amorfo77/mailcow-dockerized
1
0
Fork 0
mirror of https://github.com/mailcow/mailcow-dockerized.git synced 2026-07-31 12:25:56 +00:00
Code Issues Projects Releases Wiki Activity
7,634 Commits 31 Branches 92 Tags
d64c923aca1d80f8e2b73b0664500399a60542e2
Commit Graph
2926 Commits
Author SHA1 Message Date
FreddleSpl0it d64c923aca [ACME] Skip mta-sts certificate request when MTA-STS is not active for a domain 2026-07-30 10:33:55 +02:00
FreddleSpl0itandGitHub 2d5f166ba8 Merge pull request #7389 from mailcow/fix/default-mbox-template 
[Web] Create default mailbox template with eas and dav access
 2026-07-30 09:23:24 +02:00
FreddleSpl0itandGitHub 94b5a623ab Merge pull request #7388 from mailcow/fix/7329 
[Web] Move mailcow update check to server side
 2026-07-30 09:13:19 +02:00
FreddleSpl0itandGitHub e406ecd461 Merge pull request #7387 from mailcow/fix/mfk25 
Hardening mailcow
 2026-07-30 09:07:10 +02:00
FreddleSpl0it 36c70db86c [Web] harden CORS origin matching and add Vary: Origin 2026-07-30 08:37:18 +02:00
FreddleSpl0itandGitHub f4961c4023 Merge pull request #7333 from fallmo/fix/cors-settings-validation 
fix: cors allowed origins settings validation
 2026-07-28 15:35:29 +02:00
FreddleSpl0it f44bd2f36a [Web] document sender_acl in get/mailbox API examples 2026-07-28 14:19:45 +02:00
FreddleSpl0itandGitHub 95a77f2dcb Merge pull request #7348 from smpaz7467/fix/api-get-mailbox-sender-acl 
[Web] return sender_acl in get/mailbox API
 2026-07-28 14:12:57 +02:00
FreddleSpl0it 54170d075a [Web] Move mailcow update check to server side 2026-07-28 13:32:18 +02:00
FreddleSpl0it e245ac04d9 [Web] enforce tenant boundary for SOGo SSO 2026-07-28 09:21:29 +02:00
FreddleSpl0it fea38c8e1b [Web] escape mailbox name 2026-07-24 11:16:39 +02:00
FreddleSpl0it cc9af65852 [Web] remove domain admin sso token after use 2026-07-24 10:26:23 +02:00
FreddleSpl0it 92cc8bec90 [Web] Use parameterized LIKE for sogo_acl deletion 2026-07-23 15:29:41 +02:00
FreddleSpl0it 145745329e [Web] add dot stuffing for quarantine raw release 2026-07-23 15:01:44 +02:00
FreddleSpl0it 8e72d22c56 [Web] Escape rspamd_history and rllog 2026-07-23 11:17:55 +02:00
FreddleSpl0it ddd76d99cd [Web] Add sogo_auth_internal nginx marker for sogo-auth.php 2026-07-23 10:10:29 +02:00
Stephen RitzandClaude Opus 4.8 14772c3a20 [Web] return sender_acl in get/mailbox API 
sender_acl can be set through edit/mailbox but was never returned by
get/mailbox, so an API client could not read back what it had written,
and get/mailbox/all / get/mailbox/{mailbox} both omitted it.

Add the mailbox's internal send-as ACL (the sender_acl table rows with
external = 0) to mailbox_details as sender_acl, an array of send_as
values, mirroring the field edit/mailbox accepts. It is added in the same
block as the other detailed fields, so the lightweight get/mailbox/reduced
endpoint is unaffected.

Fixes #7011

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-14 16:36:40 -07:00
Stephen RitzandClaude Opus 4.8 c17cc8a792 [Web] fix add/time_limited_alias silently discarding requests and validity 
Three defects in add/time_limited_alias:

The description was read as $_data['description'] without a guard. When a
client omits it, null is bound to spamalias.description, which is TEXT NOT
NULL, so the insert raises a PDOException. The global exception handler is
terminal, so process_add_return() never echoes anything and the caller sees
HTTP 200 with an empty body while no alias was created. Default it to an
empty string instead.

The validity guard used a single condition whose else branch also caught the
success case, so every valid validity was overwritten with the 8760 hour
default and the parameter did nothing. Only invalid values were rejected.
Nest the range check so a valid value survives.

The OpenAPI spec documented only username and domain, while the code also
reads description, validity and permanent. Spec driven clients therefore
could not construct a working request. Document all three.

spamalias.description is the only NOT NULL description column in the schema,
which is why the same unguarded read in add/domain and add/resource does not
fail, both of those columns are nullable.

This does not change the generic exception handling. A database error is
still swallowed into an empty HTTP 200, and the message the handler builds
carries the raw PDOException, so surfacing it to API clients would need
sanitising first. That is left for a separate change.

Refs #7287

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-14 15:23:31 -07:00
Mohamed Fall 6f7fee49cd fix: cors allowed origins settings validation 2026-07-13 15:29:48 +00:00
Ralf Bergs e696ee2f6c Refined wording for displaying of active settings on quarantine page. 2026-07-12 17:22:15 +02:00
milkmakerGitHubRomain AymeMatjaž Tekavec
 		9e723e942d Translations update from Weblate (#7302) 
* [Web] Updated lang.fr-fr.json

Co-authored-by: Romain Ayme <ayme.romain@hotmail.fr>

* [Web] Updated lang.si-si.json

Co-authored-by: Matjaž Tekavec <matjaz@moj-svet.si>

---------

Co-authored-by: Romain Ayme <ayme.romain@hotmail.fr>
Co-authored-by: Matjaž Tekavec <matjaz@moj-svet.si>
 2026-06-20 13:57:15 +02:00
FreddleSpl0itandGitHub 2bd7a24b8c Merge pull request #7212 from mailcow/mkuron-patch-mobileconfig 
Escape generated password in mobileconfig
 2026-06-11 10:05:17 +02:00
FreddleSpl0itandGitHub 2d8db72d46 Merge pull request #7275 from Snafu/fix/admin-mailbox-tfa-missing 
Fix force_tfa not available in mailbox template #7216
 2026-06-11 10:03:39 +02:00
FreddleSpl0it 277a307fb9 [Web] Fix refresh SOGo view on mailbox deletion 2026-06-11 09:55:32 +02:00
Bobby cce02e2b15 Refresh SOGo view after mailbox activation 2026-06-08 00:01:43 +07:00
Snafu 0fafda696b Fix force_tfa not available in mailbox template #7216 2026-06-07 17:03:52 +02:00
goodyghandGitHub 175878f8f1 ui, fail2ban fix german ban_list_info translation (#7265) 2026-05-28 22:20:26 +02:00
milkmakerGitHubPhu D. Nguyen
 		3fcda21c4e [Web] Updated lang.vi-vn.json (#7263) 
Co-authored-by: Phu D. Nguyen <sillycat@duck.com>
 2026-05-27 17:46:42 +02:00
milkmakerGitHubEdgars Andersons
 		eac1bf02fc [Web] Updated lang.lv-lv.json (#7262) 
Co-authored-by: Edgars Andersons <Edgars+Mailcow+Weblate@gaitenis.id.lv>
 2026-05-26 22:02:05 +02:00
Michael KuronandMichael Kuron ffbc37a00c Escape generated password in mobileconfig 
Escape ampersand, less than, greater than to avoid generating invalid XML.

Fixes #7171
 2026-05-24 11:52:12 +02:00
milkmakerGitHubAdrian-Kozien
 		4f2348631a [Web] Updated lang.pl-pl.json (#7245) 
Co-authored-by: Adrian-Kozien <adrian@kozien.net>
 2026-05-21 17:16:34 +02:00
FreddleSpl0it cbd3d8b9bc escape HTML in quarantine table 2026-05-20 17:53:47 +02:00
Jahongir QurbonovandGitHub 4ddcee28e4 Add Uzbek language (#7224) 2026-05-13 16:42:38 +02:00
milkmakerGitHubEdson Wolf
 		b0d16bbcee [Web] Updated lang.pt-br.json (#7228) 
Co-authored-by: Edson Wolf <edsonwolf@vivaldi.net>
 2026-05-13 16:42:03 +02:00
FreddleSpl0itandGitHub a8e945f3da Merge pull request #7220 from mailcow/fix/06052026 
[Web] escape HTML in sieve filter edit view and queue manager
 2026-05-12 08:36:36 +02:00
FreddleSpl0it 33547d1d73 [Web] escape HTML in sieve filter edit view and queue manager 2026-05-12 08:31:51 +02:00
milkmakerGitHubNemoralisTom18314pmuch78
 		539c32d99c Translations update from Weblate (#7218) 
* [Web] Updated lang.az-az.json

Co-authored-by: Nemoralis <nemoralis@duck.com>

* [Web] Updated lang.nl-nl.json

Co-authored-by: Tom18314 <tomstokmans5@gmail.com>

* [Web] Updated lang.pl-pl.json

Co-authored-by: pmuch78 <pawel@prolin.pl>

---------

Co-authored-by: Nemoralis <nemoralis@duck.com>
Co-authored-by: Tom18314 <tomstokmans5@gmail.com>
Co-authored-by: pmuch78 <pawel@prolin.pl>
 2026-05-08 16:46:10 +02:00
FreddleSpl0it 8ead057ce9 [Web] Create default mailbox template with eas and dav access 2026-04-15 09:33:23 +02:00
milkmakerGitHubNemoralisPeterMatjaž TekavecAndré Ribas
 		886dbcc419 Translations update from Weblate (#7190) 
* [Web] Updated lang.az-az.json

[Web] Added lang.az-az.json

Co-authored-by: Nemoralis <nemoralis@duck.com>
Co-authored-by: Peter <magic@kthx.at>
Co-authored-by: milkmaker <milkmaker@mailcow.de>

* [Web] Updated lang.si-si.json

Co-authored-by: Matjaž Tekavec <matjaz@moj-svet.si>

* [Web] Updated lang.pt-br.json

Co-authored-by: André Ribas <andre@ribassu.com>

---------

Co-authored-by: Nemoralis <nemoralis@duck.com>
Co-authored-by: Peter <magic@kthx.at>
Co-authored-by: Matjaž Tekavec <matjaz@moj-svet.si>
Co-authored-by: André Ribas <andre@ribassu.com>
 2026-04-11 21:25:03 +02:00
FreddleSpl0it 5a00b5124b [Web][Dovecot] Add parameterized queries and input validation for quarantine_category 2026-03-29 12:08:45 +02:00
FreddleSpl0it 8c039f694f Improve template URI escaping and parameter handling 2026-03-19 12:48:43 +01:00
FreddleSpl0it 95bf46c1e4 escape HTML in autodiscover logs 2026-03-19 12:44:50 +01:00
FreddleSpl0it edde35156d escape HTML in qitem details 2026-03-19 12:44:30 +01:00
FreddleSpl0it 84e3c32f13 escape HTML in last logins 2026-03-19 12:44:00 +01:00
FreddleSpl0it ecb848493b add missing object-level access control 2026-03-19 12:42:45 +01:00
FreddleSpl0it 8a65b9d1c6 add missing access control 2026-03-19 12:41:47 +01:00
FreddleSpl0it ed9264fd2a [Web] Allow force_tfa for LDAP and Keycloak users 2026-03-13 14:13:25 +01:00
milkmakerandGitHub 09f09cb850 [Web] Updated lang.hu-hu.json (#7130) 2026-03-12 15:01:54 +01:00
FreddleSpl0itandGitHub d4bf377a96 Merge pull request #7121 from rezzorix/fix/theme-localstorage-staging 
Fix theme localStorage collision with rspamd UI
 2026-03-12 07:47:03 +01:00
rezzorix 03eccd4e42 added/fix: use mailcow_theme in bundled dark mode JS 2026-03-12 14:11:31 +08:00