Gnous/mailcow
2
0
Fork 0
Code Issues Pull Requests 1 Packages Projects Releases Wiki Activity
7,610 Commits 2 Branches 0 Tags 50 MiB
95a77f2dcb
Commit Graph

2909 Commits

Author SHA1 Message Date
FreddleSpl0it
95a77f2dcb
Merge pull request #7348 from smpaz7467/fix/api-get-mailbox-sender-acl 
[Web] return sender_acl in get/mailbox API
 2026-07-28 14:12:57 +02:00
Stephen Ritz
14772c3a20 [Web] return sender_acl in get/mailbox API 
sender_acl can be set through edit/mailbox but was never returned by
get/mailbox, so an API client could not read back what it had written,
and get/mailbox/all / get/mailbox/{mailbox} both omitted it.

Add the mailbox's internal send-as ACL (the sender_acl table rows with
external = 0) to mailbox_details as sender_acl, an array of send_as
values, mirroring the field edit/mailbox accepts. It is added in the same
block as the other detailed fields, so the lightweight get/mailbox/reduced
endpoint is unaffected.

Fixes #7011

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-14 16:36:40 -07:00
Stephen Ritz
c17cc8a792 [Web] fix add/time_limited_alias silently discarding requests and validity 
Three defects in add/time_limited_alias:

The description was read as $_data['description'] without a guard. When a
client omits it, null is bound to spamalias.description, which is TEXT NOT
NULL, so the insert raises a PDOException. The global exception handler is
terminal, so process_add_return() never echoes anything and the caller sees
HTTP 200 with an empty body while no alias was created. Default it to an
empty string instead.

The validity guard used a single condition whose else branch also caught the
success case, so every valid validity was overwritten with the 8760 hour
default and the parameter did nothing. Only invalid values were rejected.
Nest the range check so a valid value survives.

The OpenAPI spec documented only username and domain, while the code also
reads description, validity and permanent. Spec driven clients therefore
could not construct a working request. Document all three.

spamalias.description is the only NOT NULL description column in the schema,
which is why the same unguarded read in add/domain and add/resource does not
fail, both of those columns are nullable.

This does not change the generic exception handling. A database error is
still swallowed into an empty HTTP 200, and the message the handler builds
carries the raw PDOException, so surfacing it to API clients would need
sanitising first. That is left for a separate change.

Refs #7287

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-14 15:23:31 -07:00
Ralf Bergs
e696ee2f6c Refined wording for displaying of active settings on quarantine page. 2026-07-12 17:22:15 +02:00
milkmaker
9e723e942d
Translations update from Weblate (#7302) 
* [Web] Updated lang.fr-fr.json

Co-authored-by: Romain Ayme <ayme.romain@hotmail.fr>

* [Web] Updated lang.si-si.json

Co-authored-by: Matjaž Tekavec <matjaz@moj-svet.si>

---------

Co-authored-by: Romain Ayme <ayme.romain@hotmail.fr>
Co-authored-by: Matjaž Tekavec <matjaz@moj-svet.si>
 2026-06-20 13:57:15 +02:00
FreddleSpl0it
2bd7a24b8c
Merge pull request #7212 from mailcow/mkuron-patch-mobileconfig 
Escape generated password in mobileconfig
 2026-06-11 10:05:17 +02:00
FreddleSpl0it
2d8db72d46
Merge pull request #7275 from Snafu/fix/admin-mailbox-tfa-missing 
Fix force_tfa not available in mailbox template #7216
 2026-06-11 10:03:39 +02:00
FreddleSpl0it
277a307fb9
[Web] Fix refresh SOGo view on mailbox deletion 2026-06-11 09:55:32 +02:00
Bobby
cce02e2b15 Refresh SOGo view after mailbox activation 2026-06-08 00:01:43 +07:00
Snafu
0fafda696b Fix force_tfa not available in mailbox template #7216 2026-06-07 17:03:52 +02:00
goodygh
175878f8f1
ui, fail2ban fix german ban_list_info translation (#7265) 2026-05-28 22:20:26 +02:00
milkmaker
3fcda21c4e
[Web] Updated lang.vi-vn.json (#7263) 
Co-authored-by: Phu D. Nguyen <sillycat@duck.com>
 2026-05-27 17:46:42 +02:00
milkmaker
eac1bf02fc
[Web] Updated lang.lv-lv.json (#7262) 
Co-authored-by: Edgars Andersons <Edgars+Mailcow+Weblate@gaitenis.id.lv>
 2026-05-26 22:02:05 +02:00
Michael Kuron
ffbc37a00c Escape generated password in mobileconfig 
Escape ampersand, less than, greater than to avoid generating invalid XML.

Fixes #7171
 2026-05-24 11:52:12 +02:00
milkmaker
4f2348631a
[Web] Updated lang.pl-pl.json (#7245) 
Co-authored-by: Adrian-Kozien <adrian@kozien.net>
 2026-05-21 17:16:34 +02:00
FreddleSpl0it
cbd3d8b9bc
escape HTML in quarantine table 2026-05-20 17:53:47 +02:00
Jahongir Qurbonov
4ddcee28e4
Add Uzbek language (#7224) 2026-05-13 16:42:38 +02:00
milkmaker
b0d16bbcee
[Web] Updated lang.pt-br.json (#7228) 
Co-authored-by: Edson Wolf <edsonwolf@vivaldi.net>
 2026-05-13 16:42:03 +02:00
FreddleSpl0it
a8e945f3da
Merge pull request #7220 from mailcow/fix/06052026 
[Web] escape HTML in sieve filter edit view and queue manager
 2026-05-12 08:36:36 +02:00
FreddleSpl0it
33547d1d73
[Web] escape HTML in sieve filter edit view and queue manager 2026-05-12 08:31:51 +02:00
milkmaker
539c32d99c
Translations update from Weblate (#7218) 
* [Web] Updated lang.az-az.json

Co-authored-by: Nemoralis <nemoralis@duck.com>

* [Web] Updated lang.nl-nl.json

Co-authored-by: Tom18314 <tomstokmans5@gmail.com>

* [Web] Updated lang.pl-pl.json

Co-authored-by: pmuch78 <pawel@prolin.pl>

---------

Co-authored-by: Nemoralis <nemoralis@duck.com>
Co-authored-by: Tom18314 <tomstokmans5@gmail.com>
Co-authored-by: pmuch78 <pawel@prolin.pl>
 2026-05-08 16:46:10 +02:00
milkmaker
886dbcc419
Translations update from Weblate (#7190) 
* [Web] Updated lang.az-az.json

[Web] Added lang.az-az.json

Co-authored-by: Nemoralis <nemoralis@duck.com>
Co-authored-by: Peter <magic@kthx.at>
Co-authored-by: milkmaker <milkmaker@mailcow.de>

* [Web] Updated lang.si-si.json

Co-authored-by: Matjaž Tekavec <matjaz@moj-svet.si>

* [Web] Updated lang.pt-br.json

Co-authored-by: André Ribas <andre@ribassu.com>

---------

Co-authored-by: Nemoralis <nemoralis@duck.com>
Co-authored-by: Peter <magic@kthx.at>
Co-authored-by: Matjaž Tekavec <matjaz@moj-svet.si>
Co-authored-by: André Ribas <andre@ribassu.com>
 2026-04-11 21:25:03 +02:00
FreddleSpl0it
5a00b5124b
[Web][Dovecot] Add parameterized queries and input validation for quarantine_category 2026-03-29 12:08:45 +02:00
FreddleSpl0it
8c039f694f
Improve template URI escaping and parameter handling 2026-03-19 12:48:43 +01:00
FreddleSpl0it
95bf46c1e4
escape HTML in autodiscover logs 2026-03-19 12:44:50 +01:00
FreddleSpl0it
edde35156d
escape HTML in qitem details 2026-03-19 12:44:30 +01:00
FreddleSpl0it
84e3c32f13
escape HTML in last logins 2026-03-19 12:44:00 +01:00
FreddleSpl0it
ecb848493b
add missing object-level access control 2026-03-19 12:42:45 +01:00
FreddleSpl0it
8a65b9d1c6
add missing access control 2026-03-19 12:41:47 +01:00
FreddleSpl0it
ed9264fd2a
[Web] Allow force_tfa for LDAP and Keycloak users 2026-03-13 14:13:25 +01:00
milkmaker
09f09cb850
[Web] Updated lang.hu-hu.json (#7130) 2026-03-12 15:01:54 +01:00
FreddleSpl0it
d4bf377a96
Merge pull request #7121 from rezzorix/fix/theme-localstorage-staging 
Fix theme localStorage collision with rspamd UI
 2026-03-12 07:47:03 +01:00
rezzorix
03eccd4e42 added/fix: use mailcow_theme in bundled dark mode JS 2026-03-12 14:11:31 +08:00
FreddleSpl0it
d1feebf164
[Web] Fix LDAP/Keycloak login TypeError - missing JSON decode for attributes 2026-03-11 09:18:03 +01:00
rezzorix
293b885a85 Fix theme localStorage collision with rspamd UI 2026-03-11 13:32:53 +08:00
FreddleSpl0it
efaeb77e13
Merge pull request #7093 from mailcow/fix/7054 
[SOGo][Web] use incremental updates for mailbox/alias/resource sync in sogo_static_view
 2026-03-06 09:23:00 +01:00
milkmaker
6012cf4486
[Web] Updated lang.nl-nl.json (#7095) 
Co-authored-by: Tom18314 <tomstokmans5@gmail.com>
 2026-03-04 23:03:02 +01:00
FreddleSpl0it
4e33c7143f
[SOGo][Web] use incremental updates for mailbox/alias/resource sync in sogo_static_view 2026-03-04 11:16:48 +01:00
milkmaker
4c184b25f4
Translations update from Weblate (#7091) 
* [Web] Language file updated by 'Cleanup translation files' addon

Co-authored-by: milkmaker <milkmaker@mailcow.de>

* [Web] Updated lang.si-si.json

Co-authored-by: Matjaž Tekavec <matjaz@moj-svet.si>

---------

Co-authored-by: Matjaž Tekavec <matjaz@moj-svet.si>
 2026-03-03 20:25:24 +01:00
FreddleSpl0it
ddc2309f1e
Merge pull request #7089 from mailcow/fix/7039 
[Web] switch from GET to POST for datatable requests
 2026-03-03 15:07:17 +01:00
FreddleSpl0it
d40252ccce
[Web] Add missing EAS and DAV protocol options to mailbox bulk actions 2026-03-03 14:39:41 +01:00
FreddleSpl0it
ce5659f300
Merge pull request #7082 from JeremieCrinon/fix/show-stopped-containers-api-and-dashboard 
fix: show stopped and failed containers in dashboard and API
 2026-03-03 14:01:03 +01:00
FreddleSpl0it
609ce6b0d6
Merge pull request #6976 from mailcow/fix/autodiscover-passwordless 
feat: Implement passwordless autodiscover endpoint
 2026-03-03 13:25:16 +01:00
FreddleSpl0it
af61e2d303
[Web] Add fail2ban logging to passwordless autodiscover endpoint 2026-03-03 13:24:44 +01:00
FreddleSpl0it
c6e3f517e1
Merge pull request #7047 from jonprocter/staging 
Document qitem endpoint in openapi.yaml for editing quarantine mails
 2026-03-03 13:11:43 +01:00
FreddleSpl0it
c033cd6254
Merge pull request #7077 from mailcow/feat/force-tfa 
[Web] Add forced 2FA setup and password update enforcement
 2026-03-03 13:01:16 +01:00
FreddleSpl0it
43f570e761
[Web] switch from GET to POST for datatable requests 2026-03-03 08:10:16 +01:00
Jérémie Crinon
99dc0f6616 fix: show stopped and failed containers in dashboard and API 2026-02-27 13:41:36 +01:00
FreddleSpl0it
96d4802cb2
[Web] Switch QR code generation from external API to local library and fix composer.json/lock mismatch 2026-02-24 11:02:47 +01:00
FreddleSpl0it
ad5b94af5e
[Web] Add forced 2FA setup and password update enforcement 2026-02-24 10:44:33 +01:00