The extended_sender_acl field sat inside the
`{% if not result.authsource or result.authsource == 'mailcow' %}` block
that hides the local password fields for mailboxes authenticating against
an external identity provider. As a result the "External sender addresses"
input was not rendered at all for keycloak / generic-oidc / ldap mailboxes,
even for a full admin, so those addresses could neither be reviewed nor
edited in the UI while the underlying sender_acl rows stayed active.
Extended sender ACLs are unrelated to local password management. Move the
field out of that block; it stays gated by acl.extend_sender_acl as intended.
Fixes#7365
The forced password change modal posts to the JSON API and renders
data[0].msg directly. The API returns raw language keys rather than
translated strings, so a user who fails the complexity policy is shown
the literal text "password_complexity" instead of a message.
Every other password form renders errors through alertbox_log_parser(),
which resolves the key against $lang. The modal is the only one that
talks to the API directly, and it never resolved the key.
Resolve it against lang_danger, which base.twig already exposes for this
purpose. This also covers password_mismatch, password_empty and
access_denied, and applies to the admin path as well. Unknown keys still
fall through unchanged.
The lookup is guarded with hasOwnProperty because msg is attacker-
independent but dynamic: a bare lang_danger[msg] would resolve inherited
Object.prototype members such as "constructor" to a function, which
jQuery's .text() would then invoke as a callback.
Language files are untouched: prerequisites.inc.php loads lang.en-gb.json
as the base and merges the active locale over it, so locales that lack the
key inherit the English string.
Fixes#7301
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Adds an eye icon button to the password field on the user, admin, and
domain admin login pages. Clicking it toggles between hidden and visible
password text, using Bootstrap Icons (bi-eye / bi-eye-slash).
Closes#6893
* Allow making spam aliases permanent
* added german translation
* updated Spamalias Twig + Rename in Spam Alias
* compose: update image tags to align to vendor version
---------
Co-authored-by: DerLinkman <niklas.meyer@servercow.de>
* dkim: Add support for 3072 and 4096 bit RSA keys
Signed-off-by: Marvin A. Ruder <signed@mruder.dev>
* php: added missing ; in dkim function
* php: make 4096 DKIM default
* db: update schema to set dkim 4096 as default
* Revert "db: update schema to set dkim 4096 as default"
This reverts commit 790b40a695.
* Revert "php: make 4096 DKIM default"
This reverts commit 7e643376c7.
---------
Signed-off-by: Marvin A. Ruder <signed@mruder.dev>
Co-authored-by: DerLinkman <niklas.meyer@servercow.de>
FreddleSpl0itandGitHub
Stephen Ritz
Paul SeebachandJulian Lechner
Snafu
rezzorix
Patrik Kernstock
FreddleSpl0it
Nick Bouwhuis
