amorfo77/mailcow-dockerized
1
0 Fork 0
mirror of https://github.com/mailcow/mailcow-dockerized.git synced 2026-10-23 11:08:54 +00:00
Code Issues Projects Releases Wiki Activity

[Web] Restrict read-only API sessions

Browse Source
This commit is contained in:
FreddleSpl0it committed 2026-10-23 11:21:45 +02:00
1 parent 40488b2120
commit 4828f0cf64
2 files changed
+8
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

data/web/inc/ajax/container_ctrl.php
+4
View File
@@ -10,6 +10,10 @@ require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
if (!isset($_SESSION['mailcow_cc_role']) || $_SESSION['mailcow_cc_role'] != 'admin') {
exit();
}
// Read-only API keys must not control containers
if (!empty($_SESSION['mailcow_cc_api']) && ($_SESSION['mailcow_cc_api_access'] ?? '') != 'rw') {
exit();
}
if (preg_match('/^[a-z\-]{0,}-mailcow/', $_GET['service'])) {
if ($_GET['action'] == "start") {
data/web/inc/functions.acl.inc.php
+4
View File
@@ -193,6 +193,10 @@ function acl($_action, $_scope = null, $_data = null, $_extra = null) {
while ($row = array_shift($acl_all)) {
$acl['acl'][$row['Field']] = 1;
}
// Read-only API keys must not log in as other accounts (SOGo SSO, dual login)
if (!empty($_SESSION['mailcow_cc_api']) && ($_SESSION['mailcow_cc_api_access'] ?? '') != 'rw') {
$acl['acl']['login_as'] = 0;
}
}
elseif ($_SESSION['mailcow_cc_role'] == 'domainadmin' ||
(isset($_SESSION["dual-login"]["role"]) && $_SESSION["dual-login"]["role"] == 'domainadmin')) {