Gnous/mailcow
2
0
Fork 0
Code Issues Pull Requests 1 Packages Projects Releases Wiki Activity
7,680 Commits 2 Branches 0 Tags 50 MiB
626d006a3d
Commit Graph

5443 Commits

Author SHA1 Message Date
Stephen Ritz
c17cc8a792 [Web] fix add/time_limited_alias silently discarding requests and validity 
Three defects in add/time_limited_alias:

The description was read as $_data['description'] without a guard. When a
client omits it, null is bound to spamalias.description, which is TEXT NOT
NULL, so the insert raises a PDOException. The global exception handler is
terminal, so process_add_return() never echoes anything and the caller sees
HTTP 200 with an empty body while no alias was created. Default it to an
empty string instead.

The validity guard used a single condition whose else branch also caught the
success case, so every valid validity was overwritten with the 8760 hour
default and the parameter did nothing. Only invalid values were rejected.
Nest the range check so a valid value survives.

The OpenAPI spec documented only username and domain, while the code also
reads description, validity and permanent. Spec driven clients therefore
could not construct a working request. Document all three.

spamalias.description is the only NOT NULL description column in the schema,
which is why the same unguarded read in add/domain and add/resource does not
fail, both of those columns are nullable.

This does not change the generic exception handling. A database error is
still swallowed into an empty HTTP 200, and the message the handler builds
carries the raw PDOException, so surfacing it to API clients would need
sanitising first. That is left for a separate change.

Refs #7287

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-14 15:23:31 -07:00
Stephen Ritz
4cba448671 [Web] translate password errors in the forced password change modal 
The forced password change modal posts to the JSON API and renders
data[0].msg directly. The API returns raw language keys rather than
translated strings, so a user who fails the complexity policy is shown
the literal text "password_complexity" instead of a message.

Every other password form renders errors through alertbox_log_parser(),
which resolves the key against $lang. The modal is the only one that
talks to the API directly, and it never resolved the key.

Resolve it against lang_danger, which base.twig already exposes for this
purpose. This also covers password_mismatch, password_empty and
access_denied, and applies to the admin path as well. Unknown keys still
fall through unchanged.

The lookup is guarded with hasOwnProperty because msg is attacker-
independent but dynamic: a bare lang_danger[msg] would resolve inherited
Object.prototype members such as "constructor" to a function, which
jQuery's .text() would then invoke as a callback.

Language files are untouched: prerequisites.inc.php loads lang.en-gb.json
as the base and merges the active locale over it, so locales that lack the
key inherit the English string.

Fixes #7301

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-14 15:11:17 -07:00
Stephen Ritz
7dab6c63d1 [Nginx] only bind IPv6 default_server when ENABLE_IPV6 is set 
The HTTP-to-HTTPS redirect server block bound `listen [::]:{{ HTTP_PORT }}
default_server` unconditionally, while every other IPv6 listen directive in
this template is guarded by `{% if ENABLE_IPV6 %}`. On hosts where IPv6 is
disabled at the kernel level, nginx cannot bind `::` and fails to start.

This only triggers when HTTP_REDIRECT is enabled and ENABLE_IPV6 is false,
which is why it survives testing with ENABLE_IPV6=false alone.

Guard the directive like the other six IPv6 listeners in the template.

Refs #7296

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-14 14:54:28 -07:00
Paul Seebach
5408bc809d [Web] Use input-group-text for password toggle button 
Replaces btn-outline-secondary with input-group-text so the toggle
button border matches the surrounding input group consistently.
 2026-07-14 21:20:58 +02:00
Paul Seebach
bd5c18b145 [Web] Add show/hide password toggle on login pages 
Adds an eye icon button to the password field on the user, admin, and
domain admin login pages. Clicking it toggles between hidden and visible
password text, using Bootstrap Icons (bi-eye / bi-eye-slash).

Closes #6893
 2026-07-14 21:20:58 +02:00
DerLinkman
0f06c8e563 postfix: prepare TLSRPT compatibility for tlspol 2026-07-13 19:34:58 +02:00
DerLinkman
fffe1aec3d postfix-tlspol: upgrade to trixie + 1.11.0 update 2026-07-13 19:16:10 +02:00
Mohamed Fall
6f7fee49cd
fix: cors allowed origins settings validation 2026-07-13 15:29:48 +00:00
FreddleSpl0it
c1d75cf808
Merge pull request #7312 from mailcow/renovate/composer-composer-2.x 
Update dependency composer/composer to v2.10.2
 2026-07-13 09:40:58 +02:00
FreddleSpl0it
473fe2885d
Merge pull request #7326 from ralfbergs/fix/quarantine-text-refining 
Refined wording for displaying of active settings on quarantine page.
 2026-07-13 09:40:24 +02:00
FreddleSpl0it
31e1550668
[Postfix] change postscreen blacklist_action to denylist_action 2026-07-13 08:45:56 +02:00
Ralf Bergs
e696ee2f6c Refined wording for displaying of active settings on quarantine page. 2026-07-12 17:22:15 +02:00
DerLinkman
3098caebbc migrate postfix to trixie 2026-07-10 18:29:45 +02:00
renovate[bot]
94e23a3cd3
Update dependency composer/composer to v2.10.2 
Signed-off-by: milkmaker <milkmaker@mailcow.de>
 2026-07-01 09:32:23 +00:00
milkmaker
1840074991
update postscreen_access.cidr (#7311) 2026-07-01 11:31:58 +02:00
FreddleSpl0it
1f8b4679cc
[Nignx] Update to 1.30.3 2026-06-25 12:17:37 +02:00
milkmaker
9e723e942d
Translations update from Weblate (#7302) 
* [Web] Updated lang.fr-fr.json

Co-authored-by: Romain Ayme <ayme.romain@hotmail.fr>

* [Web] Updated lang.si-si.json

Co-authored-by: Matjaž Tekavec <matjaz@moj-svet.si>

---------

Co-authored-by: Romain Ayme <ayme.romain@hotmail.fr>
Co-authored-by: Matjaž Tekavec <matjaz@moj-svet.si>
 2026-06-20 13:57:15 +02:00
Chris Haumesser
ddcce811c1 Fixes #7150 (Dovecot passwd-verify.lua wipes auth cache during any nginx restart or unavailability) 
- distinguishes between text and numeric responses from nginx
  - prevents auth cache from being invalidated due to nginx unavailability
 2026-06-12 16:32:22 -06:00
FreddleSpl0it
83a045ed3e
Merge pull request #7193 from mailcow/renovate/composer-composer-2.x 
Update dependency composer/composer to v2.10.1
 2026-06-11 10:07:19 +02:00
FreddleSpl0it
064817ac70
Merge pull request #7189 from mailcow/renovate/php-pecl-mail-mailparse-3.x 
Update dependency php/pecl-mail-mailparse to v3.2.0
 2026-06-11 10:06:49 +02:00
FreddleSpl0it
2bd7a24b8c
Merge pull request #7212 from mailcow/mkuron-patch-mobileconfig 
Escape generated password in mobileconfig
 2026-06-11 10:05:17 +02:00
FreddleSpl0it
ecc2462e4c
Merge pull request #7267 from goodygh/7249-update-sogo 
[SOGo] Update to 5.12.9
 2026-06-11 10:04:30 +02:00
FreddleSpl0it
2d8db72d46
Merge pull request #7275 from Snafu/fix/admin-mailbox-tfa-missing 
Fix force_tfa not available in mailbox template #7216
 2026-06-11 10:03:39 +02:00
FreddleSpl0it
277a307fb9
[Web] Fix refresh SOGo view on mailbox deletion 2026-06-11 09:55:32 +02:00
FreddleSpl0it
d455555621
Merge pull request #7277 from ibobgunardi/bobi/mailcow-7136-sogo-active-refresh 
Refresh SOGo view after mailbox activation
 2026-06-11 09:53:30 +02:00
FreddleSpl0it
24cc369d84
[Rspamd] Migrate metadata_exporter to multipart formatter 2026-06-11 09:34:27 +02:00
FreddleSpl0it
5f5367f2f9
Merge pull request #7172 from mailcow/dragoangel-patch-4 
Update RSPAMD version to 4.1.0 in Dockerfile
 2026-06-11 09:04:19 +02:00
milkmaker
03c31f825a
update postscreen_access.cidr (#7269) 2026-06-09 12:20:53 +02:00
Dmytro Alieksieiev
15891960f7
Update RSPAMD version to 4.1.0 2026-06-09 01:19:06 +02:00
Bobby
cce02e2b15 Refresh SOGo view after mailbox activation 2026-06-08 00:01:43 +07:00
Snafu
0fafda696b Fix force_tfa not available in mailbox template #7216 2026-06-07 17:03:52 +02:00
renovate[bot]
843db5854c
Update dependency composer/composer to v2.10.1 
Signed-off-by: milkmaker <milkmaker@mailcow.de>
 2026-06-04 11:04:42 +00:00
goodygh
23e4e4f373 [SOGo] Update to 5.12.9 2026-05-29 01:39:38 +02:00
goodygh
175878f8f1
ui, fail2ban fix german ban_list_info translation (#7265) 2026-05-28 22:20:26 +02:00
milkmaker
3fcda21c4e
[Web] Updated lang.vi-vn.json (#7263) 
Co-authored-by: Phu D. Nguyen <sillycat@duck.com>
 2026-05-27 17:46:42 +02:00
milkmaker
eac1bf02fc
[Web] Updated lang.lv-lv.json (#7262) 
Co-authored-by: Edgars Andersons <Edgars+Mailcow+Weblate@gaitenis.id.lv>
 2026-05-26 22:02:05 +02:00
FreddleSpl0it
be37bc5a68
Merge pull request #7252 from SYNLINQ/staging 
fix unbound CVE-2026-33278
 2026-05-26 10:41:52 +02:00
FreddleSpl0it
db4e3b4d54
[Nginx] Update to 1.30.2 2026-05-26 10:36:39 +02:00
Michael Kuron
ffbc37a00c Escape generated password in mobileconfig 
Escape ampersand, less than, greater than to avoid generating invalid XML.

Fixes #7171
 2026-05-24 11:52:12 +02:00
SYNLINQ
7d17715e2e
Update Dockerfile 
install unbound package from alpine:edge
 2026-05-22 16:26:47 +02:00
milkmaker
4f2348631a
[Web] Updated lang.pl-pl.json (#7245) 
Co-authored-by: Adrian-Kozien <adrian@kozien.net>
 2026-05-21 17:16:34 +02:00
FreddleSpl0it
22ae1f5363
Merge pull request #7241 from mailcow/fix/quarantinetable 
escape HTML in quarantine table
 2026-05-20 18:02:19 +02:00
FreddleSpl0it
cbd3d8b9bc
escape HTML in quarantine table 2026-05-20 17:53:47 +02:00
FreddleSpl0it
f553f38635
[Nginx] Update to 1.30.1 2026-05-20 17:24:41 +02:00
renovate[bot]
104af58628
Update dependency php/pecl-mail-mailparse to v3.2.0 
Signed-off-by: milkmaker <milkmaker@mailcow.de>
 2026-05-14 18:33:03 +00:00
Jahongir Qurbonov
4ddcee28e4
Add Uzbek language (#7224) 2026-05-13 16:42:38 +02:00
milkmaker
b0d16bbcee
[Web] Updated lang.pt-br.json (#7228) 
Co-authored-by: Edson Wolf <edsonwolf@vivaldi.net>
 2026-05-13 16:42:03 +02:00
FreddleSpl0it
ff3d571054
[SOGo] Update to 5.12.8 2026-05-13 10:31:23 +02:00
FreddleSpl0it
a8e945f3da
Merge pull request #7220 from mailcow/fix/06052026 
[Web] escape HTML in sieve filter edit view and queue manager
 2026-05-12 08:36:36 +02:00
FreddleSpl0it
33547d1d73
[Web] escape HTML in sieve filter edit view and queue manager 2026-05-12 08:31:51 +02:00
milkmaker
539c32d99c
Translations update from Weblate (#7218) 
* [Web] Updated lang.az-az.json

Co-authored-by: Nemoralis <nemoralis@duck.com>

* [Web] Updated lang.nl-nl.json

Co-authored-by: Tom18314 <tomstokmans5@gmail.com>

* [Web] Updated lang.pl-pl.json

Co-authored-by: pmuch78 <pawel@prolin.pl>

---------

Co-authored-by: Nemoralis <nemoralis@duck.com>
Co-authored-by: Tom18314 <tomstokmans5@gmail.com>
Co-authored-by: pmuch78 <pawel@prolin.pl>
 2026-05-08 16:46:10 +02:00
milkmaker
d42c3823c4
update postscreen_access.cidr (#7209) 2026-05-02 19:15:14 +02:00
FreddleSpl0it
8ead057ce9
[Web] Create default mailbox template with eas and dav access 2026-04-15 09:33:23 +02:00
milkmaker
886dbcc419
Translations update from Weblate (#7190) 
* [Web] Updated lang.az-az.json

[Web] Added lang.az-az.json

Co-authored-by: Nemoralis <nemoralis@duck.com>
Co-authored-by: Peter <magic@kthx.at>
Co-authored-by: milkmaker <milkmaker@mailcow.de>

* [Web] Updated lang.si-si.json

Co-authored-by: Matjaž Tekavec <matjaz@moj-svet.si>

* [Web] Updated lang.pt-br.json

Co-authored-by: André Ribas <andre@ribassu.com>

---------

Co-authored-by: Nemoralis <nemoralis@duck.com>
Co-authored-by: Peter <magic@kthx.at>
Co-authored-by: Matjaž Tekavec <matjaz@moj-svet.si>
Co-authored-by: André Ribas <andre@ribassu.com>
 2026-04-11 21:25:03 +02:00
Dmitriy Alekseev
b0873edb6a
Update RSPAMD version in Dockerfile 2026-04-06 17:28:32 +02:00
Dmitriy Alekseev
694d751915
Update RSPAMD version in Dockerfile 2026-04-06 17:28:14 +02:00
milkmaker
dc15994d40
update postscreen_access.cidr (#7177) 2026-04-02 11:50:05 +02:00
Dmitriy Alekseev
08278a8be9
Update RSPAMD version to 4.0.0 in Dockerfile 2026-03-30 23:51:05 +02:00
FreddleSpl0it
5a00b5124b
[Web][Dovecot] Add parameterized queries and input validation for quarantine_category 2026-03-29 12:08:45 +02:00
FreddleSpl0it
8c039f694f
Improve template URI escaping and parameter handling 2026-03-19 12:48:43 +01:00
FreddleSpl0it
95bf46c1e4
escape HTML in autodiscover logs 2026-03-19 12:44:50 +01:00
FreddleSpl0it
edde35156d
escape HTML in qitem details 2026-03-19 12:44:30 +01:00
FreddleSpl0it
84e3c32f13
escape HTML in last logins 2026-03-19 12:44:00 +01:00
FreddleSpl0it
ecb848493b
add missing object-level access control 2026-03-19 12:42:45 +01:00
FreddleSpl0it
8a65b9d1c6
add missing access control 2026-03-19 12:41:47 +01:00
FreddleSpl0it
ed9264fd2a
[Web] Allow force_tfa for LDAP and Keycloak users 2026-03-13 14:13:25 +01:00
FreddleSpl0it
7817dda43f
[ACME] Skip subdomains covered by wildcards (DNS-01 challenge only) 2026-03-13 13:08:18 +01:00
FreddleSpl0it
127fb1e8f5
[ACME] Skip autodiscover/mta-sts subdomains covered by wildcard certificates 2026-03-13 12:35:22 +01:00
milkmaker
09f09cb850
[Web] Updated lang.hu-hu.json (#7130) 2026-03-12 15:01:54 +01:00
FreddleSpl0it
d4bf377a96
Merge pull request #7121 from rezzorix/fix/theme-localstorage-staging 
Fix theme localStorage collision with rspamd UI
 2026-03-12 07:47:03 +01:00
FreddleSpl0it
abd6fe8c79
Merge pull request #7124 from mailcow/fix/7112 
[ACME] Fix wildcard certificate conflict with MAILCOW_HOSTNAME
 2026-03-12 07:46:02 +01:00
rezzorix
03eccd4e42 added/fix: use mailcow_theme in bundled dark mode JS 2026-03-12 14:11:31 +08:00
FreddleSpl0it
1da8d1c894
[ACME] Fix wildcard certificate conflict with MAILCOW_HOSTNAME 2026-03-11 09:33:16 +01:00
FreddleSpl0it
d1feebf164
[Web] Fix LDAP/Keycloak login TypeError - missing JSON decode for attributes 2026-03-11 09:18:03 +01:00
rezzorix
293b885a85 Fix theme localStorage collision with rspamd UI 2026-03-11 13:32:53 +08:00
FreddleSpl0it
33acf56526
[SOGo] Add ActiveSync support 2026-03-10 13:13:00 +01:00
FreddleSpl0it
e7ea3aa608
[SOGo] Fix draft folder creation by adding /var/spool/sogo directory 2026-03-10 10:31:50 +01:00
FreddleSpl0it
2e176339ba
[Watchdog] Fix Nagios MariaDB client SSL compatibility with Alpine 3.23 2026-03-10 10:01:18 +01:00
FreddleSpl0it
8f883f3d37
Rename dns-101 to dns-01 2026-03-09 15:27:33 +01:00
FreddleSpl0it
8760e7e5db
[Rspamd] Update to 3.14.3-1 2026-03-09 07:59:34 +01:00
FreddleSpl0it
e848226062
[SOGo] Update paths from /usr/lib/ to /usr/local/lib/ 2026-03-06 16:26:13 +01:00
FreddleSpl0it
efaeb77e13
Merge pull request #7093 from mailcow/fix/7054 
[SOGo][Web] use incremental updates for mailbox/alias/resource sync in sogo_static_view
 2026-03-06 09:23:00 +01:00
FreddleSpl0it
6c857243ec
[SOGo] Update to 5.12.5 2026-03-06 09:18:10 +01:00
milkmaker
6012cf4486
[Web] Updated lang.nl-nl.json (#7095) 
Co-authored-by: Tom18314 <tomstokmans5@gmail.com>
 2026-03-04 23:03:02 +01:00
FreddleSpl0it
fe71f84c82
[SOGo] Fix custom UI patches after moving to source-compiled SOGo 2026-03-04 14:55:52 +01:00
FreddleSpl0it
97312c1a9d
Update alpine images to 3.23 2026-03-04 13:35:11 +01:00
FreddleSpl0it
dcbea71e67
[ACME] auto-create DNS-01 config template on startup 2026-03-04 11:42:40 +01:00
FreddleSpl0it
4e33c7143f
[SOGo][Web] use incremental updates for mailbox/alias/resource sync in sogo_static_view 2026-03-04 11:16:48 +01:00
milkmaker
4c184b25f4
Translations update from Weblate (#7091) 
* [Web] Language file updated by 'Cleanup translation files' addon

Co-authored-by: milkmaker <milkmaker@mailcow.de>

* [Web] Updated lang.si-si.json

Co-authored-by: Matjaž Tekavec <matjaz@moj-svet.si>

---------

Co-authored-by: Matjaž Tekavec <matjaz@moj-svet.si>
 2026-03-03 20:25:24 +01:00
FreddleSpl0it
ddc2309f1e
Merge pull request #7089 from mailcow/fix/7039 
[Web] switch from GET to POST for datatable requests
 2026-03-03 15:07:17 +01:00
FreddleSpl0it
d40252ccce
[Web] Add missing EAS and DAV protocol options to mailbox bulk actions 2026-03-03 14:39:41 +01:00
FreddleSpl0it
4abb5cbfab
Merge pull request #7086 from mailcow/feat/sogo-build 
[SOGo] Build SOGo from source with security patches
 2026-03-03 14:24:29 +01:00
FreddleSpl0it
b695936273
Merge pull request #6912 from cjlapao/feat-acme-dns 
acme: add DNS challenges
 2026-03-03 14:23:28 +01:00
DerLinkman
d9463c7950
sogo: shrinked image file by ~50% 2026-03-03 14:14:32 +01:00
FreddleSpl0it
579542381a
Merge pull request #7060 from jovobe/staging 
Bump alpine version of netfilter
 2026-03-03 14:06:01 +01:00
FreddleSpl0it
ce5659f300
Merge pull request #7082 from JeremieCrinon/fix/show-stopped-containers-api-and-dashboard 
fix: show stopped and failed containers in dashboard and API
 2026-03-03 14:01:03 +01:00
FreddleSpl0it
1967cb642f
Merge pull request #6457 from mailcow/renovate/composer-composer-2.x 
chore(deps): update dependency composer/composer to v2.9.5
 2026-03-03 13:38:32 +01:00
FreddleSpl0it
ba0eb04ebe
Merge pull request #6695 from maxi322/feature/check_dns_improvement 
check_dns: better time measurement
 2026-03-03 13:31:23 +01:00
FreddleSpl0it
609ce6b0d6
Merge pull request #6976 from mailcow/fix/autodiscover-passwordless 
feat: Implement passwordless autodiscover endpoint
 2026-03-03 13:25:16 +01:00
FreddleSpl0it
af61e2d303
[Web] Add fail2ban logging to passwordless autodiscover endpoint 2026-03-03 13:24:44 +01:00