[Web][Restic][Dovecot] Backup: safer restic.sh restores, access check first, own aliases and sync sources kept, runner fixes

data/web/inc/lib/mailcow/Backup/Service/JobService.php

@@ -102,6 +102,13 @@ class JobService
                 $entry[$key] = self::restricted($entry[$key], $domains);
             }
         }
+        // the account of an admin who requested the restore stays hidden, the UI shows "Administrator"
+        if (($job->params['requested_role'] ?? '') !== 'domainadmin') {
+            $entry['requested_by'] = '';
+            if (isset($entry['log'])) {
+                $entry['log'] = str_replace('(requested by ' . $job->requestedBy . ')', '(requested by an administrator)', $entry['log']);
+            }
+        }
         return $entry;
     }
 
@@ -550,6 +557,9 @@ class JobService
     private function domainScope(Snapshot $snapshot, mixed $value): array
     {
         $domain = strtolower((string)Input::text($value));
+        if ($domain !== '' && !$this->context->hasAdminRights() && !$this->context->canAccessDomain($domain)) {
+            throw new AccessDenied();
+        }
         $exists = $domain !== '' && $this->jobs->isDomain($domain);
         // a deleted domain is created from the snapshot's export: only when the content lists it
         if (!$exists && !($this->context->hasAdminRights() && $snapshot->mailboxesOf($domain) !== null)) {
@@ -580,6 +590,9 @@ class JobService
         }
         $domain = strtolower((string)Input::text($domainValue));
         foreach ($mailboxes as $username) {
+            if (str_contains($username, '@') && !$this->context->hasAdminRights() && !$this->context->canAccessDomain(self::domainOf($username))) {
+                throw new AccessDenied();
+            }
             // a deleted mailbox can be restored when the snapshot knows it
             $mailboxDomain = $this->jobs->mailboxDomain($username) ?? (isset($snapshot->mailboxesOf(self::domainOf($username))[$username]) ? self::domainOf($username) : null);
             if ($mailboxDomain === null) {

data/web/inc/lib/mailcow/Backup/Service/RestoreService.php

@@ -330,6 +330,11 @@ class RestoreService
                 continue;
             }
             $current = $this->repo->rows('alias', ['address' => $address])[0] ?? null;
+            // the own alias of another mailbox is its forwarding, it stays as its owner set it
+            if ($current !== null && $this->mailbox($address) !== null) {
+                $run->skipped('aliases');
+                continue;
+            }
             if ($current !== null) {
                 $this->aliasGoto($run, $current, $gotos);
                 continue;
@@ -676,9 +681,9 @@ class RestoreService
                 $run->skipped('syncjobs');
                 continue;
             }
-            $source = $this->repo->rows('imapsync_source', ['id' => (int)($row['source_id'] ?? 0)])[0] ?? null;
-            $sourceId = ($source !== null && strtolower((string)$source['host1']) === strtolower($host) && (int)$source['port1'] === $port)
-                ? (int)$source['id'] : ($this->repo->syncSourcesFor($host, $port, $run->username, $run->domain)[0] ?? null);
+            // the backup's source when the mailbox may still use it, else another one it may use
+            $usable = $this->repo->syncSourcesFor($host, $port, $run->username, $run->domain);
+            $sourceId = in_array((int)($row['source_id'] ?? 0), $usable, true) ? (int)$row['source_id'] : ($usable[0] ?? null);
             if ($sourceId === null || $user1 === '') {
                 $run->error('syncjobs', "$user1 ($host:$port): sync source does not exist");
                 continue;

data/web/js/site/backup.js

@@ -155,6 +155,8 @@ var mailcowBackup = (function($) {
     return job.state === 'queued' || job.state === 'running';
   }
   function isCancellable(job) {
+    // domain admins cancel only restores domain admins requested (JobService::cancel)
+    if (typeof role !== 'undefined' && role === 'domainadmin' && (job.params || {}).requested_role !== 'domainadmin') return false;
     return job.state === 'queued' || (job.state === 'running' && !(job.type === 'restore' && DOVECOT_STEPS.indexOf(job.step) !== -1));
   }
   function stepText(job) {

data/web/lang/lang.de-de.json

@@ -880,6 +880,7 @@
         "backup_password_not_confirmed": "Bitte zuerst bestätigen, dass das Repository-Passwort außerhalb von mailcow aufbewahrt wird",
         "backup_password_too_short": "Das Repository-Passwort muss mindestens %s Zeichen lang sein",
         "backup_restore_active": "Eine Wiederherstellung von %s ist bereits eingereiht oder läuft",
+        "backup_restore_domain_active": "In %s ist bereits eine Wiederherstellung eingereiht oder läuft, Domain-Administratoren können je Domain eine Wiederherstellung gleichzeitig starten",
         "backup_scope_invalid": "Ungültiger Umfang der Wiederherstellung (Mailbox oder Domain)",
         "backup_secrets_key_missing": "Der Backup-Container hat seinen Schlüssel noch nicht bereitgestellt: Bitte den Container (restic-mailcow) starten und erneut speichern",
         "backup_setting_invalid": "Ungültiger Wert für %s",

data/web/lang/lang.en-gb.json

@@ -871,6 +871,7 @@
         "backup_password_not_confirmed": "Confirm first that the repository password is stored outside of mailcow",
         "backup_password_too_short": "The repository password must have at least %s characters",
         "backup_restore_active": "A restore of %s is already queued or running",
+        "backup_restore_domain_active": "A restore in %s is already queued or running, domain administrators can run one restore per domain at a time",
         "backup_scope_invalid": "Invalid restore scope (mailbox or domain)",
         "backup_secrets_key_missing": "The backup container has not provided its key yet: start it (restic-mailcow) and save again",
         "backup_setting_invalid": "Invalid value for %s",