[Web][Dovecot] Add global bandwidth limit for syncjobs

.github/workflows/close_old_issues_and_prs.yml

@@ -14,7 +14,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Mark/Close Stale Issues and Pull Requests 🗑️
-        uses: actions/stale@v11.0.0
+        uses: actions/stale@v10.2.0
         with:
           repo-token: ${{ secrets.STALE_ACTION_PAT }}
           days-before-stale: 60

.github/workflows/image_builds.yml

@@ -27,7 +27,7 @@ jobs:
           - "watchdog-mailcow"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v6
       - name: Setup Docker
         run: |
           curl -sSL https://get.docker.com/ | CHANNEL=stable sudo sh

.github/workflows/pr_to_nightly.yml

@@ -8,11 +8,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
       - name: Run the Action
-        uses: devops-infra/action-pull-request@v1.4.0
+        uses: devops-infra/action-pull-request@v1.0.2
         with:
           github_token: ${{ secrets.PRTONIGHTLY_ACTION_PAT }}
           title: Automatic PR to nightly from ${{ github.event.repository.updated_at}}

.github/workflows/rebuild_backup_image.yml

@@ -13,7 +13,7 @@ jobs:
       packages: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v4

.github/workflows/update_postscreen_access_list.yml

@@ -15,7 +15,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
     - name: Checkout
-      uses: actions/checkout@v7
+      uses: actions/checkout@v6
 
     - name: Generate postscreen_access.cidr
       run: |

README.md

@@ -23,15 +23,10 @@ A big thank you to everyone supporting us on GitHub Sponsors—your contribution
   <a href="https://www.maehdros.com/" target=_blank><img
     src="https://avatars.githubusercontent.com/u/173894712" height="58"
   /></a>
-  <a href="https://garske-systems.de/" target=_blank><img
-    src="https://garske-systems.de/img/logo_min.png" height="58"
-  /></a>
 
 ### 50$/Month Sponsors
   <a href="https://github.com/vnukhr" target=_blank><img
     src="https://avatars.githubusercontent.com/u/7805987?s=52&v=4" height="58"
-  /></a><a href="https://github.com/humiico" target=_blank><img
-    src="https://avatars.githubusercontent.com/u/110134705?s=52&v=4" height="58"
   /></a>
 
 ## Info, documentation and support

data/Dockerfiles/acme/acme.sh

@@ -249,33 +249,12 @@ while true; do
   done <<< "${SQL_DOMAINS}"
 
   if [[ ${ONLY_MAILCOW_HOSTNAME} != "y" ]]; then
-  # Fetch all domains with an active MTA-STS policy once.
-  unset MTA_STS_ACTIVE_DOMAINS
-  declare -A MTA_STS_ACTIVE_DOMAINS
-  if [[ ${AUTODISCOVER_SAN} == "y" ]]; then
-    SQL_MTA_STS_DOMAINS=$(mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT domain FROM mta_sts WHERE active = 1" -Bs)
-    if [[ $? -eq 0 ]]; then
-      while read mta_sts_domain; do
-        if [[ -z "${mta_sts_domain}" ]]; then
-          # ignore empty lines
-          continue
-        fi
-        MTA_STS_ACTIVE_DOMAINS["${mta_sts_domain}"]=1
-      done <<< "${SQL_MTA_STS_DOMAINS}"
-    fi
-  fi
   for SQL_DOMAIN in "${SQL_DOMAIN_ARR[@]}"; do
     unset VALIDATED_CONFIG_DOMAINS_SUBDOMAINS
     declare -a VALIDATED_CONFIG_DOMAINS_SUBDOMAINS
     for SUBDOMAIN in "${ADDITIONAL_WC_ARR[@]}"; do
       FULL_SUBDOMAIN="${SUBDOMAIN}.${SQL_DOMAIN}"
 
-      # Skip mta-sts subdomain unless MTA-STS is enabled (active) for this domain
-      if [[ "${SUBDOMAIN}" == "mta-sts" && -z "${MTA_STS_ACTIVE_DOMAINS[${SQL_DOMAIN}]}" ]]; then
-        log_f "MTA-STS is not enabled for ${SQL_DOMAIN} - skipping mta-sts subdomain certificate"
-        continue
-      fi
-
       # Skip if subdomain matches MAILCOW_HOSTNAME
       if [[ "${FULL_SUBDOMAIN}" == "${MAILCOW_HOSTNAME}" ]]; then
         continue

data/Dockerfiles/clamd/Dockerfile

@@ -1,7 +1,7 @@
-FROM alpine:3.24 AS builder
+FROM alpine:3.21 AS builder
 
 WORKDIR /src
-ENV CLAMD_VERSION=1.4.6
+ENV CLAMD_VERSION=1.4.2
 
 RUN apk upgrade --no-cache \
   && apk add --update --no-cache \
@@ -68,7 +68,7 @@ RUN wget -P /src https://www.clamav.net/downloads/production/clamav-${CLAMD_VERS
   "/clamav/etc/clamav/clamav-milter.conf.sample" > "/clamav/etc/clamav/clamav-milter.conf" || exit 1
 
 
-FROM alpine:3.24
+FROM alpine:3.21
 
 LABEL maintainer = "The Infrastructure Company GmbH <info@servercow.de>"
 

data/Dockerfiles/dovecot/Dockerfile

@@ -69,6 +69,8 @@ RUN addgroup -g 5000 vmail \
   perl-par-packer \
   perl-parse-recdescent \
   perl-lockfile-simple \
+  perl-parallel-forkmanager \
+  perl-redis \
   libproc2 \
   perl-readonly \
   perl-regexp-common \

data/Dockerfiles/dovecot/imapsync_runner.pl

@@ -2,202 +2,88 @@
 
 use DBI;
 use LockFile::Simple qw(lock trylock unlock);
-use Proc::ProcessTable;
 use Data::Dumper qw(Dumper);
 use IPC::Run 'run';
-use JSON::PP;
 use File::Temp;
 use Try::Tiny;
-use POSIX ();
+use Parallel::ForkManager;
+use Redis;
 use sigtrap 'handler' => \&sig_handler, qw(INT TERM KILL QUIT);
 
 sub trim { my $s = shift; $s =~ s/^\s+|\s+$//g; return $s };
 
-$run_dir="/tmp";
-$dsn = 'DBI:mysql:database=' . $ENV{'DBNAME'} . ';mysql_socket=/var/run/mysqld/mysqld.sock';
-$lock_file = $run_dir . "/imapsync_busy";
-$lockmgr = LockFile::Simple->make(-autoclean => 1, -max => 1);
-$lockmgr->lock($lock_file) || die "can't lock ${lock_file}";
-$dbh = DBI->connect($dsn, $ENV{'DBUSER'}, $ENV{'DBPASS'}, {
-  mysql_auto_reconnect => 1,
-  mysql_enable_utf8mb4 => 1
-});
-$dbh->do("UPDATE imapsync SET is_running = 0");
+sub qqw($) {
+  my @params = ();
+  my @values = split(/(?=--)/, $_[0]);
+  foreach my $val (@values) {
+    my @tmpparam = split(/ /, $val, 2);
+    foreach my $tmpval (@tmpparam) {
+        if ($tmpval ne '') {
+          push @params, $tmpval;
+        }
+    }
+  }
+  foreach my $val (@params) {
+    $val=trim($val);
+  }
+  return @params;
+}
 
-# Max concurrent imapsync processes (admin-configurable, stored in MySQL). Fallback 1.
-my $max_parallel = 1;
-my ($mp) = $dbh->selectrow_array("SELECT value FROM imapsync_settings WHERE name = 'max_parallel'");
-$max_parallel = int($mp) if defined($mp) && int($mp) >= 1;
-
-# Global per-process bandwidth cap in bytes/s (0 = off). Applied to every imapsync run below.
-my $global_bw = 0;
-my ($gbw) = $dbh->selectrow_array("SELECT value FROM imapsync_settings WHERE name = 'max_bytes_per_second'");
-$global_bw = int($gbw) if defined($gbw) && int($gbw) > 0;
+our $pm;
 
 sub sig_handler {
-  # Send die to force exception in "run"
+  if (defined $pm) {
+    foreach my $child_pid (keys %{ $pm->{processes} }) {
+      kill 'TERM', $child_pid;
+    }
+  }
   die "sig_handler received signal, preparing to exit...\n";
 };
 
-open my $file, '<', "/etc/sogo/sieve.creds";
-my $creds = <$file>;
-close $file;
-my ($master_user, $master_pass) = split /:/, $creds;
-# Source-based schema: join imapsync_source to read host/port/encryption/auth-type
-my $sth = $dbh->prepare("SELECT
-  i.id,
-  i.user1,
-  i.user2,
-  s.host1,
-  s.auth_type,
-  i.password1,
-  i.exclude,
-  s.port1,
-  s.enc1,
-  i.delete2duplicates,
-  i.maxage,
-  i.subfolder2,
-  i.delete1,
-  i.delete2,
-  i.automap,
-  i.skipcrossduplicates,
-  i.maxbytespersecond,
-  i.custom_params,
-  i.subscribeall,
-  i.timeout1,
-  i.timeout2,
-  i.dry,
-  s.oauth_access_token,
-  s.oauth_token_expires,
-  s.oauth_flow,
-  i.source_id
-    FROM imapsync i JOIN imapsync_source s ON i.source_id = s.id
-      WHERE i.active = 1
-        AND s.active = 1
-        AND i.is_running = 0
-        AND (
-          UNIX_TIMESTAMP(NOW()) - UNIX_TIMESTAMP(i.last_run) > i.mins_interval * 60
-          OR
-          i.last_run IS NULL)
-  ORDER BY i.last_run ASC, i.prio DESC, i.id ASC
-  LIMIT $max_parallel");
+sub run_one_job {
+  my ($dbh, $row_ref, $master_user, $master_pass) = @_;
 
-$sth->execute();
-my @rows = @{$sth->fetchall_arrayref()};
-$sth->finish();
-
-# Only up to $max_parallel due jobs are pulled per run (LIMIT above)
-my $active = 0;
-foreach my $row (@rows) {
-  # Throttle: once max children are running, reap one before starting the next
-  if ($active >= $max_parallel) {
-    wait();
-    $active-- if $active > 0;
-  }
-  my $pid = fork();
-  next if (!defined $pid);
-  if ($pid != 0) { $active++; next; }   # parent: one more child running, continue
-
-  # ---- CHILD ---- own DB connection so the parent's handle stays intact across forks
-  $dbh->{InactiveDestroy} = 1;
-  $dbh = DBI->connect($dsn, $ENV{'DBUSER'}, $ENV{'DBPASS'}, {
-    mysql_auto_reconnect => 1,
-    mysql_enable_utf8mb4 => 1
-  });
-
-  $id                  = @$row[0];
-  $user1               = @$row[1];
-  $user2               = @$row[2];
-  $host1               = @$row[3];
-  $auth_type           = @$row[4];
-  $password1           = @$row[5];
-  $exclude             = @$row[6];
-  $port1               = @$row[7];
-  $enc1                = @$row[8];
-  $delete2duplicates   = @$row[9];
-  $maxage              = @$row[10];
-  $subfolder2          = @$row[11];
-  $delete1             = @$row[12];
-  $delete2             = @$row[13];
-  $automap             = @$row[14];
-  $skipcrossduplicates = @$row[15];
-  $maxbytespersecond   = @$row[16];
-  $custom_params       = @$row[17];
-  $subscribeall        = @$row[18];
-  $timeout1            = @$row[19];
-  $timeout2            = @$row[20];
-  $dry                 = @$row[21];
-  $oauth_access_token  = @$row[22];
-  $oauth_token_expires = @$row[23];
-  $oauth_flow          = @$row[24];
-  $source_id           = @$row[25];
+  my $id                  = $row_ref->[0];
+  my $user1               = $row_ref->[1];
+  my $user2               = $row_ref->[2];
+  my $host1               = $row_ref->[3];
+  my $authmech1           = $row_ref->[4];
+  my $password1           = $row_ref->[5];
+  my $exclude             = $row_ref->[6];
+  my $port1               = $row_ref->[7];
+  my $enc1                = $row_ref->[8];
+  my $delete2duplicates   = $row_ref->[9];
+  my $maxage              = $row_ref->[10];
+  my $subfolder2          = $row_ref->[11];
+  my $delete1             = $row_ref->[12];
+  my $delete2             = $row_ref->[13];
+  my $automap             = $row_ref->[14];
+  my $skipcrossduplicates = $row_ref->[15];
+  my $maxbytespersecond   = $row_ref->[16];
+  my $custom_params       = $row_ref->[17];
+  my $subscribeall        = $row_ref->[18];
+  my $timeout1            = $row_ref->[19];
+  my $timeout2            = $row_ref->[20];
+  my $dry                 = $row_ref->[21];
 
   if ($enc1 eq "TLS") { $enc1 = "--tls1"; } elsif ($enc1 eq "SSL") { $enc1 = "--ssl1"; } else { undef $enc1; }
 
-  my $template = $run_dir . '/imapsync.XXXXXXX';
+  my $template = "/tmp/imapsync.XXXXXXX";
   my $passfile1 = File::Temp->new(TEMPLATE => $template);
   my $passfile2 = File::Temp->new(TEMPLATE => $template);
-  my $tokenfile1;
 
   binmode( $passfile1, ":utf8" );
 
-  # Auth-mode-specific argument set
-  my @auth_args;
-  if (defined($auth_type) && $auth_type eq 'XOAUTH2') {
-    # authorization_code sources use a per-user token (keyed by source + user1),
-    # not the shared source-level token used by client_credentials.
-    if (defined($oauth_flow) && $oauth_flow eq 'authorization_code') {
-      my $tsth = $dbh->prepare("SELECT access_token, token_expires FROM imapsync_source_oauth_token WHERE source_id=? AND username=?");
-      $tsth->execute($source_id, $user1);
-      my $trow = $tsth->fetchrow_arrayref();
-      $oauth_access_token  = $trow ? @$trow[0] : undef;
-      $oauth_token_expires = $trow ? @$trow[1] : undef;
-    }
-    # Skip sync if cached token is missing or about to expire (<2 min)
-    if (!defined($oauth_access_token) || $oauth_access_token eq ''
-        || !defined($oauth_token_expires) || $oauth_token_expires - time() < 120) {
-      my $upd = $dbh->prepare("UPDATE imapsync SET returned_text=?, success=0, exit_status='OAUTH_TOKEN_NOT_READY', last_run=NOW(), is_running=0 WHERE id=?");
-      $upd->execute("OAuth access token for the configured source is missing or expires too soon; refresh cron will retry.", $id);
-      $dbh->disconnect();
-      unlink $passfile1->filename if defined $passfile1;
-      unlink $passfile2->filename if defined $passfile2;
-      POSIX::_exit(75);   # EX_TEMPFAIL: did not actually sync (token not ready)
-    }
-    $tokenfile1 = File::Temp->new(TEMPLATE => $template);
-    binmode($tokenfile1, ":utf8");
-    print $tokenfile1 "$oauth_access_token\n";
-    @auth_args = ("--authmech1", "XOAUTH2",
-                  "--oauthaccesstoken1", $tokenfile1->filename);
-  } else {
-    print $passfile1 "$password1\n";
-    @auth_args = ("--passfile1", $passfile1->filename);
-    # imapsync auto-picks PLAIN; only emit --authmech1 for LOGIN/CRAM-MD5
-    if (defined($auth_type) && $auth_type ne 'PLAIN') {
-      push @auth_args, "--authmech1", $auth_type;
-    }
-  }
-
+  print $passfile1 "$password1\n";
   print $passfile2 trim($master_pass) . "\n";
 
-  # Structured custom params: JSON array of {o,v}. Build one argv token per pair as "--opt=value"
-  # (value glued to its option) so a value can never become a separate option; passed via
-  # IPC::Run list form (execvp, no shell). Only allowlisted option names are stored (validated on write).
-  my @custom_params_a;
-  my $cp_pairs = eval { decode_json(defined($custom_params) && $custom_params ne '' ? $custom_params : '[]') };
-  if (ref($cp_pairs) eq 'ARRAY') {
-    for my $p (@$cp_pairs) {
-      next unless ref($p) eq 'HASH' && defined $p->{o} && $p->{o} ne '';
-      (my $ov = defined($p->{v}) ? $p->{v} : '') =~ s/\x00//g;
-      push @custom_params_a, ($ov eq '' ? "--$p->{o}" : "--$p->{o}=$ov");
-    }
+  my $effective_bps = $maxbytespersecond;
+  if ($effective_bps eq "0" && $global_max_bps > 0) {
+    $effective_bps = $global_max_bps;
   }
-  my $custom_params_ref = \@custom_params_a;
 
-  # Effective per-process bandwidth cap (bytes/s): per-job value, capped by the global limit.
-  my $eff_bw = int($maxbytespersecond);
-  if ($global_bw > 0) {
-    $eff_bw = ($eff_bw > 0 && $eff_bw < $global_bw) ? $eff_bw : $global_bw;
-  }
+  my @custom_params_a = qqw($custom_params);
+  my $custom_params_ref = \@custom_params_a;
 
   my $generated_cmds = [ "/usr/local/bin/imapsync",
   "--tmpdir", "/tmp",
@@ -208,7 +94,7 @@ foreach my $row (@rows) {
   ($exclude eq "" ? () : ("--exclude", $exclude)),
   ($subfolder2 eq "" ? () : ('--subfolder2', $subfolder2)),
   ($maxage eq "0" ? () : ('--maxage', $maxage)),
-  ($eff_bw <= 0 ? () : ('--maxbytespersecond', $eff_bw)),
+  ($effective_bps eq "0" ? () : ('--maxbytespersecond', $effective_bps)),
   ($delete2duplicates ne "1" ? () : ('--delete2duplicates')),
   ($subscribeall  ne "1" ? () : ('--subscribeall')),
   ($delete1 ne "1" ? () : ('--delete')),
@@ -218,7 +104,7 @@ foreach my $row (@rows) {
   (!defined($enc1) ? () : ($enc1)),
   "--host1", $host1,
   "--user1", $user1,
-  @auth_args,
+  "--passfile1", $passfile1->filename,
   "--port1", $port1,
   "--host2", "localhost",
   "--user2", $user2 . '*' . trim($master_user),
@@ -228,49 +114,146 @@ foreach my $row (@rows) {
   '--noreleasecheck'];
 
   try {
-    $is_running = $dbh->prepare("UPDATE imapsync SET is_running = 1, success = NULL, exit_status = NULL WHERE id = ?");
-    $is_running->bind_param( 1, ${id} );
+    my $is_running = $dbh->prepare("UPDATE imapsync SET is_running = 1, success = NULL, exit_status = NULL WHERE id = ?");
+    $is_running->bind_param( 1, $id );
     $is_running->execute();
 
     run [@$generated_cmds, @$custom_params_ref], '&>', \my $stdout;
 
-    # check exit code and status
-    ($exit_code, $exit_status) = ($stdout =~ m/Exiting\swith\sreturn\svalue\s(\d+)\s\(([^:)]+)/);
+    my ($exit_code, $exit_status) = ($stdout =~ m/Exiting\swith\sreturn\svalue\s(\d+)\s\(([^:)]+)/);
 
-    $success = 0;
+    my $success = 0;
     if (defined $exit_code && $exit_code == 0) {
       $success = 1;
     }
 
-    $update = $dbh->prepare("UPDATE imapsync SET returned_text = ?, success = ?, exit_status = ? WHERE id = ?");
-    $update->bind_param( 1, ${stdout} );
-    $update->bind_param( 2, ${success} );
-    $update->bind_param( 3, ${exit_status} );
-    $update->bind_param( 4, ${id} );
+    my $update = $dbh->prepare("UPDATE imapsync SET returned_text = ?, success = ?, exit_status = ? WHERE id = ?");
+    $update->bind_param( 1, $stdout );
+    $update->bind_param( 2, $success );
+    $update->bind_param( 3, $exit_status );
+    $update->bind_param( 4, $id );
     $update->execute();
   } catch {
-    $update = $dbh->prepare("UPDATE imapsync SET returned_text = 'Could not start or finish imapsync', success = 0 WHERE id = ?");
-    $update->bind_param( 1, ${id} );
+    my $update = $dbh->prepare("UPDATE imapsync SET returned_text = 'Could not start or finish imapsync', success = 0 WHERE id = ?");
+    $update->bind_param( 1, $id );
     $update->execute();
   } finally {
-    $update = $dbh->prepare("UPDATE imapsync SET last_run = NOW(), is_running = 0 WHERE id = ?");
-    $update->bind_param( 1, ${id} );
+    my $update = $dbh->prepare("UPDATE imapsync SET last_run = NOW(), is_running = 0 WHERE id = ?");
+    $update->bind_param( 1, $id );
     $update->execute();
   };
-
-  $dbh->disconnect();
-  # Remove this child's own temp files, then _exit so END/DESTROY are skipped — this keeps
-  # the parent's LockFile lock and DB handle intact (a plain exit() would run autoclean and
-  # release the shared lock while the parent + siblings are still working).
-  unlink $passfile1->filename if defined $passfile1;
-  unlink $passfile2->filename if defined $passfile2;
-  unlink $tokenfile1->filename if defined $tokenfile1;
-  POSIX::_exit(0);   # ---- end CHILD ----
 }
 
-# Parent: wait for all remaining children to finish
-while (wait() != -1) { }
+my $run_dir = "/tmp";
+my $dsn = 'DBI:mysql:database=' . $ENV{'DBNAME'} . ';mysql_socket=/var/run/mysqld/mysqld.sock';
+my $lock_file = $run_dir . "/imapsync_busy";
+my $lockmgr = LockFile::Simple->make(-autoclean => 1, -max => 1);
+$lockmgr->lock($lock_file) || die "can't lock ${lock_file}";
 
+my $max_parallel = 1;
+our $global_max_bps = 0;
+try {
+  my $redis = Redis->new(
+    server    => 'redis-mailcow:6379',
+    password  => $ENV{'REDISPASS'},
+    reconnect => 10,
+    every     => 1_000_000,
+  );
+  my $val = $redis->get('SYNCJOBS_MAX_PARALLEL');
+  if (defined $val && $val =~ /^\d+$/) {
+    $max_parallel = int($val);
+  }
+  my $bps = $redis->get('SYNCJOBS_MAX_BPS');
+  if (defined $bps && $bps =~ /^\d+$/) {
+    $global_max_bps = int($bps);
+  }
+  $redis->quit();
+} catch {
+  warn "Could not read settings from Redis, using defaults: $_";
+};
+$max_parallel = 1  if $max_parallel < 1;
+$max_parallel = 50 if $max_parallel > 50;
+
+my $dbh = DBI->connect($dsn, $ENV{'DBUSER'}, $ENV{'DBPASS'}, {
+  mysql_auto_reconnect => 1,
+  mysql_enable_utf8mb4 => 1
+});
+$dbh->do("UPDATE imapsync SET is_running = 0");
+
+open my $file, '<', "/etc/sogo/sieve.creds";
+my $creds = <$file>;
+close $file;
+my ($master_user, $master_pass) = split /:/, $creds;
+
+my $sth = $dbh->prepare("SELECT id,
+  user1,
+  user2,
+  host1,
+  authmech1,
+  password1,
+  exclude,
+  port1,
+  enc1,
+  delete2duplicates,
+  maxage,
+  subfolder2,
+  delete1,
+  delete2,
+  automap,
+  skipcrossduplicates,
+  maxbytespersecond,
+  custom_params,
+  subscribeall,
+  timeout1,
+  timeout2,
+  dry
+    FROM imapsync
+      WHERE active = 1
+        AND is_running = 0
+        AND (
+          UNIX_TIMESTAMP(NOW()) - UNIX_TIMESTAMP(last_run) > mins_interval * 60
+          OR
+          last_run IS NULL)
+  ORDER BY last_run");
+
+$sth->execute();
+my @jobs;
+while (my $row = $sth->fetchrow_arrayref()) {
+  push @jobs, [ @$row ];
+}
+$sth->finish();
 $dbh->disconnect();
 
+$pm = Parallel::ForkManager->new($max_parallel);
+
+JOB:
+foreach my $job (@jobs) {
+  my $pid = $pm->start;
+  if ($pid) {
+    next JOB;
+  }
+
+  my $child_dbh = DBI->connect($dsn, $ENV{'DBUSER'}, $ENV{'DBPASS'}, {
+    mysql_auto_reconnect => 1,
+    mysql_enable_utf8mb4 => 1
+  });
+  eval {
+    run_one_job($child_dbh, $job, $master_user, $master_pass);
+  };
+  if ($@) {
+    warn "run_one_job died for job $job->[0]: $@";
+    eval {
+      my $err_sth = $child_dbh->prepare("UPDATE imapsync SET last_run = NOW(), is_running = 0, success = 0, returned_text = ? WHERE id = ?");
+      $err_sth->bind_param(1, "Runner error: $@");
+      $err_sth->bind_param(2, $job->[0]);
+      $err_sth->execute();
+    };
+  }
+  $child_dbh->disconnect();
+
+  $pm->finish;
+}
+
+$pm->wait_all_children;
+
 $lockmgr->unlock($lock_file);

data/Dockerfiles/nginx/Dockerfile

@@ -1,4 +1,4 @@
-FROM nginx:1.30.4-alpine
+FROM nginx:alpine
 LABEL maintainer "The Infrastructure Company GmbH <info@servercow.de>"
 
 ENV PIP_BREAK_SYSTEM_PACKAGES=1

data/Dockerfiles/phpfpm/Dockerfile

@@ -7,13 +7,13 @@ ARG APCU_PECL_VERSION=5.1.28
 # renovate: datasource=github-tags depName=Imagick/imagick versioning=semver-coerced extractVersion=(?<version>.*)$
 ARG IMAGICK_PECL_VERSION=3.8.1
 # renovate: datasource=github-tags depName=php/pecl-mail-mailparse versioning=semver-coerced extractVersion=^v(?<version>.*)$
-ARG MAILPARSE_PECL_VERSION=3.2.0
+ARG MAILPARSE_PECL_VERSION=3.1.9
 # renovate: datasource=github-tags depName=php-memcached-dev/php-memcached versioning=semver-coerced extractVersion=^v(?<version>.*)$
 ARG MEMCACHED_PECL_VERSION=3.4.0
 # renovate: datasource=github-tags depName=phpredis/phpredis versioning=semver-coerced extractVersion=(?<version>.*)$
 ARG REDIS_PECL_VERSION=6.3.0
 # renovate: datasource=github-tags depName=composer/composer versioning=semver-coerced extractVersion=(?<version>.*)$
-ARG COMPOSER_VERSION=2.10.2
+ARG COMPOSER_VERSION=2.9.5
 
 RUN apk add -U --no-cache autoconf \
   aspell-dev \

data/Dockerfiles/postfix-tlspol/Dockerfile

@@ -1,17 +1,17 @@
-FROM golang:1.26-trixie AS builder
+FROM golang:1.25-bookworm AS builder
 WORKDIR /src
 
 ENV CGO_ENABLED=0 \
     GO111MODULE=on \
 		NOOPT=1 \
-    VERSION=1.11.0
+    VERSION=1.8.22
 
 RUN git clone --branch v${VERSION} https://github.com/Zuplu/postfix-tlspol && \
     cd /src/postfix-tlspol && \
     scripts/build.sh build-only
 
 
-FROM debian:trixie-slim
+FROM debian:bookworm-slim
 LABEL maintainer="The Infrastructure Company GmbH <info@servercow.de>"
 
 ARG DEBIAN_FRONTEND=noninteractive

data/Dockerfiles/postfix-tlspol/syslog-ng-redis_slave.conf

@@ -1,4 +1,4 @@
-@version: 4.8
+@version: 3.38
 @include "scl.conf"
 options {
   chain_hostnames(off);
@@ -7,7 +7,7 @@ options {
   dns_cache(no);
   use_fqdn(no);
   owner("root"); group("adm"); perm(0640);
-  stats(freq(0));
+  stats_freq(0);
   bad_hostname("^gconfd$");
 };
 source s_src {

data/Dockerfiles/postfix-tlspol/syslog-ng.conf

@@ -1,4 +1,4 @@
-@version: 4.8
+@version: 3.38
 @include "scl.conf"
 options {
   chain_hostnames(off);
@@ -7,7 +7,7 @@ options {
   dns_cache(no);
   use_fqdn(no);
   owner("root"); group("adm"); perm(0640);
-  stats(freq(0));
+  stats_freq(0);
   bad_hostname("^gconfd$");
 };
 source s_src {

data/Dockerfiles/postfix/Dockerfile

@@ -1,4 +1,4 @@
-FROM debian:trixie-slim
+FROM debian:bookworm-slim
 
 LABEL maintainer="The Infrastructure Company GmbH <info@servercow.de>"
 

data/Dockerfiles/postfix/syslog-ng-redis_slave.conf

@@ -1,4 +1,4 @@
-@version: 4.8
+@version: 3.38
 @include "scl.conf"
 options {
   chain_hostnames(off);
@@ -7,7 +7,7 @@ options {
   dns_cache(no);
   use_fqdn(no);
   owner("root"); group("adm"); perm(0640);
-  stats(freq(0));
+  stats_freq(0);
   bad_hostname("^gconfd$");
 };
 source s_src {

data/Dockerfiles/postfix/syslog-ng.conf

@@ -1,4 +1,4 @@
-@version: 4.8
+@version: 3.38
 @include "scl.conf"
 options {
   chain_hostnames(off);
@@ -7,7 +7,7 @@ options {
   dns_cache(no);
   use_fqdn(no);
   owner("root"); group("adm"); perm(0640);
-  stats(freq(0));
+  stats_freq(0);
   bad_hostname("^gconfd$");
 };
 source s_src {

data/Dockerfiles/rspamd/Dockerfile

@@ -2,7 +2,7 @@ FROM debian:trixie-slim
 LABEL maintainer="The Infrastructure Company GmbH <info@servercow.de>"
 
 ARG DEBIAN_FRONTEND=noninteractive
-ARG RSPAMD_VER=rspamd_4.1.4-1~beb659b
+ARG RSPAMD_VER=rspamd_3.14.3-1~236eb65
 ARG CODENAME=trixie
 ENV LC_ALL=C
 

data/Dockerfiles/sogo/Dockerfile

@@ -1,6 +1,6 @@
 # SOGo built from source to enable security patch application
 # Repository: https://github.com/Alinto/sogo
-# Version: SOGo-5.12.9
+# Version: SOGo-5.12.4
 #
 # Applied security patches:
 # -
@@ -12,8 +12,8 @@ FROM debian:bookworm
 LABEL maintainer="The Infrastructure Company GmbH <info@servercow.de>"
 
 ARG DEBIAN_FRONTEND=noninteractive
-ARG SOGO_VERSION=SOGo-5.12.10
-ARG SOPE_VERSION=SOPE-5.12.10
+ARG SOGO_VERSION=SOGo-5.12.5
+ARG SOPE_VERSION=SOPE-5.12.5
 # Security patches to apply (space-separated commit hashes)
 ARG SOGO_SECURITY_PATCHES=""
 # renovate: datasource=github-releases depName=tianon/gosu versioning=semver-coerced extractVersion=^(?<version>.*)$

data/Dockerfiles/unbound/Dockerfile

@@ -2,14 +2,11 @@ FROM alpine:3.23
 
 LABEL maintainer = "The Infrastructure Company GmbH <info@servercow.de>"
 
-# install unbound from alpine:edge to get security patches
-RUN apk add --no-cache --repository=https://dl-cdn.alpinelinux.org/alpine/edge/main unbound
-
-# install other packages from regular alpine stable repo
 RUN apk add --update --no-cache \
 	curl \
 	bind-tools \
 	coreutils \
+	unbound \
 	bash \
 	openssl \
 	drill \

data/conf/dovecot/auth/passwd-verify.lua

@@ -32,17 +32,8 @@ function auth_password_verify(request, password)
   -- Returning PASSDB_RESULT_PASSWORD_MISMATCH will reset the user's auth cache entry.
   -- Returning PASSDB_RESULT_INTERNAL_FAILURE keeps the existing cache entry,
   -- even if the TTL has expired. Useful to avoid cache eviction during backend issues.
-
-  -- On a network-level failure (nginx unreachable, DNS failure, timeout) https.request
-  -- returns nil plus an error string, so c is not a numeric HTTP status code. Treat this
-  -- as a backend outage and keep the cache entry, rather than wiping it as a mismatch.
-  if type(c) ~= "number" then
-    dovecot.i_info("HTTP request to auth backend failed with " .. tostring(c) .. " for user " .. request.user)
-    return dovecot.auth.PASSDB_RESULT_INTERNAL_FAILURE, "Upstream unreachable"
-  end
-
   if c ~= 200 and c ~= 401 then
-    dovecot.i_info("HTTP request failed with " .. tostring(c) .. " for user " .. request.user)
+    dovecot.i_info("HTTP request failed with " .. c .. " for user " .. request.user)
     return dovecot.auth.PASSDB_RESULT_PASSWORD_MISMATCH, "Upstream error"
   end
 

data/conf/dovecot/global_sieve_before

@@ -1,3 +1,13 @@
 # global_sieve_before script
 # global_sieve_before -> user sieve_before (mailcow UI) -> user sieve_after (mailcow UI) -> global_sieve_after
 
+require ["mailbox", "fileinto"];
+
+if header :contains ["Chat-Version"] [""] {
+  if mailboxexists "DeltaChat" {
+    fileinto "DeltaChat";
+  } else {
+    fileinto :create "DeltaChat";
+  }
+  stop;
+}

data/conf/nginx/templates/nginx.conf.j2

@@ -42,19 +42,12 @@ http {
         https https;
     }
 
-    map $server_port $sogo_auth_internal {
-        65510   "1";
-        default "";
-    }
-
     {% if HTTP_REDIRECT %}
     # HTTP to HTTPS redirect
     server {
         root /web;
         listen {{ HTTP_PORT }} default_server;
-        {% if ENABLE_IPV6 %}
         listen [::]:{{ HTTP_PORT }} default_server;
-        {%endif%}
 
         server_name {{ MAILCOW_HOSTNAME }} autodiscover.* autoconfig.* mta-sts.* {{ ADDITIONAL_SERVER_NAMES | join(' ') }};
 

data/conf/nginx/templates/sites-default.conf.j2

@@ -116,9 +116,6 @@ location ~ \.php$ {
     include /etc/nginx/fastcgi_params;
     fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
     fastcgi_param PATH_INFO $fastcgi_path_info;
-    fastcgi_param HTTP_X_REAL_IP $remote_addr;
-    # trusted internal-auth marker; empty for external clients (see nginx.conf map)
-    fastcgi_param SOGO_AUTH_INTERNAL $sogo_auth_internal;
     fastcgi_read_timeout 3600;
     fastcgi_send_timeout 3600;
 }

data/conf/phpfpm/crons/imapsync-oauth-refresh.php

@@ -1,100 +0,0 @@
-<?php
-
-require_once(__DIR__ . '/../web/inc/vars.inc.php');
-if (file_exists(__DIR__ . '/../web/inc/vars.local.inc.php')) {
-  include_once(__DIR__ . '/../web/inc/vars.local.inc.php');
-}
-require_once __DIR__ . '/../web/inc/lib/vendor/autoload.php';
-
-$dsn = $database_type . ":unix_socket=" . $database_sock . ";dbname=" . $database_name;
-$opt = [
-  PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
-  PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
-  PDO::ATTR_EMULATE_PREPARES   => false,
-];
-try {
-  $pdo = new PDO($dsn, $database_user, $database_pass, $opt);
-} catch (PDOException $e) {
-  fwrite(STDERR, "DB connect failed: " . $e->getMessage() . "\n");
-  exit(1);
-}
-
-$redis = new Redis();
-try {
-  if (!empty(getenv('REDIS_SLAVEOF_IP'))) {
-    $redis->connect(getenv('REDIS_SLAVEOF_IP'), getenv('REDIS_SLAVEOF_PORT'));
-  } else {
-    $redis->connect('redis-mailcow', 6379);
-  }
-  $redis->auth(getenv("REDISPASS"));
-} catch (Exception $e) {
-  fwrite(STDERR, "Redis connect failed: " . $e->getMessage() . "\n");
-  exit(1);
-}
-
-function logMsg($priority, $message, $task = "imapsync OAuth refresh") {
-  global $redis;
-  $redis->lPush('CRON_LOG', json_encode(array(
-    "time" => time(),
-    "priority" => $priority,
-    "task" => $task,
-    "message" => $message,
-  )));
-}
-
-require_once __DIR__ . '/../web/inc/functions.inc.php';
-require_once __DIR__ . '/../web/inc/functions.auth.inc.php';
-require_once __DIR__ . '/../web/inc/sessions.inc.php';
-require_once __DIR__ . '/../web/inc/functions.mailbox.inc.php';
-require_once __DIR__ . '/../web/inc/functions.syncjob.inc.php';
-
-// File-lock to prevent concurrent runs
-$lock_file = '/tmp/imapsync-oauth-refresh.lock';
-if (file_exists($lock_file)) {
-  $pid = (int)trim(@file_get_contents($lock_file));
-  if ($pid > 0 && posix_kill($pid, 0)) {
-    logMsg("info", "Previous refresh still running (pid=$pid), exiting");
-    exit(0);
-  }
-  @unlink($lock_file);
-}
-file_put_contents($lock_file, getmypid());
-
-try {
-  // 1) client_credentials sources: refresh the shared source-level token (expires < 5 min or none)
-  $stmt = $pdo->prepare("SELECT `id`, `name` FROM `imapsync_source`
-    WHERE `active` = 1 AND `auth_type` = 'XOAUTH2' AND `oauth_flow` = 'client_credentials'
-      AND (`oauth_token_expires` IS NULL OR `oauth_token_expires` < :soon)");
-  $stmt->execute(array(':soon' => time() + 300));
-  foreach ($stmt->fetchAll(PDO::FETCH_ASSOC) as $src) {
-    $ok = imapsync_source_refresh_token_internal($src['id']);
-    if ($ok) {
-      logMsg("info", "Refreshed token for source '" . $src['name'] . "' (id=" . $src['id'] . ")");
-    } else {
-      $e = $pdo->prepare("SELECT `oauth_last_refresh_error` FROM `imapsync_source` WHERE `id` = :id");
-      $e->execute(array(':id' => $src['id']));
-      logMsg("warning", "Refresh failed for source '" . $src['name'] . "' (id=" . $src['id'] . "): " . $e->fetchColumn());
-    }
-  }
-
-  // 2) authorization_code sources: refresh each per-user token via its stored refresh_token
-  $stmt = $pdo->prepare("SELECT t.`source_id`, t.`username`, s.`name`
-    FROM `imapsync_source_oauth_token` t
-    JOIN `imapsync_source` s ON s.`id` = t.`source_id`
-    WHERE s.`active` = 1 AND s.`auth_type` = 'XOAUTH2' AND s.`oauth_flow` = 'authorization_code'
-      AND t.`refresh_token` <> ''
-      AND (t.`token_expires` IS NULL OR t.`token_expires` < :soon)");
-  $stmt->execute(array(':soon' => time() + 300));
-  foreach ($stmt->fetchAll(PDO::FETCH_ASSOC) as $tok) {
-    $ok = imapsync_source_refresh_user_token_internal($tok['source_id'], $tok['username']);
-    if ($ok) {
-      logMsg("info", "Refreshed user token '" . $tok['username'] . "' on source '" . $tok['name'] . "' (id=" . $tok['source_id'] . ")");
-    } else {
-      $e = $pdo->prepare("SELECT `last_refresh_error` FROM `imapsync_source_oauth_token` WHERE `source_id` = :sid AND `username` = :user");
-      $e->execute(array(':sid' => $tok['source_id'], ':user' => $tok['username']));
-      logMsg("warning", "User-token refresh failed for '" . $tok['username'] . "' on source '" . $tok['name'] . "' (id=" . $tok['source_id'] . "): " . $e->fetchColumn());
-    }
-  }
-} finally {
-  @unlink($lock_file);
-}

data/conf/postfix/main.cf

@@ -37,7 +37,7 @@ postscreen_access_list = permit_mynetworks,
   cidr:/opt/postfix/conf/postscreen_access.cidr,
   tcp:127.0.0.1:10027
 postscreen_bare_newline_enable = no
-postscreen_denylist_action = drop
+postscreen_blacklist_action = drop
 postscreen_cache_cleanup_interval = 24h
 postscreen_cache_map = proxy:btree:$data_directory/postscreen_cache
 postscreen_dnsbl_action = enforce
@@ -107,6 +107,8 @@ smtpd_sender_restrictions = reject_authenticated_sender_login_mismatch,
   reject_unknown_sender_domain
 smtpd_soft_error_limit = 3
 smtpd_tls_auth_only = yes
+smtpd_tls_dh1024_param_file = /etc/ssl/mail/dhparams.pem
+smtpd_tls_eecdh_grade = auto
 smtpd_tls_exclude_ciphers = ECDHE-RSA-RC4-SHA, RC4, aNULL, DES-CBC3-SHA, ECDHE-RSA-DES-CBC3-SHA, EDH-RSA-DES-CBC3-SHA
 smtpd_tls_loglevel = 1
 
@@ -150,7 +152,7 @@ smtp_sasl_auth_enable = yes
 smtp_sasl_password_maps = proxy:mysql:/opt/postfix/conf/sql/mysql_sasl_passwd_maps_sender_dependent.cf
 smtp_sasl_security_options =
 smtp_sasl_mechanism_filter = plain, login
-smtp_tls_policy_maps = proxy:mysql:/opt/postfix/conf/sql/mysql_tls_policy_override_maps.cf socketmap:inet:postfix-tlspol:8642:QUERYwithTLSRPT
+smtp_tls_policy_maps = proxy:mysql:/opt/postfix/conf/sql/mysql_tls_policy_override_maps.cf socketmap:inet:postfix-tlspol:8642:QUERY
 smtp_header_checks = pcre:/opt/postfix/conf/anonymize_headers.pcre
 mail_name = Postcow
 # local_transport map catches local destinations and prevents routing local dests when the next map would route "*"

data/conf/postfix/master.cf

@@ -29,6 +29,7 @@ smtps    inet  n       -       n       -       -       smtpd
 # TLS protocol can be modified by setting submission_smtpd_tls_mandatory_protocols in extra.cf
 submission inet n       -       n       -       -       smtpd
   -o smtpd_client_restrictions=permit_mynetworks,permit_sasl_authenticated,reject
+  -o smtpd_enforce_tls=yes
   -o smtpd_tls_security_level=encrypt
   -o smtpd_tls_mandatory_protocols=$submission_smtpd_tls_mandatory_protocols
   -o tls_preempt_cipherlist=yes
@@ -37,6 +38,7 @@ submission inet n       -       n       -       -       smtpd
 10587      inet n       -       n       -       -       smtpd
   -o smtpd_upstream_proxy_protocol=haproxy
   -o smtpd_client_restrictions=permit_mynetworks,permit_sasl_authenticated,reject
+  -o smtpd_enforce_tls=yes
   -o smtpd_tls_security_level=encrypt
   -o smtpd_tls_mandatory_protocols=$submission_smtpd_tls_mandatory_protocols
   -o tls_preempt_cipherlist=yes

data/conf/postfix/postscreen_access.cidr

@@ -1,8 +1,7 @@
-# Whitelist generated by Postwhite v3.4 on Sat Aug  1 00:35:20 UTC 2026
+# Whitelist generated by Postwhite v3.4 on Wed Apr  1 00:33:31 UTC 2026
 # https://github.com/stevejenkins/postwhite/
-# 2256 total rules
+# 2246 total rules
 2a00:1450:4000::/36	permit
-2a00:1450:4864::/56	permit
 2a01:111:f400::/48	permit
 2a01:111:f403:2800::/53	permit
 2a01:111:f403:8000::/51	permit
@@ -29,11 +28,9 @@
 2a01:b747:3004:200::/56	permit
 2a01:b747:3005:200::/56	permit
 2a01:b747:3006:200::/56	permit
-2a01:b747:3007::/56	permit
 2a02:a60:0:5::/64	permit
 2a0f:f640::/56	permit
 2c0f:fb50:4000::/36	permit
-2c0f:fb50:4864::/56	permit
 2.207.151.32/27	permit
 2.207.151.53	permit
 2.207.217.30	permit
@@ -58,14 +55,13 @@
 8.25.196.0/23	permit
 8.36.116.0/24	permit
 8.39.54.0/23	permit
-8.39.54.240/29	permit
 8.39.54.250/31	permit
 8.39.144.0/24	permit
 8.40.222.0/23	permit
-8.40.222.240/29	permit
 8.40.222.250/31	permit
-8.47.10.9	permit
 12.130.86.238	permit
+13.107.213.38	permit
+13.107.246.38	permit
 13.108.16.0/20	permit
 13.110.208.0/21	permit
 13.110.209.0/24	permit
@@ -283,7 +279,6 @@
 50.56.130.221	permit
 50.56.130.222	permit
 50.112.246.219	permit
-51.83.17.38	permit
 52.1.14.157	permit
 52.5.230.59	permit
 52.6.74.205	permit
@@ -1387,7 +1382,6 @@
 117.120.16.0/21	permit
 119.42.242.52/31	permit
 119.42.242.156	permit
-121.244.91.31	permit
 121.244.91.48	permit
 121.244.91.52	permit
 122.15.156.182	permit
@@ -1557,14 +1551,12 @@
 147.243.128.26	permit
 148.105.0.0/16	permit
 148.105.8.0/21	permit
-148.116.32.128/25	permit
 149.72.0.0/16	permit
 149.72.234.184	permit
 149.72.248.236	permit
 149.97.173.180	permit
 149.118.160.128/25	permit
 150.136.21.199	permit
-150.171.109.72	permit
 150.230.98.160	permit
 151.145.38.14	permit
 152.67.105.195	permit
@@ -1642,9 +1634,8 @@
 164.177.132.168/30	permit
 165.1.100.0/25	permit
 165.173.128.0/24	permit
-165.173.180.0/24	permit
+165.173.180.1	permit
 165.173.180.250/31	permit
-165.173.182.0/24	permit
 165.173.182.250/31	permit
 165.173.189.205	permit
 166.78.68.0/22	permit
@@ -1687,7 +1678,6 @@
 169.148.144.0/25	permit
 169.148.144.10	permit
 169.148.146.0/23	permit
-169.148.174.10	permit
 169.148.175.3	permit
 169.148.179.3	permit
 169.148.188.0/24	permit
@@ -1706,7 +1696,6 @@
 173.203.81.39	permit
 173.224.161.128/25	permit
 173.224.165.0/26	permit
-173.224.166.48/28	permit
 174.36.84.8/29	permit
 174.36.84.16/29	permit
 174.36.84.32/29	permit
@@ -2238,7 +2227,6 @@
 2001:748:400:3301::4	permit
 2404:6800:4000::/36	permit
 2404:6800:4864::/56	permit
-2603:1061:14:75::1	permit
 2607:13c0:0001:0000:0000:0000:0000:7000/116	permit
 2607:13c0:0002:0000:0000:0000:0000:1000/116	permit
 2607:13c0:0004:0000:0000:0000:0000:0000/116	permit
@@ -2255,6 +2243,8 @@
 2620:10d:c09c:400::8:1	permit
 2620:119:50c0:207::/64	permit
 2620:119:50c0:207::215	permit
+2620:1ec:46::38	permit
+2620:1ec:bdf::38	permit
 2800:3f0:4000::/36	permit
 2800:3f0:4864::/56	permit
 49.12.4.251 permit # checks.mailcow.email

data/conf/rspamd/local.d/metadata_exporter.conf

@@ -3,7 +3,8 @@ rules {
     backend = "http";
     url = "http://nginx:9081/pipe.php";
     selector = "reject_no_global_bl";
-    formatter = "multipart";
+    formatter = "default";
+    meta_headers = true;
   }
 	RLINFO {
 		backend = "http";
@@ -15,7 +16,8 @@ rules {
     backend = "http";
     url = "http://nginx:9081/pushover.php";
     selector = "mailcow_rcpt";
-    formatter = "multipart";
+    formatter = "json";
+    meta_headers = true;
   }
 }
 

data/conf/rspamd/meta_exporter/pipe.php

@@ -32,42 +32,47 @@ function parse_email($email) {
   $a = strrpos($email, '@');
   return array('local' => substr($email, 0, $a), 'domain' => substr(substr($email, $a), 1));
 }
-// rspamd metadata_exporter (multipart formatter):
-//   - $_POST['metadata']        JSON with the rspamd metadata
-//   - $_FILES['message']        raw RFC822 message
-if (empty($_POST['metadata']) || !isset($_FILES['message']) || $_FILES['message']['error'] !== UPLOAD_ERR_OK) {
-  error_log("QUARANTINE: missing multipart parts from rspamd" . PHP_EOL);
-  http_response_code(400);
-  exit;
+if (!function_exists('getallheaders'))  {
+  function getallheaders() {
+    if (!is_array($_SERVER)) {
+      return array();
+    }
+    $headers = array();
+    foreach ($_SERVER as $name => $value) {
+      if (substr($name, 0, 5) == 'HTTP_') {
+        $headers[str_replace(' ', '-', ucwords(strtolower(str_replace('_', ' ', substr($name, 5)))))] = $value;
+      }
+    }
+    return $headers;
+  }
 }
 
-$meta = json_decode($_POST['metadata'], true);
-if (!is_array($meta)) {
-  error_log("QUARANTINE: cannot decode metadata JSON" . PHP_EOL);
-  http_response_code(400);
-  exit;
-}
-
-$raw_data_content = file_get_contents($_FILES['message']['tmp_name']);
+$raw_data_content = file_get_contents('php://input');
 $raw_data = mb_convert_encoding($raw_data_content, 'HTML-ENTITIES', "UTF-8");
-$raw_size = (int)$_FILES['message']['size'];
+$headers = getallheaders();
 
-$qid      = $meta['qid']     ?? 'unknown';
-$subject  = $meta['subject'] ?? '';
-$score    = $meta['score']   ?? 0;
-$rcpts    = $meta['rcpt']    ?? array();
-$user     = $meta['user']    ?? 'unknown';
-$ip       = $meta['ip']      ?? 'unknown';
-$action   = $meta['action']  ?? 'no action';
-$sender   = $meta['from']    ?? '';
-$symbols  = json_encode($meta['symbols'] ?? array());
-$fuzzy    = json_encode(is_array($meta['fuzzy'] ?? null) ? $meta['fuzzy'] : array());
+$qid      = $headers['X-Rspamd-Qid'];
+$fuzzy    = $headers['X-Rspamd-Fuzzy'];
+$subject  = iconv_mime_decode($headers['X-Rspamd-Subject']);
+$score    = $headers['X-Rspamd-Score'];
+$rcpts    = $headers['X-Rspamd-Rcpt'];
+$user     = $headers['X-Rspamd-User'];
+$ip       = $headers['X-Rspamd-Ip'];
+$action   = $headers['X-Rspamd-Action'];
+$sender   = $headers['X-Rspamd-From'];
+$symbols  = $headers['X-Rspamd-Symbols'];
+
+$raw_size = (int)$_SERVER['CONTENT_LENGTH'];
 
 if (empty($sender)) {
   error_log("QUARANTINE: Unknown sender, assuming empty-env-from@localhost" . PHP_EOL);
   $sender = 'empty-env-from@localhost';
 }
 
+if ($fuzzy == 'unknown') {
+  $fuzzy = '[]';
+}
+
 try {
   $max_size = (int)$redis->Get('Q_MAX_SIZE');
   if (($max_size * 1048576) < $raw_size) {
@@ -89,7 +94,7 @@ catch (RedisException $e) {
 $rcpt_final_mailboxes = array();
 
 // Loop through all rcpts
-foreach ($rcpts as $rcpt) {
+foreach (json_decode($rcpts, true) as $rcpt) {
   // Remove tag
   $rcpt = preg_replace('/^(.*?)\+.*(@.*)$/', '$1$2', $rcpt);
 

data/conf/rspamd/meta_exporter/pushover.php

@@ -32,46 +32,50 @@ function parse_email($email) {
   $a = strrpos($email, '@');
   return array('local' => substr($email, 0, $a), 'domain' => substr(substr($email, $a), 1));
 }
-// rspamd metadata_exporter (multipart formatter): metadata JSON arrives as $_POST['metadata'].
-if (empty($_POST['metadata'])) {
-  error_log("NOTIFY: missing metadata part from rspamd" . PHP_EOL);
-  http_response_code(400);
-  exit;
+if (!function_exists('getallheaders'))  {
+  function getallheaders() {
+    if (!is_array($_SERVER)) {
+      return array();
+    }
+    $headers = array();
+    foreach ($_SERVER as $name => $value) {
+      if (substr($name, 0, 5) == 'HTTP_') {
+        $headers[str_replace(' ', '-', ucwords(strtolower(str_replace('_', ' ', substr($name, 5)))))] = $value;
+      }
+    }
+    return $headers;
+  }
 }
 
-$meta = json_decode($_POST['metadata'], true);
-if (!is_array($meta)) {
-  error_log("NOTIFY: cannot decode metadata JSON" . PHP_EOL);
-  http_response_code(400);
-  exit;
-}
+$headers = getallheaders();
+$json_body = json_decode(file_get_contents('php://input'));
 
-$qid      = $meta['qid']    ?? 'unknown';
-$rcpts    = $meta['rcpt']   ?? array();
-$sender   = $meta['from']   ?? '';
-$ip       = $meta['ip']     ?? 'unknown';
-$subject  = $meta['subject'] ?? '';
-$messageid= $meta['message_id'] ?? '';
+$qid      = $headers['X-Rspamd-Qid'];
+$rcpts    = $headers['X-Rspamd-Rcpt'];
+$sender   = $headers['X-Rspamd-From'];
+$ip       = $headers['X-Rspamd-Ip'];
+$subject  = iconv_mime_decode($headers['X-Rspamd-Subject']);
+$messageid= $json_body->message_id;
 $priority = 0;
 
-$symbols_array = $meta['symbols'] ?? array();
+$symbols_array = json_decode($headers['X-Rspamd-Symbols'], true);
 if (is_array($symbols_array)) {
   foreach ($symbols_array as $symbol) {
-    if (($symbol['name'] ?? null) == 'HAS_X_PRIO_ONE') {
+    if ($symbol['name'] == 'HAS_X_PRIO_ONE') {
       $priority = 1;
       break;
     }
   }
 }
 
-$sender_address = $meta['header_from'][0] ?? '';
+$sender_address = $json_body->header_from[0];
 $sender_name = '-';
 if (preg_match('/(?<name>.*?)<(?<address>.*?)>/i', $sender_address, $matches)) {
 	$sender_address = $matches['address'];
   $sender_name =  trim($matches['name'], '"\' ');
 }
 
-$to_address = $meta['header_to'][0] ?? '';
+$to_address = $json_body->header_to[0];
 $to_name = '-';
 if (preg_match('/(?<name>.*?)<(?<address>.*?)>/i', $to_address, $matches)) {
 	$to_address = $matches['address'];
@@ -81,7 +85,7 @@ if (preg_match('/(?<name>.*?)<(?<address>.*?)>/i', $to_address, $matches)) {
 $rcpt_final_mailboxes = array();
 
 // Loop through all rcpts
-foreach ($rcpts as $rcpt) {
+foreach (json_decode($rcpts, true) as $rcpt) {
   // Remove tag
   $rcpt = preg_replace('/^(.*?)\+.*(@.*)$/', '$1$2', $rcpt);
 

data/web/admin/system.php

@@ -106,6 +106,7 @@ $template_data = [
   'f2b_data' => $f2b_data,
   'f2b_banlist_url' => getBaseUrl() . "/f2b-banlist?id=" . $f2b_data['banlist_id'],
   'q_data' => quarantine('settings'),
+  'sj_data' => mailbox('get', 'syncjob_settings'),
   'qn_data' => quota_notification('get'),
   'pw_reset_data' => reset_password('get_notification'),
   'rsettings_map' => file_get_contents('http://nginx:8081/settings.php'),
@@ -116,7 +117,6 @@ $template_data = [
   'ip_check' => customize('get', 'ip_check'),
   'custom_login' => customize('get', 'custom_login'),
   'password_complexity' => password_complexity('get'),
-  'imapsync_settings' => imapsync_get_settings(),
   'show_rspamd_global_filters' => @$_SESSION['show_rspamd_global_filters'],
   'cors_settings' => $cors_settings,
   'is_https' => isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on',

data/web/api/openapi.yaml

@@ -185,9 +185,6 @@ paths:
               example:
                 username: info@domain.tld
                 domain: domain.tld
-                description: my time limited alias
-                validity: 8760
-                permanent: false
               properties:
                 username:
                   description: 'the mailbox an alias should be created for'
@@ -195,15 +192,6 @@ paths:
                 domain:
                   description: "the domain"
                   type: string
-                description:
-                  description: "a description for the alias, defaults to an empty string"
-                  type: string
-                validity:
-                  description: "how many hours the alias stays valid, 1 to 87600, defaults to 8760 (one year)"
-                  type: integer
-                permanent:
-                  description: "keep the alias after it expired, defaults to false"
-                  type: boolean
               type: object
       summary: Create time limited alias
   /api/v1/add/app-passwd:
@@ -1084,7 +1072,6 @@ paths:
                           password2: "*"
                           quota: "3072"
                           force_pw_update: "1"
-                          force_tfa: "1"
                           tls_enforce_in: "1"
                           tls_enforce_out: "1"
                           tags: ["tag1", "tag2"]
@@ -1131,7 +1118,6 @@ paths:
                 password2: atedismonsin
                 quota: "3072"
                 force_pw_update: "1"
-                force_tfa: "1"
                 tls_enforce_in: "1"
                 tls_enforce_out: "1"
                 tags: ["tag1", "tag2"]
@@ -1165,9 +1151,6 @@ paths:
                 force_pw_update:
                   description: forces the user to update its password on first login
                   type: boolean
-                force_tfa:
-                  description: force 2FA enrollment at login
-                  type: boolean
                 tls_enforce_in:
                   description: force inbound email tls encryption
                   type: boolean
@@ -1537,9 +1520,7 @@ paths:
                 timeout1: "600"
                 timeout2: "600"
                 exclude: "(?i)spam|(?i)junk"
-                custom_params:
-                  - {o: dry, v: ""}
-                  - {o: folder, v: INBOX}
+                custom_params: "--dry"
                 delete2duplicates: "1"
                 delete1: "1"
                 delete2: "0"
@@ -1588,19 +1569,8 @@ paths:
                   description: exclude objects (regex)
                   type: string
                 custom_params:
-                  description: >-
-                    Allowlisted imapsync options as option/value pairs. `o` is the
-                    option name (must be one from `GET /get/syncjob_options`); `v`
-                    is the value (empty string for pure flags). Values may contain
-                    any character and are passed to imapsync as a single argument.
-                  type: array
-                  items:
-                    type: object
-                    properties:
-                      o:
-                        type: string
-                      v:
-                        type: string
+                  description: custom parameters
+                  type: string
                 delete2duplicates:
                   description: delete duplicates on destination (--delete2duplicates)
                   type: boolean
@@ -1623,151 +1593,6 @@ paths:
                   description: enables or disables the sync job
                   type: boolean
               type: object
-  /api/v1/add/syncjob_source:
-    post:
-      responses:
-        "401":
-          $ref: "#/components/responses/Unauthorized"
-        "200":
-          content:
-            application/json:
-              examples:
-                response:
-                  value:
-                    - log:
-                        - syncjob
-                        - add
-                        - source
-                        - name: Example import
-                          description: ""
-                          host1: imap.example.org
-                          port1: 993
-                          enc1: SSL
-                          auth_type: PLAIN
-                          active: 1
-                          scope: all
-                      msg:
-                        - imapsync_source_added
-                        - Example import
-                      type: success
-              schema:
-                properties:
-                  log:
-                    description: contains request object
-                    items: {}
-                    type: array
-                  msg:
-                    items: {}
-                    type: array
-                  type:
-                    enum:
-                      - success
-                      - danger
-                      - error
-                    type: string
-                type: object
-          description: OK
-          headers: {}
-      tags:
-        - Sync jobs
-      description: >-
-        Create a reusable IMAP sync source. A sync job binds to a source by id;
-        the source carries host/port/encryption and either static credentials
-        (PLAIN/LOGIN/CRAM-MD5 — supplied per-job) or an OAuth2 token endpoint
-        (XOAUTH2 — token cached on the source row).
-      operationId: Create sync job source
-      summary: Create sync job source
-      requestBody:
-        content:
-          application/json:
-            schema:
-              example:
-                name: Example import
-                description: ""
-                host1: imap.example.org
-                port1: "993"
-                enc1: SSL
-                auth_type: PLAIN
-                active: "1"
-                scope: all
-              properties:
-                name:
-                  description: source name, unique per owner
-                  type: string
-                description:
-                  description: free text shown in the UI
-                  type: string
-                host1:
-                  description: remote IMAP host
-                  type: string
-                port1:
-                  description: remote IMAP port (1-65535)
-                  type: integer
-                enc1:
-                  description: TLS / SSL / PLAIN
-                  type: string
-                  enum:
-                    - TLS
-                    - SSL
-                    - PLAIN
-                auth_type:
-                  description: authentication mechanism
-                  type: string
-                  enum:
-                    - PLAIN
-                    - LOGIN
-                    - CRAM-MD5
-                    - XOAUTH2
-                oauth_flow:
-                  description: XOAUTH2 grant type (default client_credentials)
-                  type: string
-                  enum:
-                    - client_credentials
-                    - authorization_code
-                oauth_token_endpoint:
-                  description: required when auth_type is XOAUTH2 (token URL)
-                  type: string
-                oauth_authorize_endpoint:
-                  description: required when oauth_flow is authorization_code (authorize URL)
-                  type: string
-                oauth_userinfo_endpoint:
-                  description: optional identity endpoint for authorization_code
-                  type: string
-                oauth_client_id:
-                  description: required when auth_type is XOAUTH2
-                  type: string
-                oauth_client_secret:
-                  description: required when auth_type is XOAUTH2
-                  type: string
-                oauth_scope:
-                  description: required when auth_type is XOAUTH2
-                  type: string
-                oauth_extra_params:
-                  description: optional JSON object merged into the token request body
-                  type: string
-                active:
-                  description: enables or disables the source
-                  type: boolean
-                scope:
-                  description: >-
-                    admin/domainadmin — source visibility. client_credentials
-                    XOAUTH2 sources are always forced to a private scope.
-                  type: string
-                  enum:
-                    - all
-                    - domain
-                    - user
-                domains:
-                  description: target domains when scope is domain
-                  type: array
-                  items:
-                    type: string
-                users:
-                  description: target users when scope is user
-                  type: array
-                  items:
-                    type: string
-              type: object
   /api/v1/add/tls-policy-map:
     post:
       responses:
@@ -2685,7 +2510,7 @@ paths:
       description: >-
         Using this endpoint you can perform actions on quarantine items. It is possible to release
         emails from quarantine into to the inbox, or learn them as ham to improve Rspamd filtering.
-        You must provide the quarantine item IDs. You can get the IDs using the GET method.
+        You must provide the quarantine item IDs. You can get the IDs using the GET method.      
       operationId: Edit mails in Quarantine
       requestBody:
         content:
@@ -2940,62 +2765,6 @@ paths:
                   type: object
               type: object
       summary: Delete sync job
-  /api/v1/delete/syncjob_source:
-    post:
-      responses:
-        "401":
-          $ref: "#/components/responses/Unauthorized"
-        "200":
-          content:
-            application/json:
-              examples:
-                response:
-                  value:
-                    - log:
-                        - syncjob
-                        - delete
-                        - source
-                        - id:
-                            - "3"
-                      msg:
-                        - imapsync_source_deleted
-                        - Example import
-                      type: success
-              schema:
-                properties:
-                  log:
-                    description: contains request object
-                    items: {}
-                    type: array
-                  msg:
-                    items: {}
-                    type: array
-                  type:
-                    enum:
-                      - success
-                      - danger
-                      - error
-                    type: string
-                type: object
-          description: OK
-          headers: {}
-      tags:
-        - Sync jobs
-      description: >-
-        Delete one or more sync job sources by id. Sources still referenced by
-        a sync job cannot be deleted (FK ON DELETE RESTRICT) — delete or
-        repoint the dependent jobs first.
-      operationId: Delete sync job source
-      summary: Delete sync job source
-      requestBody:
-        content:
-          application/json:
-            schema:
-              example:
-                - "3"
-              items:
-                type: string
-              type: array
   /api/v1/delete/tls-policy-map:
     post:
       responses:
@@ -3645,7 +3414,6 @@ paths:
                         - mailbox
                         - active: "1"
                           force_pw_update: "0"
-                          force_tfa: "0"
                           name: Full name
                           password: "*"
                           password2: "*"
@@ -3696,7 +3464,6 @@ paths:
                 attr:
                   active: "1"
                   force_pw_update: "0"
-                  force_tfa: "0"
                   name: Full name
                   authsource: mailcow
                   password: ""
@@ -3720,9 +3487,6 @@ paths:
                     force_pw_update:
                       description: force user to change password on next login
                       type: boolean
-                    force_tfa:
-                      description: force 2FA enrollment at login
-                      type: boolean
                     name:
                       description: Full name of the mailbox user
                       type: string
@@ -4098,25 +3862,8 @@ paths:
                         etc.)
                       type: boolean
                     custom_params:
-                      description: >-
-                        Allowlisted imapsync options as option/value pairs. `o` is
-                        the option name (must be one from `GET /get/syncjob_options`);
-                        `v` is the value (empty string for flags). Values are passed to imapsync as a single
-                        argument.
-                      type: array
-                      items:
-                        type: object
-                        properties:
-                          o:
-                            type: string
-                          v:
-                            type: string
-                    prio:
-                      description: >-
-                        Priority (admin only; ignored otherwise). The runner processes due
-                        jobs least-recently-run first, priority breaks ties (0 = normal,
-                        higher wins).
-                      type: number
+                      description: Custom parameters passed to imapsync command
+                      type: string
                     delete1:
                       description: Delete from source when completed
                       type: boolean
@@ -4184,7 +3931,7 @@ paths:
                   type: object
               type: object
       summary: Update sync job
-  /api/v1/edit/syncjob_source:
+  /api/v1/edit/syncjob_settings:
     post:
       responses:
         "401":
@@ -4195,19 +3942,14 @@ paths:
               examples:
                 response:
                   value:
-                    - log:
-                        - syncjob
-                        - edit
-                        - source
-                        - id:
-                            - "3"
-                          name: Example import
-                          host1: imap.example.org
-                          port1: 993
-                      msg:
-                        - imapsync_source_modified
-                        - Example import
-                      type: success
+                    log:
+                      - entity
+                      - action
+                      - object
+                    msg:
+                      - message
+                      - entity name
+                    type: success
               schema:
                 properties:
                   log:
@@ -4229,224 +3971,24 @@ paths:
       tags:
         - Sync jobs
       description: >-
-        Update one or more sync job sources. Fields not provided are left
-        unchanged. For XOAUTH2 sources, an empty `oauth_client_secret`
-        preserves the stored value.
-      operationId: Update sync job source
-      summary: Update sync job source
-      requestBody:
-        content:
-          application/json:
-            schema:
-              example:
-                items:
-                  - "3"
-                attr:
-                  name: Example import
-                  description: ""
-                  host1: imap.example.org
-                  port1: "993"
-                  enc1: SSL
-                  auth_type: PLAIN
-                  active: "1"
-              properties:
-                attr:
-                  properties:
-                    name:
-                      type: string
-                    description:
-                      type: string
-                    host1:
-                      type: string
-                    port1:
-                      type: integer
-                    enc1:
-                      type: string
-                      enum:
-                        - TLS
-                        - SSL
-                        - PLAIN
-                    auth_type:
-                      type: string
-                      enum:
-                        - PLAIN
-                        - LOGIN
-                        - CRAM-MD5
-                        - XOAUTH2
-                    oauth_flow:
-                      description: XOAUTH2 grant type
-                      type: string
-                      enum:
-                        - client_credentials
-                        - authorization_code
-                    oauth_token_endpoint:
-                      type: string
-                    oauth_authorize_endpoint:
-                      description: required when oauth_flow is authorization_code
-                      type: string
-                    oauth_userinfo_endpoint:
-                      description: optional identity endpoint for authorization_code
-                      type: string
-                    oauth_client_id:
-                      type: string
-                    oauth_client_secret:
-                      description: empty keeps the previously stored secret
-                      type: string
-                    oauth_scope:
-                      type: string
-                    oauth_extra_params:
-                      type: string
-                    active:
-                      type: boolean
-                    scope:
-                      description: source visibility (admin/domainadmin)
-                      type: string
-                      enum:
-                        - all
-                        - domain
-                        - user
-                    domains:
-                      description: target domains when scope is domain
-                      type: array
-                      items:
-                        type: string
-                    users:
-                      description: target users when scope is user
-                      type: array
-                      items:
-                        type: string
-                  type: object
-                items:
-                  description: list of source ids to update
-                  type: array
-                  items:
-                    type: string
-              type: object
-  /api/v1/edit/syncjob_source/refresh_token:
-    post:
-      responses:
-        "401":
-          $ref: "#/components/responses/Unauthorized"
-        "200":
-          content:
-            application/json:
-              examples:
-                response:
-                  value:
-                    - log:
-                        - syncjob
-                        - edit
-                        - refresh_token
-                        - id:
-                            - "3"
-                      msg:
-                        - imapsync_source_token_refreshed
-                        - Example import
-                      type: success
-              schema:
-                properties:
-                  log:
-                    description: contains request object
-                    items: {}
-                    type: array
-                  msg:
-                    items: {}
-                    type: array
-                  type:
-                    enum:
-                      - success
-                      - danger
-                      - error
-                    type: string
-                type: object
-          description: OK
-          headers: {}
-      tags:
-        - Sync jobs
-      description: >-
-        Force an OAuth2 access-token refresh for a XOAUTH2 source. Performs a
-        Client-Credentials grant against the source's `oauth_token_endpoint`
-        and caches the new access token + expiry on the source row. On failure,
-        the error is recorded in `oauth_last_refresh_error`.
-      operationId: Refresh sync job source token
-      summary: Refresh sync job source token
-      requestBody:
-        content:
-          application/json:
-            schema:
-              example:
-                items:
-                  - "3"
-              properties:
-                items:
-                  description: list of source ids to refresh
-                  type: array
-                  items:
-                    type: string
-              type: object
-  /api/v1/edit/imapsync_settings:
-    post:
-      responses:
-        "401":
-          $ref: "#/components/responses/Unauthorized"
-        "200":
-          content:
-            application/json:
-              examples:
-                response:
-                  value:
-                    - log:
-                        - imapsync_settings
-                        - edit
-                      msg:
-                        - max_parallel_saved
-                      type: success
-              schema:
-                properties:
-                  log:
-                    description: contains request object
-                    items: {}
-                    type: array
-                  msg:
-                    items: {}
-                    type: array
-                  type:
-                    enum:
-                      - success
-                      - danger
-                      - error
-                    type: string
-                type: object
-          description: OK
-          headers: {}
-      tags:
-        - Sync jobs
-      description: >-
-        Update global sync job settings (admin only). `max_parallel` is the
-        number of imapsync processes that may run concurrently; `max_kb_per_second`
-        is a per-process bandwidth cap in KB/s (0 = unlimited), stored internally
-        in bytes/s.
+        Update the global sync job settings. Currently exposes the maximum
+        number of imapsync processes that are allowed to run in parallel.
+        Admin access required.
       operationId: Update sync job settings
-      summary: Update sync job settings
       requestBody:
         content:
           application/json:
             schema:
               example:
-                attr:
-                  max_parallel: "4"
-                  max_kb_per_second: "2000"
+                max_parallel: 4
               properties:
-                attr:
-                  properties:
-                    max_parallel:
-                      description: Max. concurrent sync processes (>= 1)
-                      type: number
-                    max_kb_per_second:
-                      description: Bandwidth limit per process in KB/s (0 = unlimited)
-                      type: number
-                  type: object
+                max_parallel:
+                  description: >-
+                    Maximum number of imapsync processes allowed to run in
+                    parallel (1 = sequential behavior, max 50)
+                  type: integer
               type: object
+      summary: Update sync job settings
   /api/v1/edit/user-acl:
     post:
       responses:
@@ -5397,7 +4939,6 @@ paths:
                     - active: "1"
                       attributes:
                         force_pw_update: "0"
-                        force_tfa: "0"
                         mailbox_format: "maildir:"
                         quarantine_notification: never
                         sogo_access: "1"
@@ -5414,7 +4955,6 @@ paths:
                       quota: 3221225472
                       quota_used: 0
                       rl: false
-                      sender_acl: ["otherbox@doman3.tld", "@aliasdomain.tld"]
                       spam_aliases: 0
                       username: info@doman3.tld
                       tags: ["tag1", "tag2"]
@@ -6147,23 +5687,8 @@ paths:
       description: You can list all syn jobs existing in system.
       operationId: Get sync jobs
       summary: Get sync jobs
-  "/api/v1/get/syncjob_source/{id}":
+  /api/v1/get/syncjob_settings:
     get:
-      parameters:
-        - description: source id, or `all` to list every source visible to the session
-          example: all
-          in: path
-          name: id
-          required: true
-          schema:
-            type: string
-        - description: e.g. api-key-string
-          example: api-key-string
-          in: header
-          name: X-API-Key
-          required: false
-          schema:
-            type: string
       responses:
         "401":
           $ref: "#/components/responses/Unauthorized"
@@ -6173,69 +5698,25 @@ paths:
               examples:
                 response:
                   value:
-                    - id: 3
-                      name: Example import
-                      description: ""
-                      created_by: ""
-                      scope: all
-                      host1: imap.example.org
-                      port1: 993
-                      enc1: SSL
-                      auth_type: PLAIN
-                      oauth_token_endpoint: null
-                      oauth_client_id: null
-                      oauth_client_secret: ""
-                      oauth_scope: null
-                      oauth_extra_params: null
-                      oauth_access_token: ""
-                      oauth_token_expires: null
-                      oauth_last_refresh_error: null
-                      active: 1
-                      created: "2026-06-11 09:00:00"
-                      modified: "2026-06-11 09:00:00"
+                    max_parallel: 4
+              schema:
+                properties:
+                  max_parallel:
+                    description: >-
+                      Maximum number of imapsync processes allowed to run in
+                      parallel (1 = sequential behavior)
+                    type: integer
+                type: object
           description: OK
           headers: {}
       tags:
         - Sync jobs
       description: >-
-        Returns a single sync job source by id, or all sources visible to the
-        caller when `id` is `all`. Secrets (`oauth_client_secret`,
-        `oauth_access_token`) are blanked unless requested with internal
-        flags — they are never returned over the JSON API.
-      operationId: Get sync job sources
-      summary: Get sync job sources
-  /api/v1/get/syncjob_options:
-    get:
-      parameters:
-        - description: e.g. api-key-string
-          example: api-key-string
-          in: header
-          name: X-API-Key
-          required: false
-          schema:
-            type: string
-      responses:
-        "401":
-          $ref: "#/components/responses/Unauthorized"
-        "200":
-          content:
-            application/json:
-              examples:
-                response:
-                  value:
-                    - dry
-                    - folder
-                    - delete2folders
-                    - maxsize
-          description: OK
-          headers: {}
-      tags:
-        - Sync jobs
-      description: >-
-        Returns the allowlist of imapsync option names accepted in a sync job's
-        `custom_params`. Used by the UI to populate the option autocompletion.
-      operationId: Get sync job options
-      summary: Get sync job options
+        Return the global sync job settings. Currently exposes the maximum
+        number of imapsync processes allowed to run in parallel. Admin access
+        required.
+      operationId: Get sync job settings
+      summary: Get sync job settings
   "/api/v1/get/tls-policy-map/{id}":
     get:
       parameters:
@@ -6412,7 +5893,6 @@ paths:
                     - active: "1"
                       attributes:
                         force_pw_update: "0"
-                        force_tfa: "0"
                         mailbox_format: "maildir:"
                         quarantine_notification: never
                         sogo_access: "1"
@@ -6430,7 +5910,6 @@ paths:
                       quota: 3221225472
                       quota_used: 0
                       rl: false
-                      sender_acl: ["otherbox@domain3.tld", "@aliasdomain.tld"]
                       spam_aliases: 0
                       username: info@domain3.tld
                       tags: ["tag1", "tag2"]
@@ -6453,7 +5932,7 @@ paths:
                 response:
                   value:
                     - type: "success"
-                      log: ["cors", "edit", {"allowed_origins": ["*", "https://mail.mailcow.tld"], "allowed_methods": ["POST", "GET", "DELETE", "PUT"]}]
+                      log: ["cors", "edit", {"allowed_origins": ["*", "mail.mailcow.tld"], "allowed_methods": ["POST", "GET", "DELETE", "PUT"]}]
                       msg: "cors_headers_edited"
           description: OK
           headers: { }
@@ -6470,7 +5949,7 @@ paths:
             schema:
               example:
                 attr:
-                  allowed_origins: ["*", "https://mail.mailcow.tld"]
+                  allowed_origins: ["*", "mail.mailcow.tld"]
                   allowed_methods: ["POST", "GET", "DELETE", "PUT"]
               properties:
                 attr:

data/web/edit.php

@@ -204,15 +204,9 @@ if (isset($_SESSION['mailcow_cc_role'])) {
     if (isset($_GET['syncjob']) &&
       is_numeric($_GET['syncjob'])) {
         $id = $_GET["syncjob"];
-        $result = syncjob('get', 'job', $id);
+        $result = mailbox('get', 'syncjob_details', $id);
         $template = 'edit/syncjob.twig';
       }
-    elseif (isset($_GET['syncjob_source']) &&
-      is_numeric($_GET['syncjob_source'])) {
-        $id = $_GET["syncjob_source"];
-        $result = syncjob('get', 'source', array('id' => $id, 'with_secret' => true));
-        $template = 'edit/imapsync_source.twig';
-    }
     elseif (isset($_GET['filter']) &&
       is_numeric($_GET['filter'])) {
         $id = $_GET["filter"];

data/web/inc/ajax/dns_diagnostics.php

@@ -380,13 +380,13 @@ if (isset($_SESSION['mailcow_cc_role']) && ($_SESSION['mailcow_cc_role'] == "adm
             else {
               $state = state_nomatch;
             }
-            $state .= '<br />' . htmlspecialchars($current[$data_field[$current['type']]]);
+            $state .= '<br />' . $current[$data_field[$current['type']]];
           }
           if ($current['type'] == 'TXT' &&
               stripos($current['txt'], 'v=dmarc') === 0 &&
               $record[2] == $dmarc_link) {
             $current['txt'] = str_replace(' ', '', $current['txt']);
-            $state = htmlspecialchars($current[$data_field[$current['type']]]) . state_optional;
+            $state = $current[$data_field[$current['type']]] . state_optional;
           }
           elseif ($current['type'] == 'TXT' &&
                   stripos($current['txt'], 'v=spf') === 0 &&
@@ -396,7 +396,7 @@ if (isset($_SESSION['mailcow_cc_role']) && ($_SESSION['mailcow_cc_role'] == "adm
             if (in_array($ip, $rslt) && in_array(expand_ipv6($ip6), $rslt)) {
               $state = state_good;
             }
-            $state .= '<br />' . htmlspecialchars($current[$data_field[$current['type']]]) . state_optional;
+            $state .= '<br />' . $current[$data_field[$current['type']]] . state_optional;
           }
           elseif ($current['type'] == 'TXT' &&
                   stripos($current['txt'], 'v=dkim') === 0 &&
@@ -426,7 +426,7 @@ if (isset($_SESSION['mailcow_cc_role']) && ($_SESSION['mailcow_cc_role'] == "adm
         if ($state == state_nomatch) {
           $state = array();
           foreach ($currents as $current) {
-            $state[] = htmlspecialchars($current[$data_field[$current['type']]]);
+            $state[] = $current[$data_field[$current['type']]];
           }
           $state = implode('<br />', $state);
         }
@@ -436,22 +436,12 @@ if (isset($_SESSION['mailcow_cc_role']) && ($_SESSION['mailcow_cc_role'] == "adm
           <td>%s</td>
           <td class="dns-found">%s</td>
           <td class="dns-recommended">%s</td>
-        </tr>', htmlspecialchars($record[0]), htmlspecialchars($record[1]), $record[2], $state);
+        </tr>', $record[0], $record[1], $record[2], $state);
         $record[3] = explode('<br />', $state);
       }
 
       unset($record);
 
-      // Make a hostname RHS absolute so it is not read relative to $ORIGIN.
-      // Already-absolute names, the SRV root target "." and IP addresses are left alone.
-      $absolutize = function($host) {
-        $host = trim($host);
-        if ($host === '' || $host === '.' || substr($host, -1) === '.' || filter_var($host, FILTER_VALIDATE_IP)) {
-          return $host;
-        }
-        return $host . '.';
-      };
-
       $dns_data = sprintf("\$ORIGIN %s.\n", $domain);
       foreach ($records as $record) {
         if ($domain == substr($record[0], -strlen($domain))) {
@@ -472,32 +462,22 @@ if (isset($_SESSION['mailcow_cc_role']) && ($_SESSION['mailcow_cc_role'] == "adm
               $val = str_replace(state_optional, '', $val);
               $val = str_replace(state_good, '', $val);
               if (strlen($val) > 0) {
-                // these are all TXT values, their RHS is a character string, not a name
                 $vals[] = sprintf("%s\tIN\t%s\t%s\n", $label, $record[1], $val);
               }
             }
           }
           else {
-            if ($record[1] == 'MX' || $record[1] == 'CNAME') {
-              $val = $absolutize($val);
-            }
-            elseif ($record[1] == 'SRV') {
-              // format here is "target port"; only the target is a name
-              $parts = explode(' ', $val, 2);
-              $parts[0] = $absolutize($parts[0]);
-              $val = implode(' ', $parts);
-            }
             $vals[] = sprintf("%s\tIN\t%s\t%s\n", $label, $record[1], $val);
           }
 
           foreach ($vals as $val) {
-            $dns_data .= $val;
+            $dns_data .= str_replace($domain, $domain . '.', $val);
           }
         }
       }
       ?>
     </table>
-    <a id='download-zonefile' class="btn btn-sm btn-secondary visible-xs-block visible-sm-inline visible-md-inline visible-lg-inline mb-4" style="margin-top:10px" data-zonefile="<?=base64_encode($dns_data);?>" download='<?=htmlspecialchars($_GET['domain']);?>.txt' type='text/csv'>Download</a>
+    <a id='download-zonefile' class="btn btn-sm btn-secondary visible-xs-block visible-sm-inline visible-md-inline visible-lg-inline mb-4" style="margin-top:10px" data-zonefile="<?=base64_encode($dns_data);?>" download='<?=$_GET['domain'];?>.txt' type='text/csv'>Download</a>
     <script>
       var zonefile_dl_link = document.getElementById('download-zonefile');
       var zonefile = atob(zonefile_dl_link.getAttribute('data-zonefile'));

data/web/inc/ajax/syncjob_logs.php

@@ -6,7 +6,7 @@ if (!isset($_SESSION['mailcow_cc_role'])) {
 }
 
 if (isset($_GET['id']) && is_numeric($_GET['id'])) {
-  if ($details = syncjob('get', 'job', intval($_GET['id']))) {
+  if ($details = mailbox('get', 'syncjob_details', intval($_GET['id']))) {
     echo (empty($details['log'])) ? '-' : $details['log'];
   }
 }

data/web/inc/ajax/update_check.php

@@ -1,67 +0,0 @@
-<?php
-require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
-
-header('Content-Type: application/json');
-
-// Admins only
-if (!isset($_SESSION['mailcow_cc_role']) || $_SESSION['mailcow_cc_role'] !== 'admin') {
-  http_response_code(403);
-  echo json_encode(array('status' => 'error', 'message' => 'access denied'));
-  exit;
-}
-
-$owner   = $GLOBALS['MAILCOW_GIT_OWNER'];
-$repo    = $GLOBALS['MAILCOW_GIT_REPO'];
-$current = $GLOBALS['MAILCOW_GIT_VERSION'];
-
-// Cache key is bound to the running version, so an update invalidates it naturally
-$cache_key = 'MAILCOW_UPDATE_CHECK/' . $current;
-
-// Serve cached result if present (one GitHub call per TTL, not one per page load)
-$cached = $redis->get($cache_key);
-if ($cached !== false) {
-  echo $cached;
-  exit;
-}
-
-// GitHub requires a User-Agent and rate-limits unauthenticated requests to 60/h per IP
-function github_get($url) {
-  $ch = curl_init($url);
-  curl_setopt_array($ch, array(
-    CURLOPT_RETURNTRANSFER => true,
-    CURLOPT_USERAGENT      => 'mailcow-update-check',
-    CURLOPT_TIMEOUT        => 10,
-    CURLOPT_HTTPHEADER     => array('Accept: application/vnd.github+json'),
-  ));
-  $body = curl_exec($ch);
-  $code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
-  curl_close($ch);
-  if ($body === false || $code !== 200) return false;
-  $json = json_decode($body, true);
-  return is_array($json) ? $json : false;
-}
-
-$latest  = github_get("https://api.github.com/repos/{$owner}/{$repo}/releases/latest");
-$release = github_get("https://api.github.com/repos/{$owner}/{$repo}/releases/tags/{$current}");
-
-// Any failure (rate limit, offline, unexpected payload) -> honest error, cached briefly
-if ($latest === false || $release === false ||
-    empty($latest['tag_name']) || empty($latest['created_at']) || empty($release['created_at'])) {
-  $result = json_encode(array('status' => 'error', 'message' => 'could not reach GitHub API'));
-  $redis->setex($cache_key, 300, $result);
-  echo $result;
-  exit;
-}
-
-$date_latest  = strtotime($latest['created_at']);
-$date_current = strtotime($release['created_at']);
-
-if ($date_latest <= $date_current) {
-  $result = json_encode(array('status' => 'no_update'));
-} else {
-  $result = json_encode(array('status' => 'update_available', 'latest_tag' => $latest['tag_name']));
-}
-
-// Cache the positive result for an hour
-$redis->setex($cache_key, 3600, $result);
-echo $result;

data/web/inc/footer.inc.php

@@ -33,11 +33,11 @@ if (array_key_exists('pending_tfa_methods', $_SESSION)) {
   if (isset($pending_tfa_authmechs['webauthn'])) {
     $pending_tfa_authmechs['webauthn'] = true;
   }
-  if (!isset($pending_tfa_authmechs['webauthn'])
+  if (!isset($pending_tfa_authmechs['webauthn']) 
       && isset($pending_tfa_authmechs['yubi_otp'])) {
     $pending_tfa_authmechs['yubi_otp'] = true;
   }
-  if (!isset($pending_tfa_authmechs['webauthn'])
+  if (!isset($pending_tfa_authmechs['webauthn']) 
       && !isset($pending_tfa_authmechs['yubi_otp'])
       && isset($pending_tfa_authmechs['totp'])) {
     $pending_tfa_authmechs['totp'] = true;
@@ -72,7 +72,6 @@ $globalVariables = [
   'lang_fido2' => json_encode($lang['fido2']),
   'lang_success' => json_encode($lang['success']),
   'lang_danger' => json_encode($lang['danger']),
-  'lang_syncjobs' => json_encode($lang['syncjobs']),
   'docker_timeout' => $DOCKER_TIMEOUT,
   'session_lifetime' => (int)$SESSION_LIFETIME,
   'csrf_token' => $_SESSION['CSRF']['TOKEN'],

data/web/inc/functions.domain_admin.inc.php

@@ -429,25 +429,14 @@ function domain_admin_sso($_action, $_data) {
 
   switch ($_action) {
     case 'check':
-      $token = preg_replace('/[^a-zA-Z0-9-]/', '', $_data);
+      $token = $_data;
 
       $stmt = $pdo->prepare("SELECT `t1`.`username` FROM `da_sso` AS `t1` JOIN `admin` AS `t2` ON `t1`.`username` = `t2`.`username` WHERE `t1`.`token` = :token AND `t1`.`created` > DATE_SUB(NOW(), INTERVAL '30' SECOND) AND `t2`.`active` = 1 AND `t2`.`superadmin` = 0;");
       $stmt->execute(array(
-        ':token' => $token
+        ':token' => preg_replace('/[^a-zA-Z0-9-]/', '', $token)
       ));
       $return = $stmt->fetch(PDO::FETCH_ASSOC);
-      if (empty($return['username'])) {
-        return false;
-      }
-      // single-use: consume the token; if a concurrent request already used it, deny
-      $del = $pdo->prepare("DELETE FROM `da_sso` WHERE `token` = :token");
-      $del->execute(array(
-        ':token' => $token
-      ));
-      if ($del->rowCount() < 1) {
-        return false;
-      }
-      return $return['username'];
+      return empty($return['username']) ? false : $return['username'];
     case 'issue':
       if ($_SESSION['mailcow_cc_role'] != "admin") {
         $_SESSION['return'][] = array(

data/web/inc/functions.inc.php

@@ -53,39 +53,6 @@ function valid_network($network) {
 function valid_hostname($hostname) {
   return filter_var($hostname, FILTER_VALIDATE_DOMAIN, FILTER_FLAG_HOSTNAME);
 }
-// Validates a browser-style Origin: scheme://host[:port], no path/query/fragment/credentials
-function valid_origin($origin) {
-  $parts = parse_url($origin);
-  if ($parts === false || !isset($parts['scheme']) || !isset($parts['host'])) {
-    return false;
-  }
-  if (!in_array(strtolower($parts['scheme']), array('http', 'https'), true)) {
-    return false;
-  }
-  if (isset($parts['user']) || isset($parts['pass']) || isset($parts['path']) || isset($parts['query']) || isset($parts['fragment'])) {
-    return false;
-  }
-  $host = $parts['host'];
-  $host_without_brackets = trim($host, '[]');
-  if (!valid_hostname($host_without_brackets) && !filter_var($host_without_brackets, FILTER_VALIDATE_IP)) {
-    return false;
-  }
-  // Reject anything that doesn't round-trip to the exact same origin (e.g. stray trailing slash)
-  $port = isset($parts['port']) ? ':' . $parts['port'] : '';
-  $rebuilt = strtolower($parts['scheme']) . '://' . strtolower($host) . $port;
-  return strtolower($origin) === $rebuilt;
-}
-// Bring an origin into the exact form a browser sends it (scheme://host[:port], lowercase).
-function normalize_cors_origin($origin) {
-  $origin = trim($origin);
-  if ($origin === '*') {
-    return '*';
-  }
-  if ($origin !== '' && !preg_match('~^[a-z][a-z0-9+.-]*://~i', $origin)) {
-    $origin = 'https://' . $origin;
-  }
-  return valid_origin($origin) ? strtolower($origin) : false;
-}
 // Thanks to https://stackoverflow.com/a/49373789
 // Validates exact ip matches and ip-in-cidr, ipv4 and ipv6
 function ip_acl($ip, $networks) {
@@ -591,7 +558,7 @@ function logger($_data = false) {
       $type = $return['type'];
       $msg = null;
       if (isset($return['msg'])) {
-        $msg = json_encode($return['msg'], JSON_UNESCAPED_UNICODE | JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT);
+        $msg = json_encode($return['msg'], JSON_UNESCAPED_UNICODE);
       }
       $call = null;
       if (isset($return['log'])) {
@@ -633,18 +600,6 @@ function logger($_data = false) {
     return true;
   }
 }
-function is_local_mailcow_domain($domain) {
-  // True if domain is a locally managed, active primary or alias domain
-  global $pdo;
-  $domain = idn_to_ascii($domain, 0, INTL_IDNA_VARIANT_UTS46);
-  if (empty($domain)) {
-    return false;
-  }
-  $stmt = $pdo->prepare("SELECT 1 FROM `domain` WHERE `domain` = :d AND `active` = 1
-    UNION SELECT 1 FROM `alias_domain` WHERE `alias_domain` = :d2 AND `active` = 1 LIMIT 1");
-  $stmt->execute(array(':d' => $domain, ':d2' => $domain));
-  return (bool)$stmt->fetchColumn();
-}
 function hasDomainAccess($username, $role, $domain) {
   global $pdo;
   if (empty($domain) || !is_valid_domain_name($domain)) {
@@ -2328,13 +2283,10 @@ function cors($action, $data = null) {
         return false;
       }
 
-      $allowed_origins = isset($data['allowed_origins']) ? $data['allowed_origins'] : array(getBaseURL());
+      $allowed_origins = isset($data['allowed_origins']) ? $data['allowed_origins'] : array($_SERVER['SERVER_NAME']);
       $allowed_origins = !is_array($allowed_origins) ? array_filter(array_map('trim', explode("\n", $allowed_origins))) : $allowed_origins;
-      foreach ($allowed_origins as &$origin) {
-        if ($origin === '*') {
-          continue;
-        }
-        if (!valid_origin($origin)) {
+      foreach ($allowed_origins as $origin) {
+        if (!filter_var($origin, FILTER_VALIDATE_DOMAIN, FILTER_FLAG_HOSTNAME) && $origin != '*') {
           $_SESSION['return'][] = array(
             'type' => 'danger',
             'log' => array(__FUNCTION__, $action, $data),
@@ -2342,10 +2294,7 @@ function cors($action, $data = null) {
           );
           return false;
         }
-        // browsers always send a lowercase scheme/host in the Origin header, so normalize to match
-        $origin = strtolower($origin);
       }
-      unset($origin);
 
       $allowed_methods = isset($data['allowed_methods']) ? $data['allowed_methods'] : array('GET', 'POST', 'PUT', 'DELETE');
       $allowed_methods  = !is_array($allowed_methods) ? array_map('trim', preg_split( "/( |,|;|\n)/", $allowed_methods)) : $allowed_methods;
@@ -2393,35 +2342,26 @@ function cors($action, $data = null) {
         );
       }
 
-      $cors_settings                    = !$cors_settings ? array('allowed_origins' => getBaseURL(), 'allowed_methods' => 'GET, POST, PUT, DELETE') : $cors_settings;
-      $cors_settings['allowed_origins'] = empty($cors_settings['allowed_origins']) ? getBaseURL() : $cors_settings['allowed_origins'];
+      $cors_settings                    = !$cors_settings ? array('allowed_origins' => $_SERVER['SERVER_NAME'], 'allowed_methods' => 'GET, POST, PUT, DELETE') : $cors_settings;
+      $cors_settings['allowed_origins'] = empty($cors_settings['allowed_origins']) ? $_SERVER['SERVER_NAME'] : $cors_settings['allowed_origins'];
       $cors_settings['allowed_methods'] = empty($cors_settings['allowed_methods']) ? 'GET, POST, PUT, DELETE, OPTION' : $cors_settings['allowed_methods'];
 
       return $cors_settings;
     break;
     case "set_headers":
       $cors_settings = cors('get');
-      // normalize the stored list; it may still hold bare hostnames written before origins were validated as origins
-      $allowed_origins = array_filter(array_map('normalize_cors_origin', explode(',', $cors_settings['allowed_origins'])));
-      $origin = isset($_SERVER['HTTP_ORIGIN']) ? normalize_cors_origin($_SERVER['HTTP_ORIGIN']) : false;
       // check if requested origin is in allowed origins
-      $allow_origin = null;
-      if (in_array('*', $allowed_origins, true)) {
-        $allow_origin = '*';
-      } else if ($origin !== false && in_array($origin, $allowed_origins, true)) {
-        $allow_origin = $origin;
+      $allowed_origins = explode(', ', $cors_settings['allowed_origins']);
+      $cors_settings['allowed_origins'] = $allowed_origins[0];
+      if (in_array('*', $allowed_origins)){
+        $cors_settings['allowed_origins'] = '*';
+      } else if (array_key_exists('HTTP_ORIGIN', $_SERVER) && in_array($_SERVER['HTTP_ORIGIN'], $allowed_origins)) {
+        $cors_settings['allowed_origins'] = $_SERVER['HTTP_ORIGIN'];
       }
       // always allow OPTIONS for preflight request
       $cors_settings["allowed_methods"] = empty($cors_settings["allowed_methods"]) ? 'OPTIONS' : $cors_settings["allowed_methods"] . ', ' . 'OPTIONS';
 
-      // a disallowed origin gets no Access-Control-Allow-Origin at all; echoing a different origin than the requesting one tells a browser nothing
-      if ($allow_origin !== null) {
-        header('Access-Control-Allow-Origin: ' . $allow_origin);
-      }
-      if ($allow_origin !== '*') {
-        // the response depends on the request origin, keep caches from mixing them up
-        header('Vary: Origin', false);
-      }
+      header('Access-Control-Allow-Origin: ' . $cors_settings['allowed_origins']);
       header('Access-Control-Allow-Methods: '. $cors_settings['allowed_methods']);
       header('Access-Control-Allow-Headers: Accept, Content-Type, X-Api-Key, Origin');
 
@@ -3563,16 +3503,7 @@ function protect_route($allowed_roles = ['admin', 'domainadmin', 'user'], $redir
     if (isset($redirects['unauthenticated'])) {
       header('Location: ' . $redirects['unauthenticated']);
     } else {
-      // Send a deep link to the login page for its area instead of the user login at /,
-      // e.g. /admin/dashboard -> /admin rather than /
-      $request_uri = isset($_SERVER['REQUEST_URI']) ? $_SERVER['REQUEST_URI'] : '/';
-      if (strpos($request_uri, '/admin/') === 0) {
-        header('Location: /admin');
-      } elseif (strpos($request_uri, '/domainadmin/') === 0) {
-        header('Location: /domainadmin');
-      } else {
-        header('Location: /');
-      }
+      header('Location: /');
     }
     exit();
   }

data/web/inc/functions.mailbox.inc.php

@@ -41,15 +41,13 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
           else {
             $username = $_SESSION['mailcow_cc_username'];
           }
-          if (isset($_data["validity"])) {
-            if (!filter_var($_data["validity"], FILTER_VALIDATE_INT, array('options' => array('min_range' => 1, 'max_range' => 87600)))) {
-              $_SESSION['return'][] = array(
-                'type' => 'danger',
-                'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-                'msg' => 'validity_missing'
-              );
-              return false;
-            }
+          if (isset($_data["validity"]) && !filter_var($_data["validity"], FILTER_VALIDATE_INT, array('options' => array('min_range' => 1, 'max_range' => 87600)))) {
+            $_SESSION['return'][] = array(
+              'type' => 'danger',
+              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
+              'msg' => 'validity_missing'
+            );
+            return false;
           }
           else {
             // Default to 1 yr
@@ -62,8 +60,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
             $permanent = 0;
           }
           $domain = $_data['domain'];
-          // spamalias.description is NOT NULL, an absent description must not become a null insert
-          $description = $_data['description'] ?? '';
+          $description = $_data['description'];
           $valid_domains[] = mailbox('get', 'mailbox_details', $username)['domain'];
           $valid_alias_domains = user_get_alias_details($username)['alias_domains'];
           if (!empty($valid_alias_domains)) {
@@ -302,6 +299,192 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
             'msg' => array('mailbox_modified', $username)
           );
         break;
+        case 'syncjob':
+          if (!isset($_SESSION['acl']['syncjobs']) || $_SESSION['acl']['syncjobs'] != "1" ) {
+            $_SESSION['return'][] = array(
+              'type' => 'danger',
+              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
+              'msg' => 'access_denied'
+            );
+            return false;
+          }
+          if (isset($_data['username']) && filter_var($_data['username'], FILTER_VALIDATE_EMAIL)) {
+            if (!hasMailboxObjectAccess($_SESSION['mailcow_cc_username'], $_SESSION['mailcow_cc_role'], $_data['username'])) {
+              $_SESSION['return'][] = array(
+                'type' => 'danger',
+                'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
+                'msg' => 'access_denied'
+              );
+              return false;
+            }
+            else {
+              $username = $_data['username'];
+            }
+          }
+          elseif ($_SESSION['mailcow_cc_role'] == "user") {
+            $username = $_SESSION['mailcow_cc_username'];
+          }
+          else {
+            $_SESSION['return'][] = array(
+              'type' => 'danger',
+              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
+              'msg' => 'no_user_defined'
+            );
+            return false;
+          }
+          $active               = intval($_data['active']);
+          $subscribeall         = intval($_data['subscribeall']);
+          $delete2duplicates    = intval($_data['delete2duplicates']);
+          $delete1              = intval($_data['delete1']);
+          $delete2              = intval($_data['delete2']);
+          $timeout1             = intval($_data['timeout1']);
+          $timeout2             = intval($_data['timeout2']);
+          $skipcrossduplicates  = intval($_data['skipcrossduplicates']);
+          $automap              = intval($_data['automap']);
+          $dry                  = intval($_data['dry']);
+          $port1                = $_data['port1'];
+          $host1                = strtolower($_data['host1']);
+          $password1            = $_data['password1'];
+          $exclude              = $_data['exclude'];
+          $maxage               = $_data['maxage'];
+          $maxbytespersecond    = $_data['maxbytespersecond'];
+          $subfolder2           = $_data['subfolder2'];
+          $user1                = $_data['user1'];
+          $mins_interval        = $_data['mins_interval'];
+          $enc1                 = $_data['enc1'];
+          $custom_params        = (empty(trim($_data['custom_params']))) ? '' : trim($_data['custom_params']);
+
+          // validate custom params
+          foreach (explode('-', $custom_params) as $param){
+            if(empty($param)) continue;
+
+            // extract option
+            if (str_contains($param, '=')) $param = explode('=', $param)[0];
+            else $param = rtrim($param, ' ');
+            // remove first char if first char is -
+            if ($param[0] == '-') $param = ltrim($param, $param[0]);
+
+            if (str_contains($param, ' ')) {
+              // bad char
+              $_SESSION['return'][] = array(
+                'type' => 'danger',
+                'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
+                'msg' => 'bad character SPACE'
+              );
+              return false;
+            }
+
+            // check if param is whitelisted
+            if (!in_array(strtolower($param), $GLOBALS["IMAPSYNC_OPTIONS"]["whitelist"])){
+              // bad option
+              $_SESSION['return'][] = array(
+                'type' => 'danger',
+                'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
+                'msg' => 'bad option '. $param
+              );
+              return false;
+            }
+          }
+          if (empty($subfolder2)) {
+            $subfolder2 = "";
+          }
+          if (!isset($maxage) || !filter_var($maxage, FILTER_VALIDATE_INT, array('options' => array('min_range' => 1, 'max_range' => 32000)))) {
+            $maxage = "0";
+          }
+          if (!isset($timeout1) || !filter_var($timeout1, FILTER_VALIDATE_INT, array('options' => array('min_range' => 1, 'max_range' => 32000)))) {
+            $timeout1 = "600";
+          }
+          if (!isset($timeout2) || !filter_var($timeout2, FILTER_VALIDATE_INT, array('options' => array('min_range' => 1, 'max_range' => 32000)))) {
+            $timeout2 = "600";
+          }
+          if (!isset($maxbytespersecond) || !filter_var($maxbytespersecond, FILTER_VALIDATE_INT, array('options' => array('min_range' => 1, 'max_range' => 125000000)))) {
+            $maxbytespersecond = "0";
+          }
+          if (!filter_var($port1, FILTER_VALIDATE_INT, array('options' => array('min_range' => 1, 'max_range' => 65535)))) {
+            $_SESSION['return'][] = array(
+              'type' => 'danger',
+              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
+              'msg' => 'access_denied'
+            );
+            return false;
+          }
+          if (!filter_var($mins_interval, FILTER_VALIDATE_INT, array('options' => array('min_range' => 1, 'max_range' => 43800)))) {
+            $_SESSION['return'][] = array(
+              'type' => 'danger',
+              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
+              'msg' => 'access_denied'
+            );
+            return false;
+          }
+          // if (!is_valid_domain_name($host1)) {
+            // $_SESSION['return'][] = array(
+              // 'type' => 'danger',
+              // 'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
+              // 'msg' => 'access_denied'
+            // );
+            // return false;
+          // }
+          if ($enc1 != "TLS" && $enc1 != "SSL" && $enc1 != "PLAIN") {
+            $_SESSION['return'][] = array(
+              'type' => 'danger',
+              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
+              'msg' => 'access_denied'
+            );
+            return false;
+          }
+          if (@preg_match("/" . $exclude . "/", null) === false) {
+            $_SESSION['return'][] = array(
+              'type' => 'danger',
+              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
+              'msg' => 'access_denied'
+            );
+            return false;
+          }
+          $stmt = $pdo->prepare("SELECT '1' FROM `imapsync`
+            WHERE `user2` = :user2 AND `user1` = :user1 AND `host1` = :host1");
+          $stmt->execute(array(':user1' => $user1, ':user2' => $username, ':host1' => $host1));
+          $num_results = count($stmt->fetchAll(PDO::FETCH_ASSOC));
+          if ($num_results != 0) {
+            $_SESSION['return'][] = array(
+              'type' => 'danger',
+              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
+              'msg' => array('object_exists', htmlspecialchars($host1 . ' / ' . $user1))
+            );
+            return false;
+          }
+          $stmt = $pdo->prepare("INSERT INTO `imapsync` (`user2`, `exclude`, `delete1`, `delete2`, `timeout1`, `timeout2`, `automap`, `skipcrossduplicates`, `maxbytespersecond`, `subscribeall`, `dry`, `maxage`, `subfolder2`, `host1`, `authmech1`, `user1`, `password1`, `mins_interval`, `port1`, `enc1`, `delete2duplicates`, `custom_params`, `active`)
+            VALUES (:user2, :exclude, :delete1, :delete2, :timeout1, :timeout2, :automap, :skipcrossduplicates, :maxbytespersecond, :subscribeall, :dry, :maxage, :subfolder2, :host1, :authmech1, :user1, :password1, :mins_interval, :port1, :enc1, :delete2duplicates, :custom_params, :active)");
+          $stmt->execute(array(
+            ':user2' => $username,
+            ':custom_params' => $custom_params,
+            ':exclude' => $exclude,
+            ':maxage' => $maxage,
+            ':delete1' => $delete1,
+            ':delete2' => $delete2,
+            ':timeout1' => $timeout1,
+            ':timeout2' => $timeout2,
+            ':automap' => $automap,
+            ':skipcrossduplicates' => $skipcrossduplicates,
+            ':maxbytespersecond' => $maxbytespersecond,
+            ':subscribeall' => $subscribeall,
+            ':dry' => $dry,
+            ':subfolder2' => $subfolder2,
+            ':host1' => $host1,
+            ':authmech1' => 'PLAIN',
+            ':user1' => $user1,
+            ':password1' => $password1,
+            ':mins_interval' => $mins_interval,
+            ':port1' => $port1,
+            ':enc1' => $enc1,
+            ':delete2duplicates' => $delete2duplicates,
+            ':active' => $active,
+          ));
+          $_SESSION['return'][] = array(
+            'type' => 'success',
+            'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
+            'msg' => array('mailbox_modified', $username)
+          );
+        break;
         case 'domain':
           if ($_SESSION['mailcow_cc_role'] != "admin") {
             $_SESSION['return'][] = array(
@@ -564,18 +747,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
               $goto_domain = idn_to_ascii(substr(strstr($goto, '@'), 1), 0, INTL_IDNA_VARIANT_UTS46);
               $goto_local_part = strstr($goto, '@', true);
               $goto = $goto_local_part.'@'.$goto_domain;
-              // Deny external goto domains: global switch (all roles) overrides the per-DA ACL
-              if (($GLOBALS['ALIAS_DISABLE_EXTERNAL_DOMAINS'] === true ||
-                  (isset($_SESSION['acl']['alias_external_goto']) && $_SESSION['acl']['alias_external_goto'] != "1")) &&
-                  !is_local_mailcow_domain($goto_domain)) {
-                $_SESSION['return'][] = array(
-                  'type' => 'danger',
-                  'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-                  'msg' => array('external_goto_denied', htmlspecialchars($goto))
-                );
-                unset($gotos[$i]);
-                continue;
-              }
               $stmt = $pdo->prepare("SELECT `username` FROM `mailbox`
                 WHERE `kind` REGEXP 'location|thing|group'
                   AND `username`= :goto");
@@ -2094,6 +2265,234 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
             );
           }
         break;
+        case 'syncjob_settings':
+          if (!isset($_SESSION['mailcow_cc_role']) || $_SESSION['mailcow_cc_role'] != 'admin') {
+            $_SESSION['return'][] = array(
+              'type' => 'danger',
+              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
+              'msg' => 'access_denied'
+            );
+            return false;
+          }
+          $max_parallel = intval($_data['max_parallel']);
+          if ($max_parallel < 1)  { $max_parallel = 1; }
+          if ($max_parallel > 50) { $max_parallel = 50; }
+          $max_bps = intval($_data['max_bps']);
+          if ($max_bps < 0) { $max_bps = 0; }
+          try {
+            $redis->Set('SYNCJOBS_MAX_PARALLEL', $max_parallel);
+            $redis->Set('SYNCJOBS_MAX_BPS', $max_bps);
+          }
+          catch (RedisException $e) {
+            $_SESSION['return'][] = array(
+              'type' => 'danger',
+              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
+              'msg' => array('redis_error', $e->getMessage())
+            );
+            return false;
+          }
+          $_SESSION['return'][] = array(
+            'type' => 'success',
+            'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
+            'msg' => 'syncjob_settings_saved'
+          );
+        break;
+        case 'syncjob':
+          if (!is_array($_data['id'])) {
+            $ids = array();
+            $ids[] = $_data['id'];
+          }
+          else {
+            $ids = $_data['id'];
+          }
+          if (!isset($_SESSION['acl']['syncjobs']) || $_SESSION['acl']['syncjobs'] != "1" ) {
+            $_SESSION['return'][] = array(
+              'type' => 'danger',
+              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
+              'msg' => 'access_denied'
+            );
+            return false;
+          }
+          foreach ($ids as $id) {
+            $is_now = mailbox('get', 'syncjob_details', $id, array('with_password'));
+            if (!empty($is_now)) {
+              $username = $is_now['user2'];
+              $user1 = (!empty($_data['user1'])) ? $_data['user1'] : $is_now['user1'];
+              $active = (isset($_data['active'])) ? intval($_data['active']) : $is_now['active'];
+              $last_run = (isset($_data['last_run'])) ? NULL : $is_now['last_run'];
+              $success = (isset($_data['success'])) ? NULL : $is_now['success'];
+              $delete2duplicates = (isset($_data['delete2duplicates'])) ? intval($_data['delete2duplicates']) : $is_now['delete2duplicates'];
+              $subscribeall = (isset($_data['subscribeall'])) ? intval($_data['subscribeall']) : $is_now['subscribeall'];
+              $dry = (isset($_data['dry'])) ? intval($_data['dry']) : $is_now['dry'];
+              $delete1 = (isset($_data['delete1'])) ? intval($_data['delete1']) : $is_now['delete1'];
+              $delete2 = (isset($_data['delete2'])) ? intval($_data['delete2']) : $is_now['delete2'];
+              $automap = (isset($_data['automap'])) ? intval($_data['automap']) : $is_now['automap'];
+              $skipcrossduplicates = (isset($_data['skipcrossduplicates'])) ? intval($_data['skipcrossduplicates']) : $is_now['skipcrossduplicates'];
+              $port1 = (!empty($_data['port1'])) ? $_data['port1'] : $is_now['port1'];
+              $password1 = (!empty($_data['password1'])) ? $_data['password1'] : $is_now['password1'];
+              $host1 = (!empty($_data['host1'])) ? $_data['host1'] : $is_now['host1'];
+              $subfolder2 = (isset($_data['subfolder2'])) ? $_data['subfolder2'] : $is_now['subfolder2'];
+              $enc1 = (!empty($_data['enc1'])) ? $_data['enc1'] : $is_now['enc1'];
+              $mins_interval = (!empty($_data['mins_interval'])) ? $_data['mins_interval'] : $is_now['mins_interval'];
+              $exclude = (isset($_data['exclude'])) ? $_data['exclude'] : $is_now['exclude'];
+              $custom_params = (isset($_data['custom_params'])) ? $_data['custom_params'] : $is_now['custom_params'];
+              $maxage = (isset($_data['maxage']) && $_data['maxage'] != "") ? intval($_data['maxage']) : $is_now['maxage'];
+              $maxbytespersecond = (isset($_data['maxbytespersecond']) && $_data['maxbytespersecond'] != "") ? intval($_data['maxbytespersecond']) : $is_now['maxbytespersecond'];
+              $timeout1 = (isset($_data['timeout1']) && $_data['timeout1'] != "") ? intval($_data['timeout1']) : $is_now['timeout1'];
+              $timeout2 = (isset($_data['timeout2']) && $_data['timeout2'] != "") ? intval($_data['timeout2']) : $is_now['timeout2'];
+            }
+            else {
+              $_SESSION['return'][] = array(
+                'type' => 'danger',
+                'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
+                'msg' => 'access_denied'
+              );
+              continue;
+            }
+
+            // validate custom params
+            foreach (explode('-', $custom_params) as $param){
+              if(empty($param)) continue;
+
+              // extract option
+              if (str_contains($param, '=')) $param = explode('=', $param)[0];
+              else $param = rtrim($param, ' ');
+              // remove first char if first char is -
+              if ($param[0] == '-') $param = ltrim($param, $param[0]);
+
+              if (str_contains($param, ' ')) {
+                // bad char
+                $_SESSION['return'][] = array(
+                  'type' => 'danger',
+                  'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
+                  'msg' => 'bad character SPACE'
+                );
+                return false;
+              }
+
+              // check if param is whitelisted
+              if (!in_array(strtolower($param), $GLOBALS["IMAPSYNC_OPTIONS"]["whitelist"])){
+                // bad option
+                $_SESSION['return'][] = array(
+                  'type' => 'danger',
+                  'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
+                  'msg' => 'bad option '. $param
+                );
+                return false;
+              }
+            }
+            if (empty($subfolder2)) {
+              $subfolder2 = "";
+            }
+            if (!isset($maxage) || !filter_var($maxage, FILTER_VALIDATE_INT, array('options' => array('min_range' => 1, 'max_range' => 32000)))) {
+              $maxage = "0";
+            }
+            if (!isset($timeout1) || !filter_var($timeout1, FILTER_VALIDATE_INT, array('options' => array('min_range' => 1, 'max_range' => 32000)))) {
+              $timeout1 = "600";
+            }
+            if (!isset($timeout2) || !filter_var($timeout2, FILTER_VALIDATE_INT, array('options' => array('min_range' => 1, 'max_range' => 32000)))) {
+              $timeout2 = "600";
+            }
+            if (!isset($maxbytespersecond) || !filter_var($maxbytespersecond, FILTER_VALIDATE_INT, array('options' => array('min_range' => 1, 'max_range' => 125000000)))) {
+              $maxbytespersecond = "0";
+            }
+            if (!filter_var($port1, FILTER_VALIDATE_INT, array('options' => array('min_range' => 1, 'max_range' => 65535)))) {
+              $_SESSION['return'][] = array(
+                'type' => 'danger',
+                'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
+                'msg' => 'access_denied'
+              );
+              continue;
+            }
+            if (!filter_var($mins_interval, FILTER_VALIDATE_INT, array('options' => array('min_range' => 1, 'max_range' => 43800)))) {
+              $_SESSION['return'][] = array(
+                'type' => 'danger',
+                'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
+                'msg' => 'access_denied'
+              );
+              continue;
+            }
+            if (!is_valid_domain_name($host1)) {
+              $_SESSION['return'][] = array(
+                'type' => 'danger',
+                'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
+                'msg' => 'access_denied'
+              );
+              continue;
+            }
+            if ($enc1 != "TLS" && $enc1 != "SSL" && $enc1 != "PLAIN") {
+              $_SESSION['return'][] = array(
+                'type' => 'danger',
+                'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
+                'msg' => 'access_denied'
+              );
+              continue;
+            }
+            if (@preg_match("/" . $exclude . "/", null) === false) {
+              $_SESSION['return'][] = array(
+                'type' => 'danger',
+                'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
+                'msg' => 'access_denied'
+              );
+              continue;
+            }
+            $stmt = $pdo->prepare("UPDATE `imapsync` SET `delete1` = :delete1,
+              `delete2` = :delete2,
+              `automap` = :automap,
+              `skipcrossduplicates` = :skipcrossduplicates,
+              `maxage` = :maxage,
+              `maxbytespersecond` = :maxbytespersecond,
+              `subfolder2` = :subfolder2,
+              `exclude` = :exclude,
+              `host1` = :host1,
+              `last_run` = :last_run,
+              `success` = :success,
+              `user1` = :user1,
+              `password1` = :password1,
+              `mins_interval` = :mins_interval,
+              `port1` = :port1,
+              `enc1` = :enc1,
+              `delete2duplicates` = :delete2duplicates,
+              `custom_params` = :custom_params,
+              `timeout1` = :timeout1,
+              `timeout2` = :timeout2,
+              `subscribeall` = :subscribeall,
+              `dry` = :dry,
+              `active` = :active
+                WHERE `id` = :id");
+            $stmt->execute(array(
+              ':delete1' => $delete1,
+              ':delete2' => $delete2,
+              ':automap' => $automap,
+              ':skipcrossduplicates' => $skipcrossduplicates,
+              ':id' => $id,
+              ':exclude' => $exclude,
+              ':maxage' => $maxage,
+              ':maxbytespersecond' => $maxbytespersecond,
+              ':subfolder2' => $subfolder2,
+              ':host1' => $host1,
+              ':user1' => $user1,
+              ':password1' => $password1,
+              ':last_run' => $last_run,
+              ':success' => $success,
+              ':mins_interval' => $mins_interval,
+              ':port1' => $port1,
+              ':enc1' => $enc1,
+              ':delete2duplicates' => $delete2duplicates,
+              ':custom_params' => $custom_params,
+              ':timeout1' => $timeout1,
+              ':timeout2' => $timeout2,
+              ':subscribeall' => $subscribeall,
+              ':dry' => $dry,
+              ':active' => $active,
+            ));
+            $_SESSION['return'][] = array(
+              'type' => 'success',
+              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
+              'msg' => array('mailbox_modified', $username)
+            );
+          }
+        break;
         case 'filter':
           if (!isset($_SESSION['acl']['filters']) || $_SESSION['acl']['filters'] != "1" ) {
             $_SESSION['return'][] = array(
@@ -2345,19 +2744,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
                   unset($gotos[$i]);
                   continue;
                 }
-                // Deny external goto domains: global switch (all roles) overrides the per-DA ACL
-                $goto_domain = idn_to_ascii(substr(strstr($goto, '@'), 1), 0, INTL_IDNA_VARIANT_UTS46);
-                if (($GLOBALS['ALIAS_DISABLE_EXTERNAL_DOMAINS'] === true ||
-                    (isset($_SESSION['acl']['alias_external_goto']) && $_SESSION['acl']['alias_external_goto'] != "1")) &&
-                    !is_local_mailcow_domain($goto_domain)) {
-                  $_SESSION['return'][] = array(
-                    'type' => 'danger',
-                    'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-                    'msg' => array('external_goto_denied', htmlspecialchars($goto))
-                  );
-                  unset($gotos[$i]);
-                  continue;
-                }
                 if ($goto == $address) {
                   $_SESSION['return'][] = array(
                     'type' => 'danger',
@@ -3151,6 +3537,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
             // Track affected mailboxes for SOGo update
             $update_sogo_mailboxes[] = $username;
           }
+          return true;
         break;
         case 'mailbox_rename':
           $domain = $_data['domain'];
@@ -3473,7 +3860,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
             $attr["rl_frame"]                    = (!empty($_data['rl_frame'])) ? $_data['rl_frame'] : $is_now['rl_frame'];
             $attr["rl_value"]                    = (!empty($_data['rl_value'])) ? $_data['rl_value'] : $is_now['rl_value'];
             $attr["force_pw_update"]             = isset($_data['force_pw_update']) ? intval($_data['force_pw_update']) : $is_now['force_pw_update'];
-            $attr["force_tfa"]                   = isset($_data['force_tfa']) ? intval($_data['force_tfa']) : $is_now['force_tfa'];
             $attr["sogo_access"]                 = isset($_data['sogo_access']) ? intval($_data['sogo_access']) : $is_now['sogo_access'];
             $attr["active"]                      = isset($_data['active']) ? intval($_data['active']) : $is_now['active'];
             $attr["tls_enforce_in"]              = isset($_data['tls_enforce_in']) ? intval($_data['tls_enforce_in']) : $is_now['tls_enforce_in'];
@@ -4221,6 +4607,89 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
           }
           return false;
         break;
+        case 'syncjob_details':
+          $syncjobdetails = array();
+          if (!is_numeric($_data)) {
+            return false;
+          }
+          if (isset($_extra) && in_array('no_log', $_extra)) {
+            $field_query = $pdo->query('SHOW FIELDS FROM `imapsync` WHERE FIELD NOT IN ("returned_text", "password1")');
+            $fields = $field_query->fetchAll(PDO::FETCH_ASSOC);
+            while($field = array_shift($fields)) {
+              $shown_fields[] = $field['Field'];
+            }
+            $stmt = $pdo->prepare("SELECT " . implode(',', (array)$shown_fields) . ",
+              `active`
+                FROM `imapsync` WHERE id = :id");
+          }
+          elseif (isset($_extra) && in_array('with_password', $_extra)) {
+            $stmt = $pdo->prepare("SELECT *,
+              `active`
+                FROM `imapsync` WHERE id = :id");
+          }
+          else {
+            $field_query = $pdo->query('SHOW FIELDS FROM `imapsync` WHERE FIELD NOT IN ("password1")');
+            $fields = $field_query->fetchAll(PDO::FETCH_ASSOC);
+            while($field = array_shift($fields)) {
+              $shown_fields[] = $field['Field'];
+            }
+            $stmt = $pdo->prepare("SELECT " . implode(',', (array)$shown_fields) . ",
+              `active`
+                FROM `imapsync` WHERE id = :id");
+          }
+          $stmt->execute(array(':id' => $_data));
+          $syncjobdetails = $stmt->fetch(PDO::FETCH_ASSOC);
+          if (!empty($syncjobdetails['returned_text'])) {
+            $syncjobdetails['log'] = $syncjobdetails['returned_text'];
+          }
+          else {
+            $syncjobdetails['log'] = '';
+          }
+          unset($syncjobdetails['returned_text']);
+          if (!hasMailboxObjectAccess($_SESSION['mailcow_cc_username'], $_SESSION['mailcow_cc_role'], $syncjobdetails['user2'])) {
+            return false;
+          }
+          return $syncjobdetails;
+        break;
+        case 'syncjob_settings':
+          if (!isset($_SESSION['mailcow_cc_role']) || $_SESSION['mailcow_cc_role'] != 'admin') {
+            return false;
+          }
+          $settings = array();
+          try {
+            $max_parallel = $redis->Get('SYNCJOBS_MAX_PARALLEL');
+          }
+          catch (RedisException $e) {
+            $max_parallel = null;
+          }
+          $settings['max_parallel'] = intval($max_parallel) ?: 1;
+          try {
+            $max_bps = $redis->Get('SYNCJOBS_MAX_BPS');
+          }
+          catch (RedisException $e) {
+            $max_bps = null;
+          }
+          $settings['max_bps'] = intval($max_bps) ?: 0;
+          return $settings;
+        break;
+        case 'syncjobs':
+          $syncjobdata = array();
+          if (isset($_data) && filter_var($_data, FILTER_VALIDATE_EMAIL)) {
+            if (!hasMailboxObjectAccess($_SESSION['mailcow_cc_username'], $_SESSION['mailcow_cc_role'], $_data)) {
+              return false;
+            }
+          }
+          else {
+            $_data = $_SESSION['mailcow_cc_username'];
+          }
+          $stmt = $pdo->prepare("SELECT `id` FROM `imapsync` WHERE `user2` = :username");
+          $stmt->execute(array(':username' => $_data));
+          $rows = $stmt->fetchAll(PDO::FETCH_ASSOC);
+          while($row = array_shift($rows)) {
+            $syncjobdata[] = $row['id'];
+          }
+          return $syncjobdata;
+        break;
         case 'spam_score':
           $curl = curl_init();
           curl_setopt($curl, CURLOPT_UNIX_SOCKET_PATH, '/var/lib/rspamd/rspamd.sock');
@@ -4904,14 +5373,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
               $mailboxdata['rl_scope'] = 'domain';
             }
             $mailboxdata['is_relayed'] = $row['backupmx'];
-            // Internal send-as ACL for this mailbox, mirrors the sender_acl field accepted by edit/mailbox
-            $mailboxdata['sender_acl'] = array();
-            $stmt = $pdo->prepare("SELECT `send_as` FROM `sender_acl` WHERE `logged_in_as` = :username AND `external` = '0'");
-            $stmt->execute(array(':username' => $_data));
-            $sender_acl_rows = $stmt->fetchAll(PDO::FETCH_ASSOC);
-            foreach ($sender_acl_rows as $sender_acl_row) {
-              $mailboxdata['sender_acl'][] = $sender_acl_row['send_as'];
-            }
           }
           $stmt = $pdo->prepare("SELECT `tag_name`
             FROM `tags_mailbox` WHERE `username`= :username");
@@ -5050,6 +5511,46 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
     break;
     case 'delete':
       switch ($_type) {
+        case 'syncjob':
+          if (!is_array($_data['id'])) {
+            $ids = array();
+            $ids[] = $_data['id'];
+          }
+          else {
+            $ids = $_data['id'];
+          }
+          if (!isset($_SESSION['acl']['syncjobs']) || $_SESSION['acl']['syncjobs'] != "1" ) {
+            $_SESSION['return'][] = array(
+              'type' => 'danger',
+              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
+              'msg' => 'access_denied'
+            );
+            return false;
+          }
+          foreach ($ids as $id) {
+            if (!is_numeric($id)) {
+              return false;
+            }
+            $stmt = $pdo->prepare("SELECT `user2` FROM `imapsync` WHERE id = :id");
+            $stmt->execute(array(':id' => $id));
+            $user2 = $stmt->fetch(PDO::FETCH_ASSOC)['user2'];
+            if (!hasMailboxObjectAccess($_SESSION['mailcow_cc_username'], $_SESSION['mailcow_cc_role'], $user2)) {
+              $_SESSION['return'][] = array(
+                'type' => 'danger',
+                'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
+                'msg' => 'access_denied'
+              );
+              continue;
+            }
+            $stmt = $pdo->prepare("DELETE FROM `imapsync` WHERE `id`= :id");
+            $stmt->execute(array(':id' => $id));
+            $_SESSION['return'][] = array(
+              'type' => 'success',
+              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
+              'msg' => array('deleted_syncjob', $id)
+            );
+          }
+        break;
         case 'filter':
           if (!is_array($_data['id'])) {
             $ids = array();
@@ -5199,11 +5700,8 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
             $stmt->execute(array(
               ':username' => $username
             ));
-            // bind LIKE pattern + escape LIKE wildcards so the value matches literally (no SQLi, no over-match)
-            $c_object_like = '%/' . addcslashes($username, '\\%_') . '/%';
-            $stmt = $pdo->prepare("DELETE FROM `sogo_acl` WHERE `c_object` LIKE :c_object_like OR `c_uid` = :username");
+            $stmt = $pdo->prepare("DELETE FROM `sogo_acl` WHERE `c_object` LIKE '%/" . $username . "/%' OR `c_uid` = :username");
             $stmt->execute(array(
-              ':c_object_like' => $c_object_like,
               ':username' => $username
             ));
             $stmt = $pdo->prepare("DELETE FROM `sogo_store` WHERE `c_folder_id` IN (SELECT `c_folder_id` FROM `sogo_folder_info` WHERE `c_path2` = :username)");
@@ -5599,11 +6097,8 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
             $stmt->execute(array(
               ':username' => $username
             ));
-            // bind LIKE pattern + escape LIKE wildcards so the value matches literally (no SQLi, no over-match)
-            $c_object_like = '%/' . addcslashes($username, '\\%_') . '/%';
-            $stmt = $pdo->prepare("DELETE FROM `sogo_acl` WHERE `c_object` LIKE :c_object_like OR `c_uid` = :username");
+            $stmt = $pdo->prepare("DELETE FROM `sogo_acl` WHERE `c_object` LIKE '%/" . str_replace('%', '\%', $username) . "/%' OR `c_uid` = :username");
             $stmt->execute(array(
-              ':c_object_like' => $c_object_like,
               ':username' => $username
             ));
             $stmt = $pdo->prepare("DELETE FROM `sogo_store` WHERE `c_folder_id` IN (SELECT `c_folder_id` FROM `sogo_folder_info` WHERE `c_path2` = :username)");
@@ -5685,6 +6180,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
             // Track affected mailboxes for SOGo update
             $update_sogo_mailboxes[] = $username;
           }
+          return true;
         break;
         case 'mailbox_templates':
           if ($_SESSION['mailcow_cc_role'] != "admin") {
@@ -5759,11 +6255,8 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
             $stmt->execute(array(
               ':username' => $name
             ));
-            // bind LIKE pattern + escape LIKE wildcards so the value matches literally (no SQLi, no over-match)
-            $c_object_like = '%/' . addcslashes($name, '\\%_') . '/%';
-            $stmt = $pdo->prepare("DELETE FROM `sogo_acl` WHERE `c_object` LIKE :c_object_like OR `c_uid` = :username");
+            $stmt = $pdo->prepare("DELETE FROM `sogo_acl` WHERE `c_object` LIKE '%/" . $name . "/%' OR `c_uid` = :username");
             $stmt->execute(array(
-              ':c_object_like' => $c_object_like,
               ':username' => $name
             ));
             $stmt = $pdo->prepare("DELETE FROM `sogo_store` WHERE `c_folder_id` IN (SELECT `c_folder_id` FROM `sogo_folder_info` WHERE `c_path2` = :username)");

data/web/inc/functions.quarantine.inc.php

@@ -22,7 +22,7 @@ function quarantine($_action, $_data = null) {
         return false;
       }
       $stmt = $pdo->prepare('SELECT `id` FROM `quarantine` LEFT OUTER JOIN `user_acl` ON `user_acl`.`username` = `rcpt`
-        WHERE `qhash` = :hash
+        WHERE `qhash` = :hash
           AND user_acl.quarantine = 1
           AND rcpt IN (SELECT username FROM mailbox)');
       $stmt->execute(array(':hash' => $hash));
@@ -65,7 +65,7 @@ function quarantine($_action, $_data = null) {
         return false;
       }
       $stmt = $pdo->prepare('SELECT `id` FROM `quarantine` LEFT OUTER JOIN `user_acl` ON `user_acl`.`username` = `rcpt`
-        WHERE `qhash` = :hash
+        WHERE `qhash` = :hash
           AND `user_acl`.`quarantine` = 1
           AND `username` IN (SELECT `username` FROM `mailbox`)');
       $stmt->execute(array(':hash' => $hash));
@@ -170,8 +170,6 @@ function quarantine($_action, $_data = null) {
         }
         elseif ($release_format == 'raw') {
           $detail_row['msg'] = preg_replace('/^X-Spam-Flag: (.*)/m', 'X-Pre-Release-Spam-Flag: $1', $detail_row['msg']);
-          // dot-stuffing per RFC5321 4.5.2: escape leading dots
-          $detail_row['msg'] = preg_replace('~^\.~m', '..', $detail_row['msg']);
           $postfix_talk = array(
             array('220', 'HELO quarantine' . chr(10)),
             array('250', 'MAIL FROM: ' . $sender . chr(10)),
@@ -182,7 +180,7 @@ function quarantine($_action, $_data = null) {
             array('221', '')
           );
           // Thanks to https://stackoverflow.com/questions/6632399/given-an-email-as-raw-text-how-can-i-send-it-using-php
-          $smtp_connection = fsockopen($postfix, 590, $errno, $errstr, 1);
+          $smtp_connection = fsockopen($postfix, 590, $errno, $errstr, 1); 
           if (!$smtp_connection) {
             logger(array('return' => array(
               array(
@@ -194,7 +192,7 @@ function quarantine($_action, $_data = null) {
             return false;
           }
           for ($i=0; $i < count($postfix_talk); $i++) {
-            $smtp_resource = fgets($smtp_connection, 256);
+            $smtp_resource = fgets($smtp_connection, 256); 
             if (substr($smtp_resource, 0, 3) !== $postfix_talk[$i][0]) {
               $ret = substr($smtp_resource, 0, 3);
               $ret = (empty($ret)) ? '-' : $ret;
@@ -467,19 +465,17 @@ function quarantine($_action, $_data = null) {
           }
           elseif ($release_format == 'raw') {
             $row['msg'] = preg_replace('/^X-Spam-Flag: (.*)/m', 'X-Pre-Release-Spam-Flag: $1', $row['msg']);
-            // dot-stuffing per RFC5321 4.5.2: escape leading dots
-            $row['msg'] = preg_replace('~^\.~m', '..', $row['msg']);
             $postfix_talk = array(
               array('220', 'HELO quarantine' . chr(10)),
               array('250', 'MAIL FROM: ' . $sender . chr(10)),
               array('250', 'RCPT TO: ' . $row['rcpt'] . chr(10)),
               array('250', 'DATA' . chr(10)),
-              array('354', $row['msg'] . chr(10) . '.' . chr(10)),
+              array('354', str_replace("\n.", '', $row['msg']) . chr(10) . '.' . chr(10)),
               array('250', 'QUIT' . chr(10)),
               array('221', '')
             );
             // Thanks to https://stackoverflow.com/questions/6632399/given-an-email-as-raw-text-how-can-i-send-it-using-php
-            $smtp_connection = fsockopen($postfix, 590, $errno, $errstr, 1);
+            $smtp_connection = fsockopen($postfix, 590, $errno, $errstr, 1); 
             if (!$smtp_connection) {
               $_SESSION['return'][] = array(
                 'type' => 'warning',
@@ -489,7 +485,7 @@ function quarantine($_action, $_data = null) {
               return false;
             }
             for ($i=0; $i < count($postfix_talk); $i++) {
-              $smtp_resource = fgets($smtp_connection, 256);
+              $smtp_resource = fgets($smtp_connection, 256); 
               if (substr($smtp_resource, 0, 3) !== $postfix_talk[$i][0]) {
                 $ret = substr($smtp_resource, 0, 3);
                 $ret = (empty($ret)) ? '-' : $ret;
@@ -837,7 +833,7 @@ function quarantine($_action, $_data = null) {
         )));
         return false;
       }
-      $stmt = $pdo->prepare('SELECT * FROM `quarantine` WHERE `qhash` = :hash');
+      $stmt = $pdo->prepare('SELECT * FROM `quarantine` WHERE `qhash` = :hash');
       $stmt->execute(array(':hash' => $hash));
       return $stmt->fetch(PDO::FETCH_ASSOC);
     break;

data/web/inc/init_db.inc.php

@@ -4,7 +4,7 @@ function init_db_schema()
   try {
     global $pdo;
 
-    $db_version = "19082026_0900";
+    $db_version = "19022026_1220";
 
     $stmt = $pdo->query("SHOW TABLES LIKE 'versions'");
     $num_results = count($stmt->fetchAll(PDO::FETCH_ASSOC));
@@ -719,8 +719,7 @@ function init_db_schema()
           "alias_domains" => "TINYINT(1) NOT NULL DEFAULT '0'",
           "mailbox_relayhost" => "TINYINT(1) NOT NULL DEFAULT '1'",
           "domain_relayhost" => "TINYINT(1) NOT NULL DEFAULT '1'",
-          "domain_desc" => "TINYINT(1) NOT NULL DEFAULT '0'",
-          "alias_external_goto" => "TINYINT(1) NOT NULL DEFAULT '1'"
+          "domain_desc" => "TINYINT(1) NOT NULL DEFAULT '0'"
         ),
         "keys" => array(
           "primary" => array(
@@ -755,145 +754,35 @@ function init_db_schema()
         ),
         "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC"
       ),
-      "imapsync_source" => array(
-        "cols" => array(
-          "id" => "INT NOT NULL AUTO_INCREMENT",
-          "name" => "VARCHAR(100) NOT NULL",
-          "description" => "VARCHAR(255) NOT NULL DEFAULT ''",
-          "created_by" => "VARCHAR(255) NOT NULL DEFAULT ''",
-          "scope" => "ENUM('all','domain','user') NOT NULL DEFAULT 'user'",
-          "host1" => "VARCHAR(255) NOT NULL",
-          "port1" => "SMALLINT UNSIGNED NOT NULL",
-          "enc1" => "ENUM('TLS','SSL','PLAIN') DEFAULT 'TLS'",
-          "auth_type" => "ENUM('PLAIN','LOGIN','CRAM-MD5','XOAUTH2') DEFAULT 'PLAIN'",
-          "oauth_flow" => "ENUM('client_credentials','authorization_code') NOT NULL DEFAULT 'client_credentials'",
-          "oauth_token_endpoint" => "VARCHAR(500) DEFAULT NULL",
-          "oauth_authorize_endpoint" => "VARCHAR(500) DEFAULT NULL",
-          "oauth_userinfo_endpoint" => "VARCHAR(500) DEFAULT NULL",
-          "oauth_client_id" => "VARCHAR(500) DEFAULT NULL",
-          "oauth_client_secret" => "VARCHAR(500) DEFAULT NULL",
-          "oauth_scope" => "VARCHAR(500) DEFAULT NULL",
-          "oauth_extra_params" => "TEXT DEFAULT NULL",
-          "oauth_access_token" => "TEXT DEFAULT NULL",
-          "oauth_token_expires" => "BIGINT UNSIGNED DEFAULT NULL",
-          "oauth_last_refresh_error" => "TEXT DEFAULT NULL",
-          "created" => "DATETIME(0) NOT NULL DEFAULT NOW(0)",
-          "modified" => "DATETIME ON UPDATE CURRENT_TIMESTAMP",
-          "active" => "TINYINT(1) NOT NULL DEFAULT '1'"
-        ),
-        "keys" => array(
-          "primary" => array(
-            "" => array("id")
-          ),
-          "unique" => array(
-            "uniq_creator_name" => array("created_by", "name")
-          ),
-          "key" => array(
-            "idx_created_by" => array("created_by"),
-            "idx_scope" => array("scope")
-          )
-        ),
-        "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC"
-      ),
-      "imapsync_source_domain" => array(
-        "cols" => array(
-          "source_id" => "INT NOT NULL",
-          "domain" => "VARCHAR(255) NOT NULL"
-        ),
-        "keys" => array(
-          "primary" => array(
-            "" => array("source_id", "domain")
-          ),
-          "key" => array(
-            "idx_domain" => array("domain")
-          ),
-          "fkey" => array(
-            "fk_imapsync_source_domain" => array(
-              "col" => "source_id",
-              "ref" => "imapsync_source.id",
-              "delete" => "CASCADE",
-              "update" => "NO ACTION"
-            )
-          )
-        ),
-        "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC"
-      ),
-      "imapsync_source_user" => array(
-        "cols" => array(
-          "source_id" => "INT NOT NULL",
-          "username" => "VARCHAR(255) NOT NULL"
-        ),
-        "keys" => array(
-          "primary" => array(
-            "" => array("source_id", "username")
-          ),
-          "key" => array(
-            "idx_username" => array("username")
-          ),
-          "fkey" => array(
-            "fk_imapsync_source_user" => array(
-              "col" => "source_id",
-              "ref" => "imapsync_source.id",
-              "delete" => "CASCADE",
-              "update" => "NO ACTION"
-            )
-          )
-        ),
-        "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC"
-      ),
-      "imapsync_source_oauth_token" => array(
-        "cols" => array(
-          "source_id" => "INT NOT NULL",
-          "username" => "VARCHAR(255) NOT NULL",
-          "access_token" => "TEXT DEFAULT NULL",
-          "refresh_token" => "TEXT DEFAULT NULL",
-          "token_expires" => "BIGINT UNSIGNED DEFAULT NULL",
-          "last_refresh_error" => "TEXT DEFAULT NULL",
-          "created" => "DATETIME(0) NOT NULL DEFAULT NOW(0)",
-          "modified" => "DATETIME ON UPDATE CURRENT_TIMESTAMP"
-        ),
-        "keys" => array(
-          "primary" => array(
-            "" => array("source_id", "username")
-          ),
-          "fkey" => array(
-            "fk_imapsync_source_oauth_token" => array(
-              "col" => "source_id",
-              "ref" => "imapsync_source.id",
-              "delete" => "CASCADE",
-              "update" => "NO ACTION"
-            )
-          )
-        ),
-        "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC"
-      ),
       "imapsync" => array(
         "cols" => array(
           "id" => "INT NOT NULL AUTO_INCREMENT",
           "user2" => "VARCHAR(255) NOT NULL",
-          "source_id" => "INT NOT NULL",
+          "host1" => "VARCHAR(255) NOT NULL",
+          "authmech1" => "ENUM('PLAIN','LOGIN','CRAM-MD5') DEFAULT 'PLAIN'",
           "regextrans2" => "VARCHAR(255) DEFAULT ''",
           "authmd51" => "TINYINT(1) NOT NULL DEFAULT 0",
           "domain2" => "VARCHAR(255) NOT NULL DEFAULT ''",
           "subfolder2" => "VARCHAR(255) NOT NULL DEFAULT ''",
           "user1" => "VARCHAR(255) NOT NULL",
-          "password1" => "VARCHAR(255) NOT NULL DEFAULT ''",
+          "password1" => "VARCHAR(255) NOT NULL",
           "exclude" => "VARCHAR(500) NOT NULL DEFAULT ''",
           "maxage" => "SMALLINT NOT NULL DEFAULT '0'",
           "mins_interval" => "SMALLINT UNSIGNED NOT NULL DEFAULT '0'",
           "maxbytespersecond" => "VARCHAR(50) NOT NULL DEFAULT '0'",
+          "port1" => "SMALLINT UNSIGNED NOT NULL",
+          "enc1" => "ENUM('TLS','SSL','PLAIN') DEFAULT 'TLS'",
           "delete2duplicates" => "TINYINT(1) NOT NULL DEFAULT '1'",
           "delete1" => "TINYINT(1) NOT NULL DEFAULT '0'",
           "delete2" => "TINYINT(1) NOT NULL DEFAULT '0'",
           "automap" => "TINYINT(1) NOT NULL DEFAULT '0'",
           "skipcrossduplicates" => "TINYINT(1) NOT NULL DEFAULT '0'",
-          "custom_params" => "TEXT",
+          "custom_params" => "VARCHAR(512) NOT NULL DEFAULT ''",
           "timeout1" => "SMALLINT NOT NULL DEFAULT '600'",
           "timeout2" => "SMALLINT NOT NULL DEFAULT '600'",
           "subscribeall" => "TINYINT(1) NOT NULL DEFAULT '1'",
           "dry" => "TINYINT(1) NOT NULL DEFAULT '0'",
           "is_running" => "TINYINT(1) NOT NULL DEFAULT '0'",
-          "prio" => "INT NOT NULL DEFAULT 0",
           "returned_text" => "LONGTEXT",
           "last_run" => "TIMESTAMP NULL DEFAULT NULL",
           "success" => "TINYINT(1) UNSIGNED DEFAULT NULL",
@@ -905,32 +794,6 @@ function init_db_schema()
         "keys" => array(
           "primary" => array(
             "" => array("id")
-          ),
-          "key" => array(
-            "idx_source_id" => array("source_id"),
-            "idx_prio" => array("prio")
-          ),
-          "fkey" => array(
-            "fk_imapsync_source" => array(
-              "col" => "source_id",
-              "ref" => "imapsync_source.id",
-              "delete" => "RESTRICT",
-              "update" => "NO ACTION"
-            )
-          )
-        ),
-        "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC"
-      ),
-      "imapsync_settings" => array(
-        "cols" => array(
-          "name" => "VARCHAR(64) NOT NULL",
-          "value" => "VARCHAR(255) NOT NULL",
-          "created" => "DATETIME(0) NOT NULL DEFAULT NOW(0)",
-          "modified" => "DATETIME ON UPDATE CURRENT_TIMESTAMP"
-        ),
-        "keys" => array(
-          "primary" => array(
-            "" => array("name")
           )
         ),
         "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC"
@@ -1320,33 +1183,6 @@ function init_db_schema()
         }
       }
 
-      // Migrate imapsync to source-based schema
-      if ($table == 'imapsync') {
-        $stmt = $pdo->query("SHOW TABLES LIKE 'imapsync'");
-        if (count($stmt->fetchAll(PDO::FETCH_ASSOC)) != 0) {
-          $stmt = $pdo->query("SHOW COLUMNS FROM `imapsync` LIKE 'host1'");
-          $has_legacy_cols = (count($stmt->fetchAll(PDO::FETCH_ASSOC)) != 0);
-          $stmt = $pdo->query("SHOW COLUMNS FROM `imapsync` LIKE 'source_id'");
-          $has_source_id = (count($stmt->fetchAll(PDO::FETCH_ASSOC)) != 0);
-
-          if ($has_legacy_cols && !$has_source_id) {
-            $pdo->exec("INSERT IGNORE INTO `imapsync_source` (`name`, `created_by`, `scope`, `host1`, `port1`, `enc1`, `auth_type`, `active`)
-              SELECT CONCAT('legacy-', `host1`, '-', `port1`, '-', `enc1`, '-', `authmech1`) AS name,
-                '' AS created_by, 'all' AS scope, `host1`, `port1`, `enc1`, `authmech1`, 1
-              FROM `imapsync`
-              GROUP BY `host1`, `port1`, `enc1`, `authmech1`");
-            $pdo->exec("ALTER TABLE `imapsync` ADD COLUMN `source_id` INT DEFAULT NULL");
-            $pdo->exec("UPDATE `imapsync` i
-              JOIN `imapsync_source` s
-                ON s.`host1` = i.`host1` AND s.`port1` = i.`port1`
-                AND s.`enc1` = i.`enc1` AND s.`auth_type` = i.`authmech1`
-                AND s.`created_by` = '' AND s.`scope` = 'all'
-              SET i.`source_id` = s.`id`");
-            $pdo->exec("ALTER TABLE `imapsync` MODIFY COLUMN `source_id` INT NOT NULL");
-          }
-        }
-      }
-
       $stmt = $pdo->query("SHOW TABLES LIKE '" . $table . "'");
       $num_results = count($stmt->fetchAll(PDO::FETCH_ASSOC));
       if ($num_results != 0) {
@@ -1512,34 +1348,20 @@ function init_db_schema()
         AND (JSON_CONTAINS_PATH(`call`, 'one', '$[2].password')
           OR JSON_CONTAINS_PATH(`call`, 'one', '$[2].password2'));");
 
+    // Mitigate imapsync argument injection issue
+    $pdo->query("UPDATE `imapsync` SET `custom_params` = ''
+      WHERE `custom_params` LIKE '%pipemess%'
+        OR custom_params LIKE '%skipmess%'
+        OR custom_params LIKE '%delete2foldersonly%'
+        OR custom_params LIKE '%delete2foldersbutnot%'
+        OR custom_params LIKE '%regexflag%'
+        OR custom_params LIKE '%pipemess%'
+        OR custom_params LIKE '%regextrans2%'
+        OR custom_params LIKE '%maxlinelengthcmd%';");
+
     // Migrate webauthn tfa
     $stmt = $pdo->query("ALTER TABLE `tfa` MODIFY COLUMN `authmech` ENUM('yubi_otp', 'u2f', 'hotp', 'totp', 'webauthn')");
 
-    // Syncjobs: seed global settings
-    $pdo->query("INSERT IGNORE INTO `imapsync_settings` (`name`, `value`) VALUES ('max_parallel', '1')");
-
-    // Syncjobs: migrate custom_params from raw imapsync string to structured JSON pairs.
-    // Old values could not contain spaces (they were rejected), so a whitespace split is safe.
-    $allow = $GLOBALS['IMAPSYNC_OPTIONS'];
-    $cp_upd = $pdo->prepare("UPDATE `imapsync` SET `custom_params` = :cp WHERE `id` = :id");
-    foreach ($pdo->query("SELECT `id`, `custom_params` FROM `imapsync`")->fetchAll(PDO::FETCH_ASSOC) as $r) {
-      $cp = trim((string)$r['custom_params']);
-      if ($cp !== '' && $cp[0] === '[') continue; // already migrated (JSON)
-      $pairs = array();
-      if ($cp !== '') {
-        $tokens = preg_split('/\s+/', $cp, -1, PREG_SPLIT_NO_EMPTY);
-        for ($i = 0; $i < count($tokens); $i++) {
-          if (strpos($tokens[$i], '--') !== 0) continue;
-          $opt = ltrim($tokens[$i], '-'); $val = '';
-          if (strpos($opt, '=') !== false) { list($opt, $val) = explode('=', $opt, 2); }
-          elseif ($i + 1 < count($tokens) && strpos($tokens[$i + 1], '--') !== 0) { $val = $tokens[++$i]; }
-          if (!array_key_exists(strtolower($opt), $allow)) continue; // drop options no longer allowed
-          $pairs[] = array('o' => strtolower($opt), 'v' => $val);
-        }
-      }
-      $cp_upd->execute(array(':cp' => json_encode($pairs), ':id' => $r['id']));
-    }
-
     // Inject admin if not exists
     $stmt = $pdo->query("SELECT NULL FROM `admin`");
     $num_results = count($stmt->fetchAll(PDO::FETCH_ASSOC));
@@ -1642,8 +1464,6 @@ function init_db_schema()
         "pop3_access" => intval($GLOBALS['MAILBOX_DEFAULT_ATTRIBUTES']['pop3_access']),
         "smtp_access" => intval($GLOBALS['MAILBOX_DEFAULT_ATTRIBUTES']['smtp_access']),
         "sieve_access" => intval($GLOBALS['MAILBOX_DEFAULT_ATTRIBUTES']['sieve_access']),
-        "eas_access" => intval($GLOBALS['MAILBOX_DEFAULT_ATTRIBUTES']['eas_access']),
-        "dav_access" => intval($GLOBALS['MAILBOX_DEFAULT_ATTRIBUTES']['dav_access']),
         "acl_spam_alias" => 1,
         "acl_tls_policy" => 1,
         "acl_spam_score" => 1,

data/web/inc/prerequisites.inc.php

@@ -285,7 +285,6 @@ require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.domain_admin.inc.php';
 require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.fail2ban.inc.php';
 require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.fwdhost.inc.php';
 require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.mailbox.inc.php';
-require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.syncjob.inc.php';
 require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.mailq.inc.php';
 require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.oauth2.inc.php';
 require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.policy.inc.php';

data/web/inc/vars.inc.php

@@ -112,7 +112,6 @@ $AVAILABLE_LANGUAGES = array(
   'sv-se' => 'Svenska (Swedish)',
   'tr-tr' => 'Türkçe (Turkish)',
   'uk-ua' => 'Українська (Ukrainian)',
-  'uz-uz' => 'Oʻzbekcha (Uzbek)',
   'vi-vn' => 'Tiếng Việt (Vietnamese)',
   'zh-cn' => '简体中文 (Simplified Chinese)',
   'zh-tw' => '繁體中文 (Traditional Chinese)',
@@ -246,10 +245,6 @@ $PW_RESET_TOKEN_LIMIT = 3;
 // Maximum time in minutes a password reset token is valid
 $PW_RESET_TOKEN_LIFETIME = 15;
 
-// Globally forbid aliases with external (non-local) goto domains for ALL roles (incl. admins),
-// overriding the per-domain-admin da_acl. false = defer to da_acl.
-$ALIAS_DISABLE_EXTERNAL_DOMAINS = false;
-
 // UV flag handling in FIDO2/WebAuthn - defaults to false to allow iOS logins
 // true = required
 // false = preferred
@@ -285,89 +280,131 @@ $RSPAMD_MAPS = array(
 );
 
 
-// Allowed imapsync options for a sync job's custom_params, mapped to whether they take a value:
-//   true  = option takes a value
-//   false = pure flag, no value
-// Anything not listed here is rejected.
-// NEVER add (RCE): 'delete2foldersonly', 'delete2foldersbutnot', 'regexflag', 'regexmess', 'pipemess', 'regextrans2', 'maxlinelengthcmd'
 $IMAPSYNC_OPTIONS = array(
-  'abort'                  => false,
-  'authmd51'               => false,
-  'authuser1'              => true,
-  'debug'                  => false,
-  'debugcontent'           => false,
-  'debugcrossduplicates'   => false,
-  'debugflags'             => false,
-  'debugfolders'           => false,
-  'debugimap'              => false,
-  'debugimap1'             => false,
-  'debugmemory'            => false,
-  'debugssl'               => true,
-  'delete1emptyfolders'    => false,
-  'delete2folders'         => false,
-  'disarmreadreceipts'     => false,
-  'domain1'                => true,
-  'domino1'                => false,
-  'errorsmax'              => true,
-  'exchange1'              => false,
-  'exitwhenover'           => true,
-  'expunge1'               => false,
-  'f1f2'                   => true,
-  'filterbuggyflags'       => false,
-  'folder'                 => true,
-  'folderfirst'            => true,
-  'folderlast'             => true,
-  'folderrec'              => true,
-  'gmail1'                 => false,
-  'idatefromheader'        => false,
-  'include'                => true,
-  'inet4'                  => false,
-  'inet6'                  => false,
-  'justconnect'            => false,
-  'justfolders'            => false,
-  'justfoldersizes'        => false,
-  'justlogin'              => false,
-  'keepalive1'             => false,
-  'log'                    => false,
-  'maxbytesafter'          => true,
-  'maxlinelength'          => true,
-  'maxmessagespersecond'   => true,
-  'maxsize'                => true,
-  'maxsleep'               => true,
-  'minage'                 => true,
-  'minsize'                => true,
-  'noabletosearch'         => false,
-  'noabletosearch1'        => false,
-  'noexpunge1'             => false,
-  'nofoldersizesatend'     => false,
-  'noid'                   => false,
-  'nolog'                  => false,
-  'nomixfolders'           => false,
-  'noresyncflags'          => false,
-  'nossl1'                 => false,
-  'nosyncacls'             => false,
-  'notls1'                 => false,
-  'nousecache'             => false,
-  'office1'                => false,
-  'prefix1'                => true,
-  'resyncflags'            => false,
-  'resynclabels'           => false,
-  'search'                 => true,
-  'search1'                => true,
-  'sep1'                   => true,
-  'skipemptyfolders'       => false,
-  'subfolder1'             => true,
-  'subscribe'              => false,
-  'subscribed'             => false,
-  'syncacls'               => false,
-  'syncduplicates'         => false,
-  'syncinternaldates'      => false,
-  'synclabels'             => false,
-  'tests'                  => false,
-  'testslive'              => false,
-  'testslive6'             => false,
-  'truncmess'              => true,
-  'usecache'               => false,
-  'useheader'              => true,
-  'useuid'                 => false,
+  'whitelist' => array(
+    'abort',
+    'authmd51',
+    'authmd52',
+    'authmech1',
+    'authmech2',
+    'authuser1',
+    'authuser2',
+    'debug',
+    'debugcontent',
+    'debugcrossduplicates',
+    'debugflags',
+    'debugfolders',
+    'debugimap',
+    'debugimap1',
+    'debugimap2',
+    'debugmemory',
+    'debugssl',
+    'delete1emptyfolders',
+    'delete2folders',
+    'disarmreadreceipts',
+    'domain1',
+    'domain2',
+    'domino1',
+    'domino2',
+    'dry',
+    'errorsmax',
+    'exchange1',
+    'exchange2',
+    'exitwhenover',
+    'expunge1',
+    'f1f2',
+    'filterbuggyflags',
+    'folder',
+    'folderfirst',
+    'folderlast',
+    'folderrec',
+    'gmail1',
+    'gmail2',
+    'idatefromheader',
+    'include',
+    'inet4',
+    'inet6',
+    'justconnect',
+    'justfolders',
+    'justfoldersizes',
+    'justlogin',
+    'keepalive1',
+    'keepalive2',
+    'log',
+    'logdir',
+    'logfile',
+    'maxbytesafter',
+    'maxlinelength',
+    'maxmessagespersecond',
+    'maxsize',
+    'maxsleep',
+    'minage',
+    'minsize',
+    'noabletosearch',
+    'noabletosearch1',
+    'noabletosearch2',
+    'noexpunge1',
+    'noexpunge2',
+    'nofoldersizesatend',
+    'noid',
+    'nolog',
+    'nomixfolders',
+    'noresyncflags',
+    'nossl1',
+    'nossl2',
+    'nosyncacls',
+    'notls1',
+    'notls2',
+    'nouidexpunge2',
+    'nousecache',
+    'oauthaccesstoken1',
+    'oauthaccesstoken2',
+    'oauthdirect1',
+    'oauthdirect2',
+    'office1',
+    'office2',
+    'pidfile',
+    'pidfilelocking',
+    'prefix1',
+    'prefix2',
+    'proxyauth1',
+    'proxyauth2',
+    'resyncflags',
+    'resynclabels',
+    'search',
+    'search1',
+    'search2',
+    'sep1',
+    'sep2',
+    'showpasswords',
+    'skipemptyfolders',
+    'ssl2',
+    'sslargs1',
+    'sslargs2',
+    'subfolder1',
+    'subscribe',
+    'subscribed',
+    'syncacls',
+    'syncduplicates',
+    'syncinternaldates',
+    'synclabels',
+    'tests',
+    'testslive',
+    'testslive6',
+    'tls2',
+    'truncmess',
+    'usecache',
+    'useheader',
+    'useuid'
+  ),
+  'blacklist' => array(
+    'skipmess',
+    'delete2foldersonly',
+    'delete2foldersbutnot',
+    'regexflag',
+    'regexmess',
+    'pipemess',
+    'regextrans2',
+    'maxlinelengthcmd'
+  )
 );

data/web/js/build/013-mailcow.js

@@ -414,279 +414,3 @@ function copyToClipboard(id) {
   navigator.clipboard.writeText(copyText.value);
   mailcow_alert_box(lang.copy_to_clipboard, "success");
 }
-
-// ===== IMAP sync sources: shared helpers + delegated listeners =====
-// Used by the mailbox/user/edit pages (each still owns its own draw_imapsync_source_table).
-// Kept here because 013-mailcow.js is loaded globally, so the logic lives in one place.
-
-// Human-readable visibility label for a source row (used by the per-page source tables)
-function imapsyncScopeDisplay(item) {
-  if (item.scope === 'all') return '<i class="bi bi-globe"></i> ' + lang.syncjobs.source_scope_all;
-  if (item.scope === 'domain') return escapeHtml(lang.syncjobs.source_scope_domain + ': ' + (item.domains || []).join(', '));
-  var us = item.users || [];
-  if (us.length === 0) return escapeHtml(item.created_by || '');
-  return escapeHtml(lang.syncjobs.source_scope_user + ': ' + us.join(', '));
-}
-
-// Auth column for a source row: auth type, and for XOAUTH2 the flow + a token-status badge.
-function imapsyncAuthDisplay(item) {
-  var out = escapeHtml(item.auth_type);
-  if (item.auth_type !== 'XOAUTH2') return out;
-  var flow = item.oauth_flow || 'client_credentials';
-  var flowLabel = (flow === 'authorization_code')
-    ? lang.syncjobs.source_flow_badge_user
-    : lang.syncjobs.source_flow_badge_app;
-  out += ' <span class="text-muted">(' + escapeHtml(flowLabel) + ')</span>';
-  if (flow === 'authorization_code') {
-    // token lives per user+source (created via the syncjob "connect"), not on the source row
-    return out;
-  }
-  var badge;
-  if (item.oauth_token_expires && item.oauth_token_expires * 1000 > Date.now()) {
-    badge = '<span class="badge bg-success">' + lang.syncjobs.source_token_status + ': ' + new Date(item.oauth_token_expires * 1000).toLocaleString() + '</span>';
-  } else if (item.oauth_last_refresh_error) {
-    badge = '<span class="badge bg-danger" title="' + escapeHtml(item.oauth_last_refresh_error) + '">' + lang.syncjobs.source_token_error + '</span>';
-  } else {
-    badge = '<span class="badge bg-warning">' + lang.waiting + '</span>';
-  }
-  // badge on its own line, below "XOAUTH2 (Client Credentials)"
-  out += '<div class="mt-1">' + badge + '</div>';
-  return out;
-}
-
-// Per-syncjob OAuth token badge for authorization_code sources: the token is issued
-// per user (via "connect"), so a job can be pending / issued / failed. Returns '' for
-// non-XOAUTH2 or client_credentials jobs (those have no per-user token).
-function imapsyncJobTokenBadge(item) {
-  if (item.source_auth_type !== 'XOAUTH2' || item.source_oauth_flow !== 'authorization_code') return '';
-  if (item.user_token_error) {
-    return '<span class="badge bg-danger" title="' + escapeHtml(item.user_token_error) + '">' + lang.syncjobs.token_state_failed + '</span>';
-  }
-  if (item.user_token_expires && item.user_token_expires * 1000 > Date.now()) {
-    return '<span class="badge bg-success" title="' + lang.syncjobs.source_token_status + ': ' + new Date(item.user_token_expires * 1000).toLocaleString() + '">' + lang.syncjobs.token_state_issued + '</span>';
-  }
-  return '<span class="badge bg-warning">' + lang.syncjobs.token_state_pending + '</span>';
-}
-
-// (Re)build every imapsync-source dropdown from the ACL-filtered API (fresh on modal open)
-function populateImapsyncSourceSelects() {
-  $.get("/api/v1/get/syncjob_source/all", function(sources) {
-    $('select.imapsync-source-select').each(function() {
-      var $sel = $(this);
-      var keepId = $sel.data('current-source-id');
-      $sel.empty();
-      $sel.append('<option value="">' + (lang.syncjobs ? lang.syncjobs.source_select : '') + '</option>');
-      $.each(sources, function(_, src) {
-        var label = src.name + ' — ' + src.host1 + ':' + src.port1 + ' (' + src.auth_type + ')';
-        if (src.scope === 'all') label += ' [' + (lang.syncjobs ? lang.syncjobs.source_scope_all : 'all') + ']';
-        var $opt = $('<option/>').val(src.id).text(label)
-          .data('auth-type', src.auth_type).data('oauth-flow', src.oauth_flow);
-        if (keepId && parseInt(keepId) === parseInt(src.id)) $opt.attr('selected', 'selected');
-        $sel.append($opt);
-      });
-      if (typeof $sel.selectpicker === 'function') {
-        $sel.selectpicker('destroy');
-        $sel.selectpicker();
-      }
-      $sel.trigger('change');
-    });
-  });
-}
-
-// Populate a scope domain/user multiselect from the ACL-filtered endpoint (preserves existing options)
-function fillImapsyncScopeSelect($sel, url, field) {
-  $.get('/api/v1/get/' + url, function(rows) {
-    var have = {};
-    $sel.find('option').each(function() { have[$(this).val()] = true; });
-    $.each(rows, function(_, r) {
-      var v = r[field];
-      if (!v || have[v]) return;
-      $sel.append($('<option/>').val(v).text(v));
-    });
-    // Rebuild the bootstrap-select wrapper (destroy + re-init)
-    if (typeof $sel.selectpicker === 'function') {
-      $sel.selectpicker('destroy');
-      $sel.selectpicker();
-    }
-  });
-}
-
-// Source editor: OAuth block visibility + authorization_code-only fields + redirect URI
-function imapsyncSyncSourceOauthToggle($form) {
-  var isOauth = $form.find('select.imapsync-source-auth-type').val() === 'XOAUTH2';
-  var isAuthCode = $form.find('select.imapsync-source-oauth-flow').val() === 'authorization_code';
-  $form.find('.imapsync-source-oauth-block').toggle(isOauth);
-  $form.find('.imapsync-source-authcode-block').toggle(isOauth && isAuthCode);
-  $form.find('.imapsync-source-redirect-uri').val(window.location.origin + '/syncjob-oauth');
-}
-
-// Allowlisted imapsync options as a map { name: takesValue }. Loaded once and cached.
-var imapsyncCpOptions = null;
-function imapsyncCpEnsureOptions(cb) {
-  if (imapsyncCpOptions !== null) { cb(); return; }
-  $.get("/api/v1/get/syncjob_options", function(opts) {
-    imapsyncCpOptions = (opts && typeof opts === 'object') ? opts : {};
-    cb();
-  });
-}
-
-// A imapsync flag option takes no value
-function imapsyncCpTakesValue(name) {
-  return !(imapsyncCpOptions && imapsyncCpOptions[name] === false);
-}
-
-// Enable/disable/require a row's value field based on the selected option.
-function imapsyncCpApplyValueState($row) {
-  var name = $row.find('.imapsync-cp-opt').val() || '';
-  var isFlag = (name !== '') && !imapsyncCpTakesValue(name);
-  var needsValue = (name !== '') && !isFlag;
-  var $val = $row.find('.imapsync-cp-val');
-  $val.prop('disabled', isFlag);
-  if (isFlag) $val.val('');
-  $val.prop('required', needsValue);
-  $val.attr('placeholder', isFlag
-    ? ((lang.syncjobs && lang.syncjobs.custom_param_no_value) || 'no value')
-    : ((lang.syncjobs && lang.syncjobs.custom_param_value) || 'value'));
-}
-
-// Append one row to an editor; option is a native <select> (not free-text), value is arbitrary.
-function imapsyncCpAddRow($editor, o, v) {
-  var $row = $(
-    '<div class="input-group mb-2 imapsync-cp-row">' +
-      '<select class="form-control imapsync-cp-opt" style="flex:0 0 35%"></select>' +
-      '<input type="text" class="form-control imapsync-cp-val">' +
-      '<button type="button" class="btn btn-secondary imapsync-cp-remove"><i class="bi bi-trash"></i></button>' +
-    '</div>'
-  );
-  var $sel = $row.find('.imapsync-cp-opt');
-  $sel.append($('<option></option>').attr('value', '').text('— ' + ((lang.syncjobs && lang.syncjobs.custom_param_option) || 'option') + ' —'));
-  Object.keys(imapsyncCpOptions || {}).forEach(function(name) {
-    $sel.append($('<option></option>').attr('value', name).text(name));
-  });
-  // keep a stored value that is no longer allowlisted visible instead of silently dropping it
-  if (o && !(imapsyncCpOptions && (o in imapsyncCpOptions))) {
-    $sel.append($('<option></option>').attr('value', o).text(o));
-  }
-  $sel.val(o || '');
-  $row.find('.imapsync-cp-val').val(v || '');
-  $editor.find('.imapsync-cp-rows').append($row);
-  imapsyncCpApplyValueState($row);
-}
-
-// Build the rows of an editor from its hidden JSON value.
-function imapsyncCpBuild($editor) {
-  var $hidden = $editor.siblings('.imapsync-cp-value');
-  $editor.find('.imapsync-cp-rows').empty();
-  var pairs = [];
-  try { pairs = JSON.parse($hidden.val() || '[]'); } catch (e) { pairs = []; }
-  if (!Array.isArray(pairs)) pairs = [];
-  pairs.forEach(function(p) {
-    if (p && typeof p === 'object') imapsyncCpAddRow($editor, p.o, p.v);
-  });
-}
-
-// Re-serialize an editor's rows back into its hidden JSON value (option name required).
-function imapsyncCpSerialize($editor) {
-  var out = [];
-  $editor.find('.imapsync-cp-row').each(function() {
-    var o = $.trim($(this).find('.imapsync-cp-opt').val() || '').replace(/^-+/, '');
-    if (o === '') return;
-    out.push({ o: o, v: $(this).find('.imapsync-cp-val').val() || '' });
-  });
-  $editor.siblings('.imapsync-cp-value').val(JSON.stringify(out));
-}
-
-$(document).ready(function() {
-  // Custom-params editor: keep the hidden JSON in sync with the rows
-  $(document).on('change', '.imapsync-cp-opt', function() {
-    imapsyncCpApplyValueState($(this).closest('.imapsync-cp-row'));
-    imapsyncCpSerialize($(this).closest('.imapsync-cp-editor'));
-  });
-  $(document).on('input', '.imapsync-cp-val', function() {
-    imapsyncCpSerialize($(this).closest('.imapsync-cp-editor'));
-  });
-  $(document).on('click', '.imapsync-cp-add', function() {
-    var $editor = $(this).closest('.imapsync-cp-editor');
-    imapsyncCpEnsureOptions(function() { imapsyncCpAddRow($editor); });
-  });
-  $(document).on('click', '.imapsync-cp-remove', function() {
-    var $editor = $(this).closest('.imapsync-cp-editor');
-    $(this).closest('.imapsync-cp-row').remove();
-    imapsyncCpSerialize($editor);
-  });
-
-  // Edit page (syncjob.twig): build rows from the stored value on load
-  imapsyncCpEnsureOptions(function() {
-    $('.imapsync-cp-editor').each(function() { imapsyncCpBuild($(this)); });
-  });
-
-  // Syncjob form: toggle password row / OAuth "connect" button by the selected source's flow
-  $(document).on('change', 'select.imapsync-source-select', function() {
-    var $sel = $(this);
-    var $opt = $sel.find('option:selected');
-    var $form = $sel.closest('form');
-    var isOauth = ($opt.data('auth-type') === 'XOAUTH2');
-    var isAuthCode = isOauth && ($opt.data('oauth-flow') === 'authorization_code');
-    var isEdit = ($form.data('id') === 'editsyncjob');
-    $form.find('.password1-row').toggle(!isOauth);
-    $form.find('input[name="password1"]').prop('required', !isOauth && !isEdit);
-    $form.find('.imapsync-oauth-connect-row').toggle(isAuthCode);
-    $form.find('.imapsync-user1-row').toggle(!isAuthCode);
-    $form.find('input[name="user1"]').prop('required', !isAuthCode && !isEdit);
-  });
-
-  // Source editor: OAuth block + authorization_code fields
-  $(document).on('change', 'select.imapsync-source-auth-type, select.imapsync-source-oauth-flow', function() {
-    imapsyncSyncSourceOauthToggle($(this).closest('form'));
-  });
-
-  // Source editor: scope -> show + populate the domain/user pickers
-  $(document).on('change', 'select.imapsync-source-scope', function() {
-    var $form = $(this).closest('form');
-    var scope = $(this).val();
-    $form.find('.imapsync-source-domains-row').toggle(scope === 'domain');
-    $form.find('.imapsync-source-users-row').toggle(scope === 'user');
-    if (scope === 'domain') fillImapsyncScopeSelect($form.find('.imapsync-source-domains'), 'domain/all', 'domain_name');
-    if (scope === 'user') fillImapsyncScopeSelect($form.find('.imapsync-source-users'), 'mailbox/all', 'username');
-  });
-
-  // "Connect with the provider": open the per-user OAuth popup for the selected source
-  $(document).on('click', '.imapsync-oauth-connect-btn', function() {
-    var $form = $(this).closest('form');
-    var sourceId = $form.find('select.imapsync-source-select').val();
-    if (!sourceId) return;
-    window.open('/syncjob-oauth?action=start&source_id=' + encodeURIComponent(sourceId),
-      'syncjob_oauth', 'width=600,height=700');
-  });
-
-  // Result from the OAuth popup: fill + lock user1, mark connected (or show the error)
-  window.addEventListener('message', function(ev) {
-    if (ev.origin !== window.location.origin || !ev.data || ev.data.type !== 'syncjob_oauth') return;
-    $('.imapsync-oauth-connect-row:visible').each(function() {
-      var $form = $(this).closest('form');
-      var $status = $form.find('.imapsync-oauth-connect-status');
-      if (ev.data.ok) {
-        $form.find('input[name="user1"]').val(ev.data.user1).prop('readonly', true);
-        $status.removeClass('text-danger').addClass('text-success')
-          .text((lang.syncjobs ? lang.syncjobs.syncjob_oauth_connected : 'Connected') + ': ' + ev.data.user1);
-      } else {
-        $status.removeClass('text-success').addClass('text-danger').text(ev.data.error || 'error');
-      }
-    });
-  });
-
-  // Add-source modal opens: init scope pickers + OAuth block (auth_type may be cached-form preselected)
-  $(document).on('shown.bs.modal', '#addImapsyncSourceModal', function() {
-    $(this).find('select.imapsync-source-scope').trigger('change');
-    imapsyncSyncSourceOauthToggle($(this).find('form'));
-  });
-
-  // Add-syncjob modal opens: (re)load the source dropdown from the API
-  $(document).on('shown.bs.modal', '#addSyncJobModalAdmin, #addSyncJobModal', function() {
-    populateImapsyncSourceSelects();
-    var $modal = $(this);
-    imapsyncCpEnsureOptions(function() {
-      $modal.find('.imapsync-cp-editor').each(function() { imapsyncCpBuild($(this)); });
-    });
-  });
-});

data/web/js/site/dashboard.js

@@ -30,7 +30,7 @@ $(document).ready(function() {
   // create host cpu and mem charts
   createHostCpuAndMemChart();
   // check for new version
-  if (mailcow_info.branch === "master" && mailcow_cc_role === "admin"){
+  if (mailcow_info.branch === "master"){
     check_update(mailcow_info.version_tag, mailcow_info.project_url);
   }
   $("#mailcow_version").click(function(){
@@ -1089,8 +1089,6 @@ jQuery(function($){
         return str;
       }).join('<br>\n');
       item.subject = escapeHtml(item.subject);
-      if (item.sender_mime != null) item.sender_mime = escapeHtml(item.sender_mime);
-      if (item['message-id'] != null) item['message-id'] = escapeHtml(item['message-id']);
       var scan_time = item.time_real.toFixed(3);
       if (item.time_virtual) {
         scan_time += ' / ' + item.time_virtual.toFixed(3);
@@ -1169,7 +1167,6 @@ jQuery(function($){
         if (item === null) { return true; }
         item.user = escapeHtml(item.user);
         item.call = escapeHtml(item.call);
-        if (item.msg) item.msg = escapeHtml(item.msg);
         item.task = '<code>' + item.task + '</code>';
         item.type = '<span class="badge fs-6 bg-' + item.type + '">' + item.type + '</span>';
       });
@@ -1177,7 +1174,6 @@ jQuery(function($){
       $.each(data, function (i, item) {
         if (item === null) { return true; }
         item.username = escapeHtml(item.username);
-        item.real_rip = escapeHtml(item.real_rip);
         item.service = '<div class="badge fs-6 bg-secondary">' + item.service.toUpperCase() + '</div>';
       });
     } else if (table == 'general_syslog') {
@@ -1216,11 +1212,6 @@ jQuery(function($){
       });
     } else if (table == 'rllog') {
       $.each(data, function (i, item) {
-        if (item.header_from != null) item.header_from = escapeHtml(item.header_from);
-        if (item.header_subject != null) item.header_subject = escapeHtml(item.header_subject);
-        if (item.from != null) item.from = escapeHtml(item.from);
-        if (item.rcpt != null) item.rcpt = escapeHtml(item.rcpt);
-        if (item.message_id != null) item.message_id = escapeHtml(item.message_id);
         if (item.user == null) {
           item.user = "none";
         }
@@ -1678,26 +1669,41 @@ function createHostCpuAndMemChart(){
 function check_update(current_version, github_repo_url){
   if (!current_version || !github_repo_url) return false;
 
+  var github_account = github_repo_url.split("/")[3];
+  var github_repo_name = github_repo_url.split("/")[4];
 
-  window.fetch("/inc/ajax/update_check.php", {method:'GET',cache:'no-cache'}).then(function(response) {
-    if (!response.ok) throw new Error("update check returned " + response.status);
+  // get details about latest release
+  window.fetch("https://api.github.com/repos/"+github_account+"/"+github_repo_name+"/releases/latest", {method:'GET',cache:'no-cache'}).then(function(response) {
     return response.json();
-  }).then(function(data) {
-    if (data.status === "no_update") {
-      $("#mailcow_update").removeClass("text-warning text-danger").addClass("text-success");
-      $("#mailcow_update").html("<b>" + lang_debug.no_update_available + "</b>");
-    } else if (data.status === "update_available") {
-      $("#mailcow_update").removeClass("text-danger text-success").addClass("text-warning");
-      $("#mailcow_update").html(lang_debug.update_available + ` <a href="#" id="mailcow_update_changelog">`+data.latest_tag+`</a>`);
-      $("#mailcow_update_changelog").click(function(){
-        if (mailcow_cc_role !== "admin" && mailcow_cc_role !== "domainadmin")
-          return;
+  }).then(function(latest_data) {
+    // get details about current release
+    window.fetch("https://api.github.com/repos/"+github_account+"/"+github_repo_name+"/releases/tags/"+current_version, {method:'GET',cache:'no-cache'}).then(function(response) {
+      return response.json();
+    }).then(function(current_data) {
+      // compare releases
+      var date_current = new Date(current_data.created_at);
+      var date_latest = new Date(latest_data.created_at);
+      if (date_latest.getTime() <= date_current.getTime()){
+        // no update available
+        $("#mailcow_update").removeClass("text-warning text-danger").addClass("text-success");
+        $("#mailcow_update").html("<b>" + lang_debug.no_update_available + "</b>");
+      } else {
+        // update available
+        $("#mailcow_update").removeClass("text-danger text-success").addClass("text-warning");
+        $("#mailcow_update").html(lang_debug.update_available + ` <a href="#" id="mailcow_update_changelog">`+latest_data.tag_name+`</a>`);
+        $("#mailcow_update_changelog").click(function(){
+          if (mailcow_cc_role !== "admin" && mailcow_cc_role !== "domainadmin")
+            return;
 
-        showVersionModal("New Release " + data.latest_tag, data.latest_tag);
-      })
-    } else {
-      throw new Error(data.message || "update check failed");
-    }
+          showVersionModal("New Release " + latest_data.tag_name, latest_data.tag_name);
+        })
+      }
+    }).catch(err => {
+      // err
+      console.log(err);
+      $("#mailcow_update").removeClass("text-success text-warning").addClass("text-danger");
+      $("#mailcow_update").html("<b>"+ lang_debug.update_failed +"</b>");
+    });
   }).catch(err => {
     // err
     console.log(err);

data/web/js/site/edit.js

@@ -240,15 +240,4 @@ jQuery(function($){
   // Draw Table if tab is active
   onVisible("[id^=wl_policy_domain_table]", () => draw_wl_policy_domain_table());
   onVisible("[id^=bl_policy_domain_table]", () => draw_bl_policy_domain_table());
-
-  // initialise imapsync-source form on load.
-  if ($('select.imapsync-source-oauth-flow').length) {
-    imapsyncSyncSourceOauthToggle($('select.imapsync-source-oauth-flow').closest('form'));
-  }
-  if ($('select.imapsync-source-scope').length) {
-    $('select.imapsync-source-scope').trigger('change');
-  }
-  if ($('select.imapsync-source-select').length) {
-    populateImapsyncSourceSelects();
-  }
 });

data/web/js/site/mailbox.js

@@ -424,11 +424,6 @@ $(document).ready(function() {
     } else {
       $('#force_pw_update').prop('checked', false);
     }
-    if (template.force_tfa == 1){
-      $('#force_tfa').prop('checked', true);
-    } else {
-      $('#force_tfa').prop('checked', false);
-    }
     if (template.sogo_access == 1){
       $('#sogo_access').prop('checked', true);
     } else {
@@ -996,7 +991,6 @@ jQuery(function($){
               'style="min-width:2em;width:' + item.percent_in_use + '%">' + item.percent_in_use + '%' + '</div></div>'
             };
             item.username = escapeHtml(item.username);
-            item.name = escapeHtml(item.name);
 
             if (Array.isArray(item.tags)){
               var tags = '';
@@ -1248,7 +1242,6 @@ jQuery(function($){
             item.attributes.eas_access = '<i class="text-' + (item.attributes.eas_access == 1 ? 'success' : 'danger') + ' bi bi-' + (item.attributes.eas_access == 1 ? 'check-lg' : 'x-lg') + '"><span class="sorting-value">' + (item.attributes.eas_access == 1 ? '1' : '0') + '</span></i>';
             item.attributes.dav_access = '<i class="text-' + (item.attributes.dav_access == 1 ? 'success' : 'danger') + ' bi bi-' + (item.attributes.dav_access == 1 ? 'check-lg' : 'x-lg') + '"><span class="sorting-value">' + (item.attributes.dav_access == 1 ? '1' : '0') + '</span></i>';
             item.attributes.sogo_access = '<i class="text-' + (item.attributes.sogo_access == 1 ? 'success' : 'danger') + ' bi bi-' + (item.attributes.sogo_access == 1 ? 'check-lg' : 'x-lg') + '"><span class="sorting-value">' + (item.attributes.sogo_access == 1 ? '1' : '0') + '</span></i>';
-            item.attributes.force_tfa = '<i class="text-' + (item.attributes.force_tfa == 1 ? 'success' : 'danger') + ' bi bi-' + (item.attributes.force_tfa == 1 ? 'check-lg' : 'x-lg') + '"><span class="sorting-value">' + (item.attributes.force_tfa == 1 ? '1' : '0') + '</span></i>';
             if (item.attributes.quarantine_notification === 'never') {
               item.attributes.quarantine_notification = lang.never;
             } else if (item.attributes.quarantine_notification === 'hourly') {
@@ -1392,11 +1385,6 @@ jQuery(function($){
             return 1==data?'<i class="bi bi-check-lg"></i>':'<i class="bi bi-x-lg"></i>';
           }
         },
-        {
-          title: lang.force_tfa,
-          data: 'attributes.force_tfa',
-          defaultContent: ''
-        },
         {
           title: lang_edit.ratelimit,
           data: 'attributes.ratelimit',
@@ -2162,34 +2150,37 @@ jQuery(function($){
     var table = $('#sync_job_table').DataTable({
       responsive: true,
       processing: true,
-      serverSide: false,
+      serverSide: true,
       stateSave: true,
       pageLength: pagination_size,
       dom: "<'row'<'col-sm-12 col-md-6'f><'col-sm-12 col-md-6'l>>" +
            "tr" +
            "<'row'<'col-sm-12 col-md-5'i><'col-sm-12 col-md-7'p>>",
       language: lang_datatables,
-      order: [[3, 'asc']],
+      order: [[2, 'desc']],
       initComplete: function(){
         hideTableExpandCollapseBtn('#tab-syncjobs', '#sync_job_table');
       },
       ajax: {
-        type: "GET",
-        url: "/api/v1/get/syncjobs/all/no_log",
+        type: "POST",
+        url: "/api/v1/search/syncjob",
+        contentType: "application/json",
+        processData: false,
+        data: function(d) {
+          return JSON.stringify(d);
+        },
         dataSrc: function(json){
-          $.each(json, function (i, item) {
+          $.each(json.data, function (i, item) {
+            item.log = '<a href="#syncjobLogModal" data-bs-toggle="modal" data-syncjob-id="' + encodeURIComponent(item.id) + '">' + lang.open_logs + '</a>'
             item.user2 = escapeHtml(item.user2);
             if (!item.exclude > 0) {
               item.exclude = '-';
             } else {
               item.exclude  = '<code>' + escapeHtml(item.exclude) + '</code>';
             }
-            item.server_w_port = escapeHtml(item.user1) + '@' + escapeHtml(item.source_name || '?') + ' (' + escapeHtml(item.source_host || '?') + ':' + escapeHtml(item.source_port || '?') + ')';
-            var tokenBadge = imapsyncJobTokenBadge(item);
-            if (tokenBadge) item.server_w_port += '<div class="mt-1">' + tokenBadge + '</div>';
+            item.server_w_port = escapeHtml(item.user1) + '@' + escapeHtml(item.host1) + ':' + escapeHtml(item.port1);
             item.action = '<div class="btn-group">' +
               '<a href="/edit/syncjob/' + item.id + '" class="btn btn-sm btn-xs-lg btn-xs-half btn-secondary"><i class="bi bi-pencil-fill"></i> ' + lang.edit + '</a>' +
-              '<a href="#syncjobLogModal" data-bs-toggle="modal" data-syncjob-id="' + encodeURIComponent(item.id) + '" class="btn btn-sm btn-xs-lg btn-xs-half btn-info"><i class="bi bi-card-list"></i> ' + lang.open_logs + '</a>' +
               '<a href="#" data-action="delete_selected" data-id="single-syncjob" data-api-url="delete/syncjob" data-item="' + item.id + '" class="btn btn-sm btn-xs-lg btn-xs-half btn-danger"><i class="bi bi-trash"></i> ' + lang.remove + '</a>' +
               '</div>';
             item.chkbox = '<input type="checkbox" class="form-check-input" data-id="syncjob" name="multi_select" value="' + item.id + '" />';
@@ -2207,15 +2198,15 @@ jQuery(function($){
             } else {
               item.success = '<i class="text-' + (item.success == 1 ? 'success' : 'danger') + ' bi bi-' + (item.success == 1 ? 'check-lg' : 'x-lg') + '"></i>';
             }
-            if (lang.syncjobs['syncjob_'+item.exit_status]) {
-              item.exit_status = lang.syncjobs['syncjob_'+item.exit_status];
+            if (lang['syncjob_'+item.exit_status]) {
+              item.exit_status = lang['syncjob_'+item.exit_status];
             } else if (item.success != '-') {
-              item.exit_status = lang.syncjobs.syncjob_check_log;
+              item.exit_status = lang.syncjob_check_log;
             }
             item.exit_status = item.success + ' ' + item.exit_status;
           });
 
-          return json;
+          return json.data;
         }
       },
       columns: [
@@ -2239,12 +2230,7 @@ jQuery(function($){
         {
           title: 'ID',
           data: 'id',
-          responsivePriority: 3,
-          defaultContent: ''
-        },
-        {
-          title: lang.syncjobs.prio,
-          data: 'prio',
+          searchable: false,
           responsivePriority: 3,
           defaultContent: ''
         },
@@ -2262,16 +2248,27 @@ jQuery(function($){
         {
           title: lang.last_run,
           data: 'last_run',
+          searchable: false,
           defaultContent: ''
         },
         {
-          title: lang.syncjobs.syncjob_last_run_result,
+          title: lang.syncjob_last_run_result,
           data: 'exit_status',
+          searchable: false,
+          orderable: false,
+          defaultContent: ''
+        },
+        {
+          title: 'Log',
+          data: 'log',
+          searchable: false,
+          orderable: false,
           defaultContent: ''
         },
         {
           title: lang.active,
           data: 'active',
+          searchable: false,
           defaultContent: '',
           render: function (data, type) {
             return 1==data?'<i class="bi bi-check-lg"><span class="sorting-value">1</span></i>':0==data&&'<i class="bi bi-x-lg"><span class="sorting-value">0</span></i>';
@@ -2280,23 +2277,31 @@ jQuery(function($){
         {
           title: lang.status,
           data: 'is_running',
+          searchable: false,
+          orderable: false,
           defaultContent: ''
         },
         {
           title: lang.excludes,
           data: 'exclude',
+          searchable: false,
+          orderable: false,
           defaultContent: '',
           className: 'none'
         },
         {
           title: lang.mins_interval,
           data: 'mins_interval',
+          searchable: false,
+          orderable: false,
           defaultContent: '',
           className: 'none'
         },
         {
           title: lang.action,
           data: 'action',
+          searchable: false,
+          orderable: false,
           className: 'dt-sm-head-hidden dt-data-w100 dtr-col-md dt-text-right',
           responsivePriority: 5,
           defaultContent: ''
@@ -2480,56 +2485,6 @@ jQuery(function($){
     });
   }
 
-  function draw_imapsync_source_table() {
-    if ($.fn.DataTable.isDataTable('#imapsync_source_table')) {
-      $('#imapsync_source_table').DataTable().columns.adjust().responsive.recalc();
-      return;
-    }
-    $('#imapsync_source_table').DataTable({
-      responsive: true,
-      processing: true,
-      serverSide: false,
-      stateSave: true,
-      pageLength: pagination_size,
-      dom: "<'row'<'col-sm-12 col-md-6'f><'col-sm-12 col-md-6'l>>" + "tr" +
-           "<'row'<'col-sm-12 col-md-5'i><'col-sm-12 col-md-7'p>>",
-      language: lang_datatables,
-      ajax: {
-        type: "GET",
-        url: "/api/v1/get/syncjob_source/all",
-        dataSrc: function(json) {
-          $.each(json, function(i, item) {
-            item.endpoint = escapeHtml(item.host1 + ':' + item.port1 + ' (' + item.enc1 + ')');
-            item.auth_display = imapsyncAuthDisplay(item);
-            item.visibility_display = imapsyncScopeDisplay(item);
-            if (item.can_edit) {
-              item.action = '<div class="btn-group">' +
-                '<a href="/edit/syncjob_source/' + item.id + '" class="btn btn-xs btn-xs-half btn-secondary"><i class="bi bi-pencil-fill"></i> ' + lang.edit + '</a>' +
-                '<a href="#" data-action="delete_selected" data-id="single-syncjob_source" data-api-url="delete/syncjob_source" data-item="' + item.id + '" class="btn btn-xs btn-xs-half btn-danger"><i class="bi bi-trash"></i> ' + lang.remove + '</a>' +
-                '</div>';
-            } else {
-              item.action = '<span class="text-muted">-</span>';
-            }
-          });
-          return json;
-        }
-      },
-      columns: [
-        { title: 'ID', data: 'id', defaultContent: '' },
-        { title: lang.syncjobs.source_name, data: 'name', defaultContent: '', render: (d) => escapeHtml(d || '') },
-        { title: lang.syncjobs.source_scope, data: 'visibility_display', defaultContent: '' },
-        { title: 'Endpoint', data: 'endpoint', defaultContent: '' },
-        { title: lang.syncjobs.source_auth_type, data: 'auth_display', defaultContent: '' },
-        { title: lang.active, data: 'active', defaultContent: '',
-          render: function(d) { return d == 1 ? '<i class="bi bi-check-lg"></i>' : '<i class="bi bi-x-lg"></i>'; }},
-        { title: lang.action, data: 'action', defaultContent: '', className: 'dt-text-right' }
-      ]
-    });
-  }
-
-  // Shared imapsync helpers + delegated listeners live in js/build/013-mailcow.js
-  // (draw_imapsync_source_table stays per-page and calls the global imapsyncScopeDisplay).
-
   // Load only if the tab is visible
   onVisible("[id^=domain_table]", () => draw_domain_table());
   onVisible("[id^=templates_domain_table]", () => draw_templates_domain_table());
@@ -2539,7 +2494,6 @@ jQuery(function($){
   onVisible("[id^=alias_table]", () => draw_alias_table());
   onVisible("[id^=aliasdomain_table]", () => draw_aliasdomain_table());
   onVisible("[id^=sync_job_table]", () => draw_sync_job_table());
-  onVisible("[id^=imapsync_source_table]", () => draw_imapsync_source_table());
   onVisible("[id^=filter_table]", () => draw_filter_table());
   onVisible("[id^=bcc_table]", () => draw_bcc_table());
   onVisible("[id^=recipient_map_table]", () => draw_recipient_map_table());

data/web/js/site/quarantine.js

@@ -102,21 +102,18 @@ jQuery(function($){
         {
           title: 'ID',
           data: 'id',
-          defaultContent: '',
-          render: $.fn.dataTable.render.text()
+          defaultContent: ''
         },
         {
           title: lang.qid,
           data: 'qid',
-          defaultContent: '',
-          render: $.fn.dataTable.render.text()
+          defaultContent: ''
         },
         {
           title: lang.sender,
           data: 'sender',
           className: 'senders-mw220',
-          defaultContent: '',
-          render: $.fn.dataTable.render.text()
+          defaultContent: ''
         },
         {
           title: lang.subj,
@@ -131,8 +128,7 @@ jQuery(function($){
         {
           title: lang.rcpt,
           data: 'rcpt',
-          defaultContent: '',
-          render: $.fn.dataTable.render.text()
+          defaultContent: ''
         },
         {
           title: lang.danger,

data/web/js/site/queue.js

@@ -48,13 +48,13 @@ jQuery(function($){
       url: "/api/v1/get/mailq/all",
       dataSrc: function(data){
         $.each(data, function (i, item) {
-          item.chkbox = '<input type="checkbox" class="form-check-input" data-id="mailqitems" name="multi_select" value="' + escapeHtml(item.queue_id) + '" />';
+          item.chkbox = '<input type="checkbox" class="form-check-input" data-id="mailqitems" name="multi_select" value="' + item.queue_id + '" />';
           rcpts = $.map(item.recipients, function(i) {
             return escapeHtml(i);
           });
           item.recipients = rcpts.join('<hr style="margin:1px!important">');
           item.action = '<div class="btn-group">' +
-            '<a href="#" data-bs-toggle="modal" data-bs-target="#showQueuedMsg" data-queue-id="' + escapeHtml(item.queue_id) + '" class="btn btn-xs btn-secondary">' + lang.show_message + '</a>' +
+            '<a href="#" data-bs-toggle="modal" data-bs-target="#showQueuedMsg" data-queue-id="' + encodeURI(item.queue_id) + '" class="btn btn-xs btn-secondary">' + lang.show_message + '</a>' +
             '</div>';
           });
           return data;
@@ -79,14 +79,12 @@ jQuery(function($){
         {
           title: 'QID',
           data: 'queue_id',
-          defaultContent: '',
-          render: $.fn.dataTable.render.text()
+          defaultContent: ''
         },
         {
           title: 'Queue',
           data: 'queue_name',
-          defaultContent: '',
-          render: $.fn.dataTable.render.text()
+          defaultContent: ''
         },
         {
           title: lang_admin.arrival_time,
@@ -108,8 +106,7 @@ jQuery(function($){
         {
           title: lang_admin.sender,
           data: 'sender',
-          defaultContent: '',
-          render: $.fn.dataTable.render.text()
+          defaultContent: ''
         },
         {
           title: lang_admin.recipients,

data/web/js/site/user.js

@@ -272,25 +272,22 @@ jQuery(function($){
            "tr" +
            "<'row'<'col-sm-12 col-md-5'i><'col-sm-12 col-md-7'p>>",
       language: lang_datatables,
-      order: [[3, 'asc']],
       ajax: {
         type: "GET",
         url: '/api/v1/get/syncjobs/' + encodeURIComponent(mailcow_cc_username) + '/no_log',
         dataSrc: function(data){
           $.each(data, function (i, item) {
             item.user1 = escapeHtml(item.user1);
+            item.log = '<a href="#syncjobLogModal" data-bs-toggle="modal" data-syncjob-id="' + item.id + '">' + lang.open_logs + '</a>'
             if (!item.exclude > 0) {
               item.exclude = '-';
             } else {
               item.exclude  = '<code>' + escapeHtml(item.exclude) + '</code>';
             }
-            item.server_w_port = escapeHtml(item.user1 + '@' + (item.source_name || '?') + ' (' + (item.source_host || '?') + ':' + (item.source_port || '?') + ')');
-            var tokenBadge = imapsyncJobTokenBadge(item);
-            if (tokenBadge) item.server_w_port += '<div class="mt-1">' + tokenBadge + '</div>';
+            item.server_w_port = escapeHtml(item.user1 + '@' + item.host1 + ':' + item.port1);
             if (acl_data.syncjobs === 1) {
               item.action = '<div class="btn-group">' +
                 '<a href="/edit/syncjob/' + item.id + '" class="btn btn-xs btn-xs-half btn-secondary"><i class="bi bi-pencil-fill"></i> ' + lang.edit + '</a>' +
-                '<a href="#syncjobLogModal" data-bs-toggle="modal" data-syncjob-id="' + item.id + '" class="btn btn-xs btn-xs-half btn-info"><i class="bi bi-card-list"></i> ' + lang.open_logs + '</a>' +
                 '<a href="#" data-action="delete_selected" data-id="single-syncjob" data-api-url="delete/syncjob" data-item="' + item.id + '" class="btn btn-xs btn-xs-half btn-danger"><i class="bi bi-trash"></i> ' + lang.remove + '</a>' +
                 '</div>';
               item.chkbox = '<input type="checkbox" class="form-check-input" data-id="syncjob" name="multi_select" value="' + item.id + '" />';
@@ -313,10 +310,10 @@ jQuery(function($){
             } else {
               item.success = '<i class="text-' + (item.success == 1 ? 'success' : 'danger') + ' bi bi-' + (item.success == 1 ? 'check-lg' : 'x-lg') + '"></i>';
             }
-            if (lang.syncjobs['syncjob_'+item.exit_status]) {
-              item.exit_status = lang.syncjobs['syncjob_'+item.exit_status];
+            if (lang['syncjob_'+item.exit_status]) {
+              item.exit_status = lang['syncjob_'+item.exit_status];
             } else if (item.success != '-') {
-              item.exit_status = lang.syncjobs.syncjob_check_log;
+              item.exit_status = lang.syncjob_check_log;
             }
             item.exit_status = item.success + ' ' + item.exit_status;
           });
@@ -348,12 +345,6 @@ jQuery(function($){
           defaultContent: '',
           responsivePriority: 3
         },
-        {
-          title: lang.syncjobs.prio,
-          data: 'prio',
-          defaultContent: '',
-          responsivePriority: 3
-        },
         {
           title: 'Server',
           data: 'server_w_port',
@@ -371,10 +362,15 @@ jQuery(function($){
           defaultContent: ''
         },
         {
-          title: lang.syncjobs.syncjob_last_run_result,
+          title: lang.syncjob_last_run_result,
           data: 'exit_status',
           defaultContent: ''
         },
+        {
+          title: 'Log',
+          data: 'log',
+          defaultContent: ''
+        },
         {
           title: lang.active,
           data: 'active',
@@ -698,62 +694,11 @@ jQuery(function($){
     });
   }
 
-  function draw_imapsync_source_table() {
-    if ($.fn.DataTable.isDataTable('#imapsync_source_table')) {
-      $('#imapsync_source_table').DataTable().columns.adjust().responsive.recalc();
-      return;
-    }
-    $('#imapsync_source_table').DataTable({
-      responsive: true,
-      processing: true,
-      serverSide: false,
-      stateSave: true,
-      pageLength: pagination_size,
-      dom: "<'row'<'col-sm-12 col-md-6'f><'col-sm-12 col-md-6'l>>" + "tr" +
-           "<'row'<'col-sm-12 col-md-5'i><'col-sm-12 col-md-7'p>>",
-      language: lang_datatables,
-      ajax: {
-        type: "GET",
-        url: "/api/v1/get/syncjob_source/all",
-        dataSrc: function(json) {
-          $.each(json, function(i, item) {
-            item.endpoint = escapeHtml(item.host1 + ':' + item.port1 + ' (' + item.enc1 + ')');
-            item.auth_display = imapsyncAuthDisplay(item);
-            item.visibility_display = imapsyncScopeDisplay(item);
-            if (acl_data.syncjobs === 1 && item.can_edit) {
-              item.action = '<div class="btn-group">' +
-                '<a href="/edit/syncjob_source/' + item.id + '" class="btn btn-xs btn-xs-half btn-secondary"><i class="bi bi-pencil-fill"></i> ' + lang.edit + '</a>' +
-                '<a href="#" data-action="delete_selected" data-id="single-syncjob_source" data-api-url="delete/syncjob_source" data-item="' + item.id + '" class="btn btn-xs btn-xs-half btn-danger"><i class="bi bi-trash"></i> ' + lang.remove + '</a>' +
-                '</div>';
-            } else {
-              item.action = '<span class="text-muted">-</span>';
-            }
-          });
-          return json;
-        }
-      },
-      columns: [
-        { title: 'ID', data: 'id', defaultContent: '' },
-        { title: lang.syncjobs.source_name, data: 'name', defaultContent: '', render: (d) => escapeHtml(d || '') },
-        { title: lang.syncjobs.source_scope, data: 'visibility_display', defaultContent: '' },
-        { title: 'Endpoint', data: 'endpoint', defaultContent: '' },
-        { title: lang.syncjobs.source_auth_type, data: 'auth_display', defaultContent: '' },
-        { title: lang.active, data: 'active', defaultContent: '',
-          render: function(d) { return d == 1 ? '<i class="bi bi-check-lg"></i>' : '<i class="bi bi-x-lg"></i>'; }},
-        { title: lang.action, data: 'action', defaultContent: '', className: 'dt-text-right' }
-      ]
-    });
-  }
-
-  // Shared imapsync helpers + delegated listeners live in js/build/013-mailcow.js
-  // (draw_imapsync_source_table stays per-page and calls the global imapsyncScopeDisplay).
-
   // Load only if the tab is visible
   onVisible("[id^=tla_table]", () => draw_tla_table());
   onVisible("[id^=bl_policy_mailbox_table]", () => draw_bl_policy_mailbox_table());
   onVisible("[id^=wl_policy_mailbox_table]", () => draw_wl_policy_mailbox_table());
   onVisible("[id^=sync_job_table]", () => draw_sync_job_table());
-  onVisible("[id^=imapsync_source_table]", () => draw_imapsync_source_table());
   onVisible("[id^=app_passwd_table]", () => draw_app_passwd_table());
   onVisible("[id^=recent-logins]", () => last_logins('get'));
 });

data/web/json_api.php

@@ -317,10 +317,7 @@ if (isset($_GET['query'])) {
           process_add_return(admin('add', $attr));
         break;
         case "syncjob":
-          process_add_return(syncjob('add', 'job', $attr));
-        break;
-        case "syncjob_source":
-          process_add_return(syncjob('add', 'source', $attr));
+          process_add_return(mailbox('add', 'syncjob', $attr));
         break;
         case "bcc":
           process_add_return(bcc('add', $attr));
@@ -1049,36 +1046,6 @@ if (isset($_GET['query'])) {
             }
             process_get_return($data);
           break;
-          case "syncjob_options":
-            process_get_return($GLOBALS['IMAPSYNC_OPTIONS']);
-          break;
-          case "syncjob_source":
-            switch ($object) {
-              case "all":
-                $ids = syncjob('get', 'sources');
-                $data = array();
-                if (is_array($ids)) {
-                  foreach ($ids as $sid) {
-                    $row = syncjob('get', 'source', array('id' => $sid));
-                    if ($row) $data[] = $row;
-                  }
-                }
-                process_get_return($data);
-              break;
-              default:
-                if (is_numeric($object)) {
-                  $row = syncjob('get', 'source', array('id' => $object));
-                  if ($row) {
-                    process_get_return($row);
-                  } else {
-                    echo '{}';
-                  }
-                } else {
-                  echo '{}';
-                }
-              break;
-            }
-          break;
           case "syncjobs":
             switch ($object) {
               case "all":
@@ -1088,14 +1055,14 @@ if (isset($_GET['query'])) {
                     $mailboxes = mailbox('get', 'mailboxes', $domain);
                     if (!empty($mailboxes)) {
                       foreach ($mailboxes as $mailbox) {
-                        $syncjobs = syncjob('get', 'jobs', $mailbox);
+                        $syncjobs = mailbox('get', 'syncjobs', $mailbox);
                         if (!empty($syncjobs)) {
-                          foreach ($syncjobs as $sj) {
+                          foreach ($syncjobs as $syncjob) {
                             if (isset($extra)) {
-                              $details = syncjob('get', 'job', $sj, explode(',', $extra));
+                              $details = mailbox('get', 'syncjob_details', $syncjob, explode(',', $extra));
                             }
                             else {
-                              $details = syncjob('get', 'job', $sj);
+                              $details = mailbox('get', 'syncjob_details', $syncjob);
                             }
                             if ($details) {
                               $data[] = $details;
@@ -1116,14 +1083,14 @@ if (isset($_GET['query'])) {
               break;
 
               default:
-                $syncjobs = syncjob('get', 'jobs', $object);
+                $syncjobs = mailbox('get', 'syncjobs', $object);
                 if (!empty($syncjobs)) {
-                  foreach ($syncjobs as $sj) {
+                  foreach ($syncjobs as $syncjob) {
                     if (isset($extra)) {
-                      $details = syncjob('get', 'job', $sj, explode(',', $extra));
+                      $details = mailbox('get', 'syncjob_details', $syncjob, explode(',', $extra));
                     }
                     else {
-                      $details = syncjob('get', 'job', $sj);
+                      $details = mailbox('get', 'syncjob_details', $syncjob);
                     }
                     if ($details) {
                       $data[] = $details;
@@ -1137,6 +1104,10 @@ if (isset($_GET['query'])) {
               break;
             }
           break;
+          case "syncjob_settings":
+            $data = mailbox('get', 'syncjob_settings');
+            process_get_return($data);
+          break;
           case "active-user-sieve":
             if (isset($object)) {
               $sieve_filter = mailbox('get', 'active_user_sieve', $object);
@@ -1705,6 +1676,55 @@ if (isset($_GET['query'])) {
           process_search_return($data);
         break;
 
+        case "syncjob":
+          $table = ['imapsync', 'i'];
+          $primaryKey = 'id';
+          $columns = [
+            ['db' => 'id', 'dt' => 2],
+            ['db' => 'user2', 'dt' => 3],
+            ['db' => 'host1', 'dt' => 4, 'search' => ['where_column' => "CONCAT_WS(' ', `i`.`user1`, `i`.`host1`)"]],
+            ['db' => 'last_run', 'dt' => 5],
+            ['db' => 'active', 'dt' => 8],
+          ];
+
+          if ($_SESSION['mailcow_cc_role'] === 'admin') {
+            $data = SSP::simple($requestDecoded, $pdo, $table, $primaryKey, $columns);
+          } elseif ($_SESSION['mailcow_cc_role'] === 'domainadmin') {
+            $data = SSP::complex($requestDecoded, $pdo, $table, $primaryKey, $columns,
+              'INNER JOIN `mailbox` AS `mb` ON `mb`.`username` = `i`.`user2` ' .
+              'INNER JOIN `domain_admins` AS `da` ON `da`.`domain` = `mb`.`domain`',
+              [
+                'condition' => '`da`.`active` = 1 AND `da`.`username` = :username',
+                'bindings' => ['username' => $_SESSION['mailcow_cc_username']]
+              ]);
+          } elseif ($_SESSION['mailcow_cc_role'] === 'user') {
+            $data = SSP::complex($requestDecoded, $pdo, $table, $primaryKey, $columns, null,
+              [
+                'condition' => '`i`.`user2` = :username',
+                'bindings' => ['username' => $_SESSION['mailcow_cc_username']]
+              ]);
+          } else {
+            http_response_code(403);
+            echo json_encode(array(
+              'type' => 'error',
+              'msg' => 'Insufficient permissions'
+            ));
+            exit();
+          }
+
+          if (!empty($data['data'])) {
+            $syncjobData = [];
+            foreach ($data['data'] as $row) {
+              if ($details = mailbox('get', 'syncjob_details', $row[2], array('no_log'))) {
+                $syncjobData[] = $details;
+              }
+            }
+            $data['data'] = $syncjobData;
+          }
+
+          process_search_return($data);
+        break;
+
         default:
           http_response_code(404);
           echo json_encode(array(
@@ -1775,10 +1795,7 @@ if (isset($_GET['query'])) {
           process_delete_return(rsettings('delete', array('id' => $items)));
         break;
         case "syncjob":
-          process_delete_return(syncjob('delete', 'job', array('id' => $items)));
-        break;
-        case "syncjob_source":
-          process_delete_return(syncjob('delete', 'source', array('id' => $items)));
+          process_delete_return(mailbox('delete', 'syncjob', array('id' => $items)));
         break;
         case "filter":
           process_delete_return(mailbox('delete', 'filter', array('id' => $items)));
@@ -2004,39 +2021,10 @@ if (isset($_GET['query'])) {
           }
         break;
         case "syncjob":
-          switch ($object) {
-            case "run_next":
-              process_edit_return(syncjob('edit', 'run_next', array('id' => $items)));
-            break;
-            default:
-              process_edit_return(syncjob('edit', 'job', array_merge(array('id' => $items), $attr)));
-            break;
-          }
+          process_edit_return(mailbox('edit', 'syncjob', array_merge(array('id' => $items), $attr)));
         break;
-        case "imapsync_settings":
-          $mp = intval($attr['max_parallel'] ?? 0);
-          // UI sends KB/s; store bytes/s (runner + per-job field are bytes/s)
-          $bw = max(0, intval($attr['max_kb_per_second'] ?? 0)) * 1024;
-          if ($mp < 1) {
-            $_SESSION['return'][] = array('type' => 'danger', 'log' => array('imapsync_settings', 'edit', $attr), 'msg' => 'imapsync_max_parallel_invalid');
-            process_edit_return(false);
-          } elseif (imapsync_set_setting('max_parallel', $mp) && imapsync_set_setting('max_bytes_per_second', $bw)) {
-            $_SESSION['return'][] = array('type' => 'success', 'log' => array('imapsync_settings', 'edit'), 'msg' => 'max_parallel_saved');
-            process_edit_return(true);
-          } else {
-            $_SESSION['return'][] = array('type' => 'danger', 'log' => array('imapsync_settings', 'edit'), 'msg' => 'access_denied');
-            process_edit_return(false);
-          }
-        break;
-        case "syncjob_source":
-          switch ($object) {
-            case "refresh_token":
-              process_edit_return(syncjob('edit', 'refresh_token', array('id' => $items)));
-            break;
-            default:
-              process_edit_return(syncjob('edit', 'source', array_merge(array('id' => $items), $attr)));
-            break;
-          }
+        case "syncjob_settings":
+          process_edit_return(mailbox('edit', 'syncjob_settings', $attr));
         break;
         case "filter":
           process_edit_return(mailbox('edit', 'filter', array_merge(array('id' => $items), $attr)));

data/web/lang/lang.az-az.json

@@ -1,17 +1,5 @@
 {
     "acl": {
-        "login_as": "E-poçt qutusu istifadəçisi olaraq daxil ol",
-        "alias_domains": "Alternativ domenlər əlavə et",
-        "app_passwds": "Tətbiq parollarını idarə et",
-        "bcc_maps": "BCC yönləndirmə xəritələri",
-        "delimiter_action": "Ayırıcı əməliyyatı",
-        "domain_desc": "Domen təsvirini dəyiş",
-        "domain_relayhost": "Domen üçün relay serveri dəyiş",
-        "eas_reset": "EAS cihazlarını sıfırla",
-        "extend_sender_acl": "Göndərən ACL-ni xarici ünvanlarla genişləndirməyə icazə ver",
-        "filters": "Filtrlər",
-        "mailbox_relayhost": "E-poçt qutusu üçün relay serveri dəyiş",
-        "prohibited": "ACL tərəfindən məhdudlaşdırılıb",
-        "protocol_access": "Protokol girişini dəyiş"
+        "login_as": "E-poçt qutusu istifadəçisi olaraq daxil ol"
     }
 }

data/web/lang/lang.de-de.json

@@ -1,7 +1,6 @@
 {
     "acl": {
         "alias_domains": "Alias-Domains hinzufügen",
-        "alias_external_goto": "Aliase mit externen Ziel-Domains erlauben",
         "app_passwds": "App-Passwörter verwalten",
         "bcc_maps": "BCC-Maps",
         "delimiter_action": "Delimiter-Aktionen (tags)",
@@ -45,16 +44,24 @@
         "app_name": "App-Name",
         "app_password": "App-Passwort hinzufügen",
         "app_passwd_protocols": "Zugelassene Protokolle für App-Passwort",
+        "automap": "Ordner automatisch mappen (\"Sent items\", \"Sent\" => \"Sent\" etc.)",
         "backup_mx_options": "Relay-Optionen",
         "bcc_dest_format": "BCC-Ziel muss eine gültige E-Mail-Adresse sein.",
         "comment_info": "Ein privater Kommentar ist für den Benutzer nicht einsehbar. Ein öffentlicher Kommentar wird als Tooltip im Interface des Benutzers angezeigt.",
+        "custom_params": "Eigene Parameter",
+        "custom_params_hint": "Richtig: --param=xy, falsch: --param xy",
+        "delete1": "Lösche Nachricht nach Übertragung vom Quell-Server.",
+        "delete2": "Lösche Nachrichten von Ziel-Server, die nicht auf dem Quell-Server vorhanden sind.",
+        "delete2duplicates": "Lösche Duplikate im Ziel",
         "description": "Beschreibung",
         "destination": "Ziel",
         "disable_login": "Login verbieten (Mails werden weiterhin angenommen)",
         "domain": "Domain",
         "domain_matches_hostname": "Domain %s darf nicht dem Hostnamen entsprechen",
         "domain_quota_m": "Domain-Speicherplatz gesamt (MiB)",
+        "dry": "Synchronisation simulieren",
         "enc_method": "Verschlüsselung",
+        "exclude": "Elemente ausschließen (Regex)",
         "full_name": "Vor- und Nachname",
         "gal": "Globales Adressbuch",
         "gal_info": "Das globale Adressbuch enthält alle Objekte einer Domain und kann durch keinen Benutzer geändert werden. Die Verfügbarkeitsinformation in SOGo ist nur bei eingeschaltetem globalen Adressbuch ersichtlich! <b>Zum Anwenden einer Änderung muss SOGo neugestartet werden.</b>",
@@ -73,6 +80,7 @@
         "mailbox_username": "Benutzername (linker Teil der E-Mail-Adresse)",
         "max_aliases": "Max. mögliche Aliasse",
         "max_mailboxes": "Max. mögliche Mailboxen",
+        "mins_interval": "Abrufintervall (Minuten)",
         "multiple_bookings": "Mehrfaches Buchen möglich",
         "nexthop": "Next Hop",
         "password": "Passwort",
@@ -92,9 +100,15 @@
         "select_domain": "Bitte zuerst eine Domain auswählen",
         "sieve_desc": "Kurze Beschreibung",
         "sieve_type": "Filtertyp",
+        "skipcrossduplicates": "Duplikate auch über Ordner hinweg überspringen (\"first come, first serve\")",
+        "subscribeall": "Alle synchronisierten Ordner abonnieren",
+        "syncjob": "Sync-Job hinzufügen",
+        "syncjob_hint": "Passwörter werden unverschlüsselt abgelegt!",
         "target_address": "Ziel-Adresse(n)",
         "target_address_info": "<small>Vollständige E-Mail-Adresse(n). Getrennt durch Komma.</small>",
         "target_domain": "Ziel-Domain",
+        "timeout1": "Timeout für Verbindung zum Remote-Host",
+        "timeout2": "Timeout für Verbindung zum lokalen Host",
         "username": "Benutzername",
         "validate": "Validieren",
         "validation_success": "Erfolgreich validiert",
@@ -136,7 +150,7 @@
         "arrival_time": "Ankunftszeit (Serverzeit)",
         "authed_user": "Auth. Benutzer",
         "ays": "Soll der Vorgang wirklich ausgeführt werden?",
-        "ban_list_info": "Übersicht ausgesperrter Netzwerke: <b>Netzwerk (verbleibende Bannzeit) - [Aktionen]</b>.<br />IPs, die zum Entsperren eingereiht werden, verlassen die Liste aktiver Banns nach wenigen Sekunden.<br />Rote Labels kennzeichnen aktive permanente Sperren durch Denylisting.",
+        "ban_list_info": "Übersicht ausgesperrter Netzwerke: <b>Netzwerk (verbleibende Bannzeit) - [Aktionen]</b>.<br />IPs, die zum Entsperren eingereiht werden, verlassen die Liste aktiver Banns nach wenigen Sekunden.<br />Rote Labels sind Indikatoren für aktive Allowlist-Einträge.",
         "change_logo": "Logo ändern",
         "configuration": "Konfiguration",
         "convert_html_to_text": "Konvertiere HTML zu reinem Text",
@@ -358,6 +372,9 @@
         "spamfilter": "Spamfilter",
         "subject": "Betreff",
         "success": "Erfolg",
+        "syncjobs": "Sync-Jobs",
+        "syncjobs_max_bps": "Globales Bandbreitenlimit (Bytes/s)<br><small>Maximale Transferrate pro Sync-Job in Bytes pro Sekunde. 0 = kein Limit. Wird durch ein pro Sync-Job gesetztes Limit überschrieben.</small>",
+        "syncjobs_max_parallel": "Maximale Anzahl paralleler Sync-Jobs<br><small>Wie viele imapsync-Prozesse dürfen gleichzeitig laufen. 1 = sequentiell (aktuelles Verhalten).</small>",
         "sys_mails": "System-E-Mails",
         "task": "Aufgabe",
         "text": "Text",
@@ -398,12 +415,7 @@
         "logo_dark_label": "Invertiert für den Darkmode",
         "logo_normal_label": "Normal",
         "user_link": "Nutzer-Link",
-        "filter": "Filter",
-        "syncjobs": "Sync Jobs",
-        "syncjob_max_parallel": "Max. parallele Sync-Prozesse",
-        "syncjob_max_parallel_info": "Wie viele Sync-Jobs gleichzeitig laufen dürfen.",
-        "syncjob_max_kb_per_second": "Bandbreiten-Limit pro Prozess (KB/s)",
-        "syncjob_max_kb_per_second_info": "0 = unbegrenzt. Kappt jeden Sync-Prozess; ein per-Job-Wert wird hierdurch begrenzt. Gesamt ≈ dieser Wert × parallele Prozesse."
+        "filter": "Filter"
     },
     "danger": {
         "access_denied": "Zugriff verweigert oder unvollständige/ungültige Daten",
@@ -434,7 +446,6 @@
         "domain_not_found": "Domain %s nicht gefunden",
         "domain_quota_m_in_use": "Domain-Speicherplatzlimit muss größer oder gleich %d MiB sein",
         "extended_sender_acl_denied": "Keine Rechte zum Setzen von externen Absenderadressen",
-        "external_goto_denied": "Externe Ziel-Adresse %s ist nicht erlaubt",
         "extra_acl_invalid": "Externe Absenderadresse \"%s\" ist ungültig",
         "extra_acl_invalid_domain": "Externe Absenderadresse \"%s\" verwendet eine ungültige Domain",
         "fido2_verification_failed": "FIDO2-Verifizierung fehlgeschlagen: %s",
@@ -551,24 +562,7 @@
         "template_exists": "Vorlage %s existiert bereits",
         "template_id_invalid": "Vorlagen-ID %s ungültig",
         "template_name_invalid": "Name der Vorlage ungültig",
-        "required_data_missing": "Die benötigten Daten: %s fehlen",
-        "imapsync_source_in_use": "Sync-Quelle %s wird noch von einem Sync-Job verwendet und kann nicht gelöscht werden",
-        "imapsync_source_token_refresh_failed": "OAuth-Token-Erneuerung für %s fehlgeschlagen",
-        "imapsync_source_scope_empty": "Für die gewählte Sichtbarkeit mindestens eine Domain wählen",
-        "imapsync_source_unavailable": "Die gewählte Sync-Quelle ist nicht verfügbar",
-        "imapsync_source_oauth_connect_required": "Vor dem Speichern dieses Sync-Jobs beim Provider anmelden",
-        "imapsync_source_name_invalid": "Ungültiger Name der Sync-Quelle",
-        "imapsync_source_host_invalid": "Ungültiger Host",
-        "imapsync_source_port_invalid": "Ungültiger Port",
-        "imapsync_source_enc_invalid": "Ungültige Verschlüsselungsmethode",
-        "imapsync_source_auth_invalid": "Ungültige Authentifizierungsmethode",
-        "imapsync_custom_param_invalid": "Eigene Parameter enthalten eine nicht erlaubte imapsync-Option",
-        "imapsync_source_oauth_required": "OAuth2 erfordert Token-Endpoint, Client-ID, Client-Secret und Scope",
-        "imapsync_source_oauth_endpoint_invalid": "Ungültige OAuth2-Endpoint-URL",
-        "imapsync_source_oauth_extra_invalid": "OAuth2-Extra-Parameter müssen gültiges JSON sein",
-        "imapsync_source_invalid": "Ungültige Daten der Sync-Quelle",
-        "imapsync_source_oauth_invalid": "Ungültige OAuth2-Konfiguration",
-        "imapsync_max_parallel_invalid": "Anzahl paralleler Prozesse muss mindestens 1 sein"
+        "required_data_missing": "Die benötigten Daten: %s fehlen"
     },
     "datatables": {
         "collapse_all": "Alle Einklappen",
@@ -657,6 +651,7 @@
         "app_name": "App-Name",
         "app_passwd": "App-Passwörter",
         "app_passwd_protocols": "Zugelassene Protokolle für App-Passwort",
+        "automap": "Ordner automatisch mappen (\"Sent items\", \"Sent\" => \"Sent\" etc.)",
         "backup_mx_options": "Relay-Optionen",
         "bcc_dest_format": "BCC-Ziel muss eine gültige E-Mail-Adresse sein.",
         "client_id": "Client-ID",
@@ -664,6 +659,9 @@
         "comment_info": "Ein privater Kommentar ist für den Benutzer nicht einsehbar. Ein öffentlicher Kommentar wird als Tooltip im Interface des Benutzers angezeigt.",
         "created_on": "Erstellt am",
         "custom_attributes": "benutzerdefinierte Attribute",
+        "delete1": "Lösche Nachricht nach Übertragung vom Quell-Server",
+        "delete2": "Lösche Nachrichten von Ziel-Server, die nicht auf Quell-Server vorhanden sind",
+        "delete2duplicates": "Lösche Duplikate im Ziel",
         "delete_ays": "Soll der Löschvorgang wirklich ausgeführt werden?",
         "description": "Beschreibung",
         "disable_login": "Login verbieten (Mails werden weiterhin angenommen)",
@@ -687,6 +685,7 @@
         "dont_check_sender_acl": "Absender für Domain %s u. Alias-Domain nicht prüfen",
         "edit_alias_domain": "Alias-Domain bearbeiten",
         "encryption": "Verschlüsselung",
+        "exclude": "Elemente ausschließen (Regex)",
         "extended_sender_acl": "Externe Absenderadressen",
         "extended_sender_acl_info": "Der DKIM-Domainkey der externen Absenderdomain sollte in diesen Server importiert werden, falls vorhanden.<br>\r\n  Wird SPF verwendet, muss diesem Server der Versand gestattet werden.<br>\r\n  Wird eine Domain oder Alias-Domain zu diesem Server hinzugefügt, die sich mit der externen Absenderadresse überschneidet, wird der externe Absender hier entfernt.<br>\r\n  Ein Eintrag @domain.tld erlaubt den Versand als *@domain.tld",
         "force_pw_update": "Erzwinge Passwortänderung bei nächstem Login",
@@ -717,7 +716,10 @@
         "max_aliases": "Max. Aliasse",
         "max_mailboxes": "Max. Mailboxanzahl",
         "max_quota": "Max. Größe per Mailbox (MiB)",
+        "maxage": "Maximales Alter in Tagen einer Nachricht, die kopiert werden soll<br><small>(0 = alle Nachrichten kopieren)</small>",
+        "maxbytespersecond": "Max. Übertragungsrate in Bytes/s (0 für unlimitiert)",
         "mbox_rl_info": "Dieses Limit wird auf den SASL Loginnamen angewendet und betrifft daher alle Absenderadressen, die der eingeloggte Benutzer verwendet. Bei Mailbox Ratelimit überwiegt ein Domain-weites Ratelimit.",
+        "mins_interval": "Intervall (min)",
         "mta_sts": "MTA-STS",
         "mta_sts_info": "<a href='https://de.wikipedia.org/wiki/STARTTLS#MTA-STS' target='_blank'>MTA-STS</a> ist ein Standard, der den E-Mail-Versand zwischen Mailservern zwingt, TLS mit gültigen Zertifikaten zu verwenden. <br>Er wird verwendet, wenn <a target='_blank' href='https://de.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities'>DANE</a> aufgrund fehlender oder nicht unterstützter DNSSEC nicht möglich ist.<br><b>Hinweis</b>: Wenn die empfangende Domain DANE mit DNSSEC unterstützt, wird DANE <b>immer</b> bevorzugt – MTA-STS fungiert nur als Fallback.",
         "mta_sts_version": "Version",
@@ -729,7 +731,6 @@
         "mta_sts_mx": "MX-Server",
         "mta_sts_mx_info": "Erlaubt das Senden nur an explizit aufgeführte Mailserver-Hostnamen; der sendende MTA überprüft, ob der DNS-MX-Hostname mit der Richtlinienliste übereinstimmt, und erlaubt die Zustellung nur mit einem gültigen TLS-Zertifikat (schützt vor MITM).",
         "mta_sts_mx_notice": "Es können mehrere MX-Server angegeben werden (durch Kommas getrennt).",
-        "mta_sts_active_info": "Wenn nicht angehakt, wird die MTA-STS-Richtlinie nicht veröffentlicht und für die mta-sts-Subdomain kein Zertifikat über ACME angefordert.",
         "multiple_bookings": "Mehrfaches Buchen",
         "nexthop": "Next Hop",
         "none_inherit": "Keine Auswahl / Erben",
@@ -769,6 +770,7 @@
         "sender_acl_info": "Wird einem Mailbox-Benutzer A der Versand als Mailbox-Benutzer B gestattet, so erscheint der Absender <b>nicht</b> automatisch in SOGo zur Auswahl.<br>\r\n  In SOGo muss zusätzlich eine Delegation eingerichtet werden. Dieses Verhalten trifft nicht auf Alias-Adressen zu.",
         "sieve_desc": "Kurze Beschreibung",
         "sieve_type": "Filtertyp",
+        "skipcrossduplicates": "Duplikate auch über Ordner hinweg überspringen (\"first come, first serve\")",
         "sogo_access": "Direktes weiterleiten an SOGo",
         "sogo_access_info": "Nach dem Einloggen wird der Benutzer automatisch an SOGo weitergeleitet.",
         "sogo_visible": "Alias in SOGo sichtbar",
@@ -777,8 +779,12 @@
         "spam_filter": "Spamfilter",
         "spam_policy": "Hinzufügen und Entfernen von Einträgen in Allow- und Denylisten",
         "spam_score": "Einen benutzerdefiniterten Spam-Score festlegen",
+        "subfolder2": "Ziel-Ordner<br><small>(leer = kein Unterordner)</small>",
+        "syncjob": "Sync-Job bearbeiten",
         "target_address": "Ziel-Adresse(n)",
         "target_domain": "Ziel-Domain",
+        "timeout1": "Timeout für Verbindung zum Remote-Host",
+        "timeout2": "Timeout für Verbindung zum lokalen Host",
         "title": "Objekt bearbeiten",
         "unchanged_if_empty": "Unverändert, wenn leer",
         "username": "Benutzername",
@@ -992,6 +998,7 @@
         "spam_aliases": "Spam-Alias",
         "stats": "Statistik",
         "status": "Status",
+        "sync_jobs": "Synchronisationen",
         "table_size": "Tabellengröße",
         "table_size_show_n": "Zeige %s Einträge",
         "target_address": "Ziel-Adresse",
@@ -1019,8 +1026,17 @@
         "open_logs": "Öffne Logs",
         "recipient": "Empfänger",
         "sender": "Sender",
+        "syncjob_EX_OK": "Erfolg",
+        "syncjob_EXIT_AUTHENTICATION_FAILURE_USER1": "Falscher Benutzername oder Passwort",
+        "syncjob_check_log": "Logs überprüfen",
         "all_domains": "Alle Domains",
         "catch_all": "Catch-All",
+        "syncjob_last_run_result": "Letztes Ausführungsergebnis",
+        "syncjob_EXIT_CONNECTION_FAILURE": "Verbindungsproblem",
+        "syncjob_EXIT_TLS_FAILURE": "Problem mit verschlüsselter Verbindung",
+        "syncjob_EXIT_AUTHENTICATION_FAILURE": "Authentifizierungsproblem",
+        "syncjob_EXIT_OVERQUOTA": "Ziel Mailbox ist über dem Limit",
+        "syncjob_EXIT_CONNECTION_FAILURE_HOST1": "Kann keine Verbindung zum Zielserver herstellen",
         "iam": "Identitätsanbieter"
     },
     "oauth2": {
@@ -1073,7 +1089,7 @@
         "rspamd_result": "Rspamd-Ergebnis",
         "sender": "Sender (SMTP)",
         "sender_header": "Sender (\"From\"-Header)",
-        "settings_info": "Maximale Anzahl der zurückgehaltenen E-Mails (pro Mailbox): %s<br>Maximale Größe einer zu speichernden E-Mail: %s MiB",
+        "settings_info": "Maximale Anzahl der zurückgehaltenen E-Mails: %s<br>Maximale Größe einer zu speichernden E-Mail: %s MiB",
         "show_item": "Details",
         "spam": "Spam",
         "spam_score": "Bewertung",
@@ -1187,6 +1203,7 @@
         "template_modified": "Änderungen am Template %s wurden gespeichert",
         "template_removed": "Template ID %s wurde gelöscht",
         "sogo_profile_reset": "ActiveSync-Gerät des Benutzers %s wurde zurückgesetzt",
+        "syncjob_settings_saved": "Sync-Job-Einstellungen wurden gespeichert",
         "tls_policy_map_entry_deleted": "TLS-Richtlinie mit der ID %s wurde gelöscht",
         "tls_policy_map_entry_saved": "TLS-Richtlinieneintrag \"%s\" wurde gespeichert",
         "ui_texts": "Änderungen an UI-Texten",
@@ -1194,13 +1211,7 @@
         "verified_fido2_login": "FIDO2-Anmeldung verifiziert",
         "verified_totp_login": "TOTP-Anmeldung verifiziert",
         "verified_webauthn_login": "WebAuthn-Anmeldung verifiziert",
-        "verified_yotp_login": "Yubico-OTP-Anmeldung verifiziert",
-        "imapsync_source_added": "Sync-Quelle %s wurde hinzugefügt",
-        "imapsync_source_modified": "Sync-Quelle %s wurde gespeichert",
-        "imapsync_source_deleted": "Sync-Quelle %s wurde gelöscht",
-        "imapsync_source_token_refreshed": "OAuth-Token für %s wurde erneuert",
-        "max_parallel_saved": "Sync-Job-Einstellungen gespeichert",
-        "imapsync_run_next_done": "%s Sync-Job(s) an den Anfang der Warteschlange gesetzt"
+        "verified_yotp_login": "Yubico-OTP-Anmeldung verifiziert"
     },
     "tfa": {
         "authenticators": "Authentikatoren",
@@ -1235,77 +1246,6 @@
         "setup_required": "Ihr Konto erfordert Zwei-Faktor-Authentifizierung. Bitte richten Sie eine 2FA-Methode ein, um fortzufahren.",
         "cancel_setup": "Abbrechen und abmelden"
     },
-    "syncjobs": {
-        "sources_panel": "Sync-Quellen",
-        "sources_hint": "Sync-Quellen definieren IMAP-Server (mit ihrer Authentifizierungsmethode), die von Sync-Jobs wiederverwendet werden können. Definiere jede Quelle einmal und wähle sie dann beim Anlegen eines Sync-Jobs aus dem Dropdown aus.",
-        "source_add": "Quelle hinzufügen",
-        "source": "Quelle",
-        "source_name": "Name",
-        "source_description": "Beschreibung",
-        "source_scope": "Sichtbarkeit",
-        "source_scope_all": "Alle Nutzer",
-        "source_scope_domain": "Bestimmte Domains",
-        "source_scope_user": "Bestimmte Nutzer",
-        "source_domains": "Domains",
-        "source_users": "Nutzer",
-        "source_select": "Quelle wählen",
-        "source_auth_type": "Authentifizierung",
-        "source_oauth_block": "OAuth2-Konfiguration",
-        "source_token_status": "Token gültig bis",
-        "source_token_error": "Letzter Refresh-Fehler",
-        "source_refresh_now": "Token jetzt erneuern",
-        "source_secret_unchanged_hint": "Leer lassen, um das gespeicherte Secret beizubehalten.",
-        "source_oauth_flow": "OAuth2-Flow",
-        "source_oauth_flow_app": "App (Client Credentials)",
-        "source_oauth_flow_user": "Benutzer-Login (Authorization Code)",
-        "source_flow_badge_app": "Client Credentials",
-        "source_flow_badge_user": "Benutzer-Login",
-        "token_state_issued": "Token ausgestellt",
-        "token_state_pending": "Token wird ausgestellt",
-        "token_state_failed": "Token fehlgeschlagen",
-        "source_authorize_endpoint": "Authorize-Endpoint",
-        "source_userinfo_endpoint": "Userinfo-Endpoint",
-        "source_redirect_uri": "Redirect-URI",
-        "source_redirect_uri_hint": "Diese URI in der Provider-App (z.B. Azure) eintragen.",
-        "syncjob_oauth_connect": "Beim Provider anmelden",
-        "syncjob_oauth_connected": "Verbunden",
-        "sync_jobs": "Sync Jobs",
-        "syncjob_check_log": "Logs überprüfen",
-        "syncjob_last_run_result": "Letztes Ausführungsergebnis",
-        "syncjob_EX_OK": "Erfolg",
-        "syncjob_EXIT_CONNECTION_FAILURE": "Verbindungsproblem",
-        "syncjob_EXIT_TLS_FAILURE": "Problem mit verschlüsselter Verbindung",
-        "syncjob_EXIT_AUTHENTICATION_FAILURE": "Authentifizierungsproblem",
-        "syncjob_EXIT_OVERQUOTA": "Ziel Mailbox ist über dem Limit",
-        "syncjob_EXIT_CONNECTION_FAILURE_HOST1": "Kann keine Verbindung zum Zielserver herstellen",
-        "syncjob_EXIT_AUTHENTICATION_FAILURE_USER1": "Falscher Benutzername oder Passwort",
-        "add": "Sync-Job hinzufügen",
-        "add_hint": "Passwörter werden unverschlüsselt abgelegt!",
-        "edit": "Sync-Job bearbeiten",
-        "create": "Neuen Sync-Job erstellen",
-        "dry": "Synchronisation simulieren",
-        "subfolder2": "Ziel-Ordner<br><small>(leer = kein Unterordner)</small>",
-        "mins_interval": "Abrufintervall (Minuten)",
-        "maxage": "Maximales Alter in Tagen einer Nachricht, die kopiert werden soll<br><small>(0 = alle Nachrichten kopieren)</small>",
-        "exclude": "Elemente ausschließen (Regex)",
-        "automap": "Ordner automatisch mappen (\"Sent items\", \"Sent\" => \"Sent\" etc.)",
-        "delete1": "Lösche Nachricht nach Übertragung vom Quell-Server.",
-        "delete2": "Lösche Nachrichten von Ziel-Server, die nicht auf dem Quell-Server vorhanden sind.",
-        "delete2duplicates": "Lösche Duplikate im Ziel",
-        "skipcrossduplicates": "Duplikate auch über Ordner hinweg überspringen (\"first come, first serve\")",
-        "subscribeall": "Alle synchronisierten Ordner abonnieren",
-        "timeout1": "Timeout für Verbindung zum Remote-Host",
-        "timeout2": "Timeout für Verbindung zum lokalen Host",
-        "maxbytespersecond": "Max. Übertragungsrate in Bytes/s (0 für unlimitiert)",
-        "custom_params": "Eigene Parameter",
-        "custom_params_hint": "Pro Zeile eine imapsync-Option. Es werden nur erlaubte Optionen akzeptiert; der Wert darf beliebige Zeichen enthalten (Leerzeichen, Regex, …) und wird als ein einzelnes Argument übergeben.",
-        "custom_param_option": "Option",
-        "custom_param_value": "Wert",
-        "custom_param_no_value": "kein Wert nötig",
-        "custom_param_add": "Parameter hinzufügen",
-        "prio": "Priorität",
-        "prio_hint": "Fällige Jobs laufen am längsten-nicht-gelaufen zuerst; bei gleichem Stand entscheidet die höhere Priorität (0 = normal)."
-    },
     "user": {
         "action": "Aktion",
         "active": "Aktiv",
@@ -1336,6 +1276,7 @@
         "clear_recent_successful_connections": "Alle erfolgreichen Verbindungen bereinigen",
         "client_configuration": "Konfigurationsanleitungen für E-Mail-Programme und Smartphones anzeigen",
         "create_app_passwd": "Erstelle App-Passwort",
+        "create_syncjob": "Neuen Sync-Job erstellen",
         "created_on": "Erstellt am",
         "daily": "Täglich",
         "day": "Tag",
@@ -1443,6 +1384,7 @@
         "spamfilter_wl_desc": "Für E-Mail-Adressen, die vom Spamfilter <b>nicht</b> erfasst werden sollen. Die Verwendung von Wildcards ist gestattet. Ein Filter funktioniert lediglich für direkte Nicht-„Catch-All“-Alias-Adressen (Alias-Adressen mit lediglich einer Mailbox als Ziel-Adresse) sowie die Mailbox-Adresse selbst.",
         "spamfilter_yellow": "Gelb: Die Nachricht ist vielleicht Spam, wird als Spam markiert und in den Junk-Ordner verschoben",
         "status": "Status",
+        "sync_jobs": "Sync Jobs",
         "tag_handling": "Umgang mit getaggten E-Mails steuern",
         "tag_help_example": "Beispiel für eine getaggte E-Mail-Adresse: ich<b>+Facebook</b>@example.org",
         "tag_help_explain": "Als Unterordner: Es wird ein Ordner mit dem Namen des Tags unterhalb der Inbox erstellt (\"INBOX/Facebook\").<br>\r\nIn Betreff: Der Name des Tags wird dem Betreff angefügt, etwa \"[Facebook] Meine Neuigkeiten\".",
@@ -1467,7 +1409,16 @@
         "with_app_password": "mit App-Passwort",
         "year": "Jahr",
         "years": "Jahren",
+        "syncjob_EX_OK": "Erfolg",
         "open_logs": "Öffne Logs",
+        "syncjob_check_log": "Logs überprüfen",
+        "syncjob_EXIT_CONNECTION_FAILURE_HOST1": "Kann keine Verbindung zum Zielserver herstellen",
+        "syncjob_EXIT_OVERQUOTA": "Ziel Mailbox ist über dem Limit",
+        "syncjob_last_run_result": "Letztes Ausführungsergebnis",
+        "syncjob_EXIT_CONNECTION_FAILURE": "Verbindungsproblem",
+        "syncjob_EXIT_TLS_FAILURE": "Problem mit verschlüsselter Verbindung",
+        "syncjob_EXIT_AUTHENTICATION_FAILURE": "Authentifizierungsproblem",
+        "syncjob_EXIT_AUTHENTICATION_FAILURE_USER1": "Falscher Benutzername oder Passwort",
         "pushover_sound": "Ton"
     },
     "warning": {

data/web/lang/lang.en-gb.json

@@ -1,7 +1,6 @@
 {
     "acl": {
         "alias_domains": "Add alias domains",
-        "alias_external_goto": "Allow aliases with external goto domains",
         "app_passwds": "Manage app passwords",
         "bcc_maps": "BCC maps",
         "delimiter_action": "Delimiter action",
@@ -45,16 +44,24 @@
         "app_name": "App name",
         "app_password": "Add app password",
         "app_passwd_protocols": "Allowed protocols for app password",
+        "automap": "Try to automap folders (\"Sent items\", \"Sent\" => \"Sent\" etc.)",
         "backup_mx_options": "Relay options",
         "bcc_dest_format": "BCC destination must be a single valid email address.<br>If you need to send a copy to multiple addresses, create an alias and use it here.",
         "comment_info": "A private comment is not visible to the user, while a public comment is shown as tooltip when hovering it in a user's overview",
+        "custom_params": "Custom parameters",
+        "custom_params_hint": "Right: --param=xy, wrong: --param xy",
+        "delete1": "Delete from source when completed",
+        "delete2": "Delete messages on destination that are not on source",
+        "delete2duplicates": "Delete duplicates on destination",
         "description": "Description",
         "destination": "Destination",
         "disable_login": "Disallow login (incoming mail is still accepted)",
         "domain": "Domain",
         "domain_matches_hostname": "Domain %s matches hostname",
         "domain_quota_m": "Total domain quota (MiB)",
+        "dry": "Simulate synchronization",
         "enc_method": "Encryption method",
+        "exclude": "Exclude objects (regex)",
         "full_name": "Full name",
         "gal": "Global Address List",
         "gal_info": "The GAL contains all objects of a domain and cannot be edited by any user. Free/busy information in SOGo is missing, if disabled! <b>Restart SOGo to apply changes.</b>",
@@ -73,6 +80,7 @@
         "mailbox_username": "Username (left part of an email address)",
         "max_aliases": "Max. possible aliases",
         "max_mailboxes": "Max. possible mailboxes",
+        "mins_interval": "Polling interval (minutes)",
         "multiple_bookings": "Multiple bookings",
         "nexthop": "Next hop",
         "password": "Password",
@@ -92,10 +100,16 @@
         "select_domain": "Please select a domain first",
         "sieve_desc": "Short description",
         "sieve_type": "Filter type",
+        "skipcrossduplicates": "Skip duplicate messages across folders (first come, first serve)",
+        "subscribeall": "Subscribe all folders",
+        "syncjob": "Add sync job",
+        "syncjob_hint": "Be aware that passwords need to be saved plain-text!",
         "tags": "Tags",
         "target_address": "Goto addresses",
         "target_address_info": "<small>Full email address/es (comma-separated).</small>",
         "target_domain": "Target domain",
+        "timeout1": "Timeout for connection to remote host",
+        "timeout2": "Timeout for connection to local host",
         "username": "Username",
         "validate": "Validate",
         "validation_success": "Validated successfully"
@@ -368,6 +382,9 @@
         "spamfilter": "Spam filter",
         "subject": "Subject",
         "success": "Success",
+        "syncjobs": "Sync jobs",
+        "syncjobs_max_bps": "Global bandwidth limit (bytes/s)<br><small>Maximum transfer rate per sync job in bytes per second. 0 = no limit. Overridden by a per-job limit.</small>",
+        "syncjobs_max_parallel": "Maximum parallel sync jobs<br><small>How many imapsync processes are allowed to run in parallel. 1 = sequential (legacy behavior).</small>",
         "sys_mails": "System mails",
         "task": "Task",
         "text": "Text",
@@ -398,12 +415,7 @@
         "user_quicklink": "Hide Quicklink to User Login Page",
         "validate_license_now": "Validate GUID against license server",
         "verify": "Verify",
-        "yes": "&#10003;",
-        "syncjobs": "Sync jobs",
-        "syncjob_max_parallel": "Max. parallel sync processes",
-        "syncjob_max_parallel_info": "How many sync jobs may run at the same time.",
-        "syncjob_max_kb_per_second": "Bandwidth limit per process (KB/s)",
-        "syncjob_max_kb_per_second_info": "0 = unlimited. Caps every sync process; a per-job value is capped by this. Total ≈ this × max parallel."
+        "yes": "&#10003;"
     },
     "danger": {
         "access_denied": "Access denied or invalid form data",
@@ -435,7 +447,6 @@
         "domain_not_found": "Domain %s not found",
         "domain_quota_m_in_use": "Domain quota must be greater or equal to %s MiB",
         "extended_sender_acl_denied": "missing ACL to set external sender addresses",
-        "external_goto_denied": "External goto address %s is not allowed",
         "extra_acl_invalid": "External sender address \"%s\" is invalid",
         "extra_acl_invalid_domain": "External sender \"%s\" uses an invalid domain",
         "fido2_verification_failed": "FIDO2 verification failed: %s",
@@ -551,24 +562,7 @@
         "validity_missing": "Please assign a period of validity",
         "value_missing": "Please provide all values",
         "version_invalid": "Version %s is invalid",
-        "yotp_verification_failed": "Yubico OTP verification failed: %s",
-        "imapsync_source_in_use": "Sync source %s is still used by a sync job and cannot be deleted",
-        "imapsync_source_token_refresh_failed": "OAuth token refresh for %s failed",
-        "imapsync_source_scope_empty": "Select at least one domain for the chosen visibility",
-        "imapsync_source_unavailable": "The selected sync source is unavailable",
-        "imapsync_source_oauth_connect_required": "Sign in with the provider before saving this sync job",
-        "imapsync_source_name_invalid": "Invalid sync source name",
-        "imapsync_source_host_invalid": "Invalid host",
-        "imapsync_source_port_invalid": "Invalid port",
-        "imapsync_source_enc_invalid": "Invalid encryption method",
-        "imapsync_source_auth_invalid": "Invalid authentication method",
-        "imapsync_custom_param_invalid": "Custom parameters contain a disallowed imapsync option",
-        "imapsync_source_oauth_required": "OAuth2 requires token endpoint, client ID, client secret and scope",
-        "imapsync_source_oauth_endpoint_invalid": "Invalid OAuth2 endpoint URL",
-        "imapsync_source_oauth_extra_invalid": "OAuth2 extra parameters must be valid JSON",
-        "imapsync_source_invalid": "Invalid sync source data",
-        "imapsync_source_oauth_invalid": "Invalid OAuth2 configuration",
-        "imapsync_max_parallel_invalid": "Parallel process count must be at least 1"
+        "yotp_verification_failed": "Yubico OTP verification failed: %s"
     },
     "datatables": {
         "collapse_all": "Collapse All",
@@ -657,6 +651,7 @@
         "app_name": "App name",
         "app_passwd": "App password",
         "app_passwd_protocols": "Allowed protocols for app password",
+        "automap": "Try to automap folders (\"Sent items\", \"Sent\" => \"Sent\" etc.)",
         "backup_mx_options": "Relay options",
         "bcc_dest_format": "BCC destination must be a single valid email address.<br>If you need to send a copy to multiple addresses, create an alias and use it here.",
         "client_id": "Client ID",
@@ -664,6 +659,9 @@
         "comment_info": "A private comment is not visible to the user, while a public comment is shown as tooltip when hovering it in a user's overview",
         "created_on": "Created on",
         "custom_attributes": "Custom attributes",
+        "delete1": "Delete from source when completed",
+        "delete2": "Delete messages on destination that are not on source",
+        "delete2duplicates": "Delete duplicates on destination",
         "delete_ays": "Please confirm the deletion process.",
         "description": "Description",
         "disable_login": "Disallow login (incoming mail is still accepted)",
@@ -687,6 +685,7 @@
         "dont_check_sender_acl": "Disable sender check for domain %s (+ alias domains)",
         "edit_alias_domain": "Edit Alias domain",
         "encryption": "Encryption",
+        "exclude": "Exclude objects (regex)",
         "extended_sender_acl": "External sender addresses",
         "extended_sender_acl_info": "A DKIM domain key should be imported, if available.<br>\r\n  Remember to add this server to the corresponding SPF TXT record.<br>\r\n  Whenever a domain or alias domain is added to this server, that overlaps with an external address, the external address is removed.<br>\r\n  Use @domain.tld to allow to send as *@domain.tld.",
         "force_pw_update": "Force password update at next login",
@@ -717,7 +716,10 @@
         "max_aliases": "Max. aliases",
         "max_mailboxes": "Max. possible mailboxes",
         "max_quota": "Max. quota per mailbox (MiB)",
+        "maxage": "Maximum age of messages in days that will be polled from remote<br><small>(0 = ignore age)</small>",
+        "maxbytespersecond": "Max. bytes per second <br><small>(0 = unlimited)</small>",
         "mbox_rl_info": "This rate limit is applied on the SASL login name, it matches any \"from\" address used by the logged-in user. A mailbox rate limit overrides a domain-wide rate limit.",
+        "mins_interval": "Interval (min)",
         "mta_sts": "MTA-STS",
         "mta_sts_info": "<a href='https://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol#SMTP_MTA_Strict_Transport_Security' target='_blank'>MTA-STS</a> is a standard that enforces email delivery between mail servers to use TLS with valid certificates. <br>It is used when <a target='_blank' href='https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities'>DANE</a> is not possible due to missing or unsupported DNSSEC.<br><b>Note</b>: If the receiving domain supports DANE with DNSSEC, DANE is <b>always</b> preferred – MTA-STS only acts as a fallback.",
         "mta_sts_version": "Version",
@@ -729,7 +731,6 @@
         "mta_sts_mx": "MX server",
         "mta_sts_mx_info": "Allows sending only to explicitly listed mail server hostnames; the sending MTA checks if the DNS MX hostname matches the policy list, and only allows delivery with a valid TLS certificate (guards against MITM).",
         "mta_sts_mx_notice": "Multiple MX servers can be specified (separated by commas).",
-        "mta_sts_active_info": "If unchecked, the MTA-STS policy will not be published and no certificate will be requested for the mta-sts subdomain via ACME.",
         "multiple_bookings": "Multiple bookings",
         "none_inherit": "None / Inherit",
         "nexthop": "Next hop",
@@ -770,6 +771,7 @@
         "sender_acl_info": "If mailbox user A is allowed to send as mailbox user B, the sender address is not automatically displayed as selectable \"from\" field in SOGo.<br>\r\n  Mailbox user B needs to create a delegation in SOGo to allow mailbox user A to select their address as sender. To delegate a mailbox in SOGo, use the menu (three dots) to the right of your mailbox name in the upper left while in mail view. This behaviour does not apply to alias addresses.",
         "sieve_desc": "Short description",
         "sieve_type": "Filter type",
+        "skipcrossduplicates": "Skip duplicate messages across folders (first come, first serve)",
         "sogo_access": "Direct forwarding to SOGo",
         "sogo_access_info": "After logging in, the user is automatically redirected to SOGo.",
         "sogo_visible": "Alias is visible in SOGo",
@@ -778,8 +780,12 @@
         "spam_filter": "Spam filter",
         "spam_policy": "Add or remove items to allow-/denylist",
         "spam_score": "Set a custom spam score",
+        "subfolder2": "Sync into subfolder on destination<br><small>(empty = do not use subfolder)</small>",
+        "syncjob": "Edit sync job",
         "target_address": "Goto address/es <small>(comma-separated)</small>",
         "target_domain": "Target domain",
+        "timeout1": "Timeout for connection to remote host",
+        "timeout2": "Timeout for connection to local host",
         "title": "Edit object",
         "unchanged_if_empty": "If unchanged leave blank",
         "username": "Username",
@@ -926,7 +932,6 @@
         "filters": "Filters",
         "fname": "Full name",
         "force_pw_update": "Force password update at next login",
-        "force_tfa": "TFA",
         "gal": "Global Address List",
         "goto_ham": "Learn as <b>ham</b>",
         "goto_spam": "Learn as <b>spam</b>",
@@ -1001,6 +1006,16 @@
         "spam_aliases": "Temp. alias",
         "stats": "Statistics",
         "status": "Status",
+        "sync_jobs": "Sync jobs",
+        "syncjob_check_log": "Check log",
+        "syncjob_last_run_result": "Last run result",
+        "syncjob_EX_OK": "Success",
+        "syncjob_EXIT_CONNECTION_FAILURE": "Connection problem",
+        "syncjob_EXIT_TLS_FAILURE": "Problem with encrypted connection",
+        "syncjob_EXIT_AUTHENTICATION_FAILURE": "Authentication problem",
+        "syncjob_EXIT_OVERQUOTA": "Target mailbox is over quota",
+        "syncjob_EXIT_CONNECTION_FAILURE_HOST1": "Can't connect to remote server",
+        "syncjob_EXIT_AUTHENTICATION_FAILURE_USER1": "Wrong username or password",
         "table_size": "Table size",
         "table_size_show_n": "Show %s items",
         "target_address": "Goto address",
@@ -1074,7 +1089,7 @@
         "rspamd_result": "Rspamd result",
         "sender": "Sender (SMTP)",
         "sender_header": "Sender (\"From\" header)",
-        "settings_info": "Maximum amount of elements to be quarantined (per mailbox): %s<br>Maximum email size: %s MiB",
+        "settings_info": "Maximum amount of elements to be quarantined: %s<br>Maximum email size: %s MiB",
         "show_item": "Show item",
         "spam": "Spam",
         "spam_score": "Score",
@@ -1192,6 +1207,7 @@
         "settings_map_added": "Added settings map entry",
         "settings_map_removed": "Removed settings map ID %s",
         "sogo_profile_reset": "SOGo profile for user %s was reset",
+        "syncjob_settings_saved": "Sync job settings have been saved",
         "template_added": "Added template %s",
         "template_modified": "Changes to template %s have been saved",
         "template_removed": "Template ID %s has been deleted",
@@ -1202,13 +1218,7 @@
         "verified_fido2_login": "Verified FIDO2 login",
         "verified_totp_login": "Verified TOTP login",
         "verified_webauthn_login": "Verified WebAuthn login",
-        "verified_yotp_login": "Verified Yubico OTP login",
-        "imapsync_source_added": "Sync source %s has been added",
-        "imapsync_source_modified": "Sync source %s has been saved",
-        "imapsync_source_deleted": "Sync source %s has been deleted",
-        "imapsync_source_token_refreshed": "OAuth token for %s has been refreshed",
-        "max_parallel_saved": "Sync job settings saved",
-        "imapsync_run_next_done": "%s sync job(s) moved to the front of the queue"
+        "verified_yotp_login": "Verified Yubico OTP login"
     },
     "tfa": {
         "authenticators": "Authenticators",
@@ -1243,77 +1253,6 @@
         "waiting_usb_register": "<i>Waiting for USB device...</i><br><br>Please enter your password above and confirm your registration by tapping the button on your USB device.",
         "yubi_otp": "Yubico OTP authentication"
     },
-    "syncjobs": {
-        "sources_panel": "Sync Sources",
-        "sources_hint": "Sync sources define IMAP servers (and their authentication method) that sync jobs can reuse. Define each source once, then pick it from the dropdown when creating sync jobs.",
-        "source_add": "Add source",
-        "source": "Source",
-        "source_name": "Name",
-        "source_description": "Description",
-        "source_scope": "Visibility",
-        "source_scope_all": "All users",
-        "source_scope_domain": "Specific domains",
-        "source_scope_user": "Specific users",
-        "source_domains": "Domains",
-        "source_users": "Users",
-        "source_select": "Select source",
-        "source_auth_type": "Authentication",
-        "source_oauth_block": "OAuth2 configuration",
-        "source_token_status": "Token valid until",
-        "source_token_error": "Last refresh error",
-        "source_refresh_now": "Refresh token now",
-        "source_secret_unchanged_hint": "Leave blank to keep the stored secret unchanged.",
-        "source_oauth_flow": "OAuth2 flow",
-        "source_oauth_flow_app": "App (client credentials)",
-        "source_oauth_flow_user": "User login (authorization code)",
-        "source_flow_badge_app": "Client credentials",
-        "source_flow_badge_user": "User login",
-        "token_state_issued": "Token issued",
-        "token_state_pending": "Token pending",
-        "token_state_failed": "Token failed",
-        "source_authorize_endpoint": "Authorize endpoint",
-        "source_userinfo_endpoint": "Userinfo endpoint",
-        "source_redirect_uri": "Redirect URI",
-        "source_redirect_uri_hint": "Register this URI in the provider app (e.g. Azure).",
-        "syncjob_oauth_connect": "Sign in with the provider",
-        "syncjob_oauth_connected": "Connected",
-        "sync_jobs": "Sync jobs",
-        "syncjob_check_log": "Check log",
-        "syncjob_last_run_result": "Last run result",
-        "syncjob_EX_OK": "Success",
-        "syncjob_EXIT_CONNECTION_FAILURE": "Connection problem",
-        "syncjob_EXIT_TLS_FAILURE": "Problem with encrypted connection",
-        "syncjob_EXIT_AUTHENTICATION_FAILURE": "Authentication problem",
-        "syncjob_EXIT_OVERQUOTA": "Target mailbox is over quota",
-        "syncjob_EXIT_CONNECTION_FAILURE_HOST1": "Can't connect to remote server",
-        "syncjob_EXIT_AUTHENTICATION_FAILURE_USER1": "Wrong username or password",
-        "add": "Add sync job",
-        "add_hint": "Be aware that passwords need to be saved plain-text!",
-        "edit": "Edit sync job",
-        "create": "Create new sync job",
-        "dry": "Simulate synchronization",
-        "subfolder2": "Sync into subfolder on destination<br><small>(empty = do not use subfolder)</small>",
-        "mins_interval": "Polling interval (minutes)",
-        "maxage": "Maximum age of messages in days that will be polled from remote<br><small>(0 = ignore age)</small>",
-        "exclude": "Exclude objects (regex)",
-        "automap": "Try to automap folders (\"Sent items\", \"Sent\" => \"Sent\" etc.)",
-        "delete1": "Delete from source when completed",
-        "delete2": "Delete messages on destination that are not on source",
-        "delete2duplicates": "Delete duplicates on destination",
-        "skipcrossduplicates": "Skip duplicate messages across folders (first come, first serve)",
-        "subscribeall": "Subscribe all folders",
-        "timeout1": "Timeout for connection to remote host",
-        "timeout2": "Timeout for connection to local host",
-        "maxbytespersecond": "Max. bytes per second <br><small>(0 = unlimited)</small>",
-        "custom_params": "Custom parameters",
-        "custom_params_hint": "Add one imapsync option per row. Only allowlisted options are accepted; the value may contain any character (spaces, regex, …) and is passed as a single argument.",
-        "custom_param_option": "Option",
-        "custom_param_value": "Value",
-        "custom_param_no_value": "no value needed",
-        "custom_param_add": "Add parameter",
-        "prio": "Priority",
-        "prio_hint": "Due jobs run least-recently-run first; on a tie the higher priority wins (0 = normal)."
-    },
     "user": {
         "action": "Action",
         "active": "Active",
@@ -1344,6 +1283,7 @@
         "clear_recent_successful_connections": "Clear seen successful connections",
         "client_configuration": "Show configuration guides for email clients and smartphones",
         "create_app_passwd": "Create app password",
+        "create_syncjob": "Create new sync job",
         "created_on": "Created on",
         "daily": "Daily",
         "day": "day",
@@ -1453,6 +1393,16 @@
         "spamfilter_wl_desc": "Allowlisted email addresses are programmed to <b>never</b> classify as spam. Wildcards may be used. A filter is only applied to direct aliases (aliases with a single target mailbox) excluding catch-all aliases and a mailbox itself.",
         "spamfilter_yellow": "Yellow: this message may be spam, will be tagged as spam and moved to your junk folder",
         "status": "Status",
+        "sync_jobs": "Sync jobs",
+        "syncjob_check_log": "Check log",
+        "syncjob_last_run_result": "Last run result",
+        "syncjob_EX_OK": "Success",
+        "syncjob_EXIT_CONNECTION_FAILURE": "Connection problem",
+        "syncjob_EXIT_TLS_FAILURE": "Problem with encrypted connection",
+        "syncjob_EXIT_AUTHENTICATION_FAILURE": "Authentication problem",
+        "syncjob_EXIT_OVERQUOTA": "Target mailbox is over quota",
+        "syncjob_EXIT_CONNECTION_FAILURE_HOST1": "Can't connect to remote server",
+        "syncjob_EXIT_AUTHENTICATION_FAILURE_USER1": "Wrong username or password",
         "tag_handling": "Set handling for tagged mail",
         "tag_help_example": "Example for a tagged email address: me<b>+Facebook</b>@example.org",
         "tag_help_explain": "In subfolder: a new subfolder named after the tag will be created below INBOX (\"INBOX/Facebook\").<br>\r\nIn subject: the tags name will be prepended to the mails subject, example: \"[Facebook] My News\".",

data/web/lang/lang.fr-fr.json

@@ -111,8 +111,7 @@
         "app_passwd_protocols": "Protocoles autorisés pour le mot de passe de l'application",
         "dry": "Simuler la synchronisation",
         "internal": "Interne",
-        "internal_info": "Les alias internes sont accessibles uniquement depuis le domaine ou les alias du domaine.",
-        "sender_allowed": "Autoriser l'envoi sous cet alias"
+        "internal_info": "Les alias internes sont accessibles uniquement depuis le domaine ou les alias du domaine."
     },
     "admin": {
         "access": "Accès",
@@ -557,9 +556,7 @@
         "max_age_invalid": "L'âge maximum %s est invalide",
         "mode_invalid": "Le mode %s est invalide",
         "mx_invalid": "L'enregistrement MX %s est invalide",
-        "version_invalid": "La version %s est invalide",
-        "tfa_removal_blocked": "L’authentification à deux facteurs ne peut pas être supprimée, car elle est requise pour votre compte.",
-        "quarantine_category_invalid": "La catégorie de quarantaine doit être l’une des suivantes : add_header, reject, all\""
+        "version_invalid": "La version %s est invalide"
     },
     "debug": {
         "chart_this_server": "Graphique (ce serveur)",
@@ -758,9 +755,7 @@
         "mta_sts_info": "<a href='https://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol#SMTP_MTA_Strict_Transport_Security' target='_blank'>MTA-STS</a> est un standard qui oblige la délivrance des courriels entre les serveurs de courriels à utiliser TLS avec des certificats valides. <br>Il est utilisé quand <a target='_blank' href='https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities'>DANE</a> n'est pas possible à cause d'un manque ou d'un non support de DNSSEC.<br><b>Note</b> : Si le domaine du destinataire supporte DANE avec DNSSEC, DANE est <b>toujours</b> préféré – MTA-STS sert seulement en secours.",
         "mta_sts_mode_info": "Il y a trois modes parmi lesquels choisir :<ul><li><em>testing</em> – la politique est seulement surveillée, les violations n'ont pas d'impact.</li><li><em>enforce</em> – la politique est appliquée strictement, les connexions sans TLS valide sont rejetées.</li><li><em>none</em> – la politique est publiée mais non appliquée.</li></ul>",
         "mta_sts_max_age_info": "Durée en secondes pendant laquelle les serveurs de courriel peuvent mettre en cache cette politique avant de revérifier.",
-        "mta_sts_mx_info": "Autoriser l'envoi uniquement aux noms d'hôtes des serveurs de courriels indiqués explicitement ; le MTA émetteur vérifie si le nom d'hôte DNS du MX correspond à la liste de la politique, et autorise la délivrance seulement avec un certificat TLS valide (protège contre le MITM).",
-        "sender_allowed": "Autoriser l'envoi sous cet alias",
-        "sender_allowed_info": "Si cette option est désactivée, cet alias peut uniquement recevoir des courriels. Utilisez les ACL d’expéditeur pour autoriser certaines boîtes aux lettres à envoyer des messages via cet alias."
+        "mta_sts_mx_info": "Autoriser l'envoi uniquement aux noms d'hôtes des serveurs de courriels indiqués explicitement ; le MTA émetteur vérifie si le nom d'hôte DNS du MX correspond à la liste de la politique, et autorise la délivrance seulement avec un certificat TLS valide (protège contre le MITM)."
     },
     "footer": {
         "cancel": "Annuler",
@@ -993,8 +988,7 @@
         "recipient": "Destinataire",
         "open_logs": "Afficher les journaux",
         "iam": "Fournisseur d'identité",
-        "internal": "Interne",
-        "force_tfa": "TFA"
+        "internal": "Interne"
     },
     "oauth2": {
         "access_denied": "Veuillez vous connecter en tant que propriétaire de la boîte de réception pour accorder l’accès via Oauth2.",
@@ -1195,11 +1189,7 @@
         "yubi_otp": "Authentification OTP Yubico",
         "authenticators": "Authentificateurs",
         "u2f_deprecated_important": "Veuillez enregistrer votre clé dans le panneau d'administration avec la nouvelle méthode WebAuthn.",
-        "u2f_deprecated": "Il semble que votre clé ait été enregistrée à l'aide de la méthode U2F obsolète. Nous allons désactiver l'authentification à deux facteurs pour vous et supprimer votre clé.",
-        "force_tfa": "Imposer l'authentification à deux facteurs lors de la connexion",
-        "force_tfa_info": "L’utilisateur doit configurer l’authentification à deux facteurs avant de pouvoir accéder à l’interface.",
-        "setup_title": "Authentification à deux facteurs requise",
-        "setup_required": "Votre compte nécessite l’authentification à deux facteurs. Veuillez configurer une méthode 2FA pour continuer."
+        "u2f_deprecated": "Il semble que votre clé ait été enregistrée à l'aide de la méthode U2F obsolète. Nous allons désactiver l'authentification à deux facteurs pour vous et supprimer votre clé."
     },
     "fido2": {
         "set_fn": "Définir un nom",
@@ -1388,8 +1378,7 @@
         "forever": "Pour toujours",
         "spam_aliases_info": "Un alias de spam est une adresse de courriel temporaire qui peut être utilisée pour protéger les véritables adresses de courriel. <br> De manière optionnelle, une durée d'expiration peut être définie afin que l'alias soit automatiquement désactivé après la période définie, éliminant ainsi les adresses étant abusées ou ayant fuité.",
         "authentication": "Authentification",
-        "protocols": "Protocoles",
-        "pw_update_required": "Votre compte nécessite un changement de mot de passe. Veuillez définir un nouveau mot de passe pour continuer."
+        "protocols": "Protocoles"
     },
     "warning": {
         "cannot_delete_self": "Impossible de supprimer l’utilisateur connecté",

data/web/lang/lang.lv-lv.json

@@ -13,7 +13,7 @@
         "domain_relayhost": "Mainīt domēna relayhost",
         "eas_reset": "EAS ierīču atiestatīšana",
         "extend_sender_acl": "Ļauj paplašināt sūtītāja ACL ar ārējām adresēm",
-        "login_as": "Pieteikties kā pastkastes lietotājam",
+        "login_as": "Pieteikšanās kā pastkastes lietotājam",
         "mailbox_relayhost": "Pasta kastītes relayhost maiņa",
         "prohibited": "Aizliegts ar ACL",
         "protocol_access": "Protokola piekļuves maiņa",
@@ -91,12 +91,12 @@
         "activate_api": "Aktivizēt API",
         "active": "Aktīvs",
         "add": "Pievienot",
-        "add_domain_admin": "Pievienot domēna pārvaldītāju",
+        "add_domain_admin": "Pievienot domēna administratoru",
         "add_forwarding_host": "Pievienot pāradresācijas hostu",
         "add_relayhost": "Pievienot Relayhost",
         "add_row": "Pievienot rindu",
-        "admin": "Pārvaldītājs",
-        "admin_details": "Labot informāciju par pārvaldītāju",
+        "admin": "Administrators",
+        "admin_details": "Labot administratora detaļas",
         "admin_domains": "Domēna uzdevumi",
         "api_allow_from": "Atļaut API piekļuvi no šīm IP",
         "api_key": "API atslēga",
@@ -114,7 +114,7 @@
         "dkim_keys": "ARC/DKIM atslēgas",
         "dkim_private_key": "Privāta atslēga",
         "domain": "Domēns",
-        "domain_admins": "Domēna pārvaldītāji",
+        "domain_admins": "Domēna administratori",
         "edit": "Labot",
         "empty": "Nav iznākuma",
         "f2b_ban_time": "Aizlieguma laiks (s)",
@@ -188,14 +188,7 @@
         "quarantine_max_score": "Atmest paziņojumu, ja e-pasta ziņojuma mēstuļu novērtējums ir augstāks par šo vērtību:<br><small>Noklusējums ir 9999.0</small>",
         "options": "Iespējas",
         "password_reset_settings": "Paroļu atkopes iestatījumi",
-        "password_settings": "Paroļu iestatījumi",
-        "add_admin": "Pievienot pārvaldītāju",
-        "admins": "Pārvaldītāji",
-        "admins_ldap": "LDAP pārvaldītāji",
-        "admin_quicklink": "Paslēpt ātro saiti uz pārvaldītāju pieteikšanās lapu",
-        "domain_admin": "Domēna pārvaldītājs",
-        "domainadmin_quicklink": "Paslēpt ātro saiti uz domēna pārvaldītāju pieteikšanās lapu",
-        "user_quicklink": "Paslēpt ātro saiti uz lietotāju pieteikšanās lapu"
+        "password_settings": "Paroļu iestatījumi"
     },
     "danger": {
         "access_denied": "Piekļuve liegta, vai nepareizi dati",
@@ -251,10 +244,7 @@
         "app_passwd_id_invalid": "Lietotnes paroles Id %s ir nederīgs",
         "img_dimensions_exceeded": "Attēls pārsniedz lielāko pieļaujamo attēla lielumu",
         "img_size_exceeded": "Attēls pārsniedz lielāko pieļaujamo datnes lielumu",
-        "version_invalid": "Versija %s ir nederīga",
-        "generic_server_error": "Atgadījās neparedzēta servera kļūda. Lūgums sazināties ar pārvaldītāju.",
-        "password_reset_na": "Paroļu atkope šobrīd nav pieejama. Lūgums sazināties ar pārvaldītāju.",
-        "recovery_email_failed": "Nevarēja nosūtīt atkopes e-pasta ziņojumu. Lūgums sazināties ar pārvaldītāju."
+        "version_invalid": "Versija %s ir nederīga"
     },
     "diagnostics": {
         "cname_from_a": "Vērtība, kas iegūta no A/AAAA ieraksta. Tas tiek atbalstīts tik ilgi, kamēr ieraksts norāda uz pareizo resursu.",
@@ -276,7 +266,7 @@
         "delete2duplicates": "Izdzēst atkārtojošos vienumus galamērķī",
         "description": "Apraksts",
         "domain": "Labot domēnu",
-        "domain_admin": "Labot domēna pārvaldītāju",
+        "domain_admin": "Labot domēna administratoru",
         "domain_quota": "Domēna kvota",
         "domains": "Domēni",
         "dont_check_sender_acl": "Atspējot sūtītāju pārbaudi domēnam %s (+ aizstājdomēni)",
@@ -339,8 +329,7 @@
         "app_passwd": "Lietotnes parole",
         "mta_sts_version": "Versija",
         "mta_sts_version_info": "Norāda MTA-STS standarta versiju – pašreiz ir derīga tikai <code>STSv1</code>.",
-        "sender_acl_disabled": "<span class=\"badge fs-6 bg-danger\">Sūtītāja pārbaude ir atspējota</span>",
-        "admin": "Labot pārvaldītāju"
+        "sender_acl_disabled": "<span class=\"badge fs-6 bg-danger\">Sūtītāja pārbaude ir atspējota</span>"
     },
     "footer": {
         "cancel": "Atcelt",
@@ -373,14 +362,7 @@
         "username": "Lietotājvārds",
         "fido2_webauthn": "FIDO/WebAuthn pieteikšanās",
         "mobileconfig_info": "Lūgums pieteikties kā pastkastes lietotājam, lai lejupielādētu pieprasīto Apple savienojuma profilu.",
-        "other_logins": "vai pieteikties ar",
-        "forgot_password": "> Aizmirsta parole?",
-        "login_linkstext": "Nepareiza pieteikšanās?",
-        "login_domainadmintext": "Pieteikties kā domēna pārvaldītājam",
-        "login_admintext": "Pieteikties kā pārvaldītājam",
-        "login_user": "Lietotu pieteikšanās",
-        "login_dadmin": "Domēna pārvaldītāju pieteikšanās",
-        "login_admin": "Pārvaldītāju pieteikšanās"
+        "other_logins": "vai pieslēgties ar"
     },
     "mailbox": {
         "action": "Rīcība",
@@ -415,7 +397,7 @@
         "description": "Apraksts",
         "dkim_key_length": "DKIM atslēgas garums (bits)",
         "domain": "Domēns",
-        "domain_admins": "Domēna pārvaldītāji",
+        "domain_admins": "Domēna administratori",
         "domain_aliases": "Domēna aizstājvārdi",
         "domain_quota": "Kvota",
         "domain_quota_total": "Kopējais domēna ierobežojums",
@@ -525,7 +507,7 @@
         "imap_smtp_server_auth_info": "Lūgums izmantot pilnu e-pasta adresi un PLAIN autentificēšanās mehānismu.<br>\nPieteikšanās dati tiks šifrēti ar servera puses obligātu šifrēšanu."
     },
     "success": {
-        "admin_modified": "Pārvaldītāja izmaiņas tika saglabātas",
+        "admin_modified": "Izmaiņas administrātoram ir saglabātas",
         "alias_added": "Aizstājadrese %s (%d) tika pievienota",
         "alias_domain_removed": "Aizstājdomēns %s tika noņemts",
         "alias_modified": "Aizstājadreses izmaiņas %s tika saglabātas",
@@ -536,9 +518,9 @@
         "dkim_added": "DKIM atslēga saglabāta",
         "dkim_removed": "DKIM atslēga %s ir noņemta",
         "domain_added": "Pievienots domēns %s",
-        "domain_admin_added": "Tika pievienots domēna pārvaldītājs %s",
-        "domain_admin_modified": "Domēna pārvaldītāja %s izmaiņas tika saglabātas",
-        "domain_admin_removed": "Tika noņemts domēna pārvaldītājs %s",
+        "domain_admin_added": "Domēna administrātors %s pievienots",
+        "domain_admin_modified": "Izmaiņas domēna administrātoram %s ir saglabātas",
+        "domain_admin_removed": "Domēna administrators %s tika noņemts",
         "domain_modified": "Izmaiņas domēnam %s ir saglabātas",
         "domain_removed": "Domēns %s ir noņemts",
         "eas_reset": "ActiveSync ierīces priekš lietotāja %s tika atiestatītas",
@@ -566,9 +548,7 @@
         "verified_yotp_login": "Apliecināta Yubico OTP pieteikšanās",
         "app_passwd_removed": "Noņemta lietotnes parole ar Id %s",
         "app_passwd_added": "Pievienota jauna lietotnes parole",
-        "f2b_banlist_refreshed": "Liegumu saraksta Id tika sekmīgi atsvaidzināts.",
-        "admin_added": "Tika pievienots pārvaldītājs %s",
-        "admin_removed": "Tika noņemts pārvaldītājs %s"
+        "f2b_banlist_refreshed": "Liegumu saraksta Id tika sekmīgi atsvaidzināts."
     },
     "tfa": {
         "api_register": "%s izmanto Yubico Cloud API. Lūdzu iegūstiet API atslēgu priekš Jūsu atslēgas<a href=\"https://upgrade.yubico.com/getapikey/\" target=\"_blank\">here</a>",
@@ -589,8 +569,7 @@
         "waiting_usb_auth": "<i>Gaida USB ierīci...</i><br><br>Lūdzu, tagad nospiežiet pogu uz Jūsu WebAuthn USB ierīces.",
         "waiting_usb_register": "<i>Gaida USB ierīci...</i><br><br>Lūgums augstāk ievadīt savu paroli un apstiprināt reģistrēšanos ar USB ierīces pogas nospiešanu.",
         "yubi_otp": "Yubico OTP autentifikators",
-        "authenticators": "Autentificētāji",
-        "u2f_deprecated_important": "Lūgums reģistrēt savu atslēgu pārvaldības lapā ar jauno WebAuthn veidu."
+        "authenticators": "Autentificētāji"
     },
     "user": {
         "action": "Rīcība",
@@ -722,8 +701,7 @@
     "warning": {
         "domain_added_sogo_failed": "Domēns pievienots, bet neizdevās pārsāknēt SOGO. Lūgums pārbaudīt servera žurnālus.",
         "dovecot_restart_failed": "Dovecot neizdevās pārsāknēties. Lūgums pārbaudīt žurnālus",
-        "is_not_primary_alias": "Izlaists aizstājvārds %s, kas nav galvenais",
-        "no_active_admin": "Nevar deaktivēt pēdējo aktīvo pārvaldītāju"
+        "is_not_primary_alias": "Izlaists aizstājvārds %s, kas nav galvenais"
     },
     "oauth2": {
         "access_denied": "Lūgums pieteikties kā pastkastes īpašniekam, lai nodrošinātu piekļuvi ar OAuth2."

data/web/lang/lang.nl-nl.json

@@ -27,8 +27,7 @@
         "tls_policy": "Versleutelingsbeleid",
         "unlimited_quota": "Onbeperkte quota voor mailboxen",
         "domain_desc": "Wijzig domeinbeschrijving",
-        "pw_reset": "Toegang om mailcow gebruikers wachtwoord te resetten",
-        "domain_relayhost": "Verander relayhost voor een domein"
+        "pw_reset": "Toegang om mailcow gebruikers wachtwoord te resetten"
     },
     "add": {
         "activate_filter_warn": "Alle andere filters worden gedeactiveerd zolang deze geactiveerd is.",

data/web/lang/lang.pl-pl.json

@@ -189,7 +189,7 @@
         "api_info": "API jest w trakcie prac. Dokumentację można znaleźć pod adresem <a href=\"/api\">/api</a>",
         "api_key": "klucz API",
         "api_read_only": "Dostęp tylko do odczytu",
-        "api_read_write": "Dostęp do odczytu i zapisu",
+        "api_read_write": "Dostęp tylko do odczytu",
         "api_skip_ip_check": "Pomiń sprawdzenie IP dla API",
         "app_hide": "Ukryj dla logowania",
         "app_links": "Linki aplikacji",
@@ -1226,7 +1226,7 @@
         "decimal": ".",
         "emptyTable": "Brak danych w tabeli",
         "expand_all": "Rozszerz wszystko",
-        "info": "Wyświetlanie od _START_ do _END_ z _TOTAL_ wpisów",
+        "info": "Wyświetlanie od START do END z TOTAL wpisów",
         "infoEmpty": "Wyświetlanie od 0 do 0 z 0 wpisów",
         "infoFiltered": "(filtrowane z _MAX_ suma wpisów)",
         "thousands": ",",

data/web/lang/lang.pt-br.json

@@ -38,7 +38,7 @@
         "add_domain_only": "Adicionar somente domínio",
         "add_domain_restart": "Adicionar domínio e reiniciar o SoGo",
         "alias_address": "Endereço (s) de alias",
-        "alias_address_info": "<small>Endereço(s) de e-mail completo(s) ou @example.com, para capturar todas as mensagens de um domínio (separadas por vírgula). <b>Apenas domínios do Mailcow</b>.</small>",
+        "alias_address_info": "<small>Endereço/s de e-mail completo ou @example .com, para capturar todas as mensagens de um domínio (separadas por vírgula). <b> somente  domínios mailcow</b>.</small>",
         "alias_domain": "Domínio de alias",
         "alias_domain_info": "<small>Somente nomes de domínio válidos (separados por vírgula).</small>",
         "app_name": "Nome do aplicativo",
@@ -158,7 +158,7 @@
         "logo_dark_label": "Invertido para o modo escuro",
         "configuration": "Configuração",
         "convert_html_to_text": "Converter HTML em texto sem formatação",
-        "copy_to_clipboard": "Copiado para a área de transferência!",
+        "copy_to_clipboard": "Text copied to clipboard!",
         "cors_settings": "Configurações do CORS",
         "credentials_transport_warning": "<b>Aviso</b>: Adicionar uma nova entrada no mapa de transporte atualizará as credenciais de todas as entradas com uma coluna correspondente do próximo salto.",
         "customer_id": "ID do cliente",
@@ -223,7 +223,7 @@
         "includes": "Inclua esses destinatários",
         "ip_check": "Verificação de IP",
         "ip_check_disabled": "A verificação de IP está desativada. Você pode ativá-lo em <br><strong>Sistema > Configuração > Opções > Personalizar</strong>",
-        "ip_check_opt_in": "Opte por usar o serviço de terceiros <strong>ipv4.mailcow.email</strong> e <strong>ipv6.mailcow.email</strong> para resolver endereços IP externos.",
+        "ip_check_opt_in": "Opte por usar o serviço de terceiros <strong>ipv4.mailcow.email.</strong> e <strong>ipv6.mailcow.email</strong> para resolver endereços IP externos.",
         "is_mx_based": "Baseado em MX",
         "last_applied": "Aplicado pela última vez",
         "license_info": "Uma licença não é necessária, mas ajuda no desenvolvimento.<br><a href=\"https://www.servercow.de/mailcow? Lang=en#sal\" target=\"_blank\" alt=\"SAL order\">Registre seu GUID aqui</a> ou <a href=\"https://www.servercow.de/mailcow? Lang=en#support\" target=\"_blank\" alt=\"Support order\">comprar suporte para sua instalação de mailcow.</a>",
@@ -245,7 +245,7 @@
         "oauth2_add_client": "Adicionar cliente OAuth2",
         "oauth2_client_id": "ID do cliente",
         "oauth2_client_secret": "Segredo do cliente",
-        "oauth2_info": "A implementação do OAuth2 suporta o tipo de concessão \"Código de Autorização\" e emite tokens de atualização.<br>\nO servidor também emite automaticamente novos tokens de atualização após um token de atualização ter sido usado.<br>\nO escopo padrão é <i>profile</i>. Somente usuários de caixa de correio podem ser autenticados com o OAuth2. Se o parâmetro de escopo for omitido, o padrão será <i>profile</i>.<br>\nO parâmetro <i>state</i> deve ser enviado pelo cliente como parte da solicitação de autorização.<br><br>\nCaminhos para solicitações à API OAuth2: <br>\n\n<ul>\n  <li>Ponto de extremidade de autorização: <code>/oauth/authorize</code></li>\n  <li>Endpoint do token: <code>/oauth/token</code></li>\n  <li>Página de recursos: <code>/oauth/profile</code></li>\n</ul>\n\nRegenerar o segredo do cliente não expirará os códigos de autorização existentes, mas impedirá a renovação do token.<br><br>\nA revogação dos tokens de cliente causará o encerramento imediato de todas as sessões ativas. Todos os clientes precisarão se autenticar novamente.",
+        "oauth2_info": "A implementação OAuth2 suporta o tipo de concessão \"Código de Autorização\" e emite tokens de atualização.<br>\nO servidor também emite automaticamente novos tokens de atualização, depois que um token de atualização foi usado.<br><br>\n&#8226; O escopo padrão é <i>perfil</i>. Somente usuários com caixa de e-mail podem ser autenticados contra o OAuth2. Se o parâmetro de escopo for omitido, ele voltará para <i>perfil</i>.<br>\nCaminhos para solicitações OAuth2 API: <br>\n<ul>\n<li>Endpoint de autorização: <code>/oauth/authorize</code></li>\n<li>Endpoint token: <code>/oauth/token</code></li>\n<li>Página de recursos: <code>/oauth/profile</code></li>\n</ul>\nRegenerar o segredo do cliente não expirará os códigos de autorização existentes, mas eles não renovarão seu token.<br><br>\nA revogação dos tokens do cliente causará o término imediato de todas as sessões ativas. Todos os clientes precisam se autenticar novamente.",
         "oauth2_redirect_uri": "URI de redirecionamento",
         "oauth2_renew_secret": "Gere um novo segredo de cliente",
         "oauth2_revoke_tokens": "Revogar todos os tokens do cliente",
@@ -730,7 +730,7 @@
         "pushover_verify": "Verifique as credenciais",
         "quota_mb": "Cota (MiB)",
         "quota_warning_bcc": "Aviso de cota BCC",
-        "quota_warning_bcc_info": "Os avisos serão enviados em cópias separadas para os seguintes destinatários. O assunto será precedido pelo nome de usuário correspondente entre colchetes, por exemplo: <code>Aviso de cota (user@example.com)</code>.",
+        "quota_warning_bcc_info": "Os avisos serão enviados em cópias separadas para os seguintes destinatários. O assunto será sufixado pelo nome de usuário correspondente entre colchetes, por exemplo: <code>Aviso de cota (</code>user@example.com).",
         "ratelimit": "Limite de taxa",
         "redirect_uri": "URL de redirecionamento/retorno de chamada",
         "relay_all": "Retransmita todos os destinatários",
@@ -759,7 +759,7 @@
         "spam_score": "Defina uma pontuação de spam personalizada",
         "subfolder2": "Sincronizar na subpasta no destino <br><small>(vazio = não usar subpasta</small>)",
         "syncjob": "Editar tarefa de sincronização",
-        "target_address": "Ir para o(s) endereço(s) <small>(separados por vírgula)</small>",
+        "target_address": "<small>Ir para endereço/es (separados por vírgula)</small>",
         "target_domain": "Domínio de destino",
         "timeout1": "Tempo limite para conexão com o host remoto",
         "timeout2": "Tempo limite para conexão com o host local",
@@ -786,8 +786,7 @@
         "mta_sts_mx_info": "Permite envio apenas para nomes de host de servidor de email explicitamente listados; o MTA de envio verifica se o nome do host DNS MX corresponde à lista de políticas e permite entrega apenas com certificado TLS válido (protege contra MITM).",
         "mta_sts_mx_notice": "Múltiplos servidores MX podem ser especificados (separados por vírgulas).",
         "sender_allowed": "Permitir enviar como este alias",
-        "sender_allowed_info": "Se desativado, este alias poderá apenas receber e-mails. Use a ACL de remetente para substituir essa configuração e conceder a caixas de correio específicas permissão para enviar.",
-        "mta_sts_active_info": "Se esta opção estiver desmarcada, a política MTA-STS não será publicada e nenhum certificado será solicitado via ACME para o subdomínio mta-sts."
+        "sender_allowed_info": "Se desativado, este alias poderá apenas receber e-mails. Use a ACL de remetente para substituir essa configuração e conceder a caixas de correio específicas permissão para enviar."
     },
     "fido2": {
         "confirm": "Confirme",
@@ -808,7 +807,7 @@
         "cancel": "Cancelar",
         "confirm_delete": "Confirme a exclusão",
         "delete_now": "Excluir agora",
-        "delete_these_items": "Por favor, confirme as alterações feitas no seguinte ID de objeto.",
+        "delete_these_items": "Confirme suas alterações no seguinte ID de objeto",
         "hibp_check": "Verifique em haveibeenpwned.com",
         "hibp_nok": "Combinado! Essa é uma senha potencialmente perigosa!",
         "hibp_ok": "Nenhuma combinação encontrada.",
@@ -1035,8 +1034,7 @@
         "weekly": "Semanalmente",
         "yes": "✓",
         "iam": "Provedor de Identidade",
-        "internal": "Interno",
-        "force_tfa": "A2F"
+        "internal": "Interno"
     },
     "oauth2": {
         "access_denied": "Faça login como proprietário da mailbox para conceder acesso via OAuth2.",
@@ -1088,7 +1086,7 @@
         "rspamd_result": "Resultado do Rspamd",
         "sender": "Remetente (SMTP)",
         "sender_header": "Remetente (cabeçalho “De”)",
-        "settings_info": "Número máximo de elementos em quarentena (por caixa de correio): %s <br>Tamanho máximo do e-mail: %s MiB",
+        "settings_info": "Quantidade máxima de elementos a serem colocados em quarentena: %s <br>Tamanho máximo do e-mail: %s MiB",
         "show_item": "Mostrar item",
         "spam": "Spam",
         "spam_score": "Ponto",
@@ -1395,7 +1393,7 @@
         "syncjob_EXIT_CONNECTION_FAILURE_HOST1": "Não é possível se conectar ao servidor remoto",
         "syncjob_EXIT_AUTHENTICATION_FAILURE_USER1": "Nome de usuário ou senha incorretos",
         "tag_handling": "Definir o tratamento para e-mails marcados",
-        "tag_help_example": "Exemplo de endereço de e-mail com tag: eu+Facebook</b>@exemplo.org",
+        "tag_help_example": "Exemplo de um endereço de e-mail marcado: me <b>+Facebook</b> @example .org",
         "tag_help_explain": "Na subpasta: uma nova subpasta com o nome da tag será criada abaixo da CAIXA DE ENTRADA (“Caixa de entrada/Facebook”). <br>\r\nNo assunto: o nome das tags será anexado ao assunto do e-mail, por exemplo: “[Facebook] Minhas notícias”.",
         "tag_in_none": "Não faça nada",
         "tag_in_subfolder": "Na subpasta",

data/web/lang/lang.si-si.json

@@ -1001,8 +1001,7 @@
         "weekly": "Tedensko",
         "sieve_info": "Na uporabnika lahko shranite več filtrov, vendar je lahko hkrati aktiven le en predfilter in en postfilter.<br>\nVsak filter bo obdelan v opisanem vrstnem redu. Niti neuspešen skript niti izdan ukaz »keep;« ne bosta ustavila obdelave nadaljnjih skript. Spremembe globalnih skriptov sita bodo sprožile ponovni zagon Dovecota.<br><br>Globalni predfilter sita &#8226; Predfilter &#8226; Uporabniški skripti &#8226; Postfilter &#8226; Globalni postfilter sita",
         "tls_policy_maps_info": "Ta preslikava pravilnikov preglasi pravila odhodnega prenosa TLS neodvisno od uporabnikovih nastavitev pravilnikov TLS.<br>\n  Za več informacij preverite <a href=\"http://www.postfix.org/postconf.5.html#smtp_tls_policy_maps\" target=\"_blank\">dokumentacijo »smtp_tls_policy_maps«</a>.",
-        "internal": "Notranje",
-        "force_tfa": "TFA"
+        "internal": "Notranje"
     },
     "fido2": {
         "known_ids": "Znani ID-ji",
@@ -1078,7 +1077,7 @@
         "rspamd_result": "Rezultat Rspamd",
         "sender": "Pošiljatelj (SMTP)",
         "sender_header": "Pošiljatelj (glava »Od«)",
-        "settings_info": "Največje število elementov za karanteno (na poštni predal): %s<br>Največja velikost e-pošte: %s MiB",
+        "settings_info": "Največje število elementov za karanteno: %s<br>Največja velikost e-pošte: %s MiB",
         "show_item": "Prikaži element",
         "spam": "Neželena pošta",
         "subj": "Zadeva",

data/web/lang/lang.vi-vn.json

@@ -268,10 +268,10 @@
         "includes": "Bao gồm những người nhận này",
         "ip_check": "Kiểm tra IP",
         "ip_check_disabled": "Kiểm tra IP đã bị vô hiệu hóa. Bạn có thể bật nó trong<br> <strong>Hệ thống > Cấu hình > Tùy chọn > Tùy chỉnh</strong>",
-        "ip_check_opt_in": "Đăng ký tham gia sử dụng dịch vụ bên thứ ba dùng <strong>ipv4.mailcow.email</strong> và <strong>ipv6.mailcow.email</strong> để phân giải địa chỉ IP bên ngoài.",
+        "ip_check_opt_in": "Chọn tham gia sử dụng dịch vụ bên thứ ba <strong>ipv4.mailcow.email</strong> và <strong>ipv6.mailcow.email</strong> để phân giải địa chỉ IP bên ngoài.",
         "is_mx_based": "Dựa trên MX",
         "last_applied": "Áp dụng lần cuối",
-        "license_info": "Giấy phép tuy không bắt buộc nhưng giúp phát triển thêm.<br><a href=\"https://www.servercow.de/mailcow?lang=en#sal\" target=\"_blank\" alt=\"Đặt hàng SAL\">Đăng ký GUID của bạn tại đây</a> hoặc <a href=\"https://www.servercow.de/mailcow?lang=en#support\" target=\"_blank\" alt=\"Đặt hàng hỗ trợ\">mua hỗ trợ cho cài đặt mailcow của bạn.</a>",
+        "license_info": "Giấy phép không bắt buộc nhưng giúp phát triển thêm.<br><a href=\"https://www.servercow.de/mailcow?lang=en#sal\" target=\"_blank\" alt=\"Đặt hàng SAL\">Đăng ký GUID của bạn tại đây</a> hoặc <a href=\"https://www.servercow.de/mailcow?lang=en#support\" target=\"_blank\" alt=\"Đặt hàng hỗ trợ\">mua hỗ trợ cho cài đặt mailcow của bạn.</a>",
         "link": "Liên kết",
         "loading": "Vui lòng đợi...",
         "login_time": "Thời gian đăng nhập",
@@ -556,9 +556,7 @@
         "validity_missing": "Vui lòng gán thời hạn hiệu lực",
         "value_missing": "Vui lòng cung cấp tất cả các giá trị",
         "version_invalid": "Phiên bản %s không hợp lệ",
-        "yotp_verification_failed": "Xác thực Yubico OTP thất bại: %s",
-        "tfa_removal_blocked": "Xác thực hai yếu tố không thể bị xóa vì đây là yêu cầu bắt buộc đối với tài khoản của bạn.",
-        "quarantine_category_invalid": "Danh mục cách ly phải là một trong các loại sau : add_header, reject, all."
+        "yotp_verification_failed": "Xác thực Yubico OTP thất bại: %s"
     },
     "datatables": {
         "collapse_all": "Thu gọn tất cả",
@@ -581,9 +579,7 @@
         "aria": {
             "sortAscending": ": kích hoạt để sắp xếp cột tăng dần",
             "sortDescending": ": kích hoạt để sắp xếp cột giảm dần"
-        },
-        "decimal": ".",
-        "thousands": ","
+        }
     },
     "debug": {
         "architecture": "Kiến trúc",
@@ -697,19 +693,6 @@
         "internal_info": "Bí danh nội bộ chỉ có thể truy cập từ tên miền sở hữu hoặc tên miền bí danh.",
         "kind": "Loại",
         "last_modified": "Sửa đổi lần cuối",
-        "lookup_mx": "Đích là một biểu thức chính quy để khớp với tên MX (<code>.*.google.com</code> để định tuyến tất cả thư nhắm đến MX kết thúc bằng google.com qua bước nhảy này)",
-        "sender_allowed": "Cho phép gửi đi bằng bí danh",
-        "sender_allowed_info": "Nếu bị vô hiệu hóa, bí danh này chỉ có thể nhận thư. Sử dụng ACL của người gửi để ghi đè và cấp quyền gửi cho các hộp thư cụ thể.",
-        "mailbox": "Chỉnh sửa hộp thư",
-        "mailbox_quota_def": "Hạn mức hộp thư mặc định",
-        "mailbox_relayhost_info": "Chỉ áp dụng cho hộp thư và các bí danh trực tiếp, thao tác này sẽ ghi đè lên máy chủ chuyển tiếp tên miền.",
-        "mailbox_rename": "Đổi tên hộp thư",
-        "mailbox_rename_agree": "Tôi đã tạo bản sao lưu.",
-        "mailbox_rename_warning": "QUAN TRỌNG! Hãy tạo bản sao lưu trước khi đổi tên hộp thư.",
-        "mailbox_rename_alias": "Tạo tự động bí danh",
-        "mailbox_rename_title": "Tên mới của hộp thư cục bộ",
-        "max_aliases": "Số lượng Bí danh tối đa",
-        "max_mailboxes": "Số lượng hộp thư tối đa có thể có",
-        "max_quota": "Dung lượng tối đa cho mỗi hộp thư (MiB)"
+        "lookup_mx": "Đích là một biểu thức chính quy để khớp với tên MX (<code>.*.google.com</code> để định tuyến tất cả thư nhắm đến MX kết thúc bằng google.com qua bước nhảy này)"
     }
 }

data/web/mobileconfig.php

@@ -65,7 +65,6 @@ if (isset($_GET['app_password'])) {
       $attr['protocols'][] = 'dav_access';
   }
   app_passwd("add", $attr);
-  $password = htmlspecialchars($password, ENT_NOQUOTES);
 } else {
   $app_password = false;
 }

data/web/oauth/authorize.php

@@ -4,7 +4,6 @@ require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
 if (!isset($_SESSION['mailcow_cc_role'])) {
   $_SESSION['oauth2_request'] = $_SERVER['REQUEST_URI'];
   header('Location: /?oauth');
-  exit;
 }
 
 $request = OAuth2\Request::createFromGlobals();
@@ -25,11 +24,6 @@ if (!isset($_POST['authorized'])) {
   exit;
 }
 
-if (empty($_SESSION['mailcow_cc_username'])) {
-  header('Location: /?oauth');
-  exit;
-}
-
 // print the authorization code if the user has authorized your client
 $is_authorized = ($_POST['authorized'] == '1');
 $oauth2_server->handleAuthorizeRequest($request, $response, $is_authorized, $_SESSION['mailcow_cc_username']);

data/web/sogo-auth.php

@@ -8,12 +8,8 @@ $ALLOW_ADMIN_EMAIL_LOGIN = (preg_match(
 $session_var_user_allowed = 'sogo-sso-user-allowed';
 $session_var_pass = 'sogo-sso-pass';
 
-// only the internal nginx auth_request loopback (127.0.0.1:65510) sets this;
-// external clients can never supply it (bare fastcgi param, not an HTTP header)
-$is_internal_auth = (($_SERVER['SOGO_AUTH_INTERNAL'] ?? '') === '1');
-
 // validate credentials for basic auth requests
-if ($is_internal_auth && isset($_SERVER['PHP_AUTH_USER'])) {
+if (isset($_SERVER['PHP_AUTH_USER'])) {
   // load prerequisites only when required
   require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
 
@@ -54,11 +50,6 @@ elseif (isset($_GET['login'])) {
     (($_SESSION['acl']['login_as'] == "1" && $ALLOW_ADMIN_EMAIL_LOGIN !== 0) || ($is_dual === false && $login == $_SESSION['mailcow_cc_username']))) {
     if (filter_var($login, FILTER_VALIDATE_EMAIL)) {
       if (user_get_alias_details($login) !== false) {
-        // enforce tenant boundary
-        if (!hasMailboxObjectAccess($_SESSION['mailcow_cc_username'], $_SESSION['mailcow_cc_role'], $login)) {
-          header("Location: /");
-          exit;
-        }
         // Block SOGo access if pending actions (2FA setup, password update)
         if (!empty($_SESSION['pending_tfa_setup']) || !empty($_SESSION['pending_pw_update'])) {
           header("Location: /");
@@ -89,7 +80,7 @@ elseif (isset($_GET['login'])) {
   exit;
 }
 // only check for admin-login on sogo GUI requests
-elseif ($is_internal_auth && isset($_SERVER['HTTP_X_ORIGINAL_URI']) && strcasecmp(substr($_SERVER['HTTP_X_ORIGINAL_URI'], 0, 9), "/SOGo/so/") === 0) {
+elseif (isset($_SERVER['HTTP_X_ORIGINAL_URI']) && strcasecmp(substr($_SERVER['HTTP_X_ORIGINAL_URI'], 0, 9), "/SOGo/so/") === 0) {
   // this is an nginx auth_request call, we check for existing sogo-sso session variables
   require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/vars.inc.php';
   if (file_exists($_SERVER['DOCUMENT_ROOT'] . '/inc/vars.local.inc.php')) {

data/web/syncjob-oauth.php

@@ -1,85 +0,0 @@
-<?php
-// Per-user OAuth2 authorization_code flow for IMAP sync sources.
-// Opened as a popup from the sync-job modal:
-//   ?action=start&source_id=N  -> redirect the logged-in user to the provider consent screen
-//   (callback, ?code&state)    -> exchange code, store the per-user token, message the opener
-// The resulting token is bound to the authenticated remote identity, which fixes syncjob user1.
-require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
-
-function syncjob_oauth_redirect_uri() {
-  // Must match the redirect URI registered at the provider.
-  return 'https://' . $_SERVER['HTTP_HOST'] . '/syncjob-oauth';
-}
-
-function syncjob_oauth_finish($ok, $payload) {
-  // Renders a tiny page that hands the result back to the opener modal and closes the popup.
-  header('Content-Type: text/html; charset=utf-8');
-  $json = json_encode(array_merge(array('type' => 'syncjob_oauth', 'ok' => $ok), $payload));
-  echo '<!doctype html><meta charset="utf-8"><title>OAuth</title><body><script>'
-     . 'try { if (window.opener) window.opener.postMessage(' . $json . ', window.location.origin); } catch (e) {}'
-     . 'window.close();'
-     . 'document.body.innerText = ' . json_encode($ok ? 'Connected. You can close this window.' : 'Authentication failed. You can close this window.') . ';'
-     . '</script></body>';
-  exit;
-}
-
-// Must be an authenticated session; users additionally need the syncjobs ACL.
-if (empty($_SESSION['mailcow_cc_username']) || empty($_SESSION['mailcow_cc_role'])) {
-  header('Location: /');
-  exit;
-}
-if ($_SESSION['mailcow_cc_role'] == 'user' && ($_SESSION['acl']['syncjobs'] ?? '0') != '1') {
-  syncjob_oauth_finish(false, array('error' => 'access_denied'));
-}
-
-$action = isset($_GET['action']) ? $_GET['action'] : ((isset($_GET['code']) || isset($_GET['error'])) ? 'callback' : '');
-
-if ($action == 'start') {
-  $source_id = intval($_GET['source_id'] ?? 0);
-  // get/source enforces visibility for the current session
-  $source = syncjob('get', 'source', array('id' => $source_id, 'with_secret' => true));
-  if (!$source || $source['auth_type'] != 'XOAUTH2' || $source['oauth_flow'] != 'authorization_code') {
-    syncjob_oauth_finish(false, array('error' => 'source_unavailable'));
-  }
-  $state = bin2hex(random_bytes(16));
-  $_SESSION['syncjob_oauth2state'] = $state;
-  $_SESSION['syncjob_oauth_source_id'] = $source_id;
-  header('Location: ' . imapsync_source_oauth_authorize_url($source, syncjob_oauth_redirect_uri(), $state));
-  exit;
-}
-
-// --- callback ---
-if (isset($_GET['error'])) {
-  syncjob_oauth_finish(false, array('error' => substr((string)$_GET['error'], 0, 200)));
-}
-// CSRF: state must match the one stored at 'start'
-if (empty($_GET['code']) || empty($_GET['state']) || !hash_equals((string)($_SESSION['syncjob_oauth2state'] ?? ''), (string)$_GET['state'])) {
-  syncjob_oauth_finish(false, array('error' => 'invalid_state'));
-}
-$source_id = intval($_SESSION['syncjob_oauth_source_id'] ?? 0);
-unset($_SESSION['syncjob_oauth2state'], $_SESSION['syncjob_oauth_source_id']);
-
-$source = syncjob('get', 'source', array('id' => $source_id, 'with_secret' => true));
-if (!$source || $source['auth_type'] != 'XOAUTH2' || $source['oauth_flow'] != 'authorization_code') {
-  syncjob_oauth_finish(false, array('error' => 'source_unavailable'));
-}
-
-$token = imapsync_source_token_post($source['oauth_token_endpoint'], array(
-  'grant_type' => 'authorization_code',
-  'client_id' => $source['oauth_client_id'],
-  'client_secret' => $source['oauth_client_secret'],
-  'code' => $_GET['code'],
-  'redirect_uri' => syncjob_oauth_redirect_uri(),
-  'scope' => $source['oauth_scope'],
-));
-if (isset($token['error'])) {
-  syncjob_oauth_finish(false, array('error' => $token['error']));
-}
-
-$email = imapsync_source_oauth_identity($source, $token);
-if (!$email) {
-  syncjob_oauth_finish(false, array('error' => 'no_identity'));
-}
-
-imapsync_source_store_user_token($source_id, $email, $token);
-syncjob_oauth_finish(true, array('source_id' => $source_id, 'user1' => $email));

data/web/templates/admin.twig

@@ -21,8 +21,8 @@
         <li><button class="dropdown-item" data-bs-target="#tab-config-fwdhosts" aria-selected="false" aria-controls="tab-config-fwdhosts" role="tab" data-bs-toggle="tab">{{ lang.admin.forwarding_hosts }}</button></li>
         <li><button class="dropdown-item" data-bs-target="#tab-config-f2b" aria-selected="false" aria-controls="tab-config-f2b" role="tab" data-bs-toggle="tab">{{ lang.admin.f2b_parameters }}</button></li>
         <li><button class="dropdown-item" data-bs-target="#tab-config-quarantine" aria-selected="false" aria-controls="tab-config-quarantine" role="tab" data-bs-toggle="tab">{{ lang.admin.quarantine }}</button></li>
+        <li><button class="dropdown-item" data-bs-target="#tab-config-syncjobs" aria-selected="false" aria-controls="tab-config-syncjobs" role="tab" data-bs-toggle="tab">{{ lang.admin.syncjobs }}</button></li>
         <li><button class="dropdown-item" data-bs-target="#tab-config-quota" aria-selected="false" aria-controls="tab-config-quota" role="tab" data-bs-toggle="tab">{{ lang.admin.quota_notifications }}</button></li>
-        <li><button class="dropdown-item" data-bs-target="#tab-config-syncjob" aria-selected="false" aria-controls="tab-config-syncjob" role="tab" data-bs-toggle="tab">{{ lang.admin.syncjobs }}</button></li>
         <li><button class="dropdown-item" data-bs-target="#tab-config-rsettings" aria-selected="false" aria-controls="tab-config-rsettings" role="tab" data-bs-toggle="tab">{{ lang.admin.rspamd_settings_map }}</button></li>
         <li><button class="dropdown-item" data-bs-target="#tab-config-password-settings" aria-selected="false" aria-controls="tab-config-password-settings" role="tab" data-bs-toggle="tab">{{ lang.admin.password_settings }}</button></li>
         <li><button class="dropdown-item" data-bs-target="#tab-config-customize" aria-selected="false" aria-controls="tab-config-customize" role="tab" data-bs-toggle="tab">{{ lang.admin.customize }}</button></li>
@@ -51,8 +51,8 @@
         {% include 'admin/tab-config-fwdhosts.twig' %}
         {% include 'admin/tab-config-f2b.twig' %}
         {% include 'admin/tab-config-quarantine.twig' %}
+        {% include 'admin/tab-config-syncjobs.twig' %}
         {% include 'admin/tab-config-quota.twig' %}
-        {% include 'admin/tab-config-syncjob.twig' %}
         {% include 'admin/tab-config-rsettings.twig' %}
         {% include 'admin/tab-config-customize.twig' %}
         {% include 'admin/tab-config-password-settings.twig' %}

data/web/templates/admin/tab-config-syncjob.twig

@@ -1,35 +0,0 @@
-<div class="tab-pane fade" id="tab-config-syncjob" role="tabpanel" aria-labelledby="tab-config-syncjob">
-  <div class="card mb-4">
-    <div class="card-header d-flex fs-5">
-      <button class="btn d-md-none flex-grow-1 text-start" data-bs-target="#collapse-tab-config-syncjob" data-bs-toggle="collapse" aria-controls="collapse-tab-config-syncjob">
-        {{ lang.admin.syncjobs }}
-      </button>
-      <span class="d-none d-md-block">{{ lang.admin.syncjobs }}</span>
-    </div>
-    <div id="collapse-tab-config-syncjob" class="card-body collapse" data-bs-parent="#admin-content">
-      <form class="form" role="form" data-id="imapsync_settings" method="post">
-        <div class="row mb-4">
-          <div class="col-sm-6">
-            <label for="max_parallel">{{ lang.admin.syncjob_max_parallel }}:</label>
-            <input type="number" class="form-control" id="max_parallel" name="max_parallel" min="1" max="1000" value="{{ imapsync_settings.max_parallel }}">
-            <small class="text-muted">{{ lang.admin.syncjob_max_parallel_info }}</small>
-          </div>
-          <div class="col-sm-6">
-            <label for="max_kb_per_second">{{ lang.admin.syncjob_max_kb_per_second }}:</label>
-            <input type="number" class="form-control" id="max_kb_per_second" name="max_kb_per_second" min="0" max="1220000" value="{{ (imapsync_settings.max_bytes_per_second / 1024)|round }}">
-            <small class="text-muted">{{ lang.admin.syncjob_max_kb_per_second_info }}</small>
-          </div>
-        </div>
-        <div class="row">
-          <div class="col-sm-10">
-            <a type="button" class="btn btn-sm d-block d-sm-inline btn-success" data-action="edit_selected"
-               data-item="imapsync_settings"
-               data-id="imapsync_settings"
-               data-api-url='edit/imapsync_settings'
-               data-api-attr='{}'><i class="bi bi-check-lg"></i> {{ lang.user.save_changes }}</a>
-          </div>
-        </div>
-      </form>
-    </div>
-  </div>
-</div>

data/web/templates/admin/tab-config-syncjobs.twig

@@ -0,0 +1,27 @@
+<div class="tab-pane fade" id="tab-config-syncjobs" role="tabpanel" aria-labelledby="tab-config-syncjobs">
+  <div class="card mb-4">
+    <div class="card-header d-flex fs-5">
+      <button class="btn d-md-none flex-grow-1 text-start" data-bs-target="#collapse-tab-config-syncjobs" data-bs-toggle="collapse" aria-controls="collapse-tab-config-syncjobs">
+        {{ lang.admin.syncjobs }}
+      </button>
+      <span class="d-none d-md-block">{{ lang.admin.syncjobs }}</span>
+    </div>
+    <div id="collapse-tab-config-syncjobs" class="card-body collapse" data-bs-parent="#admin-content">
+      <form class="form-horizontal" data-id="syncjob_settings" role="form" method="post">
+        <div class="row mb-4">
+          <label class="col-sm-4 control-label text-sm-end" for="syncjobs_max_parallel">{{ lang.admin.syncjobs_max_parallel|raw }}</label>
+          <div class="col-sm-8">
+            <input type="number" class="form-control" id="syncjobs_max_parallel" name="max_parallel" value="{{ sj_data.max_parallel }}" min="1" max="50" required>
+          </div>
+        </div>
+        <div class="row mb-4">
+          <label class="col-sm-4 control-label text-sm-end" for="syncjobs_max_bps">{{ lang.admin.syncjobs_max_bps|raw }}</label>
+          <div class="col-sm-8">
+            <input type="number" class="form-control" id="syncjobs_max_bps" name="max_bps" value="{{ sj_data.max_bps }}" min="0">
+          </div>
+        </div>
+        <button class="btn btn-sm d-block d-sm-inline btn-success" data-action="edit_selected" data-item="self" data-id="syncjob_settings" data-api-url='edit/syncjob_settings' href="#"><i class="bi bi-check-lg"></i> {{ lang.admin.save }}</button>
+      </form>
+    </div>
+  </div>
+</div>

data/web/templates/admin_index.twig

@@ -49,7 +49,6 @@
             <div class="input-group">
               <div class="input-group-text"><i class="bi bi-lock-fill"></i></div>
               <input name="pass_user" type="password" id="pass_user" class="form-control" placeholder="{{ lang.login.password }}" required="" autocomplete="current-password">
-              <button type="button" class="input-group-text" style="cursor:pointer;" onclick="var i=document.getElementById('pass_user'),ic=this.querySelector('i');if(i.type==='password'){i.type='text';ic.className='bi bi-eye-slash';}else{i.type='password';ic.className='bi bi-eye';}" tabindex="-1" aria-label="Toggle password visibility"><i class="bi bi-eye"></i></button>
             </div>
           </div>
           <div class="d-flex justify-content-between mt-4" style="position: relative">

data/web/templates/base.twig

@@ -473,10 +473,6 @@ function recursiveBase64StrToArrayBuffer(obj) {
             window.location.reload();
           } else {
             var msg = (data && data[0] && data[0].msg) ? data[0].msg : 'Password change failed.';
-            // the API returns raw language keys, resolve them like the alert box does
-            if (Object.prototype.hasOwnProperty.call(lang_danger, msg)) {
-              msg = lang_danger[msg];
-            }
             $('#changePWAlert').show().text(msg);
           }
         },

data/web/templates/domainadmin_index.twig

@@ -49,7 +49,6 @@
             <div class="input-group">
               <div class="input-group-text"><i class="bi bi-lock-fill"></i></div>
               <input name="pass_user" type="password" id="pass_user" class="form-control" placeholder="{{ lang.login.password }}" required="" autocomplete="current-password">
-              <button type="button" class="input-group-text" style="cursor:pointer;" onclick="var i=document.getElementById('pass_user'),ic=this.querySelector('i');if(i.type==='password'){i.type='text';ic.className='bi bi-eye-slash';}else{i.type='password';ic.className='bi bi-eye';}" tabindex="-1" aria-label="Toggle password visibility"><i class="bi bi-eye"></i></button>
             </div>
           </div>
           <div class="d-flex justify-content-between mt-4" style="position: relative">

data/web/templates/edit.twig

@@ -26,7 +26,6 @@
   var lang_user = {{ lang_user|raw }};
   var lang_admin = {{ lang_admin|raw }};
   var lang_datatables = {{ lang_datatables|raw }};
-  var lang = {syncjobs: {{ lang_syncjobs|raw }}};
   var csrf_token = '{{ csrf_token }}';
   var pagination_size = Math.trunc('{{ pagination_size }}');
   var table_for_domain = '{{ domain }}';

data/web/templates/edit/domain.twig

@@ -340,7 +340,7 @@
                   <div class="row mb-4">
                     <div class="offset-sm-2 col-sm-10">
                       <div class="form-check">
-                        <label><i style="font-size: 16px; cursor: pointer;" class="bi bi-patch-question-fill m-2 ms-0" data-bs-toggle="tooltip" data-bs-html="true" data-bs-placement="bottom" title="{{ lang.edit.mta_sts_active_info|raw }}"></i><input type="checkbox" class="form-check-input" value="1" name="active"{% if mta_sts.active == '1' %} checked{% endif %}> {{ lang.edit.active }}</label>
+                        <label><input type="checkbox" class="form-check-input" value="1" name="active"{% if mta_sts.active == '1' %} checked{% endif %}> {{ lang.edit.active }}</label>
                       </div>
                     </div>
                   </div>

data/web/templates/edit/filter.twig

@@ -23,7 +23,7 @@
   <div class="row mb-4">
     <label class="control-label col-sm-2" for="script_data">Script:</label>
     <div class="col-sm-10">
-      <textarea spellcheck="false" autocorrect="off" autocapitalize="none" class="form-control textarea-code" rows="20" id="script_data" name="script_data" required>{{ result.script_data }}</textarea>
+      <textarea spellcheck="false" autocorrect="off" autocapitalize="none" class="form-control textarea-code" rows="20" id="script_data" name="script_data" required>{{ result.script_data|raw }}</textarea>
     </div>
   </div>
   <div class="row mb-2">

data/web/templates/edit/imapsync_source.twig

@@ -1,181 +0,0 @@
-{% extends 'edit.twig' %}
-
-{% block inner_content %}
-{% if result %}
-  <h4 class="mb-4">{{ lang.syncjobs.source }}: {{ result.name }}</h4>
-  <form class="form-horizontal" data-id="edit_imapsync_source" role="form" method="post">
-    <input type="hidden" value="0" name="active">
-    <div class="row mb-2">
-      <label class="control-label col-sm-2" for="name">{{ lang.syncjobs.source_name }}</label>
-      <div class="col-sm-10">
-        <input type="text" class="form-control" name="name" id="name" maxlength="100" value="{{ result.name }}" required>
-      </div>
-    </div>
-    <div class="row mb-2">
-      <label class="control-label col-sm-2" for="description">{{ lang.syncjobs.source_description }}</label>
-      <div class="col-sm-10">
-        <input type="text" class="form-control" name="description" id="description" maxlength="255" value="{{ result.description }}">
-      </div>
-    </div>
-    {% if mailcow_cc_role == 'admin' or mailcow_cc_role == 'domainadmin' %}
-      <div class="row mb-2">
-        <label class="control-label col-sm-2" for="scope">{{ lang.syncjobs.source_scope }}</label>
-        <div class="col-sm-10">
-          <select class="form-control imapsync-source-scope" name="scope" id="scope">
-            {% if mailcow_cc_role == 'admin' %}
-            <option value="all"{% if result.scope == 'all' %} selected{% endif %}>{{ lang.syncjobs.source_scope_all }}</option>
-            {% endif %}
-            <option value="domain"{% if result.scope == 'domain' %} selected{% endif %}>{{ lang.syncjobs.source_scope_domain }}</option>
-            <option value="user"{% if result.scope == 'user' %} selected{% endif %}>{{ lang.syncjobs.source_scope_user }}</option>
-          </select>
-        </div>
-      </div>
-      <div class="row mb-2 imapsync-source-domains-row" style="display:{% if result.scope == 'domain' %}flex{% else %}none{% endif %};">
-        <label class="control-label col-sm-2" for="domains">{{ lang.syncjobs.source_domains }}</label>
-        <div class="col-sm-10">
-          <select class="form-control imapsync-source-domains" name="domains[]" data-live-search="true" title="{{ lang.syncjobs.source_domains }}" multiple>
-            {% for d in result.domains %}<option value="{{ d }}" selected>{{ d }}</option>{% endfor %}
-          </select>
-        </div>
-      </div>
-      <div class="row mb-2 imapsync-source-users-row" style="display:{% if result.scope == 'user' %}flex{% else %}none{% endif %};">
-        <label class="control-label col-sm-2" for="users">{{ lang.syncjobs.source_users }}</label>
-        <div class="col-sm-10">
-          <select class="form-control imapsync-source-users" name="users[]" data-live-search="true" title="{{ lang.syncjobs.source_users }}" multiple>
-            {% for u in result.users %}<option value="{{ u }}" selected>{{ u }}</option>{% endfor %}
-          </select>
-        </div>
-      </div>
-    {% else %}
-      <p class="text-muted">{{ lang.syncjobs.source_scope }}: <code>{{ lang.syncjobs['source_scope_' ~ result.scope] }}</code></p>
-    {% endif %}
-    <div class="row mb-2">
-      <label class="control-label col-sm-2" for="host1">{{ lang.add.hostname }}</label>
-      <div class="col-sm-10">
-        <input type="text" class="form-control" name="host1" id="host1" value="{{ result.host1 }}" required>
-      </div>
-    </div>
-    <div class="row mb-2">
-      <label class="control-label col-sm-2" for="port1">{{ lang.add.port }}</label>
-      <div class="col-sm-10">
-        <input type="number" class="form-control" name="port1" id="port1" min="1" max="65535" value="{{ result.port1 }}" required>
-      </div>
-    </div>
-    <div class="row mb-2">
-      <label class="control-label col-sm-2" for="enc1">{{ lang.add.enc_method }}</label>
-      <div class="col-sm-10">
-        <select name="enc1" id="enc1">
-          <option value="SSL"{% if result.enc1 == 'SSL' %} selected{% endif %}>SSL</option>
-          <option value="TLS"{% if result.enc1 == 'TLS' %} selected{% endif %}>STARTTLS</option>
-          <option value="PLAIN"{% if result.enc1 == 'PLAIN' %} selected{% endif %}>PLAIN</option>
-        </select>
-      </div>
-    </div>
-    <div class="row mb-4">
-      <label class="control-label col-sm-2" for="auth_type">{{ lang.syncjobs.source_auth_type }}</label>
-      <div class="col-sm-10">
-        <select class="form-control imapsync-source-auth-type" name="auth_type" id="auth_type" required>
-          <option value="PLAIN"{% if result.auth_type == 'PLAIN' %} selected{% endif %}>PLAIN</option>
-          <option value="LOGIN"{% if result.auth_type == 'LOGIN' %} selected{% endif %}>LOGIN</option>
-          <option value="CRAM-MD5"{% if result.auth_type == 'CRAM-MD5' %} selected{% endif %}>CRAM-MD5</option>
-          <option value="XOAUTH2"{% if result.auth_type == 'XOAUTH2' %} selected{% endif %}>XOAUTH2 (OAuth2)</option>
-        </select>
-      </div>
-    </div>
-    <fieldset class="imapsync-source-oauth-block" style="display:{% if result.auth_type == 'XOAUTH2' %}block{% else %}none{% endif %};">
-      <legend class="fs-5">{{ lang.syncjobs.source_oauth_block }}</legend>
-      <div class="row mb-2">
-        <label class="control-label col-sm-2" for="oauth_flow">{{ lang.syncjobs.source_oauth_flow }}</label>
-        <div class="col-sm-10">
-          <select class="form-control imapsync-source-oauth-flow" name="oauth_flow" id="oauth_flow">
-            <option value="client_credentials"{% if result.oauth_flow != 'authorization_code' %} selected{% endif %}>{{ lang.syncjobs.source_oauth_flow_app }}</option>
-            <option value="authorization_code"{% if result.oauth_flow == 'authorization_code' %} selected{% endif %}>{{ lang.syncjobs.source_oauth_flow_user }}</option>
-          </select>
-        </div>
-      </div>
-      <div class="row mb-2">
-        <label class="control-label col-sm-2" for="oauth_token_endpoint">Token-Endpoint</label>
-        <div class="col-sm-10">
-          <input type="url" class="form-control" name="oauth_token_endpoint" id="oauth_token_endpoint" value="{{ result.oauth_token_endpoint }}">
-        </div>
-      </div>
-      <div class="imapsync-source-authcode-block" style="display:{% if result.oauth_flow == 'authorization_code' %}block{% else %}none{% endif %};">
-        <div class="row mb-2">
-          <label class="control-label col-sm-2" for="oauth_authorize_endpoint">{{ lang.syncjobs.source_authorize_endpoint }}</label>
-          <div class="col-sm-10">
-            <input type="url" class="form-control" name="oauth_authorize_endpoint" id="oauth_authorize_endpoint" value="{{ result.oauth_authorize_endpoint }}">
-          </div>
-        </div>
-        <div class="row mb-2">
-          <label class="control-label col-sm-2" for="oauth_userinfo_endpoint">{{ lang.syncjobs.source_userinfo_endpoint }}</label>
-          <div class="col-sm-10">
-            <input type="url" class="form-control" name="oauth_userinfo_endpoint" id="oauth_userinfo_endpoint" value="{{ result.oauth_userinfo_endpoint }}">
-          </div>
-        </div>
-        <div class="row mb-2">
-          <label class="control-label col-sm-2">{{ lang.syncjobs.source_redirect_uri }}</label>
-          <div class="col-sm-10">
-            <input type="text" class="form-control imapsync-source-redirect-uri" readonly value="">
-            <small class="text-muted">{{ lang.syncjobs.source_redirect_uri_hint }}</small>
-          </div>
-        </div>
-      </div>
-      <div class="row mb-2">
-        <label class="control-label col-sm-2" for="oauth_client_id">Client-ID</label>
-        <div class="col-sm-10">
-          <input type="text" class="form-control" name="oauth_client_id" id="oauth_client_id" value="{{ result.oauth_client_id }}">
-        </div>
-      </div>
-      <div class="row mb-2">
-        <label class="control-label col-sm-2" for="oauth_client_secret">Client-Secret</label>
-        <div class="col-sm-10">
-          <input type="password" class="form-control" name="oauth_client_secret" id="oauth_client_secret" placeholder="••••••••">
-          <small class="text-muted">{{ lang.syncjobs.source_secret_unchanged_hint }}</small>
-        </div>
-      </div>
-      <div class="row mb-2">
-        <label class="control-label col-sm-2" for="oauth_scope">Scope</label>
-        <div class="col-sm-10">
-          <input type="text" class="form-control" name="oauth_scope" id="oauth_scope" value="{{ result.oauth_scope }}">
-        </div>
-      </div>
-      <div class="row mb-4">
-        <label class="control-label col-sm-2" for="oauth_extra_params">Extra-Params (JSON)</label>
-        <div class="col-sm-10">
-          <input type="text" class="form-control" name="oauth_extra_params" id="oauth_extra_params" value="{{ result.oauth_extra_params }}">
-        </div>
-      </div>
-      <div class="row mb-4">
-        <div class="offset-sm-2 col-sm-10">
-          <p class="mb-1">
-            {{ lang.syncjobs.source_token_status }}:
-            {% if result.oauth_token_expires %}
-              <code>{{ result.oauth_token_expires|date('Y-m-d H:i:s') }}</code>
-            {% else %}
-              <span class="text-muted">—</span>
-            {% endif %}
-          </p>
-          {% if result.oauth_last_refresh_error %}
-            <p class="text-danger">{{ lang.syncjobs.source_token_error }}: <code>{{ result.oauth_last_refresh_error }}</code></p>
-          {% endif %}
-          <button type="button" class="btn btn-sm btn-secondary" data-action="edit_selected" data-id="edit_imapsync_source" data-item="{{ result.id }}" data-api-url='edit/syncjob_source/refresh_token' data-api-attr='{}'>{{ lang.syncjobs.source_refresh_now }}</button>
-        </div>
-      </div>
-    </fieldset>
-    <div class="row mb-4">
-      <div class="offset-sm-2 col-sm-10">
-        <div class="form-check">
-          <label><input type="checkbox" class="form-check-input" value="1" name="active"{% if result.active == '1' %} checked{% endif %}> {{ lang.edit.active }}</label>
-        </div>
-      </div>
-    </div>
-    <div class="row mb-2">
-      <div class="offset-sm-2 col-sm-10">
-        <button class="btn btn-xs-lg d-block d-sm-inline btn-success" data-action="edit_selected" data-id="edit_imapsync_source" data-item="{{ result.id }}" data-api-url='edit/syncjob_source' data-api-attr='{}' href="#">{{ lang.edit.save }}</button>
-      </div>
-    </div>
-  </form>
-{% else %}
-    {{ parent() }}
-{% endif %}
-{% endblock %}

data/web/templates/edit/mailbox-templates.twig

@@ -8,7 +8,6 @@
 
     <input type="hidden" value="default" name="sender_acl">
     <input type="hidden" value="0" name="force_pw_update">
-    <input type="hidden" value="0" name="force_tfa">
     <input type="hidden" value="0" name="sogo_access">
     <input type="hidden" value="0" name="protocol_access">
 
@@ -166,14 +165,6 @@
         </div>
       </div>
     </div>
-    <div class="row">
-      <div class="offset-sm-2 col-sm-10">
-        <div class="form-check">
-          <label><input type="checkbox" class="form-check-input" value="1" name="force_tfa" id="force_tfa"{% if template.attributes.force_tfa == '1' %} checked{% endif %}> {{ lang.tfa.force_tfa }}</label>
-          <small class="text-muted">{{ lang.tfa.force_tfa_info }}</small>
-        </div>
-      </div>
-    </div>
     {% if not skip_sogo %}
     <div class="row">
       <div class="offset-sm-2 col-sm-10">

data/web/templates/edit/mailbox.twig

@@ -267,7 +267,6 @@
                       <small class="text-muted">{{ lang.admin.password_reset_info }}</small>
                     </div>
                   </div>
-                  {% endif %}
                   <div data-acl="{{ acl.extend_sender_acl }}" class="row mb-4">
                     <label class="control-label col-sm-2" for="extended_sender_acl">{{ lang.edit.extended_sender_acl }}</label>
                     <div class="col-sm-10">
@@ -280,6 +279,7 @@
                       {% endif %}
                     </div>
                   </div>
+                  {% endif %}
                   <div class="row">
                     <label class="control-label col-sm-2" for="protocol_access">{{ lang.edit.allowed_protocols }}</label>
                     <div class="col-sm-10">

data/web/templates/edit/syncjob.twig

@@ -2,7 +2,7 @@
 
 {% block inner_content %}
 {% if result %}
-  <h4 class="mb-4">{{ lang.syncjobs.edit }}</h4>
+  <h4 class="mb-4">{{ lang.edit.syncjob }}</h4>
   <form class="form-horizontal" data-id="editsyncjob" role="form" method="post">
     <input type="hidden" value="0" name="delete2duplicates">
     <input type="hidden" value="0" name="delete1">
@@ -12,147 +12,140 @@
     <input type="hidden" value="0" name="active">
     <input type="hidden" value="0" name="subscribeall">
     <input type="hidden" value="0" name="dry">
-    <div class="row mb-4">
-      <label class="control-label col-sm-2" for="source_id">{{ lang.syncjobs.source }}</label>
+    <div class="row mb-2">
+      <label class="control-label col-sm-2" for="host1">{{ lang.edit.hostname }}</label>
       <div class="col-sm-10">
-        <select class="imapsync-source-select" name="source_id" id="source_id"
-                data-live-search="true"
-                data-current-source-id="{{ result.source_id }}"
-                data-current-source-auth-type="{{ result.source_auth_type }}" required>
-          <option value="{{ result.source_id }}" data-auth-type="{{ result.source_auth_type }}" data-oauth-flow="{{ result.source_oauth_flow }}" selected>{{ result.source_name }} ({{ result.source_host }}:{{ result.source_port }} / {{ result.source_auth_type }})</option>
-        </select>
+        <input type="text" class="form-control" name="host1" id="host1" value="{{ result.host1 }}">
       </div>
     </div>
-    <div class="row mb-2 imapsync-user1-row" style="display:{% if result.source_oauth_flow == 'authorization_code' %}none{% else %}flex{% endif %};">
+    <div class="row mb-4">
+      <label class="control-label col-sm-2" for="port1">Port</label>
+      <div class="col-sm-10">
+        <input type="number" class="form-control" name="port1" id="port1" min="1" max="65535" value="{{ result.port1 }}">
+      </div>
+    </div>
+    <div class="row mb-2">
       <label class="control-label col-sm-2" for="user1">{{ lang.edit.username }}</label>
       <div class="col-sm-10">
         <input type="text" class="form-control" name="user1" id="user1" value="{{ result.user1 }}">
       </div>
     </div>
-    <div class="row mb-2 imapsync-oauth-connect-row" style="display:{% if result.source_oauth_flow == 'authorization_code' %}flex{% else %}none{% endif %};">
-      <div class="offset-sm-2 col-sm-10">
-        <button type="button" class="btn btn-sm btn-primary imapsync-oauth-connect-btn">{{ lang.syncjobs.syncjob_oauth_connect }}</button>
-        <span class="imapsync-oauth-connect-status ms-2"></span>
-      </div>
-    </div>
-    <div class="row mb-4 password1-row" style="display:{% if result.source_auth_type == 'XOAUTH2' %}none{% else %}flex{% endif %};">
+    <div class="row mb-4">
       <label class="control-label col-sm-2" for="password1">{{ lang.edit.password }}</label>
       <div class="col-sm-10">
         <input type="password" class="form-control" name="password1" id="password1" value="{{ result.password1 }}">
       </div>
     </div>
     <div class="row mb-2">
-      <label class="control-label col-sm-2" for="mins_interval">{{ lang.syncjobs.mins_interval }}</label>
+      <label class="control-label col-sm-2" for="enc1">{{ lang.edit.encryption }}</label>
+      <div class="col-sm-10">
+        <select id="enc1" name="enc1">
+          <option value="SSL"{% if result.enc1 == 'SSL' %} selected{% endif %}>SSL</option>
+          <option value="TLS"{% if result.enc1 == 'TLS' %} selected{% endif %}>STARTTLS</option>
+          <option value="PLAIN"{% if result.enc1 == 'PLAIN' %} selected{% endif %}>PLAIN</option>
+        </select>
+      </div>
+    </div>
+    <div class="row mb-2">
+      <label class="control-label col-sm-2" for="mins_interval">{{ lang.edit.mins_interval }}</label>
       <div class="col-sm-10">
         <input type="number" class="form-control" name="mins_interval" min="1" max="43800" value="{{ result.mins_interval }}" required>
         <small class="text-muted">1-43800</small>
       </div>
     </div>
-    {% if mailcow_cc_role == 'admin' %}
     <div class="row mb-2">
-      <label class="control-label col-sm-2" for="prio">{{ lang.syncjobs.prio }}</label>
-      <div class="col-sm-10">
-        <input type="number" class="form-control" name="prio" id="prio" min="0" value="{{ result.prio }}">
-        <small class="text-muted">{{ lang.syncjobs.prio_hint }}</small>
-      </div>
-    </div>
-    {% endif %}
-    <div class="row mb-2">
-      <label class="control-label col-sm-2" for="subfolder2">{{ lang.syncjobs.subfolder2|raw }}</label>
+      <label class="control-label col-sm-2" for="subfolder2">{{ lang.edit.subfolder2|raw }}</label>
       <div class="col-sm-10">
         <input type="text" class="form-control" name="subfolder2" id="subfolder2" value="{{ result.subfolder2 }}">
       </div>
     </div>
     <div class="row mb-2">
-      <label class="control-label col-sm-2" for="maxage">{{ lang.syncjobs.maxage|raw }}</label>
+      <label class="control-label col-sm-2" for="maxage">{{ lang.edit.maxage|raw }}</label>
       <div class="col-sm-10">
         <input type="number" class="form-control" name="maxage" id="maxage" min="0" max="32000" value="{{ result.maxage }}">
         <small class="text-muted">0-32000</small>
       </div>
     </div>
     <div class="row mb-2">
-      <label class="control-label col-sm-2" for="maxbytespersecond">{{ lang.syncjobs.maxbytespersecond|raw }}</label>
+      <label class="control-label col-sm-2" for="maxbytespersecond">{{ lang.edit.maxbytespersecond|raw }}</label>
       <div class="col-sm-10">
         <input type="number" class="form-control" name="maxbytespersecond" id="maxbytespersecond" min="0" max="125000000" value="{{ result.maxbytespersecond }}">
         <small class="text-muted">0-125000000</small>
       </div>
     </div>
     <div class="row mb-2">
-      <label class="control-label col-sm-2" for="timeout1">{{ lang.syncjobs.timeout1 }}</label>
+      <label class="control-label col-sm-2" for="timeout1">{{ lang.add.timeout1 }}</label>
       <div class="col-sm-10">
         <input type="number" class="form-control" name="timeout1" id="timeout1" min="1" max="32000" value="{{ result.timeout1 }}">
         <small class="text-muted">1-32000</small>
       </div>
     </div>
     <div class="row mb-2">
-      <label class="control-label col-sm-2" for="timeout2">{{ lang.syncjobs.timeout2 }}</label>
+      <label class="control-label col-sm-2" for="timeout2">{{ lang.add.timeout2 }}</label>
       <div class="col-sm-10">
         <input type="number" class="form-control" name="timeout2" id="timeout2" min="1" max="32000" value="{{ result.timeout2 }}">
         <small class="text-muted">1-32000</small>
       </div>
     </div>
     <div class="row mb-2">
-      <label class="control-label col-sm-2" for="exclude">{{ lang.syncjobs.exclude }}</label>
+      <label class="control-label col-sm-2" for="exclude">{{ lang.edit.exclude }}</label>
       <div class="col-sm-10">
         <input type="text" class="form-control" name="exclude" id="exclude" value="{{ result.exclude }}">
       </div>
     </div>
     <div class="row mb-4">
-      <label class="control-label col-sm-2">{{ lang.syncjobs.custom_params }}</label>
+      <label class="control-label col-sm-2" for="custom_params">{{ lang.add.custom_params }}</label>
       <div class="col-sm-10">
-        <div class="imapsync-cp-editor">
-          <div class="imapsync-cp-rows"></div>
-          <button type="button" class="btn btn-sm btn-secondary imapsync-cp-add"><i class="bi bi-plus-lg"></i> {{ lang.syncjobs.custom_param_add }}</button>
-        </div>
-        <input type="hidden" name="custom_params" class="imapsync-cp-value" value="{{ result.custom_params }}">
+        <input type="text" class="form-control" name="custom_params" id="custom_params" value="{{ result.custom_params }}" placeholder="--some-param=xy --other-param=yx">
+        <small class="text-muted">{{ lang.add.custom_params_hint }}</small>
       </div>
     </div>
     <div class="row mb-2">
       <div class="offset-sm-2 col-sm-10">
         <div class="form-check">
-          <label><input type="checkbox" class="form-check-input" value="1" name="delete2duplicates"{% if result.delete2duplicates == '1' %} checked{% endif %}> {{ lang.syncjobs.delete2duplicates }} (--delete2duplicates)</label>
+          <label><input type="checkbox" class="form-check-input" value="1" name="delete2duplicates"{% if result.delete2duplicates == '1' %} checked{% endif %}> {{ lang.edit.delete2duplicates }} (--delete2duplicates)</label>
         </div>
       </div>
     </div>
     <div class="row mb-2">
       <div class="offset-sm-2 col-sm-10">
         <div class="form-check">
-          <label><input type="checkbox" class="form-check-input" value="1" name="delete1"{% if result.delete1 == '1' %} checked{% endif %}> {{ lang.syncjobs.delete1 }} (--delete1)</label>
+          <label><input type="checkbox" class="form-check-input" value="1" name="delete1"{% if result.delete1 == '1' %} checked{% endif %}> {{ lang.edit.delete1 }} (--delete1)</label>
         </div>
       </div>
     </div>
     <div class="row mb-2">
       <div class="offset-sm-2 col-sm-10">
         <div class="form-check">
-          <label><input type="checkbox" class="form-check-input" value="1" name="delete2"{% if result.delete2 == '1' %} checked{% endif %}> {{ lang.syncjobs.delete2 }} (--delete2)</label>
+          <label><input type="checkbox" class="form-check-input" value="1" name="delete2"{% if result.delete2 == '1' %} checked{% endif %}> {{ lang.edit.delete2 }} (--delete2)</label>
         </div>
       </div>
     </div>
     <div class="row mb-2">
       <div class="offset-sm-2 col-sm-10">
         <div class="form-check">
-          <label><input type="checkbox" class="form-check-input" value="1" name="automap"{% if result.automap == '1' %} checked{% endif %}> {{ lang.syncjobs.automap }} (--automap)</label>
+          <label><input type="checkbox" class="form-check-input" value="1" name="automap"{% if result.automap == '1' %} checked{% endif %}> {{ lang.edit.automap }} (--automap)</label>
         </div>
       </div>
     </div>
     <div class="row mb-2">
       <div class="offset-sm-2 col-sm-10">
         <div class="form-check">
-          <label><input type="checkbox" class="form-check-input" value="1" name="skipcrossduplicates"{% if result.skipcrossduplicates == '1' %} checked{% endif %}> {{ lang.syncjobs.skipcrossduplicates }} (--skipcrossduplicates)</label>
+          <label><input type="checkbox" class="form-check-input" value="1" name="skipcrossduplicates"{% if result.skipcrossduplicates == '1' %} checked{% endif %}> {{ lang.edit.skipcrossduplicates }} (--skipcrossduplicates)</label>
         </div>
       </div>
     </div>
     <div class="row mb-2">
       <div class="offset-sm-2 col-sm-10">
         <div class="form-check">
-          <label><input type="checkbox" class="form-check-input" value="1" name="subscribeall"{% if result.subscribeall == '1' %} checked{% endif %}> {{ lang.syncjobs.subscribeall }} (--subscribeall)</label>
+          <label><input type="checkbox" class="form-check-input" value="1" name="subscribeall"{% if result.subscribeall == '1' %} checked{% endif %}> {{ lang.add.subscribeall }} (--subscribeall)</label>
         </div>
       </div>
     </div>
     <div class="row mb-2">
       <div class="offset-sm-2 col-sm-10">
         <div class="form-check">
-          <label><input type="checkbox" class="form-check-input" value="1" name="dry"{% if result.dry == '1' %} checked{% endif %}> {{ lang.syncjobs.dry }} (--dry)</label>
+          <label><input type="checkbox" class="form-check-input" value="1" name="dry"{% if result.dry == '1' %} checked{% endif %}> {{ lang.add.dry }} (--dry)</label>
         </div>
       </div>
     </div>

data/web/templates/mailbox.twig

@@ -33,7 +33,7 @@
         <li role="presentation"><button class="dropdown-item" aria-selected="false" aria-controls="tab-domain-aliases" role="tab" data-bs-toggle="tab" data-bs-target="#tab-domain-aliases">{{ lang.mailbox.domain_aliases }}</button></li>
       </ul>
     </li>
-    <li class="nav-item" role="presentation"><button class="nav-link" aria-selected="false" aria-controls="tab-syncjobs" role="tab" data-bs-toggle="tab" data-bs-target="#tab-syncjobs">{{ lang.syncjobs.sync_jobs }}</button></li>
+    <li class="nav-item" role="presentation"><button class="nav-link" aria-selected="false" aria-controls="tab-syncjobs" role="tab" data-bs-toggle="tab" data-bs-target="#tab-syncjobs">{{ lang.mailbox.sync_jobs }}</button></li>
     <li class="nav-item" role="presentation"><button class="nav-link" aria-selected="false" aria-controls="tab-filters" role="tab" data-bs-toggle="tab" data-bs-target="#tab-filters">{{ lang.mailbox.filters }}</button></li>
     <li class="nav-item" role="presentation"><button class="nav-link" aria-selected="false" aria-controls="tab-bcc" role="tab" data-bs-toggle="tab" data-bs-target="#tab-bcc">{{ lang.mailbox.address_rewriting }}</button></li>
     <li class="nav-item" role="presentation"{% if mailcow_cc_role != 'admin' %} class="d-none"{% endif %}><button class="nav-link" aria-selected="false" aria-controls="tab-tls-policy" role="tab" data-bs-toggle="tab" data-bs-target="#tab-tls-policy">{{ lang.mailbox.tls_policy_maps }}</button></li>
@@ -67,7 +67,6 @@
 <script type='text/javascript'>
   var acl = '{{ acl_json|raw }}';
   var lang = {{ lang_mailbox|raw }};
-  lang.syncjobs = {{ lang_syncjobs|raw }};
   var lang_rl = {{ lang_rl|raw }};
   var lang_edit = {{ lang_edit|raw }};
   var lang_datatables = {{ lang_datatables|raw }};

data/web/templates/mailbox/tab-syncjobs.twig

@@ -1,35 +1,10 @@
 <div class="tab-pane fade" id="tab-syncjobs"  role="tabpanel" aria-labelledby="tab-syncjobs">
-  <div class="card mb-4">
-    <div class="card-header d-flex fs-5">
-      <button class="btn d-md-none flex-grow-1 text-start" data-bs-target="#collapse-tab-imapsync-sources" data-bs-toggle="collapse" aria-controls="collapse-tab-imapsync-sources">
-        {{ lang.syncjobs.sources_panel }} <span class="badge bg-info table-lines"></span>
-      </button>
-      <span class="d-none d-md-block">{{ lang.syncjobs.sources_panel }} <span class="badge bg-info table-lines"></span></span>
-      <div class="btn-group ms-auto d-flex">
-        <button class="btn btn-xs btn-secondary refresh_table" data-draw="draw_imapsync_source_table" data-table="imapsync_source_table">{{ lang.admin.refresh }}</button>
-      </div>
-    </div>
-    <div id="collapse-tab-imapsync-sources" class="card-body collapse" data-bs-parent="#mail-content">
-      <p class="text-muted">{{ lang.syncjobs.sources_hint }}</p>
-      <div class="mass-actions-mailbox mb-4 d-none d-sm-block">
-        <div class="btn-group" data-acl="{{ acl.syncjobs }}">
-          <a class="btn btn-sm btn-success" href="#" data-bs-toggle="modal" data-bs-target="#addImapsyncSourceModal"><i class="bi bi-plus-lg"></i> {{ lang.syncjobs.source_add }}</a>
-        </div>
-      </div>
-      <table id="imapsync_source_table" class="table table-striped dt-responsive w-100"></table>
-      <div class="mass-actions-mailbox mt-4">
-        <div class="btn-group" data-acl="{{ acl.syncjobs }}">
-          <a class="btn btn-sm btn-xs-lg btn-success" href="#" data-bs-toggle="modal" data-bs-target="#addImapsyncSourceModal"><i class="bi bi-plus-lg"></i> {{ lang.syncjobs.source_add }}</a>
-        </div>
-      </div>
-    </div>
-  </div>
   <div class="card mb-4">
     <div class="card-header d-flex fs-5">
       <button class="btn d-md-none flex-grow-1 text-start" data-bs-target="#collapse-tab-syncjobs" data-bs-toggle="collapse" aria-controls="collapse-tab-syncjobs">
-        {{ lang.syncjobs.sync_jobs }} <span class="badge bg-info table-lines"></span>
+        {{ lang.mailbox.sync_jobs }} <span class="badge bg-info table-lines"></span>
       </button>
-      <span class="d-none d-md-block">{{ lang.syncjobs.sync_jobs }} <span class="badge bg-info table-lines"></span></span>
+      <span class="d-none d-md-block">{{ lang.mailbox.sync_jobs }} <span class="badge bg-info table-lines"></span></span>
 
       <div class="btn-group ms-auto d-flex">
         <button class="btn btn-xs btn-secondary refresh_table" data-draw="draw_sync_job_table" data-table="sync_job_table">{{ lang.admin.refresh }}</button>
@@ -41,7 +16,7 @@
           <a class="btn btn-sm btn-xs-half btn-secondary" id="toggle_multi_select_all" data-id="syncjob" href="#"><i class="bi bi-check-all"></i> {{ lang.mailbox.toggle_all }}</a>
           <a class="btn btn-sm btn-xs-half btn-secondary dropdown-toggle" data-bs-toggle="dropdown" href="#">{{ lang.mailbox.quick_actions }}</a>
           <ul class="dropdown-menu">
-            <li><a class="dropdown-item" data-action="edit_selected" data-id="syncjob" data-api-url='edit/syncjob/run_next' data-api-attr='{}' href="#">{{ lang.mailbox.last_run_reset }}</a></li>
+            <li><a class="dropdown-item" data-action="edit_selected" data-id="syncjob" data-api-url='edit/syncjob' data-api-attr='{"last_run":"","success":""}' href="#">{{ lang.mailbox.last_run_reset }}</a></li>
             <li><hr class="dropdown-divider"></li>
             <li><a class="dropdown-item" data-action="edit_selected" data-id="syncjob" data-api-url='edit/syncjob' data-api-attr='{"active":"1"}' href="#">{{ lang.mailbox.activate }}</a></li>
             <li><a class="dropdown-item" data-action="edit_selected" data-id="syncjob" data-api-url='edit/syncjob' data-api-attr='{"active":"0"}' href="#">{{ lang.mailbox.deactivate }}</a></li>
@@ -51,7 +26,7 @@
             <li class="table_collapse_option"><a class="dropdown-item" data-datatables-expand="sync_job_table">{{ lang.datatables.expand_all }}</a></li>
             <li class="table_collapse_option"><a class="dropdown-item" data-datatables-collapse="sync_job_table">{{ lang.datatables.collapse_all }}</a></li>
           </ul>
-          <a class="btn btn-sm btn-success" href="#" data-bs-toggle="modal" data-bs-target="#addSyncJobModalAdmin"><i class="bi bi-plus-lg"></i> {{ lang.syncjobs.create }}</a>
+          <a class="btn btn-sm btn-success" href="#" data-bs-toggle="modal" data-bs-target="#addSyncJobModalAdmin"><i class="bi bi-plus-lg"></i> {{ lang.user.create_syncjob }}</a>
         </div>
       </div>
       <table id="sync_job_table" class="table table-striped dt-responsive w-100"></table>
@@ -60,7 +35,7 @@
           <a class="btn btn-sm btn-xs-lg btn-xs-half btn-secondary" id="toggle_multi_select_all" data-id="syncjob" href="#"><i class="bi bi-check-all"></i> {{ lang.mailbox.toggle_all }}</a>
           <a class="btn btn-sm btn-xs-lg btn-xs-half btn-secondary dropdown-toggle" data-bs-toggle="dropdown" href="#">{{ lang.mailbox.quick_actions }}</a>
           <ul class="dropdown-menu">
-            <li><a class="dropdown-item" data-action="edit_selected" data-id="syncjob" data-api-url='edit/syncjob/run_next' data-api-attr='{}' href="#">{{ lang.mailbox.last_run_reset }}</a></li>
+            <li><a class="dropdown-item" data-action="edit_selected" data-id="syncjob" data-api-url='edit/syncjob' data-api-attr='{"last_run":"","success":""}' href="#">{{ lang.mailbox.last_run_reset }}</a></li>
             <li><hr class="dropdown-divider"></li>
             <li><a class="dropdown-item" data-action="edit_selected" data-id="syncjob" data-api-url='edit/syncjob' data-api-attr='{"active":"1"}' href="#">{{ lang.mailbox.activate }}</a></li>
             <li><a class="dropdown-item" data-action="edit_selected" data-id="syncjob" data-api-url='edit/syncjob' data-api-attr='{"active":"0"}' href="#">{{ lang.mailbox.deactivate }}</a></li>
@@ -70,7 +45,7 @@
             <li class="table_collapse_option"><a class="dropdown-item" data-datatables-expand="sync_job_table">{{ lang.datatables.expand_all }}</a></li>
             <li class="table_collapse_option"><a class="dropdown-item" data-datatables-collapse="sync_job_table">{{ lang.datatables.collapse_all }}</a></li>
           </ul>
-          <a class="btn btn-sm btn-xs-lg btn-success" href="#" data-bs-toggle="modal" data-bs-target="#addSyncJobModalAdmin"><i class="bi bi-plus-lg"></i> {{ lang.syncjobs.create }}</a>
+          <a class="btn btn-sm btn-xs-lg btn-success" href="#" data-bs-toggle="modal" data-bs-target="#addSyncJobModalAdmin"><i class="bi bi-plus-lg"></i> {{ lang.user.create_syncjob }}</a>
         </div>
       </div>
     </div>

data/web/templates/modals/imapsync_source.twig

@@ -1,161 +0,0 @@
-<!-- add imapsync source modal (shared between user and admin views) -->
-<div class="modal fade" id="addImapsyncSourceModal" tabindex="-1" role="dialog" aria-hidden="true">
-  <div class="modal-dialog modal-xl">
-    <div class="modal-content">
-      <div class="modal-header">
-        <h3 class="modal-title">{{ lang.syncjobs.source_add }}</h3>
-        <button type="button" class="btn-close" data-bs-dismiss="modal"></button>
-      </div>
-      <div class="modal-body">
-        <form class="form-horizontal" data-cached-form="true" role="form" data-id="add_imapsync_source">
-          <div class="row mb-2">
-            <label class="control-label col-sm-2" for="name">{{ lang.syncjobs.source_name }}</label>
-            <div class="col-sm-10">
-              <input type="text" class="form-control" name="name" maxlength="100" required>
-            </div>
-          </div>
-          <div class="row mb-2">
-            <label class="control-label col-sm-2" for="description">{{ lang.syncjobs.source_description }}</label>
-            <div class="col-sm-10">
-              <input type="text" class="form-control" name="description" maxlength="255">
-            </div>
-          </div>
-          {% if mailcow_cc_role == 'admin' or mailcow_cc_role == 'domainadmin' %}
-          <div class="row mb-2">
-            <label class="control-label col-sm-2" for="scope">{{ lang.syncjobs.source_scope }}</label>
-            <div class="col-sm-10">
-              <select class="form-control imapsync-source-scope" name="scope">
-                {% if mailcow_cc_role == 'admin' %}
-                <option value="all">{{ lang.syncjobs.source_scope_all }}</option>
-                {% endif %}
-                <option value="domain">{{ lang.syncjobs.source_scope_domain }}</option>
-                <option value="user" selected>{{ lang.syncjobs.source_scope_user }}</option>
-              </select>
-            </div>
-          </div>
-          <div class="row mb-2 imapsync-source-domains-row" style="display:none;">
-            <label class="control-label col-sm-2" for="domains">{{ lang.syncjobs.source_domains }}</label>
-            <div class="col-sm-10">
-              <select class="form-control imapsync-source-domains" name="domains[]" data-live-search="true" title="{{ lang.syncjobs.source_domains }}" multiple></select>
-            </div>
-          </div>
-          <div class="row mb-2 imapsync-source-users-row" style="display:none;">
-            <label class="control-label col-sm-2" for="users">{{ lang.syncjobs.source_users }}</label>
-            <div class="col-sm-10">
-              <select class="form-control imapsync-source-users" name="users[]" data-live-search="true" title="{{ lang.syncjobs.source_users }}" multiple></select>
-            </div>
-          </div>
-          {% endif %}
-          <div class="row mb-2">
-            <label class="control-label col-sm-2" for="host1">{{ lang.add.hostname }}</label>
-            <div class="col-sm-10">
-              <input type="text" class="form-control" name="host1" required>
-            </div>
-          </div>
-          <div class="row mb-2">
-            <label class="control-label col-sm-2" for="port1">{{ lang.add.port }}</label>
-            <div class="col-sm-10">
-              <input type="number" class="form-control" name="port1" min="1" max="65535" value="993" required>
-            </div>
-          </div>
-          <div class="row mb-2">
-            <label class="control-label col-sm-2" for="enc1">{{ lang.add.enc_method }}</label>
-            <div class="col-sm-10">
-              <select name="enc1" title="{{ lang.add.select }}" required>
-                <option value="SSL" selected>SSL</option>
-                <option value="TLS">STARTTLS</option>
-                <option value="PLAIN">PLAIN</option>
-              </select>
-            </div>
-          </div>
-          <div class="row mb-4">
-            <label class="control-label col-sm-2" for="auth_type">{{ lang.syncjobs.source_auth_type }}</label>
-            <div class="col-sm-10">
-              <select class="form-control imapsync-source-auth-type" name="auth_type" required>
-                <option value="PLAIN" selected>PLAIN</option>
-                <option value="LOGIN">LOGIN</option>
-                <option value="CRAM-MD5">CRAM-MD5</option>
-                <option value="XOAUTH2">XOAUTH2 (OAuth2)</option>
-              </select>
-            </div>
-          </div>
-          <fieldset class="imapsync-source-oauth-block" style="display:none;">
-            <legend class="fs-5">{{ lang.syncjobs.source_oauth_block }}</legend>
-            <div class="row mb-2">
-              <label class="control-label col-sm-2" for="oauth_flow">{{ lang.syncjobs.source_oauth_flow }}</label>
-              <div class="col-sm-10">
-                <select class="form-control imapsync-source-oauth-flow" name="oauth_flow">
-                  <option value="client_credentials" selected>{{ lang.syncjobs.source_oauth_flow_app }}</option>
-                  <option value="authorization_code">{{ lang.syncjobs.source_oauth_flow_user }}</option>
-                </select>
-              </div>
-            </div>
-            <div class="row mb-2">
-              <label class="control-label col-sm-2" for="oauth_token_endpoint">Token-Endpoint</label>
-              <div class="col-sm-10">
-                <input type="url" class="form-control" name="oauth_token_endpoint" placeholder="https://provider.example.com/oauth2/token">
-              </div>
-            </div>
-            <div class="imapsync-source-authcode-block" style="display:none;">
-              <div class="row mb-2">
-                <label class="control-label col-sm-2" for="oauth_authorize_endpoint">{{ lang.syncjobs.source_authorize_endpoint }}</label>
-                <div class="col-sm-10">
-                  <input type="url" class="form-control" name="oauth_authorize_endpoint" placeholder="https://provider.example.com/oauth2/authorize">
-                </div>
-              </div>
-              <div class="row mb-2">
-                <label class="control-label col-sm-2" for="oauth_userinfo_endpoint">{{ lang.syncjobs.source_userinfo_endpoint }}</label>
-                <div class="col-sm-10">
-                  <input type="url" class="form-control" name="oauth_userinfo_endpoint" placeholder="https://provider.example.com/oauth2/userinfo">
-                </div>
-              </div>
-              <div class="row mb-2">
-                <label class="control-label col-sm-2">{{ lang.syncjobs.source_redirect_uri }}</label>
-                <div class="col-sm-10">
-                  <input type="text" class="form-control imapsync-source-redirect-uri" readonly value="">
-                  <small class="text-muted">{{ lang.syncjobs.source_redirect_uri_hint }}</small>
-                </div>
-              </div>
-            </div>
-            <div class="row mb-2">
-              <label class="control-label col-sm-2" for="oauth_client_id">Client-ID</label>
-              <div class="col-sm-10">
-                <input type="text" class="form-control" name="oauth_client_id">
-              </div>
-            </div>
-            <div class="row mb-2">
-              <label class="control-label col-sm-2" for="oauth_client_secret">Client-Secret</label>
-              <div class="col-sm-10">
-                <input type="password" class="form-control" name="oauth_client_secret">
-              </div>
-            </div>
-            <div class="row mb-2">
-              <label class="control-label col-sm-2" for="oauth_scope">Scope</label>
-              <div class="col-sm-10">
-                <input type="text" class="form-control" name="oauth_scope" placeholder="openid email offline_access">
-              </div>
-            </div>
-            <div class="row mb-4">
-              <label class="control-label col-sm-2" for="oauth_extra_params">Extra-Params (JSON)</label>
-              <div class="col-sm-10">
-                <input type="text" class="form-control" name="oauth_extra_params" placeholder='{"resource":"https://provider.example.com"}'>
-              </div>
-            </div>
-          </fieldset>
-          <div class="row mb-4">
-            <div class="offset-sm-2 col-sm-10">
-              <div class="form-check">
-                <label><input type="checkbox" class="form-check-input" value="1" name="active" checked> {{ lang.add.active }}</label>
-              </div>
-            </div>
-          </div>
-          <div class="row mb-2">
-            <div class="offset-sm-2 col-sm-10">
-              <button class="btn btn-xs-lg d-block d-sm-inline btn-success" data-action="add_item" data-id="add_imapsync_source" data-api-url='add/syncjob_source' data-api-attr='{}' href="#">{{ lang.admin.add }}</button>
-            </div>
-          </div>
-        </form>
-      </div>
-    </div>
-  </div>
-</div>

data/web/templates/modals/mailbox.twig

@@ -937,11 +937,11 @@
   <div class="modal-dialog modal-xl">
     <div class="modal-content">
       <div class="modal-header">
-        <h3 class="modal-title">{{ lang.syncjobs.add }}</h3>
+        <h3 class="modal-title">{{ lang.add.syncjob }}</h3>
         <button type="button" class="btn-close" data-bs-dismiss="modal"></button>
       </div>
       <div class="modal-body">
-        <p class="text-muted">{{ lang.syncjobs.add_hint }}</p>
+        <p class="text-muted">{{ lang.add.syncjob_hint }}</p>
         <form class="form-horizontal" data-cached-form="false" role="form" data-id="add_syncjob">
           <div class="row mb-2">
             <label class="control-label col-sm-2 text-sm-end" for="username">{{ lang.add.username }}</label>
@@ -954,134 +954,140 @@
             </div>
           </div>
           <div class="row mb-2">
-            <label class="control-label col-sm-2 text-sm-end" for="source_id">{{ lang.syncjobs.source_select }}</label>
+            <label class="control-label col-sm-2 text-sm-end" for="host1">{{ lang.add.hostname }}</label>
             <div class="col-sm-10">
-              <select class="imapsync-source-select" data-live-search="true" name="source_id" title="{{ lang.syncjobs.source_select }}" required>
-                {# options are loaded via the API on modal open (populateImapsyncSourceSelects) #}
-              </select>
+              <input type="text" class="form-control" name="host1" required>
             </div>
           </div>
-          <div class="row mb-2 imapsync-user1-row">
+          <div class="row mb-2">
+            <label class="control-label col-sm-2 text-sm-end" for="port1">{{ lang.add.port }}</label>
+            <div class="col-sm-10">
+              <input type="number" class="form-control" name="port1" min="1" max="65535" value="143" required>
+              <small class="text-muted">1-65535</small>
+            </div>
+          </div>
+          <div class="row mb-2">
             <label class="control-label col-sm-2 text-sm-end" for="user1">{{ lang.add.username }}</label>
             <div class="col-sm-10">
               <input type="text" class="form-control" name="user1" required>
             </div>
           </div>
-          <div class="row mb-2 imapsync-oauth-connect-row" style="display:none;">
-            <div class="offset-sm-2 col-sm-10">
-              <button type="button" class="btn btn-sm btn-primary imapsync-oauth-connect-btn">{{ lang.syncjobs.syncjob_oauth_connect }}</button>
-              <span class="imapsync-oauth-connect-status ms-2"></span>
-            </div>
-          </div>
-          <div class="row mb-2 password1-row">
+          <div class="row mb-2">
             <label class="control-label col-sm-2 text-sm-end" for="password1">{{ lang.add.password }}</label>
             <div class="col-sm-10">
-              <input type="password" class="form-control" name="password1">
+              <input type="password" class="form-control" name="password1" required>
             </div>
           </div>
           <div class="row mb-2">
-            <label class="control-label col-sm-2 text-sm-end" for="mins_interval">{{ lang.syncjobs.mins_interval }}</label>
+            <label class="control-label col-sm-2 text-sm-end" for="enc1">{{ lang.add.enc_method }}</label>
+            <div class="col-sm-10">
+              <select name="enc1" title="{{ lang.add.select }}" required>
+                <option value="SSL" selected>SSL</option>
+                <option value="TLS">STARTTLS</option>
+                <option value="PLAIN">PLAIN</option>
+              </select>
+            </div>
+          </div>
+          <div class="row mb-2">
+            <label class="control-label col-sm-2 text-sm-end" for="mins_interval">{{ lang.add.mins_interval }}</label>
             <div class="col-sm-10">
               <input type="number" class="form-control" name="mins_interval" min="1" max="43800" value="20" required>
               <small class="text-muted">1-43800</small>
             </div>
           </div>
           <div class="row mb-2">
-            <label class="control-label col-sm-2 text-sm-end" for="subfolder2">{{ lang.syncjobs.subfolder2|raw }}</label>
+            <label class="control-label col-sm-2 text-sm-end" for="subfolder2">{{ lang.edit.subfolder2|raw }}</label>
             <div class="col-sm-10">
               <input type="text" class="form-control" name="subfolder2" value="">
             </div>
           </div>
           <div class="row mb-2">
-            <label class="control-label col-sm-2 text-sm-end" for="maxage">{{ lang.syncjobs.maxage|raw }}</label>
+            <label class="control-label col-sm-2 text-sm-end" for="maxage">{{ lang.edit.maxage|raw }}</label>
             <div class="col-sm-10">
               <input type="number" class="form-control" name="maxage" min="0" max="32000" value="0">
               <small class="text-muted">0-32000</small>
             </div>
           </div>
           <div class="row mb-2">
-            <label class="control-label col-sm-2 text-sm-end" for="maxbytespersecond">{{ lang.syncjobs.maxbytespersecond|raw }}</label>
+            <label class="control-label col-sm-2 text-sm-end" for="maxbytespersecond">{{ lang.edit.maxbytespersecond|raw }}</label>
             <div class="col-sm-10">
               <input type="number" class="form-control" name="maxbytespersecond" min="0" max="125000000" value="0">
               <small class="text-muted">0-125000000</small>
             </div>
           </div>
           <div class="row mb-2">
-            <label class="control-label col-sm-2 text-sm-end" for="timeout1">{{ lang.syncjobs.timeout1 }}</label>
+            <label class="control-label col-sm-2 text-sm-end" for="timeout1">{{ lang.edit.timeout1 }}</label>
             <div class="col-sm-10">
               <input type="number" class="form-control" name="timeout1" min="1" max="32000" value="600">
               <small class="text-muted">1-32000</small>
             </div>
           </div>
           <div class="row mb-2">
-            <label class="control-label col-sm-2 text-sm-end" for="timeout2">{{ lang.syncjobs.timeout2 }}</label>
+            <label class="control-label col-sm-2 text-sm-end" for="timeout2">{{ lang.edit.timeout2 }}</label>
             <div class="col-sm-10">
               <input type="number" class="form-control" name="timeout2" min="1" max="32000" value="600">
               <small class="text-muted">1-32000</small>
             </div>
           </div>
           <div class="row mb-2">
-            <label class="control-label col-sm-2 text-sm-end" for="exclude">{{ lang.syncjobs.exclude }}</label>
+            <label class="control-label col-sm-2 text-sm-end" for="exclude">{{ lang.add.exclude }}</label>
             <div class="col-sm-10">
               <input type="text" class="form-control" name="exclude" value="(?i)spam|(?i)junk">
             </div>
           </div>
           <div class="row mb-4">
-            <label class="control-label col-sm-2 text-sm-end">{{ lang.syncjobs.custom_params }}</label>
+            <label class="control-label col-sm-2 text-sm-end" for="custom_params">{{ lang.add.custom_params }}</label>
             <div class="col-sm-10">
-              <div class="imapsync-cp-editor">
-                <div class="imapsync-cp-rows"></div>
-                <button type="button" class="btn btn-sm btn-secondary imapsync-cp-add"><i class="bi bi-plus-lg"></i> {{ lang.syncjobs.custom_param_add }}</button>
-              </div>
-              <input type="hidden" name="custom_params" class="imapsync-cp-value" value="">
+              <input type="text" class="form-control" name="custom_params" placeholder="--some-param=xy --other-param=yx">
+              <small class="text-muted">{{ lang.add.custom_params_hint }}</small>
             </div>
           </div>
           <div class="row mb-2">
             <div class="offset-sm-2 col-sm-10">
               <div class="form-check">
-                <label><input type="checkbox" class="form-check-input" value="1" name="delete2duplicates" checked> {{ lang.syncjobs.delete2duplicates }} (--delete2duplicates)</label>
+                <label><input type="checkbox" class="form-check-input" value="1" name="delete2duplicates" checked> {{ lang.add.delete2duplicates }} (--delete2duplicates)</label>
               </div>
             </div>
           </div>
           <div class="row mb-2">
             <div class="offset-sm-2 col-sm-10">
               <div class="form-check">
-                <label><input type="checkbox" class="form-check-input" value="1" name="delete1"> {{ lang.syncjobs.delete1 }} (--delete1)</label>
+                <label><input type="checkbox" class="form-check-input" value="1" name="delete1"> {{ lang.add.delete1 }} (--delete1)</label>
               </div>
             </div>
           </div>
           <div class="row mb-2">
             <div class="offset-sm-2 col-sm-10">
               <div class="form-check">
-                <label><input type="checkbox" class="form-check-input" value="1" name="delete2"> {{ lang.syncjobs.delete2 }} (--delete2)</label>
+                <label><input type="checkbox" class="form-check-input" value="1" name="delete2"> {{ lang.add.delete2 }} (--delete2)</label>
               </div>
             </div>
           </div>
           <div class="row mb-2">
             <div class="offset-sm-2 col-sm-10">
               <div class="form-check">
-                <label><input type="checkbox" class="form-check-input" value="1" name="automap" checked> {{ lang.syncjobs.automap }} (--automap)</label>
+                <label><input type="checkbox" class="form-check-input" value="1" name="automap" checked> {{ lang.add.automap }} (--automap)</label>
               </div>
             </div>
           </div>
           <div class="row mb-2">
             <div class="offset-sm-2 col-sm-10">
               <div class="form-check">
-                <label><input type="checkbox" class="form-check-input" value="1" name="skipcrossduplicates"> {{ lang.syncjobs.skipcrossduplicates }} (--skipcrossduplicates)</label>
+                <label><input type="checkbox" class="form-check-input" value="1" name="skipcrossduplicates"> {{ lang.add.skipcrossduplicates }} (--skipcrossduplicates)</label>
               </div>
             </div>
           </div>
           <div class="row mb-2">
             <div class="offset-sm-2 col-sm-10">
               <div class="form-check">
-                <label><input type="checkbox" class="form-check-input" value="1" name="subscribeall" checked> {{ lang.syncjobs.subscribeall }} (--subscribeall)</label>
+                <label><input type="checkbox" class="form-check-input" value="1" name="subscribeall" checked> {{ lang.add.subscribeall }} (--subscribeall)</label>
               </div>
             </div>
           </div>
           <div class="row mb-4">
             <div class="offset-sm-2 col-sm-10">
               <div class="form-check">
-                <label><input type="checkbox" class="form-check-input" value="1" name="dry"> {{ lang.syncjobs.dry }} (--dry)</label>
+                <label><input type="checkbox" class="form-check-input" value="1" name="dry"> {{ lang.add.dry }} (--dry)</label>
               </div>
             </div>
           </div>
@@ -1341,5 +1347,3 @@
     </div>
   </div>
 </div><!-- DNS info modal -->
-
-{% include "modals/imapsync_source.twig" %}

data/web/templates/modals/user.twig

@@ -31,141 +31,146 @@
   <div class="modal-dialog modal-xl">
     <div class="modal-content">
       <div class="modal-header">
-        <h3 class="modal-title">{{ lang.syncjobs.add }}</h3>
+        <h3 class="modal-title">{{ lang.add.syncjob }}</h3>
         <button type="button" class="btn-close" data-bs-dismiss="modal"></button>
       </div>
       <div class="modal-body">
-        <p>{{ lang.syncjobs.add_hint }}</p>
+        <p>{{ lang.add.syncjob_hint }}</p>
         <form class="form-horizontal" data-cached-form="true" role="form" data-id="add_syncjob">
-          <div class="row mb-4">
-            <label class="control-label col-sm-2" for="source_id">{{ lang.syncjobs.source_select }}</label>
+          <div class="row mb-2">
+            <label class="control-label col-sm-2" for="host1">{{ lang.add.hostname }}</label>
             <div class="col-sm-10">
-              <select class="imapsync-source-select" data-live-search="true" name="source_id" title="{{ lang.syncjobs.source_select }}" required>
-                {# options are loaded via the API on modal open (populateImapsyncSourceSelects) #}
-              </select>
+              <input type="text" class="form-control" name="host1" required>
             </div>
           </div>
-          <div class="row mb-2 imapsync-user1-row">
+          <div class="row mb-4">
+            <label class="control-label col-sm-2" for="port1">{{ lang.add.port }}</label>
+            <div class="col-sm-10">
+              <input type="number" class="form-control" name="port1" min="1" max="65535" value="143" required>
+              <small class="text-muted">1-65535</small>
+            </div>
+          </div>
+          <div class="row mb-2">
             <label class="control-label col-sm-2" for="user1">{{ lang.add.username }}</label>
             <div class="col-sm-10">
               <input type="text" class="form-control" name="user1" required>
             </div>
           </div>
-          <div class="row mb-2 imapsync-oauth-connect-row" style="display:none;">
-            <div class="offset-sm-2 col-sm-10">
-              <button type="button" class="btn btn-sm btn-primary imapsync-oauth-connect-btn">{{ lang.syncjobs.syncjob_oauth_connect }}</button>
-              <span class="imapsync-oauth-connect-status ms-2"></span>
-            </div>
-          </div>
-          <div class="row mb-4 password1-row">
+          <div class="row mb-4">
             <label class="control-label col-sm-2" for="password1">{{ lang.add.password }}</label>
             <div class="col-sm-10">
-              <input type="password" class="form-control" name="password1" data-hibp="true">
+              <input type="password" class="form-control" name="password1" data-hibp="true" required>
             </div>
           </div>
           <div class="row mb-2">
-            <label class="control-label col-sm-2" for="mins_interval">{{ lang.syncjobs.mins_interval }}</label>
+            <label class="control-label col-sm-2" for="enc1">{{ lang.add.enc_method }}</label>
+            <div class="col-sm-10">
+              <select name="enc1" title="{{ lang.add.select }}" required>
+                <option value="SSL" selected>SSL</option>
+                <option value="TLS">STARTTLS</option>
+                <option value="PLAIN">PLAIN</option>
+              </select>
+            </div>
+          </div>
+          <div class="row mb-2">
+            <label class="control-label col-sm-2" for="mins_interval">{{ lang.add.mins_interval }}</label>
             <div class="col-sm-10">
               <input type="number" class="form-control" name="mins_interval" min="1" max="43800" value="20" required>
               <small class="text-muted">1-43800</small>
             </div>
           </div>
           <div class="row mb-2">
-            <label class="control-label col-sm-2" for="subfolder2">{{ lang.syncjobs.subfolder2|raw }}</label>
+            <label class="control-label col-sm-2" for="subfolder2">{{ lang.edit.subfolder2|raw }}</label>
             <div class="col-sm-10">
               <input type="text" class="form-control" name="subfolder2" value="">
             </div>
           </div>
           <div class="row mb-2">
-            <label class="control-label col-sm-2" for="maxage">{{ lang.syncjobs.maxage|raw }}</label>
+            <label class="control-label col-sm-2" for="maxage">{{ lang.edit.maxage|raw }}</label>
             <div class="col-sm-10">
               <input type="number" class="form-control" name="maxage" min="0" max="32000" value="0">
               <small class="text-muted">0-32000</small>
             </div>
           </div>
           <div class="row mb-2">
-            <label class="control-label col-sm-2" for="maxbytespersecond">{{ lang.syncjobs.maxbytespersecond|raw }}</label>
+            <label class="control-label col-sm-2" for="maxbytespersecond">{{ lang.edit.maxbytespersecond|raw }}</label>
             <div class="col-sm-10">
               <input type="number" class="form-control" name="maxbytespersecond" min="0" max="125000000" value="0">
               <small class="text-muted">0-125000000</small>
             </div>
           </div>
           <div class="row mb-2">
-            <label class="control-label col-sm-2" for="timeout1">{{ lang.syncjobs.timeout1 }}</label>
+            <label class="control-label col-sm-2" for="timeout1">{{ lang.edit.timeout1 }}</label>
             <div class="col-sm-10">
               <input type="number" class="form-control" name="timeout1" min="1" max="32000" value="600">
               <small class="text-muted">1-32000</small>
             </div>
           </div>
           <div class="row mb-2">
-            <label class="control-label col-sm-2" for="timeout2">{{ lang.syncjobs.timeout2 }}</label>
+            <label class="control-label col-sm-2" for="timeout2">{{ lang.edit.timeout2 }}</label>
             <div class="col-sm-10">
               <input type="number" class="form-control" name="timeout2" min="1" max="32000" value="600">
               <small class="text-muted">1-32000</small>
             </div>
           </div>
           <div class="row mb-2">
-            <label class="control-label col-sm-2" for="exclude">{{ lang.syncjobs.exclude }}</label>
+            <label class="control-label col-sm-2" for="exclude">{{ lang.add.exclude }}</label>
             <div class="col-sm-10">
               <input type="text" class="form-control" name="exclude" value="(?i)spam|(?i)junk">
             </div>
           </div>
           <div class="row mb-4">
-            <label class="control-label col-sm-2">{{ lang.syncjobs.custom_params }}</label>
+            <label class="control-label col-sm-2" for="custom_params">{{ lang.add.custom_params }}</label>
             <div class="col-sm-10">
-              <div class="imapsync-cp-editor">
-                <div class="imapsync-cp-rows"></div>
-                <button type="button" class="btn btn-sm btn-secondary imapsync-cp-add"><i class="bi bi-plus-lg"></i> {{ lang.syncjobs.custom_param_add }}</button>
-              </div>
-              <input type="hidden" name="custom_params" class="imapsync-cp-value" value="">
+              <input type="text" class="form-control" name="custom_params" placeholder="--delete2folders --otheroption">
             </div>
           </div>
           <div class="row mb-2">
             <div class="offset-sm-2 col-sm-10">
               <div class="form-check">
-                <label><input type="checkbox" class="form-check-input" value="1" name="delete2duplicates" checked> {{ lang.syncjobs.delete2duplicates }} (--delete2duplicates)</label>
+                <label><input type="checkbox" class="form-check-input" value="1" name="delete2duplicates" checked> {{ lang.add.delete2duplicates }} (--delete2duplicates)</label>
               </div>
             </div>
           </div>
           <div class="row mb-2">
             <div class="offset-sm-2 col-sm-10">
               <div class="form-check">
-                <label><input type="checkbox" class="form-check-input" value="1" name="delete1"> {{ lang.syncjobs.delete1 }} (--delete1)</label>
+                <label><input type="checkbox" class="form-check-input" value="1" name="delete1"> {{ lang.add.delete1 }} (--delete1)</label>
               </div>
             </div>
           </div>
           <div class="row mb-2">
             <div class="offset-sm-2 col-sm-10">
               <div class="form-check">
-                <label><input type="checkbox" class="form-check-input" value="1" name="delete2"> {{ lang.syncjobs.delete2 }} (--delete2)</label>
+                <label><input type="checkbox" class="form-check-input" value="1" name="delete2"> {{ lang.add.delete2 }} (--delete2)</label>
               </div>
             </div>
           </div>
           <div class="row mb-2">
             <div class="offset-sm-2 col-sm-10">
               <div class="form-check">
-                <label><input type="checkbox" class="form-check-input" value="1" name="automap" checked> {{ lang.syncjobs.automap }} (--automap)</label>
+                <label><input type="checkbox" class="form-check-input" value="1" name="automap" checked> {{ lang.add.automap }} (--automap)</label>
               </div>
             </div>
           </div>
           <div class="row mb-2">
             <div class="offset-sm-2 col-sm-10">
               <div class="form-check">
-                <label><input type="checkbox" class="form-check-input" value="1" name="skipcrossduplicates"> {{ lang.syncjobs.skipcrossduplicates }} (--skipcrossduplicates)</label>
+                <label><input type="checkbox" class="form-check-input" value="1" name="skipcrossduplicates"> {{ lang.add.skipcrossduplicates }} (--skipcrossduplicates)</label>
               </div>
             </div>
           </div>
           <div class="row mb-2">
             <div class="offset-sm-2 col-sm-10">
               <div class="form-check">
-                <label><input type="checkbox" class="form-check-input" value="1" name="subscribeall" checked> {{ lang.syncjobs.subscribeall }} (--subscribeall)</label>
+                <label><input type="checkbox" class="form-check-input" value="1" name="subscribeall" checked> {{ lang.add.subscribeall }} (--subscribeall)</label>
               </div>
             </div>
           </div>
           <div class="row mb-2">
             <div class="offset-sm-2 col-sm-10">
               <div class="form-check">
-                <label><input type="checkbox" class="form-check-input" value="1" name="dry" checked> {{ lang.syncjobs.dry }} (--dry)</label>
+                <label><input type="checkbox" class="form-check-input" value="1" name="dry" checked> {{ lang.add.dry }} (--dry)</label>
               </div>
             </div>
           </div>
@@ -186,7 +191,6 @@
     </div>
   </div>
 </div><!-- add sync job modal -->
-{% include 'modals/imapsync_source.twig' %}
 <!-- app passwd modal -->
 <div class="modal fade" id="addAppPasswdModal" tabindex="-1" role="dialog" aria-hidden="true">
   <div class="modal-dialog modal-lg">

data/web/templates/user.twig

@@ -19,7 +19,7 @@
     <li class="nav-item" role="presentation"><button class="nav-link" role="tab" aria-selected="false" aria-controls="Spamfilter" role="tab" data-bs-toggle="tab" data-bs-target="#Spamfilter">{{ lang.user.spamfilter }}</button></li>
     {% endif %}
     {% if acl.syncjobs == 1 %}
-    <li class="nav-item" role="presentation"><button class="nav-link" role="tab" aria-selected="false" aria-controls="Syncjobs" role="tab" data-bs-toggle="tab" data-bs-target="#Syncjobs">{{ lang.syncjobs.sync_jobs }}</button></li>
+    <li class="nav-item" role="presentation"><button class="nav-link" role="tab" aria-selected="false" aria-controls="Syncjobs" role="tab" data-bs-toggle="tab" data-bs-target="#Syncjobs">{{ lang.user.sync_jobs }}</button></li>
     {% endif %}
     {% if acl.app_passwds == 1 %}
     <li class="nav-item" role="presentation"><button class="nav-link" role="tab" aria-selected="false" aria-controls="AppPasswds" role="tab" data-bs-toggle="tab" data-bs-target="#AppPasswds">{{ lang.user.app_passwds }}</button></li>

data/web/templates/user/Syncjobs.twig

@@ -1,29 +1,12 @@
 <div class="tab-pane fade" id="Syncjobs" role="tabpanel" aria-labelledby="Syncjobs">
-  <div class="card mb-4">
-    <div class="card-header d-flex fs-5">
-      <span class="d-none d-md-block">{{ lang.syncjobs.sources_panel }}</span>
-      <button class="btn d-md-none flex-grow-1 text-start" data-bs-target="#collapse-tab-imapsync-sources" data-bs-toggle="collapse" aria-controls="collapse-tab-imapsync-sources">
-        {{ lang.syncjobs.sources_panel }}
-      </button>
-    </div>
-    <div id="collapse-tab-imapsync-sources" class="card-body collapse" data-bs-parent="#user-content">
-      <p class="text-muted">{{ lang.syncjobs.sources_hint }}</p>
-      <div class="mass-actions-user mb-4">
-        <div class="btn-group" data-acl="{{ acl.syncjobs }}">
-          <a class="btn btn-sm d-block d-sm-inline btn-success" href="#" data-bs-toggle="modal" data-bs-target="#addImapsyncSourceModal"><i class="bi bi-plus-lg"></i> {{ lang.syncjobs.source_add }}</a>
-        </div>
-      </div>
-      <table id="imapsync_source_table" class="table table-striped dt-responsive w-100"></table>
-    </div>
-  </div>
   <div class="card mb-4">
     <div class="card-header d-flex fs-5">
       <button class="btn d-md-none flex-grow-1 text-start" data-bs-target="#collapse-tab-Syncjobs" data-bs-toggle="collapse" aria-controls="collapse-tab-Syncjobs">
-        {{ lang.syncjobs.sync_jobs }}
+        {{ lang.user.sync_jobs }}
       </button>
-      <span class="d-none d-md-block">{{ lang.syncjobs.sync_jobs }}</span>
+      <span class="d-none d-md-block">{{ lang.user.sync_jobs }}</span>
     </div>
-    <div id="collapse-tab-Syncjobs" class="card-body collapse" data-bs-parent="#user-content">
+    <div id="collapse-tab-Syncjobs" class="card-body collapse" data-bs-parent="#user-content">      
       <div class="mass-actions-user mb-4">
         <div class="btn-group" data-acl="{{ acl.syncjobs }}">
           <div class="btn-group">
@@ -40,7 +23,7 @@
             </ul>
           </div>
           <div class="btn-group">
-            <a class="btn btn-sm d-block d-sm-inline btn-success" href="#" data-bs-toggle="modal" data-bs-target="#addSyncJobModal"><i class="bi bi-plus-lg"></i> {{ lang.syncjobs.create }}</a>
+            <a class="btn btn-sm d-block d-sm-inline btn-success" href="#" data-bs-toggle="modal" data-bs-target="#addSyncJobModal"><i class="bi bi-plus-lg"></i> {{ lang.user.create_syncjob }}</a>
           </div>
         </div>
       </div>
@@ -61,7 +44,7 @@
             </ul>
           </div>
           <div class="btn-group">
-            <a class="btn btn-sm d-block d-sm-inline btn-success" href="#" data-bs-toggle="modal" data-bs-target="#addSyncJobModal"><i class="bi bi-plus-lg"></i> {{ lang.syncjobs.create }}</a>
+            <a class="btn btn-sm d-block d-sm-inline btn-success" href="#" data-bs-toggle="modal" data-bs-target="#addSyncJobModal"><i class="bi bi-plus-lg"></i> {{ lang.user.create_syncjob }}</a>
           </div>
         </div>
       </div>

data/web/templates/user_domainadmin_common.twig

@@ -3,7 +3,6 @@
 <script type='text/javascript'>
   var acl = '{{ acl_json|raw }}';
   var lang = {{ lang_user|raw }};
-  lang.syncjobs = {{ lang_syncjobs|raw }};
   var csrf_token = '{{ csrf_token }}';
   var pagination_size = Math.trunc('{{ pagination_size }}');
   var mailcow_cc_username = '{{ mailcow_cc_username }}';

data/web/templates/user_index.twig

@@ -56,7 +56,6 @@
             <div class="input-group">
               <div class="input-group-text"><i class="bi bi-lock-fill"></i></div>
               <input name="pass_user" type="password" id="pass_user" class="form-control" placeholder="{{ lang.login.password }}" required="" autocomplete="current-password">
-              <button type="button" class="input-group-text" style="cursor:pointer;" onclick="var i=document.getElementById('pass_user'),ic=this.querySelector('i');if(i.type==='password'){i.type='text';ic.className='bi bi-eye-slash';}else{i.type='password';ic.className='bi bi-eye';}" tabindex="-1" aria-label="Toggle password visibility"><i class="bi bi-eye"></i></button>
             </div>
           </div>
           <div class="mt-2 text-muted" style="font-size: 0.9rem;">

docker-compose.yml

@@ -1,7 +1,7 @@
 services:
 
     unbound-mailcow:
-      image: ghcr.io/mailcow/unbound:1.25.1-1
+      image: ghcr.io/mailcow/unbound:1.25
       environment:
         - TZ=${TZ}
         - SKIP_UNBOUND_HEALTHCHECK=${SKIP_UNBOUND_HEALTHCHECK:-n}
@@ -42,7 +42,7 @@ services:
             - mysql
 
     redis-mailcow:
-      image: redis:7.4.10-alpine
+      image: redis:7.4.6-alpine
       entrypoint: ["/bin/sh","/redis-conf.sh"]
       volumes:
         - redis-vol-1:/data/
@@ -65,7 +65,7 @@ services:
             - redis
 
     clamd-mailcow:
-      image: ghcr.io/mailcow/clamd:1.4.6-1
+      image: ghcr.io/mailcow/clamd:1.71
       restart: always
       depends_on:
         unbound-mailcow:
@@ -84,7 +84,7 @@ services:
             - clamd
 
     rspamd-mailcow:
-      image: ghcr.io/mailcow/rspamd:4.1.4-1
+      image: ghcr.io/mailcow/rspamd:3.14.3-1
       stop_grace_period: 30s
       depends_on:
         - dovecot-mailcow
@@ -117,7 +117,7 @@ services:
             - rspamd
 
     php-fpm-mailcow:
-      image: ghcr.io/mailcow/phpfpm:8.2.29-3
+      image: ghcr.io/mailcow/phpfpm:8.2.29-2
       command: "php-fpm -d date.timezone=${TZ} -d expose_php=0"
       depends_on:
         - redis-mailcow
@@ -194,16 +194,13 @@ services:
         ofelia.job-exec.phpfpm_ldap_sync.schedule: "0 * * * * *"
         ofelia.job-exec.phpfpm_ldap_sync.no-overlap: "true"
         ofelia.job-exec.phpfpm_ldap_sync.command: "/bin/bash -c \"php /crons/ldap-sync.php || exit 0\""
-        ofelia.job-exec.phpfpm_imapsync_oauth_refresh.schedule: "0 * * * * *"
-        ofelia.job-exec.phpfpm_imapsync_oauth_refresh.no-overlap: "true"
-        ofelia.job-exec.phpfpm_imapsync_oauth_refresh.command: "/bin/bash -c \"php /crons/imapsync-oauth-refresh.php || exit 0\""
       networks:
         mailcow-network:
           aliases:
             - phpfpm
 
     sogo-mailcow:
-      image: ghcr.io/mailcow/sogo:5.12.10-1
+      image: ghcr.io/mailcow/sogo:5.12.5-3
       environment:
         - DBNAME=${DBNAME}
         - DBUSER=${DBUSER}
@@ -342,7 +339,7 @@ services:
             - dovecot
 
     postfix-mailcow:
-      image: ghcr.io/mailcow/postfix:3.10.12-1
+      image: ghcr.io/mailcow/postfix:3.7.11-2
       depends_on:
         mysql-mailcow:
           condition: service_started
@@ -385,7 +382,7 @@ services:
             - postfix
 
     postfix-tlspol-mailcow:
-      image: ghcr.io/mailcow/postfix-tlspol:1.11.0
+      image: ghcr.io/mailcow/postfix-tlspol:1.8.23
       depends_on:
         unbound-mailcow:
           condition: service_healthy
@@ -422,7 +419,7 @@ services:
         - php-fpm-mailcow
         - sogo-mailcow
         - rspamd-mailcow
-      image: ghcr.io/mailcow/nginx:1.30.4-1
+      image: ghcr.io/mailcow/nginx:1.06
       dns:
         - ${IPV4_NETWORK:-172.22.1}.254
       environment:
@@ -468,7 +465,7 @@ services:
           condition: service_started
         unbound-mailcow:
           condition: service_healthy
-      image: ghcr.io/mailcow/acme:1.98
+      image: ghcr.io/mailcow/acme:1.97
       dns:
         - ${IPV4_NETWORK:-172.22.1}.254
       environment:

helper-scripts/docker-compose.override.yml.d/EXTERNAL_MYSQL_SOCKET/docker-compose.override.yml

@@ -25,6 +25,6 @@ services:
         - /var/run/mysqld/mysqld.sock:/var/run/mysqld/mysqld.sock
 
     mysql-mailcow:
-      image: alpine:3.24
+      image: alpine:3.23
       command: /bin/true
       restart: "no"