amorfo77/mailcow-dockerized
1
0 Fork 0
mirror of https://github.com/mailcow/mailcow-dockerized.git synced 2026-11-05 08:19:22 +00:00
Code Issues Projects Releases Wiki Activity

[Web] Mask IdP secrets for read-only API keys, deny sync job OAuth to read-only and pending sessions

Browse Source
This commit is contained in:
FreddleSpl0it committed 2026-11-02 09:56:24 +01:00
1 parent 5eb3148bd5
commit 4b7ebab8f3
2 files changed
+11 -2
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

data/web/json_api.php
+8 -1
View File
@@ -1549,7 +1549,14 @@ if (isset($_GET['query'])) {
if ($object == "sync-status") {
process_get_return(\Mailcow\Identity\IdentityModule::fromGlobals()->api->getStatus());
} elseif($_SESSION['mailcow_cc_role'] === 'admin') {
process_get_return($iam_settings);
$iam_settings_out = $iam_settings;
// Read-only API keys never get the secrets of the identity provider
if (($_SESSION['mailcow_cc_api_access'] ?? '') == 'ro') {
foreach (array('client_secret', 'bindpass', 'access_token') as $iam_secret) {
if (isset($iam_settings_out[$iam_secret])) $iam_settings_out[$iam_secret] = '*';
}
}
process_get_return($iam_settings_out);
} else {
process_get_return(null);
}