Restore informative messages about manual Docker daemon configuration

Co-authored-by: DerLinkman <62480600+DerLinkman@users.noreply.github.com>
Add clarifying comment about MAILCOW_CONF usage in configure_ipv6
2026-02-18 07:06:24 +00:00 · 2025-12-10 08:32:50 +00:00 · 2025-12-10 08:24:45 +00:00 · 2025-12-10 08:22:23 +00:00 · 2025-12-10 08:18:16 +00:00 · 2025-12-09 13:29:15 +01:00
31 changed files with 210 additions and 597 deletions
--- a/.github/workflows/update_postscreen_access_list.yml
+++ b/.github/workflows/update_postscreen_access_list.yml
@@ -22,7 +22,7 @@ jobs:
          bash helper-scripts/update_postscreen_whitelist.sh

    - name: Create Pull Request
-      uses: peter-evans/create-pull-request@v8
+      uses: peter-evans/create-pull-request@v7
      with:
        token: ${{ secrets.mailcow_action_Update_postscreen_access_cidr_pat }}
        commit-message: update postscreen_access.cidr
--- a/_modules/scripts/ipv6_controller.sh
+++ b/_modules/scripts/ipv6_controller.sh
@@ -139,9 +139,13 @@ docker_daemon_edit(){
          exit 1
        fi
      else
-        echo -e "${YELLOW}User declined Docker update – please insert these changes manually:${NC}"
+        echo -e "${YELLOW}User declined Docker update – skipping Docker daemon configuration.${NC}"
+        echo -e "${YELLOW}IPv6 will be disabled for mailcow.${NC}"
+        echo ""
+        echo -e "${YELLOW}If you change your mind later, please insert these changes manually to $DOCKER_DAEMON_CONFIG:${NC}"
        echo "${MISSING[*]}"
-        exit 1
+        echo ""
+        return 1
      fi
    fi

@@ -185,9 +189,23 @@ EOF
      (command -v systemctl &>/dev/null && systemctl restart docker) || service docker restart
      echo "Docker restarted."
    else
-      echo "User declined to create daemon.json – please manually merge the docker daemon with these configs:"
-      echo "${MISSING[*]}"
-      exit 1
+      echo -e "${YELLOW}User declined to create daemon.json – skipping Docker daemon configuration.${NC}"
+      echo -e "${YELLOW}IPv6 will be disabled for mailcow.${NC}"
+      echo ""
+      echo -e "${YELLOW}If you change your mind later, please create $DOCKER_DAEMON_CONFIG with these settings:${NC}"
+      if [[ -n "$DOCKER_MAJOR" && "$DOCKER_MAJOR" -lt 27 ]]; then
+        echo '  "ipv6": true,'
+        echo '  "fixed-cidr-v6": "fd00:dead:beef:c0::/80",'
+        echo '  "ip6tables": true,'
+        echo '  "experimental": true'
+      elif [[ -n "$DOCKER_MAJOR" && "$DOCKER_MAJOR" -lt 28 ]]; then
+        echo '  "ipv6": true,'
+        echo '  "fixed-cidr-v6": "fd00:dead:beef:c0::/80"'
+      else
+        echo '  "ipv6": true'
+      fi
+      echo ""
+      return 1
    fi
  fi
 }
@@ -223,7 +241,22 @@ configure_ipv6() {
    return
  fi

-  docker_daemon_edit
+  if ! docker_daemon_edit; then
+    # User declined Docker daemon configuration
+    # When called from update.sh, MAILCOW_CONF is set and we modify the existing file
+    # When called from generate_config.sh, MAILCOW_CONF is not set and we export IPV6_BOOL
+    if [[ -n "$MAILCOW_CONF" && -f "$MAILCOW_CONF" ]]; then
+      if grep -q '^ENABLE_IPV6=' "$MAILCOW_CONF"; then
+        sed -i 's/^ENABLE_IPV6=.*/ENABLE_IPV6=false/' "$MAILCOW_CONF"
+      else
+        echo "ENABLE_IPV6=false" >> "$MAILCOW_CONF"
+      fi
+    else
+      export IPV6_BOOL=false
+    fi
+    echo "IPv6 configuration complete: ENABLE_IPV6=false"
+    return 0
+  fi

  if [[ -n "$MAILCOW_CONF" && -f "$MAILCOW_CONF" ]]; then
    if grep -q '^ENABLE_IPV6=' "$MAILCOW_CONF"; then
--- a/data/Dockerfiles/acme/acme.sh
+++ b/data/Dockerfiles/acme/acme.sh
@@ -246,25 +246,6 @@ while true; do
    done
    VALIDATED_CONFIG_DOMAINS+=("${VALIDATED_CONFIG_DOMAINS_SUBDOMAINS[*]}")
  done
-
-  # Fetch alias domains where target domain has MTA-STS enabled
-  if [[ ${AUTODISCOVER_SAN} == "y" ]]; then
-    SQL_ALIAS_DOMAINS=$(mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT ad.alias_domain FROM alias_domain ad INNER JOIN mta_sts m ON ad.target_domain = m.domain WHERE ad.active = 1 AND m.active = 1" -Bs)
-    if [[ $? -eq 0 ]]; then
-      while read alias_domain; do
-        if [[ -z "${alias_domain}" ]]; then
-          # ignore empty lines
-          continue
-        fi
-        # Only add mta-sts subdomain for alias domains
-        if [[ "mta-sts.${alias_domain}" != "${MAILCOW_HOSTNAME}" ]]; then
-          if check_domain "mta-sts.${alias_domain}"; then
-            VALIDATED_CONFIG_DOMAINS+=("mta-sts.${alias_domain}")
-          fi
-        fi
-      done <<< "${SQL_ALIAS_DOMAINS}"
-    fi
-  fi
  fi

  if check_domain ${MAILCOW_HOSTNAME}; then
--- a/data/Dockerfiles/rspamd/Dockerfile
+++ b/data/Dockerfiles/rspamd/Dockerfile
@@ -1,9 +1,9 @@
-FROM debian:trixie-slim
+FROM debian:bookworm-slim
 LABEL maintainer="The Infrastructure Company GmbH <info@servercow.de>"

 ARG DEBIAN_FRONTEND=noninteractive
-ARG RSPAMD_VER=rspamd_3.14.2-82~90302bc
-ARG CODENAME=trixie
+ARG RSPAMD_VER=rspamd_3.13.2-1~8bf602278
+ARG CODENAME=bookworm
 ENV LC_ALL=C

 RUN apt-get update && apt-get install -y --no-install-recommends \
--- a/data/conf/dovecot/auth/mailcowauth.php
+++ b/data/conf/dovecot/auth/mailcowauth.php
@@ -80,21 +80,14 @@ if ($isSOGoRequest) {
 }
 if ($result === false){
  // If it's a SOGo Request, don't check for protocol access
-  if ($isSOGoRequest) {
-    $service = 'SOGO';
-    $post['service'] = 'NONE';
-  } else {
-    $service = $post['service'];
-  }
-
-  $result = apppass_login($post['username'], $post['password'], array(
-    'service' => $post['service'],
+  $service = ($isSOGoRequest) ? false : array($post['service'] => true);
+  $result = apppass_login($post['username'], $post['password'], $service, array(
    'is_internal' => true,
    'remote_addr' => $post['real_rip']
  ));
  if ($result) {
-    error_log('MAILCOWAUTH: App auth for user ' . $post['username'] . " with service " . $service . " from IP " . $post['real_rip']);
-    set_sasl_log($post['username'], $post['real_rip'], $service);
+    error_log('MAILCOWAUTH: App auth for user ' . $post['username'] . " with service " . $post['service'] . " from IP " . $post['real_rip']);
+    set_sasl_log($post['username'], $post['real_rip'], $post['service']);
  }
 }
 if ($result === false){
--- a/data/conf/rspamd/lua/rspamd.local.lua
+++ b/data/conf/rspamd/lua/rspamd.local.lua
@@ -146,171 +146,8 @@ rspamd_config:register_symbol({
      return false
    end

-    -- Helper function to parse IPv6 into 8 segments
-    local function ipv6_to_segments(ip_str)
-      -- Remove zone identifier if present (e.g., %eth0)
-      ip_str = ip_str:gsub("%%.*$", "")
-      
-      local segments = {}
-      
-      -- Handle :: compression
-      if ip_str:find('::') then
-        local before, after = ip_str:match('^(.*)::(.*)$')
-        before = before or ''
-        after = after or ''
-        
-        local before_parts = {}
-        local after_parts = {}
-        
-        if before ~= '' then
-          for seg in before:gmatch('[^:]+') do
-            table.insert(before_parts, tonumber(seg, 16) or 0)
-          end
-        end
-        
-        if after ~= '' then
-          for seg in after:gmatch('[^:]+') do
-            table.insert(after_parts, tonumber(seg, 16) or 0)
-          end
-        end
-        
-        -- Add before segments
-        for _, seg in ipairs(before_parts) do
-          table.insert(segments, seg)
-        end
-        
-        -- Add compressed zeros
-        local zeros_needed = 8 - #before_parts - #after_parts
-        for i = 1, zeros_needed do
-          table.insert(segments, 0)
-        end
-        
-        -- Add after segments
-        for _, seg in ipairs(after_parts) do
-          table.insert(segments, seg)
-        end
-      else
-        -- No compression
-        for seg in ip_str:gmatch('[^:]+') do
-          table.insert(segments, tonumber(seg, 16) or 0)
-        end
-      end
-      
-      -- Ensure we have exactly 8 segments
-      while #segments < 8 do
-        table.insert(segments, 0)
-      end
-      
-      return segments
-    end
-
-    -- Generate all common IPv6 notations
-    local function get_ipv6_variants(ip_str)
-      local variants = {}
-      local seen = {}
-      
-      local function add_variant(v)
-        if v and not seen[v] then
-          table.insert(variants, v)
-          seen[v] = true
-        end
-      end
-      
-      -- For IPv4, just return the original
-      if not ip_str:find(':') then
-        add_variant(ip_str)
-        return variants
-      end
-      
-      local segments = ipv6_to_segments(ip_str)
-      
-      -- 1. Fully expanded form (all zeros shown as 0000)
-      local expanded_parts = {}
-      for _, seg in ipairs(segments) do
-        table.insert(expanded_parts, string.format('%04x', seg))
-      end
-      add_variant(table.concat(expanded_parts, ':'))
-      
-      -- 2. Standard form (no leading zeros, but all segments present)
-      local standard_parts = {}
-      for _, seg in ipairs(segments) do
-        table.insert(standard_parts, string.format('%x', seg))
-      end
-      add_variant(table.concat(standard_parts, ':'))
-      
-      -- 3. Find all possible :: compressions
-      -- RFC 5952: compress the longest run of consecutive zeros
-      -- But we need to check all possibilities since Redis might have any form
-      
-      -- Find all zero runs
-      local zero_runs = {}
-      local in_run = false
-      local run_start = 0
-      local run_length = 0
-      
-      for i = 1, 8 do
-        if segments[i] == 0 then
-          if not in_run then
-            in_run = true
-            run_start = i
-            run_length = 1
-          else
-            run_length = run_length + 1
-          end
-        else
-          if in_run then
-            if run_length >= 1 then  -- Allow single zero compression too
-              table.insert(zero_runs, {start = run_start, length = run_length})
-            end
-            in_run = false
-          end
-        end
-      end
-      
-      -- Don't forget the last run
-      if in_run and run_length >= 1 then
-        table.insert(zero_runs, {start = run_start, length = run_length})
-      end
-      
-      -- Generate variant for each zero run compression
-      for _, run in ipairs(zero_runs) do
-        local parts = {}
-        
-        -- Before compression
-        for i = 1, run.start - 1 do
-          table.insert(parts, string.format('%x', segments[i]))
-        end
-        
-        -- The compression
-        if run.start == 1 then
-          table.insert(parts, '')
-          table.insert(parts, '')
-        elseif run.start + run.length - 1 == 8 then
-          table.insert(parts, '')
-          table.insert(parts, '')
-        else
-          table.insert(parts, '')
-        end
-        
-        -- After compression
-        for i = run.start + run.length, 8 do
-          table.insert(parts, string.format('%x', segments[i]))
-        end
-        
-        local compressed = table.concat(parts, ':'):gsub('::+', '::')
-        add_variant(compressed)
-      end
-      
-      return variants
-    end
-
    local from_ip_string = tostring(ip)
-    local ip_check_table = {}
-    
-    -- Add all variants of the exact IP
-    for _, variant in ipairs(get_ipv6_variants(from_ip_string)) do
-      table.insert(ip_check_table, variant)
-    end
+    ip_check_table = {from_ip_string}

    local maxbits = 128
    local minbits = 32
@@ -318,18 +155,10 @@ rspamd_config:register_symbol({
        maxbits = 32
        minbits = 8
    end
-    
-    -- Add all CIDR notations with variants
    for i=maxbits,minbits,-1 do
-      local masked_ip = ip:apply_mask(i)
-      local cidr_base = masked_ip:to_string()
-      
-      for _, variant in ipairs(get_ipv6_variants(cidr_base)) do
-        local cidr = variant .. "/" .. i
-        table.insert(ip_check_table, cidr)
-      end
+      local nip = ip:apply_mask(i):to_string() .. "/" .. i
+      table.insert(ip_check_table, nip)
    end
-    
    local function keep_spam_cb(err, data)
      if err then
        rspamd_logger.infox(rspamd_config, "keep_spam query request for ip %s returned invalid or empty data (\"%s\") or error (\"%s\")", ip, data, err)
@@ -337,15 +166,12 @@ rspamd_config:register_symbol({
      else
        for k,v in pairs(data) do
          if (v and v ~= userdata and v == '1') then
-            rspamd_logger.infox(rspamd_config, "found ip %s (checked as: %s) in keep_spam map, setting pre-result accept", from_ip_string, ip_check_table[k])
+            rspamd_logger.infox(rspamd_config, "found ip in keep_spam map, setting pre-result")
            task:set_pre_result('accept', 'ip matched with forward hosts', 'keep_spam')
-            task:set_flag('no_stat')
-            return
          end
        end
      end
    end
-    
    table.insert(ip_check_table, 1, 'KEEP_SPAM')
    local redis_ret_user = rspamd_redis_make_request(task,
      redis_params, -- connect params
@@ -384,7 +210,6 @@ rspamd_config:register_symbol({
 rspamd_config:register_symbol({
  name = 'TAG_MOO',
  type = 'postfilter',
-  flags = 'ignore_passthrough',
  callback = function(task)
    local util = require("rspamd_util")
    local rspamd_logger = require "rspamd_logger"
@@ -393,6 +218,9 @@ rspamd_config:register_symbol({
    local rcpts = task:get_recipients('smtp')
    local lua_util = require "lua_util"

+    local tagged_rcpt = task:get_symbol("TAGGED_RCPT")
+    local mailcow_domain = task:get_symbol("RCPT_MAILCOW_DOMAIN")
+
    local function remove_moo_tag()
      local moo_tag_header = task:get_header('X-Moo-Tag', false)
      if moo_tag_header then
@@ -403,149 +231,101 @@ rspamd_config:register_symbol({
      return true
    end

-    -- Check if we have exactly one recipient
-    if not (rcpts and #rcpts == 1) then
-      rspamd_logger.infox("TAG_MOO: not exactly one rcpt (%s), removing moo tag", rcpts and #rcpts or 0)
-      remove_moo_tag()
-      return
-    end
+    if tagged_rcpt and tagged_rcpt[1].options and mailcow_domain then
+      local tag = tagged_rcpt[1].options[1]
+      rspamd_logger.infox("found tag: %s", tag)
+      local action = task:get_metric_action('default')
+      rspamd_logger.infox("metric action now: %s", action)

-    local rcpt_addr = rcpts[1]['addr']
-    local rcpt_user = rcpts[1]['user']
-    local rcpt_domain = rcpts[1]['domain']
-
-    -- Check if recipient has a tag (contains '+')
-    local tag = nil
-    if rcpt_user:find('%+') then
-      local base_user, tag_part = rcpt_user:match('^(.-)%+(.+)$')
-      if base_user and tag_part then
-        tag = tag_part
-        rspamd_logger.infox("TAG_MOO: found tag in recipient: %s (base: %s, tag: %s)", rcpt_addr, base_user, tag)
+      if action ~= 'no action' and action ~= 'greylist' then
+        rspamd_logger.infox("skipping tag handler for action: %s", action)
+        remove_moo_tag()
+        return true
      end
-    end

-    if not tag then
-      rspamd_logger.infox("TAG_MOO: no tag found in recipient %s, removing moo tag", rcpt_addr)
-      remove_moo_tag()
-      return
-    end
+      local function http_callback(err_message, code, body, headers)
+        if body ~= nil and body ~= "" then
+          rspamd_logger.infox(rspamd_config, "expanding rcpt to \"%s\"", body)

-    -- Optional: Check if domain is a mailcow domain
-    -- When KEEP_SPAM is active, RCPT_MAILCOW_DOMAIN might not be set
-    -- If the mail is being delivered, we can assume it's valid
-    local mailcow_domain = task:get_symbol("RCPT_MAILCOW_DOMAIN")
-    if not mailcow_domain then
-      rspamd_logger.infox("TAG_MOO: RCPT_MAILCOW_DOMAIN not set (possibly due to pre-result), proceeding anyway for domain %s", rcpt_domain)
-    end
+          local function tag_callback_subject(err, data)
+            if err or type(data) ~= 'string' then
+              rspamd_logger.infox(rspamd_config, "subject tag handler rcpt %s returned invalid or empty data (\"%s\") or error (\"%s\") - trying subfolder tag handler...", body, data, err)

-    local action = task:get_metric_action('default')
-    rspamd_logger.infox("TAG_MOO: metric action: %s", action)
+              local function tag_callback_subfolder(err, data)
+                if err or type(data) ~= 'string' then
+                  rspamd_logger.infox(rspamd_config, "subfolder tag handler for rcpt %s returned invalid or empty data (\"%s\") or error (\"%s\")", body, data, err)
+                  remove_moo_tag()
+                else
+                  rspamd_logger.infox("Add X-Moo-Tag header")
+                  task:set_milter_reply({
+                    add_headers = {['X-Moo-Tag'] = 'YES'}
+                  })
+                end
+              end
+
+              local redis_ret_subfolder = rspamd_redis_make_request(task,
+                redis_params, -- connect params
+                body, -- hash key
+                false, -- is write
+                tag_callback_subfolder, --callback
+                'HGET', -- command
+                {'RCPT_WANTS_SUBFOLDER_TAG', body} -- arguments
+              )
+              if not redis_ret_subfolder then
+                rspamd_logger.infox(rspamd_config, "cannot make request to load tag handler for rcpt")
+                remove_moo_tag()
+              end
+
+            else
+              rspamd_logger.infox("user wants subject modified for tagged mail")
+              local sbj = task:get_header('Subject')
+              new_sbj = '=?UTF-8?B?' .. tostring(util.encode_base64('[' .. tag .. '] ' .. sbj)) .. '?='
+              task:set_milter_reply({
+                remove_headers = {
+                  ['Subject'] = 1,
+                  ['X-Moo-Tag'] = 0
+                },
+                add_headers = {['Subject'] = new_sbj}
+              })
+            end
+          end
+
+          local redis_ret_subject = rspamd_redis_make_request(task,
+            redis_params, -- connect params
+            body, -- hash key
+            false, -- is write
+            tag_callback_subject, --callback
+            'HGET', -- command
+            {'RCPT_WANTS_SUBJECT_TAG', body} -- arguments
+          )
+          if not redis_ret_subject then
+            rspamd_logger.infox(rspamd_config, "cannot make request to load tag handler for rcpt")
+            remove_moo_tag()
+          end

-    -- Check if we have a pre-result (e.g., from KEEP_SPAM or POSTMASTER_HANDLER)
-    local allow_processing = false
-    
-    if task.has_pre_result then
-      local has_pre, pre_action = task:has_pre_result()
-      if has_pre then
-        rspamd_logger.infox("TAG_MOO: pre-result detected: %s", tostring(pre_action))
-        if pre_action == 'accept' then
-          allow_processing = true
-          rspamd_logger.infox("TAG_MOO: pre-result is accept, will process")
        end
      end
-    end

-    -- Allow processing for mild actions or when we have pre-result accept
-    if not allow_processing and action ~= 'no action' and action ~= 'greylist' then
-      rspamd_logger.infox("TAG_MOO: skipping tag handler for action: %s", action)
-      remove_moo_tag()
-      return true
-    end
-
-    rspamd_logger.infox("TAG_MOO: processing allowed")
-
-    local function http_callback(err_message, code, body, headers)
-      if body ~= nil and body ~= "" then
-        rspamd_logger.infox(rspamd_config, "TAG_MOO: expanding rcpt to \"%s\"", body)
-
-        local function tag_callback_subject(err, data)
-          if err or type(data) ~= 'string' or data == '' then
-            rspamd_logger.infox(rspamd_config, "TAG_MOO: subject tag handler rcpt %s returned invalid or empty data (\"%s\") or error (\"%s\") - trying subfolder tag handler...", body, data, err)
-
-            local function tag_callback_subfolder(err, data)
-              if err or type(data) ~= 'string' or data == '' then
-                rspamd_logger.infox(rspamd_config, "TAG_MOO: subfolder tag handler for rcpt %s returned invalid or empty data (\"%s\") or error (\"%s\")", body, data, err)
-                remove_moo_tag()
-              else
-                rspamd_logger.infox("TAG_MOO: User wants subfolder tag, adding X-Moo-Tag header")
-                task:set_milter_reply({
-                  add_headers = {['X-Moo-Tag'] = 'YES'}
-                })
-              end
-            end
-
-            local redis_ret_subfolder = rspamd_redis_make_request(task,
-              redis_params, -- connect params
-              body, -- hash key
-              false, -- is write
-              tag_callback_subfolder, --callback
-              'HGET', -- command
-              {'RCPT_WANTS_SUBFOLDER_TAG', body} -- arguments
-            )
-            if not redis_ret_subfolder then
-              rspamd_logger.infox(rspamd_config, "TAG_MOO: cannot make request to load tag handler for rcpt")
+      if rcpts and #rcpts == 1 then
+        for _,rcpt in ipairs(rcpts) do
+          local rcpt_split = rspamd_str_split(rcpt['addr'], '@')
+          if #rcpt_split == 2 then
+            if rcpt_split[1] == 'postmaster' then
+              rspamd_logger.infox(rspamd_config, "not expanding postmaster alias")
              remove_moo_tag()
+            else
+              rspamd_http.request({
+                task=task,
+                url='http://nginx:8081/aliasexp.php',
+                body='',
+                callback=http_callback,
+                headers={Rcpt=rcpt['addr']},
+              })
            end
-
-          else
-            rspamd_logger.infox("TAG_MOO: user wants subject modified for tagged mail")
-            local sbj = task:get_header('Subject') or ''
-            new_sbj = '=?UTF-8?B?' .. tostring(util.encode_base64('[' .. tag .. '] ' .. sbj)) .. '?='
-            task:set_milter_reply({
-              remove_headers = {
-                ['Subject'] = 1,
-                ['X-Moo-Tag'] = 0
-              },
-              add_headers = {['Subject'] = new_sbj}
-            })
          end
        end
-
-        local redis_ret_subject = rspamd_redis_make_request(task,
-          redis_params, -- connect params
-          body, -- hash key
-          false, -- is write
-          tag_callback_subject, --callback
-          'HGET', -- command
-          {'RCPT_WANTS_SUBJECT_TAG', body} -- arguments
-        )
-        if not redis_ret_subject then
-          rspamd_logger.infox(rspamd_config, "TAG_MOO: cannot make request to load tag handler for rcpt")
-          remove_moo_tag()
-        end
-      else
-        rspamd_logger.infox("TAG_MOO: alias expansion returned empty body")
-        remove_moo_tag()
-      end
-    end
-
-    local rcpt_split = rspamd_str_split(rcpt_addr, '@')
-    if #rcpt_split == 2 then
-      if rcpt_split[1]:match('^postmaster') then
-        rspamd_logger.infox(rspamd_config, "TAG_MOO: not expanding postmaster alias")
-        remove_moo_tag()
-      else
-        rspamd_logger.infox("TAG_MOO: requesting alias expansion for %s", rcpt_addr)
-        rspamd_http.request({
-          task=task,
-          url='http://nginx:8081/aliasexp.php',
-          body='',
-          callback=http_callback,
-          headers={Rcpt=rcpt_addr},
-        })
      end
    else
-      rspamd_logger.infox("TAG_MOO: invalid rcpt format")
      remove_moo_tag()
    end
  end,
@@ -555,7 +335,6 @@ rspamd_config:register_symbol({
 rspamd_config:register_symbol({
  name = 'BCC',
  type = 'postfilter',
-  flags = 'ignore_passthrough',
  callback = function(task)
    local util = require("rspamd_util")
    local rspamd_http = require "rspamd_http"
@@ -584,13 +363,11 @@ rspamd_config:register_symbol({
      local email_content = tostring(task:get_content())
      email_content = string.gsub(email_content, "\r\n%.", "\r\n..")
      -- send mail
-      local from_smtp = task:get_from('smtp')
-      local from_addr = (from_smtp and from_smtp[1] and from_smtp[1].addr) or 'mailer-daemon@localhost'
      lua_smtp.sendmail({
        task = task,
        host = os.getenv("IPV4_NETWORK") .. '.253',
        port = 591,
-        from = from_addr,
+        from = task:get_from(stp)[1].addr,
        recipients = bcc_dest,
        helo = 'bcc',
        timeout = 20,
@@ -620,41 +397,27 @@ rspamd_config:register_symbol({
    end

    local action = task:get_metric_action('default')
-    rspamd_logger.infox("BCC: metric action: %s", action)
-
-    -- Check for pre-result accept (e.g., from KEEP_SPAM)
-    local allow_bcc = false
-    if task.has_pre_result then
-      local has_pre, pre_action = task:has_pre_result()
-      if has_pre and pre_action == 'accept' then
-        allow_bcc = true
-        rspamd_logger.infox("BCC: pre-result accept detected, will send BCC")
-      end
-    end
-
-    -- Allow BCC for mild actions or when we have pre-result accept
-    if not allow_bcc and action ~= 'no action' and action ~= 'add header' and action ~= 'rewrite subject' then
-      rspamd_logger.infox("BCC: skipping for action: %s", action)
-      return
-    end
+    rspamd_logger.infox("metric action now: %s", action)

    local function rcpt_callback(err_message, code, body, headers)
      if err_message == nil and code == 201 and body ~= nil then
-        rspamd_logger.infox("BCC: sending BCC to %s for rcpt match", body)
-        send_mail(task, body)
+        if action == 'no action' or action == 'add header' or action == 'rewrite subject' then
+          send_mail(task, body)
+        end
      end
    end

    local function from_callback(err_message, code, body, headers)
      if err_message == nil and code == 201 and body ~= nil then
-        rspamd_logger.infox("BCC: sending BCC to %s for from match", body)
-        send_mail(task, body)
+        if action == 'no action' or action == 'add header' or action == 'rewrite subject' then
+          send_mail(task, body)
+        end
      end
    end

    if rcpt_table then
      for _,e in ipairs(rcpt_table) do
-        rspamd_logger.infox(rspamd_config, "BCC: checking bcc for rcpt address %s", e)
+        rspamd_logger.infox(rspamd_config, "checking bcc for rcpt address %s", e)
        rspamd_http.request({
          task=task,
          url='http://nginx:8081/bcc.php',
@@ -667,7 +430,7 @@ rspamd_config:register_symbol({

    if from_table then
      for _,e in ipairs(from_table) do
-        rspamd_logger.infox(rspamd_config, "BCC: checking bcc for from address %s", e)
+        rspamd_logger.infox(rspamd_config, "checking bcc for from address %s", e)
        rspamd_http.request({
          task=task,
          url='http://nginx:8081/bcc.php',
@@ -678,7 +441,7 @@ rspamd_config:register_symbol({
      end
    end

-    -- Don't return true to avoid symbol being logged
+    return true
  end,
  priority = 20
 })
@@ -945,4 +708,4 @@ rspamd_config:register_symbol({
    return true
  end,
  priority = 1
-})
+})
--- a/data/web/autodiscover.php
+++ b/data/web/autodiscover.php
@@ -79,7 +79,7 @@ if (empty($_SERVER['PHP_AUTH_USER']) || empty($_SERVER['PHP_AUTH_PW'])) {
  exit(0);
 }

-$login_role = check_login($login_user, $login_pass, array('service' => 'EAS'));
+$login_role = check_login($login_user, $login_pass, array('eas' => TRUE));

 if ($login_role === "user") {
  header("Content-Type: application/xml");
--- a/data/web/inc/ajax/dns_diagnostics.php
+++ b/data/web/inc/ajax/dns_diagnostics.php
@@ -129,16 +129,7 @@ if (isset($_SESSION['mailcow_cc_role']) && ($_SESSION['mailcow_cc_role'] == "adm
    );
  }

-  // Check if domain is an alias domain and get target domain's MTA-STS
-  $alias_domain_details = mailbox('get', 'alias_domain_details', $domain);
-  $mta_sts_domain = $domain;
-  
-  if ($alias_domain_details !== false && !empty($alias_domain_details['target_domain'])) {
-    // This is an alias domain, check target domain for MTA-STS
-    $mta_sts_domain = $alias_domain_details['target_domain'];
-  }
-  
-  $mta_sts = mailbox('get', 'mta_sts', $mta_sts_domain);
+  $mta_sts = mailbox('get', 'mta_sts', $domain);
  if (count($mta_sts) > 0 && $mta_sts['active'] == 1) {
    if (!in_array($domain, $alias_domains)) {
      $records[] = array(
--- a/data/web/inc/functions.auth.inc.php
+++ b/data/web/inc/functions.auth.inc.php
@@ -1,11 +1,10 @@
 <?php
-function check_login($user, $pass, $extra = null) {
+function check_login($user, $pass, $app_passwd_data = false, $extra = null) {
  global $pdo;
  global $redis;

  $is_internal = $extra['is_internal'];
  $role = $extra['role'];
-  $extra['service'] = !isset($extra['service']) ? 'NONE' : $extra['service'];

  // Try validate admin
  if (!isset($role) || $role == "admin") {
@@ -26,20 +25,34 @@ function check_login($user, $pass, $extra = null) {

  // Try validate app password
  if (!isset($role) || $role == "app") {
-    $result = apppass_login($user, $pass, $extra);
+    $result = apppass_login($user, $pass, $app_passwd_data);
    if ($result !== false) {
+      if ($app_passwd_data['eas'] === true) {
+        $service = 'EAS';
+      } elseif ($app_passwd_data['dav'] === true) {
+        $service = 'DAV';
+      } else {
+        $service = 'NONE';
+      }
      $real_rip = ($_SERVER['HTTP_X_REAL_IP'] ?? $_SERVER['REMOTE_ADDR']);
-      set_sasl_log($user, $real_rip, $extra['service'], $pass);
+      set_sasl_log($user, $real_rip, $service, $pass);
      return $result;
    }
  }

  // Try validate user
  if (!isset($role) || $role == "user") {
-    $result = user_login($user, $pass, $extra);
+    $result = user_login($user, $pass);
    if ($result !== false) {
+      if ($app_passwd_data['eas'] === true) {
+        $service = 'EAS';
+      } elseif ($app_passwd_data['dav'] === true) {
+        $service = 'DAV';
+      } else {
+        $service = 'MAILCOWUI';
+      }
      $real_rip = ($_SERVER['HTTP_X_REAL_IP'] ?? $_SERVER['REMOTE_ADDR']);
-      set_sasl_log($user, $real_rip, $extra['service']);
+      set_sasl_log($user, $real_rip, $service);
      return $result;
    }
  }
@@ -180,7 +193,7 @@ function user_login($user, $pass, $extra = null){
  global $iam_settings;

  $is_internal = $extra['is_internal'];
-  $extra['service'] = !isset($extra['service']) ? 'NONE' : $extra['service'];
+  $service = $extra['service'];

  if (!filter_var($user, FILTER_VALIDATE_EMAIL) && !ctype_alnum(str_replace(array('_', '.', '-'), '', $user))) {
    if (!$is_internal){
@@ -223,10 +236,10 @@ function user_login($user, $pass, $extra = null){
      $row = $stmt->fetch(PDO::FETCH_ASSOC);

      if (!empty($row)) {
-        // check if user has access to service (imap, smtp, pop3, sieve, dav, eas) if service is set
+        // check if user has access to service (imap, smtp, pop3, sieve) if service is set
        $row['attributes'] = json_decode($row['attributes'], true);
-        if ($extra['service'] != 'NONE') {
-          $key = strtolower($extra['service']) . "_access";
+        if (isset($service)) {
+          $key = strtolower($service) . "_access";
          if (isset($row['attributes'][$key]) && $row['attributes'][$key] != '1') {
            return false;
          }
@@ -240,8 +253,8 @@ function user_login($user, $pass, $extra = null){

  // check if user has access to service (imap, smtp, pop3, sieve) if service is set
  $row['attributes'] = json_decode($row['attributes'], true);
-  if ($extra['service'] != 'NONE') {
-    $key = strtolower($extra['service']) . "_access";
+  if (isset($service)) {
+    $key = strtolower($service) . "_access";
    if (isset($row['attributes'][$key]) && $row['attributes'][$key] != '1') {
      return false;
    }
@@ -395,7 +408,7 @@ function user_login($user, $pass, $extra = null){

  return false;
 }
-function apppass_login($user, $pass, $extra = null){
+function apppass_login($user, $pass, $app_passwd_data, $extra = null){
  global $pdo;

  $is_internal = $extra['is_internal'];
@@ -411,8 +424,20 @@ function apppass_login($user, $pass, $extra = null){
    return false;
  }

-  $extra['service'] = !isset($extra['service']) ? 'NONE' : $extra['service'];
-  if (!$is_internal && $extra['service'] == 'NONE') {
+  $protocol = false;
+  if ($app_passwd_data['eas']){
+    $protocol = 'eas';
+  } else if ($app_passwd_data['dav']){
+    $protocol = 'dav';
+  } else if ($app_passwd_data['smtp']){
+    $protocol = 'smtp';
+  } else if ($app_passwd_data['imap']){
+    $protocol = 'imap';
+  } else if ($app_passwd_data['sieve']){
+    $protocol = 'sieve';
+  } else if ($app_passwd_data['pop3']){
+    $protocol = 'pop3';
+  } else if (!$is_internal) {
    return false;
  }

@@ -433,7 +458,7 @@ function apppass_login($user, $pass, $extra = null){
  $rows = $stmt->fetchAll(PDO::FETCH_ASSOC);

  foreach ($rows as $row) {
-    if ($extra['service'] != 'NONE' && $row[strtolower($extra['service']) . '_access'] != '1'){
+    if ($protocol && $row[$protocol . '_access'] != '1'){
      continue;
    }

--- a/data/web/inc/functions.inc.php
+++ b/data/web/inc/functions.inc.php
@@ -814,32 +814,6 @@ function verify_hash($hash, $password) {
        $hash = $components[4];
        return hash_equals(hash_pbkdf2('sha1', $password, $salt, $rounds), $hash);

-      case "PBKDF2-SHA512":
-        // Handle FreeIPA-style hash: {PBKDF2-SHA512}10000$<base64_salt>$<base64_hash>
-        $components = explode('$', $hash);
-        if (count($components) !== 3) return false;
-
-        // 1st part: iteration count (integer)
-        $iterations = intval($components[0]);
-        if ($iterations <= 0) return false;
-
-        // 2nd part: salt (base64-encoded)
-        $salt = $components[1];
-        // 3rd part: hash (base64-encoded)
-        $stored_hash_b64 = $components[2];
-
-        // Decode salt and hash from base64
-        $salt_bin = base64_decode($salt, true);
-        $hash_bin = base64_decode($stored_hash_b64, true);
-        if ($salt_bin === false || $hash_bin === false) return false;
-        // Get length of hash in bytes
-        $hash_len = strlen($hash_bin);
-        if ($hash_len === 0) return false;
-
-        // Calculate PBKDF2-SHA512 hash for provided password
-        $test_hash = hash_pbkdf2('sha512', $password, $salt_bin, $iterations, $hash_len, true);
-        return hash_equals($hash_bin, $test_hash);
-
      case "PLAIN-MD4":
        return hash_equals(hash('md4', $password), $hash);

--- a/data/web/inc/functions.mailbox.inc.php
+++ b/data/web/inc/functions.mailbox.inc.php
@@ -1075,8 +1075,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
            $_data['pop3_access'] = (in_array('pop3', $_data['protocol_access'])) ? 1 : 0;
            $_data['smtp_access'] = (in_array('smtp', $_data['protocol_access'])) ? 1 : 0;
            $_data['sieve_access'] = (in_array('sieve', $_data['protocol_access'])) ? 1 : 0;
-            $_data['eas_access'] = (in_array('eas', $_data['protocol_access'])) ? 1 : 0;
-            $_data['dav_access'] = (in_array('dav', $_data['protocol_access'])) ? 1 : 0;
          }
          $active = (isset($_data['active'])) ? intval($_data['active']) : intval($MAILBOX_DEFAULT_ATTRIBUTES['active']);
          $force_pw_update = (isset($_data['force_pw_update'])) ? intval($_data['force_pw_update']) : intval($MAILBOX_DEFAULT_ATTRIBUTES['force_pw_update']);
@@ -1087,8 +1085,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
          $pop3_access = (isset($_data['pop3_access'])) ? intval($_data['pop3_access']) : intval($MAILBOX_DEFAULT_ATTRIBUTES['pop3_access']);
          $smtp_access = (isset($_data['smtp_access'])) ? intval($_data['smtp_access']) : intval($MAILBOX_DEFAULT_ATTRIBUTES['smtp_access']);
          $sieve_access = (isset($_data['sieve_access'])) ? intval($_data['sieve_access']) : intval($MAILBOX_DEFAULT_ATTRIBUTES['sieve_access']);
-          $eas_access = (isset($_data['eas_access'])) ? intval($_data['eas_access']) : intval($MAILBOX_DEFAULT_ATTRIBUTES['eas_access']);
-          $dav_access = (isset($_data['dav_access'])) ? intval($_data['dav_access']) : intval($MAILBOX_DEFAULT_ATTRIBUTES['dav_access']);
          $relayhost = (isset($_data['relayhost'])) ? intval($_data['relayhost']) : 0;
          $quarantine_notification = (isset($_data['quarantine_notification'])) ? strval($_data['quarantine_notification']) : strval($MAILBOX_DEFAULT_ATTRIBUTES['quarantine_notification']);
          $quarantine_category = (isset($_data['quarantine_category'])) ? strval($_data['quarantine_category']) : strval($MAILBOX_DEFAULT_ATTRIBUTES['quarantine_category']);
@@ -1107,8 +1103,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
              'pop3_access' => strval($pop3_access),
              'smtp_access' => strval($smtp_access),
              'sieve_access' => strval($sieve_access),
-              'eas_access' => strval($eas_access),
-              'dav_access' => strval($dav_access),
              'relayhost' => strval($relayhost),
              'passwd_update' => time(),
              'mailbox_format' => strval($MAILBOX_DEFAULT_ATTRIBUTES['mailbox_format']),
@@ -1727,16 +1721,12 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
            $attr['pop3_access'] = (in_array('pop3', $_data['protocol_access'])) ? 1 : 0;
            $attr['smtp_access'] = (in_array('smtp', $_data['protocol_access'])) ? 1 : 0;
            $attr['sieve_access'] = (in_array('sieve', $_data['protocol_access'])) ? 1 : 0;
-            $attr['eas_access'] = (in_array('eas', $_data['protocol_access'])) ? 1 : 0;
-            $attr['dav_access'] = (in_array('dav', $_data['protocol_access'])) ? 1 : 0;
          }
          else {
            $attr['imap_access'] = intval($MAILBOX_DEFAULT_ATTRIBUTES['imap_access']);
            $attr['pop3_access'] = intval($MAILBOX_DEFAULT_ATTRIBUTES['pop3_access']);
            $attr['smtp_access'] = intval($MAILBOX_DEFAULT_ATTRIBUTES['smtp_access']);
            $attr['sieve_access'] = intval($MAILBOX_DEFAULT_ATTRIBUTES['sieve_access']);
-            $attr['eas_access'] = intval($MAILBOX_DEFAULT_ATTRIBUTES['eas_access']);
-            $attr['dav_access'] = intval($MAILBOX_DEFAULT_ATTRIBUTES['dav_access']);
          }
          if (isset($_data['acl'])) {
            $_data['acl'] = (array)$_data['acl'];
@@ -3053,8 +3043,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
              $_data['pop3_access'] = (in_array('pop3', $_data['protocol_access'])) ? 1 : 0;
              $_data['smtp_access'] = (in_array('smtp', $_data['protocol_access'])) ? 1 : 0;
              $_data['sieve_access'] = (in_array('sieve', $_data['protocol_access'])) ? 1 : 0;
-              $_data['eas_access'] = (in_array('eas', $_data['protocol_access'])) ? 1 : 0;
-              $_data['dav_access'] = (in_array('dav', $_data['protocol_access'])) ? 1 : 0;
            }
            if (!empty($is_now)) {
              $active               = (isset($_data['active'])) ? intval($_data['active']) : $is_now['active'];
@@ -3064,8 +3052,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
              (int)$pop3_access     = (isset($_data['pop3_access']) && hasACLAccess("protocol_access")) ? intval($_data['pop3_access']) : intval($is_now['attributes']['pop3_access']);
              (int)$smtp_access     = (isset($_data['smtp_access']) && hasACLAccess("protocol_access")) ? intval($_data['smtp_access']) : intval($is_now['attributes']['smtp_access']);
              (int)$sieve_access    = (isset($_data['sieve_access']) && hasACLAccess("protocol_access")) ? intval($_data['sieve_access']) : intval($is_now['attributes']['sieve_access']);
-              (int)$eas_access     = (isset($_data['eas_access']) && hasACLAccess("protocol_access")) ? intval($_data['eas_access']) : intval($is_now['attributes']['eas_access']);
-              (int)$dav_access    = (isset($_data['dav_access']) && hasACLAccess("protocol_access")) ? intval($_data['dav_access']) : intval($is_now['attributes']['dav_access']);
              (int)$relayhost       = (isset($_data['relayhost']) && hasACLAccess("mailbox_relayhost")) ? intval($_data['relayhost']) : intval($is_now['attributes']['relayhost']);
              (int)$quota_m         = (isset_has_content($_data['quota'])) ? intval($_data['quota']) : ($is_now['quota'] / 1048576);
              $name                 = (!empty($_data['name'])) ? ltrim(rtrim($_data['name'], '>'), '<') : $is_now['name'];
@@ -3349,8 +3335,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
                  `attributes` = JSON_SET(`attributes`, '$.pop3_access', :pop3_access),
                  `attributes` = JSON_SET(`attributes`, '$.relayhost', :relayhost),
                  `attributes` = JSON_SET(`attributes`, '$.smtp_access', :smtp_access),
-                  `attributes` = JSON_SET(`attributes`, '$.eas_access', :eas_access),
-                  `attributes` = JSON_SET(`attributes`, '$.dav_access', :dav_access),
                  `attributes` = JSON_SET(`attributes`, '$.recovery_email', :recovery_email),
                  `attributes` = JSON_SET(`attributes`, '$.attribute_hash', :attribute_hash)
                    WHERE `username` = :username");
@@ -3365,8 +3349,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
                ':pop3_access' => $pop3_access,
                ':sieve_access' => $sieve_access,
                ':smtp_access' => $smtp_access,
-                ':eas_access' => $eas_access,
-                ':dav_access' => $dav_access,
                ':recovery_email' => $pw_recovery_email,
                ':relayhost' => $relayhost,
                ':username' => $username,
@@ -3749,8 +3731,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
              $attr['pop3_access'] = (in_array('pop3', $_data['protocol_access'])) ? 1 : 0;
              $attr['smtp_access'] = (in_array('smtp', $_data['protocol_access'])) ? 1 : 0;
              $attr['sieve_access'] = (in_array('sieve', $_data['protocol_access'])) ? 1 : 0;
-              $attr['eas_access'] = (in_array('eas', $_data['protocol_access'])) ? 1 : 0;
-              $attr['dav_access'] = (in_array('dav', $_data['protocol_access'])) ? 1 : 0;
            }
            else {
              foreach ($is_now as $key => $value){
--- a/data/web/inc/init_db.inc.php
+++ b/data/web/inc/init_db.inc.php
@@ -4,7 +4,7 @@ function init_db_schema()
  try {
    global $pdo;

-    $db_version = "28012026_1000";
+    $db_version = "10312025_0525";

    $stmt = $pdo->query("SHOW TABLES LIKE 'versions'");
    $num_results = count($stmt->fetchAll(PDO::FETCH_ASSOC));
@@ -1394,8 +1394,6 @@ function init_db_schema()
    $pdo->query("UPDATE `mailbox` SET `attributes` =  JSON_SET(`attributes`, '$.imap_access', \"1\") WHERE JSON_VALUE(`attributes`, '$.imap_access') IS NULL;");
    $pdo->query("UPDATE `mailbox` SET `attributes` =  JSON_SET(`attributes`, '$.pop3_access', \"1\") WHERE JSON_VALUE(`attributes`, '$.pop3_access') IS NULL;");
    $pdo->query("UPDATE `mailbox` SET `attributes` =  JSON_SET(`attributes`, '$.smtp_access', \"1\") WHERE JSON_VALUE(`attributes`, '$.smtp_access') IS NULL;");
-    $pdo->query("UPDATE `mailbox` SET `attributes` =  JSON_SET(`attributes`, '$.eas_access', \"1\") WHERE JSON_VALUE(`attributes`, '$.eas_access') IS NULL;");
-    $pdo->query("UPDATE `mailbox` SET `attributes` =  JSON_SET(`attributes`, '$.dav_access', \"1\") WHERE JSON_VALUE(`attributes`, '$.dav_access') IS NULL;");
    $pdo->query("UPDATE `mailbox` SET `attributes` =  JSON_SET(`attributes`, '$.mailbox_format', \"maildir:\") WHERE JSON_VALUE(`attributes`, '$.mailbox_format') IS NULL;");
    $pdo->query("UPDATE `mailbox` SET `attributes` =  JSON_SET(`attributes`, '$.quarantine_notification', \"never\") WHERE JSON_VALUE(`attributes`, '$.quarantine_notification') IS NULL;");
    $pdo->query("UPDATE `mailbox` SET `attributes` =  JSON_SET(`attributes`, '$.quarantine_category', \"reject\") WHERE JSON_VALUE(`attributes`, '$.quarantine_category') IS NULL;");
--- a/data/web/inc/prerequisites.inc.php
+++ b/data/web/inc/prerequisites.inc.php
@@ -121,7 +121,7 @@ class mailcowPdo extends OAuth2\Storage\Pdo {
    $this->config['user_table'] = 'mailbox';
  }
  public function checkUserCredentials($username, $password) {
-    if (check_login($username, $password, array("role" => "user", "service" => "NONE")) == 'user') {
+    if (check_login($username, $password) == 'user') {
      return true;
    }
    return false;
--- a/data/web/inc/triggers.admin.inc.php
+++ b/data/web/inc/triggers.admin.inc.php
@@ -44,7 +44,7 @@ if (isset($_GET["cancel_tfa_login"])) {

 if (isset($_POST["login_user"]) && isset($_POST["pass_user"])) {
  $login_user = strtolower(trim($_POST["login_user"]));
-  $as = check_login($login_user, $_POST["pass_user"], array("role" => "admin", "service" => "MAILCOWUI"));
+  $as = check_login($login_user, $_POST["pass_user"], false, array("role" => "admin"));

  if ($as == "admin") {
    session_regenerate_id(true);
--- a/data/web/inc/triggers.domainadmin.inc.php
+++ b/data/web/inc/triggers.domainadmin.inc.php
@@ -55,7 +55,7 @@ if (isset($_GET["cancel_tfa_login"])) {

 if (isset($_POST["login_user"]) && isset($_POST["pass_user"])) {
  $login_user = strtolower(trim($_POST["login_user"]));
-  $as = check_login($login_user, $_POST["pass_user"], array("role" => "domain_admin", "service" => "MAILCOWUI"));
+  $as = check_login($login_user, $_POST["pass_user"], false, array("role" => "domain_admin"));

  if ($as == "domainadmin") {
    session_regenerate_id(true);
--- a/data/web/inc/triggers.user.inc.php
+++ b/data/web/inc/triggers.user.inc.php
@@ -119,7 +119,7 @@ if (isset($_GET["cancel_tfa_login"])) {

 if (isset($_POST["login_user"]) && isset($_POST["pass_user"])) {
  $login_user = strtolower(trim($_POST["login_user"]));
-  $as = check_login($login_user, $_POST["pass_user"], array("role" => "user", "service" => "MAILCOWUI"));
+  $as = check_login($login_user, $_POST["pass_user"], false, array("role" => "user"));

  if ($as == "user") {
    set_user_loggedin_session($login_user);
--- a/data/web/inc/vars.inc.php
+++ b/data/web/inc/vars.inc.php
@@ -215,12 +215,6 @@ $MAILBOX_DEFAULT_ATTRIBUTES['smtp_access'] = true;
 // Mailbox has sieve access by default
 $MAILBOX_DEFAULT_ATTRIBUTES['sieve_access'] = true;

-// Mailbox has ActiveSync/EAS access by default
-$MAILBOX_DEFAULT_ATTRIBUTES['eas_access'] = true;
-
-// Mailbox has CalDAV/CardDAV (DAV) access by default
-$MAILBOX_DEFAULT_ATTRIBUTES['dav_access'] = true;
-
 // Mailbox receives notifications about...
 // "add_header" - mail that was put into the Junk folder
 // "reject" - mail that was rejected
--- a/data/web/js/site/admin.js
+++ b/data/web/js/site/admin.js
@@ -54,16 +54,7 @@ jQuery(function($){
    $.get("/inc/ajax/show_rspamd_global_filters.php");
    $("#confirm_show_rspamd_global_filters").hide();
    $("#rspamd_global_filters").removeClass("d-none");
-    localStorage.setItem('rspamd_global_filters_confirmed', 'true');
  });
-  
-  $(document).ready(function() {
-    if (localStorage.getItem('rspamd_global_filters_confirmed') === 'true') {
-      $("#confirm_show_rspamd_global_filters").hide();
-      $("#rspamd_global_filters").removeClass("d-none");
-    }
-  });
-  
  $("#super_delete").click(function() { return confirm(lang.queue_ays); });

  $(".refresh_table").on('click', function(e) {
--- a/data/web/js/site/mailbox.js
+++ b/data/web/js/site/mailbox.js
@@ -352,12 +352,6 @@ $(document).ready(function() {
    if (template.sieve_access == 1){
      protocol_access.push("sieve");
    }
-    if (template.eas_access == 1){
-      protocol_access.push("eas");
-    }
-    if (template.dav_access == 1){
-      protocol_access.push("dav");
-    }
    $('#protocol_access').selectpicker('val', protocol_access);

    var acl = [];
@@ -939,8 +933,6 @@ jQuery(function($){
            item.imap_access = '<i class="text-' + (item.attributes.imap_access == 1 ? 'success' : 'danger') + ' bi bi-' + (item.attributes.imap_access == 1 ? 'check-lg' : 'x-lg') + '"></i>';
            item.smtp_access = '<i class="text-' + (item.attributes.smtp_access == 1 ? 'success' : 'danger') + ' bi bi-' + (item.attributes.smtp_access == 1 ? 'check-lg' : 'x-lg') + '"></i>';
            item.sieve_access = '<i class="text-' + (item.attributes.sieve_access == 1 ? 'success' : 'danger') + ' bi bi-' + (item.attributes.sieve_access == 1 ? 'check-lg' : 'x-lg') + '"></i>';
-            item.eas_access = '<i class="text-' + (item.attributes.eas_access == 1 ? 'success' : 'danger') + ' bi bi-' + (item.attributes.eas_access == 1 ? 'check-lg' : 'x-lg') + '"></i>';
-            item.dav_access = '<i class="text-' + (item.attributes.dav_access == 1 ? 'success' : 'danger') + ' bi bi-' + (item.attributes.dav_access == 1 ? 'check-lg' : 'x-lg') + '"></i>';
            if (item.attributes.quarantine_notification === 'never') {
              item.quarantine_notification = lang.never;
            } else if (item.attributes.quarantine_notification === 'hourly') {
@@ -1104,18 +1096,6 @@ jQuery(function($){
          defaultContent: '',
          className: 'none'
        },
-        {
-          title: 'EAS',
-          data: 'eas_access',
-          defaultContent: '',
-          className: 'none'
-        },
-        {
-          title: 'DAV',
-          data: 'dav_access',
-          defaultContent: '',
-          className: 'none'
-        },
        {
          title: lang.quarantine_notification,
          data: 'quarantine_notification',
@@ -1229,8 +1209,6 @@ jQuery(function($){
            item.attributes.imap_access = '<i class="text-' + (item.attributes.imap_access == 1 ? 'success' : 'danger') + ' bi bi-' + (item.attributes.imap_access == 1 ? 'check-lg' : 'x-lg') + '"><span class="sorting-value">' + (item.attributes.imap_access == 1 ? '1' : '0') + '</span></i>';
            item.attributes.smtp_access = '<i class="text-' + (item.attributes.smtp_access == 1 ? 'success' : 'danger') + ' bi bi-' + (item.attributes.smtp_access == 1 ? 'check-lg' : 'x-lg') + '"><span class="sorting-value">' + (item.attributes.smtp_access == 1 ? '1' : '0') + '</span></i>';
            item.attributes.sieve_access = '<i class="text-' + (item.attributes.sieve_access == 1 ? 'success' : 'danger') + ' bi bi-' + (item.attributes.sieve_access == 1 ? 'check-lg' : 'x-lg') + '"><span class="sorting-value">' + (item.attributes.sieve_access == 1 ? '1' : '0') + '</span></i>';
-            item.attributes.eas_access = '<i class="text-' + (item.attributes.eas_access == 1 ? 'success' : 'danger') + ' bi bi-' + (item.attributes.eas_access == 1 ? 'check-lg' : 'x-lg') + '"><span class="sorting-value">' + (item.attributes.eas_access == 1 ? '1' : '0') + '</span></i>';
-            item.attributes.dav_access = '<i class="text-' + (item.attributes.dav_access == 1 ? 'success' : 'danger') + ' bi bi-' + (item.attributes.dav_access == 1 ? 'check-lg' : 'x-lg') + '"><span class="sorting-value">' + (item.attributes.dav_access == 1 ? '1' : '0') + '</span></i>';
            item.attributes.sogo_access = '<i class="text-' + (item.attributes.sogo_access == 1 ? 'success' : 'danger') + ' bi bi-' + (item.attributes.sogo_access == 1 ? 'check-lg' : 'x-lg') + '"><span class="sorting-value">' + (item.attributes.sogo_access == 1 ? '1' : '0') + '</span></i>';
            if (item.attributes.quarantine_notification === 'never') {
              item.attributes.quarantine_notification = lang.never;
@@ -1339,16 +1317,6 @@ jQuery(function($){
          data: 'attributes.sieve_access',
          defaultContent: '',
        },
-        {
-          title: 'EAS',
-          data: 'attributes.eas_access',
-          defaultContent: '',
-        },
-        {
-          title: 'DAV',
-          data: 'attributes.dav_access',
-          defaultContent: '',
-        },
        {
          title: 'SOGO',
          data: 'attributes.sogo_access',
--- a/data/web/lang/lang.fr-fr.json
+++ b/data/web/lang/lang.fr-fr.json
@@ -1266,7 +1266,7 @@
        "no_last_login": "Aucune dernière information de connexion à l'interface",
        "no_record": "Pas d'enregistrement",
        "password": "Mot de passe",
-        "password_now": "Mot de passe actuel (confirmer les changements)",
+        "password_now": "Mot de passe courant (confirmer les changements)",
        "password_repeat": "Mot de passe (répéter)",
        "pushover_evaluate_x_prio": "Acheminement du courrier hautement prioritaire [<code>X-Priority: 1</code>]",
        "pushover_info": "Les paramètres de notification push s’appliqueront à tout le courrier propre (non spam) livré à <b>%s</b> y compris les alias (partagés, non partagés, étiquetés).",
--- a/data/web/lang/lang.pl-pl.json
+++ b/data/web/lang/lang.pl-pl.json
@@ -240,7 +240,7 @@
        "generate": "Generuj",
        "guid": "GUID - unikalny identyfikator instancji",
        "guid_and_license": "GUID & licencja",
-        "hash_remove_info": "Usunięcie hasha z limitem współczynnika (jeśli nadal istnieje) spowoduje całkowite zresetowanie jego licznika.<br> Każdy hash jest oznaczony indywidualnym kolorem.",
+        "hash_remove_info": "Usunięcie hasha z limitem współczynnika (jeśli nadal istnieje) spowoduje całkowite zresetowanie jego licznika.<br>\n\n\n\n    Każdy hash jest oznaczony indywidualnym kolorem.",
        "help_text": "Zastąp tekst pomocy poniżej maski logowania (dozwolone HTML)",
        "html": "HTML",
        "iam": "Dostawca tożsamości",
@@ -683,11 +683,7 @@
        "mailbox_rename_agree": "Stworzyłem kopię zapasową.",
        "mailbox_rename_warning": "WAŻNE! Utwórz kopię zapasową przed zmianą nazwy skrzynki pocztowej.",
        "mailbox_rename_alias": "Tworzenie aliasów automatycznie",
-        "mailbox_rename_title": "Nowa nazwa lokalnej skrzynki pocztowej",
-        "mbox_rl_info": "Ten limit szybkości dotyczy nazwy logowania SASL i odpowiada dowolnemu adresowi „from” używanemu przez zalogowanego użytkownika. Limit szybkości dla skrzynki pocztowej nadpisuje limit szybkości dla całej domeny.",
-        "nexthop": "Następny hop",
-        "private_comment": "Prywatny komentarz",
-        "public_comment": "Komentarz publiczny"
+        "mailbox_rename_title": "Nowa nazwa lokalnej skrzynki pocztowej"
    },
    "footer": {
        "cancel": "Anuluj",
@@ -1079,7 +1075,7 @@
        "spamfilter_table_remove": "Usuń",
        "spamfilter_table_rule": "Zasada",
        "spamfilter_wl": "Biała lista",
-        "spamfilter_wl_desc": "Adresy e-mail znajdujące się na liście dozwolonych (allowlist) są zaprogramowane tak, aby <b> nigdy nie </b> były klasyfikowane jako spam. Można używać symboli wieloznacznych (wildcardów).Filtr jest stosowany wyłącznie do bezpośrednich aliasów (aliasów wskazujących na jedną skrzynkę pocztową), z wyłączeniem aliasów typu „catch-all” oraz samej skrzynki pocztowej",
+        "spamfilter_wl_desc": "Adresy e-mail znajdujące się na liście dozwolonych (allowlist) są zaprogramowane tak, aby <b> nigdy nie </b> były klasyfikowane jako spam.\nMożna używać symboli wieloznacznych (wildcardów).\nFiltr jest stosowany wyłącznie do bezpośrednich aliasów (aliasów wskazujących na jedną skrzynkę pocztową), z wyłączeniem aliasów typu „catch-all” oraz samej skrzynki pocztowej",
        "spamfilter_yellow": "Żółty: ta wiadomość może być spamem, zostanie oznaczona jako spam i przeniesiona do folderu spam",
        "sync_jobs": "Zadania synchronizacji",
        "tag_handling": "Ustaw obsługę znaczników pocztowych",
--- a/data/web/lang/lang.pt-pt.json
+++ b/data/web/lang/lang.pt-pt.json
@@ -340,8 +340,7 @@
        "tls_policy": "Política de TLS",
        "quarantine_attachments": "Anexos de quarentena",
        "filters": "Filtros",
-        "smtp_ip_access": "Mudar anfitriões permitidos para SMTP",
-        "app_passwds": "Gerenciar senhas de aplicativos"
+        "smtp_ip_access": "Mudar anfitriões permitidos para SMTP"
    },
    "warning": {
        "no_active_admin": "Não é possível desactivar o último administrador activo"
--- a/data/web/mta-sts.php
+++ b/data/web/mta-sts.php
@@ -7,30 +7,7 @@ if (!isset($_SERVER['HTTP_HOST']) || strpos($_SERVER['HTTP_HOST'], 'mta-sts.') !
 }

 $host = preg_replace('/:[0-9]+$/', '', $_SERVER['HTTP_HOST']);
-$domain = idn_to_ascii(strtolower(str_replace('mta-sts.', '', $host)), 0, INTL_IDNA_VARIANT_UTS46);
-
-// Validate domain or return 404 on error
-if ($domain === false || empty($domain)) {
-  http_response_code(404);
-  exit;
-}
-
-// Check if domain is an alias domain and resolve to target domain
-try {
-  $stmt = $pdo->prepare("SELECT `target_domain` FROM `alias_domain` WHERE `alias_domain` = :domain");
-  $stmt->execute(array(':domain' => $domain));
-  $alias_row = $stmt->fetch(PDO::FETCH_ASSOC);
-  
-  if ($alias_row !== false && !empty($alias_row['target_domain'])) {
-    // This is an alias domain, use the target domain for MTA-STS lookup
-    $domain = $alias_row['target_domain'];
-  }
-} catch (PDOException $e) {
-  // On database error, return 404
-  http_response_code(404);
-  exit;
-}
-
+$domain = str_replace('mta-sts.', '', $host);
 $mta_sts = mailbox('get', 'mta_sts', $domain);

 if (count($mta_sts) == 0 ||
--- a/data/web/sogo-auth.php
+++ b/data/web/sogo-auth.php
@@ -12,21 +12,18 @@ $session_var_pass = 'sogo-sso-pass';
 if (isset($_SERVER['PHP_AUTH_USER'])) {
  // load prerequisites only when required
  require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
-
  $username = $_SERVER['PHP_AUTH_USER'];
  $password = $_SERVER['PHP_AUTH_PW'];
-
-  // Determine service type for protocol access check
-  $service = 'NONE';
+  $is_eas = false;
+  $is_dav = false;
  $original_uri = isset($_SERVER['HTTP_X_ORIGINAL_URI']) ? $_SERVER['HTTP_X_ORIGINAL_URI'] : '';
  if (preg_match('/^(\/SOGo|)\/dav.*/', $original_uri) === 1) {
-    $service = 'DAV';
+    $is_dav = true;
  }
  elseif (preg_match('/^(\/SOGo|)\/Microsoft-Server-ActiveSync.*/', $original_uri) === 1) {
-    $service = 'EAS';
+    $is_eas = true;
  }
-
-  $login_check = check_login($username, $password, array('service' => $service));
+  $login_check = check_login($username, $password, array('dav' => $is_dav, 'eas' => $is_eas));
  if ($login_check === 'user') {
    header("X-User: $username");
    header("X-Auth: Basic ".base64_encode("$username:$password"));
@@ -60,6 +57,7 @@ elseif (isset($_GET['login'])) {
          $_SESSION['mailcow_cc_role']        = "user";
        }
        // update sasl logs
+        $service = ($app_passwd_data['eas'] === true) ? 'EAS' : 'DAV';
        $stmt = $pdo->prepare("REPLACE INTO sasl_log (`service`, `app_password`, `username`, `real_rip`) VALUES ('SSO', 0, :username, :remote_addr)");
        $stmt->execute(array(
          ':username' => $login,
--- a/data/web/templates/base.twig
+++ b/data/web/templates/base.twig
@@ -144,7 +144,7 @@

 <form action="/" method="post" id="logout"><input type="hidden" name="logout"></form>

-{% if ui_texts.ui_announcement_text and ui_texts.ui_announcement_active and not is_root_uri and mailcow_cc_username %}
+{% if ui_texts.ui_announcement_text and ui_texts.ui_announcement_active and not is_root_uri %}
 <div class="container mt-4">
  <div class="alert alert-{{ ui_texts.ui_announcement_type }}">{{ ui_texts.ui_announcement_text }}</div>
 </div>
--- a/data/web/templates/edit/mailbox-templates.twig
+++ b/data/web/templates/edit/mailbox-templates.twig
@@ -108,8 +108,6 @@
          <option value="pop3"{% if template.attributes.pop3_access == '1' %} selected{% endif %}>POP3</option>
          <option value="smtp"{% if template.attributes.smtp_access == '1' %} selected{% endif %}>SMTP</option>
          <option value="sieve"{% if template.attributes.sieve_access == '1' %} selected{% endif %}>Sieve</option>
-          <option value="eas"{% if template.attributes.eas_access == '1' %} selected{% endif %}>ActiveSync</option>
-          <option value="dav"{% if template.attributes.dav_access == '1' %} selected{% endif %}>CalDAV/CardDAV</option>
        </select>
      </div>
    </div>
--- a/data/web/templates/edit/mailbox.twig
+++ b/data/web/templates/edit/mailbox.twig
@@ -281,8 +281,6 @@
                        <option value="pop3"{% if result.attributes.pop3_access == '1' %} selected{% endif %}>POP3</option>
                        <option value="smtp"{% if result.attributes.smtp_access == '1' %} selected{% endif %}>SMTP</option>
                        <option value="sieve"{% if result.attributes.sieve_access == '1' %} selected{% endif %}>Sieve</option>
-                        <option value="eas"{% if result.attributes.eas_access == '1' %} selected{% endif %}>ActiveSync</option>
-                        <option value="dav"{% if result.attributes.dav_access == '1' %} selected{% endif %}>CalDAV/CardDAV</option>
                      </select>
                    </div>
                  </div>
--- a/data/web/templates/modals/mailbox.twig
+++ b/data/web/templates/modals/mailbox.twig
@@ -148,8 +148,6 @@
                <option value="pop3">POP3</option>
                <option value="smtp">SMTP</option>
                <option value="sieve">Sieve</option>
-                <option value="eas">ActiveSync</option>
-                <option value="dav">CalDAV/CardDAV</option>
              </select>
            </div>
          </div>
@@ -337,8 +335,6 @@
                <option value="pop3" selected>POP3</option>
                <option value="smtp" selected>SMTP</option>
                <option value="sieve" selected>Sieve</option>
-                <option value="activesync" selected>ActiveSync</option>
-                <option value="dav" selected>CalDAV/CardDAV</option>
              </select>
            </div>
          </div>
--- a/data/web/templates/user/tab-user-auth.twig
+++ b/data/web/templates/user/tab-user-auth.twig
@@ -55,8 +55,6 @@
              {% if mailboxdata.attributes.smtp_access == 1 %}<div class="badge fs-6 bg-success m-2">SMTP <i class="bi bi-check-lg"></i></div>{% else %}<div class="badge fs-6 bg-danger m-2">SMTP <i class="bi bi-x-lg"></i></div>{% endif %}
              {% if mailboxdata.attributes.sieve_access == 1 %}<div class="badge fs-6 bg-success m-2">Sieve <i class="bi bi-check-lg"></i></div>{% else %}<div class="badge fs-6 bg-danger m-2">Sieve <i class="bi bi-x-lg"></i></div>{% endif %}
              {% if mailboxdata.attributes.pop3_access == 1 %}<div class="badge fs-6 bg-success m-2">POP3 <i class="bi bi-check-lg"></i></div>{% else %}<div class="badge fs-6 bg-danger m-2">POP3 <i class="bi bi-x-lg"></i></div>{% endif %}
-              {% if mailboxdata.attributes.eas_access == 1 %}<div class="badge fs-6 bg-success m-2">ActiveSync <i class="bi bi-check-lg"></i></div>{% else %}<div class="badge fs-6 bg-danger m-2">ActiveSync <i class="bi bi-x-lg"></i></div>{% endif %}
-              {% if mailboxdata.attributes.dav_access == 1 %}<div class="badge fs-6 bg-success m-2">CalDAV/CardDAV <i class="bi bi-check-lg"></i></div>{% else %}<div class="badge fs-6 bg-danger m-2">CalDAV/CardDAV <i class="bi bi-x-lg"></i></div>{% endif %}
              </div>
            </div>
          </div>
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -84,7 +84,7 @@ services:
            - clamd

    rspamd-mailcow:
-      image: ghcr.io/mailcow/rspamd:3.14.2
+      image: ghcr.io/mailcow/rspamd:2.4
      stop_grace_period: 30s
      depends_on:
        - dovecot-mailcow
@@ -321,7 +321,7 @@ services:
        ofelia.job-exec.dovecot_clean_q_aged.command: "/bin/bash -c \"[[ $${MASTER} == y ]] && /usr/local/bin/gosu vmail /usr/local/bin/clean_q_aged.sh || exit 0\""
        ofelia.job-exec.dovecot_maildir_gc.schedule: "0 */30 * * * *"
        ofelia.job-exec.dovecot_maildir_gc.command: "/bin/bash -c \"source /source_env.sh ; /usr/local/bin/gosu vmail /usr/local/bin/maildir_gc.sh\""
-        ofelia.job-exec.dovecot_sarules.schedule: "@every 24h"
+        ofelia.job-exec.dovecot_sarules.schedule: "0 0 0 * * *"
        ofelia.job-exec.dovecot_sarules.command: "/bin/bash -c \"/usr/local/bin/sa-rules.sh\""
        ofelia.job-exec.dovecot_fts.schedule: "0 0 0 * * *"
        ofelia.job-exec.dovecot_fts.command: "/bin/bash -c \"/usr/local/bin/gosu vmail /usr/local/bin/optimize-fts.sh\""
@@ -465,7 +465,7 @@ services:
          condition: service_started
        unbound-mailcow:
          condition: service_healthy
-      image: ghcr.io/mailcow/acme:1.95
+      image: ghcr.io/mailcow/acme:1.94
      dns:
        - ${IPV4_NETWORK:-172.22.1}.254
      environment:
--- a/helper-scripts/backup_and_restore.sh
+++ b/helper-scripts/backup_and_restore.sh
@@ -91,44 +91,6 @@ if grep --help 2>&1 | head -n 1 | grep -q -i "busybox"; then
  exit 1
 fi

-# Add image prefetch function
-function prefetch_image() {
-  echo "Checking Docker image: ${DEBIAN_DOCKER_IMAGE}"
-  
-  # Get local image digest if it exists
-  local local_digest=$(docker image inspect ${DEBIAN_DOCKER_IMAGE} --format='{{index .RepoDigests 0}}' 2>/dev/null | cut -d'@' -f2)
-  
-  # Get remote image digest without pulling
-  local remote_digest=$(docker manifest inspect ${DEBIAN_DOCKER_IMAGE} 2>/dev/null | grep -oP '"digest":\s*"\K[^"]+' | head -1)
-  
-  if [[ -z "${remote_digest}" ]]; then
-    echo "Warning: Unable to check remote image"
-    if [[ -n "${local_digest}" ]]; then
-      echo "Using cached version"
-      echo
-      return 0
-    else
-      echo "Error: Image ${DEBIAN_DOCKER_IMAGE} not found locally or remotely"
-      exit 1
-    fi
-  fi
-  
-  if [[ "${local_digest}" != "${remote_digest}" ]]; then
-    echo "Image update available, pulling ${DEBIAN_DOCKER_IMAGE}"
-    if docker pull ${DEBIAN_DOCKER_IMAGE} 2>/dev/null; then
-      echo "Successfully pulled ${DEBIAN_DOCKER_IMAGE}"
-    else
-      echo "Error: Failed to pull ${DEBIAN_DOCKER_IMAGE}"
-      exit 1
-    fi
-  else
-    echo "Image is up to date (${remote_digest:0:12}...)"
-  fi
-  echo
-}
-
-# Prefetch the image early in the script
-prefetch_image

 function backup() {
  DATE=$(date +"%Y-%m-%d-%H-%M-%S")
Author	SHA1	Message	Date
copilot-swe-agent[bot]	5d371293e0	Restore informative messages about manual Docker daemon configuration Co-authored-by: DerLinkman <62480600+DerLinkman@users.noreply.github.com>	2025-12-10 08:32:50 +00:00
copilot-swe-agent[bot]	215a8addff	Add clarifying comment about MAILCOW_CONF usage in configure_ipv6 Co-authored-by: DerLinkman <62480600+DerLinkman@users.noreply.github.com>	2025-12-10 08:24:45 +00:00
copilot-swe-agent[bot]	8f58ba8bc8	Fix generate_config.sh termination when user declines IPv6 Docker configuration Co-authored-by: DerLinkman <62480600+DerLinkman@users.noreply.github.com>	2025-12-10 08:22:23 +00:00
copilot-swe-agent[bot]	70affa0f69	Initial plan	2025-12-10 08:18:16 +00:00
DerLinkman	4ef65fc382	Merge pull request #6948 from mailcow/staging 2025-12	2025-12-09 13:29:15 +01:00