Merge pull request #5979 from mailcow/staging

2024-07
Merge pull request #5976 from mailcow/fix/get-tfa
2026-02-21 00:26:23 +00:00 · 2024-08-05 08:55:59 +02:00 · 2024-08-01 11:04:04 +02:00 · 2024-08-01 09:06:42 +02:00 · 2024-08-01 00:16:46 +00:00 · 2024-07-29 09:51:16 +02:00
11 changed files with 32 additions and 74 deletions
--- a/data/Dockerfiles/phpfpm/Dockerfile
+++ b/data/Dockerfiles/phpfpm/Dockerfile
@@ -1,4 +1,4 @@
-FROM php:8.2-fpm-alpine3.20
+FROM php:8.2-fpm-alpine3.18
 LABEL maintainer "The Infrastructure Company GmbH <info@servercow.de>"

 # renovate: datasource=github-tags depName=krakjoe/apcu versioning=semver-coerced extractVersion=^v(?<version>.*)$
--- a/data/Dockerfiles/phpfpm/docker-entrypoint.sh
+++ b/data/Dockerfiles/phpfpm/docker-entrypoint.sh
@@ -24,6 +24,7 @@ done
 CONTAINER_ID=
 until [[ ! -z "${CONTAINER_ID}" ]] && [[ "${CONTAINER_ID}" =~ ^[[:alnum:]]*$ ]]; do
  CONTAINER_ID=$(curl --silent --insecure https://dockerapi/containers/json | jq -r ".[] | {name: .Config.Labels[\"com.docker.compose.service\"], project: .Config.Labels[\"com.docker.compose.project\"], id: .Id}" 2> /dev/null | jq -rc "select( .name | tostring | contains(\"mysql-mailcow\")) | select( .project | tostring | contains(\"${COMPOSE_PROJECT_NAME,,}\")) | .id" 2> /dev/null)
+  echo "Could not get mysql-mailcow container id... trying again"
  sleep 2
 done
 echo "MySQL @ ${CONTAINER_ID}"
--- a/data/conf/postfix/master.cf
+++ b/data/conf/postfix/master.cf
@@ -4,7 +4,6 @@ smtp       inet  n       -       n       -       1       postscreen
  -o postscreen_upstream_proxy_protocol=haproxy
  -o syslog_name=haproxy
 smtpd      pass  -       -       n       -       -       smtpd
-  -o smtpd_helo_restrictions=permit_mynetworks,reject_non_fqdn_helo_hostname
  -o smtpd_sasl_auth_enable=no
  -o smtpd_sender_restrictions=permit_mynetworks,reject_unlisted_sender,reject_unknown_sender_domain

--- a/data/conf/postfix/postscreen_access.cidr
+++ b/data/conf/postfix/postscreen_access.cidr
@@ -1,6 +1,6 @@
-# Whitelist generated by Postwhite v3.4 on Sat Jun  1 00:15:02 UTC 2024
+# Whitelist generated by Postwhite v3.4 on Thu Aug  1 00:16:45 UTC 2024
 # https://github.com/stevejenkins/postwhite/
-# 2000 total rules
+# 1954 total rules
 2a00:1450:4000::/36	permit
 2a01:111:f400::/48	permit
 2a01:111:f403:8000::/50	permit
@@ -19,15 +19,8 @@
 8.20.114.31	permit
 8.25.194.0/23	permit
 8.25.196.0/23	permit
-8.39.54.0/23	permit
-8.40.222.0/23	permit
 10.162.0.0/16	permit
 12.130.86.238	permit
-13.70.32.43	permit
-13.72.50.45	permit
-13.74.143.28	permit
-13.78.233.182	permit
-13.92.31.129	permit
 13.110.208.0/21	permit
 13.110.209.0/24	permit
 13.110.216.0/22	permit
@@ -48,6 +41,7 @@
 18.198.96.88	permit
 18.208.124.128/25	permit
 18.216.232.154	permit
+18.235.27.253	permit
 18.236.40.242	permit
 18.236.56.161	permit
 20.51.6.32/30	permit
@@ -70,7 +64,6 @@
 20.112.250.133	permit
 20.118.139.208/30	permit
 20.141.10.196	permit
-20.185.213.0/24	permit
 20.185.214.0/27	permit
 20.185.214.32/27	permit
 20.185.214.64/27	permit
@@ -110,18 +103,19 @@
 35.176.132.251	permit
 35.190.247.0/24	permit
 35.191.0.0/16	permit
+35.205.92.9	permit
 35.242.169.159	permit
 37.218.248.47	permit
 37.218.249.47	permit
 37.218.251.62	permit
 39.156.163.64/29	permit
-40.71.187.0/24	permit
 40.92.0.0/15	permit
 40.92.0.0/16	permit
 40.107.0.0/16	permit
 40.112.65.63	permit
 43.228.184.0/22	permit
 44.206.138.57	permit
+44.217.45.156	permit
 44.236.56.93	permit
 44.238.220.251	permit
 46.19.170.16	permit
@@ -184,9 +178,8 @@
 50.18.125.237	permit
 50.18.126.162	permit
 50.31.32.0/19	permit
+50.31.36.205	permit
 50.56.130.220/30	permit
-51.137.58.21	permit
-51.140.75.55	permit
 52.1.14.157	permit
 52.5.230.59	permit
 52.27.5.72	permit
@@ -207,7 +200,6 @@
 52.96.91.34	permit
 52.96.111.82	permit
 52.96.172.98	permit
-52.96.214.50	permit
 52.96.222.194	permit
 52.96.222.226	permit
 52.96.223.2	permit
@@ -216,7 +208,6 @@
 52.100.0.0/14	permit
 52.103.0.0/17	permit
 52.119.213.144/28	permit
-52.165.175.144	permit
 52.185.106.240/28	permit
 52.200.59.0/24	permit
 52.205.61.79	permit
@@ -229,10 +220,6 @@
 52.234.172.96/28	permit
 52.235.253.128	permit
 52.236.28.240/28	permit
-52.244.206.214	permit
-52.247.53.144	permit
-52.250.107.196	permit
-52.250.126.174	permit
 54.90.148.255	permit
 54.165.19.38	permit
 54.172.97.247	permit
@@ -337,7 +324,6 @@
 65.110.161.77	permit
 65.123.29.213	permit
 65.123.29.220	permit
-65.154.166.0/24	permit
 65.212.180.36	permit
 66.102.0.0/20	permit
 66.119.150.192/26	permit
@@ -456,7 +442,6 @@
 69.171.232.0/24	permit
 69.171.244.0/23	permit
 70.37.151.128/25	permit
-70.42.149.0/24	permit
 70.42.149.35	permit
 72.14.192.0/18	permit
 72.21.192.0/19	permit
@@ -573,7 +558,6 @@
 77.238.189.142	permit
 77.238.189.146/31	permit
 77.238.189.148/30	permit
-81.7.169.128/25	permit
 81.223.46.0/27	permit
 82.165.159.2	permit
 82.165.159.3	permit
@@ -1142,7 +1126,6 @@
 104.47.108.0/23	permit
 104.130.96.0/28	permit
 104.130.122.0/23	permit
-104.214.25.77	permit
 106.10.144.64/27	permit
 106.10.144.100/31	permit
 106.10.144.103	permit
@@ -1264,6 +1247,7 @@
 106.10.244.0/24	permit
 106.39.212.64/29	permit
 106.50.16.0/28	permit
+107.20.18.111	permit
 107.20.210.250	permit
 108.174.0.0/24	permit
 108.174.0.215	permit
@@ -1299,8 +1283,6 @@
 117.120.16.0/21	permit
 119.42.242.52/31	permit
 119.42.242.156	permit
-121.244.91.48	permit
-122.15.156.182	permit
 123.126.78.64/29	permit
 124.108.96.24/31	permit
 124.108.96.28/31	permit
@@ -1356,25 +1338,14 @@
 134.170.141.64/26	permit
 134.170.143.0/24	permit
 134.170.174.0/24	permit
-135.84.80.0/24	permit
-135.84.81.0/24	permit
-135.84.82.0/24	permit
-135.84.83.0/24	permit
 135.84.216.0/22	permit
-136.143.160.0/24	permit
-136.143.161.0/24	permit
-136.143.178.49	permit
-136.143.182.0/23	permit
-136.143.184.0/24	permit
-136.143.188.0/24	permit
-136.143.190.0/23	permit
 136.147.128.0/20	permit
 136.147.135.0/24	permit
 136.147.176.0/20	permit
 136.147.176.0/24	permit
 136.147.182.0/24	permit
+136.147.224.0/20	permit
 136.179.50.206	permit
-138.91.172.26	permit
 139.60.152.0/22	permit
 139.138.35.44	permit
 139.138.46.121	permit
@@ -1425,6 +1396,7 @@
 150.230.98.160	permit
 152.67.105.195	permit
 152.69.200.236	permit
+152.70.155.126	permit
 155.248.208.51	permit
 157.55.0.192/26	permit
 157.55.1.128/26	permit
@@ -1435,7 +1407,6 @@
 157.55.61.0/24	permit
 157.55.157.128/25	permit
 157.55.225.0/25	permit
-157.55.254.216	permit
 157.56.24.0/25	permit
 157.56.120.128/26	permit
 157.56.232.0/21	permit
@@ -1482,7 +1453,6 @@
 163.114.134.16	permit
 163.114.135.16	permit
 164.177.132.168/30	permit
-165.173.128.0/24	permit
 166.78.68.0/22	permit
 166.78.68.221	permit
 166.78.69.169	permit
@@ -1491,6 +1461,7 @@
 167.89.0.0/17	permit
 167.89.46.159	permit
 167.89.54.103	permit
+167.89.60.95	permit
 167.89.64.9	permit
 167.89.65.0	permit
 167.89.65.53	permit
@@ -1509,11 +1480,6 @@
 168.245.12.252	permit
 168.245.46.9	permit
 168.245.127.231	permit
-169.148.129.0/24	permit
-169.148.131.0/24	permit
-169.148.142.10	permit
-169.148.144.0/25	permit
-169.148.144.10	permit
 170.10.68.0/22	permit
 170.10.128.0/24	permit
 170.10.129.0/24	permit
@@ -1668,15 +1634,7 @@
 199.16.156.0/22	permit
 199.33.145.1	permit
 199.33.145.32	permit
-199.34.22.36	permit
 199.59.148.0/22	permit
-199.67.80.2	permit
-199.67.80.20	permit
-199.67.82.2	permit
-199.67.82.20	permit
-199.67.84.0/24	permit
-199.67.86.0/24	permit
-199.67.88.0/24	permit
 199.101.161.130	permit
 199.101.162.0/25	permit
 199.122.120.0/21	permit
@@ -1733,8 +1691,6 @@
 204.92.114.187	permit
 204.92.114.203	permit
 204.92.114.204/31	permit
-204.141.32.0/23	permit
-204.141.42.0/23	permit
 204.220.160.0/20	permit
 204.232.168.0/24	permit
 205.139.110.0/24	permit
@@ -1753,6 +1709,7 @@
 205.251.233.36	permit
 206.25.247.143	permit
 206.25.247.155	permit
+206.55.144.0/20	permit
 206.165.246.80/29	permit
 206.191.224.0/19	permit
 206.246.157.1	permit
@@ -1770,7 +1727,6 @@
 207.46.132.128/27	permit
 207.46.198.0/25	permit
 207.46.200.0/27	permit
-207.46.225.107	permit
 207.58.147.64/28	permit
 207.67.38.0/24	permit
 207.67.98.192/27	permit
@@ -1986,8 +1942,6 @@
 2603:1030:20e:3::23c	permit
 2603:1030:b:3::152	permit
 2603:1030:c02:8::14	permit
-2607:13c0:0001:0000:0000:0000:0000:7000/116	permit
-2607:13c0:0002:0000:0000:0000:0000:1000/116	permit
 2607:f8b0:4000::/36	permit
 2620:109:c003:104::/64	permit
 2620:109:c003:104::215	permit
--- a/data/conf/rspamd/local.d/composites.conf
+++ b/data/conf/rspamd/local.d/composites.conf
@@ -21,6 +21,10 @@ FREEMAIL_TO_UNDISC_RCPT {
 SOGO_CONTACT_EXCLUDE {
  expression = "(-WHITELISTED_FWD_HOST | -g+:policies) & ^SOGO_CONTACT & !DMARC_POLICY_ALLOW";
 }
+# Remove MAILCOW_WHITE symbol for senders with broken policy recieved not from fwd hosts
+MAILCOW_WHITE_EXCLUDE {
+  expression = "^MAILCOW_WHITE & (-DMARC_POLICY_REJECT | -DMARC_POLICY_QUARANTINE | -R_SPF_PERMFAIL) & !WHITELISTED_FWD_HOST";
+}
 # Spoofed header from and broken policy (excluding sieve host, rspamd host, whitelisted senders, authenticated senders and forward hosts)
 SPOOFED_UNAUTH {
  expression = "!MAILCOW_AUTH & !MAILCOW_WHITE & !RSPAMD_HOST & !SIEVE_HOST & MAILCOW_DOMAIN_HEADER_FROM & !WHITELISTED_FWD_HOST & -g+:policies";
@@ -103,4 +107,4 @@ CLAMD_JS_MALWARE {
  expression = "CLAM_SECI_JS & !MAILCOW_WHITE";
  description = "JS malware found, Securite JS malware Flag set through ClamAV";
  score = 8;
-}
+}
--- a/data/web/inc/functions.inc.php
+++ b/data/web/inc/functions.inc.php
@@ -1560,7 +1560,7 @@ function unset_tfa_key($_data) {
 }
 function get_tfa($username = null, $id = null) {
  global $pdo;
-  if (isset($_SESSION['mailcow_cc_username'])) {
+  if (empty($username) && isset($_SESSION['mailcow_cc_username'])) {
    $username = $_SESSION['mailcow_cc_username'];
  }
  elseif (empty($username)) {
--- a/data/web/js/site/admin.js
+++ b/data/web/js/site/admin.js
@@ -397,7 +397,10 @@ jQuery(function($){
        {
          title: lang.host,
          data: 'hostname',
-          defaultContent: ''
+          defaultContent: '',
+          render: function (data, type) {
+            return escapeHtml(data);
+          }
        },
        {
          title: lang.username,
--- a/data/web/js/site/debug.js
+++ b/data/web/js/site/debug.js
@@ -325,7 +325,10 @@ jQuery(function($){
          title: 'URI',
          data: 'uri',
          defaultContent: '',
-          className: 'dtr-col-md dtr-break-all'
+          className: 'dtr-col-md dtr-break-all',
+          render: function (data, type) {
+            return escapeHtml(data);
+          }
        },
        {
          title: 'Method',
@@ -1294,13 +1297,7 @@ function update_stats(timeout=5){
      $("#host_cpu_usage").text(parseInt(data.cpu.usage).toString() + "%");
      $("#host_memory_total").text((data.memory.total / (1024 ** 3)).toFixed(2).toString() + "GB");
      $("#host_memory_usage").text(parseInt(data.memory.usage).toString() + "%");
-      if (data.architecture == "aarch64"){
-        $("#host_architecture").html('<span data-bs-toggle="tooltip" data-bs-placement="top" title="' + lang_debug.wip +'">' + data.architecture + ' ⚠️</span>');
-      }
-      else {
-        $("#host_architecture").html(data.architecture);
-      }
-
+      $("#host_architecture").html(data.architecture);
      // update cpu and mem chart
      var cpu_chart = Chart.getChart("host_cpu_chart");
      var mem_chart = Chart.getChart("host_mem_chart");
--- a/data/web/templates/debug.twig
+++ b/data/web/templates/debug.twig
@@ -77,7 +77,7 @@
                        <td>Version</td>
                        <td class="text-break">
                          <div class="fw-bolder">
-                            <p><a href="{{ mailcow_info.git_project_url }}/releases/tag/{{ mailcow_info.version_tag }}" id="mailcow_version" target="_blank">{{ mailcow_info.version_tag }}</a></p>
+                            <p ><a href="#" id="mailcow_version">{{ mailcow_info.version_tag }}</a></p>
                            <p id="mailcow_update"></p>
                          </div>
                        </td>
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -110,7 +110,7 @@ services:
            - rspamd

    php-fpm-mailcow:
-      image: mailcow/phpfpm:1.88
+      image: mailcow/phpfpm:1.87
      command: "php-fpm -d date.timezone=${TZ} -d expose_php=0"
      depends_on:
        - redis-mailcow
--- a/helper-scripts/backup_and_restore.sh
+++ b/helper-scripts/backup_and_restore.sh
@@ -55,10 +55,10 @@ ENV_FILE=${SCRIPT_DIR}/../.env
 THREADS=$(echo ${THREADS:-1})
 ARCH=$(uname -m)

-if ! [[ "${THREADS}" =~ ^[1-9]+$ ]] ; then
+if ! [[ "${THREADS}" =~ ^[1-9][0-9]?$ ]] ; then
  echo "Thread input is not a number!"
  exit 1
-elif [[ "${THREADS}" =~ ^[1-9]+$ ]] ; then
+elif [[ "${THREADS}" =~ ^[1-9][0-9]?$ ]] ; then
  echo "Using ${THREADS} Thread(s) for this run."
  echo "Notice: You can set the Thread count with the THREADS Variable before you run this script."
 fi
Author	SHA1	Message	Date
FreddleSpl0it	fcf27d640d	Merge pull request #5979 from mailcow/staging 2024-07	2024-08-05 08:55:59 +02:00
FreddleSpl0it	cbca306fc1	Merge pull request #5976 from mailcow/fix/get-tfa 2024-07 fixes	2024-08-01 11:04:04 +02:00
Niklas Meyer	6a8986fe4f	Merge pull request #5974 from mailcow:update/postscreen_access.cidr [Postfix] update postscreen_access.cidr	2024-08-01 09:06:42 +02:00
milkmaker	ff34eb12e2	update postscreen_access.cidr	2024-08-01 00:16:46 +00:00
Niklas Meyer	03fccb28e9	Merge pull request #5971 from mailcow/dragoangel-patch-1 Do not add MAILCOW_WHITE on failed DMARC	2024-07-29 09:51:16 +02:00
Dmitriy Alekseev	8fbfd99dd6	Update composites.conf	2024-07-28 13:20:24 +02:00
Dmitriy Alekseev	7f7a869678	Do not add MAILCOW_WHITE on failed DMARC	2024-07-28 13:19:03 +02:00
DerLinkman	73257151c4	postfix: remove forced helo restrictions from master.cf	2024-07-24 15:29:28 +02:00
FreddleSpl0it	efb2572f0f	[Web] escapeHtml in relayhosts table	2024-07-22 15:05:43 +02:00
FreddleSpl0it	66aa28b5de	[Web] escapeHtml in api_log table	2024-07-22 15:04:29 +02:00
Niklas Meyer	987a027339	Merge pull request #5957 from mailcow/staging 2024-06c	2024-07-12 16:25:01 +02:00
Niklas Meyer	eea81e21f6	Revert "php: Rebase on Debian 12" (#5956 ) * Revert "php: Rebase on Debian 12 (#5951)" This reverts commit `9b478b3859`. * Revert all before "the storm" in php world	2024-07-12 16:21:53 +02:00
Niklas Meyer	a689109f44	Merge pull request #5955 from mailcow/revert-5875-staging_cml Revert "Update debug.twig to include a link to the git project URL for the mailcow version tag"	2024-07-12 16:05:01 +02:00
Niklas Meyer	58c0a46459	Revert "Update debug.twig to include a link to the git project URL for the mailcow version tag"	2024-07-12 16:04:19 +02:00
Niklas Meyer	2dbe8bf4ca	Merge pull request #5952 from mailcow/staging 2024-06b	2024-07-12 10:17:46 +02:00
Niklas Meyer	ef7ec06947	Merge pull request #5930 from mailcow/update/postscreen_access.cidr [Postfix] update postscreen_access.cidr	2024-07-12 10:16:44 +02:00
DerLinkman	fc7ea7a247	web: remove WIP notice for ARM64 from ui	2024-07-12 10:15:06 +02:00
Niklas Meyer	9b478b3859	php: Rebase on Debian 12 (#5951 ) * php: rebuild on debian 12 * Restored one build dockerfile * cleanup Dockerfile	2024-07-12 09:40:10 +02:00
Niklas Meyer	aadeeb0df3	Merge pull request #5634 from torzech/proper-threads-regex Enhanced regular expression for THREADS parameter	2024-07-09 10:10:42 +02:00
FreddleSpl0it	f33d82ffc1	[Web] use correct user to fetch TFA authenticators	2024-07-03 15:50:17 +02:00
milkmaker	8e2d3a6db5	update postscreen_access.cidr	2024-07-01 00:16:56 +00:00
Tomasz Orzechowski	6dc0bdbfa3	Proper number of threads regex.	2024-01-09 22:03:24 +01:00