8 @@ "rspamd_com_settings": "Um nome de configuração será gerado automaticamente, veja os exemplos de predefinições abaixo. Para obter mais detalhes, consulte a documentação do Rspamd", "rspamd_global_filters": "Mapas de filtro globais", "rspamd_global_filters_agree": "Eu vou ter cuidado!", - "rspamd_global_filters_info": "Os mapas de filtros globais contêm diferentes tipos de listas negras e brancas globais.", - "rspamd_global_filters_regex": "Seus nomes explicam seu propósito. Todo o conteúdo deve conter uma expressão regular válida no formato “/padrão/opções” (por exemplo, /. + @domain\\ .tld/i).
\r\n Embora verificações rudimentares estejam sendo executadas em cada linha de regex, a funcionalidade do Rspamd pode ser interrompida se não conseguir ler a sintaxe corretamente.
\r\n O Rspamd tentará ler o conteúdo do mapa quando alterado. Se você tiver problemas, reinicie o Rspamd para forçar o recarregamento do mapa.
Os elementos da lista negra são excluídos da quarentena.", + "rspamd_global_filters_info": "Os mapas de filtros globais contêm diferentes tipos de listas globais de bloqueio e de permissões.", + "rspamd_global_filters_regex": "Os nomes explicam sua finalidade. Todo o conteúdo deve conter uma expressão regular válida no formato \"/padrão/opções\" (por exemplo, /.[+@domain.tld](mailto:+@domain.tld)/i).
\nEmbora verificações básicas sejam executadas em cada linha de regex, a funcionalidade do Rspamd pode ser comprometida se ele não conseguir ler a sintaxe corretamente.
\nO Rspamd tentará ler o conteúdo do mapa quando ele for alterado. Se você tiver problemas, reinicie o Rspamd para forçar o recarregamento do mapa.
Elementos na lista de bloqueio são excluídos da quarentena.", "rspamd_settings_map": "Mapa de configurações do Rspamd", "sal_level": "Nível de humor", "save": "Salvar alterações", @@ -556,7 +557,9 @@ "mode_invalid": "Modo %s é inválido", "mx_invalid": "Registro MX %s é inválido", "required_data_missing": "Dados obrigatórios %s estão ausentes", - "version_invalid": "Versão %s é inválida" + "version_invalid": "Versão %s é inválida", + "tfa_removal_blocked": "A autenticação de dois fatores não pode ser removida, pois é obrigatória para a sua conta.", + "quarantine_category_invalid": "A categoria da quarentena deve ser uma das seguintes: add_header, reject, all" }, "datatables": { "collapse_all": "Recolher tudo", @@ -746,13 +749,13 @@ "sieve_desc": "Breve descrição", "sieve_type": "Tipo de filtro", "skipcrossduplicates": "Ignore mensagens duplicadas entre pastas (primeiro a chegar, primeiro a ser servido)", - "sogo_access": "Encaminhamento direto para o SOGoo", - "sogo_access_info": "Depois de fazer login, o usuário é automaticamente redirecionado para o SOGo.", + "sogo_access": "Encaminhamento direto para o SOGo", + "sogo_access_info": "Após o login, o usuário é automaticamente redirecionado para o SOGo.", "sogo_visible": "O alias é visível no SoGo", "sogo_visible_info": "Essa opção afeta somente objetos, que podem ser exibidos no SoGo (endereços de alias compartilhados ou não compartilhados apontando para pelo menos uma mailbox local). Se estiver oculto, um alias não aparecerá como remetente selecionável no SoGo.", "spam_alias": "Crie ou altere endereços de alias com limite de tempo", "spam_filter": "Filtro de spam", - "spam_policy": "Adicionar ou remover itens da lista branca/negra", + "spam_policy": "Adicionar ou remover itens da lista de permissões/bloqueio", "spam_score": "Defina uma pontuação de spam personalizada", "subfolder2": "Sincronizar na subpasta no destino
(vazio = não usar subpasta)", "syncjob": "Editar tarefa de sincronização", @@ -781,7 +784,9 @@ "mta_sts_max_age_info": "Tempo em segundos que servidores de email de recepção podem armazenar esta política em cache até buscar novamente.", "mta_sts_mx": "Servidor MX", "mta_sts_mx_info": "Permite envio apenas para nomes de host de servidor de email explicitamente listados; o MTA de envio verifica se o nome do host DNS MX corresponde à lista de políticas e permite entrega apenas com certificado TLS válido (protege contra MITM).", - "mta_sts_mx_notice": "Múltiplos servidores MX podem ser especificados (separados por vírgulas)." + "mta_sts_mx_notice": "Múltiplos servidores MX podem ser especificados (separados por vírgulas).", + "sender_allowed": "Permitir enviar como este alias", + "sender_allowed_info": "Se desativado, este alias poderá apenas receber e-mails. Use a ACL de remetente para substituir essa configuração e conceder a caixas de correio específicas permissão para enviar." }, "fido2": { "confirm": "Confirme", @@ -970,7 +975,7 @@ "recipient_map_new": "Novo destinatário", "recipient_map_new_info": "O destino do mapa do destinatário deve ser um endereço de e-mail válido ou um nome de domínio.", "recipient_map_old": "Destinatário original", - "recipient_map_old_info": "O destino original do mapa de um destinatário deve ser um endereço de e-mail válido ou um nome de domínio.", + "recipient_map_old_info": "O destino original do mapa de destinatário deve ser um endereço de e-mail válido ou um nome de domínio.", "recipient_maps": "Mapas de destinatários", "relay_all": "Retransmita todos os destinatários", "relay_unknown": "Retransmitir mailboxes desconhecidas", @@ -1061,7 +1066,7 @@ "notified": "Notificado", "qhandler_success": "Solicitação enviada com sucesso para o sistema. Agora você pode fechar a janela.", "qid": "Respand AID", - "qinfo": "O sistema de quarentena salvará as mensagens rejeitadas no banco de dados (o remetente não terá a impressão de uma mensagem entregue), bem como as mensagens, que são entregues como cópia na pasta Lixo eletrônico de uma mailbox.\n
“Aprenda como spam e exclua” aprenderá uma mensagem como spam por meio do Teorema de Bayes e também calculará hashes difusos para negar mensagens semelhantes no futuro.\n
Esteja ciente de que aprender várias mensagens pode ser demorado, dependendo do seu sistema.
Os elementos da lista negra são excluídos da quarentena.", + "qinfo": "O sistema de quarentena irá salvar no banco de dados os e-mails rejeitados (o remetente não terá a impressão de que o e-mail foi entregue), bem como os e-mails que são entregues como cópia na pasta de spam de uma mailbox.\n
“Aprender como spam e excluir” irá classificar a mensagem como spam por meio do Teorema de Bayes e também calcular hashes fuzzy para bloquear mensagens semelhantes no futuro.\n
Esteja ciente de que o aprendizado de múltiplas mensagens pode, dependendo do seu sistema, levar tempo.
Elementos na lista de bloqueio são excluídos da quarentena.", "qitem": "Item de quarentena", "quarantine": "Quarentena", "quick_actions": "Ações", @@ -1237,7 +1242,12 @@ "webauthn": "Autenticação WebAuthn", "waiting_usb_auth": "Aguardando o dispositivo USB...

Toque no botão no seu dispositivo USB agora.", "waiting_usb_register": "Aguardando o dispositivo USB...

Digite sua senha acima e confirme seu registro tocando no botão no seu dispositivo USB.", - "yubi_otp": "Autenticação Yubico OTP" + "yubi_otp": "Autenticação Yubico OTP", + "force_tfa": "Forçar o cadastro de 2FA no login", + "force_tfa_info": "O usuário será obrigado a configurar a autenticação de dois fatores antes de acessar o painel.", + "setup_title": "Autenticação de Dois Fatores Obrigatória", + "setup_required": "Sua conta exige autenticação de dois fatores. Configure um método de 2FA para continuar.", + "cancel_setup": "Cancelar e sair" }, "user": { "action": "Ação", @@ -1276,7 +1286,7 @@ "delete_ays": "Confirme o processo de exclusão.", "direct_aliases": "Endereços de alias diretos", "direct_aliases_desc": "Os endereços de alias diretos são afetados pelo filtro de spam e pelas configurações da política TLS.", - "direct_protocol_access": "Esse usuário da mailbox tem acesso externo direto aos seguintes protocolos e aplicativos. Essa configuração é controlada pelo administrador. As senhas de aplicativos podem ser criadas para conceder acesso a protocolos e aplicativos individuais.
O botão “Login no webmail” fornece login único no SoGo e está sempre disponível.", + "direct_protocol_access": "Este usuário da mailbox possui acesso direto e externo aos seguintes protocolos e aplicações. Esta configuração é controlada pelo seu administrador. Senhas de aplicativo podem ser criadas para conceder acesso a protocolos e aplicações específicos.
O botão “Webmail” fornece login único (SSO) para o SOGo e está sempre disponível.", "eas_reset": "Redefinir o cache do dispositivo ActiveSync", "eas_reset_help": "Em muitos casos, uma redefinição do cache do dispositivo ajudará a recuperar um perfil quebrado do ActiveSync.
Atenção: Todos os elementos serão baixados novamente!", "eas_reset_now": "Reinicie agora", @@ -1352,12 +1362,12 @@ "sogo_profile_reset": "Redefinir perfil SoGo", "sogo_profile_reset_help": "Isso destruirá o perfil SoGo de um usuário e excluirá todos os dados de contato e calendário irrecuperáveis.", "sogo_profile_reset_now": "Redefina o perfil agora", - "spam_aliases": "Aliases de e-mail temporários", + "spam_aliases": "Aliases de e-mail de spam", "spam_score_reset": "Redefinir para o padrão do servidor", "spamfilter": "Filtro de spam", "spamfilter_behavior": "Avaliação", - "spamfilter_bl": "Lista negra", - "spamfilter_bl_desc": "Endereços de e-mail na lista negra para sempre serem classificados como spam e rejeitados. E-mails rejeitados não serão copiados para a quarentena. Podem ser usados curingas. Um filtro só é aplicado a aliases diretos (aliases com uma única caixa de correio de destino), excluindo aliases abrangentes e a própria mailbox.", + "spamfilter_bl": "Lista de bloqueio", + "spamfilter_bl_desc": "Endereços de e-mail na lista de bloqueio para sempre classificar como spam e rejeitados. E-mails rejeitados não serão copiados para a quarentena. Coringas podem ser utilizados. O filtro é aplicado apenas a aliases diretos (aliases com uma única mailbox de destino), excluindo aliases catch-all e a própria mailbox.", "spamfilter_default_score": "Valores padrão", "spamfilter_green": "Verde: esta mensagem não é spam", "spamfilter_hint": "O primeiro valor descreve a “pontuação baixa de spam”, o segundo representa a “alta pontuação de spam”.", @@ -1368,8 +1378,8 @@ "spamfilter_table_empty": "Não há dados para exibir", "spamfilter_table_remove": "remover", "spamfilter_table_rule": "Regra", - "spamfilter_wl": "Lista branca", - "spamfilter_wl_desc": "Os endereços de e-mail incluídos na lista branca são programados para nunca serem classificados como spam. Podem ser usados curingas. Um filtro só é aplicado a aliases diretos (aliases com uma única mailbox de destino), excluindo aliases abrangentes e a própria mailbox.", + "spamfilter_wl": "Lista de permissões", + "spamfilter_wl_desc": "Endereços de e-mail na lista de permissões são configurados para nunca serem classificados como spam. Coringas podem ser utilizados. O filtro é aplicado apenas a aliases diretos (aliases com uma única mailbox de destino), excluindo aliases catch-all e a própria mailbox.", "spamfilter_yellow": "Amarelo: esta mensagem pode ser spam, será marcada como spam e movida para sua pasta de lixo eletrônico", "status": "Status", "sync_jobs": "Trabalhos de sincronização", @@ -1408,7 +1418,11 @@ "authentication": "Autenticação", "overview": "Visão geral", "protocols": "Protocolos", - "tfa_info": "A autenticação de dois fatores ajuda a proteger sua conta. Se você habilitá-la, precisará de senhas de aplicativo para fazer login em aplicativos ou serviços que não suportam autenticação de dois fatores (por exemplo, clientes de email)." + "tfa_info": "A autenticação de dois fatores ajuda a proteger sua conta. Se você habilitá-la, precisará de senhas de aplicativo para fazer login em aplicativos ou serviços que não suportam autenticação de dois fatores (por exemplo, clientes de email).", + "expire_never": "Nunca expirar", + "forever": "Para sempre", + "pw_update_required": "Sua conta exige a alteração de senha. Defina uma nova senha para continuar.", + "spam_aliases_info": "Um alias de spam é um endereço de e-mail temporário que pode ser usado para proteger endereços de e-mail reais.
Opcionalmente, pode-se definir um tempo de expiração para que o alias seja automaticamente desativado após o período definido, descartando efetivamente endereços que tenham sido abusados ou vazados." }, "warning": { "cannot_delete_self": "Não é possível excluir o usuário conectado", diff --git a/data/web/lang/lang.si-si.json b/data/web/lang/lang.si-si.json index 5b7b8574..f5ba53f9 100644 --- a/data/web/lang/lang.si-si.json +++ b/data/web/lang/lang.si-si.json @@ -558,7 +558,8 @@ "mode_invalid": "Način %s ni veljaven", "mx_invalid": "Zapis MX %s je neveljaven", "version_invalid": "Različica %s je neveljavna", - "tfa_removal_blocked": "Dvofaktorske avtentikacije ni mogoče odstraniti, ker je obvezna za vaš račun." + "tfa_removal_blocked": "Dvofaktorske avtentikacije ni mogoče odstraniti, ker je obvezna za vaš račun.", + "quarantine_category_invalid": "Kategorija karantene mora biti ena od: add_header, reject, all" }, "debug": { "containers_info": "Informacije o zabojniku", From 8ead057ce9f6015327ce4eb8f51fef41a1292190 Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Wed, 15 Apr 2026 09:33:23 +0200 Subject: [PATCH 013/123] [Web] Create default mailbox template with eas and dav access --- data/web/inc/init_db.inc.php | 2 ++ 1 file changed, 2 insertions(+) diff --git a/data/web/inc/init_db.inc.php b/data/web/inc/init_db.inc.php index 72018a6b..23aa5e77 100644 --- a/data/web/inc/init_db.inc.php +++ b/data/web/inc/init_db.inc.php @@ -1464,6 +1464,8 @@ function init_db_schema() "pop3_access" => intval($GLOBALS['MAILBOX_DEFAULT_ATTRIBUTES']['pop3_access']), "smtp_access" => intval($GLOBALS['MAILBOX_DEFAULT_ATTRIBUTES']['smtp_access']), "sieve_access" => intval($GLOBALS['MAILBOX_DEFAULT_ATTRIBUTES']['sieve_access']), + "eas_access" => intval($GLOBALS['MAILBOX_DEFAULT_ATTRIBUTES']['eas_access']), + "dav_access" => intval($GLOBALS['MAILBOX_DEFAULT_ATTRIBUTES']['dav_access']), "acl_spam_alias" => 1, "acl_tls_policy" => 1, "acl_spam_score" => 1, From d42c3823c434ef9a04a04b81783b945948f80b99 Mon Sep 17 00:00:00 2001 From: milkmaker Date: Sat, 2 May 2026 19:15:14 +0200 Subject: [PATCH 014/123] update postscreen_access.cidr (#7209) --- data/conf/postfix/postscreen_access.cidr | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/data/conf/postfix/postscreen_access.cidr b/data/conf/postfix/postscreen_access.cidr index 2f7891cd..285ea7a8 100644 --- a/data/conf/postfix/postscreen_access.cidr +++ b/data/conf/postfix/postscreen_access.cidr @@ -1,7 +1,8 @@ -# Whitelist generated by Postwhite v3.4 on Wed Apr 1 00:33:31 UTC 2026 +# Whitelist generated by Postwhite v3.4 on Fri May 1 00:43:37 UTC 2026 # https://github.com/stevejenkins/postwhite/ -# 2246 total rules +# 2249 total rules 2a00:1450:4000::/36 permit +2a00:1450:4864::/56 permit 2a01:111:f400::/48 permit 2a01:111:f403:2800::/53 permit 2a01:111:f403:8000::/51 permit @@ -31,6 +32,7 @@ 2a02:a60:0:5::/64 permit 2a0f:f640::/56 permit 2c0f:fb50:4000::/36 permit +2c0f:fb50:4864::/56 permit 2.207.151.32/27 permit 2.207.151.53 permit 2.207.217.30 permit @@ -60,8 +62,8 @@ 8.40.222.0/23 permit 8.40.222.250/31 permit 12.130.86.238 permit -13.107.213.38 permit -13.107.246.38 permit +13.107.213.40 permit +13.107.246.40 permit 13.108.16.0/20 permit 13.110.208.0/21 permit 13.110.209.0/24 permit @@ -279,6 +281,7 @@ 50.56.130.221 permit 50.56.130.222 permit 50.112.246.219 permit +51.83.17.38 permit 52.1.14.157 permit 52.5.230.59 permit 52.6.74.205 permit @@ -1678,6 +1681,7 @@ 169.148.144.0/25 permit 169.148.144.10 permit 169.148.146.0/23 permit +169.148.174.10 permit 169.148.175.3 permit 169.148.179.3 permit 169.148.188.0/24 permit @@ -2227,6 +2231,7 @@ 2001:748:400:3301::4 permit 2404:6800:4000::/36 permit 2404:6800:4864::/56 permit +2603:1061:14:72::1 permit 2607:13c0:0001:0000:0000:0000:0000:7000/116 permit 2607:13c0:0002:0000:0000:0000:0000:1000/116 permit 2607:13c0:0004:0000:0000:0000:0000:0000/116 permit @@ -2243,8 +2248,6 @@ 2620:10d:c09c:400::8:1 permit 2620:119:50c0:207::/64 permit 2620:119:50c0:207::215 permit -2620:1ec:46::38 permit -2620:1ec:bdf::38 permit 2800:3f0:4000::/36 permit 2800:3f0:4864::/56 permit 49.12.4.251 permit # checks.mailcow.email From 539c32d99c665e64afb4a3baf7f6372b2494cd4f Mon Sep 17 00:00:00 2001 From: milkmaker Date: Fri, 8 May 2026 16:46:10 +0200 Subject: [PATCH 015/123] Translations update from Weblate (#7218) * [Web] Updated lang.az-az.json Co-authored-by: Nemoralis * [Web] Updated lang.nl-nl.json Co-authored-by: Tom18314 * [Web] Updated lang.pl-pl.json Co-authored-by: pmuch78 --------- Co-authored-by: Nemoralis Co-authored-by: Tom18314 Co-authored-by: pmuch78 --- data/web/lang/lang.az-az.json | 14 +++++++++++++- data/web/lang/lang.nl-nl.json | 3 ++- data/web/lang/lang.pl-pl.json | 2 +- 3 files changed, 16 insertions(+), 3 deletions(-) diff --git a/data/web/lang/lang.az-az.json b/data/web/lang/lang.az-az.json index 0862f691..958ed8e2 100644 --- a/data/web/lang/lang.az-az.json +++ b/data/web/lang/lang.az-az.json @@ -1,5 +1,17 @@ { "acl": { - "login_as": "E-poçt qutusu istifadəçisi olaraq daxil ol" + "login_as": "E-poçt qutusu istifadəçisi olaraq daxil ol", + "alias_domains": "Alternativ domenlər əlavə et", + "app_passwds": "Tətbiq parollarını idarə et", + "bcc_maps": "BCC yönləndirmə xəritələri", + "delimiter_action": "Ayırıcı əməliyyatı", + "domain_desc": "Domen təsvirini dəyiş", + "domain_relayhost": "Domen üçün relay serveri dəyiş", + "eas_reset": "EAS cihazlarını sıfırla", + "extend_sender_acl": "Göndərən ACL-ni xarici ünvanlarla genişləndirməyə icazə ver", + "filters": "Filtrlər", + "mailbox_relayhost": "E-poçt qutusu üçün relay serveri dəyiş", + "prohibited": "ACL tərəfindən məhdudlaşdırılıb", + "protocol_access": "Protokol girişini dəyiş" } } diff --git a/data/web/lang/lang.nl-nl.json b/data/web/lang/lang.nl-nl.json index 7b341cec..6ed9e322 100644 --- a/data/web/lang/lang.nl-nl.json +++ b/data/web/lang/lang.nl-nl.json @@ -27,7 +27,8 @@ "tls_policy": "Versleutelingsbeleid", "unlimited_quota": "Onbeperkte quota voor mailboxen", "domain_desc": "Wijzig domeinbeschrijving", - "pw_reset": "Toegang om mailcow gebruikers wachtwoord te resetten" + "pw_reset": "Toegang om mailcow gebruikers wachtwoord te resetten", + "domain_relayhost": "Verander relayhost voor een domein" }, "add": { "activate_filter_warn": "Alle andere filters worden gedeactiveerd zolang deze geactiveerd is.", diff --git a/data/web/lang/lang.pl-pl.json b/data/web/lang/lang.pl-pl.json index 758d0cb4..b1ec3591 100644 --- a/data/web/lang/lang.pl-pl.json +++ b/data/web/lang/lang.pl-pl.json @@ -1226,7 +1226,7 @@ "decimal": ".", "emptyTable": "Brak danych w tabeli", "expand_all": "Rozszerz wszystko", - "info": "Wyświetlanie od START do END z TOTAL wpisów", + "info": "Wyświetlanie od _START_ do _END_ z _TOTAL_ wpisów", "infoEmpty": "Wyświetlanie od 0 do 0 z 0 wpisów", "infoFiltered": "(filtrowane z _MAX_ suma wpisów)", "thousands": ",", From 33547d1d73237270e6d2f21edace5b2317856a1c Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Tue, 12 May 2026 08:31:51 +0200 Subject: [PATCH 016/123] [Web] escape HTML in sieve filter edit view and queue manager --- data/web/js/site/queue.js | 13 ++++++++----- data/web/templates/edit/filter.twig | 2 +- 2 files changed, 9 insertions(+), 6 deletions(-) diff --git a/data/web/js/site/queue.js b/data/web/js/site/queue.js index 26c15091..9adc79b5 100644 --- a/data/web/js/site/queue.js +++ b/data/web/js/site/queue.js @@ -48,13 +48,13 @@ jQuery(function($){ url: "/api/v1/get/mailq/all", dataSrc: function(data){ $.each(data, function (i, item) { - item.chkbox = ''; + item.chkbox = ''; rcpts = $.map(item.recipients, function(i) { return escapeHtml(i); }); item.recipients = rcpts.join('
'); item.action = '
' + - '' + lang.show_message + '' + + '' + lang.show_message + '' + '
'; }); return data; @@ -79,12 +79,14 @@ jQuery(function($){ { title: 'QID', data: 'queue_id', - defaultContent: '' + defaultContent: '', + render: $.fn.dataTable.render.text() }, { title: 'Queue', data: 'queue_name', - defaultContent: '' + defaultContent: '', + render: $.fn.dataTable.render.text() }, { title: lang_admin.arrival_time, @@ -106,7 +108,8 @@ jQuery(function($){ { title: lang_admin.sender, data: 'sender', - defaultContent: '' + defaultContent: '', + render: $.fn.dataTable.render.text() }, { title: lang_admin.recipients, diff --git a/data/web/templates/edit/filter.twig b/data/web/templates/edit/filter.twig index 124ecaf7..743f088b 100644 --- a/data/web/templates/edit/filter.twig +++ b/data/web/templates/edit/filter.twig @@ -23,7 +23,7 @@
- +
From ff3d5710545202f1c8457f34cea2b5fb8fd9ed00 Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Wed, 13 May 2026 10:31:23 +0200 Subject: [PATCH 017/123] [SOGo] Update to 5.12.8 --- data/Dockerfiles/sogo/Dockerfile | 6 +++--- docker-compose.yml | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/data/Dockerfiles/sogo/Dockerfile b/data/Dockerfiles/sogo/Dockerfile index 96d2e0a4..1c728720 100644 --- a/data/Dockerfiles/sogo/Dockerfile +++ b/data/Dockerfiles/sogo/Dockerfile @@ -1,6 +1,6 @@ # SOGo built from source to enable security patch application # Repository: https://github.com/Alinto/sogo -# Version: SOGo-5.12.4 +# Version: SOGo-5.12.8 # # Applied security patches: # - @@ -12,8 +12,8 @@ FROM debian:bookworm LABEL maintainer="The Infrastructure Company GmbH " ARG DEBIAN_FRONTEND=noninteractive -ARG SOGO_VERSION=SOGo-5.12.5 -ARG SOPE_VERSION=SOPE-5.12.5 +ARG SOGO_VERSION=SOGo-5.12.8 +ARG SOPE_VERSION=SOPE-5.12.8 # Security patches to apply (space-separated commit hashes) ARG SOGO_SECURITY_PATCHES="" # renovate: datasource=github-releases depName=tianon/gosu versioning=semver-coerced extractVersion=^(?.*)$ diff --git a/docker-compose.yml b/docker-compose.yml index 0a9578de..90e5518d 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -200,7 +200,7 @@ services: - phpfpm sogo-mailcow: - image: ghcr.io/mailcow/sogo:5.12.5-3 + image: ghcr.io/mailcow/sogo:5.12.8-1 environment: - DBNAME=${DBNAME} - DBUSER=${DBUSER} From b0d16bbceec562b3ef39464bc5bad9221d6332ee Mon Sep 17 00:00:00 2001 From: milkmaker Date: Wed, 13 May 2026 16:42:03 +0200 Subject: [PATCH 018/123] [Web] Updated lang.pt-br.json (#7228) Co-authored-by: Edson Wolf --- data/web/lang/lang.pt-br.json | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/data/web/lang/lang.pt-br.json b/data/web/lang/lang.pt-br.json index 24105db1..db3c8cac 100644 --- a/data/web/lang/lang.pt-br.json +++ b/data/web/lang/lang.pt-br.json @@ -38,7 +38,7 @@ "add_domain_only": "Adicionar somente domínio", "add_domain_restart": "Adicionar domínio e reiniciar o SoGo", "alias_address": "Endereço (s) de alias", - "alias_address_info": "Endereço/s de e-mail completo ou @example .com, para capturar todas as mensagens de um domínio (separadas por vírgula). somente domínios mailcow.", + "alias_address_info": "Endereço(s) de e-mail completo(s) ou @example.com, para capturar todas as mensagens de um domínio (separadas por vírgula). Apenas domínios do Mailcow.", "alias_domain": "Domínio de alias", "alias_domain_info": "Somente nomes de domínio válidos (separados por vírgula).", "app_name": "Nome do aplicativo", @@ -158,7 +158,7 @@ "logo_dark_label": "Invertido para o modo escuro", "configuration": "Configuração", "convert_html_to_text": "Converter HTML em texto sem formatação", - "copy_to_clipboard": "Text copied to clipboard!", + "copy_to_clipboard": "Copiado para a área de transferência!", "cors_settings": "Configurações do CORS", "credentials_transport_warning": "Aviso: Adicionar uma nova entrada no mapa de transporte atualizará as credenciais de todas as entradas com uma coluna correspondente do próximo salto.", "customer_id": "ID do cliente", @@ -223,7 +223,7 @@ "includes": "Inclua esses destinatários", "ip_check": "Verificação de IP", "ip_check_disabled": "A verificação de IP está desativada. Você pode ativá-lo em
Sistema > Configuração > Opções > Personalizar", - "ip_check_opt_in": "Opte por usar o serviço de terceiros ipv4.mailcow.email. e ipv6.mailcow.email para resolver endereços IP externos.", + "ip_check_opt_in": "Opte por usar o serviço de terceiros ipv4.mailcow.email e ipv6.mailcow.email para resolver endereços IP externos.", "is_mx_based": "Baseado em MX", "last_applied": "Aplicado pela última vez", "license_info": "Uma licença não é necessária, mas ajuda no desenvolvimento.
Registre seu GUID aqui ou comprar suporte para sua instalação de mailcow.", @@ -245,7 +245,7 @@ "oauth2_add_client": "Adicionar cliente OAuth2", "oauth2_client_id": "ID do cliente", "oauth2_client_secret": "Segredo do cliente", - "oauth2_info": "A implementação OAuth2 suporta o tipo de concessão \"Código de Autorização\" e emite tokens de atualização.
\nO servidor também emite automaticamente novos tokens de atualização, depois que um token de atualização foi usado.

\n• O escopo padrão é perfil. Somente usuários com caixa de e-mail podem ser autenticados contra o OAuth2. Se o parâmetro de escopo for omitido, ele voltará para perfil.
\nCaminhos para solicitações OAuth2 API:
\n
    \n
  • Endpoint de autorização: /oauth/authorize
    • \n
  • Endpoint token: /oauth/token
    • \n
  • Página de recursos: /oauth/profile
    • \n
\nRegenerar o segredo do cliente não expirará os códigos de autorização existentes, mas eles não renovarão seu token.

\nA revogação dos tokens do cliente causará o término imediato de todas as sessões ativas. Todos os clientes precisam se autenticar novamente.", + "oauth2_info": "A implementação do OAuth2 suporta o tipo de concessão \"Código de Autorização\" e emite tokens de atualização.
\nO servidor também emite automaticamente novos tokens de atualização após um token de atualização ter sido usado.
\nO escopo padrão é profile. Somente usuários de caixa de correio podem ser autenticados com o OAuth2. Se o parâmetro de escopo for omitido, o padrão será profile.
\nO parâmetro state deve ser enviado pelo cliente como parte da solicitação de autorização.

\nCaminhos para solicitações à API OAuth2:
\n\n
    \n
  • Ponto de extremidade de autorização: /oauth/authorize
    • \n
  • Endpoint do token: /oauth/token
    • \n
  • Página de recursos: /oauth/profile
    • \n
\n\nRegenerar o segredo do cliente não expirará os códigos de autorização existentes, mas impedirá a renovação do token.

\nA revogação dos tokens de cliente causará o encerramento imediato de todas as sessões ativas. Todos os clientes precisarão se autenticar novamente.", "oauth2_redirect_uri": "URI de redirecionamento", "oauth2_renew_secret": "Gere um novo segredo de cliente", "oauth2_revoke_tokens": "Revogar todos os tokens do cliente", @@ -730,7 +730,7 @@ "pushover_verify": "Verifique as credenciais", "quota_mb": "Cota (MiB)", "quota_warning_bcc": "Aviso de cota BCC", - "quota_warning_bcc_info": "Os avisos serão enviados em cópias separadas para os seguintes destinatários. O assunto será sufixado pelo nome de usuário correspondente entre colchetes, por exemplo: Aviso de cota (user@example.com).", + "quota_warning_bcc_info": "Os avisos serão enviados em cópias separadas para os seguintes destinatários. O assunto será precedido pelo nome de usuário correspondente entre colchetes, por exemplo: Aviso de cota (user@example.com).", "ratelimit": "Limite de taxa", "redirect_uri": "URL de redirecionamento/retorno de chamada", "relay_all": "Retransmita todos os destinatários", @@ -759,7 +759,7 @@ "spam_score": "Defina uma pontuação de spam personalizada", "subfolder2": "Sincronizar na subpasta no destino
(vazio = não usar subpasta)", "syncjob": "Editar tarefa de sincronização", - "target_address": "Ir para endereço/es (separados por vírgula)", + "target_address": "Ir para o(s) endereço(s) (separados por vírgula)", "target_domain": "Domínio de destino", "timeout1": "Tempo limite para conexão com o host remoto", "timeout2": "Tempo limite para conexão com o host local", @@ -807,7 +807,7 @@ "cancel": "Cancelar", "confirm_delete": "Confirme a exclusão", "delete_now": "Excluir agora", - "delete_these_items": "Confirme suas alterações no seguinte ID de objeto", + "delete_these_items": "Por favor, confirme as alterações feitas no seguinte ID de objeto.", "hibp_check": "Verifique em haveibeenpwned.com", "hibp_nok": "Combinado! Essa é uma senha potencialmente perigosa!", "hibp_ok": "Nenhuma combinação encontrada.", @@ -1393,7 +1393,7 @@ "syncjob_EXIT_CONNECTION_FAILURE_HOST1": "Não é possível se conectar ao servidor remoto", "syncjob_EXIT_AUTHENTICATION_FAILURE_USER1": "Nome de usuário ou senha incorretos", "tag_handling": "Definir o tratamento para e-mails marcados", - "tag_help_example": "Exemplo de um endereço de e-mail marcado: me +Facebook @example .org", + "tag_help_example": "Exemplo de endereço de e-mail com tag: eu+Facebook@exemplo.org", "tag_help_explain": "Na subpasta: uma nova subpasta com o nome da tag será criada abaixo da CAIXA DE ENTRADA (“Caixa de entrada/Facebook”).
\r\nNo assunto: o nome das tags será anexado ao assunto do e-mail, por exemplo: “[Facebook] Minhas notícias”.", "tag_in_none": "Não faça nada", "tag_in_subfolder": "Na subpasta", From 4ddcee28e4c0be584dae3e4b149723222d35a9cd Mon Sep 17 00:00:00 2001 From: Jahongir Qurbonov <109198731+Jahongir-Qurbonov@users.noreply.github.com> Date: Wed, 13 May 2026 19:42:38 +0500 Subject: [PATCH 019/123] Add Uzbek language (#7224) --- data/web/inc/vars.inc.php | 1 + data/web/lang/lang.uz-uz.json | 1440 +++++++++++++++++++++++++++++++++ 2 files changed, 1441 insertions(+) create mode 100644 data/web/lang/lang.uz-uz.json diff --git a/data/web/inc/vars.inc.php b/data/web/inc/vars.inc.php index 2f4a4b07..cec402a9 100644 --- a/data/web/inc/vars.inc.php +++ b/data/web/inc/vars.inc.php @@ -112,6 +112,7 @@ $AVAILABLE_LANGUAGES = array( 'sv-se' => 'Svenska (Swedish)', 'tr-tr' => 'Türkçe (Turkish)', 'uk-ua' => 'Українська (Ukrainian)', + 'uz-uz' => 'Oʻzbekcha (Uzbek)', 'vi-vn' => 'Tiếng Việt (Vietnamese)', 'zh-cn' => '简体中文 (Simplified Chinese)', 'zh-tw' => '繁體中文 (Traditional Chinese)', diff --git a/data/web/lang/lang.uz-uz.json b/data/web/lang/lang.uz-uz.json new file mode 100644 index 00000000..a8d2ecf8 --- /dev/null +++ b/data/web/lang/lang.uz-uz.json @@ -0,0 +1,1440 @@ +{ + "acl": { + "alias_domains": "Taxallus domenlarini qoʻshish", + "app_passwds": "Ilova parollarini boshqarish", + "bcc_maps": "BCC xaritalari", + "delimiter_action": "Ajratuvchi amali", + "domain_desc": "Domen tavsifini oʻzgartirish", + "domain_relayhost": "Domen uchun relay xostni oʻzgartirish", + "eas_reset": "EAS qurilmalarini tiklash", + "extend_sender_acl": "Tashqi manzillar yordamida joʻnatuvchi ACL ni kengaytirishga ruxsat berish", + "filters": "Filtrlar", + "login_as": "Pochta qutisi foydalanuvchisi sifatida kirish", + "mailbox_relayhost": "Pochta qutisi uchun relay xostni oʻzgartirish", + "prohibited": "ACL tomonidan taqiqlangan", + "protocol_access": "Protokolga kirishni oʻzgartirish", + "pushover": "Pushover", + "pw_reset": "mailcow foydalanuvchi parolini tiklashga ruxsat berish", + "quarantine": "Karantin amallari", + "quarantine_attachments": "Karantindagi ilovalar", + "quarantine_category": "Karantin bildirishnoma turkumini oʻzgartirish", + "quarantine_notification": "Karantin bildirishnomalarini oʻzgartirish", + "ratelimit": "Tezlik chegarasi", + "recipient_maps": "Qabul qiluvchi xaritalari", + "smtp_ip_access": "SMTP uchun ruxsat etilgan xostlarni oʻzgartirish", + "sogo_access": "SOGo kirishini boshqarishga ruxsat berish", + "sogo_profile_reset": "SOGo profilini tiklash", + "spam_alias": "Vaqtinchalik taxalluslar", + "spam_policy": "Qora roʻyxat/Oq roʻyxat", + "spam_score": "Spam bahosi", + "syncjobs": "Sinxronizatsiya vazifalari", + "tls_policy": "TLS siyosati", + "unlimited_quota": "Pochta qutilari uchun cheksiz kvota" + }, + "add": { + "activate_filter_warn": "Faol belgilansa, boshqa barcha filtrlar oʻchirib qoʻyiladi.", + "active": "Faol", + "add": "Qoʻshish", + "add_domain_only": "Faqat domen qoʻshish", + "add_domain_restart": "Domen qoʻshish va SOGoni qayta ishga tushirish", + "alias_address": "Taxallus manzil(lar)i", + "alias_address_info": "Toʻliq e-pochta manzil(lar)i yoki @example.com — domenga keladigan barcha xabarlarni qabul qilish uchun (vergul bilan ajratilgan). Faqat mailcow domenlari.", + "alias_domain": "Taxallus domeni", + "alias_domain_info": "Faqat haqiqiy domen nomlari (vergul bilan ajratilgan).", + "app_name": "Ilova nomi", + "app_password": "Ilova paroli qoʻshish", + "app_passwd_protocols": "Ilova paroli uchun ruxsat etilgan protokollar", + "automap": "Papkalarni avtomatik xaritalashga harakat qilish (\"Sent items\", \"Sent\" => \"Sent\" va h.k.)", + "backup_mx_options": "Relay sozlamalari", + "bcc_dest_format": "BCC manzili bitta haqiqiy e-pochta manzili boʻlishi kerak.
Agar bir nechta manzilga nusxa joʻnatish kerak boʻlsa, taxallus yarating va shu yerda ishlating.", + "comment_info": "Maxfiy izoh foydalanuvchiga koʻrinmaydi, ommaviy izoh esa foydalanuvchi koʻrinishida ustiga sichqoncha kelganda maslahat sifatida koʻrsatiladi", + "custom_params": "Maxsus parametrlar", + "custom_params_hint": "Toʻgʻri: --param=xy, notoʻgʻri: --param xy", + "delete1": "Tugatilgach manbadan oʻchirish", + "delete2": "Manbada boʻlmagan xabarlarni manzildan oʻchirish", + "delete2duplicates": "Manzildagi dublikatlarni oʻchirish", + "description": "Tavsif", + "destination": "Manzil", + "disable_login": "Kirishni taqiqlash (kiruvchi pochta hali ham qabul qilinadi)", + "domain": "Domen", + "domain_matches_hostname": "%s domeni xost nomiga mos keladi", + "domain_quota_m": "Domenning umumiy kvotasi (MiB)", + "dry": "Sinxronizatsiyani simulyatsiya qilish", + "enc_method": "Shifrlash usuli", + "exclude": "Obyektlarni istisno qilish (regex)", + "full_name": "Toʻliq ism", + "gal": "Global manzillar roʻyxati", + "gal_info": "GAL domenning barcha obyektlarini oʻz ichiga oladi va hech bir foydalanuvchi tomonidan tahrirlanmaydi. Oʻchirilsa, SOGodagi bandlik maʼlumotlari yoʻqoladi! Oʻzgarishlarni qoʻllash uchun SOGoni qayta ishga tushiring.", + "generate": "yaratish", + "goto_ham": "ham sifatida oʻrgatish", + "goto_null": "Xatni jimgina rad etish", + "goto_spam": "spam sifatida oʻrgatish", + "hostname": "Xost", + "inactive": "Nofaol", + "internal": "Ichki", + "internal_info": "Ichki taxalluslarga faqat oʻz domeni yoki taxallus domenlaridan kirish mumkin.", + "sender_allowed": "Ushbu taxallus orqali joʻnatishga ruxsat berish", + "kind": "Turi", + "mailbox_quota_def": "Standart pochta qutisi kvotasi", + "mailbox_quota_m": "Bitta pochta qutisining maks. kvotasi (MiB)", + "mailbox_username": "Foydalanuvchi nomi (e-pochta manzilining chap qismi)", + "max_aliases": "Mumkin boʻlgan maks. taxalluslar", + "max_mailboxes": "Mumkin boʻlgan maks. pochta qutilari", + "mins_interval": "Soʻrov oraligʻi (daqiqa)", + "multiple_bookings": "Bir nechta bandlovlar", + "nexthop": "Keyingi nuqta", + "password": "Parol", + "password_repeat": "Tasdiqlash paroli (takrorlang)", + "port": "Port", + "post_domain_add": "Yangi domen qoʻshilgandan keyin SOGo konteyneri (\"sogo-mailcow\") qayta ishga tushirilishi kerak!

Bundan tashqari, domenning DNS sozlamalarini koʻrib chiqing. DNS sozlamalari tasdiqlangach, yangi domeningiz (autoconfig.<domain>, autodiscover.<domain>) uchun sertifikatlarni avtomatik yaratish uchun \"acme-mailcow\" konteynerini qayta ishga tushiring.
Bu qadam ixtiyoriy va har 24 soatda qayta urinib koʻriladi.", + "private_comment": "Maxfiy izoh", + "public_comment": "Ommaviy izoh", + "quota_mb": "Kvota (MiB)", + "relay_all": "Barcha qabul qiluvchilarni relay qilish", + "relay_all_info": "↪ Agar barcha qabul qiluvchilarni relay qilmaslikni tanlasangiz, relay qilinishi kerak boʻlgan har bir qabul qiluvchi uchun (\"koʻr\") pochta qutisi qoʻshishingiz kerak boʻladi.", + "relay_domain": "Ushbu domenni relay qilish", + "relay_transport_info": "
Maʼlumot
Bu domen uchun maxsus manzilga transport xaritalarini belgilashingiz mumkin. Agar oʻrnatilmagan boʻlsa, MX qidiruvi amalga oshiriladi.", + "relay_unknown_only": "Faqat mavjud boʻlmagan pochta qutilarini relay qilish. Mavjud pochta qutilari mahalliy yetkazib beriladi.", + "relayhost_wrapped_tls_info": "Iltimos, TLS-oʻralgan portlardan foydalanmang (asosan 465-portda).
\r\nO'ralmagan istalgan portdan foydalaning va STARTTLS chiqaring. TLS ni majburlash uchun TLS siyosatini \"TLS siyosati xaritalari\"da yaratish mumkin.", + "select": "Iltimos, tanlang...", + "select_domain": "Avval domenni tanlang", + "sieve_desc": "Qisqa tavsif", + "sieve_type": "Filtr turi", + "skipcrossduplicates": "Papkalararo dublikat xabarlarni oʻtkazib yuborish (birinchi kelgan, birinchi xizmatlanadi)", + "subscribeall": "Barcha papkalarga obuna boʻlish", + "syncjob": "Sinxronizatsiya vazifasi qoʻshish", + "syncjob_hint": "Parollar oddiy matn sifatida saqlanishini unutmang!", + "tags": "Teglar", + "target_address": "Yoʻnaltirish manzillari", + "target_address_info": "Toʻliq e-pochta manzil(lar)i (vergul bilan ajratilgan).", + "target_domain": "Maqsad domen", + "timeout1": "Masofaviy xostga ulanish vaqtining tugashi", + "timeout2": "Mahalliy xostga ulanish vaqtining tugashi", + "username": "Foydalanuvchi nomi", + "validate": "Tekshirish", + "validation_success": "Muvaffaqiyatli tekshirildi" + }, + "admin": { + "access": "Kirish", + "action": "Amal", + "activate_api": "API ni faollashtirish", + "activate_send": "Joʻnatish tugmasini faollashtirish", + "active": "Faol", + "active_rspamd_settings_map": "Faol sozlamalar xaritasi", + "add": "Qoʻshish", + "add_admin": "Administrator qoʻshish", + "add_domain_admin": "Domen administratorini qoʻshish", + "add_forwarding_host": "Yoʻnaltirish xosti qoʻshish", + "add_relayhost": "Joʻnatuvchiga bogʻliq transport qoʻshish", + "add_relayhost_hint": "Autentifikatsiya maʼlumotlari, agar boʻlsa, oddiy matn sifatida saqlanishini unutmang.", + "add_row": "Satr qoʻshish", + "add_settings_rule": "Sozlamalar qoidasini qoʻshish", + "add_transport": "Transport qoʻshish", + "add_transports_hint": "Autentifikatsiya maʼlumotlari, agar boʻlsa, oddiy matn sifatida saqlanishini unutmang.", + "additional_rows": " ta qoʻshimcha satr qoʻshildi", + "admin": "Administrator", + "admin_details": "Administrator maʼlumotlarini tahrirlash", + "admin_domains": "Domen tayinlashlari", + "admins": "Administratorlar", + "admins_ldap": "LDAP administratorlari", + "admin_quicklink": "Admin kirish sahifasiga tezkor havolani yashirish", + "advanced_settings": "Kengaytirilgan sozlamalar", + "allowed_methods": "Access-Control-Allow-Methods", + "allowed_origins": "Access-Control-Allow-Origin", + "api_allow_from": "API kirishini ushbu IP / CIDR tarmoq belgilanishlaridan ruxsat berish", + "api_info": "API ishlab chiqilmoqda. Hujjatlarni /api manzilida topishingiz mumkin", + "api_key": "API kaliti", + "api_read_only": "Faqat oʻqish uchun kirish", + "api_read_write": "Oʻqish va yozish uchun kirish", + "api_skip_ip_check": "API uchun IP tekshiruvini oʻtkazib yuborish", + "app_hide": "Kirishda yashirish", + "app_links": "Ilova havolalari", + "app_name": "Ilova nomi", + "apps_name": "\"mailcow Apps\" nomi", + "arrival_time": "Kelish vaqti (server vaqti)", + "authed_user": "Avtorizatsiya qilingan foydalanuvchi", + "ays": "Davom etishni xohlayotganingizga ishonchingiz komilmi?", + "ban_list_info": "Quyida bloklangan IP roʻyxati keltirilgan: tarmoq (qolgan blok vaqti) - [amallar].
Blokdan chiqarishga navbatga qoʻyilgan IP lar bir necha soniya ichida faol bloklash roʻyxatidan olib tashlanadi.
Qizil yorliqlar qora roʻyxat orqali faol doimiy bloklarni bildiradi.", + "change_logo": "Logotipni oʻzgartirish", + "logo_normal_label": "Oddiy", + "logo_dark_label": "Qorongʻi rejim uchun teskari", + "configuration": "Konfiguratsiya", + "convert_html_to_text": "HTMLni oddiy matnga aylantirish", + "copy_to_clipboard": "Matn vaqtinchalik xotiraga koʻchirildi!", + "cors_settings": "CORS sozlamalari", + "credentials_transport_warning": "Diqqat: Yangi transport xaritasi yozuvi qoʻshish keyingi nuqta ustunlari mos keladigan barcha yozuvlar uchun maʼlumotlarni yangilaydi.", + "customer_id": "Mijoz ID", + "customize": "Sozlash", + "login_page": "Kirish sahifasi", + "destination": "Manzil", + "dkim_add_key": "ARC/DKIM kaliti qoʻshish", + "dkim_domains_selector": "Tanlovchi", + "dkim_domains_wo_keys": "Kalit yetishmaydigan domenlarni tanlash", + "dkim_from": "Kimdan", + "dkim_from_title": "Maʼlumotlarni koʻchirib olish uchun manba domen", + "dkim_key_length": "DKIM kalit uzunligi (bit)", + "dkim_key_missing": "Kalit yetishmaydi", + "dkim_key_unused": "Kalit ishlatilmagan", + "dkim_key_valid": "Kalit haqiqiy", + "dkim_keys": "ARC/DKIM kalitlari", + "dkim_overwrite_key": "Mavjud DKIM kalitini ustidan yozish", + "dkim_private_key": "Maxfiy kalit", + "dkim_to": "Kimga", + "dkim_to_title": "Maqsad domen(lar) — ustidan yoziladi", + "domain": "Domen", + "domain_admin": "Domen administratori", + "domain_admins": "Domen administratorlari", + "domainadmin_quicklink": "Domen admin kirish sahifasiga tezkor havolani yashirish", + "domain_s": "Domen(lar)", + "duplicate": "Nusxalash", + "duplicate_dkim": "DKIM yozuvini nusxalash", + "edit": "Tahrirlash", + "empty": "Natijalar yoʻq", + "excludes": "Ushbu qabul qiluvchilarni istisno qiladi", + "f2b_ban_time": "Bloklash vaqti (s)", + "f2b_ban_time_increment": "Har bir bloklashda blok vaqti ortadi", + "f2b_blacklist": "Qora roʻyxatdagi tarmoqlar/xostlar", + "f2b_filter": "Regex filtrlari", + "f2b_list_info": "Qora roʻyxatdagi xost yoki tarmoq har doim oq roʻyxat elementidan ustun keladi. Roʻyxat yangilanishlarini qoʻllash uchun bir necha soniya kerak boʻladi.", + "f2b_manage_external": "Fail2ban ni tashqi boshqarish", + "f2b_manage_external_info": "Fail2ban hali ham banlist ni saqlaydi, ammo trafikni bloklash uchun faol qoidalarni oʻrnatmaydi. Trafikni tashqi tomondan bloklash uchun quyida yaratilgan banlist dan foydalaning.", + "f2b_max_attempts": "Maks. urinishlar", + "f2b_max_ban_time": "Maks. bloklash vaqti (s)", + "f2b_netban_ipv4": "Blokni qoʻllash uchun IPv4 subtarmoq oʻlchami (8-32)", + "f2b_netban_ipv6": "Blokni qoʻllash uchun IPv6 subtarmoq oʻlchami (8-128)", + "f2b_parameters": "Fail2ban parametrlari", + "f2b_regex_info": "Eʼtiborga olinadigan jurnallar: SOGo, Postfix, Dovecot, PHP-FPM.", + "f2b_retry_window": "Maks. urinishlar uchun qayta urinish oynasi (s)", + "f2b_whitelist": "Oq roʻyxatdagi tarmoqlar/xostlar", + "filter": "Filtr", + "filter_table": "Filtr jadvali", + "force_sso_text": "Tashqi OIDC provayder sozlangan boʻlsa, bu variant standart mailcow kirish formalarini yashiradi va faqat Yagona kirish tugmasini koʻrsatadi", + "force_sso": "mailcow kirishini oʻchirib, faqat Yagona kirishni koʻrsatish", + "forwarding_hosts": "Yoʻnaltirish xostlari", + "forwarding_hosts_add_hint": "Siz IPv4/IPv6 manzillarini, CIDR yozuvidagi tarmoqlarni, xost nomlarini (IP manzillariga aylantiriladi) yoki domen nomlarini (SPF TXT yoki yoʻq boʻlsa MX yozuvlarini soʻrash orqali IP manzillariga aylantiriladi) belgilashingiz mumkin.", + "forwarding_hosts_hint": "Kiruvchi xabarlar bu yerda keltirilgan istalgan xostlardan shartsiz qabul qilinadi. Bu xostlar keyin DNSBL ga qarshi tekshirilmaydi yoki greylisting ga olinmaydi. Ulardan kelgan spam hech qachon rad etilmaydi, ammo ixtiyoriy ravishda Junk papkasiga joylashtirilishi mumkin. Buning eng keng tarqalgan ishlatilishi — mailcow serveringizga kiruvchi xatlarni yoʻnaltirish qoidasi oʻrnatilgan pochta serverlarini koʻrsatish.", + "from": "Kimdan", + "generate": "yaratish", + "guid": "GUID - noyob nusxa ID si", + "guid_and_license": "GUID va litsenziya", + "hash_remove_info": "Ratelimit hashini oʻchirish (agar mavjud boʻlsa) uning hisoblagichini butunlay tiklaydi.
\r\n Har bir hash alohida rang bilan koʻrsatiladi.", + "help_text": "Kirish maskasi ostidagi yordam matnini bekor qilish (HTML ruxsat etilgan)", + "host": "Xost", + "html": "HTML", + "iam": "Identifikatsiya provayderi", + "iam_attribute_field": "Atribut maydoni", + "iam_authorize_url": "Avtorizatsiya nuqtasi", + "iam_auth_flow": "Autentifikatsiya oqimi", + "iam_auth_flow_info": "Yagona kirish (SSO) uchun ishlatiladigan Authorization Code Flow (Keycloak da Standard Flow) qoʻshimcha ravishda, mailcow toʻgʻridan-toʻgʻri maʼlumotlar bilan Autentifikatsiya oqimini ham qoʻllab-quvvatlaydi. Mailpassword Flow Keycloak Admin REST API yordamida foydalanuvchi maʼlumotlarini tekshirishga harakat qiladi. mailcow Keycloakda xaritalangan mailcow_password atributidan xeshlangan parolni oladi.", + "iam_basedn": "Base DN", + "iam_client_id": "Mijoz ID", + "iam_client_secret": "Mijoz maxfiy soʻzi", + "iam_client_scopes": "Mijoz qamrovlari", + "iam_default_template": "Standart shablon", + "iam_default_template_description": "Agar foydalanuvchiga shablon tayinlanmagan boʻlsa, pochta qutisini yaratishda standart shablon ishlatiladi, lekin pochta qutisini yangilash uchun emas.", + "iam_description": "Autentifikatsiya uchun tashqi provayderni sozlash
Foydalanuvchi pochta qutilari atribut xaritalashi oʻrnatilgan boʻlsa, ular birinchi marta kirgan zahoti avtomatik yaratiladi.", + "iam_extra_permission": "Quyidagi sozlamalarning ishlashi uchun Keycloak dagi mailcow mijoziga Service account va view-users ruxsati kerak.", + "iam_host": "Xost", + "iam_host_info": "Bir yoki bir nechta LDAP xostni vergul bilan ajratib kiriting.", + "iam_import_users": "Foydalanuvchilarni import qilish", + "iam_login_provisioning": "Kirishda foydalanuvchilarni avto-yaratish", + "iam_mapping": "Atribut xaritalashi", + "iam_bindpass": "Bind paroli", + "iam_periodic_full_sync": "Davriy toʻliq sinxronizatsiya", + "iam_port": "Port", + "iam_realm": "Realm", + "iam_redirect_url": "Yoʻnaltirish URL", + "iam_rest_flow": "Mailpassword Flow", + "iam_server_url": "Server URL", + "iam_sso": "Yagona kirish (SSO)", + "iam_sync_interval": "Sinxronizatsiya / import oraligʻi (daqiqa)", + "iam_test_connection": "Ulanishni tekshirish", + "iam_token_url": "Token nuqtasi", + "iam_userinfo_url": "Foydalanuvchi maʼlumotlari nuqtasi", + "iam_username_field": "Foydalanuvchi nomi maydoni", + "iam_binddn": "Bind DN", + "iam_use_ssl": "SSL dan foydalanish", + "iam_use_ssl_info": "SSL yoqilsa va port 389 ga oʻrnatilgan boʻlsa, u avtomatik ravishda 636 ga oʻzgartiriladi.", + "iam_use_tls": "StartTLS dan foydalanish", + "iam_use_tls_info": "TLS yoqilsa, LDAP serveringiz uchun standart portni (389) ishlatishingiz kerak. SSL portlari ishlatilmaydi.", + "iam_version": "Versiya", + "ignore_ssl_error": "SSL xatolarini eʼtiborsiz qoldirish", + "import": "Import", + "import_private_key": "Maxfiy kalitni import qilish", + "in_use_by": "Kim ishlatadi", + "inactive": "Nofaol", + "include_exclude": "Kiritish/Istisno qilish", + "include_exclude_info": "Standart holatda — tanlovsiz — barcha pochta qutilariga murojaat qilinadi", + "includes": "Ushbu qabul qiluvchilarni kiritish", + "ip_check": "IP tekshiruvi", + "ip_check_disabled": "IP tekshiruvi oʻchirilgan. Uni quyidagi joydan yoqishingiz mumkin:
Tizim > Konfiguratsiya > Variantlar > Sozlash", + "ip_check_opt_in": "Tashqi IP manzillarni aniqlash uchun ipv4.mailcow.email va ipv6.mailcow.email uchinchi tomon xizmatidan foydalanishga rozilik.", + "is_mx_based": "MX asosida", + "last_applied": "Oxirgi qoʻllanilgan", + "license_info": "Litsenziya talab qilinmaydi, ammo bu loyihaning rivojlanishiga yordam beradi.
GUID ni bu yerda roʻyxatdan oʻtkazing yoki mailcow oʻrnatmangiz uchun yordam sotib oling.", + "link": "Havola", + "loading": "Iltimos, kuting...", + "login_time": "Kirish vaqti", + "logo_info": "Tasviringiz yuqori navigatsiya paneli uchun 40px balandlikka, bosh sahifa uchun maks. 250px kenglikka oʻlchanadi. Masshtablanadigan grafika tavsiya etiladi.", + "lookup_mx": "Manzil — MX nomiga mos keladigan muntazam ifoda (.*\\.google\\.com — google.com bilan tugaydigan MX ga yoʻnaltirilgan barcha pochtani ushbu nuqta orqali yoʻnaltirish uchun)", + "main_name": "\"mailcow UI\" nomi", + "merged_vars_hint": "Kulrang satrlar vars.(local.)inc.php dan birlashtirilgan va oʻzgartirib boʻlmaydi.", + "message": "Xabar", + "message_size": "Xabar oʻlchami", + "nexthop": "Keyingi nuqta", + "needs_restart": "qayta ishga tushirish kerak", + "no": "✕", + "no_active_bans": "Faol bloklar yoʻq", + "no_new_rows": "Boshqa satrlar mavjud emas", + "no_record": "Yozuv yoʻq", + "oauth2_apps": "OAuth2 ilovalari", + "oauth2_add_client": "OAuth2 mijozini qoʻshish", + "oauth2_client_id": "Mijoz ID", + "oauth2_client_secret": "Mijoz maxfiy soʻzi", + "oauth2_info": "OAuth2 amalga oshirilishi \"Authorization Code\" grant turini qoʻllab-quvvatlaydi va refresh tokenlarini chiqaradi.
\r\nServer shuningdek refresh token ishlatilgandan keyin avtomatik ravishda yangi refresh tokenlarini chiqaradi.

\r\n• Standart qamrov — profile. Faqat pochta qutisi foydalanuvchilari OAuth2 ga qarshi autentifikatsiya qilinishi mumkin. Agar scope parametri tashlab ketilgan boʻlsa, u profile ga qaytadi.
\r\n• state parametri mijoz tomonidan avtorizatsiya soʻrovining bir qismi sifatida yuborilishi shart.

\r\nOAuth2 API ga soʻrovlar uchun yoʻllar:
\r\n
    \r\n
  • Avtorizatsiya nuqtasi: /oauth/authorize
    • \r\n
  • Token nuqtasi: /oauth/token
    • \r\n
  • Resurs sahifasi: /oauth/profile
    • \r\n
\r\nMijoz maxfiy soʻzini qayta yaratish mavjud avtorizatsiya kodlarini muddati tugashiga olib kelmaydi, lekin ular tokenni yangilashda muvaffaqiyatsiz boʻladi.

\r\nMijoz tokenlarini bekor qilish barcha faol sessiyalarning darhol tugashiga olib keladi. Barcha mijozlar qayta autentifikatsiya qilishlari kerak.", + "oauth2_redirect_uri": "Yoʻnaltirish URI", + "oauth2_renew_secret": "Yangi mijoz maxfiy soʻzini yaratish", + "oauth2_revoke_tokens": "Barcha mijoz tokenlarini bekor qilish", + "optional": "ixtiyoriy", + "options": "Variantlar", + "password": "Parol", + "password_length": "Parol uzunligi", + "password_policy": "Parol siyosati", + "password_policy_chars": "Kamida bitta alifbo belgisini oʻz ichiga olishi kerak", + "password_policy_length": "Minimal parol uzunligi %d", + "password_policy_lowerupper": "Kichik va katta harflarni oʻz ichiga olishi kerak", + "password_policy_numbers": "Kamida bitta raqamni oʻz ichiga olishi kerak", + "password_policy_special_chars": "Maxsus belgilarni oʻz ichiga olishi kerak", + "password_repeat": "Tasdiqlash paroli (takrorlang)", + "password_reset_info": "Agar tiklash uchun e-pochta kiritilmagan boʻlsa, bu funksiyadan foydalanib boʻlmaydi.", + "password_reset_settings": "Parolni tiklash sozlamalari", + "password_reset_tmpl_html": "HTML shablon", + "password_reset_tmpl_text": "Matnli shablon", + "password_settings": "Parol sozlamalari", + "priority": "Muhimlik darajasi", + "private_key": "Maxfiy kalit", + "quarantine": "Karantin", + "quarantine_bcc": "Barcha bildirishnomalarning nusxasini (BCC) ushbu qabul qiluvchiga yuborish:
Oʻchirish uchun boʻsh qoldiring. Imzolanmagan, tekshirilmagan xat. Faqat ichki yetkazib berilishi kerak.", + "quarantine_exclude_domains": "Domenlar va taxallus domenlarini istisno qilish", + "quarantine_max_age": "Maksimal yosh (kunlarda)
Qiymat 1 kun yoki undan koʻp boʻlishi kerak.", + "quarantine_max_score": "Agar xatning spam bahosi ushbu qiymatdan yuqori boʻlsa, bildirishnomani rad etish:
Standart 9999.0", + "quarantine_max_size": "Maksimal oʻlcham (MiB) (kattaroq elementlar rad etiladi):
0 cheksizlikni bildirmaydi.", + "quarantine_notification_html": "Bildirishnoma e-pochta shabloni:
Standart shablonni tiklash uchun boʻsh qoldiring.", + "quarantine_notification_sender": "Bildirishnoma e-pochta joʻnatuvchisi", + "quarantine_notification_subject": "Bildirishnoma e-pochta mavzusi", + "quarantine_redirect": "Barcha bildirishnomalarni ushbu qabul qiluvchiga yoʻnaltirish:
Oʻchirish uchun boʻsh qoldiring. Imzolanmagan, tekshirilmagan xat. Faqat ichki yetkazib berilishi kerak.", + "quarantine_release_format": "Chiqarilgan elementlar formati", + "quarantine_release_format_att": "Ilova sifatida", + "quarantine_release_format_raw": "Oʻzgartirilmagan asl nusxa", + "quarantine_retention_size": "Pochta qutisi uchun saqlash:
0 — nofaolligini bildiradi.", + "quicklink_text": "Boshqa kirish sahifalariga tezkor havolalarni kirish formasi ostida koʻrsatish yoki yashirish", + "quota_notification_html": "Bildirishnoma e-pochta shabloni:
Standart shablonni tiklash uchun boʻsh qoldiring.", + "quota_notification_sender": "Bildirishnoma e-pochta joʻnatuvchisi", + "quota_notification_subject": "Bildirishnoma e-pochta mavzusi", + "quota_notifications": "Kvota bildirishnomalari", + "quota_notifications_info": "Kvota bildirishnomalari foydalanuvchilarga foydalanish 80% va 95% ga yetganda bir martadan yuboriladi.", + "quota_notifications_vars": "{{percent}} — foydalanuvchining joriy kvotasi
{{username}} — pochta qutisi nomi", + "queue_unban": "blokdan chiqarish", + "r_active": "Faol cheklovlar", + "r_inactive": "Nofaol cheklovlar", + "r_info": "Faol cheklovlar roʻyxatidagi kulrang/oʻchirilgan elementlar mailcow uchun haqiqiy cheklovlar sifatida tanilmaydi va koʻchirib boʻlmaydi. Nomaʼlum cheklovlar baribir koʻrinish tartibida oʻrnatiladi.
inc/vars.local.inc.php da yangi elementlarni qoʻshib, ularni almashtirishingiz mumkin.", + "rate_name": "Tezlik nomi", + "recipients": "Qabul qiluvchilar", + "refresh": "Yangilash", + "regen_api_key": "API kalitini qayta yaratish", + "regex_maps": "Regex xaritalari", + "relay_from": "\"From:\" manzili", + "relay_rcpt": "\"To:\" manzili", + "relay_run": "Sinovni ishga tushirish", + "relayhosts": "Joʻnatuvchiga bogʻliq transportlar", + "relayhosts_hint": "Domen konfiguratsiya muloqotida tanlash mumkin boʻlgan joʻnatuvchiga bogʻliq transportlarni belgilang.
\r\n Transport xizmati har doim \"smtp:\" va shuning uchun taklif qilinganda TLS ga harakat qiladi. Oʻralgan TLS (SMTPS) qoʻllab-quvvatlanmaydi. Foydalanuvchining individual chiquvchi TLS siyosati sozlamasi eʼtiborga olinadi.
\r\n Taxallus domenlari bilan birga tanlangan domenlarga taʼsir qiladi.", + "remove": "Olib tashlash", + "remove_row": "Satrni olib tashlash", + "reset_default": "Standartga qaytarish", + "reset_limit": "Hash ni olib tashlash", + "reset_password_vars": "{{link}} Yaratilgan parolni tiklash havolasi
{{username}} Parolni tiklashni soʻragan foydalanuvchining pochta qutisi nomi
{{username2}} Tiklash uchun pochta qutisi nomi
{{date}} Parolni tiklash soʻrovi qilingan sana
{{token_lifetime}} Daqiqalardagi token muddati
{{hostname}} mailcow xost nomi", + "restore_template": "Standart shablonni tiklash uchun boʻsh qoldiring.", + "routing": "Yoʻnaltirish", + "rsetting_add_rule": "Qoida qoʻshish", + "rsetting_content": "Qoida mazmuni", + "rsetting_desc": "Qisqa tavsif", + "rsetting_no_selection": "Iltimos, qoidani tanlang", + "rsetting_none": "Qoidalar mavjud emas", + "rsettings_insert_preset": "Misol presetini kiritish \"%s\"", + "rsettings_preset_1": "Autentifikatsiya qilingan foydalanuvchilar uchun DKIM va tezlik chegarasidan boshqa hamma narsani oʻchirib qoʻyish", + "rsettings_preset_2": "Postmasterlar spamni xohlaydi", + "rsettings_preset_3": "Pochta qutisi uchun faqat maxsus joʻnatuvchilarga ruxsat berish (yaʼni, faqat ichki pochta qutisi sifatida ishlatish)", + "rsettings_preset_4": "Domen uchun Rspamd ni oʻchirish", + "rspamd_com_settings": "Sozlama nomi avtomatik yaratiladi, quyidagi misol presetlariga qarang. Batafsil maʼlumot uchun Rspamd hujjatlariga qarang", + "rspamd_global_filters": "Global filtr xaritalari", + "rspamd_global_filters_agree": "Ehtiyot boʻlaman!", + "rspamd_global_filters_info": "Global filtr xaritalari turli xil global rad etish va ruxsat berish roʻyxatlarini oʻz ichiga oladi.", + "rspamd_global_filters_regex": "Ularning nomlari ularning maqsadini tushuntiradi. Barcha mazmun \"/pattern/options\" formatidagi haqiqiy muntazam ifodalarni oʻz ichiga olishi kerak (masalan, /.+@domain\\.tld/i).
\r\n Har bir regex satriga oddiy tekshiruvlar bajariladi, ammo agar Rspamd sintaksisni toʻgʻri oʻqiy olmasa, uning funksionalligi buzilishi mumkin.
\r\n Rspamd oʻzgarganda xarita mazmunini oʻqishga harakat qiladi. Agar muammolarga duch kelsangiz, xarita qayta yuklanishi uchun Rspamd ni qayta ishga tushiring.
Qora roʻyxatdagi elementlar karantindan istisno qilinadi.", + "rspamd_settings_map": "Rspamd sozlamalar xaritasi", + "sal_level": "Moo darajasi", + "save": "Oʻzgarishlarni saqlash", + "search_domain_da": "Domenlarni qidirish", + "send": "Joʻnatish", + "sender": "Joʻnatuvchi", + "service": "Xizmat", + "service_id": "Xizmat ID", + "source": "Manba", + "spamfilter": "Spam filtri", + "subject": "Mavzu", + "success": "Muvaffaqiyatli", + "sys_mails": "Tizim xatlari", + "task": "Vazifa", + "text": "Matn", + "time": "Vaqt", + "title": "Sarlavha", + "title_name": "\"mailcow UI\" veb-sayt sarlavhasi", + "to_top": "Yuqoriga qaytish", + "transport_dest_format": "Regex yoki sintaksis: example.org, .example.org, *, box@example.org (bir nechta qiymatlarni vergul bilan ajratish mumkin)", + "transport_maps": "Transport xaritalari", + "transport_test_rcpt_info": "• Tashqi manzilga relay qilishni sinash uchun null@hosted.mailcow.de dan foydalaning.", + "transports_hint": "• Transport xaritasi yozuvi joʻnatuvchiga bogʻliq transport xaritasidan ustun.
\r\n• MX asosidagi transportlar afzalroq ishlatiladi.
\r\n• Foydalanuvchi boʻyicha chiquvchi TLS siyosati sozlamalari eʼtiborga olinmaydi va faqat TLS siyosati xaritasi yozuvlari orqali majburlanishi mumkin.
\r\n• Belgilangan transportlar uchun transport xizmati har doim \"smtp:\" va shuning uchun taklif qilinganda TLS ga harakat qiladi. Oʻralgan TLS (SMTPS) qoʻllab-quvvatlanmaydi.
\r\n• \"/localhost$/\" ga mos keladigan manzillar har doim \"local:\" orqali tashiladi, shuning uchun \"*\" manzili bu manzillarga qoʻllanmaydi.
\r\n• Misol uchun keyingi nuqta \"[host]:25\" uchun maʼlumotlarni aniqlash uchun, Postfix har doim \"[host]:25\" ni qidirishdan oldin \"host\" ni soʻraydi. Bu xatti-harakat \"host\" va \"[host]:25\" ni bir vaqtning oʻzida ishlatishni imkonsiz qiladi.", + "ui_footer": "Pastki qism (HTML ruxsat etilgan)", + "ui_header_announcement": "Eʼlonlar", + "ui_header_announcement_active": "Eʼlonni faollashtirish", + "ui_header_announcement_content": "Matn (HTML ruxsat etilgan)", + "ui_header_announcement_help": "Eʼlon barcha tizimga kirgan foydalanuvchilarga va UI ning kirish ekranida koʻrinadi.", + "ui_header_announcement_select": "Eʼlon turini tanlang", + "ui_header_announcement_type": "Tur", + "ui_header_announcement_type_danger": "Juda muhim", + "ui_header_announcement_type_info": "Maʼlumot", + "ui_header_announcement_type_warning": "Muhim", + "ui_texts": "UI yorliqlari va matnlari", + "unban_pending": "blokdan chiqarish kutilmoqda", + "unchanged_if_empty": "Oʻzgartirilmagan boʻlsa, boʻsh qoldiring", + "upload": "Yuklash", + "username": "Foydalanuvchi nomi", + "user_link": "Foydalanuvchi havolasi", + "user_quicklink": "Foydalanuvchi kirish sahifasiga tezkor havolani yashirish", + "validate_license_now": "GUID ni litsenziya serveriga qarshi tekshirish", + "verify": "Tasdiqlash", + "yes": "✓" + }, + "danger": { + "access_denied": "Kirish rad etildi yoki noma'lum forma ma'lumotlari", + "tfa_removal_blocked": "Ikki faktorli autentifikatsiyani olib tashlab boʻlmaydi, chunki u sizning hisobingiz uchun talab qilinadi.", + "alias_domain_invalid": "%s taxallus domeni noto'g'ri", + "alias_empty": "Taxallus manzili boʻsh boʻlmasligi kerak", + "alias_goto_identical": "Taxallus va yoʻnaltirish manzili bir xil boʻlmasligi kerak", + "alias_invalid": "%s taxallus manzili noto'g'ri", + "aliasd_targetd_identical": "Taxallus domeni maqsad domeniga teng boʻlmasligi kerak: %s", + "aliases_in_use": "Maks. taxalluslar %d dan katta yoki teng boʻlishi kerak", + "app_name_empty": "Ilova nomi boʻsh boʻlolmaydi", + "app_passwd_id_invalid": "Ilova paroli ID %s noto'g'ri", + "authsource_in_use": "Identifikatsiya provayderini oʻzgartirib yoki oʻchirib boʻlmaydi, chunki u hozirda bir yoki bir nechta foydalanuvchilar tomonidan ishlatilmoqda.", + "bcc_empty": "BCC manzili boʻsh boʻlolmaydi", + "bcc_exists": "%s turi uchun %s BCC xaritasi mavjud", + "bcc_must_be_email": "BCC manzili %s haqiqiy e-pochta manzili emas", + "comment_too_long": "Izoh juda uzun, maks. 160 ta belgiga ruxsat berilgan", + "cors_invalid_method": "Noto'g'ri Allow-Method belgilangan", + "cors_invalid_origin": "Noto'g'ri Allow-Origin belgilangan", + "defquota_empty": "Bitta pochta qutisi uchun standart kvota 0 boʻlmasligi kerak.", + "demo_mode_enabled": "Demo rejim yoqilgan", + "description_invalid": "%s uchun resurs tavsifi noto'g'ri", + "dkim_domain_or_sel_exists": "\"%s\" uchun DKIM kaliti mavjud va u ustidan yozilmaydi", + "dkim_domain_or_sel_invalid": "DKIM domeni yoki tanlovchi noto'g'ri: %s", + "domain_cannot_match_hostname": "Domen xost nomiga mos kelishi mumkin emas", + "domain_exists": "%s domeni allaqachon mavjud", + "domain_invalid": "Domen nomi boʻsh yoki noto'g'ri", + "domain_not_empty": "Boʻsh boʻlmagan %s domenini olib tashlab boʻlmaydi", + "domain_not_found": "%s domeni topilmadi", + "domain_quota_m_in_use": "Domen kvotasi %s MiB dan katta yoki teng boʻlishi kerak", + "extended_sender_acl_denied": "Tashqi joʻnatuvchi manzillarini oʻrnatish uchun ACL yetishmayapti", + "extra_acl_invalid": "Tashqi joʻnatuvchi manzili \"%s\" noto'g'ri", + "extra_acl_invalid_domain": "Tashqi joʻnatuvchi \"%s\" noto'g'ri domendan foydalanmoqda", + "fido2_verification_failed": "FIDO2 tekshiruvi muvaffaqiyatsiz: %s", + "file_open_error": "Faylni yozish uchun ochib boʻlmadi", + "filter_type": "Notoʻgʻri filtr turi", + "from_invalid": "Joʻnatuvchi boʻsh boʻlmasligi kerak", + "generic_server_error": "Kutilmagan server xatosi yuz berdi. Iltimos, administratoringiz bilan bogʻlaning.", + "global_filter_write_error": "Filtr faylini yozib boʻlmadi: %s", + "global_map_invalid": "Global xarita ID %s noto'g'ri", + "global_map_write_error": "Global xarita ID %s ni yozib boʻlmadi: %s", + "goto_empty": "Taxallus manzili kamida bitta haqiqiy yoʻnaltirish manzilini oʻz ichiga olishi kerak", + "goto_invalid": "Yoʻnaltirish manzili %s noto'g'ri", + "ham_learn_error": "Ham oʻrgatish xatosi: %s", + "iam_test_connection": "Ulanish muvaffaqiyatsiz", + "imagick_exception": "Xato: Tasvirni oʻqishda Imagick istisnosi", + "img_dimensions_exceeded": "Tasvir maksimal tasvir oʻlchamidan oshib ketdi", + "img_invalid": "Tasvir faylini tekshirib boʻlmadi", + "img_size_exceeded": "Tasvir maksimal fayl oʻlchamidan oshib ketdi", + "img_tmp_missing": "Tasvir faylini tekshirib boʻlmadi: Vaqtinchalik fayl topilmadi", + "invalid_bcc_map_type": "Noto'g'ri BCC xarita turi", + "invalid_destination": "Manzil formati \"%s\" noto'g'ri", + "invalid_filter_type": "Noto'g'ri filtr turi", + "invalid_host": "Noto'g'ri xost belgilangan: %s", + "invalid_mime_type": "Noto'g'ri MIME turi", + "invalid_nexthop": "Keyingi nuqta formati noto'g'ri", + "invalid_nexthop_authenticated": "Keyingi nuqta boshqa maʼlumotlar bilan mavjud, iltimos avval bu keyingi nuqta uchun mavjud maʼlumotlarni yangilang.", + "invalid_recipient_map_new": "Yangi qabul qiluvchi noto'g'ri belgilangan: %s", + "invalid_recipient_map_old": "Asl qabul qiluvchi noto'g'ri belgilangan: %s", + "invalid_reset_token": "Noto'g'ri tiklash tokeni", + "ip_list_empty": "Ruxsat etilgan IP roʻyxati boʻsh boʻlolmaydi", + "is_alias": "%s allaqachon taxallus manzili sifatida tanilgan", + "is_alias_or_mailbox": "%s allaqachon taxallus, pochta qutisi yoki taxallus domenidan kengaytirilgan taxallus manzili sifatida tanilgan.", + "is_spam_alias": "%s allaqachon vaqtinchalik taxallus manzili (spam taxallus manzili) sifatida tanilgan", + "last_key": "Oxirgi kalitni oʻchirib boʻlmaydi, iltimos uning oʻrniga TFA ni oʻchiring.", + "login_failed": "Kirish muvaffaqiyatsiz", + "mailbox_defquota_exceeds_mailbox_maxquota": "Standart kvota maksimal kvota chegarasidan oshib ketdi", + "mailbox_invalid": "Pochta qutisi nomi noto'g'ri", + "mailbox_quota_exceeded": "Kvota domen chegarasidan oshib ketdi (maks. %d MiB)", + "mailbox_quota_exceeds_domain_quota": "Maks. kvota domen kvota chegarasidan oshib ketdi", + "mailbox_quota_left_exceeded": "Yetarli joy qolmadi (qolgan joy: %d MiB)", + "mailboxes_in_use": "Maks. pochta qutilari %d dan katta yoki teng boʻlishi kerak", + "malformed_username": "Noto'g'ri shakldagi foydalanuvchi nomi", + "map_content_empty": "Xarita mazmuni boʻsh boʻlolmaydi", + "max_age_invalid": "Maks. yosh %s noto'g'ri", + "max_alias_exceeded": "Maks. taxalluslar oshib ketdi", + "max_mailbox_exceeded": "Maks. pochta qutilari oshib ketdi (%d / %d)", + "max_quota_in_use": "Pochta qutisi kvotasi %d MiB dan katta yoki teng boʻlishi kerak", + "maxquota_empty": "Bitta pochta qutisi uchun maks. kvota 0 boʻlmasligi kerak.", + "mode_invalid": "Rejim %s noto'g'ri", + "mx_invalid": "MX yozuvi %s noto'g'ri", + "mysql_error": "MySQL xatosi: %s", + "network_host_invalid": "Noto'g'ri tarmoq yoki xost: %s", + "next_hop_interferes": "%s keyingi nuqta %s bilan tortishuvga kirishadi", + "next_hop_interferes_any": "Mavjud keyingi nuqta %s bilan tortishuvga kirishadi", + "nginx_reload_failed": "Nginx qayta yuklash muvaffaqiyatsiz: %s", + "no_user_defined": "Foydalanuvchi belgilanmagan", + "object_exists": "%s obyekti allaqachon mavjud", + "object_is_not_numeric": "%s qiymati raqamli emas", + "password_complexity": "Parol siyosatga mos kelmaydi", + "password_empty": "Parol boʻsh boʻlmasligi kerak", + "password_mismatch": "Tasdiqlash paroli mos kelmadi", + "password_reset_invalid_user": "Pochta qutisi topilmadi yoki tiklash uchun e-pochta oʻrnatilmagan", + "password_reset_na": "Parolni tiklash hozirda mavjud emas. Iltimos, administratoringiz bilan bogʻlaning.", + "policy_list_from_exists": "Berilgan nomli yozuv mavjud", + "policy_list_from_invalid": "Yozuv noto'g'ri formatga ega", + "private_key_error": "Maxfiy kalit xatosi: %s", + "pushover_credentials_missing": "Pushover tokeni va/yoki kaliti yetishmayapti", + "pushover_key": "Pushover kaliti notoʻgʻri formatga ega", + "pushover_token": "Pushover tokeni notoʻgʻri formatga ega", + "quarantine_category_invalid": "Karantin turkumi quyidagilardan biri boʻlishi kerak: add_header, reject, all", + "quota_not_0_not_numeric": "Kvota raqamli va >= 0 boʻlishi kerak", + "recipient_map_entry_exists": "Qabul qiluvchi xaritasi yozuvi \"%s\" mavjud", + "recovery_email_failed": "Tiklash e-pochtasini yuborib boʻlmadi. Iltimos, administratoringiz bilan bogʻlaning.", + "redis_error": "Redis xatosi: %s", + "relayhost_invalid": "Xarita yozuvi %s noto'g'ri", + "release_send_failed": "Xabarni chiqarib boʻlmadi: %s", + "required_data_missing": "Talab qilinadigan ma'lumotlar %s yetishmayapti", + "reset_f2b_regex": "Regex filtrini oʻz vaqtida tiklab boʻlmadi, iltimos qaytadan urinib koʻring yoki bir necha soniya kuting va sahifani qayta yuklang.", + "reset_token_limit_exceeded": "Tiklash tokeni chegarasi oshib ketdi. Iltimos, keyinroq urinib koʻring.", + "resource_invalid": "Resurs nomi %s noto'g'ri", + "rl_timeframe": "Tezlik chegarasi vaqt oraligʻi noto'g'ri", + "rspamd_ui_pw_length": "Rspamd UI paroli kamida 6 ta belgi uzunlikda boʻlishi kerak", + "script_empty": "Skript boʻsh boʻlolmaydi", + "sender_acl_invalid": "Joʻnatuvchi ACL qiymati %s noto'g'ri", + "set_acl_failed": "ACL ni oʻrnatib boʻlmadi", + "settings_map_invalid": "Sozlamalar xaritasi ID %s noto'g'ri", + "sieve_error": "Sieve tahlilchisi xatosi: %s", + "spam_learn_error": "Spam oʻrgatish xatosi: %s", + "subject_empty": "Mavzu boʻsh boʻlmasligi kerak", + "target_domain_invalid": "Maqsad domen %s noto'g'ri", + "targetd_not_found": "Maqsad domen %s topilmadi", + "targetd_relay_domain": "Maqsad domen %s relay domen", + "template_exists": "%s shabloni allaqachon mavjud", + "template_id_invalid": "Shablon ID %s noto'g'ri", + "template_name_invalid": "Shablon nomi noto'g'ri", + "temp_error": "Vaqtinchalik xato", + "text_empty": "Matn boʻsh boʻlmasligi kerak", + "tfa_token_invalid": "TFA tokeni noto'g'ri", + "tls_policy_map_dest_invalid": "Siyosat manzili noto'g'ri", + "tls_policy_map_entry_exists": "TLS siyosati xaritasi yozuvi \"%s\" mavjud", + "tls_policy_map_parameter_invalid": "Siyosat parametri noto'g'ri", + "to_invalid": "Qabul qiluvchi boʻsh boʻlmasligi kerak", + "totp_verification_failed": "TOTP tekshiruvi muvaffaqiyatsiz", + "transport_dest_exists": "Transport manzili \"%s\" mavjud", + "webauthn_verification_failed": "WebAuthn tekshiruvi muvaffaqiyatsiz: %s", + "webauthn_authenticator_failed": "Tanlangan autentifikator topilmadi", + "webauthn_publickey_failed": "Tanlangan autentifikator uchun ochiq kalit saqlanmagan", + "webauthn_username_failed": "Tanlangan autentifikator boshqa hisobga tegishli", + "unknown": "Noma'lum xato yuz berdi", + "unknown_tfa_method": "Noma'lum TFA usuli", + "unlimited_quota_acl": "Cheksiz kvota ACL tomonidan taqiqlangan", + "username_invalid": "Foydalanuvchi nomi %s ishlatib boʻlmaydi", + "validity_missing": "Iltimos, amal qilish muddatini tayinlang", + "value_missing": "Iltimos, barcha qiymatlarni kiriting", + "version_invalid": "Versiya %s noto'g'ri", + "yotp_verification_failed": "Yubico OTP tekshiruvi muvaffaqiyatsiz: %s" + }, + "datatables": { + "collapse_all": "Hammasini yigʻish", + "decimal": ".", + "emptyTable": "Jadvalda ma'lumot mavjud emas", + "expand_all": "Hammasini kengaytirish", + "info": "_TOTAL_ tadan _START_ dan _END_ gacha koʻrsatilmoqda", + "infoEmpty": "0 tadan 0 dan 0 gacha koʻrsatilmoqda", + "infoFiltered": "(jami _MAX_ tadan filtrlangan)", + "infoPostFix": "", + "thousands": ",", + "lengthMenu": "_MENU_ ta yozuvni koʻrsatish", + "loadingRecords": "Yuklanmoqda...", + "processing": "Iltimos, kuting...", + "search": "Qidirish:", + "zeroRecords": "Mos keladigan yozuvlar topilmadi", + "paginate": { + "first": "Birinchi", + "last": "Oxirgi", + "next": "Keyingi", + "previous": "Oldingi" + }, + "aria": { + "sortAscending": ": ustunni oʻsish boʻyicha saralash uchun faollashtiring", + "sortDescending": ": ustunni kamayish boʻyicha saralash uchun faollashtiring" + } + }, + "debug": { + "architecture": "Arxitektura", + "chart_this_server": "Diagramma (bu server)", + "containers_info": "Konteyner ma'lumotlari", + "container_running": "Ishlamoqda", + "container_disabled": "Konteyner toʻxtatilgan yoki oʻchirilgan", + "container_stopped": "Toʻxtatilgan", + "cores": "Yadrolar", + "current_time": "Tizim vaqti", + "disk_usage": "Disk foydalanish", + "docs": "Hujjatlar", + "error_show_ip": "Ommaviy IP manzillarini aniqlab boʻlmadi", + "external_logs": "Tashqi jurnallar", + "history_all_servers": "Tarix (barcha serverlar)", + "in_memory_logs": "Xotiradagi jurnallar", + "last_modified": "Oxirgi oʻzgartirilgan", + "log_info": "

mailcow xotiradagi jurnallar Redis roʻyxatlarida toʻplanadi va har daqiqada hammomilik kamaytirish uchun LOG_LINES (%d) ga qisqartiriladi.\r\n
Xotiradagi jurnallar doimiy boʻlishi mumkin emas. Xotirada jurnal yurituvchi barcha ilovalar ham Docker daemoniga, demak standart jurnal yuritish drayveriga ham yozadi.\r\n
Xotiradagi jurnal turi konteynerlar bilan kichik muammolarni nosozliklarni bartaraf etish uchun ishlatilishi kerak.

\r\n

Tashqi jurnallar berilgan ilovaning API si orqali toʻplanadi.

\r\n

Statik jurnallar asosan faollik jurnallaridir, ular Dockerd ga yozilmaydi, lekin baribir doimiy boʻlishi kerak (API jurnallaridan tashqari).

", + "login_time": "Vaqt", + "logs": "Jurnallar", + "memory": "Xotira", + "online_users": "Onlayn foydalanuvchilar", + "restart_container": "Qayta ishga tushirish", + "service": "Xizmat", + "show_ip": "Ommaviy IP ni koʻrsatish", + "size": "Oʻlcham", + "started_at": "Boshlangan vaqt", + "started_on": "Boshlangan sana", + "static_logs": "Statik jurnallar", + "success": "Muvaffaqiyatli", + "system_containers": "Tizim va konteynerlar", + "timezone": "Vaqt mintaqasi", + "uptime": "Ishlash vaqti", + "update_available": "Yangilanish mavjud", + "no_update_available": "Tizim oxirgi versiyada", + "update_failed": "Yangilanishni tekshirib boʻlmadi", + "username": "Foydalanuvchi nomi", + "wip": "Hozir ishlab chiqilmoqda" + }, + "diagnostics": { + "cname_from_a": "Qiymat A/AAAA yozuvidan olingan. Yozuv toʻgʻri resursga ishora qilsa, bu qoʻllab-quvvatlanadi.", + "dns_records": "DNS yozuvlari", + "dns_records_24hours": "DNS ga kiritilgan oʻzgarishlar ushbu sahifada toʻgʻri aks ettirilishi uchun 24 soatgacha vaqt ketishi mumkinligini hisobga oling. Bu DNS yozuvlaringizni qanday sozlash kerakligini osongina koʻrish va barcha yozuvlaringiz DNS da toʻgʻri saqlanganligini tekshirish uchun moʻljallangan.", + "dns_records_data": "Toʻgʻri ma'lumot", + "dns_records_docs": "Iltimos, hujjatlarga ham murojaat qiling.", + "dns_records_name": "Nomi", + "dns_records_status": "Joriy holat", + "dns_records_type": "Tur", + "optional": "Bu yozuv ixtiyoriy." + }, + "edit": { + "acl": "ACL (Ruxsat)", + "active": "Faol", + "admin": "Administratorni tahrirlash", + "advanced_settings": "Kengaytirilgan sozlamalar", + "alias": "Taxallusni tahrirlash", + "allow_from_smtp": "Faqat ushbu IP larga SMTP dan foydalanishga ruxsat berish", + "allow_from_smtp_info": "Barcha joʻnatuvchilarga ruxsat berish uchun boʻsh qoldiring.
IPv4/IPv6 manzillari va tarmoqlari.", + "allowed_protocols": "Toʻgʻridan-toʻgʻri foydalanuvchi kirishi uchun ruxsat etilgan protokollar (ilova paroli protokollariga taʼsir qilmaydi)", + "app_name": "Ilova nomi", + "app_passwd": "Ilova paroli", + "app_passwd_protocols": "Ilova paroli uchun ruxsat etilgan protokollar", + "automap": "Papkalarni avtomatik xaritalashga harakat qilish (\"Sent items\", \"Sent\" => \"Sent\" va h.k.)", + "backup_mx_options": "Relay sozlamalari", + "bcc_dest_format": "BCC manzili bitta haqiqiy e-pochta manzili boʻlishi kerak.
Agar bir nechta manzilga nusxa joʻnatish kerak boʻlsa, taxallus yarating va shu yerda ishlating.", + "client_id": "Mijoz ID", + "client_secret": "Mijoz maxfiy soʻzi", + "comment_info": "Maxfiy izoh foydalanuvchiga koʻrinmaydi, ommaviy izoh esa foydalanuvchi koʻrinishida ustiga sichqoncha kelganda maslahat sifatida koʻrsatiladi", + "created_on": "Yaratilgan sana", + "custom_attributes": "Maxsus atributlar", + "delete1": "Tugatilgach manbadan oʻchirish", + "delete2": "Manbada boʻlmagan xabarlarni manzildan oʻchirish", + "delete2duplicates": "Manzildagi dublikatlarni oʻchirish", + "delete_ays": "Iltimos, oʻchirish jarayonini tasdiqlang.", + "description": "Tavsif", + "disable_login": "Kirishni taqiqlash (kiruvchi pochta hali ham qabul qilinadi)", + "domain": "Domenni tahrirlash", + "domain_admin": "Domen administratorini tahrirlash", + "domain_footer": "Domen boʻyicha pastki qism", + "domain_footer_html": "HTML pastki qism", + "domain_footer_info": "Domen boʻyicha pastki qismlar ushbu domendagi manzilga bog'liq barcha chiquvchi xatlarga qoʻshiladi.
Pastki qism uchun quyidagi oʻzgaruvchilarni ishlatish mumkin:", + "domain_footer_info_vars": { + "auth_user": "{= auth_user =} - MTA tomonidan belgilangan autentifikatsiya qilingan foydalanuvchi nomi", + "from_user": "{= from_user =} - Konvertning Kimdan qismi, masalan \"moo@mailcow.tld\" uchun \"moo\" qaytaradi", + "from_name": "{= from_name =} - Konvertning Kimdan ismi, masalan \"Mailcow <moo@mailcow.tld>\" uchun \"Mailcow\" qaytaradi", + "from_addr": "{= from_addr =} - Konvertning Kimdan manzili qismi", + "from_domain": "{= from_domain =} - Konvertning Kimdan domeni qismi", + "custom": "{= foo =} - Agar pochta qutisida \"bar\" qiymatli \"foo\" maxsus atributi boʻlsa \"bar\" qaytaradi" + }, + "domain_footer_plain": "PLAIN pastki qism", + "domain_footer_skip_replies": "Javob xatlarida pastki qismni e'tiborsiz qoldirish", + "domain_quota": "Domen kvotasi", + "domains": "Domenlar", + "dont_check_sender_acl": "%s domeni uchun joʻnatuvchi tekshiruvini oʻchirish (+ taxallus domenlari)", + "edit_alias_domain": "Taxallus domenini tahrirlash", + "encryption": "Shifrlash", + "exclude": "Obyektlarni istisno qilish (regex)", + "extended_sender_acl": "Tashqi joʻnatuvchi manzillari", + "extended_sender_acl_info": "DKIM domen kaliti mavjud boʻlsa, import qilinishi kerak.
\r\n Ushbu serverni mos SPF TXT yozuviga qoʻshishni unutmang.
\r\n Ushbu serverga tashqi manzil bilan ust-ust tushadigan domen yoki taxallus domeni qoʻshilganda, tashqi manzil olib tashlanadi.
\r\n *@domain.tld sifatida joʻnatishga ruxsat berish uchun @domain.tld dan foydalaning.", + "force_pw_update": "Keyingi kirishda parolni majburiy yangilash", + "force_pw_update_info": "Bu foydalanuvchi faqat %s ga kira oladi. Ilova parollari ishlash holatida qoladi.", + "footer_exclude": "Pastki qismdan istisno qilish", + "full_name": "Toʻliq ism", + "gal": "Global manzillar roʻyxati", + "gal_info": "GAL domenning barcha obyektlarini oʻz ichiga oladi va hech bir foydalanuvchi tomonidan tahrirlanmaydi. Oʻchirilsa, SOGodagi bandlik maʼlumotlari yoʻqoladi! Oʻzgarishlarni qoʻllash uchun SOGoni qayta ishga tushiring.", + "generate": "yaratish", + "grant_types": "Grant turlari", + "hostname": "Xost nomi", + "inactive": "Nofaol", + "internal": "Ichki", + "internal_info": "Ichki taxalluslarga faqat oʻz domeni yoki taxallus domenlaridan kirish mumkin.", + "sender_allowed": "Ushbu taxallus orqali joʻnatishga ruxsat berish", + "sender_allowed_info": "Oʻchirilgan boʻlsa, bu taxallus faqat xat qabul qilishi mumkin. Maxsus pochta qutilariga joʻnatishga ruxsat berish uchun joʻnatuvchi ACL dan foydalaning.", + "kind": "Turi", + "last_modified": "Oxirgi oʻzgartirilgan", + "lookup_mx": "Manzil — MX nomiga mos keladigan muntazam ifoda (.*\\.google\\.com — google.com bilan tugaydigan MX ga yoʻnaltirilgan barcha pochtani ushbu nuqta orqali yoʻnaltirish uchun)", + "mailbox": "Pochta qutisini tahrirlash", + "mailbox_quota_def": "Standart pochta qutisi kvotasi", + "mailbox_relayhost_info": "Faqat pochta qutisi va to'g'ridan-to'g'ri taxalluslarga qoʻllaniladi, domen relay xostini bekor qiladi.", + "mailbox_rename": "Pochta qutisini qayta nomlash", + "mailbox_rename_agree": "Men zaxira nusxasini yaratdim.", + "mailbox_rename_warning": "MUHIM! Pochta qutisini qayta nomlashdan oldin zaxira nusxasi yarating.", + "mailbox_rename_alias": "Taxallusni avtomatik yaratish", + "mailbox_rename_title": "Yangi mahalliy pochta qutisi nomi", + "max_aliases": "Maks. taxalluslar", + "max_mailboxes": "Mumkin boʻlgan maks. pochta qutilari", + "max_quota": "Bitta pochta qutisining maks. kvotasi (MiB)", + "maxage": "Masofadan soʻraladigan xabarlarning maksimal yoshi (kunlarda)
(0 = yoshni e'tiborsiz qoldirish)", + "maxbytespersecond": "Maks. soniyaga bayt
(0 = cheksiz)", + "mbox_rl_info": "Bu tezlik chegarasi SASL kirish nomiga qoʻllaniladi, u kirgan foydalanuvchi tomonidan ishlatiladigan har qanday \"from\" manziliga mos keladi. Pochta qutisi tezlik chegarasi domen boʻyicha tezlik chegarasini bekor qiladi.", + "mins_interval": "Oraliq (daqiqa)", + "mta_sts": "MTA-STS", + "mta_sts_info": "MTA-STS — pochta serverlari oʻrtasida xat yetkazib berishni haqiqiy sertifikatli TLS dan foydalanishga majburlovchi standart.
U DNSSEC mavjud emasligi yoki qoʻllab-quvvatlanmasligi sababli DANE imkoni boʻlmaganda ishlatiladi.
Eslatma: Agar qabul qiluvchi domen DNSSEC bilan DANE ni qoʻllab-quvvatlasa, DANE har doim afzal koʻriladi — MTA-STS faqat zaxira sifatida ishlaydi.", + "mta_sts_version": "Versiya", + "mta_sts_version_info": "MTA-STS standartining versiyasini belgilaydi — hozirda faqat STSv1 haqiqiy.", + "mta_sts_mode": "Rejim", + "mta_sts_mode_info": "Tanlash uchun uchta rejim mavjud:
  • testing — siyosat faqat kuzatiladi, buzilishlar taʼsir koʻrsatmaydi.
  • enforce — siyosat qatʼiy qoʻllaniladi, haqiqiy TLS siz ulanishlar rad etiladi.
  • none — siyosat eʼlon qilinadi, ammo qoʻllanilmaydi.
", + "mta_sts_max_age": "Maks. yosh", + "mta_sts_max_age_info": "Qabul qiluvchi pochta serverlari ushbu siyosatni qayta olishdan oldin keshlashi mumkin boʻlgan vaqt (soniyalarda).", + "mta_sts_mx": "MX server", + "mta_sts_mx_info": "Faqat aniq sanab oʻtilgan pochta server xost nomlariga joʻnatishga ruxsat beradi; joʻnatuvchi MTA DNS MX xost nomi siyosat roʻyxatiga mos kelishini tekshiradi va faqat haqiqiy TLS sertifikati bilan yetkazib berishga ruxsat beradi (MITM ga qarshi himoya qiladi).", + "mta_sts_mx_notice": "Bir nechta MX serverlar belgilanishi mumkin (vergul bilan ajratilgan).", + "multiple_bookings": "Bir nechta bandlovlar", + "none_inherit": "Hech biri / Meros qilib olish", + "nexthop": "Keyingi nuqta", + "password": "Parol", + "password_recovery_email": "Parolni tiklash e-pochtasi", + "password_repeat": "Tasdiqlash paroli (takrorlang)", + "previous": "Oldingi sahifa", + "private_comment": "Maxfiy izoh", + "public_comment": "Ommaviy izoh", + "pushover": "Pushover", + "pushover_evaluate_x_prio": "Yuqori muhimlikdagi xatni eskalatsiya qilish [X-Priority: 1]", + "pushover_info": "Push bildirishnoma sozlamalari %s ga taxalluslar bilan birga (umumiy, umumiy boʻlmagan, teglangan) yetkazib beriladigan barcha toza (spam boʻlmagan) xatlarga qoʻllaniladi.", + "pushover_only_x_prio": "Faqat yuqori muhimlikdagi xatlarni koʻrib chiqish [X-Priority: 1]", + "pushover_sender_array": "Faqat quyidagi joʻnatuvchi e-pochta manzillarini koʻrib chiqish (vergul bilan ajratilgan)", + "pushover_sender_regex": "Quyidagi joʻnatuvchi regexini koʻrib chiqish", + "pushover_text": "Bildirishnoma matni", + "pushover_title": "Bildirishnoma sarlavhasi", + "pushover_sound": "Tovush", + "pushover_vars": "Joʻnatuvchi filtri belgilanmagan boʻlsa, barcha xatlar koʻrib chiqiladi.
Regex filtrlari va aniq joʻnatuvchi tekshiruvlari alohida belgilanishi mumkin va ketma-ket koʻrib chiqiladi. Ular bir-biriga bogʻliq emas.
Matn va sarlavha uchun ishlatiladigan oʻzgaruvchilar (ma'lumotlarni himoya qilish siyosatiga e'tibor bering)", + "pushover_verify": "Maʼlumotlarni tekshirish", + "quota_mb": "Kvota (MiB)", + "quota_warning_bcc": "Kvota ogohlantirishi BCC", + "quota_warning_bcc_info": "Ogohlantirishlar alohida nusxa sifatida quyidagi qabul qiluvchilarga yuboriladi. Mavzu mos foydalanuvchi nomi bilan qavs ichida qoʻshib qoʻyiladi, masalan: Kvota ogohlantirishi (user@example.com).", + "ratelimit": "Tezlik chegarasi", + "redirect_uri": "Yoʻnaltirish/Qaytarish URL", + "relay_all": "Barcha qabul qiluvchilarni relay qilish", + "relay_all_info": "↪ Agar barcha qabul qiluvchilarni relay qilmaslikni tanlasangiz, relay qilinishi kerak boʻlgan har bir qabul qiluvchi uchun (\"koʻr\") pochta qutisi qoʻshishingiz kerak boʻladi.", + "relay_domain": "Ushbu domenni relay qilish", + "relay_transport_info": "
Maʼlumot
Bu domen uchun maxsus manzilga transport xaritalarini belgilashingiz mumkin. Agar oʻrnatilmagan boʻlsa, MX qidiruvi amalga oshiriladi.", + "relay_unknown_only": "Faqat mavjud boʻlmagan pochta qutilarini relay qilish. Mavjud pochta qutilari mahalliy yetkazib beriladi.", + "relayhost": "Joʻnatuvchiga bogʻliq transportlar", + "remove": "Olib tashlash", + "resource": "Resurs", + "save": "Oʻzgarishlarni saqlash", + "scope": "Qamrov", + "sender_acl": "Quyidagi sifatida joʻnatishga ruxsat berish", + "sender_acl_disabled": "Joʻnatuvchi tekshiruvi oʻchirilgan", + "sender_acl_info": "Agar A pochta qutisi foydalanuvchisi B pochta qutisi foydalanuvchisi sifatida joʻnatishga ruxsat etilgan boʻlsa, joʻnatuvchi manzili SOGo da tanlanadigan \"from\" maydoni sifatida avtomatik koʻrsatilmaydi.
\r\n B pochta qutisi foydalanuvchisi A pochta qutisi foydalanuvchisi oʻz manzilini joʻnatuvchi sifatida tanlay olishi uchun SOGo da delegatsiya yaratishi kerak. SOGo da pochta qutisini delegatsiya qilish uchun pochta koʻrinishida yuqori chap qismdagi pochta qutisi nomingiz oʻng tomonidagi menyudan (uch nuqta) foydalaning. Bu xatti-harakat taxallus manzillariga qoʻllanmaydi.", + "sieve_desc": "Qisqa tavsif", + "sieve_type": "Filtr turi", + "skipcrossduplicates": "Papkalararo dublikat xabarlarni oʻtkazib yuborish (birinchi kelgan, birinchi xizmatlanadi)", + "sogo_access": "SOGo ga toʻgʻridan-toʻgʻri yoʻnaltirish", + "sogo_access_info": "Tizimga kirgandan keyin foydalanuvchi avtomatik ravishda SOGo ga yoʻnaltiriladi.", + "sogo_visible": "Taxallus SOGo da koʻrinadi", + "sogo_visible_info": "Bu variant faqat SOGo da koʻrsatilishi mumkin boʻlgan obyektlarga taʼsir qiladi (kamida bitta mahalliy pochta qutisiga ishora qiluvchi umumiy yoki umumiy boʻlmagan taxallus manzillari). Yashirilgan boʻlsa, taxallus SOGo da tanlanadigan joʻnatuvchi sifatida koʻrinmaydi.", + "spam_alias": "Vaqt cheklangan taxallus manzillarini yaratish yoki oʻzgartirish", + "spam_filter": "Spam filtri", + "spam_policy": "Elementlarni ruxsat etilgan/qora roʻyxatga qoʻshish yoki olib tashlash", + "spam_score": "Maxsus spam bahosini oʻrnatish", + "subfolder2": "Manzilning subpapkasiga sinxronizatsiya qilish
(boʻsh = subpapkadan foydalanmang)", + "syncjob": "Sinxronizatsiya vazifasini tahrirlash", + "target_address": "Yoʻnaltirish manzil(lar)i (vergul bilan ajratilgan)", + "target_domain": "Maqsad domen", + "timeout1": "Masofaviy xostga ulanish vaqtining tugashi", + "timeout2": "Mahalliy xostga ulanish vaqtining tugashi", + "title": "Obyektni tahrirlash", + "unchanged_if_empty": "Oʻzgartirilmagan boʻlsa, boʻsh qoldiring", + "username": "Foydalanuvchi nomi", + "validate_save": "Tekshirish va saqlash" + }, + "fido2": { + "confirm": "Tasdiqlash", + "fido2_auth": "FIDO2 bilan kirish", + "fido2_success": "Qurilma muvaffaqiyatli roʻyxatdan oʻtkazildi", + "fido2_validation_failed": "Tekshirish muvaffaqiyatsiz", + "fn": "Doʻstona nom", + "known_ids": "Maʼlum ID lar", + "none": "Oʻchirilgan", + "register_status": "Roʻyxatga olish holati", + "rename": "Qayta nomlash", + "set_fido2": "FIDO2 qurilmasini roʻyxatdan oʻtkazish", + "set_fido2_touchid": "Apple M1 da Touch ID ni roʻyxatdan oʻtkazish", + "set_fn": "Doʻstona nomni oʻrnatish", + "start_fido2_validation": "FIDO2 tekshiruvini boshlash" + }, + "footer": { + "cancel": "Bekor qilish", + "confirm_delete": "Oʻchirishni tasdiqlash", + "delete_now": "Hozir oʻchirish", + "delete_these_items": "Iltimos, quyidagi obyekt ID siga oʻzgarishlaringizni tasdiqlang", + "hibp_check": "haveibeenpwned.com ga qarshi tekshirish", + "hibp_nok": "Mos keldi! Bu xavfli parol boʻlishi mumkin!", + "hibp_ok": "Mos kelmadi.", + "loading": "Iltimos, kuting...", + "nothing_selected": "Hech narsa tanlanmadi", + "restart_container": "Konteynerni qayta ishga tushirish", + "restart_container_info": "Muhim: Yumshoq qayta ishga tushirish biroz vaqt olishi mumkin, iltimos uning tugashini kuting.", + "restart_now": "Hozir qayta ishga tushirish", + "restarting_container": "Konteyner qayta ishga tushirilmoqda, bu biroz vaqt olishi mumkin" + }, + "header": { + "administration": "Konfiguratsiya va tafsilotlar", + "apps": "Ilovalar", + "debug": "Maʼlumot", + "email": "E-pochta", + "mailcow_system": "Tizim", + "mailcow_config": "Konfiguratsiya", + "quarantine": "Karantin", + "restart_netfilter": "Netfilterni qayta ishga tushirish", + "restart_sogo": "SOGoni qayta ishga tushirish", + "user_settings": "Foydalanuvchi sozlamalari" + }, + "info": { + "awaiting_tfa_confirmation": "TFA tasdiqlanishi kutilmoqda", + "no_action": "Amal qoʻllanib boʻlmaydi", + "session_expires": "Sessiyangiz taxminan 15 soniyadan keyin tugaydi" + }, + "login": { + "back_to_mailcow": "mailcow ga qaytish", + "delayed": "Kirish %s soniyaga kechiktirildi.", + "fido2_webauthn": "FIDO2/WebAuthn kirish", + "forgot_password": "> Parolni unutdingizmi?", + "invalid_pass_reset_token": "Parolni tiklash tokeni noto'g'ri yoki muddati tugagan.
Iltimos, yangi parolni tiklash havolasini soʻrang.", + "login": "Kirish", + "login_linkstext": "Toʻgʻri kirish emasmi?", + "login_usertext": "Foydalanuvchi sifatida kirish", + "login_domainadmintext": "Domen administratori sifatida kirish", + "login_admintext": "Administrator sifatida kirish", + "login_user": "Foydalanuvchi kirishi", + "login_dadmin": "Domen-administratori kirishi", + "login_admin": "Administrator kirishi", + "mobileconfig_info": "Soʻralgan Apple ulanish profilini yuklab olish uchun pochta qutisi foydalanuvchisi sifatida kiring.", + "new_password": "Yangi parol", + "new_password_confirm": "Yangi parolni tasdiqlang", + "other_logins": "yoki quyidagi orqali kiring", + "password": "Parol", + "reset_password": "Parolni tiklash", + "request_reset_password": "Parol oʻzgartirishni soʻrash", + "username": "Foydalanuvchi nomi", + "email": "E-pochta manzili" + }, + "mailbox": { + "action": "Amal", + "activate": "Faollashtirish", + "active": "Faol", + "add": "Qoʻshish", + "add_alias": "Taxallus qoʻshish", + "add_alias_expand": "Taxallusni taxallus domenlari boʻylab kengaytirish", + "add_bcc_entry": "BCC xaritasi qoʻshish", + "add_domain": "Domen qoʻshish", + "add_domain_alias": "Domen taxallusini qoʻshish", + "add_domain_record_first": "Iltimos, avval domen qoʻshing", + "add_filter": "Filtr qoʻshish", + "add_mailbox": "Pochta qutisi qoʻshish", + "add_recipient_map_entry": "Qabul qiluvchi xaritasini qoʻshish", + "add_resource": "Resurs qoʻshish", + "add_template": "Shablon qoʻshish", + "add_tls_policy_map": "TLS siyosati xaritasini qoʻshish", + "address_rewriting": "Manzilni qayta yozish", + "alias": "Taxallus", + "alias_domain_alias_hint": "Taxalluslar domen taxalluslariga avtomatik qoʻllanilmaydi. my-alias@domain taxallus manzili my-alias@alias-domain manzilini qoplamaydi (bu yerda \"alias-domain\" — \"domain\" uchun tasavvur qilingan taxallus domeni).
Tashqi pochta qutisiga xatni yoʻnaltirish uchun sieve filtridan foydalaning (\"Filtrlar\" yorligʻiga qarang yoki SOGo -> Forwarder dan foydalaning). Yoʻq taxalluslarni avtomatik qoʻshish uchun \"Taxallusni taxallus domenlari boʻylab kengaytirish\" dan foydalaning.", + "alias_domain_backupmx": "Relay domeni uchun taxallus domeni nofaol", + "aliases": "Taxalluslar", + "all_domains": "Barcha domenlar", + "allow_from_smtp": "Faqat ushbu IP larga SMTP dan foydalanishga ruxsat berish", + "allow_from_smtp_info": "Barcha joʻnatuvchilarga ruxsat berish uchun boʻsh qoldiring.
IPv4/IPv6 manzillari va tarmoqlari.", + "allowed_protocols": "Ruxsat etilgan protokollar", + "backup_mx": "Relay domeni", + "bcc": "BCC", + "bcc_destination": "BCC manzili", + "bcc_destinations": "BCC manzili", + "bcc_info": "BCC xaritalari barcha xabarlarning nusxalarini boshqa manzilga jimgina yoʻnaltirish uchun ishlatiladi. Qabul qiluvchi xaritasi turi yozuvi mahalliy manzil xatning qabul qiluvchisi sifatida ishlaganda ishlatiladi. Joʻnatuvchi xaritalari ham xuddi shu tamoyilga muvofiq ishlaydi.
\r\n Mahalliy manzilga yetkazib berish muvaffaqiyatsiz boʻlsa, xabar berilmaydi.", + "bcc_local_dest": "Mahalliy manzil", + "bcc_map": "BCC xaritasi", + "bcc_map_type": "BCC turi", + "bcc_maps": "BCC xaritalari", + "bcc_rcpt_map": "Qabul qiluvchi xaritasi", + "bcc_sender_map": "Joʻnatuvchi xaritasi", + "bcc_to_rcpt": "Qabul qiluvchi xaritasi turiga oʻtish", + "bcc_to_sender": "Joʻnatuvchi xaritasi turiga oʻtish", + "bcc_type": "BCC turi", + "booking_null": "Doimo boʻsh sifatida koʻrsatish", + "booking_0_short": "Doimo boʻsh", + "booking_custom": "Maxsus bandlovlar soni bilan qatʼiy cheklash", + "booking_custom_short": "Qatʼiy chegara", + "booking_ltnull": "Cheksiz, lekin bandlangan boʻlsa band sifatida koʻrsatish", + "booking_lt0_short": "Yumshoq chegara", + "catch_all": "Hammasini-qabul qilish", + "created_on": "Yaratilgan sana", + "daily": "Kunlik", + "deactivate": "Oʻchirish", + "description": "Tavsif", + "disable_login": "Kirishni taqiqlash (kiruvchi pochta hali ham qabul qilinadi)", + "disable_x": "Oʻchirish", + "dkim_domains_selector": "Tanlovchi", + "dkim_key_length": "DKIM kalit uzunligi (bit)", + "domain": "Domen", + "domain_admins": "Domen administratorlari", + "domain_aliases": "Domen taxalluslari", + "domain_templates": "Domen shablonlari", + "domain_quota": "Kvota", + "domain_quota_total": "Umumiy domen kvotasi", + "domains": "Domenlar", + "edit": "Tahrirlash", + "empty": "Natijalar yoʻq", + "enable_x": "Yoqish", + "excludes": "Istisnolar", + "filter_table": "Filtr jadvali", + "filters": "Filtrlar", + "fname": "Toʻliq ism", + "force_pw_update": "Keyingi kirishda parolni majburiy yangilash", + "gal": "Global manzillar roʻyxati", + "goto_ham": "ham sifatida oʻrgatish", + "goto_spam": "spam sifatida oʻrgatish", + "hourly": "Soatlik", + "iam": "Identifikatsiya provayderi", + "in_use": "Foydalanilmoqda (%)", + "inactive": "Nofaol", + "insert_preset": "Misol presetini kiritish \"%s\"", + "internal": "Ichki", + "kind": "Turi", + "last_mail_login": "Oxirgi pochta kirishi", + "last_modified": "Oxirgi oʻzgartirilgan", + "last_pw_change": "Oxirgi parol oʻzgarishi", + "last_run": "Oxirgi ishga tushirilgan", + "last_run_reset": "Keyingisini rejalashtirish", + "mailbox": "Pochta qutisi", + "mailbox_defaults": "Standart sozlamalar", + "mailbox_defaults_info": "Yangi pochta qutilari uchun standart sozlamalarni belgilang.", + "mailbox_defquota": "Standart pochta qutisi oʻlchami", + "mailbox_templates": "Pochta qutisi shablonlari", + "mailbox_quota": "Pochta qutisining maks. oʻlchami", + "mailboxes": "Pochta qutilari", + "max_aliases": "Maks. taxalluslar", + "max_mailboxes": "Mumkin boʻlgan maks. pochta qutilari", + "max_quota": "Bitta pochta qutisining maks. kvotasi", + "mins_interval": "Oraliq (daqiqa)", + "msg_num": "Xabar #", + "multiple_bookings": "Bir nechta bandlovlar", + "never": "Hech qachon", + "no": "✕", + "no_record": "%s obyekti uchun yozuv yoʻq", + "no_record_single": "Yozuv yoʻq", + "open_logs": "Jurnallarni ochish", + "owner": "Egasi", + "private_comment": "Maxfiy izoh", + "public_comment": "Ommaviy izoh", + "q_add_header": "Junk papkasiga koʻchirilganda", + "q_all": " Junk papkasiga koʻchirilganda va rad etilganda", + "q_reject": "rad etilganda", + "quarantine_category": "Karantin bildirishnoma turkumi", + "quarantine_notification": "Karantin bildirishnomalari", + "quick_actions": "Amallar", + "recipient": "Qabul qiluvchi", + "recipient_map": "Qabul qiluvchi xaritasi", + "recipient_map_info": "Qabul qiluvchi xaritalari xabar yetkazib berilishidan oldin manzilni almashtirish uchun ishlatiladi.", + "recipient_map_new": "Yangi qabul qiluvchi", + "recipient_map_new_info": "Qabul qiluvchi xaritasi manzili haqiqiy e-pochta manzili yoki domen nomi boʻlishi kerak.", + "recipient_map_old": "Asl qabul qiluvchi", + "recipient_map_old_info": "Qabul qiluvchi xaritasining asl manzili haqiqiy e-pochta manzili yoki domen nomi boʻlishi kerak.", + "recipient_maps": "Qabul qiluvchi xaritalari", + "relay_all": "Barcha qabul qiluvchilarni relay qilish", + "relay_unknown": "Nomaʼlum pochta qutilarini relay qilish", + "remove": "Olib tashlash", + "resources": "Resurslar", + "running": "Ishlamoqda", + "sender": "Joʻnatuvchi", + "set_postfilter": "Postfiltr sifatida belgilash", + "set_prefilter": "Prefiltr sifatida belgilash", + "sieve_info": "Bitta foydalanuvchi uchun bir nechta filtrlarni saqlash mumkin, lekin bir vaqtning oʻzida faqat bitta prefiltr va bitta postfiltr faol boʻlishi mumkin.
\r\nHar bir filtr tasvirlangan tartibda qayta ishlanadi. Muvaffaqiyatsiz skript ham, chiqarilgan \"keep;\" ham keyingi skriptlarning qayta ishlanishini toʻxtatmaydi. Global sieve skriptlariga oʻzgartirishlar Dovecot ni qayta ishga tushirishni keltirib chiqaradi.

Global sieve prefilter • Prefilter • Foydalanuvchi skriptlari • Postfilter • Global sieve postfilter", + "sieve_preset_1": "Xavfli boʻlishi mumkin boʻlgan fayl turlari bilan xatlarni rad etish", + "sieve_preset_2": "Aniq joʻnatuvchining xatini har doim oʻqilgan deb belgilash", + "sieve_preset_3": "Jimgina rad etish, keyingi sieve qayta ishlashini toʻxtatish", + "sieve_preset_4": "INBOX ga joylash, sieve filtrlari tomonidan keyingi qayta ishlashni oʻtkazib yuborish", + "sieve_preset_5": "Avto-javob (taʼtil)", + "sieve_preset_6": "Javob bilan xatni rad etish", + "sieve_preset_7": "Yoʻnaltirish va saqlash/tashlash", + "sieve_preset_8": "Aniq joʻnatuvchining xatini yoʻnaltirish, oʻqilgan deb belgilash va subpapkaga saralash", + "sieve_preset_header": "Iltimos, quyidagi misol presetlariga qarang. Batafsil maʼlumot uchun Wikipediaga qarang.", + "sogo_visible": "Taxallus SOGo da koʻrinadi", + "sogo_visible_n": "Taxallusni SOGo da yashirish", + "sogo_visible_y": "Taxallusni SOGo da koʻrsatish", + "spam_aliases": "Vaqt. taxallus", + "stats": "Statistika", + "status": "Holat", + "sync_jobs": "Sinxronizatsiya vazifalari", + "syncjob_check_log": "Jurnalni tekshirish", + "syncjob_last_run_result": "Oxirgi ishga tushirilgan natija", + "syncjob_EX_OK": "Muvaffaqiyatli", + "syncjob_EXIT_CONNECTION_FAILURE": "Ulanish muammosi", + "syncjob_EXIT_TLS_FAILURE": "Shifrlangan ulanish bilan muammo", + "syncjob_EXIT_AUTHENTICATION_FAILURE": "Autentifikatsiya muammosi", + "syncjob_EXIT_OVERQUOTA": "Maqsad pochta qutisi kvotadan oshib ketdi", + "syncjob_EXIT_CONNECTION_FAILURE_HOST1": "Masofaviy serverga ulanib boʻlmadi", + "syncjob_EXIT_AUTHENTICATION_FAILURE_USER1": "Notoʻgʻri foydalanuvchi nomi yoki parol", + "table_size": "Jadval oʻlchami", + "table_size_show_n": "%s ta element koʻrsatish", + "target_address": "Yoʻnaltirish manzili", + "target_domain": "Maqsad domen", + "templates": "Shablonlar", + "template": "Shablon", + "tls_enforce_in": "Kiruvchi TLS ni majburlash", + "tls_enforce_out": "Chiquvchi TLS ni majburlash", + "tls_map_dest": "Manzil", + "tls_map_dest_info": "Misollar: example.org, .example.org, [mail.example.org]:25", + "tls_map_parameters": "Parametrlar", + "tls_map_parameters_info": "Boʻsh yoki parametrlar, masalan: protocols=!SSLv2 ciphers=medium exclude=3DES", + "tls_map_policy": "Siyosat", + "tls_policy_maps": "TLS siyosati xaritalari", + "tls_policy_maps_enforced_tls": "Bu siyosatlar chiquvchi TLS ulanishlarini majburlovchi pochta qutisi foydalanuvchilari uchun ham xatti-harakatni bekor qiladi. Agar quyida siyosat boʻlmasa, bu foydalanuvchilar smtp_tls_mandatory_protocols va smtp_tls_mandatory_ciphers sifatida belgilangan standart qiymatlarni qoʻllaydi.", + "tls_policy_maps_info": "Bu siyosat xaritasi foydalanuvchining TLS siyosati sozlamalaridan mustaqil ravishda chiquvchi TLS transport qoidalarini bekor qiladi.
\r\n Batafsil maʼlumot uchun \"smtp_tls_policy_maps\" hujjatlarini tekshiring.", + "tls_policy_maps_long": "Chiquvchi TLS siyosati xaritasi bekor qilishlari", + "toggle_all": "Hammasini almashtirish", + "username": "Foydalanuvchi nomi", + "waiting": "Kutilmoqda", + "weekly": "Haftalik", + "yes": "✓" + }, + "oauth2": { + "access_denied": "OAuth2 orqali kirishga ruxsat berish uchun pochta qutisi egasi sifatida kiring.", + "authorize_app": "Ilovaga ruxsat berish", + "deny": "Rad etish", + "permit": "Ilovaga ruxsat berish", + "profile": "Profil", + "profile_desc": "Shaxsiy maʼlumotlarni koʻrish: foydalanuvchi nomi, toʻliq ism, yaratilgan, oʻzgartirilgan, faol", + "scope_ask_permission": "Ilova quyidagi ruxsatlarni soʻradi" + }, + "quarantine": { + "action": "Amal", + "atts": "Ilovalar", + "check_hash": "VT da fayl hashini qidirish", + "confirm": "Tasdiqlash", + "confirm_delete": "Ushbu elementni oʻchirishni tasdiqlang.", + "danger": "Xavf", + "deliver_inbox": "Inbox ga yetkazib berish", + "disabled_by_config": "Joriy tizim konfiguratsiyasi karantin funksiyasini oʻchirib qoʻyadi. Iltimos, karantin elementlari uchun \"pochta qutisi boʻyicha saqlash\" va \"maksimal oʻlcham\"ni oʻrnating.", + "download_eml": "Yuklab olish (.eml)", + "empty": "Natijalar yoʻq", + "high_danger": "Yuqori", + "info": "Maʼlumot", + "junk_folder": "Junk papkasi", + "learn_spam_delete": "Spam sifatida oʻrgatish va oʻchirish", + "low_danger": "Past", + "medium_danger": "Oʻrtacha", + "neutral_danger": "Neytral", + "notified": "Xabar berildi", + "qhandler_success": "Soʻrov tizimga muvaffaqiyatli yuborildi. Endi oynani yopishingiz mumkin.", + "qid": "Rspamd QID", + "qinfo": "Karantin tizimi rad etilgan xatni (joʻnatuvchiga xat yetkazib berilgandek taassurot bermay) hamda pochta qutisining Junk papkasiga nusxa sifatida yetkazib berilgan xatni maʼlumotlar bazasiga saqlaydi.\r\n
\"Spam sifatida oʻrgatish va oʻchirish\" xabarni Bayesian teoremasi orqali spam sifatida oʻrgatadi va kelajakda oʻxshash xabarlarni rad etish uchun fuzzy hashlarni hisoblaydi.\r\n
Bir nechta xabarlarni oʻrgatish — tizimingizga qarab — vaqt talab qilishi mumkinligini unutmang.
Qora roʻyxatdagi elementlar karantindan istisno qilinadi.", + "qitem": "Karantin elementi", + "quarantine": "Karantin", + "quick_actions": "Amallar", + "quick_delete_link": "Tezkor oʻchirish havolasini ochish", + "quick_info_link": "Maʼlumot havolasini ochish", + "quick_release_link": "Tezkor chiqarish havolasini ochish", + "rcpt": "Qabul qiluvchi", + "received": "Qabul qilingan", + "recipients": "Qabul qiluvchilar", + "refresh": "Yangilash", + "rejected": "Rad etilgan", + "release": "Chiqarish", + "release_body": "Xabaringizni ushbu xabarga eml fayl sifatida ilova qildik.", + "release_subject": "Potensial xavfli karantin elementi %s", + "remove": "Olib tashlash", + "rewrite_subject": "Mavzuni qayta yozish", + "rspamd_result": "Rspamd natijasi", + "sender": "Joʻnatuvchi (SMTP)", + "sender_header": "Joʻnatuvchi (\"From\" sarlavhasi)", + "settings_info": "Karantinga olinadigan maksimal elementlar soni: %s
Maksimal e-pochta oʻlchami: %s MiB", + "show_item": "Elementni koʻrsatish", + "spam": "Spam", + "spam_score": "Baho", + "subj": "Mavzu", + "table_size": "Jadval oʻlchami", + "table_size_show_n": "%s ta element koʻrsatish", + "text_from_html_content": "Mazmun (oʻzgartirilgan html)", + "text_plain_content": "Mazmun (text/plain)", + "toggle_all": "Hammasini almashtirish", + "type": "Tur" + }, + "queue": { + "delete": "Hammasini oʻchirish", + "flush": "Navbatni tozalash", + "info": "Pochta navbati yetkazib berilishini kutayotgan barcha xatlarni oʻz ichiga oladi. Agar e-pochta uzoq vaqt davomida pochta navbatida tursa, u tizim tomonidan avtomatik ravishda oʻchiriladi.
Tegishli xatning xato xabari xat nima uchun yetkazib berilmaganligi haqida maʼlumot beradi.", + "legend": "Pochta navbati amallari funksiyalari:", + "ays": "Iltimos, joriy navbatdagi barcha elementlarni oʻchirishni tasdiqlang.", + "deliver_mail": "Yetkazib berish", + "deliver_mail_legend": "Tanlangan xatlarni qayta yetkazib berishga harakat qiladi.", + "hold_mail": "Ushlab turish", + "hold_mail_legend": "Tanlangan xatlarni ushlab turadi. (Keyingi yetkazib berish urinishlarining oldini oladi)", + "queue_manager": "Navbat menejeri", + "show_message": "Xabarni koʻrsatish", + "unban": "navbatdan blokdan chiqarish", + "unhold_mail": "Ushlab turishni bekor qilish", + "unhold_mail_legend": "Tanlangan xatlarni yetkazib berish uchun chiqaradi. (Avval ushlab turish talab qilinadi)" + }, + "ratelimit": { + "disabled": "Oʻchirilgan", + "second": "xabarlar / soniya", + "minute": "xabarlar / daqiqa", + "hour": "xabarlar / soat", + "day": "xabarlar / kun" + }, + "start": { + "help": "Yordam panelini koʻrsatish/yashirish", + "imap_smtp_server_auth_info": "Iltimos, toʻliq e-pochta manzilingiz va PLAIN autentifikatsiya mexanizmidan foydalaning.
\r\nKirish maʼlumotlaringiz server tomonidagi majburiy shifrlash orqali shifrlanadi." + }, + "success": { + "acl_saved": "%s obyekti uchun ACL saqlandi", + "admin_added": "Administrator %s qoʻshildi", + "admin_api_modified": "API ga oʻzgarishlar saqlandi", + "admin_modified": "Administrator oʻzgarishlari saqlandi", + "admin_removed": "Administrator %s olib tashlandi", + "alias_added": "Taxallus manzili %s (%d) qoʻshildi", + "alias_domain_removed": "Taxallus domeni %s olib tashlandi", + "alias_modified": "Taxallus manzili %s ga oʻzgarishlar saqlandi", + "alias_removed": "Taxallus %s olib tashlandi", + "aliasd_added": "Taxallus domeni %s qoʻshildi", + "aliasd_modified": "Taxallus domeni %s ga oʻzgarishlar saqlandi", + "app_links": "Ilova havolalariga oʻzgarishlar saqlandi", + "app_passwd_added": "Yangi ilova paroli qoʻshildi", + "app_passwd_removed": "Ilova paroli ID %s olib tashlandi", + "bcc_deleted": "BCC xaritasi yozuvlari oʻchirildi: %s", + "bcc_edited": "BCC xaritasi yozuvi %s tahrirlandi", + "bcc_saved": "BCC xaritasi yozuvi saqlandi", + "cors_headers_edited": "CORS sozlamalari saqlandi", + "custom_login_modified": "Kirishni sozlash muvaffaqiyatli saqlandi", + "db_init_complete": "Maʼlumotlar bazasini ishga tushirish tugadi", + "delete_filter": "Filtr ID %s oʻchirildi", + "delete_filters": "Filtrlar oʻchirildi: %s", + "deleted_syncjob": "Sinxronizatsiya vazifasi ID %s oʻchirildi", + "deleted_syncjobs": "Sinxronizatsiya vazifalari oʻchirildi: %s", + "dkim_added": "DKIM kaliti %s saqlandi", + "domain_add_dkim_available": "DKIM kaliti allaqachon mavjud edi", + "dkim_duplicated": "%s domeni uchun DKIM kaliti %s ga nusxalandi", + "dkim_removed": "DKIM kaliti %s olib tashlandi", + "domain_added": "Domen %s qoʻshildi", + "domain_admin_added": "Domen administratori %s qoʻshildi", + "domain_admin_modified": "Domen administratori %s ga oʻzgarishlar saqlandi", + "domain_admin_removed": "Domen administratori %s olib tashlandi", + "domain_footer_modified": "Domen pastki qismi %s ga oʻzgarishlar saqlandi", + "domain_modified": "Domen %s ga oʻzgarishlar saqlandi", + "domain_removed": "Domen %s olib tashlandi", + "dovecot_restart_success": "Dovecot muvaffaqiyatli qayta ishga tushirildi", + "eas_reset": "%s foydalanuvchisi uchun ActiveSync qurilmalari tiklandi", + "f2b_banlist_refreshed": "Banlist ID muvaffaqiyatli yangilandi.", + "f2b_modified": "Fail2ban parametrlariga oʻzgarishlar saqlandi", + "forwarding_host_added": "Yoʻnaltirish xosti %s qoʻshildi", + "forwarding_host_removed": "Yoʻnaltirish xosti %s olib tashlandi", + "global_filter_written": "Filtr faylga muvaffaqiyatli yozildi", + "hash_deleted": "Hash oʻchirildi", + "iam_test_connection": "Ulanish muvaffaqiyatli", + "ip_check_opt_in_modified": "IP tekshiruvi muvaffaqiyatli saqlandi", + "item_deleted": "Element %s muvaffaqiyatli oʻchirildi", + "item_released": "Element %s chiqarildi", + "items_deleted": "Element %s muvaffaqiyatli oʻchirildi", + "items_released": "Tanlangan elementlar chiqarildi", + "learned_ham": "ID %s ham sifatida muvaffaqiyatli oʻrgatildi", + "license_modified": "Litsenziyaga oʻzgarishlar saqlandi", + "logged_in_as": "%s sifatida tizimga kirildi", + "mailbox_added": "Pochta qutisi %s qoʻshildi", + "mailbox_modified": "Pochta qutisi %s ga oʻzgarishlar saqlandi", + "mailbox_removed": "Pochta qutisi %s olib tashlandi", + "mailbox_renamed": "Pochta qutisi %s dan %s ga qayta nomlandi", + "nginx_reloaded": "Nginx qayta yuklandi", + "object_modified": "Obyekt %s ga oʻzgarishlar saqlandi", + "password_policy_saved": "Parol siyosati muvaffaqiyatli saqlandi", + "password_changed_success": "Parol muvaffaqiyatli oʻzgartirildi", + "pushover_settings_edited": "Pushover sozlamalari muvaffaqiyatli oʻrnatildi, iltimos maʼlumotlarni tekshiring.", + "qlearn_spam": "Xabar ID %s spam sifatida oʻrgatildi va oʻchirildi", + "queue_command_success": "Navbat buyrugʻi muvaffaqiyatli yakunlandi", + "recipient_map_entry_deleted": "Qabul qiluvchi xaritasi ID %s oʻchirildi", + "recipient_map_entry_saved": "Qabul qiluvchi xaritasi yozuvi \"%s\" saqlandi", + "recovery_email_sent": "Tiklash e-pochtasi %s ga yuborildi", + "relayhost_added": "Xarita yozuvi %s qoʻshildi", + "relayhost_removed": "Xarita yozuvi %s olib tashlandi", + "reset_main_logo": "Standart logotipga qaytarildi", + "resource_added": "Resurs %s qoʻshildi", + "resource_modified": "Pochta qutisi %s ga oʻzgarishlar saqlandi", + "resource_removed": "Resurs %s olib tashlandi", + "rl_saved": "%s obyekti uchun tezlik chegarasi saqlandi", + "rspamd_ui_pw_set": "Rspamd UI paroli muvaffaqiyatli oʻrnatildi", + "saved_settings": "Sozlamalar saqlandi", + "settings_map_added": "Sozlamalar xaritasi yozuvi qoʻshildi", + "settings_map_removed": "Sozlamalar xaritasi ID %s olib tashlandi", + "sogo_profile_reset": "%s foydalanuvchisi uchun SOGo profili tiklandi", + "template_added": "Shablon %s qoʻshildi", + "template_modified": "Shablon %s ga oʻzgarishlar saqlandi", + "template_removed": "Shablon ID %s oʻchirildi", + "tls_policy_map_entry_deleted": "TLS siyosati xaritasi ID %s oʻchirildi", + "tls_policy_map_entry_saved": "TLS siyosati xaritasi yozuvi \"%s\" saqlandi", + "ui_texts": "UI matnlariga oʻzgarishlar saqlandi", + "upload_success": "Fayl muvaffaqiyatli yuklandi", + "verified_fido2_login": "FIDO2 kirishi tasdiqlandi", + "verified_totp_login": "TOTP kirishi tasdiqlandi", + "verified_webauthn_login": "WebAuthn kirishi tasdiqlandi", + "verified_yotp_login": "Yubico OTP kirishi tasdiqlandi" + }, + "tfa": { + "authenticators": "Autentifikatorlar", + "api_register": "%s Yubico Cloud API dan foydalanadi. Iltimos, kalitingiz uchun API kalitini bu yerdan oling", + "confirm": "Tasdiqlash", + "confirm_totp_token": "Iltimos, yaratilgan tokenni kiritib oʻzgarishlaringizni tasdiqlang", + "delete_tfa": "TFA ni oʻchirish", + "disable_tfa": "Keyingi muvaffaqiyatli kirishgacha TFA ni oʻchirish", + "force_tfa": "Kirishda 2FA roʻyxatdan oʻtkazishni majburlash", + "force_tfa_info": "Foydalanuvchidan panelga kirishdan oldin ikki faktorli autentifikatsiyani sozlash talab qilinadi.", + "setup_title": "Ikki faktorli autentifikatsiya talab qilinadi", + "setup_required": "Hisobingiz ikki faktorli autentifikatsiyani talab qiladi. Davom etish uchun 2FA usulini sozlang.", + "cancel_setup": "Bekor qilish va chiqish", + "enter_qr_code": "Agar qurilmangiz QR kodlarni skanerlay olmasa, TOTP kodingiz", + "error_code": "Xato kodi", + "init_webauthn": "Ishga tushirilmoqda, iltimos kuting...", + "key_id": "Qurilmangiz uchun identifikator", + "key_id_totp": "Kalitingiz uchun identifikator", + "none": "Oʻchirish", + "reload_retry": "- (xato davom etsa, brauzerni qayta yuklang)", + "scan_qr_code": "Iltimos, quyidagi kodni autentifikator ilovangiz bilan skanerlang yoki kodni qoʻlda kiriting.", + "select": "Iltimos, tanlang", + "set_tfa": "Ikki faktorli autentifikatsiya usulini oʻrnatish", + "start_webauthn_validation": "Tekshiruvni boshlash", + "tfa": "Ikki faktorli autentifikatsiya", + "tfa_token_invalid": "TFA tokeni noto'g'ri", + "totp": "Vaqt asosidagi OTP (Google Authenticator, Authy va h.k.)", + "u2f_deprecated": "Sizning kalitingiz eskirgan U2F usulidan foydalanib roʻyxatdan oʻtkazilganga oʻxshaydi. Biz siz uchun ikki faktorli autentifikatsiyani oʻchirib qoʻyamiz va kalitingizni oʻchiramiz.", + "u2f_deprecated_important": "Iltimos, kalitingizni admin panelida yangi WebAuthn usuli bilan roʻyxatdan oʻtkazing.", + "webauthn": "WebAuthn autentifikatsiya", + "waiting_usb_auth": "USB qurilmasi kutilmoqda...

Iltimos, hozir USB qurilmangizdagi tugmani bosing.", + "waiting_usb_register": "USB qurilmasi kutilmoqda...

Iltimos, yuqorida parolingizni kiriting va USB qurilmangizdagi tugmani bosib roʻyxatga olinishingizni tasdiqlang.", + "yubi_otp": "Yubico OTP autentifikatsiya" + }, + "user": { + "action": "Amal", + "active": "Faol", + "active_sieve": "Faol filtr", + "advanced_settings": "Kengaytirilgan sozlamalar", + "alias": "Taxallus", + "alias_create_random": "Tasodifiy taxallus yaratish", + "alias_extend_all": "Taxalluslarni 1 soatga uzaytirish", + "alias_full_date": "d.m.Y, H:i:s T", + "alias_remove_all": "Barcha taxalluslarni olib tashlash", + "alias_select_validity": "Amal qilish muddati", + "alias_time_left": "Qolgan vaqt", + "alias_valid_until": "Amal qiladi (gacha)", + "aliases_also_send_as": "Foydalanuvchi sifatida ham joʻnatishga ruxsat berilgan", + "aliases_send_as_all": "Quyidagi domen(lar) va ularning taxallus domenlari uchun joʻnatuvchi kirishini tekshirmaslik", + "app_hint": "Ilova parollari sizning IMAP, SMTP, CalDAV, CardDAV va EAS kirishi uchun muqobil parollardir. Foydalanuvchi nomi oʻzgarmaydi. SOGo webmail ilova parollari orqali mavjud emas.", + "allowed_protocols": "Ruxsat etilgan protokollar", + "app_name": "Ilova nomi", + "app_passwds": "Ilova parollari", + "apple_connection_profile": "Apple ulanish profili", + "apple_connection_profile_complete": "Bu ulanish profili Apple qurilmasi uchun IMAP va SMTP parametrlari hamda CalDAV (kalendarlar) va CardDAV (kontaktlar) yoʻllarini oʻz ichiga oladi.", + "apple_connection_profile_mailonly": "Bu ulanish profili Apple qurilmasi uchun IMAP va SMTP konfiguratsiya parametrlarini oʻz ichiga oladi.", + "apple_connection_profile_with_app_password": "Yangi ilova paroli yaratiladi va profilga qoʻshiladi, shunda qurilmangizni sozlashda parol kiritish kerak boʻlmaydi. Iltimos, faylni ulashmang, chunki u pochta qutingizga toʻliq kirish huquqini beradi.", + "attribute": "Atribut", + "authentication": "Autentifikatsiya", + "change_password": "Parolni oʻzgartirish", + "change_password_hint_app_passwords": "Hisobingizda %d ta ilova paroli mavjud va ular oʻzgartirilmaydi. Ularni boshqarish uchun Ilova parollari yorligʻiga oʻting.", + "clear_recent_successful_connections": "Koʻrilgan muvaffaqiyatli ulanishlarni tozalash", + "client_configuration": "E-pochta mijozlari va smartfonlar uchun konfiguratsiya qoʻllanmalarini koʻrsatish", + "create_app_passwd": "Ilova paroli yaratish", + "create_syncjob": "Yangi sinxronizatsiya vazifasi yaratish", + "created_on": "Yaratilgan sana", + "daily": "Kunlik", + "day": "kun", + "description": "Tavsif", + "delete_ays": "Iltimos, oʻchirish jarayonini tasdiqlang.", + "direct_aliases": "Toʻgʻridan-toʻgʻri taxallus manzillari", + "direct_aliases_desc": "Toʻgʻridan-toʻgʻri taxallus manzillariga spam filtri va TLS siyosati sozlamalari taʼsir qiladi.", + "direct_protocol_access": "Bu pochta qutisi foydalanuvchisi quyidagi protokollar va ilovalarga toʻgʻridan-toʻgʻri, tashqi kirishga ega. Bu sozlama administratoringiz tomonidan boshqariladi. Maxsus protokollar va ilovalarga kirishga ruxsat berish uchun ilova parollarini yaratish mumkin.
\"Webmail\" tugmasi SOGo ga yagona kirish (SSO) imkonini beradi va doimo mavjud.", + "eas_reset": "ActiveSync qurilma keshini tiklash", + "eas_reset_help": "Koʻp hollarda qurilma keshini tiklash buzilgan ActiveSync profilini tiklashga yordam beradi.
Diqqat: Barcha elementlar qayta yuklab olinadi!", + "eas_reset_now": "Hozir tiklash", + "edit": "Tahrirlash", + "email": "E-pochta", + "email_and_dav": "E-pochta, kalendarlar va kontaktlar", + "empty": "Natijalar yoʻq", + "encryption": "Shifrlash", + "excludes": "Istisnolar", + "expire_in": "Tugaydi", + "expire_never": "Hech qachon tugamasin", + "fido2_webauthn": "FIDO2/WebAuthn", + "forever": "Abadiy", + "force_pw_update": "Guruh dasturi xizmatlariga kirish uchun siz yangi parol oʻrnatishingiz kerak.", + "from": "dan", + "generate": "yaratish", + "hour": "soat", + "hourly": "Soatlik", + "hours": "soat", + "in_use": "Foydalanilmoqda", + "interval": "Oraliq", + "is_catch_all": "Domen(lar) uchun Hammasini-qabul qilish", + "last_mail_login": "Oxirgi pochta kirishi", + "last_pw_change": "Oxirgi parol oʻzgarishi", + "last_run": "Oxirgi ishga tushirilgan", + "last_ui_login": "Oxirgi UI kirishi", + "loading": "Yuklanmoqda...", + "login_history": "Kirish tarixi", + "mailbox": "Pochta qutisi", + "mailbox_details": "Tafsilotlar", + "mailbox_general": "Umumiy", + "mailbox_settings": "Sozlamalar", + "messages": "xabarlar", + "month": "oy", + "months": "oy", + "never": "Hech qachon", + "new_password": "Yangi parol", + "new_password_repeat": "Tasdiqlash paroli (takrorlang)", + "no_active_filter": "Faol filtr mavjud emas", + "no_last_login": "Oxirgi UI kirishi haqida maʼlumot yoʻq", + "no_record": "Yozuv yoʻq", + "open_logs": "Jurnallarni ochish", + "open_webmail_sso": "Webmail", + "overview": "Umumiy koʻrinish", + "password": "Parol", + "password_now": "Joriy parol (oʻzgarishlarni tasdiqlang)", + "pw_update_required": "Hisobingiz parol oʻzgartirishni talab qiladi. Davom etish uchun yangi parolni oʻrnating.", + "password_repeat": "Parol (takrorlang)", + "password_reset_info": "Agar parolni tiklash uchun e-pochta kiritilmagan boʻlsa, bu funksiyadan foydalanib boʻlmaydi.", + "protocols": "Protokollar", + "pushover_evaluate_x_prio": "Yuqori muhimlikdagi xatni eskalatsiya qilish [X-Priority: 1]", + "pushover_info": "Push bildirishnoma sozlamalari %s ga taxalluslar bilan birga (umumiy, umumiy boʻlmagan, teglangan) yetkazib beriladigan barcha toza (spam boʻlmagan) xatlarga qoʻllaniladi.", + "pushover_only_x_prio": "Faqat yuqori muhimlikdagi xatlarni koʻrib chiqish [X-Priority: 1]", + "pushover_sender_array": "Quyidagi joʻnatuvchi e-pochta manzillarini koʻrib chiqish (vergul bilan ajratilgan)", + "pushover_sender_regex": "Joʻnatuvchilarni quyidagi regex orqali mos kelishini tekshirish", + "pushover_text": "Bildirishnoma matni", + "pushover_title": "Bildirishnoma sarlavhasi", + "pushover_sound": "Tovush", + "pushover_vars": "Joʻnatuvchi filtri belgilanmagan boʻlsa, barcha xatlar koʻrib chiqiladi.
Regex filtrlari va aniq joʻnatuvchi tekshiruvlari alohida belgilanishi mumkin va ketma-ket koʻrib chiqiladi. Ular bir-biriga bogʻliq emas.
Matn va sarlavha uchun ishlatiladigan oʻzgaruvchilar (ma'lumotlarni himoya qilish siyosatiga e'tibor bering)", + "pushover_verify": "Maʼlumotlarni tekshirish", + "pw_recovery_email": "Parolni tiklash e-pochtasi", + "q_add_header": "Junk papkasi", + "q_all": "Barcha turkumlar", + "q_reject": "Rad etilgan", + "quarantine_category": "Karantin bildirishnoma turkumi", + "quarantine_category_info": "\"Rad etilgan\" bildirishnoma turkumi rad etilgan xatlarni oʻz ichiga oladi, \"Junk papkasi\" esa Junk papkasiga joylashtirilgan xatlar haqida foydalanuvchini xabardor qiladi.", + "quarantine_notification": "Karantin bildirishnomalari", + "quarantine_notification_info": "Bildirishnoma yuborilgandan keyin elementlar \"xabar berildi\" deb belgilanadi va bu element uchun keyingi bildirishnomalar yuborilmaydi.", + "recent_successful_connections": "Koʻrilgan muvaffaqiyatli ulanishlar", + "remove": "Olib tashlash", + "running": "Ishlamoqda", + "save": "Oʻzgarishlarni saqlash", + "save_changes": "Oʻzgarishlarni saqlash", + "sender_acl_disabled": "Joʻnatuvchi tekshiruvi oʻchirilgan", + "shared_aliases": "Umumiy taxallus manzillari", + "shared_aliases_desc": "Umumiy taxalluslarga foydalanuvchining maxsus sozlamalari (spam filtri yoki shifrlash siyosati kabi) taʼsir qilmaydi. Mos spam filtrlarini faqat administrator domen boʻyicha siyosat sifatida sozlashi mumkin.", + "show_sieve_filters": "Faol foydalanuvchi sieve filtrini koʻrsatish", + "sogo_profile_reset": "SOGo profilini tiklash", + "sogo_profile_reset_help": "Bu foydalanuvchining SOGo profilini yoʻq qiladi va barcha kontakt va kalendar maʼlumotlarini qaytarib boʻlmas tarzda oʻchiradi.", + "sogo_profile_reset_now": "Profilni hozir tiklash", + "spam_aliases": "Spam e-pochta taxalluslari", + "spam_aliases_info": "Spam taxallusi — bu haqiqiy e-pochta manzillarini himoya qilish uchun ishlatilishi mumkin boʻlgan vaqtinchalik e-pochta manzilidir.
Ixtiyoriy ravishda muddat tugash vaqtini belgilash mumkin, shunda taxallus belgilangan davrdan keyin avtomatik oʻchirib qoʻyiladi, suiisteʼmol qilingan yoki tarqalib ketgan manzillarni samarali tarzda chiqarib tashlaydi.", + "spam_score_reset": "Server standartiga qaytarish", + "spamfilter": "Spam filtri", + "spamfilter_behavior": "Baholash", + "spamfilter_bl": "Qora roʻyxat", + "spamfilter_bl_desc": "Qora roʻyxatdagi e-pochta manzillari har doim spam sifatida tasniflanadi va rad etiladi. Rad etilgan xat karantinga nusxalanmaydi. Joker belgilar ishlatilishi mumkin. Filtr faqat toʻgʻridan-toʻgʻri taxalluslarga (bitta maqsad pochta qutisiga ega taxalluslarga) qoʻllaniladi, hammasini-qabul qilish taxalluslari va pochta qutisining oʻzi istisno qilinadi.", + "spamfilter_default_score": "Standart qiymatlar", + "spamfilter_green": "Yashil: bu xabar spam emas", + "spamfilter_hint": "Birinchi qiymat \"past spam bahosi\"ni tavsiflaydi, ikkinchisi \"yuqori spam bahosi\"ni ifodalaydi.", + "spamfilter_red": "Qizil: bu xabar spam va server tomonidan rad etiladi", + "spamfilter_table_action": "Amal", + "spamfilter_table_add": "Element qoʻshish", + "spamfilter_table_domain_policy": "n/a (domen siyosati)", + "spamfilter_table_empty": "Koʻrsatish uchun ma'lumot yoʻq", + "spamfilter_table_remove": "olib tashlash", + "spamfilter_table_rule": "Qoida", + "spamfilter_wl": "Oq roʻyxat", + "spamfilter_wl_desc": "Oq roʻyxatdagi e-pochta manzillari hech qachon spam sifatida tasniflanmaydi. Joker belgilar ishlatilishi mumkin. Filtr faqat toʻgʻridan-toʻgʻri taxalluslarga (bitta maqsad pochta qutisiga ega taxalluslarga) qoʻllaniladi, hammasini-qabul qilish taxalluslari va pochta qutisining oʻzi istisno qilinadi.", + "spamfilter_yellow": "Sariq: bu xabar spam boʻlishi mumkin, spam sifatida belgilanadi va Junk papkangizga koʻchiriladi", + "status": "Holat", + "sync_jobs": "Sinxronizatsiya vazifalari", + "syncjob_check_log": "Jurnalni tekshirish", + "syncjob_last_run_result": "Oxirgi ishga tushirilgan natija", + "syncjob_EX_OK": "Muvaffaqiyatli", + "syncjob_EXIT_CONNECTION_FAILURE": "Ulanish muammosi", + "syncjob_EXIT_TLS_FAILURE": "Shifrlangan ulanish bilan muammo", + "syncjob_EXIT_AUTHENTICATION_FAILURE": "Autentifikatsiya muammosi", + "syncjob_EXIT_OVERQUOTA": "Maqsad pochta qutisi kvotadan oshib ketdi", + "syncjob_EXIT_CONNECTION_FAILURE_HOST1": "Masofaviy serverga ulanib boʻlmadi", + "syncjob_EXIT_AUTHENTICATION_FAILURE_USER1": "Notoʻgʻri foydalanuvchi nomi yoki parol", + "tag_handling": "Teglangan xat uchun ishlovni oʻrnatish", + "tag_help_example": "Teglangan e-pochta manzili misoli: me+Facebook@example.org", + "tag_help_explain": "Subpapkada: tegga qarab nomlangan yangi subpapka INBOX ostida yaratiladi (\"INBOX/Facebook\").
\r\nMavzuda: teg nomi xatning mavzusiga oldindan qoʻshiladi, misol: \"[Facebook] Mening yangiliklarim\".", + "tag_in_none": "Hech narsa qilmaslik", + "tag_in_subfolder": "Subpapkada", + "tag_in_subject": "Mavzuda", + "text": "Matn", + "tfa_info": "Ikki faktorli autentifikatsiya hisobingizni himoya qilishga yordam beradi. Uni yoqsangiz, ikki faktorli autentifikatsiyani qoʻllab-quvvatlamaydigan ilovalar yoki xizmatlarga (masalan, pochta mijozlari) kirish uchun ilova parollari kerak boʻladi.", + "title": "Sarlavha", + "tls_enforce_in": "Kiruvchi TLS ni majburlash", + "tls_enforce_out": "Chiquvchi TLS ni majburlash", + "tls_policy": "Shifrlash siyosati", + "tls_policy_warning": "Diqqat: Agar shifrlangan pochta transferini majburlashga qaror qilsangiz, e-pochtalarni yoʻqotishingiz mumkin.
Siyosatga mos kelmaydigan xabarlar pochta tizimi tomonidan qatʼiy muvaffaqiyatsizlik bilan qaytariladi.
Bu variant sizning asosiy e-pochta manzilingiz (kirish nomingiz), taxallus domenlaridan olingan barcha manzillar va faqat ushbu pochta qutisi maqsad sifatida boʻlgan taxallus manzillariga qoʻllaniladi.", + "user_settings": "Foydalanuvchi sozlamalari", + "username": "Foydalanuvchi nomi", + "value": "Qiymat", + "verify": "Tasdiqlash", + "waiting": "Kutilmoqda", + "week": "hafta", + "weekly": "Haftalik", + "weeks": "hafta", + "with_app_password": "ilova paroli bilan", + "year": "yil", + "years": "yil" + }, + "warning": { + "cannot_delete_self": "Tizimga kirgan foydalanuvchini oʻchirib boʻlmaydi", + "domain_added_sogo_failed": "Domen qoʻshildi, ammo SOGoni qayta ishga tushirib boʻlmadi, iltimos server jurnallaringizni tekshiring.", + "dovecot_restart_failed": "Dovecot qayta ishga tushirib boʻlmadi, iltimos jurnallarni tekshiring", + "fuzzy_learn_error": "Fuzzy hash oʻrgatish xatosi: %s", + "hash_not_found": "Hash topilmadi yoki allaqachon oʻchirilgan", + "ip_invalid": "Notoʻgʻri IP oʻtkazib yuborildi: %s", + "is_not_primary_alias": "Asosiy boʻlmagan taxallus oʻtkazib yuborildi: %s", + "no_active_admin": "Oxirgi faol administratorni oʻchirib boʻlmaydi", + "quota_exceeded_scope": "Domen kvotasi oshib ketdi: Bu domen doirasida faqat cheksiz pochta qutilari yaratilishi mumkin.", + "session_token": "Forma tokeni noto'g'ri: Token mos kelmadi", + "session_ua": "Forma tokeni noto'g'ri: User-Agent tekshiruvi xatosi" + } +} From 104af5862889dcadfd51c354d55dfbdeea47ace6 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Thu, 14 May 2026 18:33:03 +0000 Subject: [PATCH 020/123] Update dependency php/pecl-mail-mailparse to v3.2.0 Signed-off-by: milkmaker --- data/Dockerfiles/phpfpm/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/Dockerfiles/phpfpm/Dockerfile b/data/Dockerfiles/phpfpm/Dockerfile index 7917d7f7..a23a0425 100644 --- a/data/Dockerfiles/phpfpm/Dockerfile +++ b/data/Dockerfiles/phpfpm/Dockerfile @@ -7,7 +7,7 @@ ARG APCU_PECL_VERSION=5.1.28 # renovate: datasource=github-tags depName=Imagick/imagick versioning=semver-coerced extractVersion=(?.*)$ ARG IMAGICK_PECL_VERSION=3.8.1 # renovate: datasource=github-tags depName=php/pecl-mail-mailparse versioning=semver-coerced extractVersion=^v(?.*)$ -ARG MAILPARSE_PECL_VERSION=3.1.9 +ARG MAILPARSE_PECL_VERSION=3.2.0 # renovate: datasource=github-tags depName=php-memcached-dev/php-memcached versioning=semver-coerced extractVersion=^v(?.*)$ ARG MEMCACHED_PECL_VERSION=3.4.0 # renovate: datasource=github-tags depName=phpredis/phpredis versioning=semver-coerced extractVersion=(?.*)$ From 07373907e3722fe15d31e68d93a281f92d344400 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Mon, 18 May 2026 08:38:18 +0200 Subject: [PATCH 021/123] Update devops-infra/action-pull-request action to v1.1.1 (#7234) --- .github/workflows/pr_to_nightly.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/pr_to_nightly.yml b/.github/workflows/pr_to_nightly.yml index 548fabde..d0f8ccf7 100644 --- a/.github/workflows/pr_to_nightly.yml +++ b/.github/workflows/pr_to_nightly.yml @@ -12,7 +12,7 @@ jobs: with: fetch-depth: 0 - name: Run the Action - uses: devops-infra/action-pull-request@v1.0.2 + uses: devops-infra/action-pull-request@v1.1.1 with: github_token: ${{ secrets.PRTONIGHTLY_ACTION_PAT }} title: Automatic PR to nightly from ${{ github.event.repository.updated_at}} From f553f38635bc87ef6a2f00e3a39a04b82599aa30 Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Wed, 20 May 2026 17:24:41 +0200 Subject: [PATCH 022/123] [Nginx] Update to 1.30.1 --- data/Dockerfiles/nginx/Dockerfile | 2 +- docker-compose.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/data/Dockerfiles/nginx/Dockerfile b/data/Dockerfiles/nginx/Dockerfile index 7d2ce34f..b8746684 100644 --- a/data/Dockerfiles/nginx/Dockerfile +++ b/data/Dockerfiles/nginx/Dockerfile @@ -1,4 +1,4 @@ -FROM nginx:alpine +FROM nginx:1.30.1-alpine LABEL maintainer "The Infrastructure Company GmbH " ENV PIP_BREAK_SYSTEM_PACKAGES=1 diff --git a/docker-compose.yml b/docker-compose.yml index 90e5518d..eab23c8a 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -419,7 +419,7 @@ services: - php-fpm-mailcow - sogo-mailcow - rspamd-mailcow - image: ghcr.io/mailcow/nginx:1.06 + image: ghcr.io/mailcow/nginx:1.30.1-1 dns: - ${IPV4_NETWORK:-172.22.1}.254 environment: From cbd3d8b9bcb9772642bdc65111a4e615a8d8ee27 Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Wed, 20 May 2026 17:53:47 +0200 Subject: [PATCH 023/123] escape HTML in quarantine table --- data/web/js/site/quarantine.js | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/data/web/js/site/quarantine.js b/data/web/js/site/quarantine.js index 8334ff50..a9b7845b 100644 --- a/data/web/js/site/quarantine.js +++ b/data/web/js/site/quarantine.js @@ -102,18 +102,21 @@ jQuery(function($){ { title: 'ID', data: 'id', - defaultContent: '' + defaultContent: '', + render: $.fn.dataTable.render.text() }, { title: lang.qid, data: 'qid', - defaultContent: '' + defaultContent: '', + render: $.fn.dataTable.render.text() }, { title: lang.sender, data: 'sender', className: 'senders-mw220', - defaultContent: '' + defaultContent: '', + render: $.fn.dataTable.render.text() }, { title: lang.subj, @@ -128,7 +131,8 @@ jQuery(function($){ { title: lang.rcpt, data: 'rcpt', - defaultContent: '' + defaultContent: '', + render: $.fn.dataTable.render.text() }, { title: lang.danger, From da586682f64631bd683c4d07e24665bd85168554 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Thu, 21 May 2026 10:04:58 +0200 Subject: [PATCH 024/123] Update actions/stale action to v10.3.0 (#7242) Signed-off-by: milkmaker Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- .github/workflows/close_old_issues_and_prs.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/close_old_issues_and_prs.yml b/.github/workflows/close_old_issues_and_prs.yml index e55b2706..855684df 100644 --- a/.github/workflows/close_old_issues_and_prs.yml +++ b/.github/workflows/close_old_issues_and_prs.yml @@ -14,7 +14,7 @@ jobs: pull-requests: write steps: - name: Mark/Close Stale Issues and Pull Requests 🗑️ - uses: actions/stale@v10.2.0 + uses: actions/stale@v10.3.0 with: repo-token: ${{ secrets.STALE_ACTION_PAT }} days-before-stale: 60 From 4f2348631a8cc3791e6168acfb09e2e2d61ac0a2 Mon Sep 17 00:00:00 2001 From: milkmaker Date: Thu, 21 May 2026 17:16:34 +0200 Subject: [PATCH 025/123] [Web] Updated lang.pl-pl.json (#7245) Co-authored-by: Adrian-Kozien --- data/web/lang/lang.pl-pl.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/web/lang/lang.pl-pl.json b/data/web/lang/lang.pl-pl.json index b1ec3591..de3557c0 100644 --- a/data/web/lang/lang.pl-pl.json +++ b/data/web/lang/lang.pl-pl.json @@ -189,7 +189,7 @@ "api_info": "API jest w trakcie prac. Dokumentację można znaleźć pod adresem /api", "api_key": "klucz API", "api_read_only": "Dostęp tylko do odczytu", - "api_read_write": "Dostęp tylko do odczytu", + "api_read_write": "Dostęp do odczytu i zapisu", "api_skip_ip_check": "Pomiń sprawdzenie IP dla API", "app_hide": "Ukryj dla logowania", "app_links": "Linki aplikacji", From aed440bcb3b33308b48f81ded97443f5b1d6ea1f Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Thu, 21 May 2026 21:09:43 +0200 Subject: [PATCH 026/123] Update devops-infra/action-pull-request action to v1.1.2 (#7247) Signed-off-by: milkmaker Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- .github/workflows/pr_to_nightly.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/pr_to_nightly.yml b/.github/workflows/pr_to_nightly.yml index d0f8ccf7..f9ccc0fd 100644 --- a/.github/workflows/pr_to_nightly.yml +++ b/.github/workflows/pr_to_nightly.yml @@ -12,7 +12,7 @@ jobs: with: fetch-depth: 0 - name: Run the Action - uses: devops-infra/action-pull-request@v1.1.1 + uses: devops-infra/action-pull-request@v1.1.2 with: github_token: ${{ secrets.PRTONIGHTLY_ACTION_PAT }} title: Automatic PR to nightly from ${{ github.event.repository.updated_at}} From 7d17715e2e8081cac5167f144142d05155974377 Mon Sep 17 00:00:00 2001 From: SYNLINQ <69972447+SYNLINQ@users.noreply.github.com> Date: Fri, 22 May 2026 16:26:47 +0200 Subject: [PATCH 027/123] Update Dockerfile install unbound package from alpine:edge --- data/Dockerfiles/unbound/Dockerfile | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/data/Dockerfiles/unbound/Dockerfile b/data/Dockerfiles/unbound/Dockerfile index 7c492138..b1ec99e4 100644 --- a/data/Dockerfiles/unbound/Dockerfile +++ b/data/Dockerfiles/unbound/Dockerfile @@ -2,11 +2,14 @@ FROM alpine:3.23 LABEL maintainer = "The Infrastructure Company GmbH " +# install unbound from alpine:edge to get security patches +RUN apk add --no-cache --repository=https://dl-cdn.alpinelinux.org/alpine/edge/main unbound + +# install other packages from regular alpine stable repo RUN apk add --update --no-cache \ curl \ bind-tools \ coreutils \ - unbound \ bash \ openssl \ drill \ From efc2e761597b25d46ce1c51ad5b6b9c03afdb80d Mon Sep 17 00:00:00 2001 From: SYNLINQ <69972447+SYNLINQ@users.noreply.github.com> Date: Fri, 22 May 2026 16:27:43 +0200 Subject: [PATCH 028/123] Update docker-compose.yml bump unbound version --- docker-compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docker-compose.yml b/docker-compose.yml index eab23c8a..52fa15ec 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -1,7 +1,7 @@ services: unbound-mailcow: - image: ghcr.io/mailcow/unbound:1.25 + image: ghcr.io/mailcow/unbound:1.25.1 environment: - TZ=${TZ} - SKIP_UNBOUND_HEALTHCHECK=${SKIP_UNBOUND_HEALTHCHECK:-n} From ce3ceaf5b8fd57197f43c4e27400a36130b3b399 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 23 May 2026 08:36:46 +0200 Subject: [PATCH 029/123] Update devops-infra/action-pull-request action to v1.1.3 (#7253) Signed-off-by: milkmaker Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- .github/workflows/pr_to_nightly.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/pr_to_nightly.yml b/.github/workflows/pr_to_nightly.yml index f9ccc0fd..9ed6be38 100644 --- a/.github/workflows/pr_to_nightly.yml +++ b/.github/workflows/pr_to_nightly.yml @@ -12,7 +12,7 @@ jobs: with: fetch-depth: 0 - name: Run the Action - uses: devops-infra/action-pull-request@v1.1.2 + uses: devops-infra/action-pull-request@v1.1.3 with: github_token: ${{ secrets.PRTONIGHTLY_ACTION_PAT }} title: Automatic PR to nightly from ${{ github.event.repository.updated_at}} From e6fa0c5099aa0c39f91c04807695b09afb4aa6a0 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 23 May 2026 22:10:51 +0200 Subject: [PATCH 030/123] Update devops-infra/action-pull-request action to v1.2.0 (#7254) Signed-off-by: milkmaker Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- .github/workflows/pr_to_nightly.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/pr_to_nightly.yml b/.github/workflows/pr_to_nightly.yml index 9ed6be38..a3ea5d80 100644 --- a/.github/workflows/pr_to_nightly.yml +++ b/.github/workflows/pr_to_nightly.yml @@ -12,7 +12,7 @@ jobs: with: fetch-depth: 0 - name: Run the Action - uses: devops-infra/action-pull-request@v1.1.3 + uses: devops-infra/action-pull-request@v1.2.0 with: github_token: ${{ secrets.PRTONIGHTLY_ACTION_PAT }} title: Automatic PR to nightly from ${{ github.event.repository.updated_at}} From ffbc37a00c0245a5ad6aa87d8aa34f677da698c5 Mon Sep 17 00:00:00 2001 From: Michael Kuron <1748330+mkuron@users.noreply.github.com> Date: Sat, 2 May 2026 16:24:01 +0200 Subject: [PATCH 031/123] Escape generated password in mobileconfig Escape ampersand, less than, greater than to avoid generating invalid XML. Fixes #7171 --- data/web/mobileconfig.php | 1 + 1 file changed, 1 insertion(+) diff --git a/data/web/mobileconfig.php b/data/web/mobileconfig.php index 7c0ead7f..c57c4885 100644 --- a/data/web/mobileconfig.php +++ b/data/web/mobileconfig.php @@ -65,6 +65,7 @@ if (isset($_GET['app_password'])) { $attr['protocols'][] = 'dav_access'; } app_passwd("add", $attr); + $password = htmlspecialchars($password, ENT_NOQUOTES); } else { $app_password = false; } From db4e3b4d5405c5a594d5aed8f37cfe0151e50a28 Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Tue, 26 May 2026 10:36:39 +0200 Subject: [PATCH 032/123] [Nginx] Update to 1.30.2 --- data/Dockerfiles/nginx/Dockerfile | 2 +- docker-compose.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/data/Dockerfiles/nginx/Dockerfile b/data/Dockerfiles/nginx/Dockerfile index b8746684..30297362 100644 --- a/data/Dockerfiles/nginx/Dockerfile +++ b/data/Dockerfiles/nginx/Dockerfile @@ -1,4 +1,4 @@ -FROM nginx:1.30.1-alpine +FROM nginx:1.30.2-alpine LABEL maintainer "The Infrastructure Company GmbH " ENV PIP_BREAK_SYSTEM_PACKAGES=1 diff --git a/docker-compose.yml b/docker-compose.yml index eab23c8a..af15a246 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -419,7 +419,7 @@ services: - php-fpm-mailcow - sogo-mailcow - rspamd-mailcow - image: ghcr.io/mailcow/nginx:1.30.1-1 + image: ghcr.io/mailcow/nginx:1.30.2-1 dns: - ${IPV4_NETWORK:-172.22.1}.254 environment: From faac56a6110f315288cb3f420412f380efc9c8a0 Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Tue, 26 May 2026 10:43:25 +0200 Subject: [PATCH 033/123] [Unbound] Change version tag --- docker-compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docker-compose.yml b/docker-compose.yml index ebf203ae..615e19f5 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -1,7 +1,7 @@ services: unbound-mailcow: - image: ghcr.io/mailcow/unbound:1.25.1 + image: ghcr.io/mailcow/unbound:1.25.1-1 environment: - TZ=${TZ} - SKIP_UNBOUND_HEALTHCHECK=${SKIP_UNBOUND_HEALTHCHECK:-n} From a7f2b2145f49ac09531a87a18489fd66ebaef06b Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Tue, 26 May 2026 22:00:43 +0200 Subject: [PATCH 034/123] Update devops-infra/action-pull-request action to v1.2.1 (#7258) Signed-off-by: milkmaker Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- .github/workflows/pr_to_nightly.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/pr_to_nightly.yml b/.github/workflows/pr_to_nightly.yml index a3ea5d80..0b0738e9 100644 --- a/.github/workflows/pr_to_nightly.yml +++ b/.github/workflows/pr_to_nightly.yml @@ -12,7 +12,7 @@ jobs: with: fetch-depth: 0 - name: Run the Action - uses: devops-infra/action-pull-request@v1.2.0 + uses: devops-infra/action-pull-request@v1.2.1 with: github_token: ${{ secrets.PRTONIGHTLY_ACTION_PAT }} title: Automatic PR to nightly from ${{ github.event.repository.updated_at}} From eac1bf02fc9042eb3d3b5d7b198443927ceb9a57 Mon Sep 17 00:00:00 2001 From: milkmaker Date: Tue, 26 May 2026 22:02:05 +0200 Subject: [PATCH 035/123] [Web] Updated lang.lv-lv.json (#7262) Co-authored-by: Edgars Andersons --- data/web/lang/lang.lv-lv.json | 58 ++++++++++++++++++++++++----------- 1 file changed, 40 insertions(+), 18 deletions(-) diff --git a/data/web/lang/lang.lv-lv.json b/data/web/lang/lang.lv-lv.json index fd29e594..df169728 100644 --- a/data/web/lang/lang.lv-lv.json +++ b/data/web/lang/lang.lv-lv.json @@ -13,7 +13,7 @@ "domain_relayhost": "Mainīt domēna relayhost", "eas_reset": "EAS ierīču atiestatīšana", "extend_sender_acl": "Ļauj paplašināt sūtītāja ACL ar ārējām adresēm", - "login_as": "Pieteikšanās kā pastkastes lietotājam", + "login_as": "Pieteikties kā pastkastes lietotājam", "mailbox_relayhost": "Pasta kastītes relayhost maiņa", "prohibited": "Aizliegts ar ACL", "protocol_access": "Protokola piekļuves maiņa", @@ -91,12 +91,12 @@ "activate_api": "Aktivizēt API", "active": "Aktīvs", "add": "Pievienot", - "add_domain_admin": "Pievienot domēna administratoru", + "add_domain_admin": "Pievienot domēna pārvaldītāju", "add_forwarding_host": "Pievienot pāradresācijas hostu", "add_relayhost": "Pievienot Relayhost", "add_row": "Pievienot rindu", - "admin": "Administrators", - "admin_details": "Labot administratora detaļas", + "admin": "Pārvaldītājs", + "admin_details": "Labot informāciju par pārvaldītāju", "admin_domains": "Domēna uzdevumi", "api_allow_from": "Atļaut API piekļuvi no šīm IP", "api_key": "API atslēga", @@ -114,7 +114,7 @@ "dkim_keys": "ARC/DKIM atslēgas", "dkim_private_key": "Privāta atslēga", "domain": "Domēns", - "domain_admins": "Domēna administratori", + "domain_admins": "Domēna pārvaldītāji", "edit": "Labot", "empty": "Nav iznākuma", "f2b_ban_time": "Aizlieguma laiks (s)", @@ -188,7 +188,14 @@ "quarantine_max_score": "Atmest paziņojumu, ja e-pasta ziņojuma mēstuļu novērtējums ir augstāks par šo vērtību:
Noklusējums ir 9999.0", "options": "Iespējas", "password_reset_settings": "Paroļu atkopes iestatījumi", - "password_settings": "Paroļu iestatījumi" + "password_settings": "Paroļu iestatījumi", + "add_admin": "Pievienot pārvaldītāju", + "admins": "Pārvaldītāji", + "admins_ldap": "LDAP pārvaldītāji", + "admin_quicklink": "Paslēpt ātro saiti uz pārvaldītāju pieteikšanās lapu", + "domain_admin": "Domēna pārvaldītājs", + "domainadmin_quicklink": "Paslēpt ātro saiti uz domēna pārvaldītāju pieteikšanās lapu", + "user_quicklink": "Paslēpt ātro saiti uz lietotāju pieteikšanās lapu" }, "danger": { "access_denied": "Piekļuve liegta, vai nepareizi dati", @@ -244,7 +251,10 @@ "app_passwd_id_invalid": "Lietotnes paroles Id %s ir nederīgs", "img_dimensions_exceeded": "Attēls pārsniedz lielāko pieļaujamo attēla lielumu", "img_size_exceeded": "Attēls pārsniedz lielāko pieļaujamo datnes lielumu", - "version_invalid": "Versija %s ir nederīga" + "version_invalid": "Versija %s ir nederīga", + "generic_server_error": "Atgadījās neparedzēta servera kļūda. Lūgums sazināties ar pārvaldītāju.", + "password_reset_na": "Paroļu atkope šobrīd nav pieejama. Lūgums sazināties ar pārvaldītāju.", + "recovery_email_failed": "Nevarēja nosūtīt atkopes e-pasta ziņojumu. Lūgums sazināties ar pārvaldītāju." }, "diagnostics": { "cname_from_a": "Vērtība, kas iegūta no A/AAAA ieraksta. Tas tiek atbalstīts tik ilgi, kamēr ieraksts norāda uz pareizo resursu.", @@ -266,7 +276,7 @@ "delete2duplicates": "Izdzēst atkārtojošos vienumus galamērķī", "description": "Apraksts", "domain": "Labot domēnu", - "domain_admin": "Labot domēna administratoru", + "domain_admin": "Labot domēna pārvaldītāju", "domain_quota": "Domēna kvota", "domains": "Domēni", "dont_check_sender_acl": "Atspējot sūtītāju pārbaudi domēnam %s (+ aizstājdomēni)", @@ -329,7 +339,8 @@ "app_passwd": "Lietotnes parole", "mta_sts_version": "Versija", "mta_sts_version_info": "Norāda MTA-STS standarta versiju – pašreiz ir derīga tikai STSv1.", - "sender_acl_disabled": "Sūtītāja pārbaude ir atspējota" + "sender_acl_disabled": "Sūtītāja pārbaude ir atspējota", + "admin": "Labot pārvaldītāju" }, "footer": { "cancel": "Atcelt", @@ -362,7 +373,14 @@ "username": "Lietotājvārds", "fido2_webauthn": "FIDO/WebAuthn pieteikšanās", "mobileconfig_info": "Lūgums pieteikties kā pastkastes lietotājam, lai lejupielādētu pieprasīto Apple savienojuma profilu.", - "other_logins": "vai pieslēgties ar" + "other_logins": "vai pieteikties ar", + "forgot_password": "> Aizmirsta parole?", + "login_linkstext": "Nepareiza pieteikšanās?", + "login_domainadmintext": "Pieteikties kā domēna pārvaldītājam", + "login_admintext": "Pieteikties kā pārvaldītājam", + "login_user": "Lietotu pieteikšanās", + "login_dadmin": "Domēna pārvaldītāju pieteikšanās", + "login_admin": "Pārvaldītāju pieteikšanās" }, "mailbox": { "action": "Rīcība", @@ -397,7 +415,7 @@ "description": "Apraksts", "dkim_key_length": "DKIM atslēgas garums (bits)", "domain": "Domēns", - "domain_admins": "Domēna administratori", + "domain_admins": "Domēna pārvaldītāji", "domain_aliases": "Domēna aizstājvārdi", "domain_quota": "Kvota", "domain_quota_total": "Kopējais domēna ierobežojums", @@ -507,7 +525,7 @@ "imap_smtp_server_auth_info": "Lūgums izmantot pilnu e-pasta adresi un PLAIN autentificēšanās mehānismu.
\nPieteikšanās dati tiks šifrēti ar servera puses obligātu šifrēšanu." }, "success": { - "admin_modified": "Izmaiņas administrātoram ir saglabātas", + "admin_modified": "Pārvaldītāja izmaiņas tika saglabātas", "alias_added": "Aizstājadrese %s (%d) tika pievienota", "alias_domain_removed": "Aizstājdomēns %s tika noņemts", "alias_modified": "Aizstājadreses izmaiņas %s tika saglabātas", @@ -518,9 +536,9 @@ "dkim_added": "DKIM atslēga saglabāta", "dkim_removed": "DKIM atslēga %s ir noņemta", "domain_added": "Pievienots domēns %s", - "domain_admin_added": "Domēna administrātors %s pievienots", - "domain_admin_modified": "Izmaiņas domēna administrātoram %s ir saglabātas", - "domain_admin_removed": "Domēna administrators %s tika noņemts", + "domain_admin_added": "Tika pievienots domēna pārvaldītājs %s", + "domain_admin_modified": "Domēna pārvaldītāja %s izmaiņas tika saglabātas", + "domain_admin_removed": "Tika noņemts domēna pārvaldītājs %s", "domain_modified": "Izmaiņas domēnam %s ir saglabātas", "domain_removed": "Domēns %s ir noņemts", "eas_reset": "ActiveSync ierīces priekš lietotāja %s tika atiestatītas", @@ -548,7 +566,9 @@ "verified_yotp_login": "Apliecināta Yubico OTP pieteikšanās", "app_passwd_removed": "Noņemta lietotnes parole ar Id %s", "app_passwd_added": "Pievienota jauna lietotnes parole", - "f2b_banlist_refreshed": "Liegumu saraksta Id tika sekmīgi atsvaidzināts." + "f2b_banlist_refreshed": "Liegumu saraksta Id tika sekmīgi atsvaidzināts.", + "admin_added": "Tika pievienots pārvaldītājs %s", + "admin_removed": "Tika noņemts pārvaldītājs %s" }, "tfa": { "api_register": "%s izmanto Yubico Cloud API. Lūdzu iegūstiet API atslēgu priekš Jūsu atslēgashere", @@ -569,7 +589,8 @@ "waiting_usb_auth": "Gaida USB ierīci...

Lūdzu, tagad nospiežiet pogu uz Jūsu WebAuthn USB ierīces.", "waiting_usb_register": "Gaida USB ierīci...

Lūgums augstāk ievadīt savu paroli un apstiprināt reģistrēšanos ar USB ierīces pogas nospiešanu.", "yubi_otp": "Yubico OTP autentifikators", - "authenticators": "Autentificētāji" + "authenticators": "Autentificētāji", + "u2f_deprecated_important": "Lūgums reģistrēt savu atslēgu pārvaldības lapā ar jauno WebAuthn veidu." }, "user": { "action": "Rīcība", @@ -701,7 +722,8 @@ "warning": { "domain_added_sogo_failed": "Domēns pievienots, bet neizdevās pārsāknēt SOGO. Lūgums pārbaudīt servera žurnālus.", "dovecot_restart_failed": "Dovecot neizdevās pārsāknēties. Lūgums pārbaudīt žurnālus", - "is_not_primary_alias": "Izlaists aizstājvārds %s, kas nav galvenais" + "is_not_primary_alias": "Izlaists aizstājvārds %s, kas nav galvenais", + "no_active_admin": "Nevar deaktivēt pēdējo aktīvo pārvaldītāju" }, "oauth2": { "access_denied": "Lūgums pieteikties kā pastkastes īpašniekam, lai nodrošinātu piekļuvi ar OAuth2." From 3fcda21c4ec798d47e8e753c253401b7d1f712ec Mon Sep 17 00:00:00 2001 From: milkmaker Date: Wed, 27 May 2026 17:46:42 +0200 Subject: [PATCH 036/123] [Web] Updated lang.vi-vn.json (#7263) Co-authored-by: Phu D. Nguyen --- data/web/lang/lang.vi-vn.json | 27 ++++++++++++++++++++++----- 1 file changed, 22 insertions(+), 5 deletions(-) diff --git a/data/web/lang/lang.vi-vn.json b/data/web/lang/lang.vi-vn.json index 523b5dca..42813fd2 100644 --- a/data/web/lang/lang.vi-vn.json +++ b/data/web/lang/lang.vi-vn.json @@ -268,10 +268,10 @@ "includes": "Bao gồm những người nhận này", "ip_check": "Kiểm tra IP", "ip_check_disabled": "Kiểm tra IP đã bị vô hiệu hóa. Bạn có thể bật nó trong
Hệ thống > Cấu hình > Tùy chọn > Tùy chỉnh", - "ip_check_opt_in": "Chọn tham gia sử dụng dịch vụ bên thứ ba ipv4.mailcow.email và ipv6.mailcow.email để phân giải địa chỉ IP bên ngoài.", + "ip_check_opt_in": "Đăng ký tham gia sử dụng dịch vụ bên thứ ba dùng ipv4.mailcow.email và ipv6.mailcow.email để phân giải địa chỉ IP bên ngoài.", "is_mx_based": "Dựa trên MX", "last_applied": "Áp dụng lần cuối", - "license_info": "Giấy phép không bắt buộc nhưng giúp phát triển thêm.
Đăng ký GUID của bạn tại đây hoặc mua hỗ trợ cho cài đặt mailcow của bạn.", + "license_info": "Giấy phép tuy không bắt buộc nhưng giúp phát triển thêm.
Đăng ký GUID của bạn tại đây hoặc mua hỗ trợ cho cài đặt mailcow của bạn.", "link": "Liên kết", "loading": "Vui lòng đợi...", "login_time": "Thời gian đăng nhập", @@ -556,7 +556,9 @@ "validity_missing": "Vui lòng gán thời hạn hiệu lực", "value_missing": "Vui lòng cung cấp tất cả các giá trị", "version_invalid": "Phiên bản %s không hợp lệ", - "yotp_verification_failed": "Xác thực Yubico OTP thất bại: %s" + "yotp_verification_failed": "Xác thực Yubico OTP thất bại: %s", + "tfa_removal_blocked": "Xác thực hai yếu tố không thể bị xóa vì đây là yêu cầu bắt buộc đối với tài khoản của bạn.", + "quarantine_category_invalid": "Danh mục cách ly phải là một trong các loại sau : add_header, reject, all." }, "datatables": { "collapse_all": "Thu gọn tất cả", @@ -579,7 +581,9 @@ "aria": { "sortAscending": ": kích hoạt để sắp xếp cột tăng dần", "sortDescending": ": kích hoạt để sắp xếp cột giảm dần" - } + }, + "decimal": ".", + "thousands": "," }, "debug": { "architecture": "Kiến trúc", @@ -693,6 +697,19 @@ "internal_info": "Bí danh nội bộ chỉ có thể truy cập từ tên miền sở hữu hoặc tên miền bí danh.", "kind": "Loại", "last_modified": "Sửa đổi lần cuối", - "lookup_mx": "Đích là một biểu thức chính quy để khớp với tên MX (.*.google.com để định tuyến tất cả thư nhắm đến MX kết thúc bằng google.com qua bước nhảy này)" + "lookup_mx": "Đích là một biểu thức chính quy để khớp với tên MX (.*.google.com để định tuyến tất cả thư nhắm đến MX kết thúc bằng google.com qua bước nhảy này)", + "sender_allowed": "Cho phép gửi đi bằng bí danh", + "sender_allowed_info": "Nếu bị vô hiệu hóa, bí danh này chỉ có thể nhận thư. Sử dụng ACL của người gửi để ghi đè và cấp quyền gửi cho các hộp thư cụ thể.", + "mailbox": "Chỉnh sửa hộp thư", + "mailbox_quota_def": "Hạn mức hộp thư mặc định", + "mailbox_relayhost_info": "Chỉ áp dụng cho hộp thư và các bí danh trực tiếp, thao tác này sẽ ghi đè lên máy chủ chuyển tiếp tên miền.", + "mailbox_rename": "Đổi tên hộp thư", + "mailbox_rename_agree": "Tôi đã tạo bản sao lưu.", + "mailbox_rename_warning": "QUAN TRỌNG! Hãy tạo bản sao lưu trước khi đổi tên hộp thư.", + "mailbox_rename_alias": "Tạo tự động bí danh", + "mailbox_rename_title": "Tên mới của hộp thư cục bộ", + "max_aliases": "Số lượng Bí danh tối đa", + "max_mailboxes": "Số lượng hộp thư tối đa có thể có", + "max_quota": "Dung lượng tối đa cho mỗi hộp thư (MiB)" } } From 175878f8f1808103bc487717f2f23467c1455826 Mon Sep 17 00:00:00 2001 From: goodygh <101992094+goodygh@users.noreply.github.com> Date: Thu, 28 May 2026 22:20:26 +0200 Subject: [PATCH 037/123] ui, fail2ban fix german ban_list_info translation (#7265) --- data/web/lang/lang.de-de.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/web/lang/lang.de-de.json b/data/web/lang/lang.de-de.json index 3672762d..17277a03 100644 --- a/data/web/lang/lang.de-de.json +++ b/data/web/lang/lang.de-de.json @@ -150,7 +150,7 @@ "arrival_time": "Ankunftszeit (Serverzeit)", "authed_user": "Auth. Benutzer", "ays": "Soll der Vorgang wirklich ausgeführt werden?", - "ban_list_info": "Übersicht ausgesperrter Netzwerke: Netzwerk (verbleibende Bannzeit) - [Aktionen].
IPs, die zum Entsperren eingereiht werden, verlassen die Liste aktiver Banns nach wenigen Sekunden.
Rote Labels sind Indikatoren für aktive Allowlist-Einträge.", + "ban_list_info": "Übersicht ausgesperrter Netzwerke: Netzwerk (verbleibende Bannzeit) - [Aktionen].
IPs, die zum Entsperren eingereiht werden, verlassen die Liste aktiver Banns nach wenigen Sekunden.
Rote Labels kennzeichnen aktive permanente Sperren durch Denylisting.", "change_logo": "Logo ändern", "configuration": "Konfiguration", "convert_html_to_text": "Konvertiere HTML zu reinem Text", From 23e4e4f3739549d43a8f7ea3ae1bc03874c775aa Mon Sep 17 00:00:00 2001 From: goodygh <101992094+goodygh@users.noreply.github.com> Date: Fri, 29 May 2026 01:39:38 +0200 Subject: [PATCH 038/123] [SOGo] Update to 5.12.9 --- data/Dockerfiles/sogo/Dockerfile | 6 +++--- docker-compose.yml | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/data/Dockerfiles/sogo/Dockerfile b/data/Dockerfiles/sogo/Dockerfile index 1c728720..b4b401e8 100644 --- a/data/Dockerfiles/sogo/Dockerfile +++ b/data/Dockerfiles/sogo/Dockerfile @@ -1,6 +1,6 @@ # SOGo built from source to enable security patch application # Repository: https://github.com/Alinto/sogo -# Version: SOGo-5.12.8 +# Version: SOGo-5.12.9 # # Applied security patches: # - @@ -12,8 +12,8 @@ FROM debian:bookworm LABEL maintainer="The Infrastructure Company GmbH " ARG DEBIAN_FRONTEND=noninteractive -ARG SOGO_VERSION=SOGo-5.12.8 -ARG SOPE_VERSION=SOPE-5.12.8 +ARG SOGO_VERSION=SOGo-5.12.9 +ARG SOPE_VERSION=SOPE-5.12.9 # Security patches to apply (space-separated commit hashes) ARG SOGO_SECURITY_PATCHES="" # renovate: datasource=github-releases depName=tianon/gosu versioning=semver-coerced extractVersion=^(?.*)$ diff --git a/docker-compose.yml b/docker-compose.yml index 615e19f5..4da149d7 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -200,7 +200,7 @@ services: - phpfpm sogo-mailcow: - image: ghcr.io/mailcow/sogo:5.12.8-1 + image: ghcr.io/mailcow/sogo:5.12.9-1 environment: - DBNAME=${DBNAME} - DBUSER=${DBUSER} From 843db5854c2dd9d85f89cd35cde6361f43d9a999 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Thu, 4 Jun 2026 11:04:42 +0000 Subject: [PATCH 039/123] Update dependency composer/composer to v2.10.1 Signed-off-by: milkmaker --- data/Dockerfiles/phpfpm/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/Dockerfiles/phpfpm/Dockerfile b/data/Dockerfiles/phpfpm/Dockerfile index 7917d7f7..9181374a 100644 --- a/data/Dockerfiles/phpfpm/Dockerfile +++ b/data/Dockerfiles/phpfpm/Dockerfile @@ -13,7 +13,7 @@ ARG MEMCACHED_PECL_VERSION=3.4.0 # renovate: datasource=github-tags depName=phpredis/phpredis versioning=semver-coerced extractVersion=(?.*)$ ARG REDIS_PECL_VERSION=6.3.0 # renovate: datasource=github-tags depName=composer/composer versioning=semver-coerced extractVersion=(?.*)$ -ARG COMPOSER_VERSION=2.9.5 +ARG COMPOSER_VERSION=2.10.1 RUN apk add -U --no-cache autoconf \ aspell-dev \ From 0fafda696bc9ee997e3c2a368b28f4600037aaca Mon Sep 17 00:00:00 2001 From: Snafu Date: Sun, 7 Jun 2026 16:42:47 +0200 Subject: [PATCH 040/123] Fix force_tfa not available in mailbox template #7216 --- data/web/api/openapi.yaml | 14 +++++++++++++- data/web/inc/functions.mailbox.inc.php | 1 + data/web/js/site/mailbox.js | 11 +++++++++++ data/web/lang/lang.en-gb.json | 1 + data/web/templates/edit/mailbox-templates.twig | 9 +++++++++ 5 files changed, 35 insertions(+), 1 deletion(-) diff --git a/data/web/api/openapi.yaml b/data/web/api/openapi.yaml index cf54f6ad..77c58b60 100644 --- a/data/web/api/openapi.yaml +++ b/data/web/api/openapi.yaml @@ -1072,6 +1072,7 @@ paths: password2: "*" quota: "3072" force_pw_update: "1" + force_tfa: "1" tls_enforce_in: "1" tls_enforce_out: "1" tags: ["tag1", "tag2"] @@ -1118,6 +1119,7 @@ paths: password2: atedismonsin quota: "3072" force_pw_update: "1" + force_tfa: "1" tls_enforce_in: "1" tls_enforce_out: "1" tags: ["tag1", "tag2"] @@ -1151,6 +1153,9 @@ paths: force_pw_update: description: forces the user to update its password on first login type: boolean + force_tfa: + description: force 2FA enrollment at login + type: boolean tls_enforce_in: description: force inbound email tls encryption type: boolean @@ -2510,7 +2515,7 @@ paths: description: >- Using this endpoint you can perform actions on quarantine items. It is possible to release emails from quarantine into to the inbox, or learn them as ham to improve Rspamd filtering. - You must provide the quarantine item IDs. You can get the IDs using the GET method. + You must provide the quarantine item IDs. You can get the IDs using the GET method. operationId: Edit mails in Quarantine requestBody: content: @@ -3414,6 +3419,7 @@ paths: - mailbox - active: "1" force_pw_update: "0" + force_tfa: "0" name: Full name password: "*" password2: "*" @@ -3464,6 +3470,7 @@ paths: attr: active: "1" force_pw_update: "0" + force_tfa: "0" name: Full name authsource: mailcow password: "" @@ -3487,6 +3494,9 @@ paths: force_pw_update: description: force user to change password on next login type: boolean + force_tfa: + description: force 2FA enrollment at login + type: boolean name: description: Full name of the mailbox user type: string @@ -4881,6 +4891,7 @@ paths: - active: "1" attributes: force_pw_update: "0" + force_tfa: "0" mailbox_format: "maildir:" quarantine_notification: never sogo_access: "1" @@ -5805,6 +5816,7 @@ paths: - active: "1" attributes: force_pw_update: "0" + force_tfa: "0" mailbox_format: "maildir:" quarantine_notification: never sogo_access: "1" diff --git a/data/web/inc/functions.mailbox.inc.php b/data/web/inc/functions.mailbox.inc.php index adb330ea..b6d683e1 100644 --- a/data/web/inc/functions.mailbox.inc.php +++ b/data/web/inc/functions.mailbox.inc.php @@ -3828,6 +3828,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) { $attr["rl_frame"] = (!empty($_data['rl_frame'])) ? $_data['rl_frame'] : $is_now['rl_frame']; $attr["rl_value"] = (!empty($_data['rl_value'])) ? $_data['rl_value'] : $is_now['rl_value']; $attr["force_pw_update"] = isset($_data['force_pw_update']) ? intval($_data['force_pw_update']) : $is_now['force_pw_update']; + $attr["force_tfa"] = isset($_data['force_tfa']) ? intval($_data['force_tfa']) : $is_now['force_tfa']; $attr["sogo_access"] = isset($_data['sogo_access']) ? intval($_data['sogo_access']) : $is_now['sogo_access']; $attr["active"] = isset($_data['active']) ? intval($_data['active']) : $is_now['active']; $attr["tls_enforce_in"] = isset($_data['tls_enforce_in']) ? intval($_data['tls_enforce_in']) : $is_now['tls_enforce_in']; diff --git a/data/web/js/site/mailbox.js b/data/web/js/site/mailbox.js index e8edb994..0a019279 100644 --- a/data/web/js/site/mailbox.js +++ b/data/web/js/site/mailbox.js @@ -424,6 +424,11 @@ $(document).ready(function() { } else { $('#force_pw_update').prop('checked', false); } + if (template.force_tfa == 1){ + $('#force_tfa').prop('checked', true); + } else { + $('#force_tfa').prop('checked', false); + } if (template.sogo_access == 1){ $('#sogo_access').prop('checked', true); } else { @@ -1242,6 +1247,7 @@ jQuery(function($){ item.attributes.eas_access = '' + (item.attributes.eas_access == 1 ? '1' : '0') + ''; item.attributes.dav_access = '' + (item.attributes.dav_access == 1 ? '1' : '0') + ''; item.attributes.sogo_access = '' + (item.attributes.sogo_access == 1 ? '1' : '0') + ''; + item.attributes.force_tfa = '' + (item.attributes.force_tfa == 1 ? '1' : '0') + ''; if (item.attributes.quarantine_notification === 'never') { item.attributes.quarantine_notification = lang.never; } else if (item.attributes.quarantine_notification === 'hourly') { @@ -1385,6 +1391,11 @@ jQuery(function($){ return 1==data?'':''; } }, + { + title: lang.force_tfa, + data: 'attributes.force_tfa', + defaultContent: '' + }, { title: lang_edit.ratelimit, data: 'attributes.ratelimit', diff --git a/data/web/lang/lang.en-gb.json b/data/web/lang/lang.en-gb.json index e786bcbe..d2412fbf 100644 --- a/data/web/lang/lang.en-gb.json +++ b/data/web/lang/lang.en-gb.json @@ -929,6 +929,7 @@ "filters": "Filters", "fname": "Full name", "force_pw_update": "Force password update at next login", + "force_tfa": "TFA", "gal": "Global Address List", "goto_ham": "Learn as ham", "goto_spam": "Learn as spam", diff --git a/data/web/templates/edit/mailbox-templates.twig b/data/web/templates/edit/mailbox-templates.twig index ddc13958..8384fa05 100644 --- a/data/web/templates/edit/mailbox-templates.twig +++ b/data/web/templates/edit/mailbox-templates.twig @@ -8,6 +8,7 @@ + @@ -165,6 +166,14 @@
+
+
+
+ + {{ lang.tfa.force_tfa_info }} +
+
+
{% if not skip_sogo %}
From cce02e2b15ae96984803cc5a1906b0a8d268e587 Mon Sep 17 00:00:00 2001 From: Bobby Date: Mon, 8 Jun 2026 00:01:43 +0700 Subject: [PATCH 041/123] Refresh SOGo view after mailbox activation --- data/web/inc/functions.mailbox.inc.php | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/data/web/inc/functions.mailbox.inc.php b/data/web/inc/functions.mailbox.inc.php index adb330ea..326f1a09 100644 --- a/data/web/inc/functions.mailbox.inc.php +++ b/data/web/inc/functions.mailbox.inc.php @@ -3502,11 +3502,10 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) { 'msg' => array('mailbox_modified', $username) ); - // Track affected mailboxes for SOGo update - $update_sogo_mailboxes[] = $username; - } - return true; - break; + // Track affected mailboxes for SOGo update + $update_sogo_mailboxes[] = $username; + } + break; case 'mailbox_rename': $domain = $_data['domain']; $old_local_part = $_data['old_local_part']; From 15891960f78fd10e90aac0cc3ab5267720a0b38f Mon Sep 17 00:00:00 2001 From: Dmytro Alieksieiev <1865999+dragoangel@users.noreply.github.com> Date: Tue, 9 Jun 2026 01:19:06 +0200 Subject: [PATCH 042/123] Update RSPAMD version to 4.1.0 --- data/Dockerfiles/rspamd/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/Dockerfiles/rspamd/Dockerfile b/data/Dockerfiles/rspamd/Dockerfile index ab9aaa5a..d37d1226 100644 --- a/data/Dockerfiles/rspamd/Dockerfile +++ b/data/Dockerfiles/rspamd/Dockerfile @@ -2,7 +2,7 @@ FROM debian:trixie-slim LABEL maintainer="The Infrastructure Company GmbH " ARG DEBIAN_FRONTEND=noninteractive -ARG RSPAMD_VER=rspamd_4.0.1-1~8700333 +ARG RSPAMD_VER=rspamd_4.1.0-1~e2b0b18 ARG CODENAME=trixie ENV LC_ALL=C From c0050e8836a2b11233d3fb2ec132cf252b63e24b Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Tue, 9 Jun 2026 12:19:09 +0200 Subject: [PATCH 043/123] Update devops-infra/action-pull-request action to v1.3.0 (#7272) --- .github/workflows/pr_to_nightly.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/pr_to_nightly.yml b/.github/workflows/pr_to_nightly.yml index 0b0738e9..01d7a91a 100644 --- a/.github/workflows/pr_to_nightly.yml +++ b/.github/workflows/pr_to_nightly.yml @@ -12,7 +12,7 @@ jobs: with: fetch-depth: 0 - name: Run the Action - uses: devops-infra/action-pull-request@v1.2.1 + uses: devops-infra/action-pull-request@v1.3.0 with: github_token: ${{ secrets.PRTONIGHTLY_ACTION_PAT }} title: Automatic PR to nightly from ${{ github.event.repository.updated_at}} From 03c31f825ab128c22c2ce69398d2f3f61754c972 Mon Sep 17 00:00:00 2001 From: milkmaker Date: Tue, 9 Jun 2026 12:20:53 +0200 Subject: [PATCH 044/123] update postscreen_access.cidr (#7269) --- data/conf/postfix/postscreen_access.cidr | 73 ++---------------------- 1 file changed, 5 insertions(+), 68 deletions(-) diff --git a/data/conf/postfix/postscreen_access.cidr b/data/conf/postfix/postscreen_access.cidr index 285ea7a8..70fd2651 100644 --- a/data/conf/postfix/postscreen_access.cidr +++ b/data/conf/postfix/postscreen_access.cidr @@ -1,6 +1,6 @@ -# Whitelist generated by Postwhite v3.4 on Fri May 1 00:43:37 UTC 2026 +# Whitelist generated by Postwhite v3.4 on Mon Jun 1 00:52:17 UTC 2026 # https://github.com/stevejenkins/postwhite/ -# 2249 total rules +# 2186 total rules 2a00:1450:4000::/36 permit 2a00:1450:4864::/56 permit 2a01:111:f400::/48 permit @@ -56,14 +56,8 @@ 8.25.194.0/23 permit 8.25.196.0/23 permit 8.36.116.0/24 permit -8.39.54.0/23 permit -8.39.54.250/31 permit 8.39.144.0/24 permit -8.40.222.0/23 permit -8.40.222.250/31 permit 12.130.86.238 permit -13.107.213.40 permit -13.107.246.40 permit 13.108.16.0/20 permit 13.110.208.0/21 permit 13.110.209.0/24 permit @@ -73,7 +67,6 @@ 13.111.191.0/24 permit 13.216.7.111 permit 13.216.54.180 permit -13.247.164.219 permit 15.200.21.50 permit 15.200.44.248 permit 15.200.201.185 permit @@ -177,7 +170,6 @@ 34.215.104.144 permit 34.218.115.239 permit 34.225.212.172 permit -34.241.242.183 permit 35.83.148.184 permit 35.155.198.111 permit 35.158.23.94 permit @@ -201,7 +193,6 @@ 40.233.64.216 permit 40.233.83.78 permit 40.233.88.28 permit -43.239.212.33 permit 44.206.138.57 permit 44.210.169.44 permit 44.217.45.156 permit @@ -284,7 +275,6 @@ 51.83.17.38 permit 52.1.14.157 permit 52.5.230.59 permit -52.6.74.205 permit 52.12.53.23 permit 52.13.214.179 permit 52.26.1.71 permit @@ -341,7 +331,6 @@ 54.244.54.130 permit 54.244.242.0/24 permit 54.255.61.23 permit -56.124.6.228 permit 57.103.64.0/18 permit 57.129.93.249 permit 62.13.128.0/24 permit @@ -408,7 +397,6 @@ 65.110.161.77 permit 65.123.29.213 permit 65.123.29.220 permit -65.154.166.0/24 permit 65.212.180.36 permit 66.102.0.0/20 permit 66.119.150.192/26 permit @@ -1222,9 +1210,6 @@ 99.78.197.208/28 permit 103.9.96.0/22 permit 103.28.42.0/24 permit -103.84.217.15 permit -103.84.217.238 permit -103.89.75.238 permit 103.151.192.0/23 permit 103.168.172.128/27 permit 103.237.104.0/22 permit @@ -1385,9 +1370,6 @@ 117.120.16.0/21 permit 119.42.242.52/31 permit 119.42.242.156 permit -121.244.91.48 permit -121.244.91.52 permit -122.15.156.182 permit 123.126.78.64/29 permit 124.108.96.24/31 permit 124.108.96.28/31 permit @@ -1470,21 +1452,7 @@ 134.170.141.64/26 permit 134.170.143.0/24 permit 134.170.174.0/24 permit -135.84.80.0/24 permit -135.84.81.0/24 permit -135.84.82.0/24 permit -135.84.83.0/24 permit 135.84.216.0/22 permit -136.143.160.0/24 permit -136.143.161.0/24 permit -136.143.162.0/24 permit -136.143.176.0/24 permit -136.143.177.0/24 permit -136.143.178.49 permit -136.143.182.0/23 permit -136.143.184.0/24 permit -136.143.188.0/24 permit -136.143.190.0/23 permit 136.146.128.0/20 permit 136.147.128.0/20 permit 136.147.135.0/24 permit @@ -1504,7 +1472,6 @@ 139.138.46.219 permit 139.138.57.55 permit 139.138.58.119 permit -139.167.79.86 permit 139.177.108.0/25 permit 139.180.17.0/24 permit 140.238.148.191 permit @@ -1554,12 +1521,14 @@ 147.243.128.26 permit 148.105.0.0/16 permit 148.105.8.0/21 permit +148.116.32.128/25 permit 149.72.0.0/16 permit 149.72.234.184 permit 149.72.248.236 permit 149.97.173.180 permit 149.118.160.128/25 permit 150.136.21.199 permit +150.171.109.118 permit 150.230.98.160 permit 151.145.38.14 permit 152.67.105.195 permit @@ -1636,11 +1605,6 @@ 164.152.25.241 permit 164.177.132.168/30 permit 165.1.100.0/25 permit -165.173.128.0/24 permit -165.173.180.1 permit -165.173.180.250/31 permit -165.173.182.250/31 permit -165.173.189.205 permit 166.78.68.0/22 permit 166.78.68.221 permit 166.78.69.169 permit @@ -1673,19 +1637,6 @@ 168.245.12.252 permit 168.245.46.9 permit 168.245.127.231 permit -169.148.129.0/24 permit -169.148.131.0/24 permit -169.148.138.0/24 permit -169.148.142.10 permit -169.148.142.33 permit -169.148.144.0/25 permit -169.148.144.10 permit -169.148.146.0/23 permit -169.148.174.10 permit -169.148.175.3 permit -169.148.179.3 permit -169.148.188.0/24 permit -169.148.188.182 permit 170.9.232.254 permit 170.10.128.0/24 permit 170.10.129.0/24 permit @@ -1891,16 +1842,7 @@ 199.16.156.0/22 permit 199.33.145.1 permit 199.33.145.32 permit -199.34.22.36 permit 199.59.148.0/22 permit -199.67.80.2 permit -199.67.80.20 permit -199.67.82.2 permit -199.67.82.20 permit -199.67.84.0/24 permit -199.67.86.0/24 permit -199.67.88.0/24 permit -199.67.90.0/24 permit 199.101.161.130 permit 199.101.162.0/25 permit 199.122.120.0/21 permit @@ -1956,8 +1898,6 @@ 204.92.114.187 permit 204.92.114.203 permit 204.92.114.204/31 permit -204.141.32.0/23 permit -204.141.42.0/23 permit 204.216.164.202 permit 204.220.160.0/21 permit 204.220.168.0/21 permit @@ -2231,10 +2171,7 @@ 2001:748:400:3301::4 permit 2404:6800:4000::/36 permit 2404:6800:4864::/56 permit -2603:1061:14:72::1 permit -2607:13c0:0001:0000:0000:0000:0000:7000/116 permit -2607:13c0:0002:0000:0000:0000:0000:1000/116 permit -2607:13c0:0004:0000:0000:0000:0000:0000/116 permit +2603:1061:14:40::1 permit 2607:f8b0:4000::/36 permit 2607:f8b0:4864::/56 permit 2620:109:c003:104::/64 permit From 24cc369d84935428f58a4c6bef5b18a58ad248ed Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Thu, 11 Jun 2026 09:34:27 +0200 Subject: [PATCH 045/123] [Rspamd] Migrate metadata_exporter to multipart formatter --- .../rspamd/local.d/metadata_exporter.conf | 6 +- data/conf/rspamd/meta_exporter/pipe.php | 59 +++++++++---------- data/conf/rspamd/meta_exporter/pushover.php | 48 +++++++-------- docker-compose.yml | 2 +- 4 files changed, 52 insertions(+), 63 deletions(-) diff --git a/data/conf/rspamd/local.d/metadata_exporter.conf b/data/conf/rspamd/local.d/metadata_exporter.conf index daaa79b4..cc85faac 100644 --- a/data/conf/rspamd/local.d/metadata_exporter.conf +++ b/data/conf/rspamd/local.d/metadata_exporter.conf @@ -3,8 +3,7 @@ rules { backend = "http"; url = "http://nginx:9081/pipe.php"; selector = "reject_no_global_bl"; - formatter = "default"; - meta_headers = true; + formatter = "multipart"; } RLINFO { backend = "http"; @@ -16,8 +15,7 @@ rules { backend = "http"; url = "http://nginx:9081/pushover.php"; selector = "mailcow_rcpt"; - formatter = "json"; - meta_headers = true; + formatter = "multipart"; } } diff --git a/data/conf/rspamd/meta_exporter/pipe.php b/data/conf/rspamd/meta_exporter/pipe.php index 003639b0..0a9ed59e 100644 --- a/data/conf/rspamd/meta_exporter/pipe.php +++ b/data/conf/rspamd/meta_exporter/pipe.php @@ -32,47 +32,42 @@ function parse_email($email) { $a = strrpos($email, '@'); return array('local' => substr($email, 0, $a), 'domain' => substr(substr($email, $a), 1)); } -if (!function_exists('getallheaders')) { - function getallheaders() { - if (!is_array($_SERVER)) { - return array(); - } - $headers = array(); - foreach ($_SERVER as $name => $value) { - if (substr($name, 0, 5) == 'HTTP_') { - $headers[str_replace(' ', '-', ucwords(strtolower(str_replace('_', ' ', substr($name, 5)))))] = $value; - } - } - return $headers; - } +// rspamd metadata_exporter (multipart formatter): +// - $_POST['metadata'] JSON with the rspamd metadata +// - $_FILES['message'] raw RFC822 message +if (empty($_POST['metadata']) || !isset($_FILES['message']) || $_FILES['message']['error'] !== UPLOAD_ERR_OK) { + error_log("QUARANTINE: missing multipart parts from rspamd" . PHP_EOL); + http_response_code(400); + exit; } -$raw_data_content = file_get_contents('php://input'); +$meta = json_decode($_POST['metadata'], true); +if (!is_array($meta)) { + error_log("QUARANTINE: cannot decode metadata JSON" . PHP_EOL); + http_response_code(400); + exit; +} + +$raw_data_content = file_get_contents($_FILES['message']['tmp_name']); $raw_data = mb_convert_encoding($raw_data_content, 'HTML-ENTITIES', "UTF-8"); -$headers = getallheaders(); +$raw_size = (int)$_FILES['message']['size']; -$qid = $headers['X-Rspamd-Qid']; -$fuzzy = $headers['X-Rspamd-Fuzzy']; -$subject = iconv_mime_decode($headers['X-Rspamd-Subject']); -$score = $headers['X-Rspamd-Score']; -$rcpts = $headers['X-Rspamd-Rcpt']; -$user = $headers['X-Rspamd-User']; -$ip = $headers['X-Rspamd-Ip']; -$action = $headers['X-Rspamd-Action']; -$sender = $headers['X-Rspamd-From']; -$symbols = $headers['X-Rspamd-Symbols']; - -$raw_size = (int)$_SERVER['CONTENT_LENGTH']; +$qid = $meta['qid'] ?? 'unknown'; +$subject = iconv_mime_decode($meta['subject'] ?? ''); +$score = $meta['score'] ?? 0; +$rcpts = $meta['rcpt'] ?? array(); +$user = $meta['user'] ?? 'unknown'; +$ip = $meta['ip'] ?? 'unknown'; +$action = $meta['action'] ?? 'no action'; +$sender = $meta['from'] ?? ''; +$symbols = json_encode($meta['symbols'] ?? array()); +$fuzzy = json_encode(is_array($meta['fuzzy'] ?? null) ? $meta['fuzzy'] : array()); if (empty($sender)) { error_log("QUARANTINE: Unknown sender, assuming empty-env-from@localhost" . PHP_EOL); $sender = 'empty-env-from@localhost'; } -if ($fuzzy == 'unknown') { - $fuzzy = '[]'; -} - try { $max_size = (int)$redis->Get('Q_MAX_SIZE'); if (($max_size * 1048576) < $raw_size) { @@ -94,7 +89,7 @@ catch (RedisException $e) { $rcpt_final_mailboxes = array(); // Loop through all rcpts -foreach (json_decode($rcpts, true) as $rcpt) { +foreach ($rcpts as $rcpt) { // Remove tag $rcpt = preg_replace('/^(.*?)\+.*(@.*)$/', '$1$2', $rcpt); diff --git a/data/conf/rspamd/meta_exporter/pushover.php b/data/conf/rspamd/meta_exporter/pushover.php index efe5fdd5..a2cd0995 100644 --- a/data/conf/rspamd/meta_exporter/pushover.php +++ b/data/conf/rspamd/meta_exporter/pushover.php @@ -32,50 +32,46 @@ function parse_email($email) { $a = strrpos($email, '@'); return array('local' => substr($email, 0, $a), 'domain' => substr(substr($email, $a), 1)); } -if (!function_exists('getallheaders')) { - function getallheaders() { - if (!is_array($_SERVER)) { - return array(); - } - $headers = array(); - foreach ($_SERVER as $name => $value) { - if (substr($name, 0, 5) == 'HTTP_') { - $headers[str_replace(' ', '-', ucwords(strtolower(str_replace('_', ' ', substr($name, 5)))))] = $value; - } - } - return $headers; - } +// rspamd metadata_exporter (multipart formatter): metadata JSON arrives as $_POST['metadata']. +if (empty($_POST['metadata'])) { + error_log("NOTIFY: missing metadata part from rspamd" . PHP_EOL); + http_response_code(400); + exit; } -$headers = getallheaders(); -$json_body = json_decode(file_get_contents('php://input')); +$meta = json_decode($_POST['metadata'], true); +if (!is_array($meta)) { + error_log("NOTIFY: cannot decode metadata JSON" . PHP_EOL); + http_response_code(400); + exit; +} -$qid = $headers['X-Rspamd-Qid']; -$rcpts = $headers['X-Rspamd-Rcpt']; -$sender = $headers['X-Rspamd-From']; -$ip = $headers['X-Rspamd-Ip']; -$subject = iconv_mime_decode($headers['X-Rspamd-Subject']); -$messageid= $json_body->message_id; +$qid = $meta['qid'] ?? 'unknown'; +$rcpts = $meta['rcpt'] ?? array(); +$sender = $meta['from'] ?? ''; +$ip = $meta['ip'] ?? 'unknown'; +$subject = iconv_mime_decode($meta['subject'] ?? ''); +$messageid= $meta['message_id'] ?? ''; $priority = 0; -$symbols_array = json_decode($headers['X-Rspamd-Symbols'], true); +$symbols_array = $meta['symbols'] ?? array(); if (is_array($symbols_array)) { foreach ($symbols_array as $symbol) { - if ($symbol['name'] == 'HAS_X_PRIO_ONE') { + if (($symbol['name'] ?? null) == 'HAS_X_PRIO_ONE') { $priority = 1; break; } } } -$sender_address = $json_body->header_from[0]; +$sender_address = $meta['header_from'][0] ?? ''; $sender_name = '-'; if (preg_match('/(?.*?)<(?
.*?)>/i', $sender_address, $matches)) { $sender_address = $matches['address']; $sender_name = trim($matches['name'], '"\' '); } -$to_address = $json_body->header_to[0]; +$to_address = $meta['header_to'][0] ?? ''; $to_name = '-'; if (preg_match('/(?.*?)<(?
.*?)>/i', $to_address, $matches)) { $to_address = $matches['address']; @@ -85,7 +81,7 @@ if (preg_match('/(?.*?)<(?
.*?)>/i', $to_address, $matches)) { $rcpt_final_mailboxes = array(); // Loop through all rcpts -foreach (json_decode($rcpts, true) as $rcpt) { +foreach ($rcpts as $rcpt) { // Remove tag $rcpt = preg_replace('/^(.*?)\+.*(@.*)$/', '$1$2', $rcpt); diff --git a/docker-compose.yml b/docker-compose.yml index 615e19f5..16370a7b 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -84,7 +84,7 @@ services: - clamd rspamd-mailcow: - image: ghcr.io/mailcow/rspamd:3.14.3-1 + image: ghcr.io/mailcow/rspamd:4.1.0-1 stop_grace_period: 30s depends_on: - dovecot-mailcow From 277a307fb91f701f2f2619debd50ec183ca34192 Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Thu, 11 Jun 2026 09:55:32 +0200 Subject: [PATCH 046/123] [Web] Fix refresh SOGo view on mailbox deletion --- data/web/inc/functions.mailbox.inc.php | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/data/web/inc/functions.mailbox.inc.php b/data/web/inc/functions.mailbox.inc.php index 326f1a09..127374e8 100644 --- a/data/web/inc/functions.mailbox.inc.php +++ b/data/web/inc/functions.mailbox.inc.php @@ -3502,10 +3502,10 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) { 'msg' => array('mailbox_modified', $username) ); - // Track affected mailboxes for SOGo update - $update_sogo_mailboxes[] = $username; - } - break; + // Track affected mailboxes for SOGo update + $update_sogo_mailboxes[] = $username; + } + break; case 'mailbox_rename': $domain = $_data['domain']; $old_local_part = $_data['old_local_part']; @@ -6126,7 +6126,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) { // Track affected mailboxes for SOGo update $update_sogo_mailboxes[] = $username; } - return true; break; case 'mailbox_templates': if ($_SESSION['mailcow_cc_role'] != "admin") { From fa154c71f3fc855c99fae503a222790b92e1e42e Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Thu, 11 Jun 2026 10:29:01 +0200 Subject: [PATCH 047/123] [PHP] Rebuild Image --- docker-compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docker-compose.yml b/docker-compose.yml index 87b739ed..cccf3a21 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -117,7 +117,7 @@ services: - rspamd php-fpm-mailcow: - image: ghcr.io/mailcow/phpfpm:8.2.29-2 + image: ghcr.io/mailcow/phpfpm:8.2.29-3 command: "php-fpm -d date.timezone=${TZ} -d expose_php=0" depends_on: - redis-mailcow From 7e6c36dce1c106e95334410ad8313d1174fe15fa Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Thu, 11 Jun 2026 11:35:03 +0200 Subject: [PATCH 048/123] Update alpine Docker tag to v3.24 (#7280) --- .../EXTERNAL_MYSQL_SOCKET/docker-compose.override.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/helper-scripts/docker-compose.override.yml.d/EXTERNAL_MYSQL_SOCKET/docker-compose.override.yml b/helper-scripts/docker-compose.override.yml.d/EXTERNAL_MYSQL_SOCKET/docker-compose.override.yml index 5ef729a4..fd47e15f 100644 --- a/helper-scripts/docker-compose.override.yml.d/EXTERNAL_MYSQL_SOCKET/docker-compose.override.yml +++ b/helper-scripts/docker-compose.override.yml.d/EXTERNAL_MYSQL_SOCKET/docker-compose.override.yml @@ -25,6 +25,6 @@ services: - /var/run/mysqld/mysqld.sock:/var/run/mysqld/mysqld.sock mysql-mailcow: - image: alpine:3.23 + image: alpine:3.24 command: /bin/true restart: "no" From ddcce811c1f77658d857ec3357505eba1fce264d Mon Sep 17 00:00:00 2001 From: Chris Haumesser <5400416-wryfi@users.noreply.gitlab.com> Date: Fri, 12 Jun 2026 16:32:22 -0600 Subject: [PATCH 049/123] Fixes #7150 (Dovecot passwd-verify.lua wipes auth cache during any nginx restart or unavailability) - distinguishes between text and numeric responses from nginx - prevents auth cache from being invalidated due to nginx unavailability --- data/conf/dovecot/auth/passwd-verify.lua | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/data/conf/dovecot/auth/passwd-verify.lua b/data/conf/dovecot/auth/passwd-verify.lua index ea847932..a22488ea 100644 --- a/data/conf/dovecot/auth/passwd-verify.lua +++ b/data/conf/dovecot/auth/passwd-verify.lua @@ -32,8 +32,17 @@ function auth_password_verify(request, password) -- Returning PASSDB_RESULT_PASSWORD_MISMATCH will reset the user's auth cache entry. -- Returning PASSDB_RESULT_INTERNAL_FAILURE keeps the existing cache entry, -- even if the TTL has expired. Useful to avoid cache eviction during backend issues. + + -- On a network-level failure (nginx unreachable, DNS failure, timeout) https.request + -- returns nil plus an error string, so c is not a numeric HTTP status code. Treat this + -- as a backend outage and keep the cache entry, rather than wiping it as a mismatch. + if type(c) ~= "number" then + dovecot.i_info("HTTP request to auth backend failed with " .. tostring(c) .. " for user " .. request.user) + return dovecot.auth.PASSDB_RESULT_INTERNAL_FAILURE, "Upstream unreachable" + end + if c ~= 200 and c ~= 401 then - dovecot.i_info("HTTP request failed with " .. c .. " for user " .. request.user) + dovecot.i_info("HTTP request failed with " .. tostring(c) .. " for user " .. request.user) return dovecot.auth.PASSDB_RESULT_PASSWORD_MISMATCH, "Upstream error" end From 47e4552b44ddfd528b99987545ccdaf61135f2c9 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Fri, 19 Jun 2026 08:34:02 +0200 Subject: [PATCH 050/123] Update actions/checkout action to v7 (#7300) --- .github/workflows/image_builds.yml | 2 +- .github/workflows/pr_to_nightly.yml | 2 +- .github/workflows/rebuild_backup_image.yml | 2 +- .github/workflows/update_postscreen_access_list.yml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/image_builds.yml b/.github/workflows/image_builds.yml index c8ec7cca..aa56b038 100644 --- a/.github/workflows/image_builds.yml +++ b/.github/workflows/image_builds.yml @@ -27,7 +27,7 @@ jobs: - "watchdog-mailcow" runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - name: Setup Docker run: | curl -sSL https://get.docker.com/ | CHANNEL=stable sudo sh diff --git a/.github/workflows/pr_to_nightly.yml b/.github/workflows/pr_to_nightly.yml index 01d7a91a..5c361af7 100644 --- a/.github/workflows/pr_to_nightly.yml +++ b/.github/workflows/pr_to_nightly.yml @@ -8,7 +8,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: fetch-depth: 0 - name: Run the Action diff --git a/.github/workflows/rebuild_backup_image.yml b/.github/workflows/rebuild_backup_image.yml index b18d339b..4490afee 100644 --- a/.github/workflows/rebuild_backup_image.yml +++ b/.github/workflows/rebuild_backup_image.yml @@ -13,7 +13,7 @@ jobs: packages: write steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Set up QEMU uses: docker/setup-qemu-action@v4 diff --git a/.github/workflows/update_postscreen_access_list.yml b/.github/workflows/update_postscreen_access_list.yml index 066616ae..ed63281c 100644 --- a/.github/workflows/update_postscreen_access_list.yml +++ b/.github/workflows/update_postscreen_access_list.yml @@ -15,7 +15,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Generate postscreen_access.cidr run: | From 9e723e942d02de31ba8ca78aa5e34a68b62ed38b Mon Sep 17 00:00:00 2001 From: milkmaker Date: Sat, 20 Jun 2026 13:57:15 +0200 Subject: [PATCH 051/123] Translations update from Weblate (#7302) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * [Web] Updated lang.fr-fr.json Co-authored-by: Romain Ayme * [Web] Updated lang.si-si.json Co-authored-by: Matjaž Tekavec --------- Co-authored-by: Romain Ayme Co-authored-by: Matjaž Tekavec --- data/web/lang/lang.fr-fr.json | 23 +++++++++++++++++------ data/web/lang/lang.si-si.json | 3 ++- 2 files changed, 19 insertions(+), 7 deletions(-) diff --git a/data/web/lang/lang.fr-fr.json b/data/web/lang/lang.fr-fr.json index 43c9c065..9ee91671 100644 --- a/data/web/lang/lang.fr-fr.json +++ b/data/web/lang/lang.fr-fr.json @@ -111,7 +111,8 @@ "app_passwd_protocols": "Protocoles autorisés pour le mot de passe de l'application", "dry": "Simuler la synchronisation", "internal": "Interne", - "internal_info": "Les alias internes sont accessibles uniquement depuis le domaine ou les alias du domaine." + "internal_info": "Les alias internes sont accessibles uniquement depuis le domaine ou les alias du domaine.", + "sender_allowed": "Autoriser l'envoi sous cet alias" }, "admin": { "access": "Accès", @@ -556,7 +557,9 @@ "max_age_invalid": "L'âge maximum %s est invalide", "mode_invalid": "Le mode %s est invalide", "mx_invalid": "L'enregistrement MX %s est invalide", - "version_invalid": "La version %s est invalide" + "version_invalid": "La version %s est invalide", + "tfa_removal_blocked": "L’authentification à deux facteurs ne peut pas être supprimée, car elle est requise pour votre compte.", + "quarantine_category_invalid": "La catégorie de quarantaine doit être l’une des suivantes : add_header, reject, all\"" }, "debug": { "chart_this_server": "Graphique (ce serveur)", @@ -755,7 +758,9 @@ "mta_sts_info": "MTA-STS est un standard qui oblige la délivrance des courriels entre les serveurs de courriels à utiliser TLS avec des certificats valides.
Il est utilisé quand DANE n'est pas possible à cause d'un manque ou d'un non support de DNSSEC.
Note : Si le domaine du destinataire supporte DANE avec DNSSEC, DANE est toujours préféré – MTA-STS sert seulement en secours.", "mta_sts_mode_info": "Il y a trois modes parmi lesquels choisir :
  • testing – la politique est seulement surveillée, les violations n'ont pas d'impact.
  • enforce – la politique est appliquée strictement, les connexions sans TLS valide sont rejetées.
  • none – la politique est publiée mais non appliquée.
", "mta_sts_max_age_info": "Durée en secondes pendant laquelle les serveurs de courriel peuvent mettre en cache cette politique avant de revérifier.", - "mta_sts_mx_info": "Autoriser l'envoi uniquement aux noms d'hôtes des serveurs de courriels indiqués explicitement ; le MTA émetteur vérifie si le nom d'hôte DNS du MX correspond à la liste de la politique, et autorise la délivrance seulement avec un certificat TLS valide (protège contre le MITM)." + "mta_sts_mx_info": "Autoriser l'envoi uniquement aux noms d'hôtes des serveurs de courriels indiqués explicitement ; le MTA émetteur vérifie si le nom d'hôte DNS du MX correspond à la liste de la politique, et autorise la délivrance seulement avec un certificat TLS valide (protège contre le MITM).", + "sender_allowed": "Autoriser l'envoi sous cet alias", + "sender_allowed_info": "Si cette option est désactivée, cet alias peut uniquement recevoir des courriels. Utilisez les ACL d’expéditeur pour autoriser certaines boîtes aux lettres à envoyer des messages via cet alias." }, "footer": { "cancel": "Annuler", @@ -988,7 +993,8 @@ "recipient": "Destinataire", "open_logs": "Afficher les journaux", "iam": "Fournisseur d'identité", - "internal": "Interne" + "internal": "Interne", + "force_tfa": "TFA" }, "oauth2": { "access_denied": "Veuillez vous connecter en tant que propriétaire de la boîte de réception pour accorder l’accès via Oauth2.", @@ -1189,7 +1195,11 @@ "yubi_otp": "Authentification OTP Yubico", "authenticators": "Authentificateurs", "u2f_deprecated_important": "Veuillez enregistrer votre clé dans le panneau d'administration avec la nouvelle méthode WebAuthn.", - "u2f_deprecated": "Il semble que votre clé ait été enregistrée à l'aide de la méthode U2F obsolète. Nous allons désactiver l'authentification à deux facteurs pour vous et supprimer votre clé." + "u2f_deprecated": "Il semble que votre clé ait été enregistrée à l'aide de la méthode U2F obsolète. Nous allons désactiver l'authentification à deux facteurs pour vous et supprimer votre clé.", + "force_tfa": "Imposer l'authentification à deux facteurs lors de la connexion", + "force_tfa_info": "L’utilisateur doit configurer l’authentification à deux facteurs avant de pouvoir accéder à l’interface.", + "setup_title": "Authentification à deux facteurs requise", + "setup_required": "Votre compte nécessite l’authentification à deux facteurs. Veuillez configurer une méthode 2FA pour continuer." }, "fido2": { "set_fn": "Définir un nom", @@ -1378,7 +1388,8 @@ "forever": "Pour toujours", "spam_aliases_info": "Un alias de spam est une adresse de courriel temporaire qui peut être utilisée pour protéger les véritables adresses de courriel.
De manière optionnelle, une durée d'expiration peut être définie afin que l'alias soit automatiquement désactivé après la période définie, éliminant ainsi les adresses étant abusées ou ayant fuité.", "authentication": "Authentification", - "protocols": "Protocoles" + "protocols": "Protocoles", + "pw_update_required": "Votre compte nécessite un changement de mot de passe. Veuillez définir un nouveau mot de passe pour continuer." }, "warning": { "cannot_delete_self": "Impossible de supprimer l’utilisateur connecté", diff --git a/data/web/lang/lang.si-si.json b/data/web/lang/lang.si-si.json index f5ba53f9..39d57eb3 100644 --- a/data/web/lang/lang.si-si.json +++ b/data/web/lang/lang.si-si.json @@ -1001,7 +1001,8 @@ "weekly": "Tedensko", "sieve_info": "Na uporabnika lahko shranite več filtrov, vendar je lahko hkrati aktiven le en predfilter in en postfilter.
\nVsak filter bo obdelan v opisanem vrstnem redu. Niti neuspešen skript niti izdan ukaz »keep;« ne bosta ustavila obdelave nadaljnjih skript. Spremembe globalnih skriptov sita bodo sprožile ponovni zagon Dovecota.

Globalni predfilter sita • Predfilter • Uporabniški skripti • Postfilter • Globalni postfilter sita", "tls_policy_maps_info": "Ta preslikava pravilnikov preglasi pravila odhodnega prenosa TLS neodvisno od uporabnikovih nastavitev pravilnikov TLS.
\n Za več informacij preverite dokumentacijo »smtp_tls_policy_maps«.", - "internal": "Notranje" + "internal": "Notranje", + "force_tfa": "TFA" }, "fido2": { "known_ids": "Znani ID-ji", From 1f8b4679ccb92cdb27c99e9a42fcf99637b71fe6 Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Thu, 25 Jun 2026 12:17:37 +0200 Subject: [PATCH 052/123] [Nignx] Update to 1.30.3 --- data/Dockerfiles/nginx/Dockerfile | 2 +- docker-compose.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/data/Dockerfiles/nginx/Dockerfile b/data/Dockerfiles/nginx/Dockerfile index 30297362..65b34838 100644 --- a/data/Dockerfiles/nginx/Dockerfile +++ b/data/Dockerfiles/nginx/Dockerfile @@ -1,4 +1,4 @@ -FROM nginx:1.30.2-alpine +FROM nginx:1.30.3-alpine LABEL maintainer "The Infrastructure Company GmbH " ENV PIP_BREAK_SYSTEM_PACKAGES=1 diff --git a/docker-compose.yml b/docker-compose.yml index cccf3a21..6f579a8a 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -419,7 +419,7 @@ services: - php-fpm-mailcow - sogo-mailcow - rspamd-mailcow - image: ghcr.io/mailcow/nginx:1.30.2-1 + image: ghcr.io/mailcow/nginx:1.30.3-1 dns: - ${IPV4_NETWORK:-172.22.1}.254 environment: From 1840074991c4c2f07163519dc0caef1a2ddc33f4 Mon Sep 17 00:00:00 2001 From: milkmaker Date: Wed, 1 Jul 2026 11:31:58 +0200 Subject: [PATCH 053/123] update postscreen_access.cidr (#7311) --- data/conf/postfix/postscreen_access.cidr | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/data/conf/postfix/postscreen_access.cidr b/data/conf/postfix/postscreen_access.cidr index 70fd2651..6fcedff9 100644 --- a/data/conf/postfix/postscreen_access.cidr +++ b/data/conf/postfix/postscreen_access.cidr @@ -1,6 +1,6 @@ -# Whitelist generated by Postwhite v3.4 on Mon Jun 1 00:52:17 UTC 2026 +# Whitelist generated by Postwhite v3.4 on Wed Jul 1 00:51:20 UTC 2026 # https://github.com/stevejenkins/postwhite/ -# 2186 total rules +# 2251 total rules 2a00:1450:4000::/36 permit 2a00:1450:4864::/56 permit 2a01:111:f400::/48 permit @@ -1528,7 +1528,7 @@ 149.97.173.180 permit 149.118.160.128/25 permit 150.136.21.199 permit -150.171.109.118 permit +150.171.109.183 permit 150.230.98.160 permit 151.145.38.14 permit 152.67.105.195 permit @@ -1605,6 +1605,12 @@ 164.152.25.241 permit 164.177.132.168/30 permit 165.1.100.0/25 permit +165.173.128.0/24 permit +165.173.180.0/24 permit +165.173.180.250/31 permit +165.173.182.0/24 permit +165.173.182.250/31 permit +165.173.189.205 permit 166.78.68.0/22 permit 166.78.68.221 permit 166.78.69.169 permit @@ -1651,6 +1657,7 @@ 173.203.81.39 permit 173.224.161.128/25 permit 173.224.165.0/26 permit +173.224.166.48/28 permit 174.36.84.8/29 permit 174.36.84.16/29 permit 174.36.84.32/29 permit @@ -2171,7 +2178,10 @@ 2001:748:400:3301::4 permit 2404:6800:4000::/36 permit 2404:6800:4864::/56 permit -2603:1061:14:40::1 permit +2603:1061:14:1c2::1 permit +2607:13c0:0001:0000:0000:0000:0000:7000/116 permit +2607:13c0:0002:0000:0000:0000:0000:1000/116 permit +2607:13c0:0004:0000:0000:0000:0000:0000/116 permit 2607:f8b0:4000::/36 permit 2607:f8b0:4864::/56 permit 2620:109:c003:104::/64 permit From 94e23a3cd33a2147e61af1e56e62ef11172a5a13 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Wed, 1 Jul 2026 09:32:23 +0000 Subject: [PATCH 054/123] Update dependency composer/composer to v2.10.2 Signed-off-by: milkmaker --- data/Dockerfiles/phpfpm/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/Dockerfiles/phpfpm/Dockerfile b/data/Dockerfiles/phpfpm/Dockerfile index 556c5012..ca252163 100644 --- a/data/Dockerfiles/phpfpm/Dockerfile +++ b/data/Dockerfiles/phpfpm/Dockerfile @@ -13,7 +13,7 @@ ARG MEMCACHED_PECL_VERSION=3.4.0 # renovate: datasource=github-tags depName=phpredis/phpredis versioning=semver-coerced extractVersion=(?.*)$ ARG REDIS_PECL_VERSION=6.3.0 # renovate: datasource=github-tags depName=composer/composer versioning=semver-coerced extractVersion=(?.*)$ -ARG COMPOSER_VERSION=2.10.1 +ARG COMPOSER_VERSION=2.10.2 RUN apk add -U --no-cache autoconf \ aspell-dev \ From 3098caebbc747f7b329a13f8ee9c381d7cc0452a Mon Sep 17 00:00:00 2001 From: DerLinkman Date: Fri, 10 Jul 2026 18:23:58 +0200 Subject: [PATCH 055/123] migrate postfix to trixie --- data/Dockerfiles/postfix/Dockerfile | 2 +- data/Dockerfiles/postfix/syslog-ng-redis_slave.conf | 4 ++-- data/Dockerfiles/postfix/syslog-ng.conf | 4 ++-- data/conf/postfix/main.cf | 2 -- data/conf/postfix/master.cf | 2 -- 5 files changed, 5 insertions(+), 9 deletions(-) diff --git a/data/Dockerfiles/postfix/Dockerfile b/data/Dockerfiles/postfix/Dockerfile index 994612ec..cf064769 100644 --- a/data/Dockerfiles/postfix/Dockerfile +++ b/data/Dockerfiles/postfix/Dockerfile @@ -1,4 +1,4 @@ -FROM debian:bookworm-slim +FROM debian:trixie-slim LABEL maintainer="The Infrastructure Company GmbH " diff --git a/data/Dockerfiles/postfix/syslog-ng-redis_slave.conf b/data/Dockerfiles/postfix/syslog-ng-redis_slave.conf index 8e15932a..bbc9420f 100644 --- a/data/Dockerfiles/postfix/syslog-ng-redis_slave.conf +++ b/data/Dockerfiles/postfix/syslog-ng-redis_slave.conf @@ -1,4 +1,4 @@ -@version: 3.38 +@version: 4.8 @include "scl.conf" options { chain_hostnames(off); @@ -7,7 +7,7 @@ options { dns_cache(no); use_fqdn(no); owner("root"); group("adm"); perm(0640); - stats_freq(0); + stats(freq(0)); bad_hostname("^gconfd$"); }; source s_src { diff --git a/data/Dockerfiles/postfix/syslog-ng.conf b/data/Dockerfiles/postfix/syslog-ng.conf index fc7d1aa0..8f09d04a 100644 --- a/data/Dockerfiles/postfix/syslog-ng.conf +++ b/data/Dockerfiles/postfix/syslog-ng.conf @@ -1,4 +1,4 @@ -@version: 3.38 +@version: 4.8 @include "scl.conf" options { chain_hostnames(off); @@ -7,7 +7,7 @@ options { dns_cache(no); use_fqdn(no); owner("root"); group("adm"); perm(0640); - stats_freq(0); + stats(freq(0)); bad_hostname("^gconfd$"); }; source s_src { diff --git a/data/conf/postfix/main.cf b/data/conf/postfix/main.cf index f091cb3f..a8e2521a 100644 --- a/data/conf/postfix/main.cf +++ b/data/conf/postfix/main.cf @@ -107,8 +107,6 @@ smtpd_sender_restrictions = reject_authenticated_sender_login_mismatch, reject_unknown_sender_domain smtpd_soft_error_limit = 3 smtpd_tls_auth_only = yes -smtpd_tls_dh1024_param_file = /etc/ssl/mail/dhparams.pem -smtpd_tls_eecdh_grade = auto smtpd_tls_exclude_ciphers = ECDHE-RSA-RC4-SHA, RC4, aNULL, DES-CBC3-SHA, ECDHE-RSA-DES-CBC3-SHA, EDH-RSA-DES-CBC3-SHA smtpd_tls_loglevel = 1 diff --git a/data/conf/postfix/master.cf b/data/conf/postfix/master.cf index d5114df2..fb49f2df 100644 --- a/data/conf/postfix/master.cf +++ b/data/conf/postfix/master.cf @@ -29,7 +29,6 @@ smtps inet n - n - - smtpd # TLS protocol can be modified by setting submission_smtpd_tls_mandatory_protocols in extra.cf submission inet n - n - - smtpd -o smtpd_client_restrictions=permit_mynetworks,permit_sasl_authenticated,reject - -o smtpd_enforce_tls=yes -o smtpd_tls_security_level=encrypt -o smtpd_tls_mandatory_protocols=$submission_smtpd_tls_mandatory_protocols -o tls_preempt_cipherlist=yes @@ -38,7 +37,6 @@ submission inet n - n - - smtpd 10587 inet n - n - - smtpd -o smtpd_upstream_proxy_protocol=haproxy -o smtpd_client_restrictions=permit_mynetworks,permit_sasl_authenticated,reject - -o smtpd_enforce_tls=yes -o smtpd_tls_security_level=encrypt -o smtpd_tls_mandatory_protocols=$submission_smtpd_tls_mandatory_protocols -o tls_preempt_cipherlist=yes From 98e26c56038f5918c585d7fe8e12a2b46a084ea3 Mon Sep 17 00:00:00 2001 From: DerLinkman Date: Fri, 10 Jul 2026 18:41:58 +0200 Subject: [PATCH 056/123] compose: upgrade Postfix --- docker-compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docker-compose.yml b/docker-compose.yml index 6f579a8a..f2a93921 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -339,7 +339,7 @@ services: - dovecot postfix-mailcow: - image: ghcr.io/mailcow/postfix:3.7.11-2 + image: ghcr.io/mailcow/postfix:3.10.12 depends_on: mysql-mailcow: condition: service_started From f6630e5b43e019a306c29985936ac9fbd5469ca6 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sun, 12 Jul 2026 15:19:49 +0200 Subject: [PATCH 057/123] Update actions/stale action to v10.4.0 (#7322) Signed-off-by: milkmaker Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- .github/workflows/close_old_issues_and_prs.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/close_old_issues_and_prs.yml b/.github/workflows/close_old_issues_and_prs.yml index 855684df..bba04b0d 100644 --- a/.github/workflows/close_old_issues_and_prs.yml +++ b/.github/workflows/close_old_issues_and_prs.yml @@ -14,7 +14,7 @@ jobs: pull-requests: write steps: - name: Mark/Close Stale Issues and Pull Requests 🗑️ - uses: actions/stale@v10.3.0 + uses: actions/stale@v10.4.0 with: repo-token: ${{ secrets.STALE_ACTION_PAT }} days-before-stale: 60 From d65aa11870bcc5dbcac108f9452b148b2f4e700a Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sun, 12 Jul 2026 15:20:18 +0200 Subject: [PATCH 058/123] Update devops-infra/action-pull-request action to v1.4.0 (#7321) Signed-off-by: milkmaker Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- .github/workflows/pr_to_nightly.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/pr_to_nightly.yml b/.github/workflows/pr_to_nightly.yml index 5c361af7..8d6b2524 100644 --- a/.github/workflows/pr_to_nightly.yml +++ b/.github/workflows/pr_to_nightly.yml @@ -12,7 +12,7 @@ jobs: with: fetch-depth: 0 - name: Run the Action - uses: devops-infra/action-pull-request@v1.3.0 + uses: devops-infra/action-pull-request@v1.4.0 with: github_token: ${{ secrets.PRTONIGHTLY_ACTION_PAT }} title: Automatic PR to nightly from ${{ github.event.repository.updated_at}} From e696ee2f6c1dd2db6ef3fbe415059b0b4192e7ff Mon Sep 17 00:00:00 2001 From: Ralf Bergs Date: Sun, 12 Jul 2026 17:22:15 +0200 Subject: [PATCH 059/123] Refined wording for displaying of active settings on quarantine page. --- data/web/lang/lang.de-de.json | 2 +- data/web/lang/lang.en-gb.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/data/web/lang/lang.de-de.json b/data/web/lang/lang.de-de.json index 17277a03..c19eb209 100644 --- a/data/web/lang/lang.de-de.json +++ b/data/web/lang/lang.de-de.json @@ -1086,7 +1086,7 @@ "rspamd_result": "Rspamd-Ergebnis", "sender": "Sender (SMTP)", "sender_header": "Sender (\"From\"-Header)", - "settings_info": "Maximale Anzahl der zurückgehaltenen E-Mails: %s
Maximale Größe einer zu speichernden E-Mail: %s MiB", + "settings_info": "Maximale Anzahl der zurückgehaltenen E-Mails (pro Mailbox): %s
Maximale Größe einer zu speichernden E-Mail: %s MiB", "show_item": "Details", "spam": "Spam", "spam_score": "Bewertung", diff --git a/data/web/lang/lang.en-gb.json b/data/web/lang/lang.en-gb.json index d2412fbf..873d7b98 100644 --- a/data/web/lang/lang.en-gb.json +++ b/data/web/lang/lang.en-gb.json @@ -1087,7 +1087,7 @@ "rspamd_result": "Rspamd result", "sender": "Sender (SMTP)", "sender_header": "Sender (\"From\" header)", - "settings_info": "Maximum amount of elements to be quarantined: %s
Maximum email size: %s MiB", + "settings_info": "Maximum amount of elements to be quarantined (per mailbox): %s
Maximum email size: %s MiB", "show_item": "Show item", "spam": "Spam", "spam_score": "Score", From 31e1550668d21ccad6127bee38b2eecc8fc4facc Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Mon, 13 Jul 2026 08:45:56 +0200 Subject: [PATCH 060/123] [Postfix] change postscreen blacklist_action to denylist_action --- data/conf/postfix/main.cf | 2 +- docker-compose.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/data/conf/postfix/main.cf b/data/conf/postfix/main.cf index a8e2521a..080be499 100644 --- a/data/conf/postfix/main.cf +++ b/data/conf/postfix/main.cf @@ -37,7 +37,7 @@ postscreen_access_list = permit_mynetworks, cidr:/opt/postfix/conf/postscreen_access.cidr, tcp:127.0.0.1:10027 postscreen_bare_newline_enable = no -postscreen_blacklist_action = drop +postscreen_denylist_action = drop postscreen_cache_cleanup_interval = 24h postscreen_cache_map = proxy:btree:$data_directory/postscreen_cache postscreen_dnsbl_action = enforce diff --git a/docker-compose.yml b/docker-compose.yml index f2a93921..30a7ba96 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -339,7 +339,7 @@ services: - dovecot postfix-mailcow: - image: ghcr.io/mailcow/postfix:3.10.12 + image: ghcr.io/mailcow/postfix:3.10.12-1 depends_on: mysql-mailcow: condition: service_started From 6f7fee49cd7ba844dc924285de07166e5af86bd2 Mon Sep 17 00:00:00 2001 From: Mohamed Fall Date: Mon, 13 Jul 2026 15:29:48 +0000 Subject: [PATCH 061/123] fix: cors allowed origins settings validation --- data/web/api/openapi.yaml | 4 ++-- data/web/inc/functions.inc.php | 34 +++++++++++++++++++++++++++++++--- 2 files changed, 33 insertions(+), 5 deletions(-) diff --git a/data/web/api/openapi.yaml b/data/web/api/openapi.yaml index 77c58b60..0aca6997 100644 --- a/data/web/api/openapi.yaml +++ b/data/web/api/openapi.yaml @@ -5856,7 +5856,7 @@ paths: response: value: - type: "success" - log: ["cors", "edit", {"allowed_origins": ["*", "mail.mailcow.tld"], "allowed_methods": ["POST", "GET", "DELETE", "PUT"]}] + log: ["cors", "edit", {"allowed_origins": ["*", "https://mail.mailcow.tld"], "allowed_methods": ["POST", "GET", "DELETE", "PUT"]}] msg: "cors_headers_edited" description: OK headers: { } @@ -5873,7 +5873,7 @@ paths: schema: example: attr: - allowed_origins: ["*", "mail.mailcow.tld"] + allowed_origins: ["*", "https://mail.mailcow.tld"] allowed_methods: ["POST", "GET", "DELETE", "PUT"] properties: attr: diff --git a/data/web/inc/functions.inc.php b/data/web/inc/functions.inc.php index 89f14b57..f9b0f6ab 100644 --- a/data/web/inc/functions.inc.php +++ b/data/web/inc/functions.inc.php @@ -53,6 +53,28 @@ function valid_network($network) { function valid_hostname($hostname) { return filter_var($hostname, FILTER_VALIDATE_DOMAIN, FILTER_FLAG_HOSTNAME); } +// Validates a browser-style Origin: scheme://host[:port], no path/query/fragment/credentials +function valid_origin($origin) { + $parts = parse_url($origin); + if ($parts === false || !isset($parts['scheme']) || !isset($parts['host'])) { + return false; + } + if (!in_array(strtolower($parts['scheme']), array('http', 'https'), true)) { + return false; + } + if (isset($parts['user']) || isset($parts['pass']) || isset($parts['path']) || isset($parts['query']) || isset($parts['fragment'])) { + return false; + } + $host = $parts['host']; + $host_without_brackets = trim($host, '[]'); + if (!valid_hostname($host_without_brackets) && !filter_var($host_without_brackets, FILTER_VALIDATE_IP)) { + return false; + } + // Reject anything that doesn't round-trip to the exact same origin (e.g. stray trailing slash) + $port = isset($parts['port']) ? ':' . $parts['port'] : ''; + $rebuilt = strtolower($parts['scheme']) . '://' . strtolower($host) . $port; + return strtolower($origin) === $rebuilt; +} // Thanks to https://stackoverflow.com/a/49373789 // Validates exact ip matches and ip-in-cidr, ipv4 and ipv6 function ip_acl($ip, $networks) { @@ -2283,10 +2305,13 @@ function cors($action, $data = null) { return false; } - $allowed_origins = isset($data['allowed_origins']) ? $data['allowed_origins'] : array($_SERVER['SERVER_NAME']); + $allowed_origins = isset($data['allowed_origins']) ? $data['allowed_origins'] : array(getBaseURL()); $allowed_origins = !is_array($allowed_origins) ? array_filter(array_map('trim', explode("\n", $allowed_origins))) : $allowed_origins; - foreach ($allowed_origins as $origin) { - if (!filter_var($origin, FILTER_VALIDATE_DOMAIN, FILTER_FLAG_HOSTNAME) && $origin != '*') { + foreach ($allowed_origins as &$origin) { + if ($origin === '*') { + continue; + } + if (!valid_origin($origin)) { $_SESSION['return'][] = array( 'type' => 'danger', 'log' => array(__FUNCTION__, $action, $data), @@ -2294,7 +2319,10 @@ function cors($action, $data = null) { ); return false; } + // browsers always send a lowercase scheme/host in the Origin header, so normalize to match + $origin = strtolower($origin); } + unset($origin); $allowed_methods = isset($data['allowed_methods']) ? $data['allowed_methods'] : array('GET', 'POST', 'PUT', 'DELETE'); $allowed_methods = !is_array($allowed_methods) ? array_map('trim', preg_split( "/( |,|;|\n)/", $allowed_methods)) : $allowed_methods; From fffe1aec3d16a2933cbfbbb30ceb8b4a2cd862dd Mon Sep 17 00:00:00 2001 From: DerLinkman Date: Mon, 13 Jul 2026 19:16:10 +0200 Subject: [PATCH 062/123] postfix-tlspol: upgrade to trixie + 1.11.0 update --- data/Dockerfiles/postfix-tlspol/Dockerfile | 6 +++--- data/Dockerfiles/postfix-tlspol/syslog-ng-redis_slave.conf | 4 ++-- data/Dockerfiles/postfix-tlspol/syslog-ng.conf | 4 ++-- docker-compose.yml | 2 +- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/data/Dockerfiles/postfix-tlspol/Dockerfile b/data/Dockerfiles/postfix-tlspol/Dockerfile index 68f6ecce..fa363845 100644 --- a/data/Dockerfiles/postfix-tlspol/Dockerfile +++ b/data/Dockerfiles/postfix-tlspol/Dockerfile @@ -1,17 +1,17 @@ -FROM golang:1.25-bookworm AS builder +FROM golang:1.26-trixie AS builder WORKDIR /src ENV CGO_ENABLED=0 \ GO111MODULE=on \ NOOPT=1 \ - VERSION=1.8.22 + VERSION=1.11.0 RUN git clone --branch v${VERSION} https://github.com/Zuplu/postfix-tlspol && \ cd /src/postfix-tlspol && \ scripts/build.sh build-only -FROM debian:bookworm-slim +FROM debian:trixie-slim LABEL maintainer="The Infrastructure Company GmbH " ARG DEBIAN_FRONTEND=noninteractive diff --git a/data/Dockerfiles/postfix-tlspol/syslog-ng-redis_slave.conf b/data/Dockerfiles/postfix-tlspol/syslog-ng-redis_slave.conf index 3862a354..022dfc3d 100644 --- a/data/Dockerfiles/postfix-tlspol/syslog-ng-redis_slave.conf +++ b/data/Dockerfiles/postfix-tlspol/syslog-ng-redis_slave.conf @@ -1,4 +1,4 @@ -@version: 3.38 +@version: 4.8 @include "scl.conf" options { chain_hostnames(off); @@ -7,7 +7,7 @@ options { dns_cache(no); use_fqdn(no); owner("root"); group("adm"); perm(0640); - stats_freq(0); + stats(freq(0)); bad_hostname("^gconfd$"); }; source s_src { diff --git a/data/Dockerfiles/postfix-tlspol/syslog-ng.conf b/data/Dockerfiles/postfix-tlspol/syslog-ng.conf index 7126c125..70c92b5c 100644 --- a/data/Dockerfiles/postfix-tlspol/syslog-ng.conf +++ b/data/Dockerfiles/postfix-tlspol/syslog-ng.conf @@ -1,4 +1,4 @@ -@version: 3.38 +@version: 4.8 @include "scl.conf" options { chain_hostnames(off); @@ -7,7 +7,7 @@ options { dns_cache(no); use_fqdn(no); owner("root"); group("adm"); perm(0640); - stats_freq(0); + stats(freq(0)); bad_hostname("^gconfd$"); }; source s_src { diff --git a/docker-compose.yml b/docker-compose.yml index 30a7ba96..b3cb8bef 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -382,7 +382,7 @@ services: - postfix postfix-tlspol-mailcow: - image: ghcr.io/mailcow/postfix-tlspol:1.8.23 + image: ghcr.io/mailcow/postfix-tlspol:1.11.0 depends_on: unbound-mailcow: condition: service_healthy From 0f06c8e5637ebe2ec1b95d8ef469a1f5a9c803c9 Mon Sep 17 00:00:00 2001 From: DerLinkman Date: Mon, 13 Jul 2026 19:34:58 +0200 Subject: [PATCH 063/123] postfix: prepare TLSRPT compatibility for tlspol --- data/conf/postfix/main.cf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/conf/postfix/main.cf b/data/conf/postfix/main.cf index 080be499..4329f548 100644 --- a/data/conf/postfix/main.cf +++ b/data/conf/postfix/main.cf @@ -150,7 +150,7 @@ smtp_sasl_auth_enable = yes smtp_sasl_password_maps = proxy:mysql:/opt/postfix/conf/sql/mysql_sasl_passwd_maps_sender_dependent.cf smtp_sasl_security_options = smtp_sasl_mechanism_filter = plain, login -smtp_tls_policy_maps = proxy:mysql:/opt/postfix/conf/sql/mysql_tls_policy_override_maps.cf socketmap:inet:postfix-tlspol:8642:QUERY +smtp_tls_policy_maps = proxy:mysql:/opt/postfix/conf/sql/mysql_tls_policy_override_maps.cf socketmap:inet:postfix-tlspol:8642:QUERYwithTLSRPT smtp_header_checks = pcre:/opt/postfix/conf/anonymize_headers.pcre mail_name = Postcow # local_transport map catches local destinations and prevents routing local dests when the next map would route "*" From bd5c18b145707b1488411f2dafea8e0603e62047 Mon Sep 17 00:00:00 2001 From: Paul Seebach Date: Sat, 21 Mar 2026 15:54:34 +0100 Subject: [PATCH 064/123] [Web] Add show/hide password toggle on login pages Adds an eye icon button to the password field on the user, admin, and domain admin login pages. Clicking it toggles between hidden and visible password text, using Bootstrap Icons (bi-eye / bi-eye-slash). Closes #6893 --- data/web/templates/admin_index.twig | 1 + data/web/templates/domainadmin_index.twig | 1 + data/web/templates/user_index.twig | 1 + 3 files changed, 3 insertions(+) diff --git a/data/web/templates/admin_index.twig b/data/web/templates/admin_index.twig index 0dcb9145..12e1b6cd 100644 --- a/data/web/templates/admin_index.twig +++ b/data/web/templates/admin_index.twig @@ -49,6 +49,7 @@
+
diff --git a/data/web/templates/domainadmin_index.twig b/data/web/templates/domainadmin_index.twig index 2fc7bad9..3e76cf2e 100644 --- a/data/web/templates/domainadmin_index.twig +++ b/data/web/templates/domainadmin_index.twig @@ -49,6 +49,7 @@
+
diff --git a/data/web/templates/user_index.twig b/data/web/templates/user_index.twig index 28eb6389..2e843e0d 100644 --- a/data/web/templates/user_index.twig +++ b/data/web/templates/user_index.twig @@ -56,6 +56,7 @@
+
From 5408bc809d4304806fb1a54baf099e0bc9dd9e56 Mon Sep 17 00:00:00 2001 From: Paul Seebach Date: Sat, 21 Mar 2026 15:59:29 +0100 Subject: [PATCH 065/123] [Web] Use input-group-text for password toggle button Replaces btn-outline-secondary with input-group-text so the toggle button border matches the surrounding input group consistently. --- data/web/templates/admin_index.twig | 2 +- data/web/templates/domainadmin_index.twig | 2 +- data/web/templates/user_index.twig | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/data/web/templates/admin_index.twig b/data/web/templates/admin_index.twig index 12e1b6cd..44b3564c 100644 --- a/data/web/templates/admin_index.twig +++ b/data/web/templates/admin_index.twig @@ -49,7 +49,7 @@
- +
diff --git a/data/web/templates/domainadmin_index.twig b/data/web/templates/domainadmin_index.twig index 3e76cf2e..af667756 100644 --- a/data/web/templates/domainadmin_index.twig +++ b/data/web/templates/domainadmin_index.twig @@ -49,7 +49,7 @@
- +
diff --git a/data/web/templates/user_index.twig b/data/web/templates/user_index.twig index 2e843e0d..a06cdb3f 100644 --- a/data/web/templates/user_index.twig +++ b/data/web/templates/user_index.twig @@ -56,7 +56,7 @@
- +
From 7dab6c63d1daf37281c624a73d236a21cdf23934 Mon Sep 17 00:00:00 2001 From: Stephen Ritz <127270018+smpaz7467@users.noreply.github.com> Date: Tue, 14 Jul 2026 14:54:28 -0700 Subject: [PATCH 066/123] [Nginx] only bind IPv6 default_server when ENABLE_IPV6 is set The HTTP-to-HTTPS redirect server block bound `listen [::]:{{ HTTP_PORT }} default_server` unconditionally, while every other IPv6 listen directive in this template is guarded by `{% if ENABLE_IPV6 %}`. On hosts where IPv6 is disabled at the kernel level, nginx cannot bind `::` and fails to start. This only triggers when HTTP_REDIRECT is enabled and ENABLE_IPV6 is false, which is why it survives testing with ENABLE_IPV6=false alone. Guard the directive like the other six IPv6 listeners in the template. Refs #7296 Co-Authored-By: Claude Opus 4.8 (1M context) --- data/conf/nginx/templates/nginx.conf.j2 | 2 ++ 1 file changed, 2 insertions(+) diff --git a/data/conf/nginx/templates/nginx.conf.j2 b/data/conf/nginx/templates/nginx.conf.j2 index 08a85a14..8f7e5a24 100644 --- a/data/conf/nginx/templates/nginx.conf.j2 +++ b/data/conf/nginx/templates/nginx.conf.j2 @@ -47,7 +47,9 @@ http { server { root /web; listen {{ HTTP_PORT }} default_server; + {% if ENABLE_IPV6 %} listen [::]:{{ HTTP_PORT }} default_server; + {%endif%} server_name {{ MAILCOW_HOSTNAME }} autodiscover.* autoconfig.* mta-sts.* {{ ADDITIONAL_SERVER_NAMES | join(' ') }}; From 4cba4486715c63e3b7727d26a1a92b6465a7619c Mon Sep 17 00:00:00 2001 From: Stephen Ritz <127270018+smpaz7467@users.noreply.github.com> Date: Tue, 14 Jul 2026 15:11:17 -0700 Subject: [PATCH 067/123] [Web] translate password errors in the forced password change modal The forced password change modal posts to the JSON API and renders data[0].msg directly. The API returns raw language keys rather than translated strings, so a user who fails the complexity policy is shown the literal text "password_complexity" instead of a message. Every other password form renders errors through alertbox_log_parser(), which resolves the key against $lang. The modal is the only one that talks to the API directly, and it never resolved the key. Resolve it against lang_danger, which base.twig already exposes for this purpose. This also covers password_mismatch, password_empty and access_denied, and applies to the admin path as well. Unknown keys still fall through unchanged. The lookup is guarded with hasOwnProperty because msg is attacker- independent but dynamic: a bare lang_danger[msg] would resolve inherited Object.prototype members such as "constructor" to a function, which jQuery's .text() would then invoke as a callback. Language files are untouched: prerequisites.inc.php loads lang.en-gb.json as the base and merges the active locale over it, so locales that lack the key inherit the English string. Fixes #7301 Co-Authored-By: Claude Opus 4.8 (1M context) --- data/web/templates/base.twig | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/data/web/templates/base.twig b/data/web/templates/base.twig index 9e20b08a..e0f3b5b3 100644 --- a/data/web/templates/base.twig +++ b/data/web/templates/base.twig @@ -473,6 +473,10 @@ function recursiveBase64StrToArrayBuffer(obj) { window.location.reload(); } else { var msg = (data && data[0] && data[0].msg) ? data[0].msg : 'Password change failed.'; + // the API returns raw language keys, resolve them like the alert box does + if (Object.prototype.hasOwnProperty.call(lang_danger, msg)) { + msg = lang_danger[msg]; + } $('#changePWAlert').show().text(msg); } }, From c17cc8a7922946434f84a3220e0f5ec32419cc4a Mon Sep 17 00:00:00 2001 From: Stephen Ritz <127270018+smpaz7467@users.noreply.github.com> Date: Tue, 14 Jul 2026 15:23:31 -0700 Subject: [PATCH 068/123] [Web] fix add/time_limited_alias silently discarding requests and validity Three defects in add/time_limited_alias: The description was read as $_data['description'] without a guard. When a client omits it, null is bound to spamalias.description, which is TEXT NOT NULL, so the insert raises a PDOException. The global exception handler is terminal, so process_add_return() never echoes anything and the caller sees HTTP 200 with an empty body while no alias was created. Default it to an empty string instead. The validity guard used a single condition whose else branch also caught the success case, so every valid validity was overwritten with the 8760 hour default and the parameter did nothing. Only invalid values were rejected. Nest the range check so a valid value survives. The OpenAPI spec documented only username and domain, while the code also reads description, validity and permanent. Spec driven clients therefore could not construct a working request. Document all three. spamalias.description is the only NOT NULL description column in the schema, which is why the same unguarded read in add/domain and add/resource does not fail, both of those columns are nullable. This does not change the generic exception handling. A database error is still swallowed into an empty HTTP 200, and the message the handler builds carries the raw PDOException, so surfacing it to API clients would need sanitising first. That is left for a separate change. Refs #7287 Co-Authored-By: Claude Opus 4.8 (1M context) --- data/web/api/openapi.yaml | 12 ++++++++++++ data/web/inc/functions.mailbox.inc.php | 19 +++++++++++-------- 2 files changed, 23 insertions(+), 8 deletions(-) diff --git a/data/web/api/openapi.yaml b/data/web/api/openapi.yaml index 77c58b60..ee154c4d 100644 --- a/data/web/api/openapi.yaml +++ b/data/web/api/openapi.yaml @@ -185,6 +185,9 @@ paths: example: username: info@domain.tld domain: domain.tld + description: my time limited alias + validity: 8760 + permanent: false properties: username: description: 'the mailbox an alias should be created for' @@ -192,6 +195,15 @@ paths: domain: description: "the domain" type: string + description: + description: "a description for the alias, defaults to an empty string" + type: string + validity: + description: "how many hours the alias stays valid, 1 to 87600, defaults to 8760 (one year)" + type: integer + permanent: + description: "keep the alias after it expired, defaults to false" + type: boolean type: object summary: Create time limited alias /api/v1/add/app-passwd: diff --git a/data/web/inc/functions.mailbox.inc.php b/data/web/inc/functions.mailbox.inc.php index a9f17705..3a002864 100644 --- a/data/web/inc/functions.mailbox.inc.php +++ b/data/web/inc/functions.mailbox.inc.php @@ -41,13 +41,15 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) { else { $username = $_SESSION['mailcow_cc_username']; } - if (isset($_data["validity"]) && !filter_var($_data["validity"], FILTER_VALIDATE_INT, array('options' => array('min_range' => 1, 'max_range' => 87600)))) { - $_SESSION['return'][] = array( - 'type' => 'danger', - 'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr), - 'msg' => 'validity_missing' - ); - return false; + if (isset($_data["validity"])) { + if (!filter_var($_data["validity"], FILTER_VALIDATE_INT, array('options' => array('min_range' => 1, 'max_range' => 87600)))) { + $_SESSION['return'][] = array( + 'type' => 'danger', + 'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr), + 'msg' => 'validity_missing' + ); + return false; + } } else { // Default to 1 yr @@ -60,7 +62,8 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) { $permanent = 0; } $domain = $_data['domain']; - $description = $_data['description']; + // spamalias.description is NOT NULL, an absent description must not become a null insert + $description = $_data['description'] ?? ''; $valid_domains[] = mailbox('get', 'mailbox_details', $username)['domain']; $valid_alias_domains = user_get_alias_details($username)['alias_domains']; if (!empty($valid_alias_domains)) { From e5d0ed8c4c092f8a63b697c41e2f5408b9267028 Mon Sep 17 00:00:00 2001 From: Stephen Ritz <127270018+smpaz7467@users.noreply.github.com> Date: Tue, 14 Jul 2026 16:33:46 -0700 Subject: [PATCH 069/123] [Web] use absolute RHS names in generated DNS zonefile The DNS overview "Download" produces a $ORIGIN zonefile, but the right-hand side of MX, CNAME and SRV records was emitted as a relative name. A target such as mail.example.net is then read relative to the origin and expands to mail.example.net.example.org., which is wrong. The only prior attempt at making names absolute was str_replace($domain, $domain . '.', ...), which appended a dot only to targets that happened to contain the origin domain, so cross-domain targets stayed relative. That same replace also corrupted any TXT value containing the origin (e.g. a DMARC rua=mailto:x@example.org became ...@example.org.). Absolutize the RHS per record type at export time only: MX and CNAME targets, and the SRV target token, get a trailing dot; ports, the SRV root target ".", IP addresses and TXT character strings are left as is. The records used for the on-page DNS validation are untouched, so matching against dns_get_record() output still works. Fixes #6984 Co-Authored-By: Claude Opus 4.8 (1M context) --- data/web/inc/ajax/dns_diagnostics.php | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/data/web/inc/ajax/dns_diagnostics.php b/data/web/inc/ajax/dns_diagnostics.php index 95e34e88..1987a88c 100644 --- a/data/web/inc/ajax/dns_diagnostics.php +++ b/data/web/inc/ajax/dns_diagnostics.php @@ -442,6 +442,16 @@ if (isset($_SESSION['mailcow_cc_role']) && ($_SESSION['mailcow_cc_role'] == "adm unset($record); + // Make a hostname RHS absolute so it is not read relative to $ORIGIN. + // Already-absolute names, the SRV root target "." and IP addresses are left alone. + $absolutize = function($host) { + $host = trim($host); + if ($host === '' || $host === '.' || substr($host, -1) === '.' || filter_var($host, FILTER_VALIDATE_IP)) { + return $host; + } + return $host . '.'; + }; + $dns_data = sprintf("\$ORIGIN %s.\n", $domain); foreach ($records as $record) { if ($domain == substr($record[0], -strlen($domain))) { @@ -462,16 +472,26 @@ if (isset($_SESSION['mailcow_cc_role']) && ($_SESSION['mailcow_cc_role'] == "adm $val = str_replace(state_optional, '', $val); $val = str_replace(state_good, '', $val); if (strlen($val) > 0) { + // these are all TXT values, their RHS is a character string, not a name $vals[] = sprintf("%s\tIN\t%s\t%s\n", $label, $record[1], $val); } } } else { + if ($record[1] == 'MX' || $record[1] == 'CNAME') { + $val = $absolutize($val); + } + elseif ($record[1] == 'SRV') { + // format here is "target port"; only the target is a name + $parts = explode(' ', $val, 2); + $parts[0] = $absolutize($parts[0]); + $val = implode(' ', $parts); + } $vals[] = sprintf("%s\tIN\t%s\t%s\n", $label, $record[1], $val); } foreach ($vals as $val) { - $dns_data .= str_replace($domain, $domain . '.', $val); + $dns_data .= $val; } } } From 14772c3a204b14d3249936d56873a82a3870d47e Mon Sep 17 00:00:00 2001 From: Stephen Ritz <127270018+smpaz7467@users.noreply.github.com> Date: Tue, 14 Jul 2026 16:36:40 -0700 Subject: [PATCH 070/123] [Web] return sender_acl in get/mailbox API sender_acl can be set through edit/mailbox but was never returned by get/mailbox, so an API client could not read back what it had written, and get/mailbox/all / get/mailbox/{mailbox} both omitted it. Add the mailbox's internal send-as ACL (the sender_acl table rows with external = 0) to mailbox_details as sender_acl, an array of send_as values, mirroring the field edit/mailbox accepts. It is added in the same block as the other detailed fields, so the lightweight get/mailbox/reduced endpoint is unaffected. Fixes #7011 Co-Authored-By: Claude Opus 4.8 (1M context) --- data/web/inc/functions.mailbox.inc.php | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/data/web/inc/functions.mailbox.inc.php b/data/web/inc/functions.mailbox.inc.php index a9f17705..ba2756a4 100644 --- a/data/web/inc/functions.mailbox.inc.php +++ b/data/web/inc/functions.mailbox.inc.php @@ -5320,6 +5320,14 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) { $mailboxdata['rl_scope'] = 'domain'; } $mailboxdata['is_relayed'] = $row['backupmx']; + // Internal send-as ACL for this mailbox, mirrors the sender_acl field accepted by edit/mailbox + $mailboxdata['sender_acl'] = array(); + $stmt = $pdo->prepare("SELECT `send_as` FROM `sender_acl` WHERE `logged_in_as` = :username AND `external` = '0'"); + $stmt->execute(array(':username' => $_data)); + $sender_acl_rows = $stmt->fetchAll(PDO::FETCH_ASSOC); + foreach ($sender_acl_rows as $sender_acl_row) { + $mailboxdata['sender_acl'][] = $sender_acl_row['send_as']; + } } $stmt = $pdo->prepare("SELECT `tag_name` FROM `tags_mailbox` WHERE `username`= :username"); From 90ca1bf25ac356e02525f33a1c4ecc8980fadc03 Mon Sep 17 00:00:00 2001 From: Stephen Ritz <127270018+smpaz7467@users.noreply.github.com> Date: Tue, 14 Jul 2026 16:39:19 -0700 Subject: [PATCH 071/123] [Web] redirect deep links to the matching login page An unauthenticated request to a deep link such as /admin/dashboard was redirected to /, the user login, instead of the admin login. protect_route always sent unauthenticated visitors to /. Pick the login page from the request path: /admin/* redirects to /admin, /domainadmin/* to /domainadmin, everything else to / as before. Fixes #7284 Co-Authored-By: Claude Opus 4.8 (1M context) --- data/web/inc/functions.inc.php | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/data/web/inc/functions.inc.php b/data/web/inc/functions.inc.php index 89f14b57..a796f158 100644 --- a/data/web/inc/functions.inc.php +++ b/data/web/inc/functions.inc.php @@ -3503,7 +3503,16 @@ function protect_route($allowed_roles = ['admin', 'domainadmin', 'user'], $redir if (isset($redirects['unauthenticated'])) { header('Location: ' . $redirects['unauthenticated']); } else { - header('Location: /'); + // Send a deep link to the login page for its area instead of the user login at /, + // e.g. /admin/dashboard -> /admin rather than / + $request_uri = isset($_SERVER['REQUEST_URI']) ? $_SERVER['REQUEST_URI'] : '/'; + if (strpos($request_uri, '/admin/') === 0) { + header('Location: /admin'); + } elseif (strpos($request_uri, '/domainadmin/') === 0) { + header('Location: /domainadmin'); + } else { + header('Location: /'); + } } exit(); } From 4b62af9d023d5bda57f85293513631013eccd8df Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Wed, 15 Jul 2026 08:29:46 +0200 Subject: [PATCH 072/123] update README.md sponsors --- README.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/README.md b/README.md index 40288f10..8844c748 100644 --- a/README.md +++ b/README.md @@ -23,6 +23,9 @@ A big thank you to everyone supporting us on GitHub Sponsors—your contribution + ### 50$/Month Sponsors Date: Mon, 20 Jul 2026 21:31:57 +0200 Subject: [PATCH 073/123] Update Dockerfile bump nginx version to 1.30.4 --- data/Dockerfiles/nginx/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/Dockerfiles/nginx/Dockerfile b/data/Dockerfiles/nginx/Dockerfile index 65b34838..d3280a33 100644 --- a/data/Dockerfiles/nginx/Dockerfile +++ b/data/Dockerfiles/nginx/Dockerfile @@ -1,4 +1,4 @@ -FROM nginx:1.30.3-alpine +FROM nginx:1.30.4-alpine LABEL maintainer "The Infrastructure Company GmbH " ENV PIP_BREAK_SYSTEM_PACKAGES=1 From 8c9524a2fe5d765e82a65565fffde967ba726306 Mon Sep 17 00:00:00 2001 From: SYNLINQ <69972447+SYNLINQ@users.noreply.github.com> Date: Mon, 20 Jul 2026 21:32:57 +0200 Subject: [PATCH 074/123] Update docker-compose.yml reference patched nginx image --- docker-compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docker-compose.yml b/docker-compose.yml index 30a7ba96..dab078c8 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -419,7 +419,7 @@ services: - php-fpm-mailcow - sogo-mailcow - rspamd-mailcow - image: ghcr.io/mailcow/nginx:1.30.3-1 + image: ghcr.io/mailcow/nginx:1.30.4 dns: - ${IPV4_NETWORK:-172.22.1}.254 environment: From ddd76d99cdf0ec36e5e83e0cc3939d1e1149bfd8 Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Thu, 23 Jul 2026 10:10:29 +0200 Subject: [PATCH 075/123] [Web] Add sogo_auth_internal nginx marker for sogo-auth.php --- data/conf/nginx/templates/nginx.conf.j2 | 5 +++++ data/conf/nginx/templates/sites-default.conf.j2 | 2 ++ data/web/sogo-auth.php | 8 ++++++-- 3 files changed, 13 insertions(+), 2 deletions(-) diff --git a/data/conf/nginx/templates/nginx.conf.j2 b/data/conf/nginx/templates/nginx.conf.j2 index 08a85a14..aaf4a6fb 100644 --- a/data/conf/nginx/templates/nginx.conf.j2 +++ b/data/conf/nginx/templates/nginx.conf.j2 @@ -42,6 +42,11 @@ http { https https; } + map $server_port $sogo_auth_internal { + 65510 "1"; + default ""; + } + {% if HTTP_REDIRECT %} # HTTP to HTTPS redirect server { diff --git a/data/conf/nginx/templates/sites-default.conf.j2 b/data/conf/nginx/templates/sites-default.conf.j2 index 84bd8eae..688f2baa 100644 --- a/data/conf/nginx/templates/sites-default.conf.j2 +++ b/data/conf/nginx/templates/sites-default.conf.j2 @@ -116,6 +116,8 @@ location ~ \.php$ { include /etc/nginx/fastcgi_params; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; fastcgi_param PATH_INFO $fastcgi_path_info; + # trusted internal-auth marker; empty for external clients (see nginx.conf map) + fastcgi_param SOGO_AUTH_INTERNAL $sogo_auth_internal; fastcgi_read_timeout 3600; fastcgi_send_timeout 3600; } diff --git a/data/web/sogo-auth.php b/data/web/sogo-auth.php index 07456a7d..e2431bfe 100644 --- a/data/web/sogo-auth.php +++ b/data/web/sogo-auth.php @@ -8,8 +8,12 @@ $ALLOW_ADMIN_EMAIL_LOGIN = (preg_match( $session_var_user_allowed = 'sogo-sso-user-allowed'; $session_var_pass = 'sogo-sso-pass'; +// only the internal nginx auth_request loopback (127.0.0.1:65510) sets this; +// external clients can never supply it (bare fastcgi param, not an HTTP header) +$is_internal_auth = (($_SERVER['SOGO_AUTH_INTERNAL'] ?? '') === '1'); + // validate credentials for basic auth requests -if (isset($_SERVER['PHP_AUTH_USER'])) { +if ($is_internal_auth && isset($_SERVER['PHP_AUTH_USER'])) { // load prerequisites only when required require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php'; @@ -80,7 +84,7 @@ elseif (isset($_GET['login'])) { exit; } // only check for admin-login on sogo GUI requests -elseif (isset($_SERVER['HTTP_X_ORIGINAL_URI']) && strcasecmp(substr($_SERVER['HTTP_X_ORIGINAL_URI'], 0, 9), "/SOGo/so/") === 0) { +elseif ($is_internal_auth && isset($_SERVER['HTTP_X_ORIGINAL_URI']) && strcasecmp(substr($_SERVER['HTTP_X_ORIGINAL_URI'], 0, 9), "/SOGo/so/") === 0) { // this is an nginx auth_request call, we check for existing sogo-sso session variables require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/vars.inc.php'; if (file_exists($_SERVER['DOCUMENT_ROOT'] . '/inc/vars.local.inc.php')) { From 8e72d22c5664f498c7a22f2639e3c622076ced75 Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Thu, 23 Jul 2026 11:17:55 +0200 Subject: [PATCH 076/123] [Web] Escape rspamd_history and rllog --- data/web/js/site/dashboard.js | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/data/web/js/site/dashboard.js b/data/web/js/site/dashboard.js index aee36171..198a0639 100644 --- a/data/web/js/site/dashboard.js +++ b/data/web/js/site/dashboard.js @@ -1089,6 +1089,8 @@ jQuery(function($){ return str; }).join('
\n'); item.subject = escapeHtml(item.subject); + if (item.sender_mime != null) item.sender_mime = escapeHtml(item.sender_mime); + if (item['message-id'] != null) item['message-id'] = escapeHtml(item['message-id']); var scan_time = item.time_real.toFixed(3); if (item.time_virtual) { scan_time += ' / ' + item.time_virtual.toFixed(3); @@ -1212,6 +1214,11 @@ jQuery(function($){ }); } else if (table == 'rllog') { $.each(data, function (i, item) { + if (item.header_from != null) item.header_from = escapeHtml(item.header_from); + if (item.header_subject != null) item.header_subject = escapeHtml(item.header_subject); + if (item.from != null) item.from = escapeHtml(item.from); + if (item.rcpt != null) item.rcpt = escapeHtml(item.rcpt); + if (item.message_id != null) item.message_id = escapeHtml(item.message_id); if (item.user == null) { item.user = "none"; } From 145745329e02a2275554583091d6accdb5f17ece Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Thu, 23 Jul 2026 15:01:44 +0200 Subject: [PATCH 077/123] [Web] add dot stuffing for quarantine raw release --- data/web/inc/functions.quarantine.inc.php | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/data/web/inc/functions.quarantine.inc.php b/data/web/inc/functions.quarantine.inc.php index 5df86ef3..c89b3e40 100644 --- a/data/web/inc/functions.quarantine.inc.php +++ b/data/web/inc/functions.quarantine.inc.php @@ -22,7 +22,7 @@ function quarantine($_action, $_data = null) { return false; } $stmt = $pdo->prepare('SELECT `id` FROM `quarantine` LEFT OUTER JOIN `user_acl` ON `user_acl`.`username` = `rcpt` - WHERE `qhash` = :hash + WHERE `qhash` = :hash AND user_acl.quarantine = 1 AND rcpt IN (SELECT username FROM mailbox)'); $stmt->execute(array(':hash' => $hash)); @@ -65,7 +65,7 @@ function quarantine($_action, $_data = null) { return false; } $stmt = $pdo->prepare('SELECT `id` FROM `quarantine` LEFT OUTER JOIN `user_acl` ON `user_acl`.`username` = `rcpt` - WHERE `qhash` = :hash + WHERE `qhash` = :hash AND `user_acl`.`quarantine` = 1 AND `username` IN (SELECT `username` FROM `mailbox`)'); $stmt->execute(array(':hash' => $hash)); @@ -170,6 +170,8 @@ function quarantine($_action, $_data = null) { } elseif ($release_format == 'raw') { $detail_row['msg'] = preg_replace('/^X-Spam-Flag: (.*)/m', 'X-Pre-Release-Spam-Flag: $1', $detail_row['msg']); + // dot-stuffing per RFC5321 4.5.2: escape leading dots + $detail_row['msg'] = preg_replace('~^\.~m', '..', $detail_row['msg']); $postfix_talk = array( array('220', 'HELO quarantine' . chr(10)), array('250', 'MAIL FROM: ' . $sender . chr(10)), @@ -180,7 +182,7 @@ function quarantine($_action, $_data = null) { array('221', '') ); // Thanks to https://stackoverflow.com/questions/6632399/given-an-email-as-raw-text-how-can-i-send-it-using-php - $smtp_connection = fsockopen($postfix, 590, $errno, $errstr, 1); + $smtp_connection = fsockopen($postfix, 590, $errno, $errstr, 1); if (!$smtp_connection) { logger(array('return' => array( array( @@ -192,7 +194,7 @@ function quarantine($_action, $_data = null) { return false; } for ($i=0; $i < count($postfix_talk); $i++) { - $smtp_resource = fgets($smtp_connection, 256); + $smtp_resource = fgets($smtp_connection, 256); if (substr($smtp_resource, 0, 3) !== $postfix_talk[$i][0]) { $ret = substr($smtp_resource, 0, 3); $ret = (empty($ret)) ? '-' : $ret; @@ -465,17 +467,19 @@ function quarantine($_action, $_data = null) { } elseif ($release_format == 'raw') { $row['msg'] = preg_replace('/^X-Spam-Flag: (.*)/m', 'X-Pre-Release-Spam-Flag: $1', $row['msg']); + // dot-stuffing per RFC5321 4.5.2: escape leading dots + $row['msg'] = preg_replace('~^\.~m', '..', $row['msg']); $postfix_talk = array( array('220', 'HELO quarantine' . chr(10)), array('250', 'MAIL FROM: ' . $sender . chr(10)), array('250', 'RCPT TO: ' . $row['rcpt'] . chr(10)), array('250', 'DATA' . chr(10)), - array('354', str_replace("\n.", '', $row['msg']) . chr(10) . '.' . chr(10)), + array('354', $row['msg'] . chr(10) . '.' . chr(10)), array('250', 'QUIT' . chr(10)), array('221', '') ); // Thanks to https://stackoverflow.com/questions/6632399/given-an-email-as-raw-text-how-can-i-send-it-using-php - $smtp_connection = fsockopen($postfix, 590, $errno, $errstr, 1); + $smtp_connection = fsockopen($postfix, 590, $errno, $errstr, 1); if (!$smtp_connection) { $_SESSION['return'][] = array( 'type' => 'warning', @@ -485,7 +489,7 @@ function quarantine($_action, $_data = null) { return false; } for ($i=0; $i < count($postfix_talk); $i++) { - $smtp_resource = fgets($smtp_connection, 256); + $smtp_resource = fgets($smtp_connection, 256); if (substr($smtp_resource, 0, 3) !== $postfix_talk[$i][0]) { $ret = substr($smtp_resource, 0, 3); $ret = (empty($ret)) ? '-' : $ret; @@ -833,7 +837,7 @@ function quarantine($_action, $_data = null) { ))); return false; } - $stmt = $pdo->prepare('SELECT * FROM `quarantine` WHERE `qhash` = :hash'); + $stmt = $pdo->prepare('SELECT * FROM `quarantine` WHERE `qhash` = :hash'); $stmt->execute(array(':hash' => $hash)); return $stmt->fetch(PDO::FETCH_ASSOC); break; From 92cc8bec90e97f2559ed99bb922ea1544ddd2e30 Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Thu, 23 Jul 2026 15:29:41 +0200 Subject: [PATCH 078/123] [Web] Use parameterized LIKE for sogo_acl deletion --- data/web/inc/functions.mailbox.inc.php | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/data/web/inc/functions.mailbox.inc.php b/data/web/inc/functions.mailbox.inc.php index a9f17705..77dc0af6 100644 --- a/data/web/inc/functions.mailbox.inc.php +++ b/data/web/inc/functions.mailbox.inc.php @@ -5647,8 +5647,11 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) { $stmt->execute(array( ':username' => $username )); - $stmt = $pdo->prepare("DELETE FROM `sogo_acl` WHERE `c_object` LIKE '%/" . $username . "/%' OR `c_uid` = :username"); + // bind LIKE pattern + escape LIKE wildcards so the value matches literally (no SQLi, no over-match) + $c_object_like = '%/' . addcslashes($username, '\\%_') . '/%'; + $stmt = $pdo->prepare("DELETE FROM `sogo_acl` WHERE `c_object` LIKE :c_object_like OR `c_uid` = :username"); $stmt->execute(array( + ':c_object_like' => $c_object_like, ':username' => $username )); $stmt = $pdo->prepare("DELETE FROM `sogo_store` WHERE `c_folder_id` IN (SELECT `c_folder_id` FROM `sogo_folder_info` WHERE `c_path2` = :username)"); @@ -6044,8 +6047,11 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) { $stmt->execute(array( ':username' => $username )); - $stmt = $pdo->prepare("DELETE FROM `sogo_acl` WHERE `c_object` LIKE '%/" . str_replace('%', '\%', $username) . "/%' OR `c_uid` = :username"); + // bind LIKE pattern + escape LIKE wildcards so the value matches literally (no SQLi, no over-match) + $c_object_like = '%/' . addcslashes($username, '\\%_') . '/%'; + $stmt = $pdo->prepare("DELETE FROM `sogo_acl` WHERE `c_object` LIKE :c_object_like OR `c_uid` = :username"); $stmt->execute(array( + ':c_object_like' => $c_object_like, ':username' => $username )); $stmt = $pdo->prepare("DELETE FROM `sogo_store` WHERE `c_folder_id` IN (SELECT `c_folder_id` FROM `sogo_folder_info` WHERE `c_path2` = :username)"); @@ -6201,8 +6207,11 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) { $stmt->execute(array( ':username' => $name )); - $stmt = $pdo->prepare("DELETE FROM `sogo_acl` WHERE `c_object` LIKE '%/" . $name . "/%' OR `c_uid` = :username"); + // bind LIKE pattern + escape LIKE wildcards so the value matches literally (no SQLi, no over-match) + $c_object_like = '%/' . addcslashes($name, '\\%_') . '/%'; + $stmt = $pdo->prepare("DELETE FROM `sogo_acl` WHERE `c_object` LIKE :c_object_like OR `c_uid` = :username"); $stmt->execute(array( + ':c_object_like' => $c_object_like, ':username' => $name )); $stmt = $pdo->prepare("DELETE FROM `sogo_store` WHERE `c_folder_id` IN (SELECT `c_folder_id` FROM `sogo_folder_info` WHERE `c_path2` = :username)"); From cc9af65852bcd6af5abdf052f4a5902f57dd101e Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Fri, 24 Jul 2026 10:26:23 +0200 Subject: [PATCH 079/123] [Web] remove domain admin sso token after use --- data/web/inc/functions.domain_admin.inc.php | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/data/web/inc/functions.domain_admin.inc.php b/data/web/inc/functions.domain_admin.inc.php index 46b651b8..17aa4ad6 100644 --- a/data/web/inc/functions.domain_admin.inc.php +++ b/data/web/inc/functions.domain_admin.inc.php @@ -429,14 +429,25 @@ function domain_admin_sso($_action, $_data) { switch ($_action) { case 'check': - $token = $_data; + $token = preg_replace('/[^a-zA-Z0-9-]/', '', $_data); $stmt = $pdo->prepare("SELECT `t1`.`username` FROM `da_sso` AS `t1` JOIN `admin` AS `t2` ON `t1`.`username` = `t2`.`username` WHERE `t1`.`token` = :token AND `t1`.`created` > DATE_SUB(NOW(), INTERVAL '30' SECOND) AND `t2`.`active` = 1 AND `t2`.`superadmin` = 0;"); $stmt->execute(array( - ':token' => preg_replace('/[^a-zA-Z0-9-]/', '', $token) + ':token' => $token )); $return = $stmt->fetch(PDO::FETCH_ASSOC); - return empty($return['username']) ? false : $return['username']; + if (empty($return['username'])) { + return false; + } + // single-use: consume the token; if a concurrent request already used it, deny + $del = $pdo->prepare("DELETE FROM `da_sso` WHERE `token` = :token"); + $del->execute(array( + ':token' => $token + )); + if ($del->rowCount() < 1) { + return false; + } + return $return['username']; case 'issue': if ($_SESSION['mailcow_cc_role'] != "admin") { $_SESSION['return'][] = array( From fea38c8e1bdb5f68c351c5e2a02daba8e9a1cc76 Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Fri, 24 Jul 2026 11:16:39 +0200 Subject: [PATCH 080/123] [Web] escape mailbox name --- data/web/js/site/mailbox.js | 1 + 1 file changed, 1 insertion(+) diff --git a/data/web/js/site/mailbox.js b/data/web/js/site/mailbox.js index 0a019279..5ad5ccea 100644 --- a/data/web/js/site/mailbox.js +++ b/data/web/js/site/mailbox.js @@ -996,6 +996,7 @@ jQuery(function($){ 'style="min-width:2em;width:' + item.percent_in_use + '%">' + item.percent_in_use + '%' + '
' }; item.username = escapeHtml(item.username); + item.name = escapeHtml(item.name); if (Array.isArray(item.tags)){ var tags = ''; From c877fdf0a56ca4d62f0de1446acb1e26ae446c81 Mon Sep 17 00:00:00 2001 From: oidipos <32098983+oidipos@users.noreply.github.com> Date: Fri, 24 Jul 2026 20:57:27 +0200 Subject: [PATCH 081/123] fix: remove MIME decoding of JSON encoded subject Since moving to rspamd's multipart metadata_exporter, `subject` is a JSON encoded UTF-8 string and must not be MIME decoded. --- data/conf/rspamd/meta_exporter/pipe.php | 2 +- data/conf/rspamd/meta_exporter/pushover.php | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/data/conf/rspamd/meta_exporter/pipe.php b/data/conf/rspamd/meta_exporter/pipe.php index 0a9ed59e..28b06d3d 100644 --- a/data/conf/rspamd/meta_exporter/pipe.php +++ b/data/conf/rspamd/meta_exporter/pipe.php @@ -53,7 +53,7 @@ $raw_data = mb_convert_encoding($raw_data_content, 'HTML-ENTITIES', "UTF-8"); $raw_size = (int)$_FILES['message']['size']; $qid = $meta['qid'] ?? 'unknown'; -$subject = iconv_mime_decode($meta['subject'] ?? ''); +$subject = $meta['subject'] ?? ''; $score = $meta['score'] ?? 0; $rcpts = $meta['rcpt'] ?? array(); $user = $meta['user'] ?? 'unknown'; diff --git a/data/conf/rspamd/meta_exporter/pushover.php b/data/conf/rspamd/meta_exporter/pushover.php index a2cd0995..188d0a57 100644 --- a/data/conf/rspamd/meta_exporter/pushover.php +++ b/data/conf/rspamd/meta_exporter/pushover.php @@ -50,7 +50,7 @@ $qid = $meta['qid'] ?? 'unknown'; $rcpts = $meta['rcpt'] ?? array(); $sender = $meta['from'] ?? ''; $ip = $meta['ip'] ?? 'unknown'; -$subject = iconv_mime_decode($meta['subject'] ?? ''); +$subject = $meta['subject'] ?? ''; $messageid= $meta['message_id'] ?? ''; $priority = 0; From e245ac04d9a074291d91deb4584e3a2e7c7f0f35 Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Tue, 28 Jul 2026 09:21:29 +0200 Subject: [PATCH 082/123] [Web] enforce tenant boundary for SOGo SSO --- data/web/sogo-auth.php | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/data/web/sogo-auth.php b/data/web/sogo-auth.php index e2431bfe..bc9694d8 100644 --- a/data/web/sogo-auth.php +++ b/data/web/sogo-auth.php @@ -54,6 +54,11 @@ elseif (isset($_GET['login'])) { (($_SESSION['acl']['login_as'] == "1" && $ALLOW_ADMIN_EMAIL_LOGIN !== 0) || ($is_dual === false && $login == $_SESSION['mailcow_cc_username']))) { if (filter_var($login, FILTER_VALIDATE_EMAIL)) { if (user_get_alias_details($login) !== false) { + // enforce tenant boundary + if (!hasMailboxObjectAccess($_SESSION['mailcow_cc_username'], $_SESSION['mailcow_cc_role'], $login)) { + header("Location: /"); + exit; + } // Block SOGo access if pending actions (2FA setup, password update) if (!empty($_SESSION['pending_tfa_setup']) || !empty($_SESSION['pending_pw_update'])) { header("Location: /"); From b4bb1a625b787691d5ffd8ad9ae978e0163aff87 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Tue, 28 Jul 2026 11:07:20 +0200 Subject: [PATCH 083/123] Update actions/stale action to v11 (#7375) --- .github/workflows/close_old_issues_and_prs.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/close_old_issues_and_prs.yml b/.github/workflows/close_old_issues_and_prs.yml index bba04b0d..13dbac27 100644 --- a/.github/workflows/close_old_issues_and_prs.yml +++ b/.github/workflows/close_old_issues_and_prs.yml @@ -14,7 +14,7 @@ jobs: pull-requests: write steps: - name: Mark/Close Stale Issues and Pull Requests 🗑️ - uses: actions/stale@v10.4.0 + uses: actions/stale@v11.0.0 with: repo-token: ${{ secrets.STALE_ACTION_PAT }} days-before-stale: 60 From 54170d075a4cccd624809ff2e52356e3fb09238c Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Tue, 28 Jul 2026 13:32:18 +0200 Subject: [PATCH 084/123] [Web] Move mailcow update check to server side --- data/web/inc/ajax/update_check.php | 67 ++++++++++++++++++++++++++++++ data/web/js/site/dashboard.js | 51 ++++++++--------------- 2 files changed, 85 insertions(+), 33 deletions(-) create mode 100644 data/web/inc/ajax/update_check.php diff --git a/data/web/inc/ajax/update_check.php b/data/web/inc/ajax/update_check.php new file mode 100644 index 00000000..6bf01600 --- /dev/null +++ b/data/web/inc/ajax/update_check.php @@ -0,0 +1,67 @@ + 'error', 'message' => 'access denied')); + exit; +} + +$owner = $GLOBALS['MAILCOW_GIT_OWNER']; +$repo = $GLOBALS['MAILCOW_GIT_REPO']; +$current = $GLOBALS['MAILCOW_GIT_VERSION']; + +// Cache key is bound to the running version, so an update invalidates it naturally +$cache_key = 'MAILCOW_UPDATE_CHECK/' . $current; + +// Serve cached result if present (one GitHub call per TTL, not one per page load) +$cached = $redis->get($cache_key); +if ($cached !== false) { + echo $cached; + exit; +} + +// GitHub requires a User-Agent and rate-limits unauthenticated requests to 60/h per IP +function github_get($url) { + $ch = curl_init($url); + curl_setopt_array($ch, array( + CURLOPT_RETURNTRANSFER => true, + CURLOPT_USERAGENT => 'mailcow-update-check', + CURLOPT_TIMEOUT => 10, + CURLOPT_HTTPHEADER => array('Accept: application/vnd.github+json'), + )); + $body = curl_exec($ch); + $code = curl_getinfo($ch, CURLINFO_HTTP_CODE); + curl_close($ch); + if ($body === false || $code !== 200) return false; + $json = json_decode($body, true); + return is_array($json) ? $json : false; +} + +$latest = github_get("https://api.github.com/repos/{$owner}/{$repo}/releases/latest"); +$release = github_get("https://api.github.com/repos/{$owner}/{$repo}/releases/tags/{$current}"); + +// Any failure (rate limit, offline, unexpected payload) -> honest error, cached briefly +if ($latest === false || $release === false || + empty($latest['tag_name']) || empty($latest['created_at']) || empty($release['created_at'])) { + $result = json_encode(array('status' => 'error', 'message' => 'could not reach GitHub API')); + $redis->setex($cache_key, 300, $result); + echo $result; + exit; +} + +$date_latest = strtotime($latest['created_at']); +$date_current = strtotime($release['created_at']); + +if ($date_latest <= $date_current) { + $result = json_encode(array('status' => 'no_update')); +} else { + $result = json_encode(array('status' => 'update_available', 'latest_tag' => $latest['tag_name'])); +} + +// Cache the positive result for an hour +$redis->setex($cache_key, 3600, $result); +echo $result; diff --git a/data/web/js/site/dashboard.js b/data/web/js/site/dashboard.js index aee36171..eb50d698 100644 --- a/data/web/js/site/dashboard.js +++ b/data/web/js/site/dashboard.js @@ -30,7 +30,7 @@ $(document).ready(function() { // create host cpu and mem charts createHostCpuAndMemChart(); // check for new version - if (mailcow_info.branch === "master"){ + if (mailcow_info.branch === "master" && mailcow_cc_role === "admin"){ check_update(mailcow_info.version_tag, mailcow_info.project_url); } $("#mailcow_version").click(function(){ @@ -1669,41 +1669,26 @@ function createHostCpuAndMemChart(){ function check_update(current_version, github_repo_url){ if (!current_version || !github_repo_url) return false; - var github_account = github_repo_url.split("/")[3]; - var github_repo_name = github_repo_url.split("/")[4]; - // get details about latest release - window.fetch("https://api.github.com/repos/"+github_account+"/"+github_repo_name+"/releases/latest", {method:'GET',cache:'no-cache'}).then(function(response) { + window.fetch("/inc/ajax/update_check.php", {method:'GET',cache:'no-cache'}).then(function(response) { + if (!response.ok) throw new Error("update check returned " + response.status); return response.json(); - }).then(function(latest_data) { - // get details about current release - window.fetch("https://api.github.com/repos/"+github_account+"/"+github_repo_name+"/releases/tags/"+current_version, {method:'GET',cache:'no-cache'}).then(function(response) { - return response.json(); - }).then(function(current_data) { - // compare releases - var date_current = new Date(current_data.created_at); - var date_latest = new Date(latest_data.created_at); - if (date_latest.getTime() <= date_current.getTime()){ - // no update available - $("#mailcow_update").removeClass("text-warning text-danger").addClass("text-success"); - $("#mailcow_update").html("" + lang_debug.no_update_available + ""); - } else { - // update available - $("#mailcow_update").removeClass("text-danger text-success").addClass("text-warning"); - $("#mailcow_update").html(lang_debug.update_available + ` `+latest_data.tag_name+``); - $("#mailcow_update_changelog").click(function(){ - if (mailcow_cc_role !== "admin" && mailcow_cc_role !== "domainadmin") - return; + }).then(function(data) { + if (data.status === "no_update") { + $("#mailcow_update").removeClass("text-warning text-danger").addClass("text-success"); + $("#mailcow_update").html("" + lang_debug.no_update_available + ""); + } else if (data.status === "update_available") { + $("#mailcow_update").removeClass("text-danger text-success").addClass("text-warning"); + $("#mailcow_update").html(lang_debug.update_available + ` `+data.latest_tag+``); + $("#mailcow_update_changelog").click(function(){ + if (mailcow_cc_role !== "admin" && mailcow_cc_role !== "domainadmin") + return; - showVersionModal("New Release " + latest_data.tag_name, latest_data.tag_name); - }) - } - }).catch(err => { - // err - console.log(err); - $("#mailcow_update").removeClass("text-success text-warning").addClass("text-danger"); - $("#mailcow_update").html(""+ lang_debug.update_failed +""); - }); + showVersionModal("New Release " + data.latest_tag, data.latest_tag); + }) + } else { + throw new Error(data.message || "update check failed"); + } }).catch(err => { // err console.log(err); From f44bd2f36a802d2a2d948c579fb34948e8181038 Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Tue, 28 Jul 2026 14:19:45 +0200 Subject: [PATCH 085/123] [Web] document sender_acl in get/mailbox API examples --- data/web/api/openapi.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/data/web/api/openapi.yaml b/data/web/api/openapi.yaml index ee154c4d..093f9dd5 100644 --- a/data/web/api/openapi.yaml +++ b/data/web/api/openapi.yaml @@ -4920,6 +4920,7 @@ paths: quota: 3221225472 quota_used: 0 rl: false + sender_acl: ["otherbox@doman3.tld", "@aliasdomain.tld"] spam_aliases: 0 username: info@doman3.tld tags: ["tag1", "tag2"] @@ -5846,6 +5847,7 @@ paths: quota: 3221225472 quota_used: 0 rl: false + sender_acl: ["otherbox@domain3.tld", "@aliasdomain.tld"] spam_aliases: 0 username: info@domain3.tld tags: ["tag1", "tag2"] From 9cd16f00019f96d5e202db07a36e1e8161baf048 Mon Sep 17 00:00:00 2001 From: Stephen Ritz <127270018+smpaz7467@users.noreply.github.com> Date: Tue, 28 Jul 2026 07:12:17 -0700 Subject: [PATCH 086/123] [Web] show external sender addresses regardless of authsource The extended_sender_acl field sat inside the `{% if not result.authsource or result.authsource == 'mailcow' %}` block that hides the local password fields for mailboxes authenticating against an external identity provider. As a result the "External sender addresses" input was not rendered at all for keycloak / generic-oidc / ldap mailboxes, even for a full admin, so those addresses could neither be reviewed nor edited in the UI while the underlying sender_acl rows stayed active. Extended sender ACLs are unrelated to local password management. Move the field out of that block; it stays gated by acl.extend_sender_acl as intended. Fixes #7365 --- data/web/templates/edit/mailbox.twig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/web/templates/edit/mailbox.twig b/data/web/templates/edit/mailbox.twig index 34e869ce..db258fe4 100644 --- a/data/web/templates/edit/mailbox.twig +++ b/data/web/templates/edit/mailbox.twig @@ -267,6 +267,7 @@ {{ lang.admin.password_reset_info }} + {% endif %}
@@ -279,7 +280,6 @@ {% endif %}
- {% endif %}
From 36c70db86cea54dcf810343c8d6b2cc10435ffe9 Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Thu, 30 Jul 2026 08:37:18 +0200 Subject: [PATCH 087/123] [Web] harden CORS origin matching and add Vary: Origin --- data/web/inc/functions.inc.php | 38 ++++++++++++++++++++++++++-------- 1 file changed, 29 insertions(+), 9 deletions(-) diff --git a/data/web/inc/functions.inc.php b/data/web/inc/functions.inc.php index f9b0f6ab..dfd860a9 100644 --- a/data/web/inc/functions.inc.php +++ b/data/web/inc/functions.inc.php @@ -75,6 +75,17 @@ function valid_origin($origin) { $rebuilt = strtolower($parts['scheme']) . '://' . strtolower($host) . $port; return strtolower($origin) === $rebuilt; } +// Bring an origin into the exact form a browser sends it (scheme://host[:port], lowercase). +function normalize_cors_origin($origin) { + $origin = trim($origin); + if ($origin === '*') { + return '*'; + } + if ($origin !== '' && !preg_match('~^[a-z][a-z0-9+.-]*://~i', $origin)) { + $origin = 'https://' . $origin; + } + return valid_origin($origin) ? strtolower($origin) : false; +} // Thanks to https://stackoverflow.com/a/49373789 // Validates exact ip matches and ip-in-cidr, ipv4 and ipv6 function ip_acl($ip, $networks) { @@ -2370,26 +2381,35 @@ function cors($action, $data = null) { ); } - $cors_settings = !$cors_settings ? array('allowed_origins' => $_SERVER['SERVER_NAME'], 'allowed_methods' => 'GET, POST, PUT, DELETE') : $cors_settings; - $cors_settings['allowed_origins'] = empty($cors_settings['allowed_origins']) ? $_SERVER['SERVER_NAME'] : $cors_settings['allowed_origins']; + $cors_settings = !$cors_settings ? array('allowed_origins' => getBaseURL(), 'allowed_methods' => 'GET, POST, PUT, DELETE') : $cors_settings; + $cors_settings['allowed_origins'] = empty($cors_settings['allowed_origins']) ? getBaseURL() : $cors_settings['allowed_origins']; $cors_settings['allowed_methods'] = empty($cors_settings['allowed_methods']) ? 'GET, POST, PUT, DELETE, OPTION' : $cors_settings['allowed_methods']; return $cors_settings; break; case "set_headers": $cors_settings = cors('get'); + // normalize the stored list; it may still hold bare hostnames written before origins were validated as origins + $allowed_origins = array_filter(array_map('normalize_cors_origin', explode(',', $cors_settings['allowed_origins']))); + $origin = isset($_SERVER['HTTP_ORIGIN']) ? normalize_cors_origin($_SERVER['HTTP_ORIGIN']) : false; // check if requested origin is in allowed origins - $allowed_origins = explode(', ', $cors_settings['allowed_origins']); - $cors_settings['allowed_origins'] = $allowed_origins[0]; - if (in_array('*', $allowed_origins)){ - $cors_settings['allowed_origins'] = '*'; - } else if (array_key_exists('HTTP_ORIGIN', $_SERVER) && in_array($_SERVER['HTTP_ORIGIN'], $allowed_origins)) { - $cors_settings['allowed_origins'] = $_SERVER['HTTP_ORIGIN']; + $allow_origin = null; + if (in_array('*', $allowed_origins, true)) { + $allow_origin = '*'; + } else if ($origin !== false && in_array($origin, $allowed_origins, true)) { + $allow_origin = $origin; } // always allow OPTIONS for preflight request $cors_settings["allowed_methods"] = empty($cors_settings["allowed_methods"]) ? 'OPTIONS' : $cors_settings["allowed_methods"] . ', ' . 'OPTIONS'; - header('Access-Control-Allow-Origin: ' . $cors_settings['allowed_origins']); + // a disallowed origin gets no Access-Control-Allow-Origin at all; echoing a different origin than the requesting one tells a browser nothing + if ($allow_origin !== null) { + header('Access-Control-Allow-Origin: ' . $allow_origin); + } + if ($allow_origin !== '*') { + // the response depends on the request origin, keep caches from mixing them up + header('Vary: Origin', false); + } header('Access-Control-Allow-Methods: '. $cors_settings['allowed_methods']); header('Access-Control-Allow-Headers: Accept, Content-Type, X-Api-Key, Origin'); From 7036dbf4f855ff238c9a8a57e957f7ee4178ca81 Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Thu, 30 Jul 2026 08:50:18 +0200 Subject: [PATCH 088/123] [Rspamd] update to 4.1.4 --- data/Dockerfiles/rspamd/Dockerfile | 2 +- docker-compose.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/data/Dockerfiles/rspamd/Dockerfile b/data/Dockerfiles/rspamd/Dockerfile index d37d1226..13e56357 100644 --- a/data/Dockerfiles/rspamd/Dockerfile +++ b/data/Dockerfiles/rspamd/Dockerfile @@ -2,7 +2,7 @@ FROM debian:trixie-slim LABEL maintainer="The Infrastructure Company GmbH " ARG DEBIAN_FRONTEND=noninteractive -ARG RSPAMD_VER=rspamd_4.1.0-1~e2b0b18 +ARG RSPAMD_VER=rspamd_4.1.4-1~beb659b ARG CODENAME=trixie ENV LC_ALL=C diff --git a/docker-compose.yml b/docker-compose.yml index dab078c8..8b24b23c 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -84,7 +84,7 @@ services: - clamd rspamd-mailcow: - image: ghcr.io/mailcow/rspamd:4.1.0-1 + image: ghcr.io/mailcow/rspamd:4.1.4-1 stop_grace_period: 30s depends_on: - dovecot-mailcow From bd037d5644fa133e60909ef17d743019f67a244d Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Thu, 30 Jul 2026 08:51:21 +0200 Subject: [PATCH 089/123] [Nginx] Set image tag to 1.30.4-1 --- docker-compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docker-compose.yml b/docker-compose.yml index dab078c8..a2bcae9d 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -419,7 +419,7 @@ services: - php-fpm-mailcow - sogo-mailcow - rspamd-mailcow - image: ghcr.io/mailcow/nginx:1.30.4 + image: ghcr.io/mailcow/nginx:1.30.4-1 dns: - ${IPV4_NETWORK:-172.22.1}.254 environment: From d64c923aca1d80f8e2b73b0664500399a60542e2 Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Thu, 30 Jul 2026 10:33:55 +0200 Subject: [PATCH 090/123] [ACME] Skip mta-sts certificate request when MTA-STS is not active for a domain --- data/Dockerfiles/acme/acme.sh | 21 +++++++++++++++++++++ data/web/lang/lang.de-de.json | 1 + data/web/lang/lang.en-gb.json | 1 + data/web/templates/edit/domain.twig | 2 +- docker-compose.yml | 2 +- 5 files changed, 25 insertions(+), 2 deletions(-) diff --git a/data/Dockerfiles/acme/acme.sh b/data/Dockerfiles/acme/acme.sh index 271de4fc..6b7b7430 100755 --- a/data/Dockerfiles/acme/acme.sh +++ b/data/Dockerfiles/acme/acme.sh @@ -249,12 +249,33 @@ while true; do done <<< "${SQL_DOMAINS}" if [[ ${ONLY_MAILCOW_HOSTNAME} != "y" ]]; then + # Fetch all domains with an active MTA-STS policy once. + unset MTA_STS_ACTIVE_DOMAINS + declare -A MTA_STS_ACTIVE_DOMAINS + if [[ ${AUTODISCOVER_SAN} == "y" ]]; then + SQL_MTA_STS_DOMAINS=$(mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT domain FROM mta_sts WHERE active = 1" -Bs) + if [[ $? -eq 0 ]]; then + while read mta_sts_domain; do + if [[ -z "${mta_sts_domain}" ]]; then + # ignore empty lines + continue + fi + MTA_STS_ACTIVE_DOMAINS["${mta_sts_domain}"]=1 + done <<< "${SQL_MTA_STS_DOMAINS}" + fi + fi for SQL_DOMAIN in "${SQL_DOMAIN_ARR[@]}"; do unset VALIDATED_CONFIG_DOMAINS_SUBDOMAINS declare -a VALIDATED_CONFIG_DOMAINS_SUBDOMAINS for SUBDOMAIN in "${ADDITIONAL_WC_ARR[@]}"; do FULL_SUBDOMAIN="${SUBDOMAIN}.${SQL_DOMAIN}" + # Skip mta-sts subdomain unless MTA-STS is enabled (active) for this domain + if [[ "${SUBDOMAIN}" == "mta-sts" && -z "${MTA_STS_ACTIVE_DOMAINS[${SQL_DOMAIN}]}" ]]; then + log_f "MTA-STS is not enabled for ${SQL_DOMAIN} - skipping mta-sts subdomain certificate" + continue + fi + # Skip if subdomain matches MAILCOW_HOSTNAME if [[ "${FULL_SUBDOMAIN}" == "${MAILCOW_HOSTNAME}" ]]; then continue diff --git a/data/web/lang/lang.de-de.json b/data/web/lang/lang.de-de.json index c19eb209..28ad0d72 100644 --- a/data/web/lang/lang.de-de.json +++ b/data/web/lang/lang.de-de.json @@ -728,6 +728,7 @@ "mta_sts_mx": "MX-Server", "mta_sts_mx_info": "Erlaubt das Senden nur an explizit aufgeführte Mailserver-Hostnamen; der sendende MTA überprüft, ob der DNS-MX-Hostname mit der Richtlinienliste übereinstimmt, und erlaubt die Zustellung nur mit einem gültigen TLS-Zertifikat (schützt vor MITM).", "mta_sts_mx_notice": "Es können mehrere MX-Server angegeben werden (durch Kommas getrennt).", + "mta_sts_active_info": "Wenn nicht angehakt, wird die MTA-STS-Richtlinie nicht veröffentlicht und für die mta-sts-Subdomain kein Zertifikat über ACME angefordert.", "multiple_bookings": "Mehrfaches Buchen", "nexthop": "Next Hop", "none_inherit": "Keine Auswahl / Erben", diff --git a/data/web/lang/lang.en-gb.json b/data/web/lang/lang.en-gb.json index 873d7b98..b8a11e5a 100644 --- a/data/web/lang/lang.en-gb.json +++ b/data/web/lang/lang.en-gb.json @@ -728,6 +728,7 @@ "mta_sts_mx": "MX server", "mta_sts_mx_info": "Allows sending only to explicitly listed mail server hostnames; the sending MTA checks if the DNS MX hostname matches the policy list, and only allows delivery with a valid TLS certificate (guards against MITM).", "mta_sts_mx_notice": "Multiple MX servers can be specified (separated by commas).", + "mta_sts_active_info": "If unchecked, the MTA-STS policy will not be published and no certificate will be requested for the mta-sts subdomain via ACME.", "multiple_bookings": "Multiple bookings", "none_inherit": "None / Inherit", "nexthop": "Next hop", diff --git a/data/web/templates/edit/domain.twig b/data/web/templates/edit/domain.twig index 83353079..45ec654c 100644 --- a/data/web/templates/edit/domain.twig +++ b/data/web/templates/edit/domain.twig @@ -340,7 +340,7 @@
- +
diff --git a/docker-compose.yml b/docker-compose.yml index 76359151..4742fef1 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -465,7 +465,7 @@ services: condition: service_started unbound-mailcow: condition: service_healthy - image: ghcr.io/mailcow/acme:1.97 + image: ghcr.io/mailcow/acme:1.98 dns: - ${IPV4_NETWORK:-172.22.1}.254 environment: From 54da526d418f0bef3f4e9160847dff87cfab0bd6 Mon Sep 17 00:00:00 2001 From: MaximalBenedikt Date: Thu, 30 Jul 2026 14:11:32 +0200 Subject: [PATCH 091/123] update README.md sponsors --- README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/README.md b/README.md index 8844c748..63d0b648 100644 --- a/README.md +++ b/README.md @@ -30,6 +30,8 @@ A big thank you to everyone supporting us on GitHub Sponsors—your contribution ### 50$/Month Sponsors ## Info, documentation and support From f7a536d63463236973898a2fde7fb686ca82683e Mon Sep 17 00:00:00 2001 From: milkmaker Date: Tue, 4 Aug 2026 18:35:48 +0200 Subject: [PATCH 092/123] update postscreen_access.cidr (#7394) --- data/conf/postfix/postscreen_access.cidr | 68 ++++++++++++++++++++++-- 1 file changed, 64 insertions(+), 4 deletions(-) diff --git a/data/conf/postfix/postscreen_access.cidr b/data/conf/postfix/postscreen_access.cidr index 6fcedff9..3801fe31 100644 --- a/data/conf/postfix/postscreen_access.cidr +++ b/data/conf/postfix/postscreen_access.cidr @@ -1,6 +1,6 @@ -# Whitelist generated by Postwhite v3.4 on Wed Jul 1 00:51:20 UTC 2026 +# Whitelist generated by Postwhite v3.4 on Sat Aug 1 00:35:20 UTC 2026 # https://github.com/stevejenkins/postwhite/ -# 2251 total rules +# 2256 total rules 2a00:1450:4000::/36 permit 2a00:1450:4864::/56 permit 2a01:111:f400::/48 permit @@ -29,6 +29,7 @@ 2a01:b747:3004:200::/56 permit 2a01:b747:3005:200::/56 permit 2a01:b747:3006:200::/56 permit +2a01:b747:3007::/56 permit 2a02:a60:0:5::/64 permit 2a0f:f640::/56 permit 2c0f:fb50:4000::/36 permit @@ -56,7 +57,14 @@ 8.25.194.0/23 permit 8.25.196.0/23 permit 8.36.116.0/24 permit +8.39.54.0/23 permit +8.39.54.240/29 permit +8.39.54.250/31 permit 8.39.144.0/24 permit +8.40.222.0/23 permit +8.40.222.240/29 permit +8.40.222.250/31 permit +8.47.10.9 permit 12.130.86.238 permit 13.108.16.0/20 permit 13.110.208.0/21 permit @@ -67,6 +75,7 @@ 13.111.191.0/24 permit 13.216.7.111 permit 13.216.54.180 permit +13.247.164.219 permit 15.200.21.50 permit 15.200.44.248 permit 15.200.201.185 permit @@ -170,6 +179,7 @@ 34.215.104.144 permit 34.218.115.239 permit 34.225.212.172 permit +34.241.242.183 permit 35.83.148.184 permit 35.155.198.111 permit 35.158.23.94 permit @@ -193,6 +203,7 @@ 40.233.64.216 permit 40.233.83.78 permit 40.233.88.28 permit +43.239.212.33 permit 44.206.138.57 permit 44.210.169.44 permit 44.217.45.156 permit @@ -275,6 +286,7 @@ 51.83.17.38 permit 52.1.14.157 permit 52.5.230.59 permit +52.6.74.205 permit 52.12.53.23 permit 52.13.214.179 permit 52.26.1.71 permit @@ -331,6 +343,7 @@ 54.244.54.130 permit 54.244.242.0/24 permit 54.255.61.23 permit +56.124.6.228 permit 57.103.64.0/18 permit 57.129.93.249 permit 62.13.128.0/24 permit @@ -397,6 +410,7 @@ 65.110.161.77 permit 65.123.29.213 permit 65.123.29.220 permit +65.154.166.0/24 permit 65.212.180.36 permit 66.102.0.0/20 permit 66.119.150.192/26 permit @@ -1210,6 +1224,9 @@ 99.78.197.208/28 permit 103.9.96.0/22 permit 103.28.42.0/24 permit +103.84.217.15 permit +103.84.217.238 permit +103.89.75.238 permit 103.151.192.0/23 permit 103.168.172.128/27 permit 103.237.104.0/22 permit @@ -1370,6 +1387,10 @@ 117.120.16.0/21 permit 119.42.242.52/31 permit 119.42.242.156 permit +121.244.91.31 permit +121.244.91.48 permit +121.244.91.52 permit +122.15.156.182 permit 123.126.78.64/29 permit 124.108.96.24/31 permit 124.108.96.28/31 permit @@ -1452,7 +1473,21 @@ 134.170.141.64/26 permit 134.170.143.0/24 permit 134.170.174.0/24 permit +135.84.80.0/24 permit +135.84.81.0/24 permit +135.84.82.0/24 permit +135.84.83.0/24 permit 135.84.216.0/22 permit +136.143.160.0/24 permit +136.143.161.0/24 permit +136.143.162.0/24 permit +136.143.176.0/24 permit +136.143.177.0/24 permit +136.143.178.49 permit +136.143.182.0/23 permit +136.143.184.0/24 permit +136.143.188.0/24 permit +136.143.190.0/23 permit 136.146.128.0/20 permit 136.147.128.0/20 permit 136.147.135.0/24 permit @@ -1472,6 +1507,7 @@ 139.138.46.219 permit 139.138.57.55 permit 139.138.58.119 permit +139.167.79.86 permit 139.177.108.0/25 permit 139.180.17.0/24 permit 140.238.148.191 permit @@ -1528,7 +1564,7 @@ 149.97.173.180 permit 149.118.160.128/25 permit 150.136.21.199 permit -150.171.109.183 permit +150.171.109.72 permit 150.230.98.160 permit 151.145.38.14 permit 152.67.105.195 permit @@ -1643,6 +1679,19 @@ 168.245.12.252 permit 168.245.46.9 permit 168.245.127.231 permit +169.148.129.0/24 permit +169.148.131.0/24 permit +169.148.138.0/24 permit +169.148.142.10 permit +169.148.142.33 permit +169.148.144.0/25 permit +169.148.144.10 permit +169.148.146.0/23 permit +169.148.174.10 permit +169.148.175.3 permit +169.148.179.3 permit +169.148.188.0/24 permit +169.148.188.182 permit 170.9.232.254 permit 170.10.128.0/24 permit 170.10.129.0/24 permit @@ -1849,7 +1898,16 @@ 199.16.156.0/22 permit 199.33.145.1 permit 199.33.145.32 permit +199.34.22.36 permit 199.59.148.0/22 permit +199.67.80.2 permit +199.67.80.20 permit +199.67.82.2 permit +199.67.82.20 permit +199.67.84.0/24 permit +199.67.86.0/24 permit +199.67.88.0/24 permit +199.67.90.0/24 permit 199.101.161.130 permit 199.101.162.0/25 permit 199.122.120.0/21 permit @@ -1905,6 +1963,8 @@ 204.92.114.187 permit 204.92.114.203 permit 204.92.114.204/31 permit +204.141.32.0/23 permit +204.141.42.0/23 permit 204.216.164.202 permit 204.220.160.0/21 permit 204.220.168.0/21 permit @@ -2178,7 +2238,7 @@ 2001:748:400:3301::4 permit 2404:6800:4000::/36 permit 2404:6800:4864::/56 permit -2603:1061:14:1c2::1 permit +2603:1061:14:75::1 permit 2607:13c0:0001:0000:0000:0000:0000:7000/116 permit 2607:13c0:0002:0000:0000:0000:0000:1000/116 permit 2607:13c0:0004:0000:0000:0000:0000:0000/116 permit From d1a2f4e168ed1a0ba0b9019c3e6b6ae13eb3382f Mon Sep 17 00:00:00 2001 From: milkmaker Date: Tue, 4 Aug 2026 18:37:38 +0200 Subject: [PATCH 093/123] Translations update from Weblate (#7400) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * [Web] Updated lang.si-si.json Co-authored-by: Matjaž Tekavec Co-authored-by: milkmaker * [Web] Updated lang.pt-br.json Co-authored-by: André Glazastov --------- Co-authored-by: Matjaž Tekavec Co-authored-by: André Glazastov --- data/web/lang/lang.pt-br.json | 8 +++++--- data/web/lang/lang.si-si.json | 2 +- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/data/web/lang/lang.pt-br.json b/data/web/lang/lang.pt-br.json index db3c8cac..5645537c 100644 --- a/data/web/lang/lang.pt-br.json +++ b/data/web/lang/lang.pt-br.json @@ -786,7 +786,8 @@ "mta_sts_mx_info": "Permite envio apenas para nomes de host de servidor de email explicitamente listados; o MTA de envio verifica se o nome do host DNS MX corresponde à lista de políticas e permite entrega apenas com certificado TLS válido (protege contra MITM).", "mta_sts_mx_notice": "Múltiplos servidores MX podem ser especificados (separados por vírgulas).", "sender_allowed": "Permitir enviar como este alias", - "sender_allowed_info": "Se desativado, este alias poderá apenas receber e-mails. Use a ACL de remetente para substituir essa configuração e conceder a caixas de correio específicas permissão para enviar." + "sender_allowed_info": "Se desativado, este alias poderá apenas receber e-mails. Use a ACL de remetente para substituir essa configuração e conceder a caixas de correio específicas permissão para enviar.", + "mta_sts_active_info": "Se esta opção estiver desmarcada, a política MTA-STS não será publicada e nenhum certificado será solicitado via ACME para o subdomínio mta-sts." }, "fido2": { "confirm": "Confirme", @@ -1034,7 +1035,8 @@ "weekly": "Semanalmente", "yes": "✓", "iam": "Provedor de Identidade", - "internal": "Interno" + "internal": "Interno", + "force_tfa": "A2F" }, "oauth2": { "access_denied": "Faça login como proprietário da mailbox para conceder acesso via OAuth2.", @@ -1086,7 +1088,7 @@ "rspamd_result": "Resultado do Rspamd", "sender": "Remetente (SMTP)", "sender_header": "Remetente (cabeçalho “De”)", - "settings_info": "Quantidade máxima de elementos a serem colocados em quarentena: %s
Tamanho máximo do e-mail: %s MiB", + "settings_info": "Número máximo de elementos em quarentena (por caixa de correio): %s
Tamanho máximo do e-mail: %s MiB", "show_item": "Mostrar item", "spam": "Spam", "spam_score": "Ponto", diff --git a/data/web/lang/lang.si-si.json b/data/web/lang/lang.si-si.json index 39d57eb3..2deb8271 100644 --- a/data/web/lang/lang.si-si.json +++ b/data/web/lang/lang.si-si.json @@ -1078,7 +1078,7 @@ "rspamd_result": "Rezultat Rspamd", "sender": "Pošiljatelj (SMTP)", "sender_header": "Pošiljatelj (glava »Od«)", - "settings_info": "Največje število elementov za karanteno: %s
Največja velikost e-pošte: %s MiB", + "settings_info": "Največje število elementov za karanteno (na poštni predal): %s
Največja velikost e-pošte: %s MiB", "show_item": "Prikaži element", "spam": "Neželena pošta", "subj": "Zadeva", From b5fa926bc043a36faabc1fba83f4829be7e009fb Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Thu, 13 Aug 2026 13:56:49 +0200 Subject: [PATCH 094/123] [Clamd] Update to 1.4.6 --- data/Dockerfiles/clamd/Dockerfile | 6 +++--- docker-compose.yml | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/data/Dockerfiles/clamd/Dockerfile b/data/Dockerfiles/clamd/Dockerfile index e60e7eef..5f444a8f 100644 --- a/data/Dockerfiles/clamd/Dockerfile +++ b/data/Dockerfiles/clamd/Dockerfile @@ -1,7 +1,7 @@ -FROM alpine:3.21 AS builder +FROM alpine:3.24 AS builder WORKDIR /src -ENV CLAMD_VERSION=1.4.2 +ENV CLAMD_VERSION=1.4.6 RUN apk upgrade --no-cache \ && apk add --update --no-cache \ @@ -68,7 +68,7 @@ RUN wget -P /src https://www.clamav.net/downloads/production/clamav-${CLAMD_VERS "/clamav/etc/clamav/clamav-milter.conf.sample" > "/clamav/etc/clamav/clamav-milter.conf" || exit 1 -FROM alpine:3.21 +FROM alpine:3.24 LABEL maintainer = "The Infrastructure Company GmbH " diff --git a/docker-compose.yml b/docker-compose.yml index 4742fef1..07c738e4 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -65,7 +65,7 @@ services: - redis clamd-mailcow: - image: ghcr.io/mailcow/clamd:1.71 + image: ghcr.io/mailcow/clamd:1.4.6-1 restart: always depends_on: unbound-mailcow: From 8c85044781163a94a5af13410ed965002bd8eecd Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Mon, 17 Aug 2026 08:20:45 +0200 Subject: [PATCH 095/123] [SOGo] Update to 5.12.10 --- data/Dockerfiles/sogo/Dockerfile | 4 ++-- docker-compose.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/data/Dockerfiles/sogo/Dockerfile b/data/Dockerfiles/sogo/Dockerfile index b4b401e8..f65ec7eb 100644 --- a/data/Dockerfiles/sogo/Dockerfile +++ b/data/Dockerfiles/sogo/Dockerfile @@ -12,8 +12,8 @@ FROM debian:bookworm LABEL maintainer="The Infrastructure Company GmbH " ARG DEBIAN_FRONTEND=noninteractive -ARG SOGO_VERSION=SOGo-5.12.9 -ARG SOPE_VERSION=SOPE-5.12.9 +ARG SOGO_VERSION=SOGo-5.12.10 +ARG SOPE_VERSION=SOPE-5.12.10 # Security patches to apply (space-separated commit hashes) ARG SOGO_SECURITY_PATCHES="" # renovate: datasource=github-releases depName=tianon/gosu versioning=semver-coerced extractVersion=^(?.*)$ diff --git a/docker-compose.yml b/docker-compose.yml index 07c738e4..66455c10 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -200,7 +200,7 @@ services: - phpfpm sogo-mailcow: - image: ghcr.io/mailcow/sogo:5.12.9-1 + image: ghcr.io/mailcow/sogo:5.12.10-1 environment: - DBNAME=${DBNAME} - DBUSER=${DBUSER} From feed5ad1831405ac2714a9e3c96eff6e91a53a41 Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Mon, 17 Aug 2026 08:35:53 +0200 Subject: [PATCH 096/123] [Dovecot] Remove legacy DeltaChat auto-filing sieve rule --- data/conf/dovecot/global_sieve_before | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/data/conf/dovecot/global_sieve_before b/data/conf/dovecot/global_sieve_before index 3e79ca1d..e71be510 100644 --- a/data/conf/dovecot/global_sieve_before +++ b/data/conf/dovecot/global_sieve_before @@ -1,13 +1,3 @@ # global_sieve_before script # global_sieve_before -> user sieve_before (mailcow UI) -> user sieve_after (mailcow UI) -> global_sieve_after -require ["mailbox", "fileinto"]; - -if header :contains ["Chat-Version"] [""] { - if mailboxexists "DeltaChat" { - fileinto "DeltaChat"; - } else { - fileinto :create "DeltaChat"; - } - stop; -} From 555e7ed706aeb8863109e0b2cd2fe0df68502000 Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Tue, 18 Aug 2026 08:12:32 +0200 Subject: [PATCH 097/123] [Redis] Update to 7.4.10 --- docker-compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docker-compose.yml b/docker-compose.yml index 66455c10..7dce4569 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -42,7 +42,7 @@ services: - mysql redis-mailcow: - image: redis:7.4.6-alpine + image: redis:7.4.10-alpine entrypoint: ["/bin/sh","/redis-conf.sh"] volumes: - redis-vol-1:/data/ From 91d3b7246a53247feaa19350f8ec330423c6d909 Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Tue, 18 Aug 2026 09:08:17 +0200 Subject: [PATCH 098/123] [Web] Minor hardening across web UI and nginx --- data/conf/nginx/templates/sites-default.conf.j2 | 1 + data/web/inc/ajax/dns_diagnostics.php | 12 ++++++------ data/web/inc/functions.inc.php | 2 +- data/web/js/site/dashboard.js | 2 ++ data/web/oauth/authorize.php | 6 ++++++ 5 files changed, 16 insertions(+), 7 deletions(-) diff --git a/data/conf/nginx/templates/sites-default.conf.j2 b/data/conf/nginx/templates/sites-default.conf.j2 index 688f2baa..842c50a5 100644 --- a/data/conf/nginx/templates/sites-default.conf.j2 +++ b/data/conf/nginx/templates/sites-default.conf.j2 @@ -116,6 +116,7 @@ location ~ \.php$ { include /etc/nginx/fastcgi_params; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; fastcgi_param PATH_INFO $fastcgi_path_info; + fastcgi_param HTTP_X_REAL_IP $remote_addr; # trusted internal-auth marker; empty for external clients (see nginx.conf map) fastcgi_param SOGO_AUTH_INTERNAL $sogo_auth_internal; fastcgi_read_timeout 3600; diff --git a/data/web/inc/ajax/dns_diagnostics.php b/data/web/inc/ajax/dns_diagnostics.php index 95e34e88..7ed92db7 100644 --- a/data/web/inc/ajax/dns_diagnostics.php +++ b/data/web/inc/ajax/dns_diagnostics.php @@ -380,13 +380,13 @@ if (isset($_SESSION['mailcow_cc_role']) && ($_SESSION['mailcow_cc_role'] == "adm else { $state = state_nomatch; } - $state .= '
' . $current[$data_field[$current['type']]]; + $state .= '
' . htmlspecialchars($current[$data_field[$current['type']]]); } if ($current['type'] == 'TXT' && stripos($current['txt'], 'v=dmarc') === 0 && $record[2] == $dmarc_link) { $current['txt'] = str_replace(' ', '', $current['txt']); - $state = $current[$data_field[$current['type']]] . state_optional; + $state = htmlspecialchars($current[$data_field[$current['type']]]) . state_optional; } elseif ($current['type'] == 'TXT' && stripos($current['txt'], 'v=spf') === 0 && @@ -396,7 +396,7 @@ if (isset($_SESSION['mailcow_cc_role']) && ($_SESSION['mailcow_cc_role'] == "adm if (in_array($ip, $rslt) && in_array(expand_ipv6($ip6), $rslt)) { $state = state_good; } - $state .= '
' . $current[$data_field[$current['type']]] . state_optional; + $state .= '
' . htmlspecialchars($current[$data_field[$current['type']]]) . state_optional; } elseif ($current['type'] == 'TXT' && stripos($current['txt'], 'v=dkim') === 0 && @@ -426,7 +426,7 @@ if (isset($_SESSION['mailcow_cc_role']) && ($_SESSION['mailcow_cc_role'] == "adm if ($state == state_nomatch) { $state = array(); foreach ($currents as $current) { - $state[] = $current[$data_field[$current['type']]]; + $state[] = htmlspecialchars($current[$data_field[$current['type']]]); } $state = implode('
', $state); } @@ -436,7 +436,7 @@ if (isset($_SESSION['mailcow_cc_role']) && ($_SESSION['mailcow_cc_role'] == "adm %s %s %s - ', $record[0], $record[1], $record[2], $state); + ', htmlspecialchars($record[0]), htmlspecialchars($record[1]), $record[2], $state); $record[3] = explode('
', $state); } @@ -477,7 +477,7 @@ if (isset($_SESSION['mailcow_cc_role']) && ($_SESSION['mailcow_cc_role'] == "adm } ?> - .txt' type='text/csv'>Download + .txt' type='text/csv'>Download diff --git a/data/web/templates/mailbox.twig b/data/web/templates/mailbox.twig index f0b1af46..1265d00c 100644 --- a/data/web/templates/mailbox.twig +++ b/data/web/templates/mailbox.twig @@ -7,12 +7,12 @@ {% else %} - + {% endif %} {% if mailcow_cc_role == 'admin' %}
{{ lang.admin.ui_theme }}
-

{{ lang.admin.ui_theme_info|raw }}

+
{{ lang.admin.ui_theme_info|raw }}
From 4a29767a31e69dfe7a4f856a031816dda9bcaca3 Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Thu, 15 Oct 2026 15:23:29 +0200 Subject: [PATCH 117/123] [Web] Add role color marker and icons to login pages --- data/web/css/build/014-mailcow.css | 23 +++++++++++++++++++++++ data/web/css/themes/servercow/theme.css | 7 +++---- data/web/templates/admin_index.twig | 4 ++-- data/web/templates/domainadmin_index.twig | 4 ++-- data/web/templates/user_index.twig | 2 +- 5 files changed, 31 insertions(+), 9 deletions(-) diff --git a/data/web/css/build/014-mailcow.css b/data/web/css/build/014-mailcow.css index 52c087a3..52a34f8b 100644 --- a/data/web/css/build/014-mailcow.css +++ b/data/web/css/build/014-mailcow.css @@ -62,6 +62,9 @@ --mc-dtr-color: #fff; --mc-dtr-hover-bg: #5e5e5e; --mc-dtr-active-bg: #979797; + --mc-login-user: #28b62c; + --mc-login-domainadmin: #ffc107; + --mc-login-admin: #ff4136; } body { @@ -439,6 +442,26 @@ button[aria-expanded='true'] > .caret { text-decoration: none; } +/* role marker on login pages, header icons differ too (color blindness) */ +.login-card::before { + content: ""; + display: block; + height: 5px; + background: var(--mc-login-color); + border-radius: inherit; + border-bottom-left-radius: 0; + border-bottom-right-radius: 0; +} +.login-user { + --mc-login-color: var(--mc-login-user); +} +.login-domainadmin { + --mc-login-color: var(--mc-login-domainadmin); +} +.login-admin { + --mc-login-color: var(--mc-login-admin); +} + .hr-title { display: flex; align-items: center; diff --git a/data/web/css/themes/servercow/theme.css b/data/web/css/themes/servercow/theme.css index 9d01a532..14bcecd1 100644 --- a/data/web/css/themes/servercow/theme.css +++ b/data/web/css/themes/servercow/theme.css @@ -116,6 +116,9 @@ --mc-dtr-color: var(--sc-brown); --mc-dtr-hover-bg: var(--sc-brown-tint); --mc-dtr-active-bg: var(--sc-brown-soft); + --mc-login-user: var(--sc-green); + --mc-login-domainadmin: #f5c400; + --mc-login-admin: var(--sc-danger); } /* base */ @@ -571,10 +574,6 @@ table.dataTable.table-hover > tbody > tr:hover > * { background-color: var(--sc-warning) !important; } -/* login pages (no navbar), green line on top */ -body:not(:has(> .navbar)) { - border-top: 5px solid var(--sc-green); -} /* footer */ .footer, .footer a { diff --git a/data/web/templates/admin_index.twig b/data/web/templates/admin_index.twig index 44b3564c..0507786c 100644 --- a/data/web/templates/admin_index.twig +++ b/data/web/templates/admin_index.twig @@ -6,9 +6,9 @@
-
+