amorfo77/mailcow-dockerized
1
0 Fork 0
mirror of https://github.com/mailcow/mailcow-dockerized.git synced 2026-11-10 10:31:01 +00:00
Code Issues Projects Releases Wiki Activity

[Web] Mail policies, groups: check domain access first

Browse Source
This commit is contained in:
FreddleSpl0it committed 2026-11-09 12:19:07 +01:00
1 parent c304040140
commit 03ce9fe879
4 files changed
+33 -11
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

tests/php/MailPolicy/Service/PolicyServiceTest.php
+3 -1
View File
@@ -28,7 +28,7 @@ class PolicyServiceTest extends TestCase
protected function setUp(): void
{
$this->repo = $this->createMock(PolicyRepository::class);
$this->repo->method('isDomain')->willReturnCallback(fn(string $domain): bool => in_array($domain, ['firma.de', 'tochter.de'], true));
$this->repo->method('isDomain')->willReturnCallback(fn(string $domain): bool => in_array($domain, ['firma.de', 'tochter.de', 'xn--mller-kva.de'], true));
$this->repo->method('mailboxDomain')->willReturnCallback(fn(string $username): ?string =>
['azubi@firma.de' => 'firma.de', 'chef@firma.de' => 'firma.de', 'andere@tochter.de' => 'tochter.de'][$username] ?? null);
$this->repo->method('groupDomain')->willReturnCallback(function (int $id): ?string {
@@ -91,6 +91,7 @@ class PolicyServiceTest extends TestCase
], array_intersect_key($policy->toArray(), array_flip(['domain', 'name', 'description', 'send_mode', 'send_allow', 'send_block',
'receive_mode', 'receive_allow', 'receive_block', 'reject_text', 'active', 'mailboxes', 'groups'])));
$this->assertCount(1, $this->saved);
$this->assertSame('xn--mller-kva.de', $this->service()->create(['domain' => 'Müller.de', 'name' => 'Test'])->domain);
}
public function testUpdateKeepsMissingValuesAndReplacesListGroups(): void
@@ -153,6 +154,7 @@ class PolicyServiceTest extends TestCase
$this->assertNotNull($this->service($da)->get(3));
// other domains, no ACL, users and read-only keys
$this->expectUserError('access_denied', fn() => $this->service($da)->create(['domain' => 'tochter.de', 'name' => 'Test']));
$this->expectUserError('access_denied', fn() => $this->service($da)->create(['domain' => 'unbekannt.de', 'name' => 'Test']));
$this->expectUserError(['mail_policy_entry_invalid', 'group:9'],
fn() => $this->service($da)->create(['domain' => 'firma.de', 'name' => 'Test', 'send_block_groups' => ['9']]));
$this->assertNull($this->service(FakeContext::domainAdmin([], ['tochter.de'], ['mail_policies' => '1']))->get(3));
tests/php/MailboxGroup/Service/GroupServiceTest.php
+9
View File
@@ -184,6 +184,15 @@ class GroupServiceTest extends TestCase
$this->expectUserError('access_denied', fn() => $service->create(['domain' => 'other.org', 'name' => 'X']));
$this->expectUserError('access_denied', fn() => $service->create(['domain' => 'example.org', 'name' => 'X', 'members' => ['c@other.org']]));
$this->expectUserError('access_denied', fn() => $service->create(['domain' => 'example.org', 'name' => 'X', 'send_as' => '@other.org']));
// unknown names outside their domains look the same as existing ones
$this->expectUserError('access_denied', fn() => $service->create(['domain' => 'nope.org', 'name' => 'X']));
$this->expectUserError('access_denied', fn() => $service->create(['domain' => 'example.org', 'name' => 'X', 'members' => ['room1@other.org']]));
$this->expectUserError('access_denied', fn() => $service->create(['domain' => 'example.org', 'name' => 'X', 'send_as' => '@nope.org']));
$this->expectUserError('access_denied', fn() => $service->create(['domain' => 'example.org', 'name' => 'X', 'send_as' => 'nobody@other.org']));
$this->expectUserError(['group_member_invalid', 'room1@example.org'],
fn() => $service->create(['domain' => 'example.org', 'name' => 'X', 'members' => ['room1@example.org']]));
$this->expectUserError(['group_send_as_invalid', 'nobody@example.org'],
fn() => $service->create(['domain' => 'example.org', 'name' => 'X', 'send_as' => 'nobody@example.org']));
}
public function testAdminFieldsAreIgnoredForDomainAdmins(): void