From ddd76d99cdf0ec36e5e83e0cc3939d1e1149bfd8 Mon Sep 17 00:00:00 2001
From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com>
Date: Thu, 23 Jul 2026 10:10:29 +0200
Subject: [PATCH] [Web] Add sogo_auth_internal nginx marker for sogo-auth.php

---
 data/conf/nginx/templates/nginx.conf.j2         | 5 +++++
 data/conf/nginx/templates/sites-default.conf.j2 | 2 ++
 data/web/sogo-auth.php                          | 8 ++++++--
 3 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/data/conf/nginx/templates/nginx.conf.j2 b/data/conf/nginx/templates/nginx.conf.j2
index 08a85a144..aaf4a6fb3 100644
--- a/data/conf/nginx/templates/nginx.conf.j2
+++ b/data/conf/nginx/templates/nginx.conf.j2
@@ -42,6 +42,11 @@ http {
         https https;
     }
 
+    map $server_port $sogo_auth_internal {
+        65510   "1";
+        default "";
+    }
+
     {% if HTTP_REDIRECT %}
     # HTTP to HTTPS redirect
     server {
diff --git a/data/conf/nginx/templates/sites-default.conf.j2 b/data/conf/nginx/templates/sites-default.conf.j2
index 84bd8eae4..688f2baa6 100644
--- a/data/conf/nginx/templates/sites-default.conf.j2
+++ b/data/conf/nginx/templates/sites-default.conf.j2
@@ -116,6 +116,8 @@ location ~ \.php$ {
     include /etc/nginx/fastcgi_params;
     fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
     fastcgi_param PATH_INFO $fastcgi_path_info;
+    # trusted internal-auth marker; empty for external clients (see nginx.conf map)
+    fastcgi_param SOGO_AUTH_INTERNAL $sogo_auth_internal;
     fastcgi_read_timeout 3600;
     fastcgi_send_timeout 3600;
 }
diff --git a/data/web/sogo-auth.php b/data/web/sogo-auth.php
index 07456a7d1..e2431bfe4 100644
--- a/data/web/sogo-auth.php
+++ b/data/web/sogo-auth.php
@@ -8,8 +8,12 @@ $ALLOW_ADMIN_EMAIL_LOGIN = (preg_match(
 $session_var_user_allowed = 'sogo-sso-user-allowed';
 $session_var_pass = 'sogo-sso-pass';
 
+// only the internal nginx auth_request loopback (127.0.0.1:65510) sets this;
+// external clients can never supply it (bare fastcgi param, not an HTTP header)
+$is_internal_auth = (($_SERVER['SOGO_AUTH_INTERNAL'] ?? '') === '1');
+
 // validate credentials for basic auth requests
-if (isset($_SERVER['PHP_AUTH_USER'])) {
+if ($is_internal_auth && isset($_SERVER['PHP_AUTH_USER'])) {
   // load prerequisites only when required
   require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
 
@@ -80,7 +84,7 @@ elseif (isset($_GET['login'])) {
   exit;
 }
 // only check for admin-login on sogo GUI requests
-elseif (isset($_SERVER['HTTP_X_ORIGINAL_URI']) && strcasecmp(substr($_SERVER['HTTP_X_ORIGINAL_URI'], 0, 9), "/SOGo/so/") === 0) {
+elseif ($is_internal_auth && isset($_SERVER['HTTP_X_ORIGINAL_URI']) && strcasecmp(substr($_SERVER['HTTP_X_ORIGINAL_URI'], 0, 9), "/SOGo/so/") === 0) {
   // this is an nginx auth_request call, we check for existing sogo-sso session variables
   require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/vars.inc.php';
   if (file_exists($_SERVER['DOCUMENT_ROOT'] . '/inc/vars.local.inc.php')) {