amorfo77/mailcow-dockerized
1
0 Fork 0
mirror of https://github.com/mailcow/mailcow-dockerized.git synced 2026-11-10 18:41:01 +00:00
Code Issues Projects Releases Wiki Activity
7,835 Commits 16 Branches 97 Tags
a03fd8aaade58703b1e4fdc417d6001fa709da03
Commit Graph
1269 Commits
Author SHA1 Message Date
FreddleSpl0it e3a90718c2 Merge pull request #7516 from wbilalz400/fix/webauthn-forced-enrollment-empty-credential 
[Web] Fix forced WebAuthn TFA enrollment storing an empty credential
 2026-11-10 15:21:30 +01:00
FreddleSpl0it 4ced82d554 Merge pull request #7548 from junkerderprovinz/fix/idp-ignore-ssl-error-key 
[Web] Fix ignore_ssl_error key in identity provider settings
 2026-11-10 13:55:15 +01:00
FreddleSpl0it 37d304d075 Merge pull request #7544 from jorgeavlobo/fix/keycloak-admin-token-introspect 
[Web] Keycloak: skip introspection of an expired admin token and reuse the new one
 2026-11-10 01:45:16 +01:00
FreddleSpl0it b21acd4787 Merge pull request #7637 from mailcow/fix/7557 
[Web] Domain admins saw sender aliases of other domains
 2026-11-10 01:02:39 +01:00
FreddleSpl0it 4ab954dcd1 [Web] Domain admins: show sender ACL and alias entries of their own domains only 2026-11-10 01:01:22 +01:00
FreddleSpl0it 867b9dddab Merge pull request #7634 from mailcow/fix/7503 
[Web] Keycloak: accept Base64-encoded mailcow_password
 2026-11-09 23:30:20 +01:00
FreddleSpl0it a4326e6642 [Web] Keycloak Mailpassword Flow: accept Base64-encoded password hashes 2026-11-09 23:28:53 +01:00
FreddleSpl0it c5e89a9e03 Merge pull request #7633 from mailcow/fix/7501 
[Web] Forwarding hosts: store IPv6 addresses in canonical form
 2026-11-09 23:25:40 +01:00
FreddleSpl0it 45d31b3279 [Web] Forwarding hosts: store IPv6 addresses in canonical form 2026-11-09 23:24:39 +01:00
FreddleSpl0it f810cecd3a Merge pull request #7630 from mailcow/fix/7476 
[Web] force_tfa did not prevent removing 2FA
 2026-11-09 23:14:38 +01:00
FreddleSpl0it cfad223824 [Web] force_tfa: read the flag with JSON_VALUE 2026-11-09 23:13:26 +01:00
FreddleSpl0it 1911847c3b Merge pull request #7625 from mailcow/fix/6931 
[Web] Update "Last modified" when tags of a domain or mailbox change
 2026-11-09 22:48:21 +01:00
FreddleSpl0it 497872080b [Web] Update "Last modified" when tags of a domain or mailbox change 2026-11-09 22:46:15 +01:00
FreddleSpl0it e0640949a2 [Web][Dovecot] Show the last SOGo login in the mailbox list and API 2026-11-09 22:39:42 +01:00
FreddleSpl0it 6a83b9e0f0 [Web] Mailbox protocols do not limit app passwords 2026-11-05 12:46:22 +01:00
FreddleSpl0it e8f12cd061 [Web] Add Netfilter unban all button 2026-11-04 22:23:16 +01:00
FreddleSpl0it 52f28025a5 [Web][Dovecot] imapsync: Block skipmess in custom params 2026-11-04 12:02:18 +01:00
FreddleSpl0it 3c03f8e567 Merge branch 'fix/sec' into fix/rework-bugs 2026-11-04 11:46:47 +01:00
FreddleSpl0it 9293e4ce43 [Web][Dovecot] Do not count denied logins as failed logins 2026-11-04 10:39:32 +01:00
FreddleSpl0it a8d1121f0e [Dovecot][Web] imapsync: verify certificates against the source host, make the check optional per source 2026-11-03 09:31:16 +01:00
FreddleSpl0it a4b60ae26f [Netfilter][Dovecot] Count failed master logins, log the client address of successful logins 2026-11-02 14:55:42 +01:00
FreddleSpl0it 7c73199bde [Web] Groups: limit changes of domain admins to their domains 2026-11-02 10:01:43 +01:00
FreddleSpl0it 5eb3148bd5 [Web] OIDC/LDAP: check the OAuth state, keep the mailbox on token refresh, require unique IdP users 2026-11-02 09:54:54 +01:00
FreddleSpl0it 41467dc47f [Web] imapsync: change the server of a sync source only with access to all its sync jobs 2026-11-02 09:50:24 +01:00
FreddleSpl0it a1cbd51d70 [Dovecot][Web] imapsync: restrict custom parameters and source hosts, verify certificates 2026-11-02 09:49:03 +01:00
FreddleSpl0it 510674ee67 [Web] Pending account setup adjustments 2026-10-28 17:11:25 +01:00
FreddleSpl0it 9eb3a79f3b [Web] Quarantine list adjustments 2026-10-28 16:16:00 +01:00
FreddleSpl0it d5e3de3ae8 [Web] Add TFA Ratelimit 2026-10-28 16:04:45 +01:00
FreddleSpl0it 44429fa0d0 [Web] App password and API adjustments 2026-10-28 15:29:55 +01:00
FreddleSpl0it 4dd7aead73 [Web] Store PKCE data of OAuth2 authorization codes 2026-10-28 11:57:46 +01:00
FreddleSpl0it bd8c784118 [Web] Update composer libraries 2026-10-28 11:56:29 +01:00
FreddleSpl0it 1c7c328a2a [Web][Netfilter] Fix netban limits, no negative ban times, save lists atomically, check banlist id 2026-10-27 12:53:01 +01:00
FreddleSpl0it 7457fd59aa [Web][Dovecot] Do not count logins as failed while the identity provider is unavailable 2026-10-27 12:46:24 +01:00
FreddleSpl0it 2c5718c9c9 [Web][Dovecot][SOGo][DockerApi] Add mailbox groups, shared mailboxes and identity provider sync 2026-10-27 10:01:33 +01:00
Junker der Provinzanddiko 5705a48724 [Web] Fix ignore_ssl_error key in identity provider settings 
The edit action stores the setting as ignore_ssl_error, but the get
action cast and defaulted ignore_ssl_errors. The stored value was
returned as a string and LDAP setups got an extra ignore_ssl_errors
field that was always false.

Co-authored-by: diko <108140792+admins-little-helper@users.noreply.github.com>
 2026-10-24 20:05:10 +02:00
FreddleSpl0it f63042bbaf [Web] Bind API sessions to their key 2026-10-23 11:22:32 +02:00
FreddleSpl0it 4828f0cf64 [Web] Restrict read-only API sessions 2026-10-23 11:21:45 +02:00
FreddleSpl0it 0dadf49934 [Web] Rework API keys: multiple read-only/read-write keys, service keys from mailcow.conf 2026-10-23 11:20:17 +02:00
Jorge Lobo 2f76230daf [Web] Keycloak: skip introspection of expired admin token 2026-10-23 00:52:03 +01:00
FreddleSpl0it c145f858e2 [Web][Dovecot] imapsync: update to 2.314, refresh OAuth tokens of running jobs, add source presets 2026-10-22 18:27:49 +02:00
FreddleSpl0it 7c62a57910 [Web][Dovecot] Rework imapsync: sync sources, OAuth2 (XOAUTH2), worker pool, Python runner 2026-10-22 10:07:52 +02:00
FreddleSpl0it b2a152fe45 [Web] Add Mailcow\ class structure and imapsync module classes 2026-10-22 10:07:43 +02:00
FreddleSpl0it 571c1b5b29 [Web] Update Bootstrap to 5.3.8, add theme support 2026-10-15 14:43:06 +02:00
Bilal Zahid d93f32072e fix(web): post WebAuthn TFA enrollment through the JSON API 
The forced TFA enrollment form submitted the raw credential JSON in the
'token' field, which set_tfa()'s webauthn case never reads. It expects the
parsed \['registration'] object that only the JSON API builds, so the
form POST inserted a row with an empty keyHandle and a NULL publicKey while
still reporting success. Every WebAuthn 2FA login then failed, because
webauthn-tfa-get-args sent an empty credential id in allowCredentials.

- base.twig: POST the attestation to /api/v1/add/webauthn-tfa-registration
  like the regular WebAuthn modal does
- functions.inc.php: refuse incomplete WebAuthn registrations
- lang.en-gb.json: message for the new guard
 2026-10-13 19:25:17 +05:00
FreddleSpl0it ed4fe41d7a Merge pull request #7349 from smpaz7467/fix/login-redirect-deeplink 
[Web] redirect deep links to the matching login page
 2026-08-18 14:37:32 +02:00
FreddleSpl0it 6b9d875773 Merge pull request #7347 from smpaz7467/fix/dns-zonefile-absolute-rhs 
[Web] use absolute RHS names in generated DNS zonefile
 2026-08-18 14:30:50 +02:00
FreddleSpl0it 8bd9e12a73 [Web] Add ACL + global switch to disable external alias goto 2026-08-18 14:07:37 +02:00
FreddleSpl0it 91d3b7246a [Web] Minor hardening across web UI and nginx 2026-08-18 09:08:17 +02:00
FreddleSpl0it 2d5f166ba8 Merge pull request #7389 from mailcow/fix/default-mbox-template 
[Web] Create default mailbox template with eas and dav access
 2026-07-30 09:23:24 +02:00
FreddleSpl0it 94b5a623ab Merge pull request #7388 from mailcow/fix/7329 
[Web] Move mailcow update check to server side
 2026-07-30 09:13:19 +02:00