From b5fa926bc043a36faabc1fba83f4829be7e009fb Mon Sep 17 00:00:00 2001
From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com>
Date: Thu, 13 Aug 2026 13:56:49 +0200
Subject: [PATCH 1/5] [Clamd] Update to 1.4.6

---
 data/Dockerfiles/clamd/Dockerfile | 6 +++---
 docker-compose.yml                | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/data/Dockerfiles/clamd/Dockerfile b/data/Dockerfiles/clamd/Dockerfile
index e60e7eef1..5f444a8f4 100644
--- a/data/Dockerfiles/clamd/Dockerfile
+++ b/data/Dockerfiles/clamd/Dockerfile
@@ -1,7 +1,7 @@
-FROM alpine:3.21 AS builder
+FROM alpine:3.24 AS builder
 
 WORKDIR /src
-ENV CLAMD_VERSION=1.4.2
+ENV CLAMD_VERSION=1.4.6
 
 RUN apk upgrade --no-cache \
   && apk add --update --no-cache \
@@ -68,7 +68,7 @@ RUN wget -P /src https://www.clamav.net/downloads/production/clamav-${CLAMD_VERS
   "/clamav/etc/clamav/clamav-milter.conf.sample" > "/clamav/etc/clamav/clamav-milter.conf" || exit 1
 
 
-FROM alpine:3.21
+FROM alpine:3.24
 
 LABEL maintainer = "The Infrastructure Company GmbH <info@servercow.de>"
 
diff --git a/docker-compose.yml b/docker-compose.yml
index 4742fef17..07c738e4c 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -65,7 +65,7 @@ services:
             - redis
 
     clamd-mailcow:
-      image: ghcr.io/mailcow/clamd:1.71
+      image: ghcr.io/mailcow/clamd:1.4.6-1
       restart: always
       depends_on:
         unbound-mailcow:

From 8c85044781163a94a5af13410ed965002bd8eecd Mon Sep 17 00:00:00 2001
From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com>
Date: Mon, 17 Aug 2026 08:20:45 +0200
Subject: [PATCH 2/5] [SOGo] Update to 5.12.10

---
 data/Dockerfiles/sogo/Dockerfile | 4 ++--
 docker-compose.yml               | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/data/Dockerfiles/sogo/Dockerfile b/data/Dockerfiles/sogo/Dockerfile
index b4b401e8c..f65ec7ebd 100644
--- a/data/Dockerfiles/sogo/Dockerfile
+++ b/data/Dockerfiles/sogo/Dockerfile
@@ -12,8 +12,8 @@ FROM debian:bookworm
 LABEL maintainer="The Infrastructure Company GmbH <info@servercow.de>"
 
 ARG DEBIAN_FRONTEND=noninteractive
-ARG SOGO_VERSION=SOGo-5.12.9
-ARG SOPE_VERSION=SOPE-5.12.9
+ARG SOGO_VERSION=SOGo-5.12.10
+ARG SOPE_VERSION=SOPE-5.12.10
 # Security patches to apply (space-separated commit hashes)
 ARG SOGO_SECURITY_PATCHES=""
 # renovate: datasource=github-releases depName=tianon/gosu versioning=semver-coerced extractVersion=^(?<version>.*)$
diff --git a/docker-compose.yml b/docker-compose.yml
index 07c738e4c..66455c103 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -200,7 +200,7 @@ services:
             - phpfpm
 
     sogo-mailcow:
-      image: ghcr.io/mailcow/sogo:5.12.9-1
+      image: ghcr.io/mailcow/sogo:5.12.10-1
       environment:
         - DBNAME=${DBNAME}
         - DBUSER=${DBUSER}

From feed5ad1831405ac2714a9e3c96eff6e91a53a41 Mon Sep 17 00:00:00 2001
From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com>
Date: Mon, 17 Aug 2026 08:35:53 +0200
Subject: [PATCH 3/5] [Dovecot] Remove legacy DeltaChat auto-filing sieve rule

---
 data/conf/dovecot/global_sieve_before | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/data/conf/dovecot/global_sieve_before b/data/conf/dovecot/global_sieve_before
index 3e79ca1d3..e71be5100 100644
--- a/data/conf/dovecot/global_sieve_before
+++ b/data/conf/dovecot/global_sieve_before
@@ -1,13 +1,3 @@
 # global_sieve_before script
 # global_sieve_before -> user sieve_before (mailcow UI) -> user sieve_after (mailcow UI) -> global_sieve_after
 
-require ["mailbox", "fileinto"];
-
-if header :contains ["Chat-Version"] [""] {
-  if mailboxexists "DeltaChat" {
-    fileinto "DeltaChat";
-  } else {
-    fileinto :create "DeltaChat";
-  }
-  stop;
-}

From 555e7ed706aeb8863109e0b2cd2fe0df68502000 Mon Sep 17 00:00:00 2001
From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com>
Date: Tue, 18 Aug 2026 08:12:32 +0200
Subject: [PATCH 4/5] [Redis] Update to 7.4.10

---
 docker-compose.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index 66455c103..7dce45691 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -42,7 +42,7 @@ services:
             - mysql
 
     redis-mailcow:
-      image: redis:7.4.6-alpine
+      image: redis:7.4.10-alpine
       entrypoint: ["/bin/sh","/redis-conf.sh"]
       volumes:
         - redis-vol-1:/data/

From 91d3b7246a53247feaa19350f8ec330423c6d909 Mon Sep 17 00:00:00 2001
From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com>
Date: Tue, 18 Aug 2026 09:08:17 +0200
Subject: [PATCH 5/5] [Web] Minor hardening across web UI and nginx

---
 data/conf/nginx/templates/sites-default.conf.j2 |  1 +
 data/web/inc/ajax/dns_diagnostics.php           | 12 ++++++------
 data/web/inc/functions.inc.php                  |  2 +-
 data/web/js/site/dashboard.js                   |  2 ++
 data/web/oauth/authorize.php                    |  6 ++++++
 5 files changed, 16 insertions(+), 7 deletions(-)

diff --git a/data/conf/nginx/templates/sites-default.conf.j2 b/data/conf/nginx/templates/sites-default.conf.j2
index 688f2baa6..842c50a54 100644
--- a/data/conf/nginx/templates/sites-default.conf.j2
+++ b/data/conf/nginx/templates/sites-default.conf.j2
@@ -116,6 +116,7 @@ location ~ \.php$ {
     include /etc/nginx/fastcgi_params;
     fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
     fastcgi_param PATH_INFO $fastcgi_path_info;
+    fastcgi_param HTTP_X_REAL_IP $remote_addr;
     # trusted internal-auth marker; empty for external clients (see nginx.conf map)
     fastcgi_param SOGO_AUTH_INTERNAL $sogo_auth_internal;
     fastcgi_read_timeout 3600;
diff --git a/data/web/inc/ajax/dns_diagnostics.php b/data/web/inc/ajax/dns_diagnostics.php
index 95e34e886..7ed92db77 100644
--- a/data/web/inc/ajax/dns_diagnostics.php
+++ b/data/web/inc/ajax/dns_diagnostics.php
@@ -380,13 +380,13 @@ if (isset($_SESSION['mailcow_cc_role']) && ($_SESSION['mailcow_cc_role'] == "adm
             else {
               $state = state_nomatch;
             }
-            $state .= '<br />' . $current[$data_field[$current['type']]];
+            $state .= '<br />' . htmlspecialchars($current[$data_field[$current['type']]]);
           }
           if ($current['type'] == 'TXT' &&
               stripos($current['txt'], 'v=dmarc') === 0 &&
               $record[2] == $dmarc_link) {
             $current['txt'] = str_replace(' ', '', $current['txt']);
-            $state = $current[$data_field[$current['type']]] . state_optional;
+            $state = htmlspecialchars($current[$data_field[$current['type']]]) . state_optional;
           }
           elseif ($current['type'] == 'TXT' &&
                   stripos($current['txt'], 'v=spf') === 0 &&
@@ -396,7 +396,7 @@ if (isset($_SESSION['mailcow_cc_role']) && ($_SESSION['mailcow_cc_role'] == "adm
             if (in_array($ip, $rslt) && in_array(expand_ipv6($ip6), $rslt)) {
               $state = state_good;
             }
-            $state .= '<br />' . $current[$data_field[$current['type']]] . state_optional;
+            $state .= '<br />' . htmlspecialchars($current[$data_field[$current['type']]]) . state_optional;
           }
           elseif ($current['type'] == 'TXT' &&
                   stripos($current['txt'], 'v=dkim') === 0 &&
@@ -426,7 +426,7 @@ if (isset($_SESSION['mailcow_cc_role']) && ($_SESSION['mailcow_cc_role'] == "adm
         if ($state == state_nomatch) {
           $state = array();
           foreach ($currents as $current) {
-            $state[] = $current[$data_field[$current['type']]];
+            $state[] = htmlspecialchars($current[$data_field[$current['type']]]);
           }
           $state = implode('<br />', $state);
         }
@@ -436,7 +436,7 @@ if (isset($_SESSION['mailcow_cc_role']) && ($_SESSION['mailcow_cc_role'] == "adm
           <td>%s</td>
           <td class="dns-found">%s</td>
           <td class="dns-recommended">%s</td>
-        </tr>', $record[0], $record[1], $record[2], $state);
+        </tr>', htmlspecialchars($record[0]), htmlspecialchars($record[1]), $record[2], $state);
         $record[3] = explode('<br />', $state);
       }
 
@@ -477,7 +477,7 @@ if (isset($_SESSION['mailcow_cc_role']) && ($_SESSION['mailcow_cc_role'] == "adm
       }
       ?>
     </table>
-    <a id='download-zonefile' class="btn btn-sm btn-secondary visible-xs-block visible-sm-inline visible-md-inline visible-lg-inline mb-4" style="margin-top:10px" data-zonefile="<?=base64_encode($dns_data);?>" download='<?=$_GET['domain'];?>.txt' type='text/csv'>Download</a>
+    <a id='download-zonefile' class="btn btn-sm btn-secondary visible-xs-block visible-sm-inline visible-md-inline visible-lg-inline mb-4" style="margin-top:10px" data-zonefile="<?=base64_encode($dns_data);?>" download='<?=htmlspecialchars($_GET['domain']);?>.txt' type='text/csv'>Download</a>
     <script>
       var zonefile_dl_link = document.getElementById('download-zonefile');
       var zonefile = atob(zonefile_dl_link.getAttribute('data-zonefile'));
diff --git a/data/web/inc/functions.inc.php b/data/web/inc/functions.inc.php
index dfd860a9b..90c830b69 100644
--- a/data/web/inc/functions.inc.php
+++ b/data/web/inc/functions.inc.php
@@ -591,7 +591,7 @@ function logger($_data = false) {
       $type = $return['type'];
       $msg = null;
       if (isset($return['msg'])) {
-        $msg = json_encode($return['msg'], JSON_UNESCAPED_UNICODE);
+        $msg = json_encode($return['msg'], JSON_UNESCAPED_UNICODE | JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT);
       }
       $call = null;
       if (isset($return['log'])) {
diff --git a/data/web/js/site/dashboard.js b/data/web/js/site/dashboard.js
index d591f8ac0..7c077e27b 100644
--- a/data/web/js/site/dashboard.js
+++ b/data/web/js/site/dashboard.js
@@ -1169,6 +1169,7 @@ jQuery(function($){
         if (item === null) { return true; }
         item.user = escapeHtml(item.user);
         item.call = escapeHtml(item.call);
+        if (item.msg) item.msg = escapeHtml(item.msg);
         item.task = '<code>' + item.task + '</code>';
         item.type = '<span class="badge fs-6 bg-' + item.type + '">' + item.type + '</span>';
       });
@@ -1176,6 +1177,7 @@ jQuery(function($){
       $.each(data, function (i, item) {
         if (item === null) { return true; }
         item.username = escapeHtml(item.username);
+        item.real_rip = escapeHtml(item.real_rip);
         item.service = '<div class="badge fs-6 bg-secondary">' + item.service.toUpperCase() + '</div>';
       });
     } else if (table == 'general_syslog') {
diff --git a/data/web/oauth/authorize.php b/data/web/oauth/authorize.php
index 1fdcd0335..2bde21d36 100644
--- a/data/web/oauth/authorize.php
+++ b/data/web/oauth/authorize.php
@@ -4,6 +4,7 @@ require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
 if (!isset($_SESSION['mailcow_cc_role'])) {
   $_SESSION['oauth2_request'] = $_SERVER['REQUEST_URI'];
   header('Location: /?oauth');
+  exit;
 }
 
 $request = OAuth2\Request::createFromGlobals();
@@ -24,6 +25,11 @@ if (!isset($_POST['authorized'])) {
   exit;
 }
 
+if (empty($_SESSION['mailcow_cc_username'])) {
+  header('Location: /?oauth');
+  exit;
+}
+
 // print the authorization code if the user has authorized your client
 $is_authorized = ($_POST['authorized'] == '1');
 $oauth2_server->handleAuthorizeRequest($request, $response, $is_authorized, $_SESSION['mailcow_cc_username']);