amorfo77/mailcow-dockerized
1
0 Fork 0
mirror of https://github.com/mailcow/mailcow-dockerized.git synced 2026-11-05 16:29:32 +00:00
Code Issues Projects Releases Wiki Activity

[Web] Pending account setup adjustments

Browse Source
This commit is contained in:
FreddleSpl0it committed 2026-10-28 17:11:25 +01:00
1 parent a21604cd7b
commit 510674ee67
2 files changed
+27
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

data/web/json_api.php
+18
View File
@@ -105,6 +105,24 @@ if (isset($_GET['query'])) {
'msg' => 'Cannot find attributes in post data'
));
// A login with pending 2FA setup or password update may only use the calls of these steps
if (!empty($_SESSION['pending_tfa_setup']) || !empty($_SESSION['pending_pw_update'])) {
if (!empty($_SESSION['pending_tfa_setup'])) {
$pending_allowed = array('get/passwordpolicy', 'get/webauthn-tfa-registration', 'add/webauthn-tfa-registration');
}
else {
$pending_allowed = array('get/passwordpolicy', 'edit/self', 'edit/admin');
}
if (!in_array($action . '/' . $category, $pending_allowed)) {
http_response_code(403);
echo json_encode(array(
'type' => 'error',
'msg' => 'API access denied until the pending account setup is finished'
));
exit();
}
}
switch ($action) {
case "add":
if ($_SESSION['mailcow_cc_api_access'] == 'ro' || isset($_SESSION['pending_mailcow_cc_username']) || !isset($_SESSION["mailcow_cc_username"])) {